Question:
Why GAO Did This Study

DOD spends billions of dollars annually to maintain business functions that support the warfighter. Many of these functions are performed by the DAFAs—DOD's 19 defense agencies and 8 field activities intended to provide department-wide consolidated support functions. GAO has previously identified instances of fragmentation, overlap, and duplication among the DAFAs.
Senate Report 115-125, accompanying a bill for the National Defense Authorization Act for Fiscal Year 2018, included a provision that GAO review the DAFAs. This report evaluates the extent to which (1) DOD has assessed the continuing need for each DAFA; (2) any overlap or fragmentation among the DAFAs that provide human resources services has affected service delivery; and (3) DOD has monitored and evaluated the results of its efficiency initiatives that affect the DAFAs. GAO reviewed legal requirements, assessed prior DOD reports, and analyzed DOD's human resources activities and documentation tracking past efficiency initiatives.

What GAO Found

The Department of Defense (DOD) does not comprehensively or routinely assess the continuing need for its defense agencies and DOD field activities (DAFAs). DOD was statutorily required to review the services and supplies each DAFA provides to ensure there is a continuing need for each and that the provision of services and supplies by each DAFA, rather than by the military departments, is more effective, economical, or efficient. A DOD directive requires the recording of the review. DOD previously issued biennial reports to Congress to record its review. Since 2012, DOD has relied on existing processes to fulfill the requirement; such as the annual budget process and the day-to-day management of the DAFAs. However, DOD did not provide sufficient evidence that these processes satisfy the statute. For example, while DOD reviews the DAFAs during the budget process, it does not specifically review the provision of services by the DAFAs rather than the military departments. Further, DOD does not have internal guidance that provides clear direction for conducting and recording its response to the statutory requirement. Without such guidance, DOD is limited in its ability to clearly define or target the scope of its reviews and any resulting reports. As such, DOD and congressional decision makers may not have reasonable assurance of a continuing need for the DAFAs, or that the provision of services and supplies is effective, economical, and efficient.
There is fragmentation and overlap within the DAFAs that provide human resources services to other defense agencies or organizations within DOD. At least six DOD organizations, including three DAFAs, perform human resources services for other parts of the department. One DAFA receives human resources services from all six organizations. This has resulted in negative effects, such as inconsistent performance information regarding hiring, fragmented information technology systems, and inefficiencies associated with overhead costs. For example, DOD officials stated that there are over 800 fragmented information technology systems used to store and record training records across the department, which are costly to maintain. DOD established a reform team to reduce inefficiencies within this business function. However, the team lacks comprehensive information on overhead costs that could guide reform and does not have time frames or deliverables for completing certain reform initiatives. With consistent human resource performance information, comprehensive information on overhead costs, and clear time frames in place, the team would be better positioned to thoroughly assess the department's system for human resources service delivery and develop and implement long-term solutions for better coordination or consolidation of this function.
DOD has taken some steps to monitor and evaluate the results of key efficiency initiatives that affect the DAFAs. However, DOD has not always established baselines or performed ongoing monitoring of its initiatives. Further, DOD has focused on whether steps have been taken, rather than outcomes achieved. For example, DOD did not evaluate whether a prior efficiency initiative called the Core Business Process Review achieved any of its intended savings or led to expected efficiencies. Without ensuring that efficiency initiatives are fully monitored and evaluated against established baselines over time, DOD lacks a systematic basis for evaluating whether its various initiatives have improved the efficiency or effectiveness of its programs or activities.

What GAO Recommends

GAO is making five recommendations, including for DOD to develop internal guidance to conduct and record its reviews of DAFAs; collect consistent performance information and comprehensive overhead cost information; establish time frames and deliverables for key reform efforts; and ensure routine and comprehensive monitoring and evaluation of ongoing efficiency initiatives. DOD concurred with GAO's recommendations.


Question:
Why GAO Did This Study

Misuse of prescription opioids can lead to overdose and death. Medicare and Medicaid, two of the nation's largest health care programs, provide prescription drug coverage that can include opioids. GAO and others have reported on inappropriate activities and risks associated with these prescriptions.
This statement is based on GAO's October 2017 report (GAO-18-15) and discusses (1) CMS oversight of Medicare beneficiaries who receive opioid prescriptions under Part D, and (2) CMS oversight of providers who prescribe opioids to Medicare Part D beneficiaries. For the October 2017 report, GAO reviewed CMS opioid utilization and prescriber data, CMS guidance for plan sponsors, and CMS's strategy to prevent opioid misuse. GAO also interviewed CMS officials, the six largest Part D plan sponsors, and 12 national associations selected to represent insurance plans, pharmacy benefit managers, physicians, patients, and regulatory and law enforcement authorities.

What GAO Found

In October 2017, GAO found that the Centers for Medicare & Medicaid Services (CMS) provided guidance on the monitoring of Medicare beneficiaries who received opioid prescriptions to plan sponsors—private organizations that implement the Medicare drug benefit, Part D—but it lacked information on most beneficiaries at risk of harm from opioid use. Specifically, GAO found that
CMS provided guidance to plan sponsors on how they should monitor opioid overutilization among Medicare Part D beneficiaries, and required them to implement drug utilization review systems that use criteria similar to CMS's. Prior to 2018, the agency's criteria focused on beneficiaries who did all the following: (1) received prescriptions of high doses of opioids, (2) received prescriptions from four or more providers, and (3) filled prescriptions at four or more pharmacies. According to CMS, this approach focused actions on beneficiaries the agency determined to have the highest risk of harm. For 2018, CMS revised the criteria to include more at-risk beneficiaries.
CMS's criteria, including recent revisions, did not provide sufficient information about the larger population of potentially at-risk beneficiaries. CMS estimated that, in 2015, 727,016 beneficiaries would have received high doses of opioids regardless of the number of providers or pharmacies, but only 33,223 would have met its revised criteria. In 2016, CMS began to collect information on some of these beneficiaries using a higher dosage threshold for opioid use. However, based on Centers for Disease Control and Prevention guidelines, CMS's approach also missed some who could be at risk of harm. As a result, CMS had limited information to assess progress against the goals of the Medicare and Medicaid programs' Opioid Misuse Strategy, which includes activities to reduce risk of harm to beneficiaries.
CMS provided oversight on prescribing of drugs at high risk of abuse through a variety of projects, but did not analyze data specifically on opioids. According to CMS officials, CMS and plan sponsors identified providers who prescribed large amounts of drugs with a high risk of abuse, and those suspected of fraud or abuse may be referred to law enforcement. However, GAO found that CMS did not identify providers who may be inappropriately prescribing large amounts of opioids separately from other drugs, and did not require plan sponsors to report actions they take when they identified such providers. As a result, CMS lacked information that it could use to assess how opioid prescribing patterns are changing over time, and whether its efforts to reduce harm are effective.

What GAO Recommends

In the October 2017 report, GAO made three recommendations that CMS (1) gather information on the full number of at-risk beneficiaries receiving high doses of opioids, (2) identify providers who prescribe high amounts of opioids, and (3) require plan sponsors to report to CMS on actions related to providers who inappropriately prescribe opioids. HHS concurred with the first two recommendations, but not with the third. GAO continues to believe the recommendation is valid, as discussed in the report and in this statement.


Question:
Why GAO Did This Study

Medicare covered over 58 million people in 2017 and has wide-ranging impact on the health-care sector and the overall U.S. economy. However, the billions of dollars in Medicare outlays as well as program complexity make it susceptible to improper payments, including fraud. Although there are no reliable estimates of fraud in Medicare, in fiscal year 2017 improper payments for Medicare were estimated at about $52 billion. Further, about $1.4 billion was returned to Medicare Trust Funds in fiscal year 2017 as a result of recoveries, fines, and asset forfeitures.
In December 2017, GAO issued a report examining how CMS managed its fraud risks overall and particularly the extent to which its efforts in the Medicare and Medicaid programs aligned with GAO's Framework. This testimony, based on that report, discusses the extent to which CMS's management of fraud risks in Medicare aligns with the Framework. For the report, GAO reviewed CMS policies and interviewed officials and external stakeholders.

What GAO Found

In its December 2017 report, GAO found that the Centers for Medicare & Medicaid Services' (CMS) antifraud efforts for Medicare partially align with GAO's 2015 A Framework for Managing Fraud Risks in Federal Programs (Framework). The Fraud Reduction and Data Analytics Act of 2015 required OMB to incorporate leading practices identified in this Framework in its guidance to agencies on addressing fraud risks.
Consistent with the Framework, GAO determined that CMS had demonstrated commitment to combating fraud by creating a dedicated entity to lead antifraud efforts; the Center for Program Integrity (CPI) serves as this entity for fraud, waste, and abuse issues in Medicare. CMS also promoted an antifraud culture by, for example, coordinating with internal stakeholders to incorporate antifraud features into new program design. To increase awareness of fraud risks in Medicare, CMS offered and required training for stakeholder groups such as providers of medical services, but it did not offer or require similar fraud-awareness training for most of its workforce.
CMS took some steps to identify fraud risks in Medicare; however, it had not conducted a fraud risk assessment or designed and implemented a risk-based antifraud strategy for Medicare as defined in the Framework. CMS identified fraud risks through control activities that target areas the agency designated as higher risk within Medicare, including specific provider types, such as home health agencies. Building on earlier steps and conducting a fraud risk assessment, consistent with the Framework, would provide the detailed information and insights needed to create a fraud risk profile, which, in turn, is the basis for creating an antifraud strategy.
CMS established monitoring and evaluation mechanisms for its program-integrity control activities that, if aligned with an antifraud strategy, could enhance the effectiveness of fraud risk management in Medicare. For example, CMS used return-on-investment and savings estimates to measure the effectiveness of its Medicare program-integrity activities. In developing an antifraud strategy, consistent with the Framework, CMS could include plans for refining and building on existing methods such as return-on-investment, to evaluate the effectiveness of all of its antifraud efforts.

What GAO Recommends

In its December 2017 report, GAO made three recommendations, namely that CMS (1) require and provide fraud-awareness training to its employees; (2) conduct fraud risk assessments; and (3) create an antifraud strategy for Medicare, including an approach for evaluation. The Department of Health and Human Services agreed with these recommendations and reportedly is evaluating options to implement them. Accordingly, the recommendations remain open.


Question:
Why GAO Did This Study

Government-wide estimated improper payments totaled almost $1.4 trillion from fiscal year 2003 through fiscal year 2017. IPERA requires IGs to annually assess and report on whether executive branch agencies complied with the six criteria to (1) publish an agency financial report or performance accountability report, (2) conduct program-specific improper payment risk assessments, (3) publish improper payment estimates, (4) publish corrective action plans, (5) publish and meet annual improper payment reduction targets, and (6) report a gross improper payment rate of less than 10 percent.
This report examines the extent to which
1. CFO Act agencies complied with IPERA criteria for fiscal years 2016 and 2017, and the trends evident since 2011, as reported by their IGs;
2. CFO Act agencies addressed requirements for programs reported as noncompliant with IPERA criteria for 3 or more consecutive years, as of fiscal year 2016, and communicated their strategies to Congress for reducing improper payments and achieving compliance; and
3. OMB made determinations regarding whether additional funding would help CFO Act agency programs reported as noncompliant with IPERA criteria for 2 consecutive years, as of fiscal years 2016 and 2017, come into compliance.
GAO analyzed the IGs' fiscal years 2016 and 2017 IPERA compliance reports; reviewed prior GAO reports on agencies' IPERA compliance; reviewed agency information submitted to Congress; and made inquiries to OMB, applicable agencies, and IGs; and assessed such information based on relevant IPERA provisions and OMB and other guidance.

What GAO Found

Over half of the 24 Chief Financial Officers Act of 1990 (CFO Act) agencies were reported by their inspectors general (IG) as noncompliant with one or more criteria under the Improper Payments Elimination and Recovery Act of 2010 (IPERA) for fiscal years 2016 and 2017. Nine CFO Act agencies have been reported as noncompliant in one or more programs every year since the implementation of IPERA in fiscal year 2011, totaling 7 consecutive years of noncompliance.
The IGs of the 14 noncompliant agencies reported that a total of 58 programs were responsible for the identified instances of noncompliance in fiscal year 2017. Further, 18 of the 58 programs at 9 agencies were reported as noncompliant for 3 or more consecutive years. Fourteen of these 18 programs accounted for an estimated $74.4 billion of the $141 billion total estimated improper payments for fiscal year 2017; the other 4 programs did not report improper payment estimates. This sum may include estimates that are of unknown reliability. The $74.4 billion is primarily composed of estimates reported for two noncompliant programs, the Department of Health and Human Services' Medicaid program and the Department of the Treasury's (Treasury) Earned Income Tax Credit program; estimated improper payments for these two programs are also a central part of certain high-risk areas in GAO's 2017 High-Risk List.
Agencies with any program reported as noncompliant for 3 or more consecutive years are required to notify Congress of their program's consecutive noncompliance and submit a proposal for reauthorization or statutory change to bring that program into compliance. GAO found that three agencies with one or more programs reported as noncompliant for 3 or more consecutive years, as of fiscal year 2016, did not notify Congress or submit the required proposals. The Departments of Labor and the Treasury submitted proposed legislative changes in response to their programs being previously reported as noncompliant, but did not notify Congress of the programs' continued noncompliance as of fiscal year 2016. The U.S. Department of Agriculture (USDA) has not notified Congress despite prior GAO and USDA IG recommendations to do so. To address these issues, in June 2018 the Office of Management and Budget (OMB) updated its guidance to clarify the notification requirements for each consecutive year a program is reported as noncompliant.
GAO found that five agencies did notify Congress as required, and included additional quality information that is not specifically required, but could be useful in updating Congress on their compliance efforts. For example, all five agencies provided information on the root causes, risks, changes, or issues affecting their efforts and corrective actions or strategies to address them; three agencies provided other quality information on accountability mechanisms, designated senior officials, and measurable milestones.
In June 2018, OMB updated its guidance to clarify agency reporting requirements for programs reported as noncompliant for 3 or more consecutive years. However, the updated guidance does not direct agencies to include the types of quality information included in these five agencies' notifications for fiscal year 2016. GAO's Standards for Internal Control in the Federal Government emphasizes the importance of communicating quality information, such as significant matters affecting agencies' efforts to achieve compliance objectives. Such information could be useful in understanding the current challenges of these programs and is essential for assessing agency efforts to address high-risk and other issues. As a result, Congress could have more complete information to effectively oversee agency efforts to address program noncompliance for 3 or more consecutive years.
When programs are reported as noncompliant for 2 consecutive years, IPERA gives OMB authority to determine whether additional funding is needed to help resolve the noncompliance. In April 2018, OMB staff stated that they determined that no additional funding was needed for the 15 programs that were reported as noncompliant for 2 consecutive years, as of fiscal year 2016, and that they primarily rely on the IGs' recommendations in their annual IPERA compliance reports when making funding determinations. OMB staff subsequently stated that they no longer need to conduct a detailed review of the IGs' IPERA compliance reports to identify recommendations related to additional funding needs. Instead, OMB updated its guidance in June 2018 to direct agencies to submit proposals to OMB regarding additional funding needs to help address IPERA noncompliance and clarified that the funding determination process will unfold as part of the annual development of the President's Budget. As of September 2018, OMB was in the process of making funding determinations for 12 programs that were reported as noncompliant as of fiscal year 2017 and stated that any determinations made would be developed in the President's Budget for fiscal year 2020.

What GAO Recommends

GAO recommends that OMB update its guidance to specify other types of quality information that agencies with programs noncompliant for 3 or more consecutive years should include in their notifications to Congress, such as significant matters related to risks, issues, root causes, measurable milestones, designated senior officials, accountability mechanisms, and corrective actions or strategies planned or taken by agencies to achieve compliance.
GAO provided a draft of this report to OMB and requested comments, and OMB said that it had no comments. GAO also provided a draft of this report to the 24 CFO Act agencies and their IGs and requested comments. In its written comments, the Social Security Administration (SSA) stated that it provided information on measurable milestones, designated senior officials, and accountability mechanisms in its agency financial report. However, SSA did not provide this information in its notifications to Congress for programs reported as noncompliant under IPERA as of fiscal year 2016. GAO believes that OMB should take steps to update OMB's guidance to help ensure that agencies report such significant information and include it in their notifications to Congress. In addition, several agencies and IGs provided technical comments, which were incorporated in the report as appropriate.


Question:
Why GAO Did This Study

This testimony summarizes the information contained in GAO's September 2017 report, entitled Navy and Marine Corps Training: Further Planning Needed for Amphibious Operations Training ( GAO-17-789 ).

What GAO Found

Navy and Marine Corps units that are deploying as part of an Amphibious Ready Group and Marine Expeditionary Unit (ARG-MEU) completed their required training for amphibious operations, but other Marine Corps units have been limited in their ability to conduct training for other amphibious operations–related priorities. GAO found that several factors, to include the decline in the fleet of the Navy's amphibious ships from 62 in 1990 to 31 today limited the ability of Marine Corps units to conduct training for other priorities, such as recurring training for home-station units (see figure). As a result, training completion for amphibious operations was low for some but not all Marine Corps units from fiscal years 2014 through 2016. The services have taken steps to address amphibious training shortfalls, such as more comprehensively determining units that require training. However, these efforts are incomplete because the services do not have an approach to prioritize available training resources, evaluate training resource alternatives, and monitor progress towards achieving priorities. Thus, the services are not well positioned to mitigate any training shortfalls.
The Navy and Marine Corps have taken some steps to improve coordination between the two services, but have not fully incorporated leading collaboration practices to improve integration of the two services—naval integration—for amphibious operations. For example, the Navy and Marine Corps have not defined and articulated common outcomes for naval integration that would help them align efforts to maximize training opportunities for amphibious operations.
The Marine Corps has taken steps to better integrate virtual training devices into operational training, but gaps remain in its process to develop and use them. GAO found that for selected virtual training devices, the Marine Corps did not conduct front-end analysis that considered key factors, such as the specific training tasks that a device would accomplish; consider device usage data to support its investment decisions; or evaluate the effectiveness of existing virtual training devices because of weaknesses in the service's guidance. As a result, the Marine Corps risks investing in devices that are not cost-effective and whose value to operational training is undetermined.


Question:
Why GAO Did This Study

Misuse of prescription opioids can lead to overdose and death. In 2016, over 14 million Medicare Part D beneficiaries received opioid prescriptions, and spending for opioids was almost $4.1 billion. GAO and others have reported on inappropriate activities and risks associated with these prescriptions, such as receiving multiple opioid prescriptions from different providers.
GAO was asked to describe what is known about CMS’s oversight of Medicare Part D opioid use and prescribing. This report examines (1) CMS oversight of beneficiaries who receive opioid prescriptions under Part D, and (2) CMS oversight of providers who prescribe opioids to Medicare Part D beneficiaries.GAO reviewed CMS opioid utilization and prescriber data, CMS guidance for plan sponsors, and CMS’s strategy to prevent opioid misuse. GAO also interviewed CMS officials, the six largest Part D plan sponsors, and 12 national associations selected to represent insurance plans, pharmacy benefit managers, physicians, patients, and regulatory and law enforcement authorities.

What GAO Found

The Centers for Medicare & Medicaid Services (CMS) provides guidance on the monitoring of Medicare beneficiaries who receive opioid prescriptions to plan sponsors—private organizations that implement the Medicare drug benefit, Part D—but lacks information on most beneficiaries at risk of harm.
CMS provides plan sponsors guidance on how they should monitor opioid overutilization among Medicare Part D beneficiaries and requires them to implement drug utilization review systems that use criteria similar to CMS's. CMS's criteria focus on beneficiaries who (1) receive prescriptions of high doses of opioids, (2) receive prescriptions from four or more providers, and (3) fill the prescriptions at four or more pharmacies. According to CMS officials, this approach allows plan sponsors to focus their actions on those beneficiaries it determined to have the highest risk of harm from opioid use.
CMS’s criteria, including recent revisions, do not provide sufficient information about the larger population of potentially at-risk beneficiaries. CMS estimates that while 33,223 beneficiaries would have met the revised criteria in 2015, 727,016 would have received high doses of opioids regardless of the number of providers or pharmacies. In 2016, CMS began to collect information on some of these beneficiaries using a higher dosage threshold for opioid use. This approach misses some who could be at risk of harm, based on Centers for Disease Control and Prevention guidelines. As a result, CMS is limited in its ability to assess progress toward meeting the broader goals of its Opioid Misuse Strategy, which includes activities to reduce the risk of harm from opioid use.
CMS Estimates of 2015 Part D Beneficiaries with High Opioid Doses and Those Who Would Have Met Revised Overutilization Monitoring Criteria
CMS oversees the prescribing of drugs at high risk of abuse through a variety of projects, but does not analyze data specifically on opioids. According to CMS officials, CMS and plan sponsors identify providers who prescribe large amounts of drugs with a high risk of abuse, and those suspected of fraud or abuse may be referred to law enforcement. However, GAO found that CMS does not identify providers who may be inappropriately prescribing large amounts of opioids separately from other drugs, and does not require plan sponsors to report actions they take when they identify such providers. As a result, CMS is lacking information that it could use to assess how opioid prescribing patterns are changing over time, and whether its efforts to reduce harm are effective.

What GAO Recommends

GAO recommends that CMS (1) gather information on the full number of at-risk beneficiaries receiving high doses of opioids, (2) identify providers who prescribe high amounts of opioids, and (3) require plan sponsors to report to CMS on actions related to providers who inappropriately prescribe opioids. HHS concurred with the first two recommendations, but not with the third. GAO continues to believe the recommendation is valid, as discussed in the report.


Question:
Why GAO Did This Study

In 2012 and 2015, DOT was provided with additional authority to oversee the safety of rail transit. Within DOT, FTA is now implementing this authority. The DOT's Office of Inspector General has reported, though, that FTA faces challenges in carrying out its enhanced safety oversight. FRA, also in DOT, has long carried out safety oversight of freight, intercity passenger, and commuter railroads.
GAO was asked to review various rail safety and oversight issues, including the differences between FRA's and FTA's rail safety oversight programs. This report examines (1) key characteristics of FRA's and FTA's rail safety oversight programs and (2) strengths and limitations of FRA's and FTA's rail safety oversight programs. GAO assessed FRA's and FTA's information about rail safety oversight activities against guidance from the Office of Management and Budget, leading practices developed by the transit industry, and federal standards for internal control. GAO also interviewed stakeholders, including rail operators chosen based on mode, size, and location.

What GAO Found

The Department of Transportation's (DOT) Federal Railroad Administration (FRA) and Federal Transit Administration (FTA) carry out different approaches to rail safety oversight. FRA has a more centralized safety oversight program for railroads, while FTA's program for oversight of rail transit safety largely relies on state safety agencies to monitor and enforce rail transit safety, as established in federal statute. Key characteristics of both programs include: (1) safety regulations, (2) inspections and other oversight activities, and (3) enforcement mechanisms to ensure that safety deficiencies are addressed (see figure).
There are strengths and limitations to FRA's and FTA's approaches to their safety oversight missions, including how the two agencies develop safety regulations, conduct inspections, and carry out enforcement. The National Transportation Safety Board has reported, and stakeholders GAO spoke with generally agreed, that strengths of FRA's rail safety oversight program include its safety regulations, its risk-based inspection program, and its enforcement authorities. FRA also has potential limitations in its oversight framework, though, such as difficulty evaluating the effectiveness of its enforcement mechanisms. FTA has made some progress implementing changes to the rail transit safety program. However, FTA has not provided all the necessary guidance and support to states' safety agencies to ensure they develop appropriate and effective rail transit safety inspection programs. In particular, FTA has not provided states with guidance on how to develop and implement risk-based inspection programs. Though FTA has said that it will develop such guidance, it does not have a plan or timeline to do so. Without guidance from FTA on how to develop and carry out risk-based inspections, state safety agencies may not allocate their limited resources efficiently, and important safety issues may go undetected. In addition, FTA has not developed a process or methodology to evaluate whether state safety agency enforcement authorities and practices are effective. Without clear evidence that state safety agencies' enforcement is effective, states and FTA may not be able to compel rail transit operators to remedy safety deficiencies. As a result, deficiencies may remain for long periods, potentially contributing to safety incidents.

What GAO Recommends

GAO recommends that FTA (1) create a plan, with timeline, for developing risk-based inspection guidance for state safety agencies, and (2) develop and communicate a method for how FTA will monitor whether state safety agencies' enforcement practices are effective. DOT agreed with our recommendations. DOT, NTSB, and WMATA provided technical comments that we incorporated as appropriate.


Question:
Why GAO Did This Study

Since the Sandy Recovery Improvement Act (SRIA) of 2013, federally recognized Indian tribes affected by major disasters have had the option to make disaster declaration requests directly to the President of the United States or join a state's request for federal disaster assistance. Prior to this, tribes had to receive assistance through a state.
GAO was asked to assess the implementation of this new authority. This report addresses (1) the factors that influenced selected tribes' decisions about how to seek federal disaster assistance, and (2) the actions FEMA has taken to help tribes exercise the new authority.
GAO analyzed FEMA's pilot guidance for tribal declarations and interviewed FEMA and tribal emergency management experts. GAO also surveyed the 36 tribes who made requests for disaster assistance in fiscal years 2013-2016 about the factors that influenced their decision making. Twenty three tribes responded. GAO visited seven tribes selected from among the survey respondents to represent different FEMA regions and disaster types. The site visits cannot be generalized but provided valuable insights into the opportunities and challenges of exercising this new authority.

What GAO Found

According to tribal officials GAO surveyed and interviewed, there are several factors they considered when deciding whether to make a direct request or to join a state's request for a major disaster declaration. Key factors that tribes reported considering were the (1) importance of tribal sovereignty, (2) financial matters such as the timeliness with which they receive funds, (3) the level of support they anticipated receiving from the Federal Emergency Management Agency (FEMA), and (4) their own emergency management capacity. For example, survey results showed that tribal officials' confidence in their capacity to manage the declaration was a key factor in determining whether to make a request directly. Specifically, various elements of emergency management capacity, as illustrated below, could affect tribes' ability to manage a declaration.
FEMA has developed pilot guidance for tribal declarations and solicited comments from tribes, as part of its effort to consider the needs of tribes and develop regulations. According to FEMA officials, they are currently assessing the effectiveness of policies and procedures based on data collected from tribal declarations since the passage of SRIA. These officials said they intend to begin the rulemaking process as soon as 2 years into the pilot, but may delay if they cannot collect enough data about different disaster situations during that time to conduct a complete analysis. Until the regulations are final, officials say they will exercise flexibility whenever possible. In addition, the agency offers training on the tribal declaration process and has dedicated staff who act as primary points of contact for tribal governments that require technical assistance.

What GAO Recommends

GAO is not making any recommendations in this report.


Question:
Why GAO Did This Study

The Office of Commercial Space Transportation, which regulates and promotes the U.S. commercial space launch industry, was established in 1984 within the Office of the Secretary of Transportation and transferred to FAA in 1995. In 2015, GAO reported that the Office of Commercial Space Transportation faced challenges associated with the growth of the commercial space launch industry such as licensing more launches. To help meet these and other challenges such as updating regulations, some industry stakeholders and others suggested that the Office of Commercial Space Transportation should be moved back to the Office of the Secretary of Transportation.
GAO was asked to review issues regarding transferring the Office of Commercial Space Transportation from FAA to the Office of the Secretary of Transportation. This report addresses: (1) selected stakeholders' and officials' perspectives on transferring the Office of Commercial Space Transportation from FAA to the Office of the Secretary of Transportation, (2) what steps would be required to make this transfer, and (3) key practices and considerations GAO has previously identified for organizational changes that could be instructive for such a transfer. GAO interviewed industry stakeholders and FAA and DOT officials, reviewed the steps taken during the office's 1995 transfer, and reviewed prior reports on key practices and questions to consider regarding organizational changes.
GAO is making no recommendations in this report.

What GAO Found

Representatives from commercial space launch companies and spaceports GAO interviewed described advantages and disadvantages of moving the Office of Commercial Space Transportation to the Office of the Secretary of Transportation, but most of them favored moving the office. Conversely, most Federal Aviation Administration (FAA) officials GAO interviewed did not favor the idea. A senior official in the Office of Commercial Space Transportation said that there are advantages and disadvantages to moving the office and that whether such an action would be beneficial depends on the implementation details and the administration's preferences. Officials from the Office of the Secretary of Transportation said they currently do not have plans to move the office. Stakeholders' and officials' perspectives are based on what they perceive could occur as a result of a move, for example:
Communication and coordination: Department of Transportation (DOT) officials said that a possible advantage of moving the office would be having a unified point of contact for the industry in communicating about commercial space launch issues, while FAA officials said that moving the office could make it more difficult for FAA offices to coordinate on commercial space activities.
Regulations: Some stakeholders said that moving the office could help accelerate the pace of commercial space regulatory reform, but DOT officials said that moving the office would not necessarily do so.
Resources: According to some stakeholders and a senior official in the Office of Commercial Space Transportation, moving the office out of FAA could give commercial space launch issues a higher profile and more resources because FAA is focused on aviation as opposed to commercial space. However, officials from the Office of the Secretary of Transportation said that it is uncertain whether the office would receive more resources if it were moved to the Secretary's office.
The Secretary of Transportation could move all or part of the office through a delegation of responsibilities for commercial space, as was the case in the prior move in 1995. If the office were moved, other necessary steps would include addressing the differences in pay scales between FAA and the Office of the Secretary of Transportation, obtaining support services and office space, and establishing new coordination and communication processes and procedures.
GAO's prior work has identified key practices and questions for consideration when evaluating proposals for or implementing organizational changes such as a consolidation or merger. These key practices include: (1) focusing on a key set of principles and priorities at the outset of the transformation, (2) setting implementation goals and a timeline to build momentum and show progress, and (3) establishing a communication plan. Questions to consider when evaluating consolidation proposals include (1) What are the goals of the consolidation? and (2) What will be the likely costs and benefits of the consolidation?


Question:
Why GAO Did This Study

The current federal legal framework governing buying and selling of firearms does not specifically address the use of the Internet to facilitate these transactions. Additionally, private transactions involving the most-common types of firearms between individuals who are not licensed to commercially sell weapons and who are residents of the same state, including transactions facilitated by the Internet, are generally not subject to federal background-check requirements.
Congressional requesters asked that GAO assess the extent to which ATF is enforcing existing laws and investigate whether online private sellers sell firearms to people who are not allowed or eligible to possess a firearm. This report describes (1) techniques ATF uses to investigate and enforce generally applicable firearm laws in instances where the firearm or firearm-component transaction is facilitated by the Internet and (2) results of GAO's undercover attempts to buy firearms on the Dark Web and Surface Web.
GAO analyzed documents and interviewed officials to identify actions ATF has taken to prohibit illegal firearm transactions. GAO also attempted to purchase firearms from Dark Web and Surface Web marketplaces. The results of the testing are illustrative and nongeneralizable.

What GAO Found

The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) is responsible for investigating criminal and regulatory violations of firearms statutes and regulations that govern firearms transactions, including sales that are facilitated by the Internet. Two components of the Internet may be used to facilitate Internet firearm sales: the Surface Web and the Dark Web. The Surface Web is searchable with standard web search engines. The Dark Web contains content that has been intentionally concealed and requires specific computer software to gain access. ATF created the Internet Investigations Center (Center) to investigate buyers and sellers who use the Internet to facilitate illegal firearms transactions. The Center uses several tools to provide investigative support to ATF, which has resulted in the arrests of individuals using the Internet to facilitate illegal firearm purchases. ATF officials with the Center also noted that investigations might involve both the Surface Web and the Dark Web. For example, to identify an anonymous user on the Dark Web, the Center works to establish a user's “digital footprint” on the Surface Web.
In 2016, the Center also issued a report about Internet firearm transactions. This and other ATF reports highlighted the following about Internet-facilitated firearm transactions:
The relative anonymity of the Internet makes it an ideal means for prohibited individuals to obtain illegal firearms.
The more anonymity employed by a firearms purchaser, the greater the likelihood that the transaction violates federal law.
Firearm transactions that occur on the Dark Web are more likely to be completed in person or via the mail or common carrier, versus through a Federal Firearm Licensee.
GAO agents attempted to purchase firearms from Dark Web and Surface Web marketplaces. Agents made seven attempts to purchase firearms on the Dark Web. In these attempts, agents did not disclose any information about whether they were prohibited from possessing a firearm. Of these seven attempts, two on a Dark Web marketplace were successful. Specifically, GAO agents purchased and received an AR-15 rifle and an Uzi that the seller said was modified so that it would fire automatically. GAO provided referral letters to applicable law-enforcement agencies for these purchases to inform any ongoing investigations.
Tests performed on the Surface Web demonstrated that private sellers GAO contacted on gun forums and other classified ads were unwilling to sell a firearm to an individual who appeared to be prohibited from possessing a firearm. Of the 72 attempts agents made to purchase firearms on the Surface Web, 56 sellers refused to complete a transaction: 29 sellers stated they would not ship a firearm and 27 refused after the disclosure of the undercover identities' stated prohibited status. Furthermore, in 5 of these 72 attempts, the accounts GAO set up were frozen by the websites, which prevented the agents from using the forums and attempting to make a purchase.

What GAO Recommends

GAO is not making recommendations in this report. ATF provided technical comments, which GAO incorporated as appropriate.


Question:
Why GAO Did This Study

Since 1993, the U.S. government has committed more than $5 billion in bilateral assistance to the Palestinians in the West Bank and Gaza. According to the Department of State, this assistance to the Palestinians promotes U.S. economic and political foreign policy interests by supporting Middle East peace negotiations and financing economic stabilization programs. USAID is primarily responsible for administering ESF assistance to the West Bank and Gaza.
Appropriations acts for fiscal years 2015 and 2016 included provisions for GAO to review the treatment, handling, and uses of funds provided through the ESF for assistance to the West Bank and Gaza. This report examines (1) the status of ESF assistance and projects provided to the West Bank and Gaza for fiscal years 2015 and 2016, including project assistance and payments to PA creditors, and (2) the extent to which USAID conducted required vetting of PA creditors to ensure that this assistance would not support entities or individuals associated with terrorism and assessed PA ministries' capacity to use ESF assistance as intended. GAO reviewed relevant laws and regulations and USAID financial data, policies, procedures, and documents. GAO also interviewed USAID and State Department officials.

What GAO Found

As of March 2018, the U.S. Agency for International Development (USAID) had allocated about $545 million of funding appropriated to the Economic Support Fund (ESF) for assistance in the West Bank and Gaza for fiscal years 2015 and 2016. USAID obligated about $544 million (over 99 percent) and expended about $351 million (over 64 percent) of the total allocations. Project assistance accounted for approximately $399 million of the obligated funds, while payments to Palestinian Authority (PA) creditors accounted for $145 million (see figure). USAID's obligations for project assistance in the West Bank and Gaza for fiscal years 2015 and 2016 supported three development objectives—Economic Growth and Infrastructure ($239 million), Investing in the Next Generation ($107 million), and Governance and Civic Engagement (about $25 million). In fiscal years 2015 and 2016, USAID made payments directly to PA creditors—two Israeli fuel companies, to cover debts for petroleum purchases, and a local Palestinian bank, to pay off a line of credit used for PA medical referrals to six hospitals in the East Jerusalem Hospital network.
USAID vetted PA creditors to ensure that the program assistance would not provide support to entities or individuals associated with terrorism and also conducted external assessments and financial audits of PA ministries of Health and Finance and Planning. USAID documentation showed that, as required, officials checked the vetting status of each PA creditor within 12 months before USAID signed its debt relief grant agreements with the PA. In addition, although USAID determined that it was not legally required to assess the PA Ministry of Health's medical referral services and the Ministry of Finance and Planning's petroleum procurement system, the agency commissioned external assessments of both ministries. These assessments found some weaknesses in both ministries' systems; however, USAID mission officials stated that these weaknesses did not affect USAID debt relief payments to the PA creditors. Nevertheless, USAID took additional steps to mitigate the identified weaknesses. For example, a USAID contractor worked with the Ministry of Health to update, revise, and approve guidelines for medical referrals. In addition, USAID commissioned financial audits of the debt relief grant agreements between USAID and the PA for direct payments to PA creditors in fiscal year 2015 and 2016. The audits did not identify any ineligible costs, reportable material weaknesses in internal control, or material instances of noncompliance with the terms of the agreements.

What GAO Recommends

GAO is not making recommendations in this report.


Question:
Why GAO Did This Study

To maintain heavy polar icebreaking capability, the Coast Guard and the Navy are collaborating to acquire up to three new heavy polar icebreakers through an integrated program office. The Navy plans to award a contract in 2019. GAO has found that before committing resources, successful acquisition programs begin with sound business cases, which include plans for a stable design, mature technologies, a reliable cost estimate, and a realistic schedule.
Section 122 of the National Defense Authorization Act for Fiscal Year 2018 included a provision for GAO to assess issues related to the acquisition of the icebreaker vessels. In addition, GAO was asked to review the heavy polar icebreaker program's acquisition risks. This report examines, among other objectives, the extent to which the program is facing risks to achieving its goals, particularly in the areas of design maturity, technology readiness, cost, and schedule. GAO reviewed Coast Guard and Navy program documents, analyzed Coast Guard and Navy data, and interviewed knowledgeable officials.

What GAO Found

The Coast Guard—a component of the Department of Homeland Security (DHS)—did not have a sound business case in March 2018, when it established the cost, schedule, and performance baselines for its heavy polar icebreaker acquisition program, because of risks in four key areas:
Design. The Coast Guard set program baselines before conducting a preliminary design review, which puts the program at risk of having an unstable design, thereby increasing the program's cost and schedule risks. While setting baselines without a preliminary design review is consistent with DHS's current acquisition policy, it is inconsistent with acquisition best practices. Based on GAO's prior recommendation, DHS is currently evaluating its policy to better align technical reviews and acquisition decisions.
Technology. The Coast Guard intends to use proven technologies for the program, but did not conduct a technology readiness assessment to determine the maturity of key technologies prior to setting baselines. Coast Guard officials indicated such an assessment was not necessary because the technologies the program plans to employ have been proven on other icebreaker ships. However, according to best practices, such technologies can still pose risks when applied to a different program or operational environment, as in this case. Without such an assessment, the program's technical risk is underrepresented.
Cost. The lifecycle cost estimate that informed the program's $9.8 billion cost baseline substantially met GAO's best practices for being comprehensive, well-documented, and accurate, but only partially met best practices for being credible. The cost estimate did not quantify the range of possible costs over the entire life of the program. As a result, the cost estimate was not fully reliable and may underestimate the total funding needed for the program.
Schedule. The Coast Guard's planned delivery dates were not informed by a realistic assessment of shipbuilding activities, but rather driven by the potential gap in icebreaking capabilities once the Coast Guard's only operating heavy polar icebreaker—the Polar Star —reaches the end of its service life (see figure).
GAO's analysis of selected lead ships for other shipbuilding programs found the icebreaker program's estimated construction time of 3 years is optimistic. As a result, the Coast Guard is at risk of not delivering the icebreakers when promised and the potential gap in icebreaking capabilities could widen.

What GAO Recommends

GAO is making six recommendations to the Coast Guard, DHS, and the Navy. Among other things, GAO recommends that the program conduct a technology readiness assessment, re-evaluate its cost estimate and develop a schedule according to best practices, and update program baselines following a preliminary design review. DHS concurred with all six of GAO's recommendations.


Question:
Why GAO Did This Study

An increasing number of Air Force missions use unmanned aerial systems, or RPAs, to provide their specialized capabilities in support of combat operations. The demand for crew members for these systems has grown rapidly. For example, RPA pilot requirements increased by 76 percent since fiscal year 2013 while those for fighter pilots stayed about the same. These requirements include pilots who serve in non-operational staff positions, such as trainers.
Senate Report 115-125 included a provision that GAO review career advancement for Air Force RPA pilots compared to other pilots. This report, among other things, describes (1) the rates that RPA and other pilots were promoted; (2) the rates that non-operational staff positions requiring RPA pilot expertise were assigned to various organizations, and (3) the extent to which the Air Force has reviewed its oversight process to effectively manage non-operational staff positions requiring aviator expertise.
Among other things, GAO analyzed Air Force pilot promotion data from 2006-2017. GAO also analyzed non-operational staff position data from fiscal years 2013-2018 and interviewed officials regarding the management and oversight of these positions.

What GAO Found

The promotion rates for Air Force Remotely Piloted Aircraft (RPA) pilots have been generally similar to those of other pilots since 2013 and have increased over time. See figure below for promotion rates from major to lieutenant colonel. Air Force officials stated that RPA pilot promotion rates increased because the creation of a dedicated career field resulted in more competitive candidates.
Since 2013, over 75 percent of non-operational staff positions requiring RPA pilot expertise were assigned to various organizations within the Air Force, according to GAO's analysis. These positions carry out support and other noncombat-related activities as well as training functions and are essential to the development of officers. However, the overall number of these positions that require a RPA pilot is about one-tenth of the combined number of those requiring other pilots. For example, in fiscal year 2018, 83 non-operational staff positions required RPA pilots compared to 330 requiring fighter pilots. Air Force officials stated that the small number of RPA positions is because the career field is new.
The Air Force has not reviewed its oversight process to ensure that it is efficiently managing its non-operational staff positions that require aviator expertise. Air Force officials explained that over the last 10 years, the Air Force reduced the number of squadrons but had not reviewed the number of non-operational staff positions. Similarly, the Air Force has had no widely accessible oversight process to monitor whether it had established an accurate number of non-operational staff positions required to support the new RPA career field. In August 2018, the Air Force identified 513 non-operational staff positions (out of 2,783) as needing further review because they lacked adequate justification of the need for aviator expertise. Officials described the process for managing these positions as time and labor intensive, which can cause delays in obtaining reliable information needed to inform decision-making. By reviewing this process, the Air Force may be able to identify opportunities to create efficiencies and more effectively manage its non-operational staff positions requiring aviator expertise.

What GAO Recommends

GAO recommends that the Air Force review its oversight process for managing the non-operational staff positions, including those for RPA pilots, to identify opportunities to increase efficiencies. DOD concurred with this recommendation.


Question:
Why GAO Did This Study

VA manages a $1.9 billion research program that has produced numerous healthcare inventions, such as the pacemaker. In 2000, VA created a program to help transfer VA inventions to the private sector so that they can be commercialized and used by veterans and the public, while VA retains ownership and collects royalties. Many of VA's 3,000 researchers also hold positions at universities, which take the lead in commercializing inventions developed by these researchers. Researchers and universities are required to disclose such inventions to VA, and universities are to report on commercialization activities according to their agreements with VA.
GAO was asked to examine VA's ability to ensure its ownership of inventions made with VA resources. This report examines, among other things, the extent to which VA has taken steps to ensure that (1) researchers disclose inventions and (2) universities report on commercialization activities for joint inventions. GAO reviewed laws; policies; a nongeneralizable sample of university agreements based on backlogs of disclosures, among other factors; and interviews with officials and researchers from VA medical centers and their affiliated universities.

What GAO Found

The Department of Veterans Affairs (VA) has taken steps to educate agency researchers about its requirements to disclose inventions to VA, but officials reported that researchers have not consistently done so. VA policy requires researchers to disclose inventions to both VA and the university they work for even when they do not use VA resources. GAO found, through discussions with VA officials and researchers, that several factors contribute to researchers not consistently disclosing their inventions, including that VA researchers may have:
disclosed inventions to their university, assuming the university would then disclose them to VA;
not been familiar with VA's invention disclosure process, because they may not have frequently developed inventions; or
thought that invention disclosure was unnecessary when they did not use VA resources to develop their invention.
In 2017, VA staff visited universities and VA medical centers 26 times to meet with researchers about invention disclosure. Also, VA created an online training course to educate researchers on the need to disclose inventions, but the training is not mandatory, and about 4 percent of researchers took it. Without mandatory training to communicate invention disclosure requirements—consistent with federal internal control standards for internally communicating quality information—VA researchers may not be fully informed about those requirements, which can result in lost technology transfer opportunities and royalties for VA.
VA has improved communication with universities but has not ensured that they are consistently reporting information on commercialization activities for joint inventions. VA reported that about three-quarters of VA's 79 university partners did not submit the annual reports required by VA in 2017. GAO reviewed a nongeneralizable sample of agreements VA has with universities and found that reporting requirements about timing and content of reports were unclear. Without providing a standardized method that clearly guides universities in fulfilling VA's reporting requirements, consistent with federal standards for internal control, VA cannot ensure that it has adequate information to account for its licenses and royalties.

What GAO Recommends

GAO recommends that VA (1) make training about invention disclosure mandatory and (2) provide universities with a standardized method for annual reporting. VA concurred with GAO’s recommendations.


Question:
Why GAO Did This Study

IT systems are essential to the operations of the federal government. The supply chain—the set of organizations, people, activities, and resources that create and move a product from suppliers to end users—for IT systems is complex and global in scope. The exploitation of vulnerabilities in the IT supply chain is a continuing threat. Federal security guidelines provide for managing the risks to the supply chain.
This testimony statement highlights information security risks associated with the supply chains used by federal agencies to procure IT systems. The statement also summarizes GAO's 2012 report that assessed the extent to which four national security-related agencies had addressed such risks. To develop this statement, GAO relied on its previous reports, as well as information provided by the national security-related agencies on their actions in response to GAO's previous recommendations. GAO also reviewed federal information security guidelines and directives.

What GAO Found

Reliance on a global supply chain introduces multiple risks to federal information systems. Supply chain threats are present during the various phases of an information system's development life cycle and could create an unacceptable risk to federal agencies. Information technology (IT) supply chain-related threats are varied and can include:
installation of intentionally harmful hardware or software (i.e., containing “malicious logic”);
installation of counterfeit hardware or software;
failure or disruption in the production or distribution of critical products;
reliance on malicious or unqualified service providers for the performance of technical services; and
installation of hardware or software containing unintentional vulnerabilities, such as defective code.
These threats can have a range of impacts, including allowing adversaries to take control of systems or decreasing the availability of materials needed to develop systems. These threats can be introduced by exploiting vulnerabilities that could exist at multiple points in the supply chain. Examples of such vulnerabilities include the acquisition of products or parts from unauthorized distributors; inadequate testing of software updates and patches; and incomplete information on IT suppliers. Malicious actors could exploit these vulnerabilities, leading to the loss of the confidentiality, integrity, or availability of federal systems and the information they contain.
GAO reported in 2012 that the four national security-related agencies in its review—the Departments of Defense, Justice, Energy, Homeland Security (DHS)—varied in the extent to which they had addressed supply chain risks. Of the four agencies, Defense had made the most progress addressing the risks. It had defined and implemented supply chain protection controls, and initiated efforts to monitor the effectiveness of the controls. Conversely, Energy and DHS had not developed or documented policies and procedures that defined security measures for protecting against IT supply chain threats and had not developed capabilities for monitoring the implementation and effectiveness of the measures. Although Justice had defined supply chain protection measures, it also had not developed or documented procedures for implementing or monitoring the measures.
Energy and Justice fully implemented the recommendations that GAO made in its 2012 report and resolved the deficiencies that GAO had identified with their supply chain risk management efforts by 2016. DHS also fully implemented two recommendations to document policies and procedures for defining and implementing security measures to protect against supply chain threats by 2015, but could not demonstrate that it had fully implemented the recommendation to develop and implement a monitoring capability to assess the effectiveness of the security measures.

What GAO Recommends

In its 2012 report, GAO recommended that Justice, Energy, and DHS take eight actions, as needed, to develop and document policies, procedures, and monitoring capabilities that address IT supply chain risk. The departments generally concurred with the recommendations and subsequently implemented seven recommendations and partially implemented the eighth recommendation.


Question:
Why GAO Did This Study

Natural gas storage is important for ensuring that natural gas is available when demand increases. There are 415 storage sites—including underground caverns and depleted aquifers and oil and gas reservoirs—located in 31 states, often near population centers (see fig.). Leaks from these sites, such as one near Los Angeles that led to the temporary relocation of about 8,000 families in 2015, can result in environmental and economic damage. Until 2016, states set standards for 211 sites, but there were no standards for 204 sites connected to interstate pipelines subject to federal jurisdiction. With passage of the PIPES Act of 2016, PHMSA, an agency within DOT that sets and enforces standards for energy pipelines, among other things, was tasked with issuing minimum standards for all gas storage sites.
GAO was asked to review natural gas storage safety standards. This report examines (1) PHMSA's efforts to implement the requirement to issue minimum safety standards for natural gas storage sites and (2) the extent to which PHMSA has planned strategically to enforce its safety standards for these sites. GAO reviewed PHMSA documents and plans, compared them to leading planning practices, and interviewed PHMSA officials.

What GAO Found

To meet its requirement under the Protecting Our Infrastructure of Pipelines and Enhancing Safety (PIPES) Act of 2016, the Department of Transportation's (DOT) Pipeline and Hazardous Materials Safety Administration (PHMSA) issued minimum safety standards in an interim rule and plans to finalize them by January 2018. Under the interim standards, site operators are to follow industry-developed best practices to detect and prevent leaks and plan for emergencies, among other things. Since the interim rule went into effect in January 2017, the minimum safety standards apply to all 415 natural gas storage sites, and the rule will be subject to further revision before it is final.
To enforce its safety standards, PHMSA has taken steps to establish a natural gas storage safety enforcement program. For example, PHMSA has started developing a training program for its inspectors. PHMSA also has identified a strategic goal for its program—to promote continuous improvement in safety performance—and is developing a performance goal for its training program.
However, PHMSA has not yet followed certain leading strategic planning practices. For example, PHMSA has not yet defined the level of performance to be achieved, fully addressed all core program activities, or used baseline data to develop its performance goal. GAO has previously reported that requirements under the Government Performance and Results Act (GPRA) and GPRA Modernization Act of 2010—which include establishing performance goals to define the level of performance—can serve as leading practices for lower levels of an agency, such as PHMSA. GAO also has found that successful performance goals address all core program activities. PHMSA's goal focuses on training and does not address other core program activities, such as conducting effective inspections. For example, a goal to evaluate whether PHMSA's inspections are effective could be to annually reduce, by a certain percentage, the number of sites not meeting minimum standards. PHMSA officials told GAO that they will strive to add and refine performance goals as the program evolves. As they do so, ensuring that these goals define the level of performance, address all core program activities, and use baseline data could help PHMSA better track progress toward its strategic goal.

What GAO Recommends

GAO is making two recommendations, which are that PHMSA (1) define levels of performance and address all core program activities and (2) use budget data to refine performance goals for its gas storage program. DOT concurred with GAO's recommendations.


Question:
Why GAO Did This Study

The Basin is one of the nation's largest watersheds and extends mainly through four Western states and into Canada. Activities such as power generation and agricultural practices have impaired water quality in some areas, so that human health is at risk and certain species, such as salmon, are threatened or extinct. In December 2016, Congress amended the Clean Water Act by adding Section 123, which requires EPA and OMB to take actions related to restoration efforts in the Basin.
GAO was asked to review restoration efforts in the Basin. This report examines (1) efforts to improve water quality in the Basin from fiscal years 2010 through 2016; (2) approaches to collaboration that entities have used for selected efforts; (3) sources of funding and federal funding expenditures; and (4) the extent to which EPA and OMB have implemented Clean Water Act Section 123. GAO reviewed documentation, including laws, policies, and budget information; surveyed federal, state, tribal, and nongovernmental entities that GAO determined had participated in restoration efforts; and conducted interviews with officials from most of these entities.

What GAO Found

Various entities, including federal and state agencies and tribes, implemented restoration efforts to improve water quality in the Columbia River Basin from fiscal years 2010 through 2016, according to GAO survey results. Entities implemented a range of restoration efforts. Efforts included activities to improve surface water quality and restore and protect habitat. For example, the Kootenai Tribe of Idaho implemented projects on the Kootenai River to restore and maintain conditions that support all life stages of native fish.
Entities used various collaborative approaches . Entities' approaches to collaboration for selected water quality-related efforts in the Basin varied. For example, the Environmental Protection Agency (EPA) sought various entities' voluntary involvement to coordinate toxics reduction efforts in the Basin.
Total federal expenditures could not be determined . Entities reported using a mix of federal and nonfederal funding sources for restoration efforts in the Basin, but total federal expenditures could not be determined, in part because there is no federal funding dedicated to restoring the Basin.
EPA and Office of Management and Budget ( OMB) have not yet implemented Section 123. According to EPA officials, the agency has not yet taken steps to establish the Columbia River Basin Restoration Program, as required by the Clean Water Act Section 123. EPA officials told GAO they have not received dedicated funding appropriated for this purpose; however, EPA has not yet requested funding to implement the program or identified needed resources. By developing a program management plan that identifies actions and resources needed, EPA would have more reasonable assurance that it can establish the program in a timely manner. Also, an interagency crosscut budget has not been submitted. According to OMB officials, they have had internal conversations on the approach to develop the budget but have not requested information from agencies. A crosscut budget would help ensure Congress is better informed as it considers funding for Basin restoration efforts.

What GAO Recommends

GAO is making three recommendations, including that EPA develop a program management plan for implementing the Columbia River Basin Restoration Program and that OMB compile and submit an interagency crosscut budget. EPA agreed with its recommendation. OMB did not comment, and GAO maintains its recommendations are valid.


Question:
Why GAO Did This Study

Federal spending on services paid for under Medicaid managed care was $171 billion in 2017, almost half of the total federal Medicaid expenditures for that year. Federal and state program integrity efforts have largely focused on Medicaid fee-for-service delivery where the state pays providers directly, rather than managed care, where it pays MCOs. As a result, less is known about the types of payment risks under managed care.
GAO was asked to examine payment risks in Medicaid managed care. In this report, GAO (1) identified payment risks; (2) identified any challenges to state oversight and strategies to address them; and (3) assessed CMS efforts to help states address payment risks and oversight challenges. To do this work, GAO reviewed findings on managed care payment risks and oversight challenges from federal and state audits and other sources. GAO also interviewed 49 state program integrity stakeholders in 10 states selected based on size, the percent of population in managed care, and geography. Stakeholders included the state Medicaid managed care office, state Medicaid program integrity unit, state auditor, Medicaid Fraud Control Unit, and an MCO.

What GAO Found

Under Medicaid managed care, managed care organizations (MCO) receive a periodic payment per beneficiary in order to provide health care services. Managed care has the potential to help states reduce Medicaid program costs and better manage the use of health care services. However, managed care payments also have the potential to create program integrity risks. GAO identified six types of payment risks associated with managed care, including four related to payments that state Medicaid agencies make to MCOs, and two related to payments that MCOs make to providers. Of the six payment risks GAO identified, state stakeholders responsible for ensuring Medicaid program integrity more often cited the following two as having a higher level of risk:
incorrect fee-for-service payments from MCOs, where the MCO paid providers for improper claims, such as claims for services not provided; and
inaccurate state payments to MCOs resulting from using data that are not accurate or including costs that should be excluded in setting payment rates.
GAO also identified multiple challenges to program integrity oversight for managed care programs. Stakeholders most frequently cited challenges related to (1) appropriate allocation of resources, (2) quality of the data and technology used, and (3) adequacy of state policies and practices. Some stakeholders offered strategies to address these challenges, including collaborating with other entities to identify problem providers and fraud schemes, as well as having effective data systems to better manage risks.
The Centers for Medicare & Medicaid Services (CMS), which oversees Medicaid, has initiated efforts to assist states with program integrity oversight for managed care. However, some of these efforts have been delayed, and there are also gaps in oversight.
CMS's planned Medicaid managed care guidance to states has been delayed due to the agency's internal review of the regulations; as of May 2018, no issuance date had been set for the guidance.
CMS established a new approach for conducting managed care audits beginning in 2016. However, only a few audits have been conducted, with none initiated in the past 2 years. In part, this is due to certain impediments identified by states, such as the lack of some provisions in MCO contracts.
CMS has updated standards for its periodic reviews of the state capitation rates set for MCOs. However, overpayments to providers by MCOs are not consistently accounted for in determining future state payments to MCOs, which can result in states' payments to MCOs being too high.
Lack of guidance and gaps in program integrity oversight are inconsistent with federal internal control standards, as well as with CMS's goals to (1) improve states' oversight of managed care; (2) use audits to investigate fraud, waste, and abuse of providers paid by MCOs; and (3) hold MCOs financially accountable. Without taking action to address these issues, CMS is missing an opportunity to develop more robust program integrity safeguards that will help mitigate payment risks in Medicaid managed care.

What GAO Recommends

GAO recommends that CMS (1) expedite issuing planned guidance on Medicaid managed care program integrity, (2) address impediments to managed care audits, and (3) ensure states account for overpayments in setting future MCO payment rates. The Department of Health and Human Services concurred with these recommendations.


Question:
Why GAO Did This Study

According to OPM, it receives more than 100,000 retirement applications each fiscal year. Between 2014 to 2017, OPM did not meet its goal of processing most retirement applications within 60 days. GAO was asked to review potential improvements in federal retirement processing at OPM. This report (1) describes the root causes of retirement application processing delays, as determined by OPM; and (2) examines what strategies, if any, OPM has taken to address those root causes, and how OPM has evaluated the effectiveness of the strategies.
GAO reviewed OPM data and documents, and interviewed OPM officials. GAO also interviewed officials from DOD, HHS, NASA, and USPS about their experiences with processing retirement applications. GAO selected these agencies because they represent a variety of application error rates and relatively high application volume.

What GAO Found

The Office of Personnel Management (OPM), which administers the federal retirement program, identified three root causes for retirement processing delays:
1. the continuing reliance on paper-based applications and manual processing;
2. insufficient staffing capacity, particularly during peak workload season; and
3. incomplete applications.
OPM has taken various actions to address these root causes and thereby reduce delays.
Vision for modernizing retirement processing. OPM's strategic vision consists of five key initiatives for modernizing the application process, including developing an electronic application form and an electronic system to store retirement information. However, OPM was unable to provide estimated time frames or costs for the initiatives. OPM officials said that additional information technology (IT) modernization work is dependent on sufficient funding, among other factors. These factors are important but do not preclude OPM from establishing estimated cost ranges and time frames—practices consistent with industry best practices and IT project management principles.
Actions to increase staffing capacity. OPM's actions have included using overtime pay and hiring additional staff. However, OPM generally does not assess the effectiveness of these actions or whether they reduce delays. For example, OPM does not measure overtime productivity or correlate overtime data with application processing data. Federal internal control standards state that management should review its performance compared to its goals. OPM officials stated that they have limited resources for assessments. However, without assessments, OPM is less able to make informed decisions on how to best use staffing practices to improve processing times.
Actions to reduce missing information in applications. OPM provides assistance to agencies through guidance, training, communication through liaisons and email, and error reports. OPM's monthly error reports to agencies include information on the type of error found and the volume of applications with the same error, according to OPM. The four agencies GAO interviewed—Department of Defense (DOD), Department of Health and Human Services (HHS), National Aeronautics and Space Administration (NASA), and U.S. Postal Service (USPS)—reported that aspects of the error reports were not user-friendly. OPM stated that its assistance is intended to help agencies submit complete and accurate retirement packages for quicker processing. Federal internal control standards state that management should communicate quality information externally and periodically reevaluate its communication methods. OPM officials stated that the error report is intended to capture the overarching errors many agencies face and that revising the error report would not be cost-effective. However, the current format of the error report may limit its usefulness to agencies in improving their retirement applications.

What GAO Recommends

GAO is making 6 recommendations. These recommendations include that OPM should develop a retirement services IT modernization plan for initial project phases; develop and implement policies for assessing staffing strategies intended to improve processing times; and determine if there are cost-effective ways to make the retirement application error report more user-friendly. OPM concurred with 1 recommendation and partially concurred with 5 recommendations. GAO continues to believe all aspects of the recommendations are valid, as discussed in the report. GAO also incorporated technical comments.


Question:
Why GAO Did This Study

CMS, an agency within the Department of Health and Human Services (HHS), provides health coverage for over 145 million Americans through its four principal programs, with annual outlays of about $1.1 trillion. GAO has designated the two largest programs, Medicare and Medicaid, as high risk partly due to their vulnerability to fraud, waste, and abuse. In fiscal year 2016, improper payment estimates for these programs totaled about $95 billion.
GAO's Fraud Risk Framework and the subsequent enactment of the Fraud Reduction and Data Analytics Act of 2015 have called attention to the importance of federal agencies' antifraud efforts. This report examines (1) CMS's approach for managing fraud risks across its four principal programs, and (2) how CMS's efforts managing fraud risks in Medicare and Medicaid align with the Fraud Risk Framework.
GAO reviewed laws and regulations and HHS and CMS documents, such as program-integrity manuals. It also interviewed CMS officials and a sample of CMS stakeholders, including state officials and contractors. GAO selected states based on fraud risk and other factors, such as geographic diversity. GAO selected contractors based on a mix of companies and geographic areas served.

What GAO Found

The approach that the Centers for Medicare & Medicaid Services (CMS) has taken for managing fraud risks across its four principal programs—Medicare, Medicaid, the Children's Health Insurance Program (CHIP), and the health-insurance marketplaces—is incorporated into its broader program-integrity approach. According to CMS officials, this broader program-integrity approach can help the agency develop control activities to address multiple sources of improper payments, including fraud. As the figure below shows, CMS views fraud as part of a spectrum of actions that may result in improper payments.
CMS's efforts managing fraud risks in Medicare and Medicaid partially align with GAO's 2015 A Framework for Managing Fraud Risks in Federal Programs (Fraud Risk Framework). This framework describes leading practices in four components: commit , assess , design and implement , and evaluate and adapt . CMS has shown commitment to combating fraud in part by establishing a dedicated entity—the Center for Program Integrity—to lead antifraud efforts. Furthermore, CMS is offering and requiring antifraud training for stakeholder groups such as providers, beneficiaries, and health-insurance plans. However, CMS does not require fraud-awareness training on a regular basis for employees, a practice that the framework identifies as a way agencies can help create a culture of integrity and compliance. Regarding the assess and design and implement components, CMS has taken steps to identify fraud risks, such as by designating specific provider types as high risk and developing associated control activities. However, it has not conducted a fraud risk assessment for Medicare or Medicaid, and has not designed and implemented a risk-based antifraud strategy. A fraud risk assessment allows managers to fully consider fraud risks to their programs, analyze their likelihood and impact, and prioritize risks. Managers can then design and implement a strategy with specific control activities to mitigate these fraud risks, as well as an appropriate evaluation approach consistent with the evaluate and adapt component. By developing a fraud risk assessment and using that assessment to create an antifraud strategy and evaluation approach, CMS could better ensure that it is addressing the full portfolio of risks and strategically targeting the most-significant fraud risks facing Medicare and Medicaid.

What GAO Recommends

GAO recommends that CMS (1) provide and require fraud-awareness training to its employees, (2) conduct fraud risk assessments, and (3) create an antifraud strategy for Medicare and Medicaid, including an approach for evaluation. HHS concurred with GAO's recommendations.


Question:
Why GAO Did This Study

BEP, within Treasury, designs and produces U.S. currency notes at BEP's facilities in Washington, D.C., and Fort Worth, Texas. The Federal Reserve pays for BEP's operational expenses, including currency production. BEP is requesting legal authority to purchase land and construct a new production facility in the D.C. area. BEP officials told GAO that, if it does not receive the necessary legal authority for a new production facility, it will renovate the D.C. facility.
GAO was asked to review BEP's facility planning process. This report: (1) describes the results of facility studies that BEP has funded and factors that led BEP to propose a new production facility, (2) examines the extent to which BEP's actions align with leading capital planning and cost estimating practices, and (3) describes other factors that could affect total federal costs of BEP's actions.
GAO analyzed BEP documents and data from 2010-2017 on currency note production, visited both BEP production facilities, assessed BEP's actions against leading capital planning and cost estimating practices, and interviewed officials from BEP, GSA, the Federal Reserve, and Treasury.
GAO provided the draft report to BEP, GSA, the Federal Reserve, and Treasury for review. BEP coordinated with Treasury in its comments. In the comments, reproduced in Appendix I, BEP emphasized the factors that led BEP to determine that a new facility is the preferred alternative. BEP and the Federal Reserve also provided technical comments, which we incorporated as appropriate. GSA did not provide comments.

What GAO Found

The Bureau of Engraving and Printing's (BEP) studies and research determined that a new production facility would be less expensive and better address BEP's need for secure, efficient, and flexible currency production than a renovation of its Washington, D.C. facility. According to 2017 cost estimates, BEP's preferred option—a new production facility in the Washington, D.C., area and some renovated administrative space in its current D.C. facility—would cost approximately $1.4 billion, while a renovation of its current facility for both production and administrative functions would cost approximately $2.0 billion. A new facility similar to BEP's Texas facility could have a secure perimeter that meets federal building security standards. Such a perimeter is not possible with the current facility. A new facility could also house production on a single production floor to allow for a more efficient production process.
BEP generally followed leading capital-planning practices, and its 2017 cost estimate of a new production facility partially met the characteristics of a reliable cost estimate. BEP's capital planning followed leading practices, for example, by including a needs assessment, a link to BEP's strategic plan, and a long-term capital plan. BEP's cost estimate partially followed leading practices, for example, by including most life-cycle cost components and documentation of the data used for the estimate. However, it did not include sufficient sensitivity analyses, which identify a range of costs-based on varying assumptions. BEP officials stated that they plan to follow the updated GSA guidance that includes GAO's cost-estimating leading practices when updating this early stage estimate.
The ability to sell or repurpose any part of the current D.C. facility could affect the total federal costs of BEP's actions. According to officials from the Department of the Treasury (Treasury) and the General Services Administration (GSA), there could be savings if Treasury could consolidate staff or operations into the vacated facility. There could also be savings if the unneeded facility could be sold to a private buyer. However there would be costs to prepare the facility for use by other entities or if the unneeded facility does not sell. Agency officials said that it is too early to determine specific costs and savings.


Question:
Why GAO Did This Study

Over 4 decades ago, Congress authorized the SPR—the world's largest government-owned stockpile of emergency crude oil—to reduce the impact of disruptions in supplies of petroleum products. Since 2015, Congress has also mandated sales of SPR oil to fund the modernization of SPR facilities and other national priorities. DOE manages the SPR, whose storage and related infrastructure is aging, and has plans to modernize its facilities. As a member of the International Energy Agency, the United States is obligated to maintain reserves equivalent to at least 90 days of the previous year's net imports (imports minus exports). As of March 2018, the SPR held about 665 million barrels of crude oil, about 138 days of net imports.
This testimony highlights GAO's May 2018 report on the SPR, including the extent to which (1) DOE has identified the optimal size of the SPR, and (2) DOE's plans for modernizing the SPR take into account the effects of congressionally mandated crude oil sales. GAO reviewed DOE's documents and studies and interviewed agency officials.

What GAO Found

The Department of Energy (DOE) has not identified the optimal size of the Strategic Petroleum Reserve (SPR). In 2016, DOE completed a long-term strategic review of the SPR after its last comprehensive examination was conducted in 2005. The 2016 review examined the benefits of several SPR sizes, but it did not identify an optimal size and was limited in several ways. In particular, in the review, DOE did not fully consider recent and expected future changes in market conditions, such as the implications of projected fluctuations in net imports or the role of the private sector in responding to supply disruptions. These changes have contributed to SPR and private reserves reaching historically high levels on a net imports basis. These changes are expected to continue to evolve, and according to government projections, the United States will become a net exporter in the late 2020s before again becoming a net importer between 2040 and 2050. GAO has found that agencies should reexamine their programs if conditions change. GAO recommended that DOE supplement its 2016 review by conducting an additional analysis, and take actions to ensure the agency periodically conducts a strategic review of the SPR. DOE generally agreed with these recommendations.
DOE has taken steps to account for congressionally mandated sales of SPR crude oil in its $1.4 billion modernization plans for SPR's infrastructure and facilities. However, DOE's current plans, developed in 2016, are based on information largely developed prior to recent congressionally mandated sales of an additional 117 million barrels of oil. According to DOE officials, the agency began a study in March 2018 to assess the effects of these sales on the SPR's modernization. However, GAO reported that this study was not examining a full range of options for handling any excess SPR assets that may be created by currently mandated sales or any additional sales that may be mandated in the future, inconsistent with an agency order on real property asset management that calls for identifying excess assets. For example, according to officials, DOE does not currently have the authority to lease unused storage capacity to the private sector, and DOE was not planning to examine this option. If authorized, leasing unused SPR storage capacity could generate revenues that could help offset the costs of modernization. GAO recommended that DOE should consider a full range of options for handling potentially excess assets and, if needed, request congressional authority for the disposition of these assets. DOE agreed with this recommendation.

What GAO Recommends

GAO made four recommendations, including that DOE (1) supplement the 2016 review by conducting an additional analysis, (2) ensure it periodically reexamines the SPR, and (3) consider a full range of options for handling potentially excess assets. DOE partially agreed with the first recommendation and agreed with the other two recommendations.


Question:
Why GAO Did This Study

The use of IT is crucial to helping VA effectively serve the nation's veterans and, each year, the department spends billions of dollars on its information systems and assets. However, VA has faced challenges spanning a number of critical initiatives related to modernizing its major systems. To improve all major federal agencies' acquisitions and hold them accountable for reducing duplication and achieving cost savings, in December 2014 Congress enacted federal IT acquisition reform legislation (commonly referred to as the Federal Information Technology Acquisition Reform Act , or FITARA).
GAO was asked to summarize its previous and ongoing work regarding VA's history of efforts to modernize VistA, including past use of contractors, and the department's recent effort to acquire a commercial electronic health record system to replace VistA. GAO was also asked to provide an update on VA's progress in key FITARA-related areas, including (1) data center consolidation and optimization, (2) incremental system development practices, and (3) software license management. VA generally agreed with the information upon which this statement is based.

What GAO Found

For nearly two decades, the Department of Veterans Affairs (VA) has undertaken multiple efforts to modernize its health information system—the Veterans Health Information Systems and Technology Architecture (known as VistA). Two of VA's most recent efforts included the Integrated Electronic Health Record (iEHR) program, a joint program with the Department of Defense (DOD) intended to replace separate systems used by VA and DOD with a single system; and the VistA Evolution program, which was to modernize VistA with additional capabilities and a better interface for all users. VA has relied extensively on assistance from contractors for these efforts. VA obligated over $1.1 billion for contracts with 138 contractors during fiscal years 2011 through 2016 for iEHR and VistA Evolution. Contract data showed that the 15 key contractors that worked on both programs accounted for $741 million of the funding obligated for system development, project management, and operations and maintenance to support the two programs (see figure). VA recently announced that it intends to change its VistA modernization approach and acquire the same electronic health record system that DOD is implementing.
With respect to key FITARA-related areas, the department has reported progress on consolidating and optimizing its data centers, although this progress has fallen short of targets set by the Office of Management and Budget. VA has also reported $23.61 million in data center-related cost savings, yet does not expect to realize further savings from additional closures. In addition, VA's Chief Information Officer (CIO) certified the use of adequate incremental development for 10 of the department's major IT investments; however, VA has not yet updated its policy and process for CIO certification as GAO recommended. Finally, VA has issued a software licensing policy and has generated an inventory of its software licenses to inform future investment decisions.

What GAO Recommends

GAO has made multiple recommendations to VA aimed at improving the department's IT management. VA has generally agreed with the recommendations and begun taking responsive actions.