Question:
Why GAO Did This Study

In 1999, Congress required DOD to monitor the time that individual service members spend away from home and set a threshold to limit excessive time away. At the time, the threshold was no more than 220 days served away from home in a 365-day period. In the interest of national security, in 2001 DOD exercised a provision in the law and waived the requirement to limit time away for service members. Recently, DOD leaders have stated that the continued high pace of military operations have limited their ability to rebuild readiness.
Senate Report 114-255 includes a provision for GAO to review the root causes of degraded readiness, including reviewing DOD's management of perstempo. This report assesses the extent to which DOD, the services, and SOCOM have (1) policies with specific and measurable thresholds on perstempo and (2) reliable data to monitor perstempo.
GAO analyzed DOD, service, and SOCOM perstempo policies and analyzed DOD-wide perstempo data for fiscal years 2012-2016.

What GAO Found

The Department of Defense (DOD), military service, and U.S. Special Operations Command (SOCOM) policies vary in identifying specific and measurable thresholds on the total time individual service members can be away from home, known as personnel tempo or “perstempo.” DOD's policy issued in 2013 states that service members should not be deployed for longer than they are at home. However, the policy does not set thresholds for perstempo, which includes time away from home for exercises and training in addition to deployment. Service members are sometimes away from home for long periods for training, exercises, or other activities. For example, Air Force officials told GAO that F-16 pilots participate in multiple exercises every year that require them to spend significant time away from home. The Navy and SOCOM set specific and measurable perstempo thresholds in policy in 2014 and 2016, respectively. However, the other services either are not enforcing or have not established specific and measurable perstempo thresholds in their policies. DOD has maintained the waiver of statutory perstempo thresholds since 2001, and officials have cited the effect of the high pace of operations and training on service members; however, DOD has not taken action to focus attention on the management of perstempo thresholds within the services and department-wide. Unless DOD ensures that perstempo thresholds are established and followed while statutory thresholds are waived, DOD will be unable to judge whether service members are spending too much total time away from home and, if so, whether this has resulted in any associated effects on military readiness.
DOD does not have reliable data to monitor perstempo because the data are incomplete. Based on available DOD-wide data, GAO estimated that for fiscal year 2016 at least 51,000 service personnel spent more than 7 months away from home. However, that number is conservative because the analysis is limited by incomplete data. Specifically:
DOD analysis shows that perstempo records are missing for at least 145,000 personnel who deployed in fiscal years 2014-2016.
For fiscal years 2012-2016, 30 percent of DOD's perstempo records were missing information that identifies service members' occupations, 14 percent were missing information that identifies the purpose of the perstempo events, and 8 percent were missing information that identifies the category of perstempo events.
The Navy identified about 13,000 personnel who spent more than 220 days away from home in fiscal year 2016 but were not accounted for in the DOD-wide data, and DOD officials could not explain why they were missing.
Without taking steps to emphasize the collection of complete and reliable perstempo data, DOD will be limited in its ability to assess the amount of time service members are serving away from home for all perstempo events and in its ability to use that information to assist in gauging the stress on the force.

What GAO Recommends

GAO recommends that DOD (1) clarify its policy to include specific and measurable department-wide perstempo thresholds for use while statutory thresholds are waived or ensure service-level policies are established and followed, and (2) take steps to emphasize the collection of complete and reliable perstempo data. DOD concurred with GAO's recommendations.


Question:
Why GAO Did This Study

In fiscal year 2017, the federal government awarded approximately $675 billion in grants to state and local governments. GAO was asked to review the federal grants workforce training. GAO reviewed (1) OPM's, OMB's, and the CFOC's actions to address the grants workforce's training needs; (2) the extent to which grants workforce training at selected agencies is consistent with leading practices; and (3) how selected agencies monitor and oversee training of their grants workforce. GAO selected HHS, USDA, and Education and several of their sub-agencies based on their grants spending and numbers of grants management specialists. GAO reviewed OPM and OMB memorandums and guidance, compared selected agency training practices against leading training practices, and interviewed officials.

What GAO Found

The Offices of Personnel Management (OPM) and Management and Budget (OMB) and the Chief Financial Officers Council (CFOC) have taken some steps to help ensure the federal grants workforce receives training. For example, OMB worked with the CFOC to issue five basic grants training modules and a “Career Roadmap” for grants managers; however, they did not widely publicize the resources. Many of the officials with whom GAO spoke at selected sub-agencies at the Departments of Health and Human Services (HHS), Agriculture (USDA), and Education (Education) were unfamiliar with the Career Roadmap and made limited use of the training resources. Further, OMB and CFOC do not collect detailed user data or feedback, limiting their abilities to determine the usefulness of these resources.
GAO found that sub-agencies at HHS, USDA, and Education vary in following leading training practices for planning, designing, implementing, and evaluating their grants training programs. Additionally, HHS, USDA, and Education could not readily identify grants management specialists—the 1109 job series—or employees in other job series working on grants without querying each sub-agency. These agencies cannot do so because their central offices do not have a reporting mechanism tracking their sub-agencies' grants workforce. Further, agency central offices do not evaluate sub-agency grants training efforts. Without sufficient monitoring and oversight, the agencies cannot have reasonable assurance that their sub-agencies are sufficiently training their grants workforce so they have the necessary knowledge, skills, and abilities to properly manage, administer, and monitor the billions of dollars that the federal government spends on grants annually.

What GAO Recommends

GAO is making five recommendations including that OMB, working with the CFOC, should (1) publicize the Career Roadmap and (2) collect data metrics and user feedback on its use. HHS, USDA, and Education should establish processes to centrally monitor and evaluate their grants training, including identifying the grants workforce and ensuring consistency with leading practices. HHS and USDA concurred, Education generally concurred, and OMB partially concurred with our recommendations. OPM had no comments on the report.


Question:
Why GAO Did This Study

First fielded in 1976 on Shemya Island in Alaska, the Cobra Dane radar faces growing sustainment challenges that DOD plans to address through modernization projects. Anticipating future needs, DOD began investing in new radar systems that share capabilities with Cobra Dane to support ballistic missile defense and space surveillance, including the LRDR (Alaska), the Space Fence (Marshall Islands), and the Pacific Radar (location to be determined).
The conference report accompanying a bill for the National Defense Authorization Act for Fiscal Year 2018 included a provision that GAO review the Air Force's report to Congress on the operation and sustainment of Cobra Dane. This report identifies information included in the Air Force's report and describes additional information that GAO reviewed on (1) the capabilities of the Cobra Dane radar and other planned radars to meet DOD's mission requirements, (2) Cobra Dane's operational availability and the plan to mitigate the effect on those missions when Cobra Dane is not available, and (3) DOD's funding plan and project cost estimates for the operation and sustainment of Cobra Dane and its site at Shemya Island. GAO reviewed the Air Force report and related documentation, and interviewed relevant officials.

What GAO Found

In its January 2018 report to Congress, the Air Force reported how the Cobra Dane radar and the Long Range Discrimination Radar (LRDR) have shared and unique capabilities to support ballistic missile defense and space surveillance missions. The report noted that the respective locations of both radar systems affect their ability to provide those capabilities. The Department of Defense (DOD) also has other radar investments—the Pacific Radar and the Space Fence, which, according to DOD officials, may reduce DOD's reliance on Cobra Dane to provide ballistic missile defense and space surveillance capabilities.
The Air Force's report to Congress noted that Cobra Dane met its requirement for operational availability, which refers to the percentage of time that the radar is able to meet its missions. GAO found that the Air Force has developed procedures to mitigate risks when Cobra Dane is not available. For example, U.S. Northern Command and Missile Defense Agency (MDA) officials stated that they can mitigate risks when Cobra Dane is not available by using the Sea-Based X-band radar to provide support for ballistic missile defense. The Air Force would face some limitations in its ability to conduct space surveillance if Cobra Dane were not available, as Cobra Dane tracks objects no other radar can track. However, MDA officials noted there are no plans to take Cobra Dane offline long enough to compromise space surveillance.
The Air Force and MDA plan to contribute total funding of $278.6 million for the operation and sustainment of Cobra Dane, according to their fiscal year 2019 budget plans. Specifically, the Air Force and MDA plan to share funding for the operation and maintenance of the Cobra Dane radar and for three modernization projects that make up their sustainment plan for the radar. Further, the Air Force report noted that the Air Force also plans to provide $140 million in funding for the sustainment and maintenance of operational access to Cobra Dane's site at Shemya Island. In addition, GAO found that the Air Force developed a total cost estimate for one project—known as the transmitter group replacement—but not for its other two projects. Air Force officials plan to complete cost estimates for those two projects in conjunction with their fiscal year 2020 budget submission.


Question:
Why GAO Did This Study

Biological threats come from a variety of sources and can pose a catastrophic danger to public health, animal and plant health, and national security. Threat awareness, which consists of activities such as collecting and analyzing intelligence, developing risk assessments, and anticipating future threats, is vital to help federal agencies identify necessary biodefense capabilities and ensure investments are prioritized to make effective use of federal funds.
GAO was asked to review how key federal agencies develop and share threat awareness information, and how that information informs further investments in biodefense. This report describes: (1) the types of actions that key federal agencies have taken to develop biological threat awareness, and how that information is used to support investment decisions; (2) the extent to which these agencies have developed shared threat awareness; and (3) how DHS's NBACC determines what additional threat characterization knowledge to pursue.
GAO analyzed federal policies, directives, and strategies related to biodefense, as well as agency documents such as threat assessments and modeling studies. We identified five key biodefense agencies based on review of the roles designated in these documents. GAO interviewed officials from these agencies about threat awareness activities, and reviewed prior GAO work and related biodefense studies. Each of the key agencies reviewed a draft of this report and provided technical comments that GAO incorporated as appropriate.

What GAO Found

Key biodefense agencies—the Departments of Homeland Security (DHS), Defense (DOD), Agriculture (USDA), and Health and Human Services (HHS), and the Environmental Protection Agency—conduct a wide range of activities to develop biological threat awareness for intentional and naturally occurring threats, and reported using that information to support investment decisions.
Intelligence gathering: Agencies use a combination of intelligence gathering on adversaries' capabilities to cause harm with a biological weapon and global disease surveillance to monitor threats from naturally occurring health threats that might impact humans, animals, or plants.
Scientific research: Agencies use traditional laboratory research to help understand the characteristics of various threat agents, including their virulence, stability, and ability to be dispersed through various methods. Scientific research is also performed on emerging pathogens to understand their means of transmission, host susceptibility, and effects of infection.
Analysis activities: Agencies use modeling studies and other analytical work to help determine the scope and impact of possible biological threats.
These three activities help agencies identify and prioritize the most dangerous biological threats, which can then be used to guide biodefense investments. For example, USDA told GAO it uses threat information to determine which foreign animal diseases represent its highest priorities based on the potential of those agents to cause catastrophic harm, and those priorities are used to inform investments. Similarly, HHS said it conducts threat awareness activities to help inform the development and acquisition of human medical countermeasures.
Federal agencies with key roles in biodefense share biological threat information through many different mechanisms designed to facilitate collaboration among government partners, including working groups and interagency agreements. For example, agency officials reported using collaborative mechanisms to coordinate activities and avoid duplication and overlap. However, as GAO and others have noted, opportunities exist to better leverage shared resources and inform budgetary tradeoffs. Recent legislation requires key biodefense agencies to create a national biodefense strategy that has the potential to help address these issues, by, among other things, supporting shared threat awareness. Until the strategy is developed, the extent to which it will meet this need is unknown.
The threat characterization research agenda at DHS's National Biodefense Analysis and Countermeasures Center (NBACC) is based primarily on the results and knowledge gaps identified through the Bioterrorism Risk Assessment (BTRA). According to DHS officials, the knowledge gaps deemed most critical include data about biological agents that have a high impact on BTRA consequence estimates and also a high degree of uncertainty. Each year NBACC produces an annual plan that outlines new research projects intended to address these knowledge gaps, and incorporates additional planning criteria, such as interagency stakeholder input, resource availability, and maintenance of required technical capabilities. According to DHS officials, the results of NBACC research were used to directly enhance the BTRA, including updating data associated with eight biological agents since 2010.


Question:
Why GAO Did This Study

Much of the voting equipment acquired with federal funds after the enactment of the Help America Vote Act in 2002 may now be reaching the end of its life span, and some states and local election jurisdictions—which number about 10,300 and generally have responsibility for conducting federal elections—have or are considering whether to replace their equipment. GAO was asked to examine voting equipment use and replacement.
This report addresses (1) the types of voting equipment jurisdictions used for the 2016 general election and their perspectives on the equipment; (2) factors considered when deciding whether to replace equipment and replacement approaches in selected jurisdictions; and (3) stakeholder perspectives on how federal voting system guidelines affect replacing and developing equipment.
GAO surveyed officials from a nationwide generalizable sample of 800 local jurisdictions (68 percent weighted response rate) and all 50 states and the District of Columbia (46 responded) to obtain information on voting equipment use and replacement. GAO also interviewed officials from (1) five jurisdictions, selected based on population size and type of voting equipment used, among other things, to illustrate equipment replacement approaches; and (2) seven voting system vendors, selected based on prevalence of jurisdictions' use of equipment, type of equipment manufactured, and systems certified, to obtain views on federal voting system guidelines. These interviews are not generalizable, but provide insights into jurisdictions' and vendors' experiences.

What GAO Found

Local election jurisdictions primarily used optical scan and direct recording electronic (DRE), also known as touch screen, equipment during the 2016 general election and were generally satisfied with voting equipment performance. Specifically, on the basis of GAO's nationwide generalizable survey of local election jurisdictions, GAO estimated that jurisdictions with 63 percent (from 54 to 72 percent) of the population nationwide used optical or digital scan equipment as their predominant voting equipment during the election, while jurisdictions with 32 percent (from 23 to 41 percent) of the population nationwide used DREs. In addition, the survey results indicated that accurate vote counting and efficiency of operation were top benefits experienced by jurisdictions for both types of equipment, and storage and transportation costs were a top challenge. Further, GAO estimated that jurisdictions with 93 percent (from 88 to 96 percent) of the population nationwide did not experience equipment errors or malfunctions on a very or somewhat common basis and jurisdictions with 96 percent (from 94 to 98 percent) of the population were very or generally satisfied with the performance of their equipment during the 2016 general election.
GAO identified four key factors that jurisdictions and states consider when deciding whether to replace voting equipment—(1) need for equipment to meet federal, state, and local voting system standards and requirements; (2) cost to acquire new equipment and availability of funding; (3) ability to maintain equipment and receive timely vendor support; and (4) overall performance and features of equipment. When replacing equipment, the five jurisdictions GAO selected for interviews used varying approaches based on their specific needs and resources. For example, Los Angeles County, California, which has a large and diverse electorate, is self-designing its own voting equipment and, according to officials, has incorporated a user-centered approach that prioritizes the needs and expectations of its voters. Lafayette County, Florida, which has a small population, joined a consortium of other small counties to help obtain funding and pool purchasing power to replace its equipment.
The state election officials we surveyed and the seven selected voting system vendors we interviewed, among other stakeholders, had varying perspectives on how the current voluntary federal voting system guidelines affected the replacement and development of voting equipment. These guidelines can be used to test and certify equipment to verify that it meets baseline functionality, accessibility, and security requirements. The stakeholders we surveyed or interviewed generally indicated that the guidelines and their associated testing processes provide helpful guidance for equipment developers, cost savings for states that do not have to duplicate federal testing, and assurance that certified equipment meets certain requirements. However, some of these stakeholders stated that aspects of the guidelines could discourage the development of innovative equipment and limit the choices of voting equipment on the market. The Election Assistance Commission (EAC), which is responsible for developing the federal guidelines, is updating them with stakeholder input and plans to issue a new version in late summer 2018.
GAO incorporated technical comments provided by the EAC and election officials from the selected local jurisdictions and their respective states as appropriate.


Question:
Why GAO Did This Study

Congress can provide budget authority to federal agencies and programs through the annual appropriations process. It can also provide budget authority through laws other than annual appropriations acts, or through permanent appropriations that permit the agency to obligate budget authority without further congressional action. Analysis of these authorities helps provide Congress with visibility into spending authority that is not considered during the annual appropriations process.
GAO was asked to update its 1996 report that had provided an inventory of accounts with spending authority and permanent appropriations for fiscal years 1985 through 1994. This report discusses (1) federal budget accounts with spending authority and permanent appropriations, including the statutory references for the authorities, changes in the number of accounts and dollar amounts since fiscal year 1994, and other relevant information; and (2) whether the identified accounts are subject to or exempt from sequestration, or subject to any special sequestration rules or limitations. GAO also is providing an online dataset of the inventory of accounts with spending authority and permanent appropriations on GAO's public website at https://www.gao.gov/products/GAO-19-36 .
GAO analyzed Office of Management and Budget (OMB) budget data to identify accounts with spending authority and permanent appropriations. GAO reviewed data through fiscal year 2015 because that was the most recent data available when GAO began its work. GAO reviewed agency information to confirm data and statutory authority. Agencies also reviewed and verified the final data for their accounts. For the sequestration designation, GAO analyzed OMB data for fiscal years 2013 and 2015--the most recently completed years for which sequestration occurred and OMB identified designations when GAO began its work.
GAO provided a draft of this report and the online dataset to the Director of OMB for review and comment. OMB staff provided technical comments, which GAO incorporated as appropriate.

What GAO Found

A total of $3.2 trillion in spending authority and permanent appropriations was reported in fiscal year 2015; an increase of 88 percent from fiscal year 1994 adjusted for inflation in fiscal year 2015 dollars. Fiscal year 1994 was the last year included in GAO's prior work. For the purposes of this report, spending authority and permanent appropriations is budget authority provided to agencies through laws other than annual appropriations acts or available permanently by law without further legislation. These authorities include permanent appropriations, contract authority, borrowing authority, offsetting collections, and monetary credits or bartering. Permanent appropriations were the primary driver of the increase in spending authority and permanent appropriations. Offsetting collections authority--which includes certain fees, fines, and penalties--also grew. Agencies reported no use of monetary credits or bartering.
a
Permanent appropriations fund federal entitlement programs, such as Medicare, administered by the Department of Health and Human Services (HHS), and the Social Security Administration's (SSA) Old-Age, Survivors, and Disability Insurance program. These programs are a significant proportion of reported budget authority in GAO's inventory of accounts in fiscal year 2015. These programs continue to show spending increases largely as a result of the aging population and rising health care costs and are projected to continue to increase in the future. In fiscal year 2015, 7 of the 10 accounts reporting the largest dollar amounts of spending authority and permanent appropriations funded entitlement programs.
Three agencies comprised three quarters of the total government-wide spending authority and permanent appropriations in fiscal year 2015.
HHS reported the largest amount of spending authority and permanent appropriations with $979 billion, or about 30 percent--mainly from Medicare. HHS overtook SSA and reported the highest dollar amounts of permanent appropriations for the first time in fiscal year 2006.
SSA reported $920 billion, or about 28 percent of total spending authority and permanent appropriations--mainly from its Old-Age and Survivor's Insurance program and the Disability Insurance program.
The Department of the Treasury reported the third largest amount--$542 billion, or about 17 percent--the majority of which is for interest on debt held by the public and intragovernmental debt. This interest dropped as a percentage of permanent appropriations since fiscal year 1994, due to lower interest rates that allow the government to borrow money more cheaply. However, interest rates are predicted to rise in the long term, which would increase the net interest costs on the debt.
The second largest reported budget authority type was offsetting collections--a total of $421 billion in fiscal year 2015, more than double the fiscal year 1994 amount, adjusted for inflation. The Postal Service reported the largest use of offsetting collections authority in fiscal year 2015 in its Postal Service Fund, which includes revenue from mail services.
Sequestration--cancellation of budgetary resources under a presidential order--is a process established in statute which helps to enforce spending limits and thereby control the deficit. In fiscal year 2015, 57 percent of spending authority and permanent appropriations authorities were exempt from sequestration, up from 37 percent in fiscal year 1994. This means that fewer of these authorities were subject to this budgetary enforcement mechanism in fiscal year 2015.


Question:
Why GAO Did This Study

The Veterans Health Administration (VHA is responsible for providing a safe and secure, yet welcoming environment for staff, patients, and visitors at nearly 170 medical centers. These facilities have been the target of violence, threats, and other security-related incidents. Assessing and managing risks a critical element for ensuring adequate physical security at these facilities.
GAO was asked to review VA's physical security risk-management policies and practices. This report: (1) assesses how VA's policies for risk management reflect prevailing standards, and (2) evaluates VA's oversight of risk management at VHA medical facilities. GAO compared VA policies to ISC standards; reviewed VA documents; interviewed VA and ISC officials; and assessed risk assessment activities at nine medical centers selected based on factors such as patient and security-incident data and geographical diversity. While not generalizable, these nine locations provide illustrative examples of how VA's policies are carried out.

What GAO Found

The Department of Veterans Affairs' (VA) risk management policies include some but not all of the elements of standards set by the Interagency Security Committee (ISC). ISC was established via executive order to develop security standards and best practices that federal agencies are to follow when developing and conducting risk assessments. As part of this process, VA's policy identifies minimum countermeasures as called for in ISC's standards. In other areas, VA policy only partially adheres or does not adhere to ISC's standards, for example:
Of the five factors ISC calls for when calculating a facility's security level, VA considers three but does not consider a facility's population and size.
VA policy does not include performance measures, such as the number of countermeasures in use or the percentage of facility assessments completed; this percentage is a key element of ISC's standards for assessing the effectiveness of an agency's security programs.
Officials at VA said that its risk management program was developed prior to the ISC standards' being issued in 2013 and that it is up to each agency to determine how to best apply the standards. Nevertheless, VA officials said they are currently reexamining their policies. Until VA reviews its policies in accordance with ISC standards, its approach to risk management may not yield the appropriate security posture needed to adequately protect its medical centers.
VA's oversight activities for risk management do not encompass key aspects of the Standards for Internal Control in the Federal Government and Circular A-123 from the Office of Management and Budget that require agencies to conduct oversight activities to ensure the accountability and effectiveness of agency programs. VA has an oversight process to ensure that biennial assessments of individual facilities' security are completed. However, VA:
does not review the quality of medical centers' required risk assessments,
does not identify whether countermeasures were implemented appropriately by the medical centers, and
does not collect system-wide data to gain an understanding of physical security issues across medical centers.
In the absence of a comprehensive VA-wide strategy or guidance that reflects these internal control standards, individual sites have established their own approaches to carrying out VA's risk management policy. For example, the nine sites GAO reviewed conducted their security assessments differently, and none of the assessments indicated that all of the threat categories in VA's policy were reviewed. The lack of a system-wide oversight strategy means that the differences among medical center approaches, along with the security effects of those different approaches, are unknown. Accordingly, VA does not know if its medical centers are adequately protected, and it may be missing opportunities to leverage resources nationally and make better informed, proactive policy decisions.

What GAO Recommends

GAO recommends that the Department of Veterans Affairs review and revise its risk management policies to reflect prevailing standards, and develop an oversight strategy to assess the effectiveness of risk management programs at VHA facilities. VA agreed with GAO's recommendations and identified steps to implement them.


Question:
Why GAO Did This Study

In recent years, some Southwest border residents and businesses reported difficulty accessing banking services, including experiencing bank account terminations and bank branch closings in the region. In addition, the World Bank and others have reported that some money transmitters have been losing access to banking services with depository institutions.
This statement is based on findings from GAO's February 2018 report on access to banking services along the Southwest border ( GAO-18-263 ) and March 2018 report on the effects of derisking on remittance flows to fragile countries ( GAO-18-313 ). GAO discusses (1) the extent to which banks are terminating accounts and closing branches in the Southwest border region, (2) the extent to which money transmitters serving selected fragile countries are facing banking access challenges, and (3) actions relevant U.S. agencies have taken to respond to these challenges. For those reports, GAO surveyed more than 400 banks, developed an econometric model on the drivers of branch closures, and conducted case studies on four countries to assess the effects of derisking on remittances flows.

What GAO Found

“Derisking” is the practice of depository institutions limiting certain services or ending their relationships with customers to, among other things, avoid perceived regulatory concerns about facilitating money laundering or other criminal activity such as financing to terrorist groups. In its February 2018 report, GAO found that money laundering risk is high in the Southwest border region because of the high volume of cash transactions, the number of cross-border transactions, and foreign account holders. According to GAO's nationally representative survey of banks, an estimated 80 percent (+/- 11) of Southwest border banks limited or did not offer accounts to customers that are considered high risk for money laundering because the customers drew heightened Bank Secrecy Act/anti-money laundering (BSA/AML) oversight—behavior that could indicate derisking. Nationally, GAO's econometric analysis suggested that counties that were urban, younger, had higher income, or had higher money laundering-related risk were more likely to lose branches.
In March 2018, GAO found that money transmitters (businesses that facilitate global money transfers) serving Haiti, Liberia, Nepal, and especially Somalia— countries it identified as fragile—all reported losing bank accounts or having restrictions placed on them during the last 10 years. As a result, 9 of the 12 money transmitters GAO interviewed, including all 4 that served Somalia, reported using channels outside the banking system (hereafter referred to as nonbanking channels), such as transporting cash to transfer funds, and that this increased their operational costs and exposure to risks. Furthermore, some banks GAO interviewed reported that they closed the accounts of money transmitters because of the high cost of due diligence actions they considered necessary to minimize the risk of fines under BSA/AML regulations. Department of the Treasury (Treasury) officials noted that despite information that some money transmitters have lost bank accounts, Treasury saw no evidence that the volume of remittances was falling or that costs of sending remittances were rising.
To address concerns about derisking, Treasury and federal banking regulators (the Board of Governors of the Federal Reserve System, the Office of the Comptroller of the Currency, and the Federal Deposit Insurance Corporation), have taken actions including issuing guidance to banks and conducting some evaluations to assess the extent to which derisking is occurring. While agencies were engaged in BSA/AML regulatory reviews, these were limited in scope and had not evaluated how regulatory concerns may influence banks to engage in derisking or to close branches. Without assessing the full range of BSA/AML factors that may be influencing banks to derisk or close branches, Treasury, the federal banking regulators, and Congress do not have the information needed to determine if BSA/AML regulations and their implementation can be made more effective or less burdensome. Moreover, in March 2018 GAO reported that Treasury could not assess the effects of money transmitters' loss of banking access on remittance flows because existing data did not allow Treasury to identify remittances transferred through banking and nonbanking channels. Nonbanking channels are generally less transparent than banking channels and thus more susceptible to the risk of money laundering and terrorism financing.

What GAO Recommends

GAO made five recommendations in the two reports: to Treasury and the federal banking regulators to conduct a retrospective review of BSA/AML regulations and their implementation, and to Treasury to assess shifts in remittance flows to nonbanking channels. Banking regulators agreed with the recommendations. GAO requested comments from Treasury, but none were provided.


Question:
Why GAO Did This Study

Millions of households subscribe to cable, satellite, and telephone companies—known as MVPDs—for television, which is generally delivered via a set-top box attached to a television. Congress directed FCC to adopt regulations to assure a commercial market for devices to access MVPDs, and in February 2016, FCC proposed a rule intended to do so. Many industry stakeholders raised concerns about the proposal's potential effects, and FCC did not issue the proposed rule. This report examines: (1) the role of set-top boxes in accessing video programming content and (2) views of selected stakeholders and experts on the need for FCC regulation regarding set-top boxes and FCC's analysis of such need.
GAO analyzed data from a media research group regarding the video market and interviewed 35 industry stakeholders including 12 MVPDs, 5 video content producers, 3 device manufacturers, 12 industry associations, and others; GAO selected stakeholders based on comments filed with FCC on its 2016 proposed rule. GAO also interviewed 11 industry analysts and experts selected based on industry coverage and publications.

What GAO Found

Set-top boxes play a significant but diminishing role in delivering video content in an evolving video market. Subscribers to multichannel video programming distributors (MVPD)—companies that provide pay television services via subscriptions such as cable and satellite companies—generally need a set-top box to access MVPD television services, and most subscribers lease a set-top box from their MVPD. However, consumers can now access video through a wide range of Internet-based services without a set-top box, using a variety of Internet-capable devices, such as tablets. Internet-based services include those providing on-demand video such as Netflix and some, such as Sling TV, providing live content similar to that from MVPDs. Some Internet-capable devices, such as Roku, allow people to watch Internet-based video on televisions. In recent years, subscriptions to MVPDs have fallen as more Internet-based services have become available. Partly in response to this competition, many MVPDs have begun offering content over the Internet to subscribers, accessible on many Internet-capable devices, including streaming devices that display it on televisions. While in most cases, MVPD subscribers still need a set-top box, a few MVPDs GAO interviewed now allow subscribers to access content they subscribe to solely over the Internet, without a set-top box.
The Federal Communications Commission (FCC) has conducted limited analysis of the need for regulations to assure a commercial market for devices, such as set-top boxes, to access MVPD services. Most stakeholders and experts GAO interviewed said that further regulations for this purpose were not needed, given recent changes in the video content market. FCC is directed by law to set regulations to assure a commercial market for devices to access MVPD services. However, the law also specifies that any such regulations may no longer apply if FCC determines that the markets for both MVPD services and devices to access MVPDs are fully competitive. Moreover, while it does not extend to independent agencies, Office of Management and Budget guidance says agencies could use analyses to evaluate the need for proposed actions. However, FCC proposed a new rule in 2016 to promote a commercial set-top box market without undertaking a comprehensive analysis of the competitiveness of the market to support the proposed rule. FCC did not enact a final rule. Stakeholders had differing views on the potential effects of the proposed rule, but some raised concerns that the rule could have had negative effects on MVPDs and content providers. As described above, widespread changes in the video market in recent years have expanded consumers' choices for video services as well as devices to access those services. Nineteen of the 35 industry stakeholders GAO interviewed said rules are not needed at this time, while 8 said rules are still needed. (The rest gave uncertain answers or did not comment on this issue.) Without a comprehensive analysis, FCC lacks information on the extent of consumer choice and, furthermore, the extent to which increased options for video services affect the relative importance of consumer choice for devices to access MVPDs. Such an analysis could help FCC determine if additional regulations are needed and, as the market likely continues its rapid evolution, could serve as a benchmark in FCC's further consideration of whether market conditions have been met such that regulations may no longer apply.

What GAO Recommends

GAO recommends that FCC conduct a comprehensive analysis of how recent industry changes related to video services affect consumer choice for devices to access video services.
FCC agreed with GAO's recommendation and provided technical comments that GAO incorporated as appropriate.


Question:
Why GAO Did This Study

Each year, DOD spends billions of dollars to develop, produce, and field large, complex satellites. For such satellite systems, a single adversary attack or on-orbit failure can result in the loss of billions of dollars of investment and significant loss of vital capabilities. As DOD plans new space systems and addresses an increasingly contested space environment, it has the opportunity to consider different acquisition approaches. One such approach is to integrate a government sensor or payload onto a commercial host satellite.
House Armed Services Committee report 115-200, accompanying a bill for the Fiscal Year 2018 National Defense Authorization Act, included a provision for GAO to review DOD's use of commercially hosted payloads. This report (1) determines the extent to which DOD uses commercially hosted payloads and (2) describes and assesses factors that affect their use.
GAO reviewed DOD policies, documentation, and planning documents, and interviewed a wide range of DOD and civil government officials, and commercial stakeholders.

What GAO Found

GAO and others have found that using commercial satellites to host government sensors or communications packages—called payloads—may be one way DOD can achieve on-orbit capability faster and more affordably. Using hosted payloads may also help facilitate a proliferation of payloads on orbit, making it more difficult for an adversary to defeat a capability. Since 2009, DOD has used three commercially hosted payloads, with three more missions planned or underway through 2022 (see figure below).
DOD estimates that it has achieved cost savings of several hundred million dollars from using commercially hosted payloads to date, and expects to realize additional savings and deliver faster capabilities on orbit from planned missions. Cost savings can result from sharing development, launch, and ground system costs with the commercial host company.
Among the factors that affect DOD's use of hosted payloads are
a perception among some DOD officials that matching government payloads to commercial satellites is too difficult; and
limited, fragmented knowledge on how to mitigate various challenges
GAO found that further opportunities to use hosted payloads may emerge as DOD plans new and follow-on space systems in the coming years. However, DOD's knowledge on using hosted payloads is fragmented, in part because programs are not required to share information. In 2011, the Air Force created a Hosted Payload Office to provide expertise and other tools to facilitate matching government payloads with commercial hosts. However, GAO found that DOD programs using hosted payloads are not required and generally do not provide cost and technical data, or lessons learned, to the Hosted Payload Office, or another central office for analysis. Requiring programs that use hosted payloads agency-wide to provide this information to a central location would better position DOD to make informed decisions when considering acquisition approaches for upcoming space system designs.

What GAO Recommends

GAO recommends that DOD require programs using commercially hosted payloads to contribute resulting data to a central location. In implementing this recommendation, DOD should assess whether the Air Force's Hosted Payload Office is the appropriate location to collect and analyze the data. DOD concurred with the recommendation.


Question:
Why GAO Did This Study

In April 2018, Facebook disclosed that a Cambridge University researcher may have improperly shared the data of up to 87 million of its users with a political consulting firm. This disclosure followed other recent incidents involving the misuse of consumers' personal information from the Internet, which is used by about three-quarters of Americans. GAO was asked to review federal oversight of Internet privacy. This report addresses, among other objectives: (1) how FTC and FCC have overseen consumers' Internet privacy and (2) selected stakeholders' views on the strengths and limitations of how Internet privacy currently is overseen and how, if it all, this approach could be enhanced.
GAO evaluated FTC and FCC Internet privacy enforcement actions and authorities and interviewed representatives from industry, consumer advocacy groups, and academia; FTC and FCC staff; former FTC and FCC commissioners; and officials from other federal oversight agencies. Industry stakeholders were selected to represent different sectors, and academics were selected because of their expertise in privacy, consumer protection, and regulatory issues.

What GAO Found

The United States does not have a comprehensive Internet privacy law governing the collection, use, and sale or other disclosure of consumers' personal information. At the federal level, the Federal Trade Commission (FTC) currently has the lead in overseeing Internet privacy, using its statutory authority under the FTC Act to protect consumers from unfair and deceptive trade practices. However, to date FTC has not issued regulations for Internet privacy other than those protecting financial privacy and the Internet privacy of children, which were required by law. For FTC Act violations, FTC may promulgate regulations but is required to use procedures that differ from traditional notice-and-comment processes and that FTC staff said add time and complexity.
In the last decade, FTC has filed 101 enforcement actions regarding Internet privacy; nearly all actions resulted in settlement agreements requiring action by the companies. In most of these cases, FTC did not levy civil penalties because it lacked such authority for those particular violations. The Federal Communications Commission (FCC) has had a limited role in overseeing Internet privacy. From 2015 to 2017, FCC asserted jurisdiction over the privacy practices of Internet service providers. In 2016, FCC promulgated privacy rules for Internet service providers that Congress later repealed. FTC resumed privacy oversight of Internet service providers in June 2018.
Stakeholders GAO interviewed had varied views on the current Internet privacy enforcement approach and how it could be enhanced. Most Internet industry stakeholders said they favored FTC's current approach—direct enforcement of its unfair and deceptive practices statutory authority, rather than promulgating and enforcing regulations implementing that authority. These stakeholders said that the current approach allows for flexibility and that regulations could hinder innovation. Other stakeholders, including consumer advocates and most former FTC and FCC commissioners GAO interviewed, favored having FTC issue and enforce regulations. Some stakeholders said a new data-protection agency was needed to oversee consumer privacy. Stakeholders identified three main areas in which Internet privacy oversight could be enhanced:
Statute . Some stakeholders told GAO that an overarching Internet privacy statute could enhance consumer protection by clearly articulating to consumers, industry, and agencies what behaviors are prohibited.
Rulemaking . Some stakeholders said that regulations can provide clarity, enforcement fairness, and flexibility. Officials from two other consumer protection agencies said their rulemaking authority assists in their oversight efforts and works together with enforcement actions.
Civil penalty authority. Some stakeholders said FTC's Internet privacy enforcement could be more effective with authority to levy civil penalties for first-time violations of the FTC Act.
Comprehensive Internet privacy legislation that establishes specific standards and includes traditional notice-and-comment rulemaking and broader civil penalty authority could enhance the federal government's ability to protect consumer privacy.

What GAO Recommends

Congress should consider developing comprehensive legislation on Internet privacy that would enhance consumer protections and provide flexibility to address a rapidly evolving Internet environment. Issues that should be considered include what authorities agencies should have in order to oversee Internet privacy, including appropriate rulemaking authority.


Question:
Why GAO Did This Study

Reverse auctions are intended to result in enhanced competition, lower prices, and reduced acquisition costs. GAO has previously found that agencies did not maximize these benefits.
GAO was asked to review federal agencies' use of reverse auctions. This report examines (1) the use of reverse auctions and the extent to which selected agencies achieved benefits, such as competition; and (2) the extent to which selected agencies had insight into reverse auction fees.
GAO collected and analyzed data on federal agencies' use of reverse auctions from fiscal years 2013 to 2017. For five of the largest users of reverse auctions—the Departments of the Army, Homeland Security, Interior, Navy, and State—GAO reviewed documentation for 40 auctions that resulted in contract awards in fiscal year 2016 (the most recent data available when the review began), and that were selected to obtain a mix of dollar values and levels of competition, among other factors. GAO also interviewed contracting officials and analyzed agency guidance.

What GAO Found

Federal agencies' use of reverse auctions—a process where vendors bid against each other with lower prices to win government contracts—declined between fiscal years 2013 and 2017, from about 34,000 to 19,000 auctions valued at about $1.9 billion and $1.5 billion, respectively. In fiscal year 2016, the year GAO studied in detail, nearly three-quarters of auctions at the agencies GAO reviewed resulted in iterative bidding—when there are multiple bidders and at least one bidder submits more than one bid during the auction (see figure).
Contracting officers said reverse auctions reduce administrative burden, especially during peak contracting times. Reverse auctions data indicate that selected agencies may have saved more than $100 million in 2016.
The five agencies GAO reviewed indirectly paid about $13 million in fees to reverse auction providers through awardees in 2016. However, 28 of the 30 contracting officials GAO interviewed did not fully understand how fees were set. Further, in 2016, agencies GAO reviewed indirectly paid approximately $3 million in fees for reverse auctions for which a fee-free alternative was likely available. None of the guidance GAO reviewed provided sufficient information for contracting officers to assess the appropriateness of these fees (see table). Without better information, contracting officials may be offsetting potential savings by paying more in fees than necessary for the level of services required.

What GAO Recommends

GAO is making a total of 21 recommendations to the five agencies in GAO's review, including that agencies inform contracting officials about fees to better compare available provider options. Defense, State, and Interior concurred with this recommendation. DHS did not, stating that contracting officials should obtain this knowledge during market research. GAO believes managing this information centrally could eliminate confusion and minimize duplicate efforts.


Question:
Why GAO Did This Study

Incarcerated students are generally prohibited from receiving Pell grants, which provide need-based federal financial aid to low-income undergraduate students. However, Education has the authority to waive specific statutory or regulatory requirements for providing federal student aid at schools approved to participate in its experiments. Accordingly, the department initiated the multi-year Second Chance Pell pilot in 2015 to test whether allowing incarcerated individuals to receive Pell grants increases their participation in higher education programs and influences their academic and life outcomes, or creates any obstacles to schools' administration of federal financial aid programs.
GAO was asked to review the Second Chance Pell pilot. This report examines (1) actions Education, schools, and other stakeholders have taken to implement the pilot; (2) experiences participating schools are having as they implement the pilot; and (3) how Education is monitoring and evaluating the pilot and whether opportunities for improvement exist.
GAO analyzed summary-level Education data from the 2016-2017 and 2017-2018 school years and interviewed a non-generalizable sample of 12 schools (and associated prison partners) that were selected for variation in type of school (i.e., public and private nonprofit), type of prisons served, and other variables. GAO also interviewed Education officials.

What GAO Found

The Department of Education (Education) selected 64 schools across 26 states to participate in the Second Chance Pell pilot, and participating schools collaborated with prisons and other stakeholders to implement the pilot. Across the pilot's first 2 years, schools awarded approximately $35.6 million in Pell grants to about 8,800 incarcerated students.
Officials from the 12 schools GAO interviewed reported experiencing some challenges implementing the pilot. First, school officials said they experienced challenges establishing incarcerated applicants' eligibility for Pell grants, since some applicants had not registered for Selective Service and some had an existing federal student loan in default. However, many applicants were able to complete the necessary steps—such as making a set number of payments on their defaulted loans—to reestablish eligibility. Second, obtaining documents from incarcerated applicants to support verification—which helps the department's efforts to reduce improper payments of federal student aid—was another challenge officials reported. School officials also said that providing college classes in prisons required them to develop new processes and creative solutions to overcome technology limitations, space limitations, and the transfer of students to other prisons. Officials from 8 of 12 schools told GAO they hired additional staff or developed new approaches in response to their pilot efforts.
Incarcerated College Students inside New York's Sing Sing Correctional Facility
Education monitors the pilot by collecting data from participating schools, but had not established how it intended to evaluate Second Chance Pell or measure the pilot's performance against its objectives. Education is required to review and evaluate experiments under the Experimental Sites Initiative—of which Second Chance Pell is a part—and make recommendations, as appropriate, to improve the delivery of federal student aid. In its comments on the draft report, Education stated that it was planning to evaluate the pilot, consistent with the pilot's objectives, and described a number of steps it was taking to do so. Completing this evaluation can help ensure policymakers have the information needed to make decisions about the future of Pell grants for incarcerated students.

What GAO Recommends

GAO recommends that the Secretary of Education complete its evaluation of the pilot to report on its findings and conclusions. Education concurred, with clarification, and stated that it had actions underway to evaluate the pilot.


Question:
Why GAO Did This Study

SSA delivers services that touch the lives of almost every American, and relies heavily on IT resources to do so. Its systems support a range of activities, such as processing Disability Insurance payments, to calculating and withholding Medicare premiums, and issuing Social Security numbers and cards. For fiscal year 2018, the agency planned to spend approximately $1.6 billion on IT.
GAO has previously reported that federal IT projects have often failed, in part, due to a lack of oversight and governance. Given the challenges that federal agencies, including SSA, have encountered in managing IT acquisitions, Congress and the administration have taken steps to improve federal IT, including enacting federal IT acquisition reform legislation and issuing related guidance.
This statement summarizes GAO's previously reported findings regarding SSA's management of IT acquisitions and operations. In developing this testimony, GAO summarized findings from its reports issued in 2011 through 2018, and information on SSA's actions in response to GAO's recommendations.

What GAO Found

The Social Security Administration (SSA) has improved its management of information technology (IT) acquisitions and operations by addressing 14 of the 15 recommendations that GAO has made to the agency. For example,
Incremental development . The Office of Management and Budget (OMB) has emphasized the need for agencies to deliver IT investments in smaller increments to reduce risk and deliver capabilities more quickly. In November 2017, GAO reported that agencies, including SSA, needed to improve their certification of incremental development. As a result, GAO recommended that SSA's CIO (1) report incremental development information accurately, and (2) update its incremental development policy and processes. SSA implemented both recommendations.
Software licenses . Effective management of software licenses can help avoid purchasing too many licenses that result in unused software. In May 2014, GAO reported that most agencies, including SSA, lacked comprehensive software license policies. As a result, GAO made six recommendations to SSA, to include developing a comprehensive software licenses policy and inventory. SSA implemented all six recommendations.
However, SSA's IT management policies have not fully addressed the role of its CIO. Various laws and related guidance assign IT management responsibilities to CIOs in six key areas. In August 2018, GAO reported that SSA had fully addressed the role of the CIO in one of the six areas (see table). Specifically, SSA's policies fully addressed the CIO's role in the IT leadership and accountability area by requiring the CIO to report directly to the agency head, among other things.
In contrast, SSA's policies did not address or minimally addressed the IT workforce and IT strategic planning areas. For example, SSA's policies did not include requirements for the CIO to annually assess the extent to which personnel meet IT management skill requirements or to measure how well IT supports agency programs. GAO recommended that SSA address the weaknesses in the remaining five key areas. SSA agreed with GAO's recommendation and stated that the agency plans to implement the recommendation by the end of this month.

What GAO Recommends

GAO has made 15 recommendations to SSA to improve its management of IT acquisitions and operations from 2011 through 2018, and 1 recommendation to improve its CIO policies. While SSA has implemented nearly all of them, it would be better positioned to overcome longstanding IT management challenges when it addresses the CIO's role in its policies.


Question:
Why GAO Did This Study

Open data can foster accountability and public trust by providing citizens with information on government activities and their outcomes. It can also promote private sector innovation. The DATA Act requires that the federal government collect and present open data on roughly $4 trillion in annual federal spending. The DATA Act also includes a provision requiring GAO to review its implementation.
This report (1) identifies key practices for transparently reporting government data; and (2) evaluates the extent to which USAspending.gov is consistent with those key practices and other requirements. GAO developed the key practices by systematically evaluating and synthesizing information from literature on open data, as well as interviews with open data experts and good governance groups. GAO used these key practices as well as existing federal website standards and applicable laws to evaluate USAspending.gov.

What GAO Found

GAO identified five key practices for transparently reporting government data, as well as actions to implement each practice. These key practices and actions can assist managers of open government data programs in the transparent presentation of their data. Open data are information that can be freely used, modified, or shared by anyone for any purpose.
USAspending.gov aligns with several key practices. However, the Department of the Treasury (Treasury) has not fully aligned the website with all of the key practices, the requirements of the Federal Funding Accountability and Transparency Act of 2006 (FFATA), and Office of Management and Budget (OMB) guidance (see table.) FFATA, as amended by the Digital Accountability and Transparency Act of 2014 (DATA Act), directed Treasury to develop and manage USAspending.gov to provide detailed information on federal spending.

What GAO Recommends

GAO is making five recommendations including that Treasury (1) establish a process to ensure that additions to USAspending.gov meet security requirements, (2) provide structured metadata and licensing information on the website, and (3) ensure that users can search for awards by city and program source as required by law. Treasury agreed with GAO's recommendations.


Question:
Why GAO Did This Study

DOD has reported printing costs that totaled about $608 million, on average, during fiscal years 2010 through 2015. DLA Document Services has key DOD-wide responsibilities for (1) printing and reproduction, (2) print device procurement, and (3) electronic content management (e.g., digital document repositories). Other DOD components, including the military services, also maintain some document services capabilities at various locations.
House Report 115-200 accompanying a bill for the National Defense Authorization Act for fiscal year 2018 included a provision for GAO to examine DOD's document services. This report evaluates (1) the progress DOD has made in achieving efficiencies in its document services and opportunities, if any, to achieve further efficiencies, and (2) the extent to which DOD reports accurate financial information about its document services to key stakeholders. GAO reviewed documents and interviewed officials regarding DOD's efficiency initiatives, including DLA Document Services' transformation plan; reviewed print device procurement contracts and pricing information; and analyzed DOD budget data for fiscal years 2012 through 2016.

What GAO Found

The Department of Defense (DOD) has taken steps to achieve efficiencies in its document services, including implementing a transformation plan to consolidate existing Defense Logistics Agency (DLA) Document Services facilities. However, GAO identified four areas where further gains may be possible:
Managing fragmentation in printing and reproduction services. DOD has designated DLA Document Services as the single manager for printing and reproduction services, but DOD customers, citing concerns with DLA's services, have also obtained these services directly from the Government Publishing Office and via in-house print facilities (see fig.). DOD has not assessed DLA's performance in this role or whether additional efficiencies may be possible in light of DLA's transformation plan.
Reducing overlap in procuring print devices. GAO found that DOD components used at least four different contract sources to acquire print devices. DOD has not assessed which acquisition approach represents the best value; doing so might better position DOD to further reduce its costs.
Meeting goals to reduce the number of print devices. DOD and the military services have not demonstrated that they achieved established goals for reducing the number of print devices. Additional controls and assignment of oversight responsibilities to monitor progress could better enable DOD to achieve its cost savings goals, estimated to be millions of dollars annually.
Consolidating DLA facilities. DLA is closing or consolidating 74 of its 112 facilities in the United States. However, GAO found that for four of seven types of specialty services, DLA plans to retain facilities that are responsible for less than 5 percent of the total revenue for each of those specialties, which suggests that further consolidations are possible.
DOD includes the cost of non-printing activities, such as the purchase of advertising time for recruiting, within its budget materials for printing and reproduction. It does not include costs to acquire print devices and for electronic content management. As a result, DOD and the Congress lack the oversight into total document services costs needed to make informed decisions.

What GAO Recommends

GAO is making six recommendations, including that DOD evaluate options to achieve additional cost savings and other efficiencies in its document services and report more accurate budget data. DOD generally agreed with the recommendations.


Question:
Why GAO Did This Study

A 2004 federal directive and the related standard set forth a vision for using information technology to verify the identity of individuals accessing federal buildings. The vision calls for secure and reliable forms of identification that work in conjunction with access control systems. Interoperability of these systems across departments and agencies is part of the vision. OMB and GSA have government-wide responsibilities related to this effort. ISC provides guidance to non-military executive branch agencies on physical security issues. GAO was asked to examine PACS implementation efforts.
This report discusses (1) steps OMB and GSA have taken to fulfill their government-wide responsibilities related to PACS and (2) challenges selected federal agencies face in meeting current requirements. For review, GAO analyzed documents from Commerce, GSA, ISC, and OMB. GAO selected five non-military agencies based on factors including number of buildings and geographic location. GAO reviewed relevant requirements and key practices. GAO also interviewed federal agency officials, PACS vendors, and knowledgeable industry officials.

What GAO Found

The Office of Management and Budget (OMB) and the General Services Administration (GSA) have taken steps to help agencies procure and implement secure, interoperable, GSA-approved “physical access control systems” (PACS) for federal buildings. PACS are systems for managing access to controlled areas within buildings. PACS include identification cards, card readers, and other technology that electronically confirm employees' and contractors' identities and validate their access to facilities (see figure). Steps taken include the following:
OMB issued several memos to clarify agencies' responsibilities. For example, OMB issued a 2011 memo citing Department of Homeland Security (DHS) guidance that agencies must upgrade existing PACS to use identity credentials before using relevant funds for other activities. But, GAO found OMB's oversight efforts are hampered because it lacks baseline data on agencies' implementation of PACS. Without such data, OMB cannot meet its responsibility to ensure agencies adhere to PACS requirements or track progress in implementing federal PACS requirements and achieving the vision of secure, interoperable systems across agencies.
GSA developed an Approved Products List that identifies products that meet federal requirements through a testing and evaluation program. Federal agencies are required to use the Approved Products List to procure PACS equipment. GSA also has provided procurement guidance to agencies through its identity management website.
Officials from the five selected agencies that GAO reviewed identified a number of challenges relating to PACS implementation including cost, lack of clarity on how to procure equipment, and difficulty adding new PACS equipment to legacy systems. Officials from OMB, GSA, and industry not only confirmed that these challenges exist but also told GAO that they were most likely present across the federal government. The Interagency Security Committee (ISC), chaired by the DHS and consisting of 60 federal departments and agencies, has a mission to develop security standards for non-military agencies. In this capacity the ISC is well-positioned to determine the extent that PACS implementation challenges exist across its membership and to develop strategies to address them. An ISC official told GAO that the ISC has taken steps to do so including setting up a working group to assess what additional PACS guidance would be beneficial.

What GAO Recommends

GAO recommends (1) that OMB determine and regularly monitor a baseline level of progress on PACS implementation and (2) that ISC assess the extent of, and develop strategies to address, government-wide challenges to implementing PACS. OMB had no comment on the recommendation. DHS concurred with the recommendation to ISC.


Question:
Why GAO Did This Study

BOP is the largest employer within DOJ and is responsible for the care and custody of an inmate population of about 186,000. BOP has faced challenges retaining staff at correctional facilities, although it has used retention incentives, along with other human capital flexibilities. GAO was asked to review BOP's use of retention incentives.
This report addresses: (1) how BOP used its authority to pay retention incentives; (2) internal controls BOP has in place for the use of retention incentives; and (3) the extent to which BOP plans for and evaluates the use of retention incentives. GAO obtained employee-level retention incentive expenditure data from DOJ's Justice Management Division for fiscal years 2012 through 2016. GAO also reviewed agency documentation, such as policy statements and 40 randomly selected retention incentive application packet case files from fiscal years 2014 through 2016. GAO also interviewed officials from BOP's Central Office and four correctional facilities that use retention incentives, selected to reflect variation in the number and types of employees receiving retention incentives, BOP regions, and BOP institution security levels.

What GAO Found

From fiscal years 2012 to 2016, the Department of Justice's (DOJ) Federal Bureau of Prisons' (BOP) total retention incentive expenditures generally increased from $10.7 to $14.0 million and the number of employees receiving retention incentives increased from 2,024 to 2,460. During those five years, BOP spent more than 97 percent of its total retention incentive expenditures on employees at four BOP institutions in California and for medical professionals nationwide. Further, total retention incentive expenditures for medical professionals increased by an average of 21 percent per year (see figure). According to BOP officials, BOP uses retention incentives, for example, to supplement BOP's medical professionals' salaries which are generally lower than private sector salaries.
BOP has a variety of internal controls in place throughout the retention incentive process that help ensure retention incentive applications and approvals meet requirements. For example, each application goes through multiple levels of review to verify its accuracy and completeness.
BOP takes steps to determine workforce needs and how to fill those needs, but has not strategically planned for and evaluated its use of retention incentives. According to BOP, planning for human capital needs is conducted at institutions during quarterly meetings, but discussions about these incentives respond to short-term staffing situations rather than proactively addressing future staffing needs. Including human capital goals and strategies in BOP's human capital plan would create a roadmap so the agency could move from being reactive to its current workforce needs to being strategic in trying to achieve its long-term workforce goals. Additionally BOP has not evaluated the effectiveness of its use of retention incentives in retaining staff. As a result, BOP does not know whether retention incentives have contributed to employees' retention in relation to other incentives used by BOP. Consistent with key principles for strategic human capital planning, planning for and evaluating the use of retention incentives could help BOP better determine if these incentives are an efficient and effective means by which to retain staff.

What GAO Recommends

GAO recommends that BOP (1) include human capital goals and how retention incentives will be used to achieve these goals in its human capital plan; and (2) evaluate the use of retention incentives. BOP concurred with GAO's recommendations.


Question:
Why GAO Did This Study

DOE, including NNSA, is the largest federal civilian contracting agency, spending about 90 percent of its appropriations on contracts with companies, universities, and others for federal research and development, engineering, and production. DOE headquarters and local offices oversee contractors’ activities, including their management of subcontracts.
GAO was asked to review contracting at DOE, including the use of subcontractors. This report examines, for fiscal year 2016, (1) the parties that participated in DOE’s largest prime contracts and the extent to which they subcontracted their work; (2) the extent to which DOE ensured that those contractors audited subcontractors’ costs, as required; and (3) the extent to which DOE ensured that contractors met other subcontract oversight requirements. GAO reviewed DOE’s fiscal year 2016 data and documents, analyzed regulations, and interviewed federal officials and contractor representatives for DOE’s 24 largest fiscal year 2016 prime contracts.

What GAO Found

In fiscal year 2016, 28 entities participated in the Department of Energy’s (DOE) and its National Nuclear Security Administration’s (NNSA) 24 largest prime contracts, which totaled $23.6 billion of DOE’s fiscal year 2016 obligations. The contractors awarded about $6.9 billion (nearly 30 percent) of those obligations to thousands of subcontractors. Further, multiple companies, universities, and other entities can join together to bid on a contract (i.e., become a “party to” a contract). GAO’s review of data about these contracts and subcontracts identified complex ownership relationships among the contractors and subcontractors. For example, GAO found that almost all of the 28 parties to the prime contracts in its review were also subcontractors to some prime contracts, holding a total of nearly 3,000 subcontracts with fiscal year 2016 obligations totaling about $927 million (see figure). GAO found that it can be difficult to track changes in the ownership of parties to the contracts and to understand the relationships between parties.
DOE and NNSA did not always ensure that contractors audited subcontractors’ incurred costs as required in their contracts. GAO’s review of 43 incurred-cost assessment and audit reports identified more than $3.4 billion in subcontract costs incurred over a 10-year period that had not been audited as required, and some subcontracts remained unaudited or unassessed for more than 6 years. Completing audits in a timely manner is important because of a 6-year statute of limitations to recover unallowable costs that could be identified through such audits. DOE headquarters has not issued procedures or guidance that requires local offices to monitor contractors to ensure that required subcontract audits are completed in a timely manner, consistent with federal standards for internal control. Without such procedures or guidance, unallowable costs may go unidentified beyond the 6-year limitation period of the Contract Disputes Act, preventing DOE from recovering those costs.
DOE and NNSA perform several reviews to ensure that contractors meet other subcontract oversight requirements. For example, DOE’s local offices review proposed subcontracts to ensure they are awarded consistent with policies related to potential conflicts of interest. However, local officials do not independently review information on subcontractor ownership because doing so is not required, although such information could alert officials to potential conflicts of interest. By requiring contracting officers to independently review subcontractor ownership information, DOE and NNSA would have better assurance that contractors are adequately identifying and mitigating organizational conflicts of interest.

What GAO Recommends

GAO is making six recommendations, including that DOE develop procedures that require local offices to monitor contractors to ensure timely completion of required subcontract audits, and require local DOE officials to independently review subcontractor ownership information to identify potential conflicts of interest. DOE partially concurred with five of GAO’s six recommendations but did not agree to independently review subcontractor ownership information. GAO maintains that the recommended actions are valid.


Question:
Why GAO Did This Study

Safeguarding confidentiality to the maximum extent possible is essential for encouraging whistleblowers to report wrongdoing without fear of reprisal. In fiscal year 2018, DODIG received over 12,000 contacts from potential whistleblowers related to fraud, waste, abuse, employee misconduct, or other violations. The National Defense Authorization Act for Fiscal Year 2017 included a provision for GAO to review the integrity of DOD's whistleblower program. This report assesses the extent to which DODIG and the military service IGs (1) met and took steps to achieve key fiscal year 2018 timeliness and quality goals, (2) established processes to protect whistleblower confidentiality, and (3) are able to safeguard sensitive information necessary to handle whistleblower complaints. It also evaluates (4) the extent to which select cases involving certain senior DOD civilian officials met key requirements.
GAO assessed fiscal year 2018 IG performance data, surveyed all 108 DODIG employees who directly handle whistleblower complaints, reviewed IT security controls, and analyzed all 125 cases involving civilian DOD Presidential appointees with Senate confirmation dismissed by DODIG in fiscal years 2013-2017.

What GAO Found

The Department of Defense Office of Inspector General (DODIG) and military service offices of inspector general (IG) met some but not all fiscal year 2018 timeliness and quality goals for handling whistleblower complaints. For example, DODIG met its goals related to referring complaints to the appropriate agency within a certain number of days. All IGs also generally met goals related to the quality of investigations. However, about 85 percent of DODIG reprisal and senior official misconduct investigations exceeded statutory and internal timeliness goals. Further, military service IGs did not meet most goals for handling cases within prescribed timeframes. For example, the service IGs averaged between 17 and 84 days to notify DODIG of their receipt of whistleblower reprisal allegations, exceeding the 10-day goal. The IGs have various initiatives underway to improve timeliness, such as a Naval IG program to reduce timeframes for initial credibility determinations. However, additional actions could provide a more targeted approach to improving performance against unmet timeliness goals—such as for senior official misconduct investigations—and better assure whistleblowers that their cases will be handled expeditiously.
DODIG and the military service IGs have policies to protect whistleblower confidentiality, but some gaps exist. For example, DODIG guidance for protecting whistleblowers who report internal DODIG misconduct does not specify key steps investigators should take to protect confidentiality, such as not identifying complainants during interviews with case subjects. Also, Air Force, Naval, and Marine Corps IG guidance does not specify when whistleblower identities can be disclosed without consent. Without updated guidance, the IGs cannot ensure the consistent implementation of confidentiality protections.
The IGs have taken steps to safeguard whistleblower information in their information technology (IT) systems and applications, such as by restricting access to case information through unique user permissions and by taking actions to follow DOD's IT risk management process. However, between 2016 and 2018, employees in all of the IGs have been able to access sensitive whistleblower information without a need to know. For example, DODIG determined that numerous restricted whistleblower records in its document repository were accessible to DODIG personnel without a need to know. Similarly, the Air Force IG's application did not restrict users from other DOD components from viewing Air Force IG case descriptions and complainant identities, while the Army IG's application and the Naval IG's system did not restrict personnel within those IGs from viewing allegations or investigations involving other personnel within those IGs. Additionally, employees in Marine Corps IG offices were able to see whistleblower cases assigned to other IG offices without a need to know. While some actions have been taken to address these issues, additional steps are needed to restrict access to case information in order to mitigate ongoing risks to whistleblower confidentiality.
DODIG generally met key documentation requirements for the 125 cases it dismissed without investigation involving civilian DOD Presidential appointees with Senate confirmation.

What GAO Recommends

GAO is making 12 recommendations, including that the IGs take additional actions to improve timeliness, develop additional procedures to protect whistleblower confidentiality, and take steps to further limit IG employee access to sensitive whistleblower information. DOD concurred with all of the recommendations.


Question:
Why GAO Did This Study

To promote international peace and security, the UN had 16 ongoing peacekeeping operations worldwide as of June 30, 2017, with a total budget of almost $8 billion in UN fiscal year 2017 and contributions of over 100,000 military, police, and civilian personnel from more than 120 countries. The United States is the largest financial contributor to UN peacekeeping operations, providing an average of about 28 percent of total funding annually.
The Department of State Authorities Act, Fiscal Year 2017, includes a provision for GAO to compare the costs, strengths, and limitations of UN and U.S. peacekeeping operations. This report (1) compares the reported costs of a specific UN operation to the estimated costs of a hypothetical, comparable operation implemented by the United States; (2) identifies factors that affect cost differences; and (3) identifies stakeholder views on the relative strengths of UN and U.S. peacekeeping operations.
GAO worked with the UN, DOD, and State to generate a cost estimate of a hypothetical U.S.-led operation in the Central African Republic comparable to MINUSCA. GAO developed this estimate using DOD's cost estimating tool for contingency operations and State data on civilian costs, assuming a U.S. operation using roughly the same levels of military and civilian personnel as MINUSCA. The cost estimate should not be construed as suggesting that the United States would likely implement such an operation in the Central African Republic or that it would implement such an operation in the same way.
GAO is making no recommendations.

What GAO Found

Based on United Nations (UN) and Departments of Defense (DOD) and State (State) data, GAO estimates that it would cost the United States more than twice as much as it would cost the UN to implement a hypothetical operation comparable to the UN Multidimensional Integrated Stabilization Mission in the Central African Republic (MINUSCA). MINUSCA cost the UN approximately $2.4 billion for the first 39 months of the operation. GAO estimates that a hypothetical U.S. peacekeeping operation in the Central African Republic of roughly the same size and duration would cost nearly $5.7 billion—almost eight times more than the $700 million the United States contributed to MINUSCA over the same time period.
Various factors affect differences between the actual cost of MINUSCA and the estimated cost of a hypothetical, comparable U.S. operation in the Central African Republic. The United States and the UN would source and transport some supplies and equipment differently, affecting the cost of both operations; for example, the United States would airlift water into the Central African Republic, while the UN does not do so to the same extent. The United States also would incur the cost of civilian police and military reservist salaries, while the UN does not pay any troop or police salaries. Finally, some higher standards for facilities, intelligence, and medical services increase the U.S. cost estimate relative to UN costs for similar operational elements.
UN and U.S. peacekeeping operations have various relative strengths, according to U.S. and UN officials. These officials said that, because the UN is a multilateral organization, UN peacekeeping operations have international acceptance and are more likely to be viewed as impartial. Officials also said that the UN enjoys global access to expertise and experience, and can leverage assistance from multilateral donors and development banks. Relative strengths of a U.S. peacekeeping operation would include faster deployment and superior command and control, logistics, intelligence, and counterterrorism capability, according to U.S. and UN officials.


Question:
Why GAO Did This Study

In fiscal year 2017, ICE operated on a budget of nearly $3 billion to manage the U.S. immigration detention system, which houses foreign nationals whose immigration cases are pending or who have been ordered removed from the country. In recent years, ICE has consistently had to reprogram and transfer millions of dollars into, out of, and within its account used to fund its detention system. The explanatory statement accompanying the DHS Appropriations Act, 2017, includes a provision for GAO to review ICE's methodologies for determining detention resource requirements. This report examines (1) how ICE formulates its budget request for detention resources, (2) how ICE develops bed rates and determines ADP for use in its budget process, and (3) to what extent ICE's methods for estimating detention costs follow best practices. GAO analyzed ICE's budget documents, including CBJs, for fiscal years 2014 to 2018, examined ICE's models for projecting ADP and bed rates, and evaluated ICE's cost estimating process against best practices.

What GAO Found

U.S. Immigration and Customs Enforcement (ICE) formulates its budget request for detention resources based on guidance from the Office of Management and Budget and the Department of Homeland Security (DHS). To project its detention costs, ICE primarily relies on two variables—the average dollar amount to house one adult detainee for one day (bed rate) and the average daily population (ADP) of detainees.
U.S. Immigration and Customs Enforcement's (ICE) Formula to Calculate Detention Costs
GAO found a number of inconsistencies and errors in ICE's calculations for its congressional budget justifications (CBJs). For example, in its fiscal year 2015 budget request, ICE made an error that resulted in an underestimation of $129 million for immigration detention expenses. While ICE officials stated their budget documents undergo multiple reviews to ensure accuracy, ICE was not able to provide documentation of such reviews. Without a documented review process for reviewing the accuracy of its budget request, ICE is not positioned to ensure the credibility of its budget requests.
ICE has models to project the adult bed rate and ADP for purposes of determining its budget requests. However, ICE consistently underestimated the actual bed rate due to inaccuracies in the model, and it is unclear if the ADP used in the budget justification is based on statistical analysis. GAO identified factors in ICE's bed rate model—such as how it accounts for inflation and double counts certain costs—that may lead to its inaccurate bed rate projections. For example, in fiscal year 2016, ICE's projections underestimated the actual bed rate by $5.42 per day. For illustrative purposes, underestimating the bed rate by $5 per day, assuming an ADP of 34,000, yields a more than $62 million underestimation in the detention budget request. By assessing its methodology and addressing identified inaccuracies, ICE could ensure a more accurate estimate of its actual bed rate cost. Additionally, ICE reported that the ADP projections in its CBJs are based on policy decisions that account, for example, for anticipated policies that could affect the number of ICE's detainees. While ICE's projected ADP may account for policy decisions, documenting the methodology and rationale by which it determined the projected ADP would help demonstrate how the number was determined and that it was based on sound assumptions.
ICE's methods for estimating detention costs do not fully meet the four characteristics of a reliable cost estimate, as outlined in GAO's Cost Estimating and Assessment Guide . For example, while ICE's fiscal year 2018 detention cost estimate substantially met the comprehensive characteristic, it partially met the well-documented and accurate characteristics, and minimally met the credible characteristic. By taking steps to fully reflect cost estimating best practices, ICE could better ensure a more reliable budget request.

What GAO Recommends

GAO recommends that the Director of ICE: (1) document and implement its review process to ensure accuracy in its budget documents; (2) assess ICE's adult bed rate methodology; (3) update ICE's adult bed rate methodology; (4) document the methodology and rationale behind the ADP projection used in budget requests; and (5) take steps to ensure that ICE's detention cost estimate more fully addresses best practices. DHS concurred with the recommendations.


Question:
Why GAO Did This Study

Colleges and other postsecondary schools must plan for various potential emergencies, ranging from natural disasters to violence. A number of federal agencies, including DHS, DOJ, and Education, offer resources to support these efforts. GAO was asked to review colleges' awareness of these resources.
This report examines how (1) selected colleges prepare for emergencies, and (2) federal agencies support college emergency preparedness efforts, including the extent to which selected colleges reported awareness of federal resources.
To answer these questions, GAO interviewed officials from a non-generalizable sample of 18 colleges selected for diversity in size, type, and location. GAO also interviewed officials from three states (Colorado, Kansas, and Virginia) in which some of these schools operated. The states were selected to represent varied approaches to supporting colleges' emergency preparedness efforts. GAO also reviewed federal emergency preparedness resources, agency written responses, applicable federal laws, and federal internal control standards, and interviewed federal officials and representatives from several associations recommended by agency officials.

What GAO Found

Emergency managers at 18 colleges across the country told GAO that their efforts to prepare for emergencies involved working with the campus community to develop, communicate, and practice plans, as well as working with state and local partners. Campus community members who are involved often include personnel from offices such as public safety, student affairs, or facilities. Officials at all 18 colleges reported developing emergency plans addressing a range of potential events—an approach consistent with federal emergency management principles. To publicize plans, officials often reported using websites, text messages, or presentations to the campus community. Colleges also reported practicing plans through drills. College officials noted that buy-in from the college president and other top campus leaders was critical to their efforts; several officials reported struggling to obtain such support. Most officials also said they coordinate with local or state partners such as police and relied on these partners for advice or to obtain emergency preparedness resources.
The Departments of Homeland Security (DHS), Justice (DOJ), and Education (Education) offer a variety of emergency preparedness resources to colleges (see figure). However, officials GAO interviewed at 18 colleges described mixed awareness of federal resources, especially those specifically tailored to colleges, despite federal efforts to publicize these resources in a variety of ways. Federal officials and other stakeholders acknowledged this mixed awareness and identified potential causes, such as college emergency managers having networks comprised of local officials who are more likely to know about federal resources for local agencies versus those for colleges, or some college officials devoting limited time to researching federal resources for various reasons.
DHS, DOJ, and Education all publicize their resources through electronic mailing lists, websites, or other methods, but GAO identified missed opportunities in their dissemination approaches. For example, the electronic mailing list for one key resource may reach the approximately 1,000 officials from colleges subscribed, but may miss at least 3,000 additional schools. GAO also found two federal agency websites that did not include key resources from other federal agencies. Federal internal control standards state that agencies should consider the most appropriate methods for communicating with their external audiences. By identifying opportunities to improve dissemination, federal agencies may increase their ability to effectively communicate important information to colleges.

What GAO Recommends

GAO recommends that DHS, DOJ, and Education work together to identify opportunities to more effectively publicize emergency preparedness resources to colleges. All three agencies concurred with the recommendations or described actions to implement them.


Question:
Why GAO Did This Study

NRC is responsible for regulating the commercial nuclear industry, including nuclear power plants. NRC provides services, such as inspections, for regulated entities that hold licenses—that is, licensees. NRC recovers the costs for these services by assessing fees and billing licensees quarterly. In fiscal year 2016, NRC collected about $321 million in service fees. From 2006 to 2016, audits of NRC's fees identified problems with NRC's billing process. For example, a 2012 audit identified about $24 million in unbilled fees from fiscal years 2011 and 2012.
GAO was asked to review NRC's billing process for service fees. This report examines (1) the actions NRC is taking to address problems with its billing process identified by internal reviews and (2) the challenges selected licensees identified with NRC's billing process and the extent to which NRC's actions are addressing them.
GAO reviewed audits of NRC's billing process and other documents related to this process. GAO also interviewed NRC staff and a nongeneralizable sample of 13 licensees, selected based on the amount of service fees charged from October 2015 through July 2017, and compared NRC's actions against criteria on internal controls and project planning.

What GAO Found

The Office of the Inspector General for the Nuclear Regulatory Commission (NRC) and internal reviews conducted by NRC identified several problems with the agency's billing process, and NRC has implemented or plans to implement several changes to address the recommendations. For example, the codes that NRC staff use to record their work hours on time cards—referred to as activity codes—did not describe the work and did not have a consistent naming convention, which increased the risk of staff charging their time to the wrong activity codes. This could lead, in some cases, to billing errors. To address these problems, NRC created a standard naming convention for activity codes that provides more information about the activity. See the figure below for the steps in NRC's billing process for work that NRC or contractor staff performed.
Some of the 13 licensees that GAO interviewed identified challenges with NRC's billing process, including its method for delivering paper invoices by mail. For example, two of these licensees stated that with invoices taking up to 10 days to arrive in the mail, they sometimes do not have sufficient time to properly review charges and remit payment to NRC within the 30-day deadline for paying the invoice. One licensee said that delays in receiving an invoice resulted in late fees. NRC is undertaking an initiative to transition to electronic billing, which may address the challenges the licensees identified and, according to NRC staff, improve the agency's billing process. However, NRC has not developed planning documents for this initiative and, according to staff, the planning phase is already past its original deadline of October 2017. The Project Management Institute has identified standards related to project management processes, including project planning. By developing a project management plan that is consistent with best practices and includes steps for involving licensees in system development and assessing results of the project, NRC would have reasonable assurance that it can better manage its electronic billing initiative.

What GAO Recommends

GAO is making five recommendations, including that NRC develop a project management plan for its electronic billing initiative that follows project management standards and includes steps for involving licensees and assessing results. NRC agreed with these recommendations.