Question:
Why GAO Did This Study

In 2000, Congress authorized the WOSB program, allowing contracting officers to set aside procurements to women-owned small businesses in industries in which they are substantially underrepresented. To be eligible to participate in the WOSB program, firms have the option to self-certify or be certified by a third-party certifier. However, the 2015 NDAA changed the WOSB program by (1) authorizing SBA to implement sole-source authority, (2) eliminating the option for firms to self-certify as being eligible for the program and (3) allowing SBA to implement a new certification process.
GAO was asked to review the WOSB program. This report discusses (1) the extent to which SBA has addressed the 2015 NDAA changes, (2) SBA's efforts to address previously identified deficiencies, and (3) use of the WOSB program. GAO reviewed relevant laws, regulations, and program documents; analyzed federal contracting data from April 2011 through June 2018; and interviewed SBA officials, officials from contracting agencies selected to obtain a range of experience with the WOSB program, and three of the four private third-party certifiers.

What GAO Found

The Small Business Administration (SBA) has implemented one of the three changes to the Women-Owned Small Business (WOSB) program authorized in the National Defense Authorization Act of 2015 (2015 NDAA). Specifically, in September 2015 SBA published a final rule to implement sole-source authority, effective October 2015. As of February 2019, SBA had not eliminated the option for program participants to self-certify that they are eligible to participate, as required by 2015 NDAA. SBA officials stated that this requirement would be addressed as part of the new certification process for the WOSB program, which they expect to implement by January 1, 2020.
SBA has not addressed WOSB program oversight deficiencies identified in GAO's 2014 review (GAO-15-54). For example, GAO previously recommended that SBA establish procedures to assess the performance of four third-party certifiers—private entities approved by SBA to certify the eligibility of WOSB firms. While SBA conducted a compliance review of the certifiers in 2016, it has no plans to regularly monitor them. By not improving its oversight of the WOSB program, SBA is limiting its ability to ensure third-party certifiers are following program requirements. In addition, the implementation of sole-source authority in light of these continued oversight deficiencies can increase program risk. Consequently, GAO maintains that its prior recommendations should be addressed. In addition, similar to previous findings from SBA's Office of Inspector General, GAO found that about 3.5 percent of contracts using a WOSB set-aside were awarded for ineligible goods or services from April 2011 through June 2018. SBA does not review contracting data that could identify this problem and inform SBA which agencies making awards may need targeted outreach or training. As a result, SBA cannot provide reasonable assurance that WOSB program requirements are being met and that the program is meeting its goals.
While federal contract obligations to all women-owned small businesses and WOSB program set-asides have increased since fiscal year 2012, WOSB program set-asides remain a small percentage (see figure).

What GAO Recommends

GAO recommends that SBA develop a process for periodically reviewing the extent to which WOSB program set-asides are awarded for ineligible goods or services and use the results to address identified issues, such as through targeted outreach or training on the WOSB program. SBA agreed with the recommendation.


Question:
Why GAO Did This Study

In 2017, approximately 25.6 million firearm-related background checks were processed through NICS, and about 181,000 of the attempted purchases at the federal and state levels combined were denied because the individual was prohibited from possessing a firearm under federal or state law. Individuals who certify that they are not prohibited from purchasing or receiving a firearm and are subsequently determined to be prohibited could be subject to investigation, and if prosecuted, a fine, imprisonment, or both.
GAO was asked to examine firearms denials. This report (1) describes the extent to which federal and selected state law enforcement agencies investigate and prosecute firearms denial cases; (2) examines related challenges faced by these agencies; and (3) describes the circumstances that lead to investigations and prosecutions. GAO reviewed laws and regulations; analyzed federal and state data from 2011 through 2017; and interviewed officials from ATF headquarters, 6 of 25 ATF field divisions (the 6 that investigated the most cases), and the 13 states that process all NICS checks within their state. Results from state interviews are not generalizable but provide insights on state practices.

What GAO Found

Investigations and prosecutions. Federal and selected state law enforcement agencies that process firearm-related background checks through the National Instant Criminal Background Check System (NICS) collectively investigate and prosecute a small percentage of individuals who falsify information on a firearms form (e.g., do not disclose a felony conviction) and are denied a purchase. Federal NICS checks resulted in about 112,000 denied transactions in fiscal year 2017, of which the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) referred about 12,700 to its field divisions for further investigation. U.S. Attorney's Offices (USAO) had prosecuted 12 of these cases as of June 2018.
At the state level, officials from 10 of 13 selected states said they did not investigate or prosecute firearm denials, some citing competing resource demands and the lack of statutes with which states prosecute as reasons. The remaining 3 states investigated a high proportion of firearms denials. One of the 3 states reported about 1,900 referrals for prosecution in 2017 and about 470 convictions.
Challenges. ATF and selected states reported challenges in investigating and prosecuting firearms denials. Officials from six selected ATF field divisions said that investigating the increasing number of denial cases referred to field divisions—which increased from about 5,200 in fiscal year 2011 to about 12,700 in fiscal year 2017—has been time intensive and required use of their limited resources. ATF policy provides that field divisions may send “warning notices” to denied persons in lieu of prosecution, but ATF has not assessed field divisions' use of these notices, which could provide greater awareness of their deterrence value and inform whether any policy changes are needed. Officials from the Executive Office for United States Attorneys said that prosecuting denial cases can require significant effort and may offer little value to public safety compared to other cases involving gun violence. Selected state officials said that denial investigations can take law enforcement officials away from their core duties. State prosecutors said gathering evidence to prove individuals knew they were prohibited was a challenge.
Types of cases. ATF field divisions investigate denial cases based on USAO criteria and generally only refer cases to USAOs for prosecution when aggravating circumstances exist, such as violent felonies or multiple serious offenses over a short period of time. Officials from two of three selected states refer all denial cases for investigation, while one state uses risk-based criteria for selecting cases that include conditions such as felony convictions and misdemeanor crimes of domestic violence. Prosecutors from these three states said they generally pursue cases that involve indications of violence, though individual prosecutors had differing priorities based on public safety concerns.

What GAO Recommends

GAO recommends that ATF assess the extent to which ATF field divisions use warning notifications as an enforcement tool, which would inform whether changes to policy are needed. DOJ concurred with GAO's recommendation.


Question:
Why GAO Did This Study

This testimony summarizes the information contained in two GAO reports: Broadband Internet: FCC’s Data Overstate Access on Tribal Lands , ( GAO-18-630 ) and Tribal Broadband: Few Partnerships Exist and the Rural Utilities Service Needs to Identify and Address Any Funding Barriers Tribes Face ( GAO-18-682 ). Specifically, it addresses (1) the extent to which FCC’s approach to collecting broadband availability data accurately captures broadband access on tribal lands, (2) the extent to which FCC obtains tribal input on the data, (3) partnerships tribes have formed with entities to deploy broadband infrastructure on tribal lands, and (4) barriers tribes face in obtaining federal funding. For these reports, GAO analyzed FCC and RUS data, and interviewed agency officials as well as a non-generalizable sample of stakeholders representing tribes and broadband providers.

What GAO Found

The Federal Communications Commission’s (FCC) approach to collecting data on broadband availability causes it to overstate broadband access—the ability to obtain service—on tribal lands. In FCC’s approach, broadband is considered to be “available” for an entire census block if the provider could serve at least one location in the census block. FCC, tribal stakeholders, and providers have noted that this approach leads to overstatements of broadband availability. Because FCC uses these data to measure broadband access, it also overstates broadband access on tribal lands. By developing and implementing methods for collecting and reporting accurate and complete data on broadband access specific to tribal lands, FCC would be better able to target federal broadband funding to tribal areas that need it the most.
FCC does not have a formal process to obtain tribal input on the accuracy of provider-submitted broadband data. Most of the tribal stakeholders GAO interviewed stated FCC should work more directly with tribes to improve the accuracy of FCC’s data. Establishing a formal process to obtain input from tribal governments could help improve the accuracy of FCC’s broadband data for tribal lands.
Tribes have formed partnerships with different types of entities to deploy broadband infrastructure on tribal lands, but such partnerships are not widespread. The partnerships GAO identified included private providers, a community access network provider, an electric cooperative, a regional consortium, and tribally owned broadband providers.
GAO reviewed four federal programs to deploy broadband services and found that from 2010 to 2017, less than 1 percent of funding has gone directly to tribes or tribally owned providers. The tribal entities GAO contacted cited barriers to obtaining funds from the Rural Utilities Service (RUS) grant funding, such as preparing network design, demonstrating financial sustainability of the broadband project within 5 years, and obtaining matching funds required to apply for federal grants. However, according to RUS officials, RUS has not taken steps to identify or address the barriers tribes face when applying for RUS grant funding due to limited resources and multiple competing priorities for those resources. By identifying and addressing regulatory barriers that may impede tribal entities’ access to RUS funding, RUS could help tribes obtain funding to expand broadband deployment on tribal lands.

What GAO Recommends

In GAO-18-630 , GAO made three recommendations to FCC, two of which related to improving its collection of broadband data. In GAO-18-682 , GAO made one recommendation to RUS to address regulatory barriers. FCC agreed and RUS neither agreed nor disagreed and both agencies described actions planned to address the recommendations.


Question:
Why GAO Did This Study

Cloud computing enables on-demand access to shared computing resources providing services more quickly and at a lower cost than having agencies maintain these resources themselves. In 2012, OMB began requiring agencies to assess all IT investments for cloud services.
GAO was asked to review agencies' reported use of cloud services. This report discusses selected agencies' progress in implementing cloud services, the extent to which those agencies increased cloud service spending and achieved savings or cost avoidances, and examples of agency-reported cloud investments with notable benefits. GAO selected 16 agencies to review based on their fiscal year 2017 IT budgets and analyzed their use of cloud services, associated spending and savings data, and guidance for assessing investments for these services. GAO interviewed agency officials in charge of cloud services and reviewed pertinent documents to identify acquisitions with notable benefits. GAO also interviewed OMB staff about their agency's role in federal cloud computing and related OMB guidance.

What GAO Found

The 16 agencies GAO reviewed made progress in implementing cloud computing services (cloud services)—namely, they established assessment guidance, performed assessments, and implemented these services—but the extent of their progress varied. To encourage cloud service acquisition, the Office of Management and Budget (OMB) began requiring agencies to assess all information technology (IT) investments for cloud services. However, only 10 of the 16 agencies reviewed had established assessment guidance. In addition, while the agencies assessed the majority of their planned fiscal year 2019 IT investments for cloud services, 12 agencies had not completed an assessment of 10 or more investments. Nevertheless, 10 of the agencies reported increasing their use of cloud services between fiscal years 2016 through 2019 (see figure). Six agencies noted that inconsistent reporting of cloud investments and investment consolidation impacted their reported percentage.
Further, the 16 agencies reported that they had increased their cloud service spending since 2015 and 13 of the 16 agencies had saved $291 million to date from these services. However, these agencies identified issues in tracking and reporting cloud spending and savings data, including not having consistent processes in place to do so. Agencies also noted that OMB guidance did not require them to explicitly report savings from cloud implementations and, therefore, they had to specifically collect this data to meet GAO's request. As a result of these identified issues, it is likely that agency-reported cloud spending and savings figures were underreported.
Officials from 15 of the 16 agencies reported that they had identified significant benefits from acquiring cloud services, including improved customer service and the acquisition of more cost-effective options for managing IT services. In addition, these agencies identified nine cloud investments that, among other things, enhanced the availability of weather-related information, facilitated collaboration and information sharing among federal, state, and local agencies related to homeland security, and provided benefits information to veterans, as examples of systems that realized these benefits. One agency reported that it had not realized benefits because it did not have any completed migration efforts.

What GAO Recommends

GAO is making one recommendation to OMB on cloud savings reporting, and 34 recommendations to the 16 agencies on cloud assessments and savings. Fourteen agencies agreed with all recommendations, OMB and one agency neither agreed nor disagreed, and one (Defense) agreed with one recommendation but not the other. GAO continues to believe its recommendation to the department is appropriate.


Question:
Why GAO Did This Study

DHS is the lead agency tasked with protecting the nation's critical infrastructure from cyber threats. The Homeland Security Cybersecurity Workforce Assessment Act of 2014 required DHS to identify, categorize, and assign employment codes to all of the department's cybersecurity workforce positions. These codes define work roles and tasks for cybersecurity specialty areas such as program management and system administration. Further, the act required DHS to identify and report its cybersecurity workforce critical needs.
GAO was asked to testify on the extent to which DHS has (1) identified, categorized, and assigned employment codes to its cybersecurity positions and (2) identified its cybersecurity workforce areas of critical need. To do so, GAO summarized the findings discussed in its February 2018 report on DHS's cybersecurity workforce ( GAO-18-175 ).

What GAO Found

The Department of Homeland Security (DHS) has taken actions to identify, categorize, and assign employment codes to its cybersecurity positions, as required by the Homeland Security Cybersecurity Workforce Assessment Act of 2014 ; however, its actions have not been timely and complete. For example, DHS did not establish timely and complete procedures to identify, categorize, and code its cybersecurity position vacancies and responsibilities. Further, DHS did not complete efforts to identify all of the department's cybersecurity positions and accurately assign codes to all filled and vacant cybersecurity positions. In August 2017, DHS reported to Congress that it had coded 95 percent of the department's identified cybersecurity positions. However, the department had, at that time, coded approximately 79 percent of the positions. DHS's 95 percent estimate was overstated primarily because it excluded vacant positions, even though the act required DHS to report these positions.
In addition, although DHS has taken steps to identify its workforce capability gaps, it has not identified or reported to Congress on its departmentwide cybersecurity critical needs that align with specialty areas. The department also has not reported annually its cybersecurity critical needs to the Office of Personnel Management (OPM), as required, and has not developed plans with clearly defined time frames for doing so. (See table).
Without ensuring that its procedures are complete and that its progress in identifying and assigning codes to its cybersecurity positions is accurately reported, DHS will not be positioned to effectively examine its cybersecurity workforce, identify critical skill gaps, or improve its workforce planning. Further, until DHS establishes plans and time frames for reporting on its critical needs, the department may not be able to ensure that it has the necessary cybersecurity personnel to help protect the department's and the nation's federal networks and critical infrastructure from cyber threats. The commitment of DHS's leadership to addressing these matters is essential to helping the department fulfill the act's requirements.

What GAO Recommends

In its February 2018 report, GAO recommended that DHS take six actions, including ensuring that its cybersecurity workforce procedures identify position vacancies and responsibilities; reported workforce data are complete and accurate; and plans for reporting on critical needs are developed. DHS concurred with the six recommendations and described actions the department plans to take to address them.


Question:
Why GAO Did This Study

The federal government faces a long- term, unsustainable fiscal path based on an imbalance between federal revenues and spending. While addressing this imbalance will require fiscal policy changes, in the near term opportunities exist in a number of areas to improve this situation, including where federal programs or activities are fragmented, overlapping, or duplicative.
To call attention to these opportunities, Congress included a provision in statute for GAO to identify and report on federal programs, agencies, offices, and initiatives—either within departments or government-wide—that have duplicative goals or activities.
GAO also identifies areas that are fragmented or overlapping and additional opportunities to achieve cost savings or enhance revenue collection. GAO's 2018 annual report is its eighth in this series ( GAO-18-371SP ).
This statement discusses
new areas identified in GAO's 2018 annual report;
the progress made in addressing actions GAO identified in its 2011 to 2017 reports; and
examples of open actions directed to Congress or executive branch agencies.
To identify what actions exist to address these issues, GAO reviewed and updated prior work, including recommendations for executive action and matters for congressional consideration.

What GAO Found

GAO's 2018 annual report identifies 68 new actions that Congress or executive branch agencies can take to improve the efficiency and effectiveness of government in 23 new program areas. For example:
The Department of Defense (DOD) could potentially save approximately
$527 million over 5 years by minimizing unnecessary overlap and duplication in its U.S. distribution centers for troop support goods.
The Department of Energy may be able to reduce certain risks and save tens of billions of dollars by adopting alternative approaches to treat a portion of its low-activity radioactive waste at its Hanford Site.
The Department of Veterans Affairs could potentially save tens of millions of dollars when acquiring medical and surgical supplies by better adhering to supply chain practices of leading hospitals.
The Coast Guard should close its boat stations that provide unnecessarily duplicative search and rescue coverage to improve operations and potentially save millions of dollars .
Significant progress has been made in addressing many of the 724 actions that GAO identified from 2011 to 2017. As of March 2018, Congress and executive branch agencies have fully or partially addressed 551 (76 percent) of these actions. This has resulted in about $178 billion in financial benefits, of which $125 billion has been realized and at least an additional $53 billion is estimated to accrue. These estimates are based on a variety of sources that considered different time periods, assumptions, and methodologies. GAO estimates that tens of billions of additional dollars could be saved should Congress and executive branch agencies fully address the remaining 365 open actions, including the 68 new ones identified in 2018.
Further steps are needed to fully address these remaining actions. For example:
Congress and the Internal Revenue Service could realize hundreds of millions of dollars in savings and increased revenues by enhancing online services and improving efforts to prevent identity theft refund fraud.
Medicare could save $1 to 2 billion annually if Congress equalized the rates paid for certain health care services, which often vary depending on where the service is performed.
DOD could achieve billions of dollars in savings over the next several years by continuing to employ best management practices on its weapon systems acquisition programs.
Congress could consider modifying how Medicare pays certain cancer hospitals to achieve almost $500 million annually in program savings.
The Social Security Administration could help prevent the loss of billions of dollars by preventing overpayments to beneficiaries of the Disability Insurance program and improper waivers of beneficiaries' overpayment debt.
Congress could consider modifying tobacco tax rates to eliminate significant tax differentials between similar products to address future revenue losses caused by manufacturers and consumers substituting tobacco products. Federal losses ranged from $2.6 to 3.7 billion between April 2009 and February 2014.


Question:
Why GAO Did This Study

The effects of climate change, combined with other factors, may alter human migration trends across the globe, according to the International Organization for Migration. For example, climate change can increase the frequency and intensity of natural disasters, causing populations to move from an area. Climate change can also intensify slow-onset disasters, such as drought, crop failure, or sea level rise, potentially altering longer-term migration trends.
GAO was asked to review how U.S. agencies address climate change as a potential driver of global migration. For State, USAID, and DOD, this report (1) describes executive branch actions related to climate change and migration from fiscal years 2014 through 2018; (2) examines the extent to which the agencies discussed the potential effects of climate change on migration in their plans and risk assessments; and (3) describes agency activities on the issue. GAO analyzed documents on administration priorities; reviewed agency plans, risk assessments, and documentation of agency activities; and interviewed agency officials.

What GAO Found

From fiscal years 2014 through 2018, a variety of executive branch actions related to climate change—such as executive orders and strategies—affected the Department of State (State), the U.S. Agency for International Development (USAID), and the Department of Defense (DOD), including their activities that could potentially address the nexus of climate change and migration. For example, a fiscal year 2016 presidential memorandum—rescinded in 2017—required agencies to develop implementation plans to identify the potential impact of climate change on human mobility, among other things. In general, however, climate change as a driver of migration was not a focus of the executive branch actions. For example, a fiscal year 2014 executive order—also rescinded in 2017—requiring agencies to prepare for the impacts of climate change did not highlight migration as a particular concern.
State, USAID, and DOD have discussed the potential effects of climate change on migration in agency plans and risk assessments. For example, State and USAID required climate change risk assessments when developing country and regional strategies, and a few of the strategies reviewed by GAO identified the nexus of climate change and migration as a risk. However, State changed its approach in 2017, no longer providing missions with guidance on whether and how to include climate change risks in their integrated country strategies. In doing so, State did not include in its 2018 guidance to the missions any information on how to include climate change risks, should the missions choose to do so. Without clear guidance, State may miss opportunities to identify and address issues related to climate change as a potential driver of migration.
The three agencies have been involved in climate change related activities but none were specifically focused on the nexus with global migration. For example, USAID officials said that the agency's adaptation efforts, such as its Pastoralist Areas Resilience Improvement through Market Expansion project in Ethiopia, were the most likely to include activities, such as enhancing resilience, that can indirectly address the issue of climate change as a driver of migration.

What GAO Recommends

GAO recommends that State provide missions with guidance that clearly documents its process for climate change risk assessments for country strategies. In commenting on a draft of this report, State indicated that it would update its integrated country strategy guidance and will specifically note that missions have the option to provide additional information on climate resilience and related topics.


Question:
Why GAO Did This Study

The Centers for Medicare & Medicaid Services pays LTCHs for care provided to Medicare beneficiaries. There were about 400 LTCHs across the nation in 2016.
The 21st Century Cures Act included a provision for GAO to examine certain issues pertaining to LTCHs. This report examines (1) the health care needs of Medicare beneficiaries who receive services from the two qualifying hospitals; (2) how Medicare LTCH payment polices could affect the two qualifying hospitals; and (3) how the two qualifying hospitals compare with other LTCHs and other facilities that may treat Medicare patients with similar conditions.
GAO analyzed the most recently available Medicare claims and other data for the two qualifying hospitals and other facilities that treat patients with spinal cord injuries. GAO also interviewed HHS officials and stakeholders from the qualifying hospitals, other facilities that treat spinal cord patients, specialty associations, and others.
GAO provided a draft of this report to HHS. HHS provided technical comments, which were incorporated as appropriate. We also provided the two qualifying hospitals summaries of information we collected from them, to confirm the accuracy of statements included in our draft report. We incorporated their comments, as appropriate.

What GAO Found

Spinal cord injuries may result in secondary complications that often lead to decreased functional independence and quality of life. The 21st Century Cures Act changed how Medicare pays certain long-term care hospitals (LTCH) that provide spinal cord specialty treatment. For these hospitals, the act included a temporary exception from how Medicare pays other LTCHs. Two LTCHs—Craig Hospital in Englewood, Colorado and Shepherd Center in Atlanta, Georgia—have qualified for this exception. GAO found that most Medicare beneficiaries treated at these two hospitals typically receive specialized care for multiple chronic conditions and other long-term complications that develop after initial injuries, such as pressure ulcers that can result in life-threatening infection. The two hospitals also provide specialty care for acquired brain injuries, such as traumatic brain injuries.
GAO's simulations of Medicare payments to these two hospitals using claims data from two baseline years—fiscal years 2013 and 2016—illustrate potential effects of payment policies. LTCHs are paid under a two-tiered system for care provided to beneficiaries: they receive the LTCH standard federal payment rate—or standard rate—for certain patients discharged from the LTCH, and a generally lower rate—known as a “site-neutral” rate—for all other discharges. Under the temporary exception, Craig Hospital and Shepherd Center receive the standard rate for all discharges during fiscal years 2018 and 2019. Assuming their types of discharges remain the same as in fiscal years 2013 and 2016, GAO's simulations of Medicare payments in the baseline years indicate:
Most of the discharges we examined would not qualify for the standard rate, if the exception did not apply.
Medicare payments would generally decrease under fiscal year 2020 payment policy, once the exception expires.
However, the actual effects of Medicare's payment policies on these two hospitals could vary based on factors, including the severity of patient conditions (e.g., Medicare payment is typically higher for more severe injuries), and whether hospitals' discharges meet criteria for the standard rate.
Similarities and differences may exist between the two qualifying hospitals and other facilities that treat Medicare patients with spinal cord and brain injuries. Patients with spinal cord and brain injuries may receive care in other LTCHs, but GAO found that most Medicare beneficiaries at these other LTCHs are treated for conditions other than spinal cord and brain injuries. Certain inpatient rehabilitation facilities (IRF) also provide post-acute rehabilitation services to patients with spinal cord and brain injuries. While data limitations make a direct comparison between these facilities and the two qualifying hospitals difficult, GAO identified some similarities and differences. For example, officials from some IRFs we interviewed reported providing several of the same programs and services as the two qualifying hospitals to medically complex patients, but the availability of services and complexity of patients varied. Among other reasons, the different Medicare payment requirements that apply to LTCHs and IRFs affect the types of services they provide and the patients they treat.


Question:
Why GAO Did This Study

Acquisition management has been a long-standing challenge at NASA, although GAO has reported on improvements the agency has made in recent years. Three space telescope projects are the key enablers for NASA to achieve its astrophysics' science goals, which include seeking to understand the universe. In its fiscal year 2018 budget request, NASA asked for about $697 million for these three projects, which represents over 50 percent of NASA's budget for its astrophysics' major projects. In total, these projects represent an expected investment of at least $12.4 billion.
This statement reflects preliminary observations on (1) the current status and cost of NASA's major telescope projects and (2) lessons learned that can be applied to NASA's management of its telescope projects. This statement is based on ongoing work on JWST and ongoing work on the status of NASA's major projects. Both reports are planned to be published in Spring 2018. This statement is also based on past GAO reports on JWST and NASA's acquisitions of major projects, and NASA input.

What GAO Found

The National Aeronautics and Space Administration's (NASA) current portfolio of major space telescopes includes three projects that vary in cost, complexity, and phase of the acquisition life cycle.
GAO's ongoing work indicates that these projects are each making progress in line with their phase of the acquisition cycle but also face some challenges. For example, the current launch date for the James Webb Space Telescope (JWST) project reflects a 57-60-month delay from the project's original schedule. GAO's preliminary observations indicate this project still has significant integration and testing to complete, with very little schedule reserve remaining to account for delays. Therefore, additional delays beyond the delay of up to 8 months recently announced are likely, and funding available under the $8 billion Congressional cost cap for formulation and development may be inadequate.
There are a number of lessons learned from its acquisitions that NASA could consider to increase the likelihood of successful outcomes for its telescope projects, as well as for its larger portfolio of projects, such as its human spaceflight projects. For example, twice in the history of the JWST program, independent reviews found that the program was not holding adequate cost and schedule reserves. GAO has found that NASA has not applied this lesson learned to all of its large projects, and similar outcomes to JWST have started to emerge. For example, NASA did not incorporate this lesson with its human spaceflight programs. In July 2016 and April 2017, GAO found that these programs were holding inadequate levels of cost and schedule reserves to cover unexpected cost increases or delays. In April 2017, GAO recommended that NASA reassess the date of the programs' first test flight. NASA concurred and, in November 2017, announced a launch delay of up to 19 months.

What GAO Recommends

GAO is not making any recommendations in this statement, but has made recommendations in prior reports to strengthen NASA's acquisition management of its major projects. NASA has generally agreed with GAO's recommendations and taken steps to implement them.


Question:
Why GAO Did This Study

The United States economy has historically been the largest recipient of foreign direct investment in the world—receiving $373 billion in 2016, according to U.S. government statistics. Ensuring that these foreign investments do not harm national security can be a challenge. CFIUS is an interagency group that reviews transactions under its authority—certain foreign acquisitions or mergers of U.S. businesses—to determine their effects on U.S. national security, while maintaining an open investment climate. If CFIUS identifies concerns, it may work with parties to the transaction to mitigate them. In rare cases, CFIUS may recommend that the President block or suspend a transaction.
GAO was asked to review the CFIUS process and possible changes to that process. This report (1) examines changes in CFIUS's workload and staffing from 2011 through 2016, and (2) provides information on stakeholder views on potential changes to CFIUS. GAO analyzed CFIUS information on staffing levels and transactions reviewed, and interviewed officials from member agencies, selected nonmember agencies that have CFIUS-related expertise, and knowledgeable external experts, such as think tanks.

What GAO Found

states that management should establish the organizational structure necessary to achieve its objectives and periodically evaluate this structure. Treasury—the agency that leads CFIUS— has not coordinated member agencies' efforts to better understand the staffing levels needed to address the current and future workload associated with core functions of the committee. Without this information, CFIUS may be limited in its ability to fulfill its objectives and address national security concerns.
Officials from CFIUS member agencies and selected nonmember agencies, as well as external experts, expressed a range of views on the potential benefits and drawbacks to possible changes to CFIUS. GAO organized the possible changes into three categories: (1) altering the structure of CFIUS, (2) redefining which transactions should be considered for CFIUS review, and (3) expanding the factors CFIUS considers when evaluating the impacts of a foreign transaction on national security. Agency officials were generally satisfied with CFIUS' structure, such as the committee's chair and membership. Views among officials and experts varied on redefining which transactions should be considered for review, such as requiring CFIUS to review all transactions covered by its authority regardless of notification. Officials and experts generally did not support expanding the list of national security factors CFIUS considers, such as by adding a net economic benefit test. Agency officials and experts agreed that one trade-off related to some possible changes is a likely increase to the CFIUS workload, which they noted is already straining agencies' staff resources.

What GAO Recommends

Treasury, as CFIUS lead, should coordinate member agencies' efforts to better understand the staffing levels needed to address the current and projected CFIUS workload associated with core committee functions. Treasury concurred.


Question:
Why GAO Did This Study

Certain Afghan or Iraqi nationals who worked for the U.S. government and may have experienced serious threats due to this work may qualify for an SIV. An SIV allows them and eligible family members to resettle in the United States, and since 2008 over 60,000 SIV holders (principal holder and family members) have done so. Upon arrival, they are eligible for resettlement assistance from State and HHS. GAO was asked to review SIV holders' resettlement outcomes and challenges. This report examines (1) available data on SIV holders' employment and other outcomes, (2) challenges affecting their resettlement, and (3) federal efforts to help address challenges. GAO analyzed the most recent federal data (State: 2010-2016; and HHS: 2016) on SIV holders' outcomes; interviewed officials from nine national resettlement agencies; and visited three states (CA, TX, and VA) where over half of SIV holders resettled. In these states, GAO interviewed the states' refugee coordinators and, for two local areas with relatively high levels of SIV resettlement, interviewed local resettlement agency officials and conducted focus groups with SIV holders. GAO also reviewed relevant federal laws and policies and interviewed federal officials.

What GAO Found

Since fiscal year 2011, about 13,000 Afghan and Iraqi nationals (excluding family members) have resettled in the United States under special immigrant visas (SIV), but limited data on their outcomes are available from the Department of State (State) and the Department of Health and Human Services (HHS). State collects data on SIV holders' resettlement outcomes once—90 days after they arrive. GAO's analysis of State's data from October 2010 through December 2016 showed that the majority of principal SIV holders—those who worked for the U.S. government—were unemployed at 90 days, including those reporting high levels of education and spoken English. Separately, HHS collects data on about one-third of resettled SIV holders (those in one HHS grant program). According to HHS's fiscal year 2016 data (the only year available), most of these SIV holders were employed and not receiving cash assistance 6 months after arrival; however, these data are not representative of all SIV holders. GAO did not identify any outcome data for SIV holders beyond 6 months after arrival. HHS annually surveys refugees up to 5 years after arrival, but does not do so for SIV holders. However, it has occasionally used its survey of refugees to analyze selected groups at no additional reported cost. Such analysis could provide valuable information on whether SIV holders have achieved longer-term assimilation, consistent with HHS' mission and program goals.
Stakeholders GAO interviewed reported several resettlement challenges, including capacity issues in handling large numbers of SIV holders, difficulties finding skilled employment, and SIV holders' high expectations. Officials from local resettlement agencies in Northern Virginia reported capacity challenges for their agencies and the community due to the large increase of SIV holders. In almost all of GAO's focus groups with principal SIV holders, participants expressed frustration at the need to take low-skilled jobs because they expected that their education and prior work experience would lead to skilled work.
State and HHS have taken steps to address some resettlement challenges. For example, in 2017 State placed restrictions on where SIV holders could resettle and HHS announced a new grant to support career development programs for SIV holders, refugees, and others. In addition, State provides information to prospective SIV holders about resettlement. However, the information is general, and lacks detail on key issues such as housing affordability, employment, and available government assistance. Providing such specifics could lead to more informed decisions by SIV holders on where to resettle and help them more quickly adapt to potential challenges once in the United States.

What GAO Recommends

GAO recommends that 1) HHS consider including SIV holders in its annual survey on refugees' longer-term outcomes, and that 2) State provide more detailed information on key issues to prospective SIV holders. Both agencies agreed with our recommendations.


Question:
Why GAO Did This Study

WMATA transports more than 1 million rail and bus passengers each weekday in the nation's capital and surrounding areas. However, recent safety incidents and declines in ridership and revenues have focused public attention on how WMATA manages its workforce and associated costs.
GAO was asked to review WMATA's workforce management. This report examines, among other things, (1) how WMATA's workforce costs have changed from fiscal years 2006 through 2017 and factors contributing to those changes, and (2) how WMATA has designed and implemented its employee performance management systems. GAO reviewed WMATA's annual financial statements and budgets from fiscal years 2006 through 2017, and compared WMATA's workforce cost and performance management efforts to leading practices and internal control and actuarial principles. GAO also reviewed a non-generalizable sample of employee performance evaluations selected to include occupations with the highest number of evaluations.

What GAO Found

The Washington Metropolitan Area Transit Authority's (WMATA) workforce costs—including wages, salaries, and benefits for employees and retirees—increased on average by about 3 percent annually from fiscal years 2006 through 2017. This increase was largely driven by the cost of employee and retiree benefits. Specifically, the amount WMATA was required to contribute to its pension plans increased by an annual average of about 19 percent during this period. Due to their relative size, proportion of retirees compared to active members, and investment decisions, these pension plans pose significant risk to WMATA's financial operations, yet WMATA has not fully assessed the risks. Without comprehensive information on the risks facing its pension plans, WMATA may not be prepared for economic scenarios that could increase its required contributions to an extent that might jeopardize its ability to provide some transit service.
WMATA has implemented two employee performance management systems that cover all employees, but these systems lack some key elements of an effectively designed and implemented performance management system. For example, WMATA's performance management systems are not designed to make meaningful distinctions in performance, a key element of an effective system. This design is due in part to WMATA's lack of comprehensive policies and procedures for its performance management systems. In addition, WMATA lacks sufficient controls to ensure that supervisors complete required performance evaluations accurately and on-time. For example, in 10 of 50 performance evaluations we reviewed, we found scoring errors where employees were assigned a performance rating inconsistent with the supporting review. Without comprehensive policies and procedures or sufficient controls over its performance management systems, WMATA lacks tools and information to move employees toward achieving WMATA's strategic goals.

What GAO Recommends

GAO is making five recommendations to WMATA, including that it develop a comprehensive assessment of risks posed by its pension plans, comprehensive policies and procedures for its employee performance management systems, and controls to ensure supervisors complete required performance evaluations, among other actions.
WMATA agreed with four recommendations and neither agreed nor disagreed with the fifth.


Question:
Why GAO Did This Study

In January and March 2017, the President issued a series of executive orders related to border security and immigration. The orders direct federal agencies to take a broad range of actions with potential resource implications. For example, Executive Order 13767 instructs DHS to construct a wall or other physical barriers along the U.S. southern border and to hire an additional 5,000 U.S. Border Patrol agents. Executive Order 13768 instructs federal agencies, including DHS and DOJ, to ensure that U.S immigration law is enforced against all removable individuals and directs ICE to hire an additional 10,000 immigration officers. Executive Order 13780 directs agencies to develop a uniform baseline for screening and vetting standards and procedures; and established nationality-based entry restrictions with respect to visa travelers for a 90-day period, and refugees for 120 days.
GAO was asked to review agencies' implementation of the executive orders and related spending. This report addresses (1) actions DHS, DOJ, and State have taken, or plan to take, to implement provisions of the executive orders; and (2) resources to implement provisions of the executive orders, particularly funds DHS, DOJ, and State have obligated, expended, or shifted. GAO reviewed agency planning, tracking, and guidance documents related to the orders, as well as budget requests, appropriations acts, and internal budget information. GAO also interviewed agency officials regarding actions and budgetary costs associated with implementing the orders.

What GAO Found

The Departments of Homeland Security (DHS), Justice (DOJ), and State issued internal and public reports such as studies and progress updates, developed or revised policies, and took initial planning and programmatic actions to implement Executive Orders 13767, 13768, and 13780. For example:
DHS's U.S. Customs and Border Protection (CBP) started the acquisition process for a Border Wall System Program and issued task orders to design and construct barrier prototypes. In November 2017, CBP awarded a contract worth up to $297 million to help with hiring 5,000 U.S. Border Patrol agents, 2,000 CBP officers, and 500 Air and Marine Operations agents.
DOJ issued memoranda providing guidance for federal prosecutors on prioritizing certain immigration-related criminal offenses. Additionally, from March through October 2017, DOJ detailed approximately 40 immigration judge positions to detention centers and to the southern border to conduct removal and other related proceedings, according to DOJ officials.
State participated in an interagency working group to develop uniform standards related to the adjudication of visa applications, interviews, and system security checks. State also implemented visa and refugee entry restrictions in accordance with the Supreme Court's June 26, 2017, ruling.
Agency officials anticipate that implementing the executive orders will be a multi-year endeavor comprising additional reporting, planning, and other actions.
DHS, DOJ, and State used existing fiscal year 2017 resources to support initial executive order actions that fit within their established mission areas. GAO found that it was not always possible to disaggregate which fiscal year 2017 funds were used for implementation of the orders versus other agency activities. All three agencies indicated that they used existing personnel to implement the orders and, in some cases, these efforts took substantial time. For example, according to ICE data, personnel spent about 14,000 regular hours (the equivalent of 1,750 8-hour days) and 2,400 overtime hours planning for the ICE hiring surge from January 2017 through January 2018.
In March 2017, the President submitted a budget amendment along with a request for $3 billion in supplemental appropriations for DHS to implement the orders. In May 2017, DHS received an appropriation of just over $1.1 billion, some of which DHS used to fund actions to implement the orders. For example, CBP received $65 million for hiring and, according to CBP officials, used these funds to plan and prepare for the surge in U.S. Border Patrol agents. As of January 2018, CBP had obligated $18.8 million of the $65 million.
Agencies plan to continue to use their base budgets and request additional funds as needed to carry out their missions and implement the orders. For example, for fiscal year 2018, CBP requested approximately $1.6 billion and received (in March 2018) approximately $1.3 billion to build new and replace existing sections of physical barriers along the southern border. For fiscal year 2019, ICE requested $571 million to hire 2,000 immigration officers and DOJ requested approximately $40 million to hire new immigration judges and supporting staff.


Question:
Why GAO Did This Study

DOD's contracting process is designed to protect taxpayers' interests, among other things, and can take time. DOD leadership and contractors have expressed concern about the length of time to award contracts and DOD has proposed reducing that time.
GAO was asked to evaluate the length of time to award weapon systems contracts. This report examines (1) DOD's efforts to determine the time it takes to award contracts; (2) data on the time interval from solicitation to contract award for selected contracts; and (3) factors identified as contributing to contract award time frames.
GAO used the Federal Procurement Data System-Next Generation to identify new weapon systems-related contracts awarded in fiscal years 2014 through 2016, valued over $5 million, among other factors. GAO selected a nongeneralizable sample of 129 contracts at four DOD components with the highest total dollar value and highest number of contracts from those fiscal years for further analysis. GAO analyzed contract documentation and surveyed contracting officials on a subset of contracts to determine the factors affecting the time between solicitation issuance and award.

What GAO Found

Although the Department of Defense (DOD) has proposed reducing the time it takes to award contracts related to weapon systems, the department has a limited understanding of how long it currently takes and therefore lacks a baseline to measure success. The DOD components GAO reviewed—Air Force, Army, Defense Logistics Agency, and Navy—collect data on their time frames for awarding contracts. However, they do so in different ways in the absence of a DOD-wide strategy for what information should be collected. For example, the Air Force measures the time to award beginning with solicitation issuance, while the other components use a different starting point. As a result, information the components collect is not comparable and is of limited use for understanding contract award time frames department-wide. Determining what information is needed to monitor time taken to award contracts consistently across components should help DOD assess its progress toward reducing the time.
GAO analyzed the time from solicitation issuance to award for 129 weapon systems-related contracts and found it ranged from less than a month to over 4 years. Although some DOD and industry officials stated that contract value could affect contract award time frames, GAO observed a wide range of time intervals and did not observe any patterns based on this characteristic. (See figure below.)
According to DOD contracting officials GAO surveyed, factors that can help reduce—or, alternatively lengthen—the time between when a solicitation is issued to when a contract is awarded include a decision to make the contract award an office priority and how quickly contractors respond to requests for additional information after initial proposals are received.

What GAO Recommends

GAO recommends that DOD develop a strategy that identifies the information it needs to collect and how it will use the information to assess contract award time frames. DOD concurred.


Question:
Why GAO Did This Study

Federal financial regulators must comply with various rulemaking and review requirements, including those in RFA and EGRPRA. These statutes require analyses relating to regulatory burden, small entities, or both. RFA requires analyses of a rule's impact on small entities and alternatives that may minimize any significant economic impact. It also requires agencies to review rules (within 10 years) to determine if the rules should be amended or rescinded. EGRPRA directs specified regulators to review regulations at least every 10 years and identify areas that are outdated, unnecessary, or unduly burdensome on insured depository institutions.
This statement is based on findings from GAO's January 2018 report on RFA implementation ( GAO-18-256 ) and February 2018 report on regulatory burden on community banks and credit unions ( GAO-18-213 ). GAO discusses regulatory burdens and how financial regulators address regulatory burdens through the rulemaking process and retrospective reviews. For those reports, GAO's work included reviewing Federal Register notices; regulators' workpapers, policies and procedures; and reports to Congress on EGRPRA reviews. GAO also interviewed more than 60 community banks and credit unions.

What GAO Found

More than 60 smaller depository institutions told GAO that regulations for reporting mortgage characteristics; reviewing transactions for potentially illicit activity; and disclosing fees, conditions, and mortgage terms to consumers were the most burdensome. Institution representatives said these regulations were time-consuming and costly because the requirements were complex and required reporting that had to be reviewed for accuracy. Financial regulators and others noted these regulations provide various benefits as well, such as preventing lending discrimination or use of the banking system for illicit activity.
The Regulatory Flexibility Act (RFA) requires federal agencies to analyze the impact of their regulations on small entities. GAO found several weaknesses with the analyses of six financial regulators—Board of Governors of the Federal Reserve System (Federal Reserve), Office of the Comptroller of the Currency (OCC), Federal Deposit Insurance Corporation (FDIC), Securities and Exchange Commission, Commodity Futures Trading Commission, and Consumer Financial Protection Bureau (CFPB)—that could undermine the goal of RFA and limit transparency and public accountability. For example, some analyses lacked important information, such as data sources, methodologies, and consideration of broad economic impacts. Evaluations of potential economic effects and alternative regulatory approaches also were limited. Finally, regulators generally lacked comprehensive policies and procedures for RFA implementation. By not developing such policies and procedures, regulators' ability to consistently and effectively meet RFA objectives may be limited.
The Economic Growth and Regulatory Paperwork Reduction Act of 1996 (EGRPRA) and RFA require regulators to conduct retrospective reviews, and GAO found weaknesses.
EGRPRA. GAO found limitations in activities regulators undertook for retrospective reviews under EGRPRA. CFPB, which has regulatory authority for a number of consumer financial laws, was not included in the most recent review process. Moreover, as part of their EGRPRA reviews, the Federal Reserve, OCC, FDIC, and the National Credit Union Administration had not conducted and reported analyses of quantitative data nor had these regulators assessed the cumulative effect of regulations. Addressing these limitations in the EGRPRA processes likely would make the analyses they perform more transparent, and potentially result in additional burden reduction.
RFA. The issues GAO identified with RFA retrospective reviews (section 610 reviews) included some regulators using the EGRPRA process to fulfill RFA requirements and gaps or weaknesses in analysis and documentation. But EGRPRA requirements do not fully align with RFA's, and it is not clear if the EGRPRA process satisfies the requirements of section 610. Also, regulators generally have not developed policies and procedures for section 610 reviews. By meeting section 610 review requirements, regulators will be in a better position to minimize any significant economic impact of a rule on a substantial number of small entities, as the statute seeks to ensure.

What GAO Recommends

GAO made a total of 20 recommendations to the financial regulators in the two reports to improve their policies and procedures and analysis under RFA and in retrospective reviews. The regulators generally agreed with the recommendations.


Question:
Why GAO Did This Study

According to a U.S. government study, increased U.S. energy trade with Canada and Mexico—two of the United States' top energy trade partners—is viewed as a major contributor to U.S. economic prosperity and energy security. In recent years, North American energy production has experienced changes. For example, the United States has become the world's top oil producer, Canada has substantially increased its oil outputs, and Mexico has implemented energy reforms. To address energy production and trade issues, the public sector and private sector stakeholders have advocated for further integration of the three North American countries' energy sectors.
GAO was asked to review the role of U.S. agencies in supporting energy integration in North America. This report examines (1) ways in which the U.S., Canadian, and Mexican governments cooperate on North American energy integration; (2) U.S. agencies' activities to facilitate North American energy integration; (3) U.S. agencies' efforts to coordinate among themselves on North American energy integration; (4) ways in which U.S. agencies receive feedback from U.S. industry and civil society regarding North American energy integration; and (5) steps that U.S., Canadian, and Mexican officials suggested to further facilitate North American energy integration. GAO reviewed bilateral and trilateral cooperation activities and mechanisms; surveyed U.S. agencies involved in energy integration; and interviewed U.S., Canadian, and Mexican energy officials.
GAO is not making any recommendations in this report.

What GAO Found

Cooperation. The United States cooperates with Canada and Mexico on integrating North American energy markets and infrastructure (energy integration). Cooperation occurs at the presidential and ministerial levels (e.g., the countries' secretaries or ministers of energy) for strategic issues and at the agency level for technical issues. However, progress on some strategic issues has been limited. For example, development of a North American energy strategy, which the U.S. Department of Energy (DOE) proposed in March 2017, was suspended later that year because of disagreement about its scope. Discussions of the strategy resumed in 2018, according to DOE officials.
Agency activities. Eight U.S. agencies have engaged in multiple efforts to facilitate North American energy integration. DOE generally serves as the lead agency on energy integration issues, while the Department of State—the lead agency on foreign policy—also leads some bilateral and trilateral efforts. Other agencies play roles in areas such as regulatory compliance or efforts to open energy markets. Agency officials GAO surveyed and interviewed identified 81 energy integration–related activities conducted in 2014 through 2017, including international agreements and other instruments, research and development, technical forums and assistance, regulatory cooperation, and trade promotion.
Interagency coordination. U.S. agency officials reported coordinating on energy integration through high-level U.S. interagency meetings, summits, and other means. For example, agencies participating in a National Security Council–led working group share information, provide advice, and coordinate on activities. Agency officials also reported using mechanisms such as stakeholder forums and staff discussions to coordinate on energy integration issues.
Stakeholder feedback. U.S. agencies receive feedback on energy integration issues from the private sector and civil society through formal mechanisms such as comments in the Federal Register and public–private advisory entities. For example, the U.S.–Mexico Energy Business Council is designed to capture private sector feedback. Informal feedback comes through activities such as emails, phone calls, and letters.
Steps suggested by U.S., Canadian, and Mexican officials . Officials in the three countries expressed general satisfaction with intergovernmental cooperation on energy integration and said cooperative activities had helped foster integration. They also suggested further work in areas such as aligning energy regulations.
Source: GAO analysis of information provided by U.S, Canadian, and Mexican officials. | GAO-18-575


Question:
Why GAO Did This Study

Federal agencies and the nation's critical infrastructures—such as energy, transportation systems, communications, and financial services—are dependent on information technology systems to carry out operations. The security of these systems and the data they use is vital to public confidence and national security, prosperity, and well-being.
The risks to these systems are increasing as security threats evolve and become more sophisticated. GAO first designated information security as a government-wide high-risk area in 1997. This was expanded to include protecting cyber critical infrastructure in 2003 and protecting the privacy of personally identifiable information in 2015.
This report provides an update to the information security high-risk area. To do so, GAO identified the actions the federal government and other entities need to take to address cybersecurity challenges. GAO primarily reviewed prior work issued since the start of fiscal year 2016 related to privacy, critical federal functions, and cybersecurity incidents, among other areas. GAO also reviewed recent cybersecurity policy and strategy documents, as well as information security industry reports of recent cyberattacks and security breaches.

What GAO Found

GAO has identified four major cybersecurity challenges and 10 critical actions that the federal government and other entities need to take to address them. GAO continues to designate information security as a government-wide high-risk area due to increasing cyber-based threats and the persistent nature of security vulnerabilities.
GAO has made over 3,000 recommendations to agencies aimed at addressing cybersecurity shortcomings in each of these action areas, including protecting cyber critical infrastructure, managing the cybersecurity workforce, and responding to cybersecurity incidents. Although many recommendations have been addressed, about 1,000 have not yet been implemented. Until these shortcomings are addressed, federal agencies' information and systems will be increasingly susceptible to the multitude of cyber-related threats that exist.

What GAO Recommends

GAO has made over 3,000 recommendations to agencies since 2010 aimed at addressing cybersecurity shortcomings. As of August 2018, about 1,000 still needed to be implemented.


Question:
Why GAO Did This Study

More than 2.7 million miles of pipeline transport and distribute oil, natural gas, and other hazardous products throughout the United States. Interstate pipelines run through remote areas and highly populated urban areas, and are vulnerable to accidents, operating errors, and malicious physical and cyber-based attack or intrusion. The energy sector accounted for 35 percent of the 796 critical infrastructure cyber incidents reported to DHS from 2013 to 2015. Several federal and private entities have roles in pipeline security. TSA is primarily responsible for the oversight of pipeline physical security and cybersecurity.
GAO was asked to review TSA's efforts to assess and enhance pipeline security and cybersecurity. This report examines, among other objectives: (1) the guidance pipeline operators reported using to address security risks and the extent that TSA ensures its guidelines reflect the current threat environment; (2) the extent that TSA has assessed pipeline systems' security risks; and (3) the extent TSA has assessed its effectiveness in reducing pipeline security risks.
GAO analyzed TSA documents, such as its Pipeline Security Guidelines ; evaluated TSA pipeline risk assessment efforts; and interviewed TSA officials, 10 U.S. pipeline operators—selected based on volume, geography, and material transported—and representatives from five industry associations.

What GAO Found

Pipeline operators reported using a range of guidelines and standards to address physical and cybersecurity risks, including the Department of Homeland Security's (DHS) Transportation Security Administration's (TSA) Pipeline Security Guidelines , initially issued in 2011. TSA issued revised guidelines in March 2018 to reflect changes in the threat environment and incorporate most of the principles and practices from the National Institute of Standards and Technology's Framework for Improving Critical Infrastructure Cybersecurity . However, TSA's revisions do not include all elements of the current framework and TSA does not have a documented process for reviewing and revising its guidelines on a regular basis. Without such a documented process, TSA cannot ensure that its guidelines reflect the latest known standards and best practices for physical security and cybersecurity, or address the dynamic security threat environment that pipelines face. Further, GAO found that the guidelines lack clear definitions to ensure that pipeline operators identify their critical facilities. GAO's analysis showed that operators of at least 34 of the nation's top 100 critical pipeline systems (determined by volume of product transported) deemed highest risk had identified no critical facilities. This may be due, in part, to the guidelines not clearly defining the criteria to determine facilities' criticality.
To assess pipeline security risks, TSA conducts pipeline security reviews—Corporate Security Reviews and Critical Facility Security Reviews—to assess pipeline systems' vulnerabilities. However, GAO found that the number of TSA security reviews has varied considerably over the last several years, as shown in the table on the following page.
TSA officials stated that staffing limitations have prevented TSA from conducting more reviews. Staffing levels for TSA's Pipeline Security Branch have varied significantly since fiscal year 2010 with the number of staff ranging from 14 full-time equivalents in fiscal years 2012 and 2013 to 1 in 2014. Further, TSA does not have a strategic workforce plan to help ensure it identifies the skills and competencies—such as the required level of cybersecurity expertise—necessary to carry out its pipeline security responsibilities. By establishing a strategic workforce plan, TSA can help ensure that it has identified the necessary skills, competencies, and staffing.
GAO also identified factors that likely limit the usefulness of TSA's risk assessment methodology for prioritizing pipeline system reviews. Specifically, TSA has not updated its risk assessment methodology since 2014 to reflect current threats to the pipeline industry. Further, its sources of data and underlying assumptions and judgments regarding certain threat and vulnerability inputs are not fully documented. In addition, the risk assessment has not been peer reviewed since its inception in 2007. Taking steps to strengthen its risk assessment, and initiating an independent, external peer review would provide greater assurance that TSA ranks relative risk among pipeline systems using comprehensive and accurate data and methods.
TSA has established performance measures to monitor pipeline security review recommendations, analyze their results, and assess effectiveness in reducing risks. However, these measures do not possess key attributes—such as clarity, and having measurable targets—that GAO has found are key to successful performance measures. By taking steps to ensure that its pipeline security program performance measures exhibit these key attributes, TSA could better assess its effectiveness at reducing pipeline systems' security risks. Pipeline Security Branch officials also reported conducting security reviews as the primary means for assessing the effectiveness of TSA's efforts to reduce pipeline security risks. However, TSA has not tracked the status of Corporate Security Review recommendations for the past 5 years. Until TSA monitors and records the status of these reviews' recommendations, it will be hindered in its efforts to determine whether its recommendations are leading to significant reduction in risk.

What GAO Recommends

GAO makes 10 recommendations to TSA to improve its pipeline security program management (many are listed on the next page), and DHS concurred.
GAO recommends, among other things, that the TSA Administrator take the following actions:
implement a documented process for reviewing, and if deemed necessary, for revising TSA's Pipeline Security Guidelines at defined intervals;
clarify TSA's Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities;
develop a strategic workforce plan for TSA's Security Policy and Industry Engagement‘s Surface Division;
update TSA's pipeline risk assessment methodology to include current data to ensure it reflects industry conditions and threats;
fully document the data sources, underlying assumptions and judgments that form the basis of TSA's pipeline risk assessment methodology;
take steps to coordinate an independent, external peer review of TSA's pipeline risk assessment methodology;
ensure the Security Policy and Industry Engagement‘s Surface Division has a suite of performance measures which exhibit key attributes of successful performance measures; and
enter information on Corporate Security Review recommendations and monitor and record their status.


Question:
Why GAO Did This Study

Contractor business systems produce critical data that contracting officers use to help negotiate and manage defense contracts. These systems and their related internal controls act as important safeguards against fraud, waste, and abuse of federal funding. Federal and defense acquisition regulations and DOD policies require that DOD take steps to review the adequacy of certain business systems, but GAO and other oversight entities have raised questions about the sufficiency and consistency of DOD's review process.
The National Defense Authorization Act for Fiscal Year 2018 contained a provision for GAO to evaluate how DOD implemented legislation intended to improve its business system review process. Among other things, this report examines (1) the changes DOD made to its review process and (2) the extent to which DOD is ensuring timely business system reviews.
GAO analyzed DOD acquisition regulations, policies, and procedures for conducting contractor business system reviews and analyzed data on reviews conducted between fiscal years 2013 and 2018.

What GAO Found

Since 2011, the Department of Defense (DOD) has implemented several changes to its processes for reviewing contractor business systems—which include systems such as accounting, estimating, and purchasing. Among other changes, DOD
clarified the roles and responsibilities of the Defense Contract Management Agency (DCMA) and the Defense Contract Audit Agency (DCAA)—the two agencies that are responsible for conducting the reviews;
clarified timeframes for business system reviews and established criteria for business systems; and
withheld payments from contractors that were found to have significant deficiencies in their business systems.
DOD does not have a mechanism to monitor and ensure that these reviews are being conducted in a timely manner. For its part, DCAA has conducted few business system audits since 2013, as it focused its efforts on other types of audits. DCAA plans to significantly increase the number of business system audits over the next 4 years, but its success in doing so depends on its ability to shift resources from other audits; to use public accounting firms to conduct other, non-business system audits; and DCAA staff's ability to execute new audit plans in a timely manner.
DCMA relies on the three offices responsible for conducting DCMA-led reviews to manage the reviews, but DCMA does not formally monitor whether these reviews are being conducted consistent with policy nor does it monitor DCAA's efforts to complete the audits for which it is responsible. DCMA is ultimately responsible for approving a contractor's business systems. DCMA currently lacks a mechanism based on relevant and reliable information, such as the number of reviews that are outstanding and the resources available to conduct such reviews, to ensure reviews are being completed in a timely fashion. Such information could help inform more strategic oversight on whether the current review process is achieving its intended results, or whether additional changes to the timing of or criteria for conducting reviews are needed.

What GAO Recommends

GAO recommends that DCMA, in collaboration with DCAA, develop a mechanism to monitor and ensure contractor business system reviews are conducted in a timely fashion. DOD concurred with the recommendation.


Question:
Why GAO Did This Study

Airlines recently came under scrutiny for their treatment of passengers—including a high-profile incident in which a passenger was forcibly removed from an overbooked flight. However, airlines maintain that service has improved, citing better on-time performance and lower airfares. DOT has the authority to issue and enforce certain consumer protection requirements. DOT also educates passengers about their rights.
GAO was asked to examine airline consumer protection issues. This report examines, among other issues, (1) trends in DOT's data on airline service; (2) the effectiveness of DOT's compliance efforts; and (3) the extent to which DOT's passenger education efforts align with key practices for consumer outreach. GAO reviewed DOT data on airline service and analyzed passenger complaint data for the 12 largest domestic airlines from 2008 through 2017; reviewed relevant documents and data on DOT's compliance program; assessed DOT's educational efforts against key practices for successful consumer outreach; and interviewed DOT officials. GAO interviewed or obtained written information from 11 of the 12 airlines.

What GAO Found

The Department of Transportation's (DOT) data offered mixed information on whether airlines' service improved from 2008 through 2017. While DOT's operational data on rates of late flights, denied boardings, and mishandled baggage generally suggested improvement, the rate of passenger complaints received by DOT increased about 10 percent—from about 1.1 complaints per 100,000 passengers to 1.2 complaints per 100,000 passengers.
DOT conducts five key activities to ensure airlines' compliance with consumer protection requirements (see table). However, GAO found that DOT lacked performance measures to help it evaluate some of these activities and that it could improve its procedures (i.e., guidance documents and training materials), that analysts use to code passenger complaints.
Performance measures : DOT has established objectives for each of its five key compliance activities that state what it seeks to achieve; however, DOT lacks performance measures for three objectives. For example, DOT lacks a performance measure for conducting inspections of airlines' compliance with consumer protection requirements at airlines' headquarters and at airports. As a result, DOT is missing opportunities to capture critical information about airlines' compliance with consumer protection requirements.
Procedures : DOT has procedures to help analysts code passenger complaints and identify potential consumer protection violations. GAO found that DOT's guidance for coding passenger complaints did not consistently include definitions or examples that illustrate appropriate use or help analysts select among the various complaint categories. Additional procedures would help DOT ensure that complaints are consistently coded and that potential violations are properly identified.
GAO found that while DOT has taken steps to educate passengers on their rights, its efforts did not fully align with four of nine key practices GAO previously identified for conducting consumer education. For example, while DOT has defined the goals and objectives of its outreach efforts, it has not used budget information to prioritize efforts or established performance measures to assess the results. DOT has also not solicited input directly from passengers to understand what they know about their rights. Taking such actions would provide DOT with greater assurance that its efforts are meeting passengers' needs.

What GAO Recommends

GAO is making six recommendations, including that DOT: develop performance measures for compliance activities, improve its procedures for coding airline passengers' complaints, and improve how passenger education aligns with GAO's key practices. DOT concurred with our recommendations and provided technical comments, which we incorporated as appropriate.


Question:
Why GAO Did This Study

The World Health Organization estimates that tobacco use kills over 7 million people each year, more than tuberculosis, HIV/AIDS, and malaria combined. Since the 1990s, Congress has enacted restrictions regarding the use of certain appropriated funds to promote U.S. tobacco exports.
GAO was asked to review the implementation of these restrictions. This report examines (1) guidance select U.S. agencies have issued to implement these restrictions, (2) whether overseas officials from select U.S. agencies were aware of the restrictions and guidance, and (3) select U.S. agencies' implementation of the guidance overseas. GAO reviewed U.S. laws, agency guidance, and internal communications; analyzed Commerce data; and interviewed agency officials in Washington, D.C. and in 24 offices across 11 overseas posts in 9 countries. GAO selected these countries based on criteria that included U.S. tobacco export totals, smoking rates, and geographic dispersion.

What GAO Found

Congress has restricted the use of certain appropriated funding to promote tobacco exports and the Departments of State (State), Commerce (Commerce), and Agriculture (USDA) have issued interagency guidance through the cable system that they rely on to implement these restrictions. State collaborates with these and other agencies to periodically update this cable. The cable informs officials about the types of actions they should take—such as providing routine business facilitation services to all U.S. companies—and the types of actions they should not take—such as attending events sponsored by tobacco companies.
Most, but not all, officials overseas that GAO interviewed were aware of the restrictions and received some guidance concerning the restrictions. However, GAO found that some officials did not recall receiving the interagency guidance cable. In addition, State and USDA's current training materials do not address the restrictions. Federal internal control standards state that appropriate training is essential to an organization's operational success. Thus, providing officials overseas with training about the funding restrictions and related guidance would help to ensure that officials are aware of the restrictions.
U.S. officials overseas have implemented restrictions on promoting tobacco, but some officials said that the interagency guidance lacks clarity. Officials said that they have not promoted tobacco by, for example, attending events sponsored solely by tobacco companies. However, officials identified three areas of the guidance that are unclear: (1) attendance at events not sponsored by U.S. tobacco companies but attended by representatives of these companies; (2) the types of services officials can provide tobacco companies; and (3) the description of tobacco products, such as whether component parts for electronic cigarettes are included. Federal standards for internal control state that management should clearly document internal controls in policies and guidance to prevent officials from failing to achieve an objective or address a risk. By providing more specific guidance, the agencies would help ensure that officials consistently implement the funding restrictions on promoting tobacco.

What GAO Recommends

GAO recommends that (1) State and USDA include information about the funding restrictions and guidance in training materials for relevant employees and (2) State, in consultation with Commerce and USDA, assess and update the interagency guidance cable, as needed, on promoting tobacco in light of questions raised by officials at posts overseas. State and USDA concurred with the recommendations.


Question:
Why GAO Did This Study

In 2010, the Coast Guard initiated an effort—known as IHiS—to replace its aging EHR system with a suite of modernized systems that was to automate various health care services for its nearly 50,000 military members. However, in October 2015, the Coast Guard announced that the modernization project would be canceled.
GAO was asked to review the Coast Guard's efforts to develop a modernized EHR system. GAO's objectives were to (1) describe what led the Coast Guard to terminate further IHiS development, and how much was spent on the project; (2) evaluate the Coast Guard's management and oversight for the discontinued project and what, if any, lessons learned were identified; (3) describe the Coast Guard's current process for managing health records and the challenges, if any, it is encountering; and (4) determine the Coast Guard's plans for effectively implementing a new EHR system and the current status of its efforts. To do so, GAO reviewed project expenditures, analyzed key project management documentation, surveyed Regional Managers and clinical staff, and interviewed knowledgeable staff.

What GAO Found

Financial, technical, schedule, and personnel risks led to the United States Coast Guard's (Coast Guard) decision to terminate the Integrated Health Information System (IHiS) project in 2015. According to the Coast Guard (a military service within the Department of Homeland Security), as of August 2017, $59.9 million was spent on the project over nearly 7 years and no equipment or software could be reused for future efforts. In addition, the Coast Guard could not fully demonstrate the project management actions taken for IHiS, lacked governance mechanisms, and did not document lessons learned for the failed project.
As a result of the cancelation of the IHiS project and the decommissioning of the two legacy electronic health record (EHR) systems IHiS was to replace, the Coast Guard directed its clinics to revert to maintaining health records using a predominantly paper process. Coast Guard Regional Managers and clinic and sick bay administrators informed GAO of the many challenges encountered in returning to a paper process. These challenges include the inability for some clinics to adequately track vital information such as the medications members are taking—potentially causing harm to them.
To help alleviate several of these challenges, the Coast Guard has developed alternative work-around processes. However, these alternative processes may not provide sustained solutions to overcoming these challenges.
In February 2016, the Coast Guard initiated the process for acquiring a new EHR system. As of November 2017, agency officials had conducted research and recommended a solution based on performance, risk, cost, and schedule advantages. However, 2 years after canceling IHiS and moving toward a predominately manual process, the agency has not yet made a final determination on this. Successfully and quickly implementing an EHR system is vital to overcoming the challenges Coast Guard currently faces in managing paper health records. The expeditious implementation of such a system can significantly improve the quality and efficiency of care to the thousands of Coast Guard active duty and reserve members that receive health care.

What GAO Recommends

GAO is recommending the Coast Guard (1) expeditiously and judiciously pursue the acquisition of a new EHR system, and in doing so (2) ensure key processes are implemented, (3) establish project governance boards, and (4) document lessons learned. The Department of Homeland Security concurred with GAO's recommendations.


Question:
Why GAO Did This Study

FWS awarded $1.5 billion in grants in fiscal year 2016, which represented about half of the agency's budget. In general, FWS awards two types of grants: (1) formula grants, which are distributed to recipients based on a required formula, and (2) competitive grants, where potential recipients submit an application for funding that is reviewed and scored against criteria. Within FWS, WSFR manages several grant programs.
GAO was asked to review WSFR's management of its competitive grant programs. This report (1) identifies and describes competitive grant programs that WSFR awards and monitors; (2) examines how WSFR awards grants under these programs and the extent to which this is consistent with relevant regulations; and (3) examines how WSFR monitors grants under these programs and the extent to which this is consistent with relevant regulations. GAO reviewed relevant federal laws, regulations, and FWS guidance; analyzed agency data for fiscal years 2012-2016; reviewed award documents for fiscal year 2016 and a sample of monitoring documents for grants awarded in fiscal year 2015 (selected to ensure sufficient time for required reports to be submitted) and compared these with requirements from relevant regulations; interviewed WSFR headquarters and regional officials and grant recipients.

What GAO Found

The U.S. Fish and Wildlife Service's (FWS) Wildlife and Sport Fish Restoration (WSFR) program, within the Department of the Interior, awards and monitors five competitive grant programs. These grant programs fund different types of projects ranging from building docks to acquiring wetlands. GAO found that the number of grants and funding awarded varied by grant program from fiscal years 2012 through 2016.
Dollars in thousands
The award process WSFR uses for the five competitive grant programs generally involves publicly announcing the grant opportunity through a Notice of Funding Opportunity, which contains information applicants need to consider when applying, such as available funding and criteria that will be used to score applications. A panel comprised of WSFR staff, and in some cases other FWS staff or a third party organization, reviews and scores the applications based on the criteria in the Notice of Funding Opportunity and develops a list of recommended projects and funding amounts. The list is forwarded to the Director of FWS for review and approval. GAO found that WSFR's grant award process is consistent with federal regulations for awarding federal grants.
WSFR monitors its competitive grants by reviewing financial and performance reports submitted by grant recipients. In general, this process is consistent with relevant regulations, but some of the performance reports were missing required information. Specifically, for fiscal year 2015 grants GAO reviewed, financial and performance reports were generally submitted on time by grant recipients, but several performance reports (9 of 51) did not include a comparison of actual accomplishments to the goals of the grant, as required by regulations. WSFR does not have a template for grant recipients to follow in preparing these reports for most of the grant programs, and the template used by one region does not clearly ask for all required information. WSFR officials have said the agency plans to develop a more standardized reporting process but no timeline has been established. According to Standards for Internal Control in the Federal Government , management should design control activities to achieve objectives and respond to risks, including designing mechanisms to help monitor performance. Without a template or standardized method that facilitates the collection of performance information, WSFR grant recipients may continue to submit performance reports that are missing information needed by FWS to monitor its competitive grant programs.

What GAO Recommends

GAO recommends that FWS develop a template or other standardized method to facilitate collection of all required information for grant performance reports. The Department of the Interior concurred with this recommendation.


Question:
Why GAO Did This Study

VA spends billions every year to procure goods and services and is required to give preference to veteran-owned small businesses when awarding contracts—a program known as Veterans First. In turn, those firms must comply with limitations on the use of subcontracting. A 2006 statute established Veterans First, and a 2016 Supreme Court decision clarified conflicting interpretations, resulting in changes to how VA must now implement the program.
GAO was asked to review VA's implementation of Veterans First since the Supreme Court decision. Among other things, this report assesses the extent to which (1) changes occurred in procurement obligations to veteran-owned small businesses from fiscal years 2014 through 2017; (2) VA has encountered any challenges in implementing Veterans First policies; and (3) VA has mechanisms to oversee contractor compliance with subcontracting limitations.
GAO analyzed VA regulations, policies, and contracting data; conducted three site visits; and reviewed a non-generalizable sample, selected based on factors such as high dollar value, of 35 contracts and orders, 29 of which VA awarded under Veterans First.

What GAO Found

GAO found that the percentage of Department of Veterans Affairs (VA) obligations set aside for veteran-owned small businesses under its Veterans First program was higher in 2017—the first full year following the 2016 Supreme Court decision—than in previous years. In its decision, the court clarified that VA contract competitions must be restricted to these businesses if they meet two criteria: (1) the contracting officer reasonably expects that at least two such businesses will submit offers, and (2) the award can be made at a fair and reasonable price and best value to the government. This has become known as the “VA Rule of Two.” VA created a new policy for implementing Veterans First following the 2016 decision. The percentage of obligations set aside for veteran-owned small businesses increased from fiscal years 2014 to 2017 (see figure).
Contracting officers face challenges implementing aspects of Veterans First, some of which VA has addressed through policy and optional training. However, 12 of the 30 contracting officers GAO interviewed cited difficulty in assessing the second criterion of the VA Rule of Two when making a set-aside decision. Eight of them stated that they sometimes lacked confidence in their fair and reasonable price determinations. VA's training, however, does not fully address these more challenging aspects of implementing the Veterans First policy. More targeted training would provide VA with greater assurance that its contracting officers have the knowledge and skills necessary to implement the policy. Additionally, assessing whether training on this policy should be mandatory would allow VA to determine if it would be beneficial for all contracting officers.
GAO found that VA conducts limited oversight of contractor compliance with limitations on subcontracting and has few mechanisms for ensuring compliance. For example, GAO found that the required clause for ensuring that veteran-owned small business contractors perform the required portion of work was either missing entirely or an outdated version was used in 11 of the 29 set-aside contract actions GAO reviewed. Without better oversight, VA is limited in its ability to detect violations and ensure that the goal of Veterans First—to promote opportunities for veteran-owned small businesses—is not undermined.

What GAO Recommends

GAO is making six recommendations, including that VA provide more targeted training for contracting officers, assess whether training should be mandatory, ensure required clauses are included in contracts, and improve oversight of compliance with subcontracting limitations. VA agreed with GAO's recommendations.


Question:
Why GAO Did This Study

The Great Lakes-Seaway system extends 2,300 miles and serves more than 100 ports in the United States and Canada. Four of the 17 locks that enable navigation are managed by the Army Corps (within the Department of Defense) and U.S. Seaway Corporation (within the Department of Transportation). The rest are managed by Canada. A 2007 U.S.-Canada study noted the system could absorb additional traffic and led to U.S. asset renewal plans to improve lock infrastructure condition.
GAO was asked to review efforts to modernize the Great Lakes-Seaway. This report examines (1) shipping trends since 1980 and factors affecting recent trends, (2) stakeholder views on challenges to use, and (3) the extent to which the Army Corps and the U.S. Seaway Corporation have made progress on and measure performance of lock renewal efforts. GAO analyzed Seaway and Army Corps shipping data from 1980 through 2016, the agencies' asset renewal plans, and interviewed 24 stakeholders, including port and shipper representatives, selected to represent a range of perspectives.

What GAO Found

The tons of cargo moved by domestic Great Lakes and St. Lawrence Seaway traffic have declined since 1980—by 32 and 48 percent, respectively, according to U.S. Army Corps of Engineers (Army Corps) and Saint Lawrence Seaway Development Corporation (U.S. Seaway Corporation) data. Stakeholders identified various factors for this decrease such as the U.S. economy's shift away from manufacturing. Traffic on the Great Lakes-St. Lawrence Seaway (Great Lakes-Seaway) is traditionally dominated by bulk commodities like iron ore, although stakeholders noted emerging uses like containerized cargo and cruises.
Stakeholders identified a range of challenges to using the Great Lakes- Seaway—such as inadequate portside infrastructure for intermodal transfers of shipping containers—that together pose risks for both traditional bulk cargos and emerging uses. Although the U.S. Seaway Corporation's mission is to improve the system's utilization and reliability, the Corporation has not fully assessed the risks that challenges pose to the system's users. Establishing a process to assess and monitor risks, in accordance with federal internal control standards, would help inform future actions to address identified and emerging challenges.
The U.S. Seaway Corporation and the Army Corps have made progress on lock asset renewal efforts, but the Army Corps lacks goals and measures to assess performance and outcomes of these efforts. According to estimates provided by the Army Corps, it has completed 18 projects totaling about $53 million to date, and has about $257 million in remaining and ongoing work through 2035. Meanwhile, the U.S. Seaway Corporation has completed 16 projects totaling $45 million and has almost $144 million in remaining and ongoing work through 2023. The Army Corps has not developed goals and measures to assess its asset renewal results, as the U.S. Seaway Corporation has done. As a result, the Army Corps lacks tools to assess the outcomes of these efforts and demonstrate the extent to which its asset renewal efforts have improved operational performance of the Soo Locks.

What GAO Recommends

GAO recommends that (1) the U.S. Seaway Corporation establish a process to identify, analyze, and monitor risks to the system's use to inform future actions, and (2) the Army Corps develop and adopt goals and measures to assess the performance of the Soo Locks and assess of asset renewal outcomes. The Departments of Transportation and Defense concurred with our recommendations and provided technical comments which we incorporated as appropriate.