Question:
Why GAO Did This Study

Federal regulations require that contracting officers assign the NAICS code that best describes the principal purpose of the acquisition. SBA's OHA is responsible for reviewing appeals of NAICS code assignments. Questions have been raised about whether agencies assign the appropriate NAICS codes to ID/IQ contracts with multiple task orders.
GAO was asked to review several issues related to NAICS codes. In this report, GAO examines (1) what contracting officers consider when assigning NAICS codes to federal contracts and the status of efforts to clarify code assignment and (2) industry views on NAICS code assignment and the number and outcomes of appeals.
GAO reviewed policies and procedures of the four agencies with the highest ID/IQ obligations from fiscal years 2011–2015: Army, Navy, Department of Homeland Security (DHS), and Department of Health and Human Services (HHS); reviewed one contract and 10 related task orders at each of the selected agencies and interviewed the related contracting officers; analyzed 2016 federal contracting data to identify commonly used NAICS codes and size standards; interviewed three industry groups and five firms that filed appeals for industry views on NAICS code assignment; and analyzed SBA decisions on NAICS code appeals in 2014–2016.
The Department of Defense, DHS, and SBA had no comments on the report. The General Services Administration and HHS had technical comments, which we incorporated as appropriate.

What GAO Found

Agencies' contracting officers consider various factors in assigning North American Industry Classification System (NAICS) codes to federal contracts, and the Small Business Administration (SBA) issued a rule in 2013 intended to clarify NAICS code assignment. NAICS codes are the basis for SBA's size standards; therefore, the code that the contracting officer assigns determines whether a firm is eligible for federal contracting preferences, such as small business set-asides. The contracting officers GAO interviewed cited several factors that affect their assignment of NAICS codes, including information on the work to be performed and input from agency small business specialists. However, they stated that assigning a NAICS code can be challenging when one or more codes could apply to a contract. In the 2013 rule, SBA clarified that under certain circumstances, contracting officers may assign more than one code to multiple-award contracts. Such contracts are awarded to two or more contractors under a single solicitation and include indefinite delivery/indefinite quantity (ID/IQ) contracts used when quantities and timing are not known at the time of the award. However, updates to the Federal Acquisition Regulation (FAR)—the rules governing the federal government's purchasing process—are required to fully implement SBA's final rule. The agencies GAO interviewed plan to implement this rule after it is adopted into the FAR and they can make necessary updates to their information technology for contracting. This FAR rule-making process is ongoing.
Some industry groups and firms GAO interviewed expressed concerns about how contracting officers assign NAICS codes, but SBA's Office of Hearings and Appeals (OHA) dismissed most appeals and denied more than half of the remaining appeals. Some industry groups and firms GAO interviewed expressed concerns that contracting officers may assign NAICS codes based on the size standard (thereby affecting the number of firms that can compete as a small business) and not the work to be performed. However, some also stated it was difficult to determine how often this practice occurs, and OHA officials noted it is the office's role to review the appropriateness of appealed NAICS codes, not the contracting officer's intention when assigning the code. Of the 62 NAICS code appeals that were filed in calendar years 2014–2016, OHA dismissed 35, denied 15, and granted 12 (see fig.). Appeals were dismissed because, among other things, they were untimely or the contracting officer cancelled the acquisition.


Question:
Why GAO Did This Study

DOD continues to confront organizational challenges that hinder collaboration. To address these challenges, section 911 of the NDAA for FY 2017 directed the Secretary of Defense to issue an organizational strategy that identifies critical objectives that span multiple functional boundaries and would benefit from the use of cross-functional teams. Additionally, DOD is to establish cross-functional teams to support this strategy, issue guidance on these teams, and provide training to team members and civilian leaders in the Office of the Secretary of Defense.
The NDAA also included a provision for GAO to periodically assess DOD's actions in response to section 911. This is GAO's third report on the implementation of section 911. It assesses the status of DOD's efforts to (1) establish cross-functional teams, (2) issue an organizational strategy, and (3) issue guidance on cross-functional teams and provide training to team members and Office of the Secretary of Defense leaders.
GAO reviewed documentation on DOD's implementation of its cross-functional teams and DOD's draft organizational strategy, draft guidance on establishing cross-functional teams, and draft training curricula. GAO also interviewed DOD officials on efforts to implement section 911.
GAO is not making new recommendations in this report. DOD concurred and is taking actions to address GAO's previous recommendations on DOD's implementation of section 911. DOD also concurred with the findings in a draft of this report.

What GAO Found

The Department of Defense (DOD) has implemented some statutory requirements in section 911 of the National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2017, enacted in December 2016, to address organizational challenges. However, senior leadership has not implemented several requirements intended to support cross-functional teams and promote department-wide collaboration (see table).
DOD has established 10 cross-functional teams, which are in various stages of implementation. Specifically, DOD is in the early stages of establishing one cross-functional team to address the backlog of the department's personnel security clearance background investigations and has assigned an interim leader and seven members to this team. In addition, DOD established 9 cross-functional teams to implement reform initiatives intended to improve the efficiency of the department's business operations. DOD generally appointed senior department officials to lead these teams, and the size of the teams, as of May 2018, ranged from 5 to 12 members.
DOD has drafted, but not issued, an organizational strategy. DOD officials stated that they have not completed the strategy because they want to align it with two department-wide strategy documents—the National Defense Strategy, which was issued in January 2018, and the National Defense Business Operations Plan, which was issued in May 2018.
DOD also has not fulfilled three statutory requirements related to guidance and training for cross-functional teams and civilian leaders in the Office of the Secretary of Defense. Specifically, DOD has not (1) provided training to cross-functional team members, (2) issued guidance on cross-functional teams, or (3) provided training to presidential appointees in the Office of the Secretary of Defense. DOD officials stated that they plan to send the guidance and training curricula to the Secretary of Defense for review and approval after DOD issues the organizational strategy. Fully implementing these requirements and GAO's prior recommendations related to the organizational strategy, guidance, and training, will better position DOD to effectively implement its cross-functional teams and advance a collaborative culture as required by the NDAA.


Question:
Why GAO Did This Study

Federal agencies collect a wide variety of information to ensure the public is kept safe from harm, receives benefits to which they are entitled, and fulfill their missions. Such collections can also impose significant burdens on the public. The goal of the PRA is to minimize the burden of these collections and maximize their utility. To help accomplish this, the PRA requires agencies to estimate the burden, and consult with the public on these estimates.
This report examines (1) how agencies estimate burden hours and costs of their collections, and any limitations of agencies' approaches; and (2) the extent to which agencies consult with the public on estimated burden. To address these objectives, GAO selected four agencies with the largest burden hour estimates, reviewed the 50 ICRs with the largest burden hour estimates at each agency, with a focus on the 2 largest ICRs at each as case studies, and interviewed agency officials and OMB staff.

What GAO Found

Agencies GAO reviewed—the Departments of Agriculture (USDA), Health and Human Services (HHS), and Transportation (DOT), and the Internal Revenue Service (IRS)—generally used existing data, such as historical data, to estimate the time, or “burden hours,” it takes for the public to complete an information collection request (ICR). IRS reported gathering original data on public burden through surveys of taxpayers to help estimate the burden for its two largest ICRs. When data were unavailable for one or more elements of the burden calculation (e.g., average time per response), agencies relied on professional judgment, informed in some instances by internal consultation with issue area experts.
GAO found two limitations with the agencies' current approaches for estimating burden. First, 76 of 200 ICRs that GAO reviewed, including the 2 largest ICRs at IRS and DOT, did not translate burden hours into dollars, or estimated “respondent time costs.” Although the Office of Management and Budget (OMB) requires agencies to include these costs, it reviewed and approved all 76 ICRs. ICRs that included respondent time costs did not consistently include fringe benefits, such as insurance contributions, in part because of a lack of clear guidance from OMB. Inconsistencies in estimating respondent time costs could lead to inconsistent implementation of new requirements under Executive Order 13771 that agencies offset the incremental costs of new regulations with reductions in regulatory burden, including paperwork burden, elsewhere.
Second, while all agencies and OMB reported having independent review processes in place, as required by the Paperwork Reduction Act (PRA), GAO found instances where 3 of the 4 selected agencies—USDA, HHS, and DOT—did not detect math errors through these review processes or inconsistencies among estimates provided on Reginfo.gov, and in the more detailed ICR supporting statements. For example, GAO found that one ICR underestimated burden by as much as $270 million, and another overestimated burden time by more than 12 million hours. Agencies acknowledged they followed their review processes but not detect the errors and inconsistencies. OMB also did not detect the errors and inconsistencies in its review of the ICRs. Until agencies ensure that their review processes detect errors or inconsistencies, the public may have less confidence in agencies' ability to effectively manage and minimize burden.
While the agencies solicited public comments through the Federal Register , as required by the PRA, IRS and DOT did not always provide the level of information in the notices (e.g., the frequency of the collection) needed to allow the public to evaluate the burden estimates. Also, agencies did not always consult with the public beyond these notices, as required under the PRA. Of the 200 ICRs GAO reviewed, 113 contained information in their supporting statements indicating public consultation beyond the Federal Register notices. Only 6 of these 113 indicated that public outreach was related to the burden hour estimates. OMB could help ensure that agencies consistently obtain public input by directing agencies to consult with the public beyond the Federal Register notices on each ICR, as required in the PRA. However, OMB continues to believe that additional consulting should occur only for ICRs where important information may be missed by the public notice and comment period. Congressional action to clarify the PRA requirement may be needed.

What GAO Recommends

Congress should consider more explicitly requiring agencies to consult with the public beyond the Federal Register notices. GAO is also making 11 recommendations: 1 to OMB on ensuring consistent application of the requirement for estimating respondent time costs; 4 on reexamining processes for reviewing ICRs to OMB, USDA, HHS, and DOT; 2 on improving public notices to IRS and DOT; and 4 on better leveraging existing public consultation to USDA, HHS, DOT, and IRS. USDA, HHS, DOT, and IRS agreed with the recommendations. OMB staff did not agree or disagree.


Question:
Why GAO Did This Study

The Border Patrol has primary responsibility for securing the border between U.S. ports of entry. On the southwest border, Border Patrol deploys agents along the immediate border and in areas up to 100 miles from the border as part of a layered approach known as the defense in depth strategy. Immigration checkpoints, generally located between 25 and 100 miles from the border, are one element of this strategy. GAO was asked to review the defense in depth strategy.
This report addresses: (1) the factors Border Patrol considers in deploying agents, (2) where apprehensions of illegal crossers and seizures of contraband are occurring, and (3) what data show about how checkpoints contribute to apprehensions and seizures, among other objectives. To answer these questions, GAO analyzed Border Patrol documents and data on apprehensions and seizures from fiscal year 2012 through 2016, visited two southwest border sectors, interviewed officials from the other seven southwest border sectors and Border Patrol headquarters, and reviewed prior GAO work on border security.

What GAO Found

According to U.S. Border Patrol (Border Patrol), agent deployment decisions are based on factors such as staffing levels and the availability of agents, among other things. As of May 2017, nationwide, Border Patrol had about 1,900 fewer agents than authorized, which officials cited as a key challenge for optimal agent deployment. In recent years, attrition has exceeded hiring (an average of 904 agents compared to 523 agents) according to officials. GAO analyzed scheduling data, including time that agents were scheduled to be not working (for example, off duty or on leave) because these activities can affect deployment decisions by reducing the number of agents available on a particular day. GAO found that agents were available for deployment about 43 percent of the time.
From fiscal years 2012 through 2016, Border Patrol apprehended a total of almost 2 million individuals along the southwest border, and these apprehensions increasingly occurred closer to the border, with 42 percent of apprehensions occurring one-half mile or less from the border in fiscal year 2016 compared to 24 percent in fiscal year 2012. One driver for this change is the increasing number of apprehensions of children, whom officials report may turn themselves in to Border Patrol without attempting to evade detection. Meanwhile, over this period, the locations where seizures of contraband occurred remained roughly the same, with the majority occurring 10 or more miles from the border.
For fiscal years 2013 through 2016, GAO found that 2 percent of apprehensions and 43 percent of seizures occurred at checkpoints; however, determining the extent to which apprehensions and seizures are attributable to checkpoints is difficult because of long-standing data issues. More apprehensions and seizures may be attributable to checkpoints, but Border Patrol's reporting does not distinguish apprehensions that occurred “at” versus “around” a checkpoint. Border Patrol is drafting guidance to clarify how checkpoint apprehension and seizure data are to be recorded that would respond to a 2009 GAO recommendation to improve the internal controls for management oversight of checkpoint data. GAO also determined that seizures at checkpoints differed from those at other locations. Specifically, 40 percent of seizures at checkpoints were 1 ounce or less of marijuana from U.S. citizens. In contrast, seizures at other locations were more often higher quantities of marijuana seized from aliens.

What GAO Recommends

GAO is not making any new recommendations at this time but has previously recommended that Border Patrol establish internal controls for checkpoint data, among other things. DHS concurred with this recommendation and has taken some steps to improve the quality of checkpoint data, but additional actions are needed to fully implement the recommendation.


Question:
Why GAO Did This Study

Several U.S. agencies train police in the Northern Triangle countries of El Salvador, Guatemala, and Honduras, where corruption and human rights abuses have traditionally plagued civilian police forces. State, the primary agency responsible for foreign police assistance, allocated about $37 million to train police in these countries from appropriations for fiscal years 2014 through 2017. Although it is not a focus of their efforts, DOD and USAID also train police in the Northern Triangle.
Senate Report 115-125 includes a provision for GAO to report on various aspects of U.S. police training efforts in the Northern Triangle. In this report, GAO examines, among other objectives, the extent to which U.S. agencies have (1) established objectives for and delivered training to professionalize police, including promoting respect for human rights, and (2) collected data related to police training indicators. GAO analyzed agency data and project documents, including for 22 State and USAID-funded projects implemented during fiscal years 2014 through 2017 that agencies identified as including assistance for police. GAO also conducted fieldwork in El Salvador and interviewed agency officials in Honduras; Guatemala; and Washington, D.C., who oversee and conduct police training.

What GAO Found

Agencies have established objectives and delivered training to professionalize police in Central America's Northern Triangle but have not consistently done so to promote police respect for human rights. U.S. strategies include objectives to professionalize police, and the Departments of State (State) and Defense (DOD) and U.S. Agency for International Development (USAID) have delivered related training (see figure). These strategies also highlight the importance of police respect for human rights, but agencies have few objectives or other control mechanisms to ensure police receive related training. For instance, none of the 14 State projects and 2 of the 8 USAID projects that GAO reviewed had such objectives. Officials said this is because objectives were designed to be broader in focus. DOD also does not have objectives but has other control mechanisms to ensure its training includes human rights content. Federal standards for internal control call for managers to establish control mechanisms consistent with priorities. Without them, it may be difficult for State and USAID to ensure that training supports agencies' goals to promote police respect for human rights.
DOD, State, and USAID collect information on police training, but State lacks readily available, reliable data on the number of police trained—a key indicator in the U.S. Strategy for Central America . State's data are not readily available because, according to officials, the process to track training is decentralized and data are not consolidated. Further, GAO found State's fiscal year 2017 police training data to be unreliable because, among other reasons, the data did not include training delivered by some implementers. Officials noted that State did not have sufficient internal control mechanisms and staff in place to collect data as it expanded police training in the Northern Triangle. Without such data, State cannot accurately assess its efforts in Central America.

What GAO Recommends

To improve oversight of police training in the Northern Triangle, State and USAID should design control mechanisms to ensure human rights content is included as appropriate, and State should improve police training data. State and USAID concurred.


Question:
Why GAO Did This Study

The U.S. food supply is generally considered safe, but the Centers for Disease Control and Prevention (CDC) estimate that Salmonella and Campylobacter in food cause about 2 million human illnesses per year in the United States. In 2014, GAO identified challenges USDA faced in reducing pathogens in poultry products, including standards that were outdated or nonexistent and limited control over factors that affect pathogen contamination outside of meat and poultry slaughter and processing plants, such as practices on the farm.
GAO was asked to review USDA's approach to reducing pathogens in meat and poultry products. This report examines (1) the extent to which USDA has developed standards for meat and poultry products and (2) any additional steps USDA has taken to address challenges GAO identified in 2014. GAO reviewed relevant regulations, documents, and data and interviewed officials from USDA and CDC, as well as 17 stakeholders representing industry, consumer groups, and researchers selected based on their knowledge of USDA's meat and poultry slaughter inspections and food safety.

What GAO Found

To help ensure the safety of our nation's food supply, the U.S. Department of Agriculture (USDA) has developed standards limiting the amount of Salmonella and Campylobacter —pathogens that can cause foodborne illness in humans—permitted in certain meat (beef and pork) and poultry (chicken and turkey) products, such as ground beef, pork carcasses, and chicken breasts. However, the agency has not developed standards for other products that are widely available, such as turkey breasts and pork chops. Further, its process for deciding which products to consider for new standards is unclear because it is not fully documented, which is not consistent with federal standards for internal control. For example, USDA has informed stakeholders that it will take into account factors including consumption and illness data, but the agency has not documented this process going forward. Previously, USDA had developed new standards after widespread outbreaks indicated the need. For example, in 2016, USDA concluded that new standards were needed for certain poultry products to reduce Salmonella after reviewing outbreaks from these products in 2011, 2013, and 2015—outbreaks in which 794 people were sickened and 1 died. By documenting the agency's process for deciding which products to consider for new standards, USDA could better ensure that such decisions will be risk-based.
USDA is taking steps to address challenges GAO identified in 2014 for reducing pathogens in poultry products, but these challenges are ongoing and could affect USDA's ability to reduce pathogens in meat as well. For example, one challenge GAO identified is that the level of pathogens in poultry products can be affected by practices on farms where poultry are raised. GAO recommended in 2014 that to help overcome this challenge, USDA guidelines on practices for controlling Salmonella and Campylobacter on farms include information on the effectiveness of each of the practices, consistent with a recommendation from a USDA advisory committee. Since GAO's 2014 report, USDA drafted revised guidelines to include information on the effectiveness of on-farm practices for controlling pathogens in poultry and beef cattle, in 2015 and 2017, respectively. However, USDA's draft guidelines for controlling Salmonella in hogs do not contain such information. By including such information as it finalizes its draft guidelines, USDA could better inform industry of the potential benefits of adopting on-farm practices included in the guidelines and encourage implementation of such practices.

What GAO Recommends

GAO is making three recommendations, including that USDA document its process for deciding which products to consider for new standards and that it include information on the effectiveness of on-farm practices in its guidelines for Salmonella control in hogs. USDA agreed with GAO's recommendations and described actions it will take to implement them.


Question:
Why GAO Did This Study

DOD relies on a multi-tiered supply chain to provide SRMs, the propulsion systems behind the various missile systems that provide defense capabilities to meet U.S. national security objectives. The SRM industrial base includes manufacturers that turn to an extensive network of suppliers that provide the raw materials, components, and subsystems needed to build SRMs. DOD is responsible for developing a strategy for the national industrial base that ensures that defense contractors and their suppliers are capable of providing the goods and services needed to achieve national security objectives.
GAO was asked to review the state of the U.S. industrial base for SRMs. This report addresses (1) SRM industry trends, (2) single source supplier risks, and (3) opportunities for SRM manufacturers' engineering workforce development. GAO analyzed DOD's annual industrial capabilities reports to Congress for fiscal years 2009 through 2016, which reflect DOD's most current information on SRM risks, and reviewed DOD budget data and information from missile prime contractors and SRM manufacturers. GAO also interviewed missile prime contractors, SRM manufacturer representatives, and officials from DOD and the military departments.

What GAO Found

Over the past two decades, the solid rocket motor (SRM) industrial base has undergone various changes including consolidation and recent expansion. Specifically, since 1995, the industry has consolidated from six U.S. manufacturers to two U.S. manufacturers. With regard to expansion, a foreign supplier entered the market in 2012, and in 2017, a U.S. firm, which is ultimately foreign-owned, was also established. According to the Department of Defense (DOD) while it supports competition, its current demand for SRMs can only sustain two manufacturers. Although at this stage it is too early to know how, or if, these new entrants will impact the economic viability of the more long-standing U.S. manufacturers.
The consolidation in the SRM industrial base has also been accompanied by a decrease of suppliers throughout the supply chain. For example, one SRM manufacturer estimated a decrease in suppliers, from approximately 5,000 to 1,000, over the last 20 years. This increases the risk of production delays and disruptions in the event that key components and materials available from a single source become unavailable from that source. GAO found that DOD and industry are taking steps to identify and mitigate these risks, such as by establishing alternative sources and requiring advance notice when suppliers are considering exiting the market.
In its annual industrial capabilities reports to Congress, DOD has consistently stated that the limited number of new missile development programs inhibits its ability to provide opportunities to help SRM manufacturers maintain their workforce capabilities. Specifically, with few new missile programs being initiated, engineers have had fewer opportunities to develop their engineering skills related to SRM concept designs, system development, and production, which are critical if SRM performance issues arise. However, in 2016, DOD funded a 4-year project to enhance engineering design skills for less experienced engineers working for the two U.S. manufacturers and help them develop advanced SRM technologies.

What GAO Recommends

GAO is not making recommendations at this time.


Question:
Why GAO Did This Study

Puget Sound is the nation's second-largest estuary and serves as an important economic engine in Washington State, supporting millions of people, major industries, and a wide variety of species. However, according to the CCMP, human use and development have degraded water quality and habitats and harmed critical species such as salmon.
GAO was asked to review efforts to restore Puget Sound. This report examines, among other objectives, (1) Puget Sound restoration efforts and related expenditures for fiscal years 2012 through 2016, (2) how federal and nonfederal entities coordinate their restoration efforts, and (3) the framework for assessing progress toward Puget Sound restoration. GAO reviewed restoration plans and other documentation, conducted a two-phase survey of the more than 25 federal and state entities that GAO determined had participated in restoration efforts, conducted discussion groups with tribal and local representatives, and interviewed representatives from these federal and nonfederal entities.

What GAO Found

Through its survey of federal and Washington State entities, GAO identified numerous federal and state efforts that, in whole or in part, supported Puget Sound restoration from fiscal years 2012 through 2016. The efforts involved a variety of activities, including habitat protection, water quality improvement, and monitoring. Some of these efforts focused exclusively on Puget Sound restoration, while others had a broader geographic or programmatic scope. Funding for these efforts came from a variety of sources, such as the Environmental Protection Agency (EPA), which reported expending about $142 million for activities in Puget Sound through the National Estuary Program and the Puget Sound Geographic Program during this time frame. However, total expenditures for all efforts are unknown, in part because of difficulties isolating expenditures specific to Puget Sound. A 2017 state audit recommended that two state agencies develop a plan to create a more complete inventory of restoration efforts and related funding. The state agencies concurred and have plans to develop this inventory by August 2019.
Federal and nonfederal entities coordinate restoration efforts through two primary interagency groups. First, the state-led Puget Sound Management Conference has developed a comprehensive conservation and management plan (CCMP), approved by EPA under the National Estuary Program, that serves as the primary planning document for Puget Sound restoration. Second, the Puget Sound Federal Task Force complements the work of the management conference by coordinating the efforts of federal agencies to support the CCMP, including by developing a draft Federal Action Plan that identifies priority federal actions to protect and restore Puget Sound.
The CCMP lays out a framework for assessing restoration progress, including 6 goals, 47 indicators, and recovery targets for 31 of the indicators. In 2017, the Puget Sound Partnership, a state agency, reported that progress had been made in some areas, but many key indicators had not shown improvement. For example:
One indicator that showed improvement was acres of harvestable shellfish beds, which the Partnership reported increased from 2007 to 2016.
One indicator that showed no improvement was the abundance of Puget Sound Chinook salmon populations, which the Partnership reported remained below desired levels.
The Partnership also reported that most of the 31 recovery targets that the management conference has adopted for 2020 are not likely to be attained. However, the Partnership's ability to assess progress has been limited in some instances, in part because the management conference has not developed targets for 16 of the 47 indicators. GAO has identified measurable targets as a key attribute of successful performance measures. By working with the management conference to help ensure that measurable targets are developed where possible for the highest priority indicators currently lacking such targets, EPA would better position the Partnership to assess progress toward restoration goals.

What GAO Recommends

GAO is making two recommendations, including that EPA work with the management conference to help ensure that measurable targets are developed where possible for the highest priority indicators currently lacking such targets. EPA agreed with GAO's recommendations and highlighted steps the agency has begun taking and plans to take to address the recommendations.


Question:
Why GAO Did This Study

Since 2012, the United States has provided approximately $36 billion in humanitarian assistance to save lives and alleviate human suffering. Much of this assistance is provided in areas plagued by conflict or other issues that increase the risk of financial crimes. The World Bank and others have reported that humanitarian assistance organizations face challenges in accessing banking services that could affect project implementation.
GAO was asked to review the possible effects of decreased banking access for nonprofit organizations on the delivery of U.S. humanitarian assistance. In this report, GAO examines (1) the extent to which State and USAID partners experienced banking access challenges, (2) USAID partners' reporting on such challenges, and (3) actions U.S. agencies have taken to help address such challenges. GAO selected four high-risk countries—Syria, Somalia, Haiti, and Kenya—based on factors such as their inclusion in multiple financial risk-related indices, and selected a non-generalizable sample of 18 projects in those countries. GAO reviewed documentation and interviewed U.S. officials and the 18 partners for the selected projects.

What GAO Found

Implementing partners (partners) for 7 of 18 Department of State (State) and U.S. Agency for International Development (USAID) humanitarian assistance projects that GAO selected noted encountering banking access challenges, such as delays or denials in transferring funds overseas. Of those 7 projects, 1 partner told us that banking access challenges adversely affected its project and 2 additional partners told us that the challenges had the potential for adverse effects. Moreover, the majority of partners (15 out of 18) for the 18 projects noted experiencing banking access challenges on their global portfolio of projects over the previous 5 years.
USAID's partners' written reports do not capture potential risks posed by banking access challenges because USAID generally does not require most partners to report in writing any challenges that do not affect implementation. Six of the 7 projects that encountered challenges were USAID-funded. Of those 6 USAID projects, 5 partners told us that these challenges did not rise to the threshold of affecting project implementation that would necessitate reporting, and 1 did not report challenges although its project was adversely affected. Additionally, GAO's review of about 1,300 USAID partner reports found that the few instances where challenges were mentioned lacked sufficient detail for GAO to determine their type, severity, or origin. Without information on banking access challenges that pose potential risks to project implementation, USAID is not aware of the full extent of risks to achieving its objectives.
The Department of the Treasury (Treasury) and State have taken various actions to help address banking access challenges encountered by nonprofit organizations (NPO), but USAID's efforts have been limited. Treasury's efforts have focused on engagement between NPOs and U.S. agencies, while State has issued guidance on the topic to its embassies and designated an office to focus on these issues. In contrast, USAID lacks a comparable office, and NPOs stated that it is difficult to find USAID staff to engage with on this topic. Further, GAO found that awareness of specific challenges was generally limited to USAID staff directly overseeing the project. Without communicating these challenges to relevant parties, USAID may not be aware of all risks to agency objectives and may not be able to effectively engage with external entities on efforts to address these challenges.

What GAO Recommends

GAO recommends that USAID should take steps to (1) collect information on banking access challenges experienced by USAID's partners and (2) communicate that information both within USAID and with external entities, such as other U.S. agencies and partners. USAID concurred with our recommendations.


Question:
Why GAO Did This Study

The Taxpayer Bill of Rights entitles taxpayers with the right to appeal a decision of the Internal Revenue Service (IRS) in an independent forum. GAO was asked to review this administrative appeal process within IRS.
Among other things, this report (1) describes the IRS appeal process and staffing; (2) assesses how IRS monitors and manages the time to receive and resolve taxpayer appeals cases; and (3) evaluates the extent to which Appeals communicates customer service standards and assesses taxpayer satisfaction with the appeal process.
GAO reviewed IRS guidance, publications, and documentation on the appeal process. GAO analyzed IRS data for administrative appeal cases closed in fiscal years 2014 through 2017 to compare appeal case resolution time for different types of cases. GAO interviewed IRS officials and a non-generalizable sample of external stakeholders, including attorneys and accountants, knowledgeable about the appeal process. Among other things, GAO compared IRS actions to federal standards for internal control and customer service.

What GAO Found

The Internal Revenue Service (IRS) has a standard process to resolve a diverse array of taxpayer requests to appeal IRS proposed actions to assess additional taxes and penalties or collect taxes owed. The process begins with a taxpayer filing an appeal with the IRS examination or collection unit proposing the compliance action and ends with a decision from the Office of Appeals (Appeals).
Appeals must have staff with expertise in all areas of tax law to review taxpayer appeals. However, its staffing levels declined by nearly 40 percent from 2,172 in fiscal year 2010 to 1,345 in fiscal year 2017. Appeals anticipates a continued risk of losing subject matter expertise given that about one-third of its workforce was eligible for retirement at the end of last fiscal year.
Appeals monitors the number of days to resolve taxpayer appeals of examination, collection, and other tax disputes. However, IRS does not monitor the timeliness of transfers of all incoming appeal requests. GAO analysis showed that the time to transfer appeal requests from compliance units varied depending on the type of case (see table below).
Collections workstreams —taxpayer appeals where IRS (1) filed a notice of federal tax lien or proposed a levy (collection due process) or (2) rejected an offer to settle a tax liability for less than owed (offer in compromise).
The Internal Revenue Manual (IRM), IRS's primary source of instructions to staff, requires transfer to Appeals within 45 days for the largest collection workstream. With manager approval, collection staff may have an additional 45 days to work with the taxpayer. Nearly 90 percent of collection appeals closed in fiscal years 2014 to 2017 were transferred to Appeals within 90 days.
Examination workstreams —taxpayer appeals of additional tax and penalty assessments IRS proposed based on its auditing of tax returns over a wide range of examination issues.
IRS does not have an IRM requirement with guidelines and procedures for timely transfer for examination appeals. Accordingly, more than 20 percent of examination appeals closed in fiscal years 2014 to 2017 took more than 120 days to be transferred to Appeals. Delays in transferring appeals can result in increased interest costs for taxpayers.
Although Appeals maintains data on total appeal resolution time—from IRS receipt to Appeals' decision—such information is not readily transparent to IRS compliance units or the public. GAO analysis of IRS data found that, for fiscal years 2014 to 2017, about 15 percent of all appeal cases closed within 90 days (see figure below). About 85 percent of all cases were resolved within one year of when the taxpayer requested an appeal. Total resolution times differed by case type. However, without easily accessible information on resolution times, taxpayers are not well informed on what to expect when requesting an appeal.
Although Appeals has customer a service standard and conducts a customer satisfaction survey, its standard and related performance results are not readily available to the public. Under the GPRA Modernization Act of 2010 (GPRAMA) and Executive Orders, the Department of the Treasury is responsible for customer service performance. Appeals conducts outreach to the tax practitioner community but does not regularly solicit input before policy changes. Without a mechanism, such as leveraging existing IRS advisory groups or alternatively developing its own advisory body, Appeals is missing an opportunity to obtain public input on policy changes affecting the taxpayer's experience in the appeal process.

What GAO Recommends

GAO makes seven recommendations to help enhance controls over and transparency of the IRS appeals process (several of the recommendations are detailed on the following page).
GAO recommends, among other things, that the Commissioner of Internal Revenue
Establish timeframes and monitoring procedures for timely transfer of taxpayer appeals requests by examination compliance units to the Office of Appeals.
Direct the Office of Appeals to regularly report and share with each compliance unit the data on the time elapsed between when a taxpayer requests an appeal to when it is received in the Office of Appeals.
Provide more transparency to taxpayers on historical average total appeal resolution times.
GAO recommends, among other things, that the Secretary of the Treasury, consistent with its responsibilities under GPRAMA and Executive Orders for customer service, ensure that the Commissioner of Internal Revenue develops a mechanism to solicit and consider customer feedback on a regular basis on current and proposed IRS appeal policies and procedures.
Treasury and IRS agreed with GAO's recommendations, and IRS said it will provide detailed corrective action plans.


Question:
Why GAO Did This Study

Federally funded employment and training (E&T) programs help job seekers enhance their job skills, identify job opportunities, and obtain employment. In 2011, GAO identified overlap and fragmentation among E&T programs administered by nine federal agencies. The Workforce Innovation and Opportunity Act (WIOA) was enacted in 2014, in part, to improve coordination and integration among these programs.
This report examines (1) how the number of and obligations for federal E&T programs have changed since GAO's 2011 review, (2) the extent to which E&T programs continue to provide similar services to similar populations and examples of potential effects, and (3) the extent to which agencies have taken actions to address previously identified fragmentation and overlap among E&T programs and what agencies have learned about the results. To address these objectives, GAO surveyed E&T program administrators, reviewed relevant reports and studies, and interviewed federal agency officials.

What GAO Found

The number of federal employment and training (E&T) programs and program obligations have declined since GAO's 2011 report. In that review, GAO identified 47 E&T programs and found that 44 had overlap with at least one other program in that they provided similar services to a similar population. In fiscal year 2017, the most recent year data are available, GAO identified 43 E&T programs, or 4 fewer than in 2011 (see figure). From fiscal year 2009 to 2017, federal agencies' annual obligations for E&T programs decreased from about $20 billion to $14 billion. GAO analysis of survey data found the decrease in obligations was largely due to the expiration of funding from the American Recovery and Reinvestment Act of 2009, which had provided additional funding for selected E&T programs during and after the Great Recession.
Survey results from federal administrators of the 43 E&T programs show that the programs continue to span nine agencies and generally overlap by providing similar services, such as employment counseling and assessment services (39 of 43) and job readiness training (38 of 43). Further, programs targeting a specific population, such as Native Americans, veterans, or youth, also provided similar services. In some cases, such overlap may be appropriate or beneficial, but it may also suggest opportunities for greater efficiency.
Almost all (38 of 43) E&T programs reported at least one action to manage fragmentation or overlap, such as co-locating services and sharing information. However, the agencies were not able to consistently provide information on the results of these actions and few evaluations encompassed multiple programs. Among studies GAO identified, six examined more than one E&T program, but only one assessed how any coordinated activities benefited the population served. None of the six studies focused on Native Americans, youth, or refugees. The Workforce Innovation and Opportunity Act (WIOA) encourages agencies to conduct evaluations, and specifically requires the Department of Labor (DOL) to publish a 5-year plan describing certain E&T priorities, consistent with the purpose of aligning and coordinating certain programs. While DOL reported it took some steps, it continues to lack a strategic plan for E&T evaluations over a multi-year period. As a result, DOL does not know whether actions to manage overlap are successful.

What GAO Recommends

GAO recommends that DOL, in consultation with other federal agencies, develop and publish a multi-year strategic plan for its evaluations of employment and training that includes assessing the completeness and results of efforts to coordinate among E&T programs. DOL agreed with our recommendation.


Question:
Why GAO Did This Study

The Secret Service is responsible for protecting the President and his family, including adult children when they travel. The Secret Service can request assistance in its mission from other agencies, such as DOD and the Coast Guard. When the President travels, he must fly on DOD aircraft.
GAO was asked to review the travel- related costs for four trips that the President took to Mar-a-Lago and three trips that the President's adult children made to certain overseas destinations. This report examines (1) the costs incurred by federal agencies associated with the President's travel on selected trips to Mar-a-Lago, (2) the costs incurred by federal agencies associated with certain overseas trips taken by Donald Trump, Jr. and Eric Trump, and (3) the extent to which the Coast Guard, the Secret Service, and DOD have reported their costs pursuant to the Presidential Protection Assistance Act of 1976. GAO analyzed agency cost data in connection with the President's travel to Mar-a-Lago and the President's adult children's trips to certain overseas locations. GAO also reviewed the law, agency guidance, and semiannual reports related to the Presidential Protection Assistance Act of 1976.

What GAO Found

GAO estimated that federal agencies incurred costs of about $13.6 million for the President's four trips to Mar-a-Lago from February 3 through March 5, 2017. This estimate consisted of approximately $10.6 million for operating costs of government aircraft and boats and $3 million for temporary duty costs of government personnel supporting the President's travel, including transportation, lodging, and meals and incidental expenses. These figures do not include certain classified cost information or the salaries and benefits of government personnel traveling with the President because, salaries and benefits would be paid regardless of whether the President was traveling.
The United States Secret Service (Secret Service) incurred about $396,000, primarily for temporary duty costs, while protecting Donald Trump, Jr. and Eric Trump during three international trips taken in January and February 2017. Eric Trump traveled to Uruguay and the Dominican Republic and Donald Trump, Jr., Eric Trump, and their spouses traveled to the United Arab Emirates. Documentation provided by Secret Service officials confirmed that the Trumps and their spouses flew on commercial aircraft. Officials from the 89th Airlift Wing confirmed that no military aircraft supported these trips. Secret Service agents protecting the Trump family flew by commercial aircraft.
GAO found that, of the three agencies required to report by the Presidential Protection Assistance Act of 1976, as amended, only the United States Coast Guard (Coast Guard) reported protection costs semiannually to Congress for fiscal years 2015 through 2017. GAO found that the Secret Service does not have a policy for ensuring that the semiannual reports are prepared and has not consistently submitted the reports. Secret Service officials last submitted reports in fiscal year 2015 and were unaware that reports had not been submitted in fiscal years 2016 and 2017 until GAO requested this information. GAO also found that the Department of Defense (DOD) has a policy but did not produce and submit the reports as required. Moreover, weaknesses in DOD's existing policy and instruction do not clearly establish the responsibility for preparing and reporting the costs incurred to support protection activities. Absent clear policies with an oversight mechanism to ensure that the reports are produced, Congress has not been provided required information concerning the costs for providing protective services for the President and others.

What GAO Recommends

GAO is making recommendations to the Secret Service and DOD to ensure that the reports required under the Presidential Protection Assistance Act of 1976, as amended, are prepared and submitted. The Department of Homeland Security and DOD concurred with GAO's recommendations.


Question:
Why GAO Did This Study

Reported improper payment estimates totaled over $1.2 trillion government-wide from fiscal years 2003 through 2016. Agencies are statutorily required to perform improper payment risk assessments to identify programs and activities that may be susceptible to significant improper payments and are required to report an improper payment estimate for ones that are susceptible to significant improper payments.
GAO was asked to review federal agencies' improper payment risk assessments. This report examines the extent to which (1) the 24 CFO Act agencies followed OMB guidance for reporting on improper payment risk assessments and (2) selected CFO Act agencies properly designed control activities to include all of their programs and activities in an improper payment risk assessment at least once every 3 years, as statutorily required. GAO analyzed the 24 CFO Act agencies' AFRs and PARs and reviewed the procedures at 9 selected agencies. GAO selected 9 agencies that did not report improper payment estimates in fiscal year 2015, except for those estimates that were mandated to be reported pursuant to the Disaster Relief Appropriations Act, 2013. For this review, GAO did not evaluate the quality of improper payment risk assessments completed.

What GAO Found

GAO's review of the 24 Chief Financial Officers Act of 1990 (CFO Act) agencies' fiscal years 2014 through 2016 agency financial reports (AFR) and performance and accountability reports (PAR) found that these agencies generally adhered to the Office of Management and Budget's (OMB) improper payment risk assessment reporting directives. However, GAO found instances of nonadherence, including the following:
There were two instances of nonadherence to OMB's directive for agencies to report the basis for how they grouped programs and activities, both of which occurred in fiscal year 2014. All agencies that completed risk assessments adhered to this directive for fiscal years 2015 and 2016.
The Improper Payments Information Act of 2002, as amended, identifies seven risk factors and OMB guidance includes two additional risk factors that agencies are to consider when conducting risk assessments. For fiscal years 2015 and 2016 reporting, OMB directed agencies to report the risk factors considered in their risk assessments. However, GAO found six agencies that did not report one or more of the nine risk factors in their AFRs or PARs.
OMB's revised guidance for fiscal year 2017 no longer directs agencies to report on their risk assessments. OMB staff stated that their primary motivation for removing such reporting was to reduce the administrative burden. After GAO notified OMB of the importance of certain data, OMB staff plan to direct agencies to provide additional data, including a listing of risk assessed programs and activities, on www.paymentaccuracy.gov for reporting beginning in fiscal year 2017. OMB staff also plan to revise the guidance for fiscal year 2018 for agencies to report the other risk assessment information in their AFRs or PARs.
GAO also found that three of the nine selected agencies (the Departments of Energy and Justice and the U.S. Agency for International Development) that it reviewed had designed and documented control activities to help ensure that all programs and activities were assessed every 3 years. For the remaining six agencies, GAO found that the agencies did not properly design control activities for this purpose. Specifically, GAO found the following:
Three agencies—the Department of Commerce, the National Science Foundation, and the Nuclear Regulatory Commission—did not have documented procedures for conducting risk assessments during fiscal years 2014 through 2016 but subsequently documented them.
Three agencies—the Departments of the Interior (Interior) and State (State) and the National Aeronautics and Space Administration (NASA)—documented procedures for conducting risk assessments but did not include all programs and activities in their risk assessments. Interior later drafted revisions to its procedures and State updated its procedures to include them.
Without properly designed and documented control activities, there is a risk that an agency may not identify all programs and activities that require a risk assessment, which could result in the agency failing to develop and report improper payment estimates for programs and activities that should have been identified as susceptible to significant improper payments.

What GAO Recommends

GAO recommends that NASA revise its procedures to help ensure that all programs and activities are assessed for susceptibility to significant improper payments at least once every 3 years. NASA concurred with the recommendation.


Question:
Why GAO Did This Study

DOD has until January 1, 2020, to equip its aircraft with ADS-B Out technology that would provide DOD, FAA, and private citizens the ability to track their flights in real-time and track flight patterns over time. This technology is a component of NextGen, a broader FAA initiative that seeks to modernize the current radar-driven, ground-based air transportation system into a satellite-driven space-based system.
Senate Report 114-255 included a provision for GAO to assess the national defense implications of FAA's implementation of ADS-B. This report assesses the extent to which (1) DOD and FAA have identified operations and security risks and approved solutions to address these risks to ADS-B Out -equipped military aircraft; and (2) DOD has implemented key tasks in the 2007 memorandum on implementing NextGen.
GAO analyzed risks identified by DOD and FAA related to ADS-B vulnerabilities, and how they could affect current and future air defense and air traffic missions. GAO also reviewed the tasks in the 2007 NextGen Memorandum and assessed whether the eight tasks specifically related to ADS-B were implemented.

What GAO Found

Since 2008, the Department of Defense (DOD) and the Department of Transportation's Federal Aviation Administration (FAA) have identified a variety of risks related to Automatic Dependent Surveillance-Broadcast (ADS-B) Out technology that could adversely affect DOD security and missions. However, they have not approved any solutions to address these risks. Compared with other tracking technology, ADS-B Out provides more information, such as an aircraft's precise location, velocity, and airframe dimensions, and better enables real-time and historical flight tracking. Individuals—including adversaries—could track military aircraft equipped with ADS-B Out technology, presenting risks to physical security and operations. This readily available public information allowed GAO to track various kinds of military aircraft. ADS-B Out is also vulnerable to electronic warfare and cyber-attacks. Since FAA is planning to divest radars as part of ADS-B implementation, homeland defense could also be at risk, since the North American Aerospace Defense Command relies on information from FAA radars to monitor air traffic. DOD and FAA have drafted a memorandum of agreement that focuses on equipping aircraft with ADS-B Out but does not address specific security risks. Unless DOD and FAA focus on these risks and approve one or more solutions in a timely manner, they may not have time to plan and execute actions that may be needed before January 1, 2020—when all aircraft are required to be equipped with ADS-B Out technology.
Of the eight tasks associated with the implementation of ADS-B Out technology in the 2007 DOD NextGen memorandum—issued by the Deputy Secretary of Defense to ensure that the NextGen vision for the future national airspace system met DOD's requirements and the appropriate management of DOD's resources—DOD has implemented two, has partially implemented four, and has not implemented two. DOD has established a joint program office and identified a lead service, but it has only partially validated ADS-B Out requirements, developed a directive, issued an implementation plan, and incorporated NextGen into the planning, budgeting, and programming process. DOD has not taken significant action to integrate the needs and requirements of DOD components related to ADS-B into cohesive plans and policies for inclusion in NextGen joint planning and development, and has not provided periodic and recurring NextGen progress reports to the Deputy Secretary of Defense. As a result of DOD not fully implementing the 2007 NextGen memorandum, DOD components have lacked direction and cohesion while trying to address FAA's requirement to equip military aircraft.
This is a public version of a classified report GAO issued in January 2018.

What GAO Recommends

GAO is recommending that DOD and FAA approve one or more solutions to address ADS-B -related security risks; and that DOD implement key tasks to facilitate consistent, long-term planning and implementation of NextGen. DOD and the Department of Transportation generally concurred and described planned actions to implement the recommendations.


Question:
Why GAO Did This Study

The U.S. government relies on U.S.-flag vessels that trade internationally to transport cargo and to provide a pool of U.S. mariners who could be called upon in times of crisis for DOD's reserve fleet. Through financial support and cargo preferences, the United States has supported the viability of the U.S.-flag fleet. However, in recent years concern has grown about the sustainability of the U.S.-flag fleet, and in 2014, Congress statutorily mandated that DOT develop national strategies related to the sustainability of the U.S.-flag fleet including recommendations for the future.
GAO was asked to review U.S. government support for these U.S.-flag vessels that trade internationally. This report discusses: (1) the effect the U.S. government's support for the U.S.-flag fleet has had on national defense needs and other government programs; (2) the challenges identified by stakeholders in sustaining the U.S.-flag fleet for defense needs; and (3) the status of the mandated national strategies related to the U.S.-flag fleet.
GAO reviewed relevant laws and analyzed DOT and DOD documents and government cargo data for fiscal years 2012–2017. GAO also interviewed officials from DOT, DOD, and other federal agencies subject to cargo preference; MSP vessel operators; and other stakeholders.

What GAO Found

U.S. government support for the U.S.-registered (U.S.-flag) fleet has helped meet national defense needs, but it has had a negative effect on some non-defense government programs. Specifically, the U.S. government supports U.S.-flag vessels through: (1) an annual stipend provided through the Maritime Security Program (MSP) and (2) cargo preferences that require federal agencies to transport certain percentages of government cargo on U.S.-flag vessels. These supports have helped ensure that a sufficient number of U.S.-flag vessels are available to meet the Department of Defense's (DOD) cargo capacity needs. Although cargo preference requirements have helped support the financial viability of U.S.-flag vessels that participate in the MSP, they have had a negative impact on some non-defense programs. For example, the requirement pursuant to which food-aid agencies send a certain percentage of food aid on U.S.-flag vessels has resulted in higher shipping costs for these agencies and has negatively affected their missions, according to officials at these agencies.
Stakeholders GAO spoke to identified two primary challenges in sustaining the internationally trading U.S.-flag fleet for national defense needs.
First, even with the annual MSP stipend, maintaining the financial viability of U.S.-flag vessels is a challenge. This challenge largely results from the higher costs of operating a U.S.-flag vessel. According to U.S. Maritime Administration (MARAD) officials, the additional cost of operating a U.S. flag vessel compared to a foreign-flag vessel has increased—from about $4.8 million annually in 2009 and 2010 to about $6.2 to $6.5 million currently—making it harder for such vessels to remain financially viable. In addition, government cargo volumes have fallen in recent years. In response to this challenge, Congress increased the MSP stipend from $3.5 million per vessel for fiscal year 2016 to $4.99 million per vessel for fiscal year 2017. MARAD officials said this increase has temporarily stabilized the financial situation of MSP vessel operators. However, MARAD officials stated trends in operating costs and government cargo suggest this will remain an ongoing challenge.
Second, a potential shortage of U.S.-citizen mariners available to crew the government-owned reserve fleet during a crisis is a challenge. DOD counts on mariners working on U.S.-flag vessels to crew this fleet when activated. A MARAD working group recently estimated a shortage of over 1,800 mariners in the case of a drawn-out military effort, although it also recommended data improvements to increase the accuracy of the count of available mariners.
The Department of Transportation (DOT) has drafted but not issued the national maritime strategies mandated by Congress. The strategies are intended to address U.S.-flag vessels' competitiveness and ensure the long-term viability of U.S.-flag vessels and U.S.-citizen mariners. According to DOT officials, a combined draft strategy was developed under the previous administration but is now being reviewed by the current administration. DOT has not established a timeline for finalizing the strategy even though it was to be completed by 2015. Without establishing a timeline to complete this required strategy, DOT continues to delay providing decision-makers the information they need to determine how best to address the challenges facing the U.S.-flag fleet.

What GAO Recommends

GAO recommends that DOT complete the national maritime strategy and establish time frames for its issuance. DOT concurred with our recommendation and provided technical comments, which we incorporated as appropriate.


Question:
Why GAO Did This Study

DOD plans to spend about $1.66 trillion to develop its current portfolio of major weapon systems. Potential adversaries have developed advanced cyber-espionage and cyber-attack capabilities that target DOD systems. Cybersecurity—the process of protecting information and information systems—can reduce the likelihood that attackers are able to access our systems and limit the damage if they do.
GAO was asked to review the state of DOD weapon systems cybersecurity. This report addresses (1) factors that contribute to the current state of DOD weapon systems' cybersecurity, (2) vulnerabilities in weapons that are under development, and (3) steps DOD is taking to develop more cyber resilient weapon systems.
To do this work, GAO analyzed weapon systems cybersecurity test reports, policies, and guidance. GAO interviewed officials from key defense organizations with weapon systems cybersecurity responsibilities as well as program officials from a non-generalizable sample of nine major defense acquisition program offices.

What GAO Found

The Department of Defense (DOD) faces mounting challenges in protecting its weapon systems from increasingly sophisticated cyber threats. This state is due to the computerized nature of weapon systems; DOD's late start in prioritizing weapon systems cybersecurity; and DOD's nascent understanding of how to develop more secure weapon systems. DOD weapon systems are more software dependent and more networked than ever before (see figure).
Automation and connectivity are fundamental enablers of DOD's modern military capabilities. However, they make weapon systems more vulnerable to cyber attacks. Although GAO and others have warned of cyber risks for decades, until recently, DOD did not prioritize weapon systems cybersecurity. Finally, DOD is still determining how best to address weapon systems cybersecurity.
In operational testing, DOD routinely found mission-critical cyber vulnerabilities in systems that were under development, yet program officials GAO met with believed their systems were secure and discounted some test results as unrealistic. Using relatively simple tools and techniques, testers were able to take control of systems and largely operate undetected, due in part to basic issues such as poor password management and unencrypted communications. In addition, vulnerabilities that DOD is aware of likely represent a fraction of total vulnerabilities due to testing limitations. For example, not all programs have been tested and tests do not reflect the full range of threats.
DOD has recently taken several steps to improve weapon systems cybersecurity, including issuing and revising policies and guidance to better incorporate cybersecurity considerations. DOD, as directed by Congress, has also begun initiatives to better understand and address cyber vulnerabilities. However, DOD faces barriers that could limit the effectiveness of these steps, such as cybersecurity workforce challenges and difficulties sharing information and lessons about vulnerabilities. To address these challenges and improve the state of weapon systems cybersecurity, it is essential that DOD sustain its momentum in developing and implementing key initiatives. GAO plans to continue evaluating key aspects of DOD's weapon systems cybersecurity efforts.

What GAO Recommends

GAO is not making any recommendations at this time. GAO will continue to evaluate this issue.


Question:
Why GAO Did This Study

NNSA has several mission needs for enriched uranium, including providing LEU to fuel a nuclear reactor that produces tritium—a key isotope used in nuclear weapons. NNSA has a pressing defense need for unobligated LEU to fuel this reactor, meaning the uranium, technology and equipment used to produce the LEU, must be U.S. in origin. Because the United States lost its only source of unobligated LEU production in 2013, the supply is finite.
A House Armed Services Committee report included a provision for GAO to assess NNSA's plans to manage tritium and enriched uranium. This report examines (1) the actions NNSA is taking to extend its existing LEU inventories to address near-term tritium needs; (2) the extent to which NNSA's plan to analyze long-term options for supplying enriched uranium is consistent with DOE directives; and (3) NNSA's preliminary cost estimates for long-term uranium enrichment technology options and the extent to which they meet best practices for reliable estimates. GAO analyzed NNSA plans on costs, schedules, and risks; compared them with its guide on best practices in cost estimating; and interviewed NNSA and other officials.

What GAO Found

The National Nuclear Security Administration (NNSA), a separately organized agency within the Department of Energy (DOE), is taking or plans to take four actions to extend inventories of low-enriched uranium (LEU) that is unobligated, or carries no promises or peaceful use to foreign trade partners until about 2038 to 2041. Two of the actions involve preserving supplies of LEU, and the other two involve diluting highly enriched uranium (HEU) with lower enriched forms of uranium to produce LEU. GAO reviewed these actions and found the actual costs and schedules for those taken to date generally align with estimates. NNSA and GAO have identified risks associated with two of these actions. One of these risks has been resolved; NNSA is taking steps to mitigate another, while others, such as uncertainty of future appropriations, are unresolved.
NNSA's preliminary plan for analyzing options to supply unobligated enriched uranium in the long term is inconsistent with DOE directives for the acquisition of capital assets, which state that the mission need statement should be a clear and concise description of the gap between current capabilities and the mission need. The scope of the mission need statement that NNSA has developed can be interpreted to meet two different mission needs: (1) a need for enriched uranium for multiple national security needs, including tritium, and (2) a specific need for enriched uranium to produce tritium. The DOE directives also state that mission need should be independent of and not defined by a particular solution. However, NNSA is showing preference toward a particular solution—building a new uranium enrichment capability—and the agency has not included other technology options for analysis. Without (1) revising the scope of the mission need statement to clarify the mission need it seeks to achieve and (2) adjusting the range of options it considers in the analysis of alternatives process, NNSA may not consider all options to satisfy its mission need.
Although the scope of the mission need statement is unclear, NNSA has prepared preliminary cost estimates for the two uranium enrichment technology options—the large and small centrifuge—that the agency considers to be the most feasible. However, these estimates are limited in scope and do not fully meet best practices for reliable cost estimates. Based on GAO's review of NNSA documents, NNSA appears to favor an incremental approach to reestablishing an enrichment capability that could ultimately meet all national security needs for enriched uranium. The estimates' scope is limited, however, in that they reflect only the costs of the first increment—producing LEU for tritium—and do not reflect the full costs of building a uranium enrichment facility that could meet the range of enriched uranium needs. GAO's cost guide—which provides cost estimating best practices—states that the scope of preliminary cost estimates should reflect full life-cycle costs. Also, NNSA's estimates for the two options minimally or partially met best practice characteristics for reliable cost estimates even when assessed for the more limited mission scope. For example, the estimates excluded certain costs and did not describe the calculations used. NNSA officials said that the cost estimates are preliminary and will be revised. By developing reliable cost estimates that are aligned with the revised mission need statement and consistent with best practices, NNSA will reasonably ensure that it has reliable information to make a decision about which option to select.

What GAO Recommends

GAO is making two recommendations, including that NNSA revise the scope of its mission need statement and ensure that the scope of its cost estimates are aligned with the revised statement while developing estimates consistent with best practices. NNSA described actions planned and in process to address both recommendations.


Question:
Why GAO Did This Study

Veterans' access to timely health care at VA medical facilities has been a long-standing problem identified by GAO and VA's Office of Inspector General. The remote nature of the Pacific Islands creates some unique challenges for VAPIHCS, which may affect its ability to provide the approximately 50,000 veterans it serves in American Samoa, Guam, Hawaii, and the Commonwealth of the Northern Mariana Islands with timely access to primary, mental health, and specialty care.
House Report 114–497 included a provision for GAO to review VHA's efforts to provide timely access to health care within VAPIHCS. Among other things, this report examines: the extent to which the VAPIHCS veterans received (1) timely primary and mental health care, and (2) timely specialty care; and (3) any challenges VAPIHCS faced in recruiting and retaining physicians, and strategies to resolve them. GAO reviewed relevant policy documents and a randomly selected, non-generalizable sample of 164 medical records, and interviewed VHA, VAPIHCS, and DOD officials.

What GAO Found

For the sample of veterans' medical records that GAO reviewed, most veterans received primary and mental health care from the Department of Veterans Affairs (VA) Pacific Islands Health Care System (VAPIHCS) within timeliness goals set by VA's Veterans Health Administration (VHA). However, GAO also found that some of these veterans experienced delays related to the processing of their enrollment applications, contacting them to schedule appointments, and completing comprehensive mental health evaluations. These delays were similar to some GAO had identified in previous work pertaining to veterans' access to care nationwide.
For the sample of veterans' medical records that GAO reviewed, VAPIHCS referred nearly all specialty care to non-VA providers within VHA's timeliness goal, but the time taken to provide care was variable and sometimes lengthy. Specifically, VAPIHCS sent specialty care referrals to
the Veterans Choice Program (Choice Program)—for veterans that GAO reviewed, the number of days to receive care from the Choice Program was, on average, 75 days.
Department of Defense (DOD) military treatment facilities—for veterans that GAO reviewed, the number of days to receive care from the two DOD facilities for which VAPIHCS has agreements was, on average, 37 days from one facility and 47 days from the other.
GAO identified weaknesses in VAPIHCS' management of its referral process for sending veterans for specialty care services at one of the two military treatment facilities. GAO found VAPIHCS did not always manage referrals to the military treatment facility in a timely way and there was inconsistent guidance describing the roles and responsibilities of the VAPIHCS staff involved in the process. These weaknesses may have contributed to the amount of time it took for veterans to receive specialty care services.
GAO also found that VAPIHCS faces challenges recruiting and retaining physicians. As of October 2017, 17 of approximately 100 VAPIHCS physician positions were vacant, as were several other types of health care providers. Some of the challenges VAPIHCS faced are unique to the Pacific Islands, such as the availability of only one local medical school from which to recruit, along with travel burdens and a high cost of living that may discourage physicians from relocating there. Other challenges were similar to those GAO has previously identified as faced by VA medical centers across the country, such as differences in interpretation of hiring and recruiting policies. VAPIHCS officials said they use several strategies to help recruit and retain physicians, including VHA strategies used by other VA medical centers such as financial incentives and an educational debt reduction program. Although they described limits to the success of some of these strategies, they have not evaluated their effectiveness. Without completing an evaluation of its strategies, VAPIHCS may not be optimizing its resources to improve its hiring efforts and may continue to struggle with physician shortages.

What GAO Recommends

GAO makes four recommendations, including that VAPIHCS improve monitoring of referrals to one DOD facility and evaluate the effectiveness of physician recruitment and retention strategies. VA concurred with three recommendations and partially concurred with the fourth. GAO maintains that monitoring referrals to the DOD facility is needed, as discussed in the report.


Question:
Why GAO Did This Study

HUD established DEC in 1998 to consolidate enforcement functions. In fiscal year 2017, DEC received about 2,800 referrals from program offices for oversight of and enforcement actions against property owners, public housing agencies, and state and local grantees that do not comply with requirements.
The Joint Explanatory Statement accompanying the Consolidated Appropriations Act, 2017, included a provision for GAO to assess DEC's effectiveness addressing noncompliance. GAO examined (1) the processes selected program offices have in place to make referrals, (2) how DEC assesses its performance, and (3) challenges that may affect the ability of DEC to achieve its mission. GAO reviewed agreements and referral data between DEC and three of the nine HUD program offices that made referrals to DEC from fiscal years 2014 to 2017 (accounting for 73 percent of the total referrals during that period), and interviewed HUD staff in headquarters and field offices.

What GAO Found

The three program offices of the Department of Housing and Urban Development (HUD) that GAO examined have a process in place for referring cases of potential noncompliance to the Departmental Enforcement Center (DEC), but two of the offices do not provide their staff with specific guidance on when to make referrals. The Office of Multifamily Housing makes referrals to DEC based on defined thresholds for noncompliance, such as for properties that do not pass physical inspections. In contrast, the Offices of Public and Indian Housing (PIH) and Community Planning and Development (CPD) have broad guidelines but not specific thresholds for when to refer an entity to DEC. These two offices do not provide field staff with specific guidance to help determine which housing agencies or grantees to refer to DEC for possible enforcement action. As a result, the offices cannot ensure that decisions on whether to make referrals are made on a well-supported and consistent basis, potentially limiting DEC's effectiveness in fulfilling its mission of providing independent oversight of HUD's programs. In addition, PIH and CPD have targets for how many annual referrals the program office will make to DEC, but the targets are not based on program risk. According to federal internal control standards, management should identify, analyze, and respond to risks related to achieving the defined objectives. Without a target number of referrals based on program risk, PIH and CPD cannot be confident that the number of cases referred to DEC is appropriate and that DEC resources are being used efficiently.
DEC tracks some performance measures, but it largely measures outputs, such as number of work assignments completed, rather than outcomes, such as financial performance improvements resulting from its work, that would help assess the impact of its activities. DEC also does not track the status of recommendations it makes to program offices or measure indicators of its timeliness in completing its reviews for the referrals it receives. In addition, GAO found that DEC staff did not consistently record two key data elements (including the corrective action taken) in the spreadsheet used to track referrals. Improving DEC's performance measurement system and data recording would be consistent with federal internal control standards and allow DEC to better assess its effectiveness, ensure accountability, and identify potential improvements.
DEC has experienced various information technology challenges that have affected its ability to carry out its mission. For example, DEC's current system is not designed to allow staff to easily determine the basis for certain referrals or identify and analyze trends in referrals over multiple years. In addition, DEC has experienced continuing outages and breaks in service. HUD has developed plans for a replacement system, but funding constraints have delayed the implementation of the new system. DEC staff also noted that the organizational location of DEC within the Office of General Counsel was a challenge to carrying out its mission because it limited DEC's ability to hold program offices accountable for corrections. HUD disagreed and also stated that the department has no plans to relocate DEC. Based on GAO's review, other factors, such as the lack of guidance for making referrals (discussed above), may better explain why DEC may not be utilized more effectively.

What GAO Recommends

GAO is making eight recommendations to HUD related to DEC, including for staff guidance on when to make referrals; targets for the number of DEC referrals based on program risk; outcome measures to track performance; and controls to ensure consistent data recording. HUD agreed with five of the eight recommendations, noting that setting referral targets was inconsistent with basing them on program risk. GAO maintains that setting referral targets can help ensure that program offices make referrals to DEC.


Question:
Why GAO Did This Study

While federal law prohibits federal funding for abortions in most circumstances, state Medicaid programs are required to cover abortions in limited circumstances. CMS is responsible for monitoring state compliance with federal requirements. However, concerns have been raised about challenges women may face obtaining Medicaid coverage for abortions eligible for federal funding, as well as with abortion access more broadly.
GAO was asked to review issues related to abortion access. This report examines (1) factors that may present challenges to women, including Medicaid beneficiaries, accessing abortions; and (2) federal and state information on the number of abortions eligible for federal Medicaid funding. GAO reviewed federal laws, regulations, and data sources; surveyed and received responses from Medicaid program officials in all 50 states and the District of Columbia; conducted a literature review; and interviewed CMS officials and eight abortion providers selected based on factors such as variation in Medicaid abortion coverage and geography.

What GAO Found

Women could face various challenges accessing abortions depending on where they live, and Medicaid beneficiaries may face additional challenges in some states. GAO identified seven key factors that could pose challenges to women accessing abortions, based on its interviews with providers and review of the literature: gestational limits, mandatory counseling, out-of-pocket costs, parental involvement requirements, provider availability, stigma and harassment, and waiting period requirements. The presence of these factors and their effect on abortion access—such as delays in care or increased costs—varied by state.
GAO also found that state variation in Medicaid abortion coverage and payment requirements could further complicate access for program beneficiaries. State Medicaid programs are generally required to cover abortions and can seek federal funding for such coverage when the pregnancy is the result of an act of rape or incest, or the life of the pregnant woman would be endangered unless an abortion is performed. States may also cover abortions under other circumstances, but federal funds may not be used. In GAO's survey, one state reported not covering abortions in cases of rape or incest, and 14 states reported not covering the drug used in medical abortions, which they are generally required to cover if the abortion is otherwise eligible for federal funding. Officials from the Centers for Medicare & Medicaid Services (CMS), the federal agency that oversees Medicaid, were unaware that these states were not covering the drug, and thus, have not taken any actions to address states' non-compliance.
Federal information on the number of abortions eligible for federal Medicaid funding is incomplete, limiting CMS's ability to ensure proper payments and states' coverage of such abortions. For example, the form CMS-64, which states use to report Medicaid expenditures, does not collect information on the number of abortions paid for by managed care—the delivery system serving most Medicaid beneficiaries. It also does not include this information from 8 states that GAO identified as incorrectly reporting abortion costs on the form. While also not complete, state information reported in GAO's survey was more comprehensive, and showed a wide range in the number of abortions eligible for federal funding covered across the 42 states that reported such information.

What GAO Recommends

GAO is making three recommendations to CMS to ensure state compliance with federal requirements for Medicaid abortion coverage, including coverage of the drug used for medical abortions. The Department of Health and Human Services concurred with these recommendations.


Question:
Why GAO Did This Study

While foreign states generally cannot be sued in a U.S. court, under FSIA, parties can sue governments for certain crimes such as injury or death from an act of terrorism, if certain factors are present. State is required by statute to serve notice of such suits or default judgments when other means for effecting service are not available, and charges plaintiffs a fee of $2,275 to complete this task. Plaintiffs in such cases may also qualify for compensation from a fund that Congress established called the U.S. Victims of State Sponsored Terrorism Fund.
In this report, GAO examines (1) how State completes this service and the length of time it takes to complete requests, and (2) whether State has implemented key controls for executing service requests promptly. GAO reviewed State regulations, guidance, case files, and data from 2007 through 2017; and interviewed State officials in Washington, D.C., the Czech Republic, Germany, and Switzerland, which handle the vast majority of cases. GAO assessed State's controls against federal internal control standards.

What GAO Found

The Department of State (State) notifies sovereign defendants of court proceedings under the Foreign Sovereign Immunities Act (FSIA) in a four stage process that has taken on average about 5 months to complete. State headquarters has overall responsibility for delivering legal documents but U.S. embassies and foreign governments play key roles as well. From 2007 through 2017, State completed 229 requests for delivery of legal documents in an average of about 5 months, but about 28 percent of the requests took longer than 6 months and 7 requests took more than a year. Slow delivery could adversely affect a plaintiff's ability to obtain compensation from a special victims' fund that Congress set up in 2015.
State's guidance and federal internal control standards require controls such as accurate and complete record-keeping, continuous monitoring, and analysis of data; however, GAO found that State lacks several key controls to manage its delivery of legal documents. First, State's records are incomplete. For example, for 82 percent of the cases, State had no information about when it received court requests. Second, State did not monitor the progress of cases, resulting in slow service. This slow service led State to waive fees of about $57,000 because checks had expired. Third, State did not analyze case data to identify factors contributing to slow service, or establish timeframes for completing service. As a result, managers lack a sound basis for making decisions on how to improve timeliness. In June 2018, State took some actions based on GAO's review to improve its performance, including preparing step-by-step guidance and developing a new record-keeping system, but further actions could fill the gaps that have impaired program performance.

What GAO Recommends

GAO is making five recommendations to State, including that it update its record-keeping guidance to ensure its records are accurate and complete, monitor the progress of requests, periodically analyze data to identify causes of slow service and take corrective actions, and establish timeframes for completing service. State concurred with all five of GAO's recommendations and identified actions it plans to take to address them.


Question:
Why GAO Did This Study

VHA oversees one of the largest health care systems, serving approximately 9-million veterans at numerous health care facilities, including 170 medical centers. To ensure a safe environment for veterans and employees, VHA must keep its facilities clean and well maintained.
GAO was asked to examine (1) how VHA medical centers identify maintenance and repair needs and challenges they face in addressing those needs, and (2) to what extent VHA provides oversight to ensure medical centers are providing a safe, clean, and functional environment.
GAO reviewed VHA's procedures and standards related to facility operations and maintenance functions at medical centers and interviewed VHA's administrative office officials regarding oversight of these functions. GAO also interviewed VHA officials from three regional offices and six medical centers selected based on factors such as geographic location and veteran population served, and conducted site visits at four of these medical centers.

What GAO Found

Veterans Health Administration's (VHA) medical centers conduct regular inspections of the settings in which patients receive health care services, called the “environment of care”, to identify maintenance and repair needs. These inspections also help ensure compliance with accreditation standards requiring, among other things, that utility systems operate properly and that areas are clean and in good repair. The main three steps in the process associated with these inspections are shown below. In addition to the environment of care inspections, VHA conducts other periodic assessments of facilities' major systems, such as plumbing and air conditioning.
VHA inspections routinely identify deficiencies reflective of an aging infrastructure—VHA's buildings are on average 55 years old. This situation in turn is leading to workload and staffing challenges in addressing maintenance and repair needs. For example, according to VHA's 2017 data, medical centers reported conducting approximately 11,000 total inspections for the year that resulted in about 128,000 identified deficiencies. Most of these deficiencies were closed within 14 business days, as required by VHA. However, nearly 30,000 of them were not closed or had been addressed through a plan for future work. Medical center officials added that correcting deficiencies may only be a temporary solution for issues related to aging structures that need extensive repairs and renovations. In addition, VA headquarters and field officials said that staff vacancies are common and can affect the efficiency and speed of maintenance and repairs.
VHA provides guidance and selected oversight to ensure medical centers implement the process for environment of care inspections. However, VHA lacks performance goals, objectives, and measures that would enable it to provide effective oversight, address challenges, and assess how well it is achieving a clean, safe, and functional environment. As part of ensuring compliance with the inspection process, VHA measures whether medical centers meet certain requirements, such as having appropriate staff present for inspections. VHA does not, however, have measures that enable it to assess how well medical centers are achieving desired outcomes. Although it has stated its intent to develop such measures, VHA has not yet committed to a time frame for doing so.

What GAO Recommends

GAO recommends that VHA set a timeline for defining goals, objectives, and outcome-oriented performance measures that can address challenges and help achieve a clean and safe care environment. VA concurred with the recommendation and provided general and technical comments, which GAO incorporated as appropriate.


Question:
Why GAO Did This Study

The cost of the decennial census has steadily increased over the past several decades, with self-response rates declining over the same period. The largest and costliest operation that the Bureau undertakes, NRFU is the Bureau's attempt to enumerate households not initially self-responding to the census.
GAO was asked to review NRFU implementation during the 2018 Census Test as well as the Bureau's overall readiness for peak field operations, which cover the actual enumeration of residents. This report examines (1) how peak field operations, including NRFU, were implemented during the test; and (2) the extent to which prior test implementation issues have been addressed. GAO reviewed test planning and training documentation, as well as production and payroll data. At the test site, GAO observed and interviewed enumerators, field supervisors, and managers conducting peak operations.

What GAO Found

In preparation for the 2020 census, the Census Bureau (Bureau) set out to enumerate over 140,000 housing units during the 2018 Census Test at a site in Providence County, Rhode Island. The 2018 Census Test marked the Bureau's last chance to test enumeration procedures for peak field operations under census-like conditions before 2020. Implementation of this test identified the following concerns:
The Bureau experienced operational issues during implementation of the Non-Response Follow-Up (NRFU) as part of the 2018 Census Test. For example, the Bureau had not finalized procedures for data collection during late phases of NRFU (e.g., after multiple attempts to interview had been made) until after the work had already started. As a result, enumerators and their supervisors did not have standardized procedures during the test, which made it difficult to evaluate the effectiveness of the test procedures. GAO also observed a range of other NRFU implementation issues during the test, such as the Bureau's use of progress reporting that overstates the number of NRFU cases not needing any additional fieldwork and the Bureau having fewer of its enumerators work Saturdays, which can be among the most productive interview days. The Bureau is taking steps to assess and mitigate these and other issues that GAO identified.
The Bureau's field workforce was not fully prepared to face all of the enumeration challenges that arose during the test. For instance, the Bureau expects census field supervisors to provide front-line coaching to enumerators but did not screen these employees to ensure they had the needed skills. Moreover, it did not provide them with the authorities and information that would have helped them serve that role. As a result, we believe that supervisors did not have the casework expertise, information, or authority to help enumerators with procedural questions, and higher-level census field managers ended up providing direct support to enumerators.
While the Bureau provided extensive online and in-person training to enumerators prior to NRFU fieldwork for the 2018 Census Test, the Bureau lacked any standardized form of mid-operation training or guidance as new procedures were implemented. GAO observed that during the test some enumerators continued to have questions and were uncertain about procedures. Developing targeted, location-specific training could help ensure that, in 2020, enumerators receive the guidance they need to collect census data consistently and in accordance with NRFU procedures.
The Bureau has made progress addressing prior test implementation issues but still faces challenges. For example, the Bureau improved its collection of enumerator case notes, which reflect real-time knowledge gained during enumeration. However, enumerators did not always report cases using flags built in to their interviewing device that would benefit from supervisory review, such as for language barriers. Moreover, supervisors were not systematically analyzing case notes to identify cases not flagged properly. As a result, critical data on fieldwork challenges were not being communicated effectively to those who could analyze and use them.

What GAO Recommends

GAO recommends that the Bureau (1) determine procedures for late-NRFU data collection; (2) align census field supervisor screening, authorities, and information flows; (3) prepare for targeted mid-operation training or guidance as needed; and (4) improve training on reporting cases that need supervisory attention and alternative ways to communicate these cases.
The Department of Commerce agreed with GAO's findings and recommendations, and the Bureau provided technical comments that were incorporated as appropriate.