United States Government Accountability Office Report to Congressional Committees March 2019 HIGH-RISK SERIES Substantial Efforts Needed to Achieve Greater Progress on High-Risk Areas GAO-19-157SP March 2019 HIGH-RISK SERIES Substantial Efforts Needed to Achieve Greater Progress on High-Risk Areas Highlights of GAO-19-157SP a report to congressional committees Why GAO Did This Study What GAO Found The federal government is one of the world’s largest and most complex entities about $4 1 trillion in outlays in fiscal year 2018 funded a broad array of programs and operations GAO’s high-risk program identifies government operations with vulnerabilities to fraud waste abuse and mismanagement or in need of transformation to address economy efficiency or effectiveness challenges The ratings for more than half of the 35 areas on the 2019 High-Risk List remain largely unchanged Since GAO’s last update in 2017 seven areas improved three regressed and two showed mixed progress by improving in some criteria but declining in others Where there has been improvement in high-risk areas congressional actions have been critical in spurring progress in addition to actions by executive agencies This biennial update describes the status of high-risk areas outlines actions that are still needed to assure further progress and identifies two new high-risk areas needing attention by the executive branch and Congress Solutions to high-risk problems save billions of dollars improve service to the public and would strengthen government performance and accountability GAO uses five criteria to assess progress in addressing high-risk areas 1 leadership commitment 2 agency capacity 3 an action plan 4 monitoring efforts and 5 demonstrated progress What GAO Recommends This report describes GAO’s views on progress made and what remains to be done to bring about lasting solutions for each high-risk area Substantial efforts are needed by the executive branch to achieve progress on highrisk areas Addressing GAO’s hundreds of open recommendations across the high-risk areas and continued congressional oversight and action are essential to achieving greater progress View GAO-19-157SP For more information contact J Christopher Mihm at 202 512-6806 or mihmj@gao gov GAO is removing two of the seven areas with improved ratings from the HighRisk List because they met all of GAO’s five criteria for removal The first area Department of Defense DOD Supply Chain Management made progress on seven actions and outcomes related to monitoring and demonstrated progress that GAO recommended for improving supply chain management For example DOD improved the visibility of physical inventories receipt processing cargo tracking and unit moves Improvements in asset visibility have saved millions of dollars and allow DOD to better meet mission needs by providing assets where and when needed The second area Mitigating Gaps in Weather Satellite Data made significant progress in establishing and implementing plans to mitigate potential gaps For example the National Oceanic and Atmospheric Administration successfully launched a satellite now called NOAA-20 in November 2017 NOAA-20 is operational and provides advanced weather data and forecasts DOD developed plans and has taken actions to address gaps in weather data through its plans to launch the Weather System Follow-on–Microwave satellite in 2022 There are two new areas on the High-Risk List since 2017 Added in 2018 outside of GAO’s biennial high-risk update cycle the Government-Wide Personnel Security Clearance Process faces significant challenges related to processing clearances in a timely fashion measuring investigation quality and ensuring information technology security The second area added in 2019 is Department of Veterans Affairs VA Acquisition Management VA has one of the most significant acquisition functions in the federal government both in obligations and number of contract actions GAO identified seven contracting challenges for VA such as outdated acquisition regulations and policies lack of an effective medical supplies procurement strategy and inadequate acquisition training Overall 24 high-risk areas have either met or partially met all five criteria for removal from the list 20 of these areas fully met at least one criterion Ten highrisk areas have neither met nor partially met one or more criteria While progress is needed across all high-risk areas GAO has identified nine that need especially focused executive and congressional attention including Ensuring the Cybersecurity of the Nation Resolving the Federal Role in Housing Finance addressing Pension Benefit Guaranty Corporation Insurance Programs Managing Risks and Improving VA Health Care and ensuring an effective 2020 Decennial Census Beyond these specific areas focused attention is needed to address mission-critical skills gaps in 16 high-risk areas confront three high-risk areas concerning health care and tax law enforcement that include billions of dollars in improper payments each year and focus on a yawning tax gap United States Government Accountability Office GAO’s 2019 High-Risk List Strengthening the Foundation for Efficiency and Effectiveness Strategic Human Capital Management Managing Federal Real Property a Funding the Nation’s Surface Transportation System a Modernizing the U S Financial Regulatory System a Resolving the Federal Role in Housing Finance a USPS Financial Viability Management of Federal Oil and Gas Resources a Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks Improving the Management of IT Acquisitions and Operations a Improving Federal Management of Programs That Serve Tribes and Their Members a 2020 Decennial Census a U S Government Environmental Liability Transforming DOD Program Management DOD Weapon Systems Acquisition DOD Financial Management DOD Business Systems Modernization a DOD Support Infrastructure Management DOD Approach to Business Transformation Ensuring Public Safety and Security Government-wide Personnel Security Clearance Process new a a Ensuring the Cybersecurity of the Nation Strengthening Department of Homeland Security Management Functions a Ensuring the Effective Protection of Technologies Critical to U S National Security Interests a Improving Federal Oversight of Food Safety Protecting Public Health through Enhanced Oversight of Medical Products a Transforming EPA’s Processes for Assessing and Controlling Toxic Chemicals Managing Federal Contracting More Effectively VA Acquisition Management new a DOE’s Contract Management for the National Nuclear Security Administration and Office of Environmental Management a NASA Acquisition Management DOD Contract Management Assessing the Efficiency and Effectiveness of Tax Law Administration Enforcement of Tax Lawsa Modernizing and Safeguarding Insurance and Benefit Programs Medicare Program Improper Paymentsa a Strengthening Medicaid Program Integrity Improving and Modernizing Federal Disability Programs a Pension Benefit Guaranty Corporation Insurance Programs a National Flood Insurance Program Managing Risks and Improving VA Health Carea Source GAO GAO-19-157SP a Legislation is likely to be necessary in order to effectively address this area Contents Letter 1 How We Identify and Rate High-Risk Areas Changes to the 2019 High-Risk List DOD Supply Chain Management Mitigating Gaps in Weather Satellite Data High-Risk Areas That Made Progress High-Risk Areas Needing Significant Attention 2 4 6 13 25 45 Appendix I Background 69 Appendix II Overview for Each High-Risk Area 74 Strategic Human Capital Management Managing Federal Real Property Funding the Nation’s Surface Transportation System Modernizing the U S Financial Regulatory System Resolving the Federal Role in Housing Finance USPS Financial Viability Management of Federal Oil and Gas Resources Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks Improving the Management of IT Acquisitions and Operations Improving Federal Management of Programs that Serve Tribes and Their Members 2020 Decennial Census U S Government’s Environmental Liability DOD Weapon Systems Acquisition DOD Financial Management DOD Business Systems Modernization DOD Support Infrastructure Management DOD Approach to Business Transformation Government-wide Personnel Security Clearance Process Ensuring the Cybersecurity of the Nation Strengthening Department of Homeland Security Management Functions Ensuring the Effective Protection of Technologies Critical to U S National Security Interests Improving Federal Oversight of Food Safety Protecting Public Health through Enhanced Oversight of Medical Products Page i 75 78 86 91 95 99 103 110 123 128 134 138 143 147 152 158 163 170 178 185 190 195 198 GAO-19-157SP High-Risk Series Transforming EPA’s Process for Assessing and Controlling Toxic Chemicals VA Acquisition Management DOE’s Contract and Project Management for the National Nuclear Security Administration and Office of Environmental Management NASA Acquisition Management DOD Contract Management Enforcement of Tax Laws Medicare Program Improper Payments Strengthening Medicaid Program Integrity Improving and Modernizing Federal Disability Programs Pension Benefit Guaranty Corporation Insurance Programs National Flood Insurance Program Managing Risks and Improving VA Health Care Appendix III GAO’s 2019 High-Risk List 204 210 217 222 227 235 241 250 259 267 272 275 283 GAO Related Products 285 Tables Table 1 Status of Asset Visibility Remaining Action Items Required to Remove Supply Chain Management from GAO’s High-Risk List Table 2 Status of Materiel Distribution Remaining Action Items Required to Remove Supply Chain Management from GAO’s High-Risk List Table 3 2017 High-Risk Areas Rated Against Five Criteria for Removal from GAO’s High-Risk List Table 4 2019 High-Risk Area Ratings on Five Criteria for Removal from GAO’s High-Risk List Table 5 Examples of Congressional Actions Taken on High-Risk Areas Table 6 Examples of GAO High-Risk Area Recommendations Leading to Financial Benefits Table 7 Skills Gaps Related to High-Risk Areas Table 8 Changes to the High-Risk List 1990-2019 Page ii 8 10 25 28 35 43 60 69 GAO-19-157SP High-Risk Series Table 9 Percent of Executive Branch Agencies Meeting Security Clearance Processing Timeliness Objectives in Fiscal Year 2018 Table 10 GAO’s 2019 High-Risk List 174 283 Figures Figure 1 Illustrative Example of High-Risk Progress Criteria Ratings Figure 2 Segments of GAO’s Department of Defense’s Supply Chain Management High-Risk Area Figure 3 High-Risk Areas’ Progress and Regress on High-Risk Criteria Since 2017 Figure 4 Percentage of Agencies That Identified Their Involvement with the Fraud Reduction and Data Analytics Act of 2015 Working Group as a Great or Moderate Challenge Figure 5 Essential Elements of Federal Government Enterprise Risk Management Figure 6 Ten Critical Actions Needed to Address Four Major Cybersecurity Challenges Figure 7 Improper Payment Estimates Were Concentrated in Three Areas in Fiscal Year 2018 Figure 8 Criteria for Removal from the High-Risk List and Examples of Actions Leading to Progress Figure 9 History of Areas Removed from the High-Risk List Figure 10 Areas on GAO’s 2019 High-Risk List Were Designated as High Risk by Year Added Figure 11 Projected Cumulative Highway Trust Fund Balance Fiscal Years 2022 through 2029 Figure 12 Ten Critical Actions Needed to Address Four Major Cybersecurity Challenges Figure 13 Percent of VHA Contract Actions Designated as Emergencies Fiscal Year 2016 Figure 14 Pension Benefit Guaranty Corporation’s PBGC Net Financial Position of the Single-Employer and Multiemployer Programs Combined Fiscal Years 1990 through 2018 Page iii 4 6 27 39 45 53 64 71 72 73 87 182 213 268 GAO-19-157SP High-Risk Series This is a work of the U S government and is not subject to copyright protection in the United States The published product may be reproduced and distributed in its entirety without further permission from GAO However because this work may contain copyrighted images or other material permission from the copyright holder may be necessary if you wish to reproduce this material separately Page iv GAO-19-157SP High-Risk Series Letter 441 G St N W Washington DC 20548 Comptroller General of the United States March 6 2019 The Honorable Ron Johnson Chairman The Honorable Gary C Peters Ranking Member Committee on Homeland Security and Governmental Affairs United States Senate The Honorable Elijah E Cummings Chairman The Honorable Jim Jordan Ranking Member Committee on Oversight and Reform House of Representatives Since the early 1990s our high-risk program has focused attention on government operations with greater vulnerabilities to fraud waste abuse and mismanagement or that are in need of transformation to address economy efficiency or effectiveness challenges This effort supported by the Senate Committee on Homeland Security and Governmental Affairs and by the House of Representatives Committee on Oversight and Reform has brought much needed attention to problems impeding effective government and costing billions of dollars each year We have made hundreds of recommendations to reduce the government’s high-risk challenges Executive agencies either have addressed or are addressing many of them and as a result progress is being made in a number of areas Congress also continues to take important actions For example Congress has enacted a number of laws since our last report in February 2017 that are helping to make progress on high-risk issues Financial benefits to the federal government due to progress in addressing high-risk areas over the past 13 years fiscal year 2006 through fiscal year 2018 totaled nearly $350 billion or an average of about $27 billion per year In fiscal year 2018 financial benefits were the highest we ever reported at nearly $47 billion 1 1 Financial benefits are based on actions taken in response to our work such as reducing government expenditures increasing revenues or reallocating funds to other areas Page 1 GAO-19-157SP High-Risk Series This report describes 1 progress made addressing high-risk areas and the reasons for that progress and 2 actions that are still needed It also identifies two new high-risk areas—Government-wide Personnel Security Clearance Process and Department of Veterans Affairs VA Acquisition Management and two high-risk areas we removed from the list because they demonstrated sufficient progress in managing risk—Department of Defense DOD Supply Chain Management and Mitigating Gaps in Weather Satellite Data 2 Substantial efforts are needed on the remaining high-risk areas to achieve greater progress and to address regress in some areas since the last high-risk update in 2017 Continued congressional attention and executive branch leadership attention remain key to success To determine which federal government programs and functions should be designated high-risk we use our guidance document Determining Performance and Accountability Challenges and High Risks 3 How We Identify and Rate High-Risk Areas We consider qualitative factors such as whether the risk • involves public health or safety service delivery national security national defense economic growth or privacy or citizens’ rights or • could result in significantly impaired service program failure injury or loss of life or significantly reduced economy efficiency or effectiveness We also consider the exposure to loss in monetary or other quantitative terms At a minimum $1 billion must be at risk in areas such as the value of major assets being impaired revenue sources not being realized major agency assets being lost stolen damaged wasted or underutilized potential for or evidence of improper payments and presence of contingencies or potential liabilities Before making a high-risk designation we also consider corrective measures planned or under way to resolve a material control weakness and the status and effectiveness of these actions 2 Government-wide Personnel Security Clearance Process was added to the High-Risk List in January 2018 3 GAO Determining Performance and Accountability Challenges and High Risks GAO-01-159SP Washington D C November 2000 Page 2 GAO-19-157SP High-Risk Series Our experience has shown that the key elements needed to make progress in high-risk areas are top-level attention by the administration and agency leaders grounded in the five criteria for removal from the High-Risk List as well as any needed congressional action The five criteria for removal that we issued in November 2000 are as follows • Leadership commitment Demonstrated strong commitment and top leadership support • Capacity Agency has the capacity i e people and resources to resolve the risk s • Action plan A corrective action plan exists that defines the root cause solutions and provides for substantially completing corrective measures including steps necessary to implement solutions we recommended • Monitoring A program has been instituted to monitor and independently validate the effectiveness and sustainability of corrective measures • Demonstrated progress Ability to demonstrate progress in implementing corrective measures and in resolving the high-risk area Starting in our 2015 update we added clarity and specificity to our assessments by rating each high-risk area’s progress on the five criteria and used the following definitions • Met Actions have been taken that meet the criterion There are no significant actions that need to be taken to further address this criterion • Partially met Some but not all actions necessary to meet the criterion have been taken • Not met Few if any actions towards meeting the criterion have been taken Figure 1 shows a visual representation of varying degrees of progress in each of the five criteria for a high-risk area Each point of the star represents one of the five criteria for removal from the High-Risk List and each ring represents one of the three designations not met partially met or met An unshaded point at the innermost ring means that the criterion has not been met a partially shaded point at the middle ring means that the criterion has been partially met and a fully shaded point at the outermost ring means that the criterion has been met Further a plus symbol inside the star indicates the rating for that criterion progressed since our last high-risk update Likewise a minus symbol inside the star indicates the rating for that criterion declined since our last update Page 3 GAO-19-157SP High-Risk Series Figure 1 Illustrative Example of High-Risk Progress Criteria Ratings Some high-risk areas are comprised of segments or subareas that make up the overall high-risk area For example the high-risk area Protecting Public Health through Enhanced Oversight of Medical Products includes two segments—Response to Globalization and Drug Availability—to reflect two interrelated parts of the overall high-risk area Multidimensional high-risk areas such as these have separate ratings for each segment as well as a summary rating of the overall high-risk area that reflects a composite of the ratings received under the segment for each of the five high-risk criteria High-risk areas that are primarily based on the need for congressional action are not rated on the criteria and do not receive a star graphic Changes to the 2019 High-Risk List We are removing two areas—DOD Supply Chain Management and Mitigating Gaps in Weather Satellite Data—from the list due to the progress that was made in addressing the high-risk issues As we have with areas previously removed from the High-Risk List we will continue to monitor these areas to ensure that the improvements we have noted are sustained If significant problems again arise we will consider reapplying the high-risk designation We added two areas to the High-Risk List since our 2017 update—Government-Wide Personnel Security Clearance Process and VA Acquisition Management See pages 6-18 for more information on the two high-risk areas being removed Page 4 GAO-19-157SP High-Risk Series In addition to specific areas that we have designated as high risk other important challenges facing our nation merit continuing close attention One of these is the use of illicit drugs and the misuse of prescription drugs and the ways they affect individuals their families and the communities in which they live Page 5 GAO-19-157SP High-Risk Series DOD Supply Chain Management DOD Supply Chain Management We are removing this high-risk area because the Department of Defense DOD has made sufficient progress on the remaining seven actions and outcomes we recommended for improving supply chain management Congressional attention DOD leadership commitment and our collaboration contributed to this successful outcome Why High-Risk Area is Being Why Area Was High Risk Removed DOD manages about 4 9 million secondary inventory items such as spare parts with a reported value of $92 9 billion as of September 2017 Effective and efficient supply chain management is critical for 1 supporting the readiness and capabilities of the force and 2 helping to ensure that DOD avoids spending resources on unneeded inventory that could be better applied to other defense and national priorities We define supply chain management as including three segments—inventory management asset visibility and materiel distribution DOD Supply Chain Management has been on our High-Risk List since 1990— starting with inventory management— because of inefficient and ineffective management practices leading to excess inventory In 2005 we added asset visibility and materiel distribution to this high-risk area due to weaknesses identified during operations in Iraq and Afghanistan including backlogs of hundreds of pallets and containers at distribution points In 2017 we removed inventory management from this area because DOD made key improvements such as reducing on-order excess inventory by about $600 million and addressing each of our high-risk criteria resulting in demonstrable and sustained improvements Contact Information For additional information about this high-risk area contact Diana Maurer at 202-512-9627 or maurerd@gao gov From 2014 to 2017 we identified 18 actions and outcomes DOD needed to implement in order for its supply chain management to be removed from our High-Risk List In our 2017 High-Risk Report we reported that DOD had made progress in addressing 11 actions and met the criteria of leadership commitment capacity and action plan for asset visibility and materiel distribution However DOD needed to take additional actions to fully implement the remaining seven actions and outcomes related to the monitoring and demonstrated progress criteria See fig 2 Figure 2 Segments of GAO’s Department of Defense’s Supply Chain Management High-Risk Area We are removing DOD Supply Chain Management from the High-Risk List because since 2017 DOD has addressed the remaining two criteria monitoring and demonstrated progress for asset visibility and materiel distribution by addressing the seven actions and outcomes identified in our 2017 High-Risk Report Page 6 GAO-19-157SP High-Risk Series DOD Supply Chain Management Since our 2017 High-Risk Report DOD has continued to meet the criteria of leadership commitment capacity and action plan for asset visibility Further DOD has fully addressed the three remaining actions and outcomes we outlined in 2017 in order to mitigate or resolve long-standing weaknesses in asset visibility Consequently DOD has met the monitoring and demonstrated progress criteria for asset visibility to remove this area from our High-Risk List Asset Visibility Leadership commitment met Senior leaders have continued to demonstrate commitment through their involvement in groups such as the Supply Chain Executive Steering Committee—senior-level officials responsible for overseeing asset visibility improvement efforts—and through the Asset Visibility Working Group which identifies opportunities for improvement and monitors the implementation of initiatives by issuing its Strategy for Improving DOD Asset Visibility Strategy in 2014 2015 and 2017 Capacity met DOD continues to demonstrate that it has the capacity— personnel and resources—to improve asset visibility For example DOD’s 2015 and 2017 Strategies advise the components to consider items such as staffing materiel and sustainment costs when documenting cost estimates for the initiatives in the Strategy as we recommended in January 2015 Action plan met A provision in the National Defense Authorization Act for Fiscal Year 2014 required DOD to submit to Congress a comprehensive strategy and implementation plans for improving asset tracking and in-transit visibility In January 2014 DOD issued the Strategy and accompanying implementation plans which outlined initiatives intended to improve asset visibility DOD updated its 2014 Strategy in October 2015 and in August 2017 Importantly since 2017 DOD addressed the three remaining actions and outcomes related to the monitoring and demonstrated progress criteria through updates to and implementation of the Strategies see table 1 Page 7 GAO-19-157SP High-Risk Series DOD Supply Chain Management Table 1 Status of Asset Visibility Remaining Action Items Required to Remove Supply Chain Management from GAO’s High-Risk List Action items Action item status High-risk category 1 Incorporate the attributes of successful performance measures e g clear quantifiable objective and reliable as appropriate in subsequent updates to the Strategy for Improving DOD Asset Visibility Met Monitoring 2 Take steps to incorporate into after-action reports information relating to performance measures for the asset visibility initiatives Met Monitoring 3 Demonstrate sustained progress in implementing initiatives that result in measurable outcomes and progress towards realizing the goals and objectives in the Strategy for Improving DOD Asset Visibility Met Demonstrated progress Source GAO analysis and prior GAO report GAO-19-157SP Monitoring met DOD provided guidance in its 2017 update to the Strategy for the military components to consider key attributes of successful performance measures during metric development for their improvement initiatives As appropriate the military components have followed the guidance and provided high-level summary metrics updates to the Asset Visibility Working Group In addition DOD has taken steps to monitor asset visibility by incorporating into after-action reports as appropriate information relating to performance measures These afteraction reports serve as closure documents and permanent records of each initiative’s accomplishments Demonstrated progress met DOD has demonstrated sustained progress by completing 34 of the 39 initiatives to improve asset visibility and continues to monitor the remaining 5 initiatives These initiatives have supported DOD’s goals and objectives which include 1 improving visibility efficiencies of physical inventories receipt processing cargo tracking and unit moves 2 ensuring asset visibility data are discoverable accessible and understandable to support informed decision-making across the enterprise and 3 increasing efficiencies for delivery accuracy and cycle times Also the Asset Visibility Working Group meets regularly to identify opportunities to further improve asset visibility within DOD DOD has taken the following actions to demonstrate sustained progress 1 created an integrated single portal system providing 7 500 users access to near-real-time in-transit visibility of eight million lines of items of supply and transportation data and 2 increased its visibility of assets through radio-frequency identification RFID an automated data-capture technology that can be used to electronically identify track and store information contained on a tag There are two main types of RFID tags Page 8 GAO-19-157SP High-Risk Series DOD Supply Chain Management passive and active which show whether assets are in-storage in-transit in-process or in-use Passive tags such as mass transit passes do not contain their own power source and cannot initiate communication with a reader while active tags such as an “E-Z pass ” contain a power source and a transmitter and send a continuous signal over longer distances DOD closed nine initiatives from its Strategies by implementing RFID technology For example the Marine Corps implemented long-range passive RFID for visibility and accountability of items resulting in improvements that include an increased range for “reading” an item— from 30 feet to 240 feet—and reduced inventory cycle times from 12 days to 10 hours Also the Navy reported that the use of passive RFID technology to support the overhaul of its nuclear-powered attack submarines enabled the Navy to better track parts resulting in 98 percent fewer missing components and an average cost avoidance of $1 3 million per boat Additionally according to DOD the use of RFID tags to provide visibility of sustainment cargo at the tactical leg resulted in $1 4 million annual cost savings Further DOD reported that the migration of the active RFID enterprise from a proprietary communication standard to a competitive multivendor environment reduced the cost of active RFID tags by half resulting in an estimated $5 7 million annual reduction in costs Since our 2017 High-Risk Report DOD has continued to meet the criteria of leadership commitment capacity and action plan for materiel distribution Further DOD has fully addressed the four remaining actions and outcomes we outlined in 2017 in order to mitigate or resolve long-standing weaknesses in materiel distribution Consequently DOD has met the monitoring and demonstrated progress criteria for materiel distribution to remove this area from our High-Risk List Materiel Distribution Leadership commitment met Senior leaders continue to demonstrate commitment through their involvement in groups such as the Supply Chain Executive Steering Committee—senior-level officials responsible for overseeing materiel distribution corrective actions—and through the Distribution Working Group which helped develop the Materiel Distribution Improvement Plan Improvement Plan in 2016 Capacity met DOD has continued to demonstrate that it has the personnel and resources such as key organizations and the associated Page 9 GAO-19-157SP High-Risk Series DOD Supply Chain Management governance structure to improve materiel distribution The Improvement Plan recognizes that additional resources will be required to accomplish its corrective actions and close any identified performance gaps within the time frame specified Action plan met In 2016 DOD developed its corrective action plan to address the department’s materiel distribution challenges The Improvement Plan details specific goals and actions to better measure the end-to-end distribution process ensure the accuracy of underlying data and strengthen and integrate distribution policies and the governance structure Importantly since 2017 DOD has fully addressed the four remaining actions and outcomes related to monitoring and demonstrated progress to mitigate or resolve long-standing weaknesses in materiel distribution see table 2 Table 2 Status of Materiel Distribution Remaining Action Items Required to Remove Supply Chain Management from GAO’s High-Risk List Action items Action item status High-risk category 1 Make progress in developing Department of Defense’s DOD’s suite of distribution performance metrics improving the quality of data underlying those metrics and sharing metrics information among stakeholders Met Monitoring 2 Integrate distribution metrics data including cost data from the combatant commands and other DOD components as appropriate on the performance of all a legs of the distribution system including the tactical leg Met Monitoring 3 Refine existing actions in the Materiel Distribution Improvement Plan or incorporate additional actions based on interim progress and results and update the Materiel Distribution Improvement Plan accordingly Met Monitoring 4 Demonstrate that the actions implemented under its Materiel Distribution Improvement Plan improve its capability to comprehensively measure distribution performance identify distribution problems and root causes and identify and implement solutions Met Demonstrated progress Source GAO analysis and prior GAO report GAO-19-157SP a The tactical leg is the last segment of the distribution system between the supply points in a military theater of operations and the forward operating bases and units Monitoring met DOD has monitored materiel distribution by making progress in developing its suite of distribution performance metrics improving the quality of their underlying data and sharing metrics information with stakeholders For example in January 2017 DOD developed a suite of performance metrics that provides a comprehensive picture of the distribution process including whether supplies are Page 10 GAO-19-157SP High-Risk Series DOD Supply Chain Management delivered on time and at sufficient quantity and quality Also DOD implemented checklists to assess the quality of data underlying each performance metric based on relevance accuracy comparability and interpretability The checklists and their standards assist in identifying root causes and addressing areas where performance data quality may be lacking DOD has also incorporated internal control requirements in its supply chain management guidance to increase confidence in the performance data Additionally DOD has revised its policy documents to require stakeholders to routinely capture and share distribution performance metrics including cost data and the department maintains websites to provide current performance information to distribution stakeholders DOD has also incorporated distribution metrics as appropriate on the performance of all legs of the distribution system including the tactical leg i e the last segment of the distribution system We previously reported on DOD’s deficiencies to accurately assess its distribution performance at the tactical leg such as missing delivery dates for shipments in Afghanistan Since that time the geographic combatant commands have been tracking metrics at the tactical leg including required delivery dates to determine the movement and causes of delays for shipments and have been sharing distribution performance information with the U S Transportation Command TRANSCOM through their deployment and distribution operations centers DOD is implementing a cost framework to incorporate transportation costs for all legs of the distribution system which will provide an additional metric for distribution stakeholders to assess the efficiency of the system The first phase of the cost framework began operating in August 2018 and is expected to be fully implemented in 2019 DOD is making progress in refining its Improvement Plan and is incorporating additional actions based on interim progress and results Since DOD issued the Improvement Plan in September 2016 the agency has 1 documented the results and monitored the status of each corrective action 2 revised completion dates as needed and 3 periodically provided decision makers with summary action charts plans and milestones DOD is also updating its instruction on management and oversight of the distribution enterprise to clarify the roles and responsibilities of all distribution stakeholders DOD officials have not determined a date for when this instruction will be issued Demonstrated progress met DOD has demonstrated sustained progress in improving its capability to comprehensively measure distribution performance identify distribution problems and root causes and implement solutions DOD has implemented 10 of 18 corrective actions in its Improvement Plan and is on track to implement the Page 11 GAO-19-157SP High-Risk Series DOD Supply Chain Management remaining 8 by September 2019 Because of this progress DOD’s monthly shipment reports have assessed performance against enhanced metrics across the distribution system For example in December 2017 TRANSCOM investigated performance standards for truck deliveries from its Defense Logistics Agency warehouses in Bahrain to customers in Kuwait due to frequent delays in shipments TRANSCOM determined that inadequate time for clearing customs in Kuwait resulted in an unrealistic delivery standard TRANSCOM in coordination with distribution stakeholders adjusted the delivery standard to adequately account for the in-theater customs process In addition TRANSCOM in partnership with the Defense Logistics Agency and the General Services Administration developed and implemented initiatives focused on distribution process and operational improvements to reduce costs and improve distribution services to the warfighter According to DOD these efforts have resulted in at least $1 56 billion in distribution cost avoidances to date Monitoring After Removal DOD has demonstrated commendable sustained progress improving its supply chain management This does not mean DOD has addressed all risk within this area It remains imperative that senior leaders continue their efforts to implement initiatives and corrective actions to maintain visibility of supplies track cargo movements meet delivery standards and maintain delivery data for shipments Continued oversight and attention are also warranted given the recent reorganization of the Office of the Under Secretary of Defense for Acquisition and Sustainment and the resulting change in the oversight structure of Supply Chain Management We will therefore continue to conduct oversight of supply chain management at DOD Related GAO Products Defense Logistics Improved Performance Measures and Information Needed for Assessing Asset Visibility Initiatives GAO-17-183 Washington D C Mar 16 2017 Defense Logistics DOD Has Addressed Most Reporting Requirements and Continues to Refine its Asset Visibility Strategy GAO-16-88 Washington D C Dec 22 2015 Defense Logistics Improvements Needed to Accurately Assess the Performance of DOD’s Materiel Distribution Pipeline GAO-15-226 Washington D C Feb 26 2015 Page 12 GAO-19-157SP High-Risk Series Mitigating Gaps in Weather Satellite Data Mitigating Gaps in Weather Satellite Data We are removing this high-risk area because—with strong congressional support and oversight—the National Oceanic and Atmospheric Administration NOAA and the Department of Defense DOD have made significant progress in establishing and implementing plans to mitigate potential gaps in weather satellite data Why Area Was High Risk The United States relies on two satellite systems for weather forecasts and observations 1 polar-orbiting satellites that provide a global perspective every morning and afternoon and 2 geostationary satellites that maintain a fixed view of the nation NOAA is responsible for the polar satellite program that crosses the equator in the afternoon and for the geostationary satellite program DOD is responsible for the polar satellite program that crosses the equator in the early morning orbit These agencies are planning or executing major satellite acquisition programs to replace existing polar and geostationary satellites that are nearing the end of or are beyond their expected life spans A gap in satellite data would result in less accurate and timely weather forecasts and warnings of extreme events—such as hurricanes and floods Given the criticality of satellite data to weather forecasts the likelihood of significant gaps in weather satellite data and the potential impact of such gaps on the health and safety of the U S population and economy we concluded that the potential gap in weather satellite data was a high-risk area and added it to the High-Risk List in 2013 More recently in recognition of NOAA’s progress we removed the geostationary satellite segment from the high-risk area in 2017 Contact Information For additional information about this high-risk area contact Carol C Harris at 202-512-4456 or at harriscc@gao gov Why High-Risk Area Is Being Removed In our 2017 High-Risk Report we reported that NOAA had fully implemented criteria associated with demonstrating leadership commitment having the needed capacity to address risks and monitoring progress We also reported that NOAA had partially implemented the criteria for establishing an action plan and demonstrating progress In addition our 2017 report noted DOD’s slow progress in establishing plans for its follow-on weather satellite program and for determining how it would fulfill other weather requirements in the early morning orbit Since that time 1 NOAA has fully implemented actions in response to the remaining two criteria that had previously been partially implemented and 2 DOD pursuant to statutes and accompanying congressional direction established and began implementing plans both for its follow-on weather satellite program and for addressing the key requirements that were not included in that satellite program Consequently we are removing the need to mitigate gaps in weather satellite data from our High-Risk List Page 13 GAO-19-157SP High-Risk Series Mitigating Gaps in Weather Satellite Data Since our last high-risk update in 2017 NOAA continues to meet the criteria of leadership commitment capacity and monitoring and now also meets the criteria of action plan and demonstrated progress NOAA’s PolarOrbiting Weather Satellites Leadership commitment met NOAA program officials met the leadership commitment criteria in 2015 and have continued to sustain their strong leadership commitment to mitigating potential satellite data gaps since that time For example NOAA issued and frequently updated its polar satellite gap mitigation plan which identifies the specific technical programmatic and management steps the agency is taking to ensure that satellite mitigation options are viable In addition NOAA executives continue to oversee the acquisition of polar-orbiting satellites through monthly briefings on the cost schedule and risks affecting the satellites’ development Capacity met NOAA continues to meet the criterion of improving its capacity to address the risk of a satellite data gap In December 2014 we recommended that NOAA investigate ways to prioritize the gap mitigation projects with the greatest potential benefit to weather forecasting such as by improving its high-performance computing capacity NOAA agreed with this recommendation and implemented it For example NOAA upgraded its high-performance computers which allowed the agency to move forward on multiple other mitigation activities including experimenting with other data sources and assimilating these data into its weather models Action plan met NOAA now meets the criterion for having a plan to address the risk of a polar satellite data gap which is an increase over its rating in 2017 In June 2012 we reported that while NOAA officials communicated publicly and often about the risk of a polar satellite data gap the agency had not established plans to mitigate the gap We recommended that NOAA establish a gap mitigation plan and the agency did so in February 2014 However in December 2014 we recommended that NOAA revise its plan to address shortfalls including 1 adding recovery time objectives for key products 2 identifying opportunities for accelerating the calibration and validation of satellite data products 3 providing an assessment of available alternatives based on their costs and impacts and 4 establishing a schedule with meaningful timelines and linkages among mitigation activities The agency agreed with the recommendation and subsequently addressed it Specifically NOAA issued three updates to its gap Page 14 GAO-19-157SP High-Risk Series Mitigating Gaps in Weather Satellite Data mitigation plan between January 2016 and February 2017 With the last of the updates the agency addressed the shortfalls we had identified Monitoring met NOAA met this criterion in 2017 and continues to meet it now by implementing our recommendations to more consistently and comprehensively monitor its progress on gap mitigation activities For example all three NOAA organizations responsible for gap mitigation projects regularly brief senior management on their progress Demonstrated progress met NOAA now meets the criterion for demonstrated progress which is an increase over its prior rating In our 2017 High-Risk Report we noted that NOAA had identified 35 different gap mitigation projects and was making progress in implementing them These projects fell into three general categories 1 understanding the likelihood and impact of a gap 2 reducing the likelihood of a gap and 3 reducing the impact of a gap Nevertheless one of the most important steps in reducing the likelihood of a gap—keeping the launch of the next polar satellite on schedule—had encountered problems Specifically agency officials decided to delay the launch due to challenges in developing the ground system and a critical instrument on the spacecraft This delay exacerbated the probability of a satellite data gap More recently however NOAA was able to demonstrate progress by successfully launching the satellite in November 2017 That satellite now called NOAA-20 is currently operational and is being used to provide advanced weather data and forecasts Moreover the agency is also working to build and launch the next satellites in the polar satellite program DOD’s Polar-Orbiting Weather Satellites Since our last high-risk update in 2017 DOD now meets all five high-risk criteria Leadership commitment met With strong congressional oversight DOD now meets this criterion Pursuant to enactment of the Carl Levin and Howard P ’Buck’ McKeon National Defense Authorization Act for Fiscal Year 2015 NDAA for FY 2015 the National Defense Authorization Act for Fiscal Year 2016 NDAA for FY 2016 and the Consolidated Appropriations Act 2016 DOD leadership committed to developing and implementing plans to address its weather satellite requirements For example in late 2017 the department awarded a contract for its Weather System Follow-on— Microwave satellite to fulfill core weather requirements Page 15 GAO-19-157SP High-Risk Series Mitigating Gaps in Weather Satellite Data Capacity met With strong congressional oversight DOD now meets the capacity criterion Specifically the NDAA for FY 2015 restricted the availability of 50 percent of the FY 2015 funds authorized for the Weather Satellite Follow-on System now called the Weather System Follow-on— Microwave satellite program until DOD submitted to the congressional defense committees a plan to meet weather monitoring data collection requirements In addition the explanatory statement that accompanied the Consolidated Appropriations Act 2016 recommended that the Air Force focus on ensuring that the next generation of weather satellites meet the full spectrum of requirements and work with civil stakeholders to leverage appropriate civil or international weather assets As called for in the law and the explanatory statement DOD established plans to meet weather monitoring data collection needs including by acquiring satellites as part of a family of systems to replace its aging legacy weather satellites Additionally DOD formally coordinated with NOAA on weather monitoring data collection efforts In January 2017 the Air Force and NOAA signed a memorandum of agreement and in November 2017 signed an annex to that agreement to allow for the exchange of information and collaboration on a plan for collecting weather monitoring data The Air Force and NOAA are now developing plans to relocate a residual NOAA satellite over the Indian Ocean an area of concern for cloud characterization and area-specific weather imagery coverage Action plan met In our 2017 High-Risk Report we reported that DOD was slow to establish plans for its Weather System Follow-on–Microwave program and had made little progress in determining how it would meet weather satellite requirements for cloud characterization and area-specific weather imagery Pursuant to the NDAA for FY 2015 the NDAA for FY 2016 and the explanatory statement that accompanied the Consolidated Appropriations Act 2016 the department developed and began implementing plans to address its weather satellite requirements As mentioned above in late 2017 the department awarded a contract for its Weather System Follow-on–Microwave satellite to fulfill core weather requirements Under this program the department may launch a demonstration satellite in 2021 and plans to launch an operational satellite in 2022 DOD also developed plans for providing its two highest-priority capabilities—cloud characterization and area-specific weather imagery data collection—that will not be covered by the Weather System Followon–Microwave satellite program The department is planning a longerterm solution called the Electro-Optical Infrared Weather Systems program to meet these needs with a planned satellite launch in 2024 Page 16 GAO-19-157SP High-Risk Series Mitigating Gaps in Weather Satellite Data Monitoring met DOD now meets the monitoring criterion as evidenced by its actions to initiate a major acquisition program the Weather System Follow-on–Microwave and award a contract for the first satellite In addition program officials stated that they plan to monitor the program’s progress toward addressing critical needs and assess its operations and sustainment costs Demonstrated progress met DOD now meets the demonstrated progress criterion because it has developed plans and taken actions to address gaps in weather data through its plans to launch the Weather System Follow-on–Microwave satellite in 2022 The department also plans to launch the Electro-Optical Infrared Weather Systems satellite in 2024 By developing these plans DOD has reduced the risk of a gap in weather satellite data and addressed the concerns about a lack of planning that we identified in our 2017 High-Risk Report DOD’s effective implementation of its plans will be key to further reducing the risks of gaps in weather satellite data in the future Monitoring After Removal Moving forward we will continue to monitor both NOAA and DOD efforts to develop and launch the next satellites in their respective weather satellite programs NOAA plans to launch its next geostationary weather satellite in 2021 and to launch its next polar weather satellite in 2022 DOD plans satellite launches in 2021 potentially 2022 and 2024 In addition we will continue to monitor DOD’s efforts to develop long-term plans to meet its weather satellite requirements Related GAO Products Weapon Systems Annual Assessment Knowledge Gaps Pose Risks to Sustaining Recent Positive Trends GAO-18-360SP Washington D C Apr 25 2018 Satellite Acquisitions Agencies May Recover a Limited Portion of Contract Value When Satellites Fail GAO-17-490 Washington D C June 9 2017 Defense Acquisitions Assessments of Selected Weapon Programs GAO-17-333SP Washington D C Mar 30 2017 Defense Weather Satellites DOD Faces Acquisition Challenges for Addressing Capability Needs GAO-16-769T Washington D C July 7 2016 Polar Satellites NOAA Faces Challenges and Uncertainties that Could Affect the Availability of Critical Weather Data GAO-16-773T Washington D C July 7 2016 Page 17 GAO-19-157SP High-Risk Series Mitigating Gaps in Weather Satellite Data Polar Weather Satellites NOAA Is Working to Ensure Continuity but Needs to Quickly Address Information Security Weaknesses and Future Program Uncertainties GAO-16-359 Washington D C May 17 2016 Defense Weather Satellites Analysis of Alternatives Is Useful for Certain Capabilities but Ineffective Coordination Limited Assessment of Two Capabilities GAO-16-252R Washington D C Mar 10 2016 Page 18 GAO-19-157SP High-Risk Series Government-wide Personnel Security Clearance Process Added to the High-Risk List Executive branch agencies are not meeting investigation timeliness objectives and these processing delays have contributed to a significant backlog that the National Background Investigations Bureau NBIB —the agency responsible for personnel security clearance investigations— reported to be approximately 565 000 investigations as of February 2019 In addition the executive branch has not finalized performance measures to ensure the quality of background investigations and some longstanding key reform initiatives remain incomplete Further information technology IT security concerns may delay planned milestones for the development of a new background investigation IT system We included the DOD program on our High-Risk List in 2005 and removed it in 2011 because of improvements in the timeliness of investigations and adjudications and steps toward measuring the quality of the process We put the government-wide personnel security clearance process on our High-Risk List in January 2018 because of significant challenges related to the timely processing of security clearances and completing the development of quality measures In addition the government’s effort to reform the personnel security clearance process starting with the enactment of the Intelligence Reform and Terrorism Prevention Act of 2004 has had mixed progress and key reform efforts have not been implemented government-wide 4 Since adding this area to the High-Risk List the Security Clearance Suitability and Credentialing Performance Accountability Council PAC including its four principal members—the Deputy Director for Management of the Office of Management and Budget OMB the Director of National Intelligence DNI the Under Secretary of Defense for Intelligence and the Director of the Office of Personnel Management OPM —have not fully met the five criteria for high-risk removal Several issues contribute to the risks facing the government-wide personnel security clearance process • Clearance processing delays Executive branch agencies are not meeting most investigation timeliness objectives The percentage of executive branch agencies meeting established timeliness objectives for initial secret clearances initial top secret clearances and periodic reinvestigations decreased each year from fiscal years 2012 through 2018 For example 97 percent of the executive branch agencies we 4 Pub L No 108-458 118 Stat 3638 2004 Page 19 GAO-19-157SP High-Risk Series reviewed did not meet the timeliness objectives for initial secret clearance investigations in fiscal year 2018 • Lack of quality measures While the executive branch has taken steps to establish government-wide performance measures for the quality of background investigations—including establishing quality assessment standards and a quality assessment reporting tool—it is unclear when this effort will be completed • Security clearance reform delays The executive branch has reformed many parts of the personnel security clearance process—such as updating adjudicative guidelines to establish common adjudicative criteria for security clearances however some long-standing key initiatives remain incomplete—such as completing plans to fully implement and monitor continuous evaluation • IT security DOD is responsible for developing a new system to support background investigation processes and DOD officials expressed concerns about the security of connecting to OPM’s legacy systems since a 2015 data breach compromised OPM’s background investigation systems and files for 21 5 million individuals As of December 2018 OPM has not fully taken action on our priority recommendations to update its security plans evaluate its security control assessments and implement additional training opportunities However since we added this area to our High-Risk List the PAC has demonstrated progress in some areas For example NBIB reported that the backlog of background investigations decreased from almost 715 000 cases in January 2018 to approximately 565 000 cases in February 2019 NBIB officials credit an Executive Memorandum—issued jointly in June 2018 by the DNI and the Director of OPM and containing measures to reduce the investigation backlog—as a driver in backlog reduction Further in response to a requirement in the Securely Expediting Clearances Through Reporting Transparency SECRET Act of 2018 in September 2018 NBIB reported to Congress for each clearance level 1 the size of the investigation backlog 2 the average length of time to conduct an initial investigation and a periodic reinvestigation and 3 a discussion of the factors contributing to investigation timeliness 5 The PAC is also reporting publicly on the progress of key reforms through www performance gov and for fiscal year 2018 the website contains quarterly action plans and progress updates which present figures on the 5 Pub L No 115-173 § 3 132 Stat 1291 1291–1292 2018 Page 20 GAO-19-157SP High-Risk Series average timeliness of initial investigations and periodic reinvestigations for the executive branch as a whole investigation workload and backlog and investigator headcounts We have made numerous recommendations to PAC members to address risks associated with the personnel security clearance process between 2011—when we removed DOD’s personnel security clearance program from the High-Risk List and 2018—when we placed the government-wide personnel security clearance process on the High-Risk List We consider 27 of these recommendations key to addressing the high-risk designation Eight recommendations key to the high-risk designation have been implemented including three since January 2018 Nineteen of these key recommendations remain open—including recommendations that the principal members of the PAC 1 conduct an evidence-based review of investigation and adjudication timeliness objectives 2 develop and report to Congress on investigation quality measures 3 prioritize the timely completion of efforts to modernize and secure IT systems that affect clearance holders government-wide and 4 develop and implement a comprehensive workforce plan that identifies the workforce needed to meet current and future demand for background investigations services and to reduce the investigations backlog See appendix II for additional detail on this high-risk area including more details on actions that need to be taken VA Acquisition Management Added to the High-Risk List VA spends tens of billions of dollars to procure a wide range of goods and services—including medical supplies IT and construction of hospitals clinics and other facilities—to meet its mission of providing health care and other benefits to millions of veterans VA has one of the most significant acquisition functions in the federal government both in obligations and number of contract actions The Veterans Health Administration VHA provides medical care to veterans and is by far the largest administration in the VA Since we began focusing on VA’s acquisition management activities in 2015 we have reported numerous challenges in this area Since 2015 we have made 31 recommendations 21 of which remain open that cover a range of areas to address challenges in VA’s acquisition management In fiscal year 2019 VA received the largest discretionary budget in its history—$86 5 billion about $20 billion higher than in 2015 About a third of VA’s discretionary budget in fiscal year 2017 or $26 billion has been Page 21 GAO-19-157SP High-Risk Series used to contract for goods and services VA’s acquisition management continues to face challenges including 1 outdated acquisition regulations and policies 2 lack of an effective medical supplies procurement strategy 3 inadequate acquisition training 4 contracting officer workload challenges 5 lack of reliable data systems 6 limited contract oversight and incomplete contract file documentation and 7 leadership instability In light of these challenges and given the significant taxpayer investment it is imperative that VA show sustained leadership commitment to take steps to improve the performance of its procurement function so that it can use its funding in the most efficient manner possible to meet the needs of those who served our country This area has been added to the High-Risk List for the following reasons in particular • Outdated acquisition regulations and policies VA’s procurement policies have historically been outdated disjointed and difficult for contracting officers to use In September 2016 we reported that the acquisition regulations contracting officers currently follow have not been fully updated since 2008 and that VA had been working on completing a comprehensive revision of its acquisition regulations since 2011 VA’s delay in updating this fundamental source of policy has impeded the ability of contracting officers to effectively carry out their duties We recommended in September 2016 that VA identify measures to expedite the revision of its acquisition regulations and clarify what policies are currently in effect VA concurred with this recommendation but has not yet fully implemented it • Lack of an effective medical supplies procurement strategy VA’s Medical Surgical Prime Vendor-Next Generation MSPV-NG program for purchasing medical supplies to meet the needs of about 9 million veterans at 172 medical centers has not been effectively executed nor is it in line with practices at leading hospitals that have launched similar programs We reported in November 2017 that VA’s approach to developing its catalog of supplies was rushed and lacked key stakeholder involvement and buy-in As a result VA was not able to accomplish some of the key efficiencies the program was intended to achieve such as streamlining the purchase of medical supplies and saving money We recommended in November 2017 that VA develop document and communicate to stakeholders an overarching strategy for the program VA concurred with this recommendation and reported that it would develop a new strategy by March 2019 Page 22 GAO-19-157SP High-Risk Series • Contracting officer workload challenges The majority of our reviews since 2015 have highlighted workload as a contributing factor to the challenges that contracting officers face Most recently in September 2018 we reported that about 54 percent of surveyed VA contracting officers said their workload was not reasonable In addition in September 2016 we reported that VHA contracting officers processed a large number of emergency procurements of routine medical supplies which accounted for approximately 20 percent of VHA’s overall contract actions in fiscal year 2016 with obligations totaling about $1 9 billion Contracting officers told us that these frequent and urgent small-dollar transactions reduce contracting officers’ efficiency and ability to take a strategic view of procurement needs We recommended in November 2017 that VHA network contracting offices work with medical centers to identify opportunities to more strategically purchase goods and services frequently purchased on an emergency basis VA concurred with this recommendation and reported in December 2018 that it is utilizing a supply chain dashboard to track items purchased on an emergency basis and determine which of those items to include on the catalog VA noted that it added 13 300 items to the catalog from June 2018 to December 2018 including items often purchased on an emergency basis We requested documentation showing which items added to the catalog were previously purchased on an emergency basis but as of January 2019 VA had not yet provided it Among other things VA should implement our 21 open recommendations and specifically needs to take the following steps to demonstrate greater leadership commitment and strategic planning to ensure efficient use of its acquisition funding and staffing resources • Prioritize completing the revision of its acquisition regulations which has been in process since 2011 • Develop document and communicate to stakeholders a strategy for the Medical Surgical Prime Vendor program to achieve overall program goals • Identify opportunities to strategically purchase goods and services that are frequently purchased on an emergency basis See appendix II for additional detail on this high-risk area including more details on actions that need to be taken Page 23 GAO-19-157SP High-Risk Series Emerging Issue Requiring Close Attention Federal Efforts to Prevent Drug Misuse In addition to specific areas that we have designated as high risk other important challenges facing our nation merit continuing close attention One of these is the use of illicit drugs and the misuse of prescription drugs and the ways they affect individuals their families and the communities in which they live Over 70 000 people died from drug overdoses in 2017—about 191 people every day—according to the Centers for Disease Control and Prevention with the largest portion of these deaths attributed to opioids Further drug overdoses are the leading cause of death due to injuries in the United States They are currently at their highest ever recorded level and since 2011 have outnumbered deaths by firearms motor vehicle crashes suicide and homicide according to the Drug Enforcement Administration The Council of Economic Advisors estimates that in 2015 the economic cost of the opioid crisis alone was more than $500 billion when considering the value of lives lost due to opioid-related overdose Federal drug control efforts spanning prevention treatment interdiction international operations and law enforcement represent a considerable federal investment According to the President’s fiscal year 2019 budget federal drug control funding for fiscal year 2017 was $28 8 billion Multiple federal agencies have ongoing efforts to respond to this crisis including efforts to reduce the supply and demand for illicit drugs to prevent misuse of prescription drugs and to treat substance use disorders However we previously found that many efforts lacked measures to gauge the success of the federal response Further we have long advocated an approach to decision-making based on risk management Such an approach would 1 link agencies’ plans and budgets to achieving their strategic goals 2 assess values and risks of various courses of actions to help set priorities and allocate resources and 3 provide for the use of performance measures to assess progress The Office of National Drug Control Policy ONDCP is responsible for overseeing and coordinating the implementation of U S drug policy including developing the National Drug Control Strategy Strategy ONDCP released the 2019 Strategy on January 31 2019 The Strategy focuses on approaches related to prevention treatment and recovery and steps to reduce the availability of illicit drugs in the United States We will continue to monitor the extent to which ONDCP and other federal agencies are employing a risk management and coordinated approach to their efforts to limit drug misuse Page 24 GAO-19-157SP High-Risk Series In particular we have ongoing and planned work to assess ONDCP’s operations including its 1 leadership and coordination of efforts across the federal government 2 the effects of the drug crisis on labor force participation and productivity and on people with disabilities and other vulnerable populations 3 key federal efforts to reduce the availability of illicit drugs and 4 agency efforts around drug education and prevention We will determine whether this issue should be added to the High-Risk List once we have completed this ongoing and planned work High-Risk Areas That Made Progress Agencies can show progress by addressing our five criteria for removal from the list leadership commitment capacity action plan monitoring and demonstrated progress 6 As shown in table 3 24 high-risk areas or about two-thirds of all the areas have met or partially met all five criteria for removal from our High-Risk List 20 of these areas fully met at least one criterion Compared with our last assessment 7 high-risk areas showed progress in one or more of the five criteria without regressing in any of the criteria Ten high-risk areas have neither met nor partially met one or more criteria Two areas showed mixed progress by increasing in at least one criterion and also declining in at least one criterion Three areas declined since 2017 These changes are indicated by the up and down arrows in table 3 Table 3 2017 High-Risk Areas Rated Against Five Criteria for Removal from GAO’s High-Risk List Number of criteria High-risk area Change since 2017 Met Partially met Not met Department of Defense DOD Supply Chain Management  5 0 0 Mitigating Gaps in Weather Satellite Data  5 0 0 DOD Support Infrastructure Management  2 3 0 Medicare Program Improper Paymentsa  2 3 0 DOD Financial Management  1 3 1 DOE’s Contract Management for the National Nuclear Security Administration and Office of Environmental Management  1 3 1 DOD Business Systems Modernization  0 5 0 DOD Approach to Business Transformation  1 4 0 USPS Financial Viability  1 3 1 6 Additional detail on our high-risk criteria and ratings is in appendix I Page 25 GAO-19-157SP High-Risk Series Number of criteria High-risk area Change since 2017 Met Partially met Not met NASA Acquisition Management  1 4 0 Transforming the Environmental Protection Agency’s EPA Processes for Assessing and Controlling Toxic Chemicals  0 5 0 Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks  0 3 2 Strengthening Department of Homeland Security Management Functions ● 3 2 0 DOD Contract Management ● 1 4 0 DOD Weapon Systems Acquisition ● 1 4 0 Enforcement of Tax Laws ● 1 4 0 Ensuring the Cybersecurity of the Nation ● 1 4 0 Improving the Management of IT Acquisitions and Operations ● 1 4 0 Managing Federal Real Property ● 1 4 0 Protecting Public Health through Enhanced Oversight of Medical Products ● 1 4 0 Strategic Human Capital Management ● 1 3 1 Ensuring the Effective Protection of Technologies Critical to U S National Security Interests ● 0 5 0 Improving and Modernizing Federal Disability Programs ● 0 5 0 Management of Federal Oil and Gas Resources ● 0 5 0 Modernizing the U S Financial Regulatory System ● 0 5 0 National Flood Insurance Program ● 0 5 0 Strengthening Medicaid Program Integrity ● 0 5 0 Resolving the Federal Role in Housing Finance ● 0 4 1 Improving Federal Oversight of Food Safety ● 0 3 2 Managing Risks and Improving VA Health Care ● 0 2 3 1 4 0 1 3 1 0 5 0 0 1 4 2020 Decennial Census b Government-wide Personnel Security Clearance Process b Improving Federal Management of Programs that Serve Tribes and Their Membersb b U S Government’s Environmental Liability Funding the Nation’s Surface Transportation System c Pension Benefit Guaranty Corporation Insurance Programsc  indicates one or more areas progressed  indicates one or more areas declined since 2017   indicates mixed progress ● indicates no change Source GAO GAO-19-157SP a Medicare Program Improper Payments was only rated on the Improper Payments program we did not rate other elements of the Medicare program because the area is subject to frequent legislative updates and the program is in a state of transition b Four areas are receiving ratings for the first time because they were newly added in 2017 and 2018 c Two high-risk areas were not rated because addressing them primarily involves congressional action Funding the Nation’s Surface Transportation System and Pension Benefit Guaranty Corporation Insurance Programs Page 26 GAO-19-157SP High-Risk Series Figure 3 shows that since our 2017 update the most progress was made on the action plan criterion—four high-risk areas received higher ratings We rated two areas lower on leadership commitment and two areas lower on monitoring Figure 3 High-Risk Areas’ Progress and Regress on High-Risk Criteria Since 2017 Leadership Attention Needed to Meet High-Risk Criteria Table 4 shows that 17 of the 34 high-risk areas we rated have met the leadership commitment criterion while two high-risk area ratings regressed on leadership commitment from met to partially met since our last report Leadership commitment is the critical element for initiating and sustaining progress and leaders provide needed support and accountability for managing risks Leadership commitment is needed to make progress on Page 27 GAO-19-157SP High-Risk Series the other four high-risk criteria Table 4 shows that only three high-risk areas met the criterion for capacity six met the criterion for action plan and two met the criterion for demonstrated progress One high-risk area—U S Government’s Environmental Liability—has partially met only one criterion since we added the area to our list in 2017 and the rest are not met Table 4 2019 High-Risk Area Ratings on Five Criteria for Removal from GAO’s High-Risk List Criteria High-risk area Leadership Capacity commitment Action plan Monitoring Demonstrated progress Department Of Defense DOD Supply Chain Management 3 3 3 3 3 5 Mitigating Gaps in Weather Satellite Data 3 3 3 3 3 5 Strengthening Department of Homeland Security Management Functions 3 2 3 3 2 3 Medicare Program Improper Paymentsa 3 3 2 2 2 2 1 DOD Support Infrastructure Management 3 2 3 2 2 2 2020 Decennial Census 3 2 2 2 2 1 8 DOD Contract Management 3 2 2 2 2 1 4 DOD Weapon Systems Acquisition 3 2 2 2 2 1 4 Enforcement of Tax Laws 3 2 2 2 2 1 4 Ensuring the Cybersecurity of the Nation 3 2 2 2 2 1 4 Improving the Management of Information Technology Acquisitions and Operations 3 2 2 2 2 1 4 Managing Federal Real Property 3 2 2 2 2 1 4 Protecting Public Health through Enhanced Oversight of Medical Products DOD Approach to Business Transformation NASA Acquisition Management DOD Financial Management Strategic Human Capital Management Page 28 GAO-19-157SP High-Risk Series Criteria High-risk area Leadership Capacity commitment Action plan Monitoring Demonstrated progress Government-wide Personnel Security Clearance Process DOE’s Contract Management for the National Nuclear Security Administration and Office of Environmental Management USPS Financial Viability DOD Business Systems Modernization Ensuring the Effective Protection of Technologies Critical to U S National Security Interests Improving and Modernizing Federal Disability Programs Improving Federal Management of Programs that Serve Tribes and Their Members Management of Federal Oil and Gas Resources Modernizing the U S Financial Regulatory System National Flood Insurance Program Strengthening Medicaid Program Integrity Transforming the Environmental Protection Agency’s EPA Processes for Assessing and Controlling Toxic Chemicals Resolving the Federal Role in Housing Finance Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks Improving Federal Oversight of Food Safety Managing Risks and Improving VA Health Care U S Government’s Environmental Liability Legend Met Partially Met Not Met Source GAO GAO-19-157SP Notes Two high-risk areas—Funding the Nation’s Surface Transportation System and Pension Benefit Guaranty Corporation Insurance Programs—did not receive ratings against the five high-risk criteria because progress would primarily involve congressional action a Medicare Program Improper Payments was only rated on the Improper Payments and we did not rate other elements of the Medicare program Page 29 GAO-19-157SP High-Risk Series Progress in High-Risk Areas As noted seven areas showed improvement in one or more criterion without regressing in any criteria Two areas showed sufficient progress to be removed from the High-Risk List The other five high-risk areas remaining on the 2019 list demonstrated improvement and are described below Three of these five improving high-risk areas are the responsibility of the Department of Defense DOD —DOD Support Infrastructure Management DOD Financial Management and DOD Business Systems Modernization The two other improving areas are Department of Energy’s DOE's Contract Management for the National Nuclear Security Administration and Office of Environmental Management and Medicare Program Improper Payments • DOD Support Infrastructure Management DOD manages a portfolio of real property assets that as of fiscal year 2017 reportedly included about 586 000 facilities—including barracks maintenance depots commissaries and office buildings The combined replacement value of this portfolio is almost $1 2 trillion and includes about 27 million acres of land at nearly 4 800 sites worldwide This infrastructure is critical to maintaining military readiness and the cost to build and maintain it represents a significant financial commitment Since our 2017 High-Risk Report DOD’s rating for two criteria—leadership commitment and action plan—improved from partially met to met DOD has demonstrated leadership commitment by stating its commitment to addressing key recommendations we have made by for example 1 better forecasting the initial Base Realignment and Closure BRAC costs for military construction IT and relocating military personnel and equipment 2 better aligning infrastructure to DOD force structure needs by for example improving the accuracy and sufficiency of its excess capacity estimates and 3 pursuing an effort to consolidate and standardize leases which includes analyzing whether it is feasible to relocate functions from commercial leased space to existing space on an installation thereby reducing leases and better utilizing excess space DOD has developed action plans to better identify excess infrastructure and thus be positioned to dispose of it For example in the 2017 HighRisk Report we stated that DOD’s Real Property Efficiency Plan includes DOD’s goals for reducing the footprint of its real property inventory and metrics to gauge progress to be implemented by the end of 2020 We also found in 2018 that DOD was achieving cost savings and cost avoidances as it had begun using intergovernmental support agreements between military installations and local governments to obtain installation services such as waste removal grounds maintenance and stray animal control As a result of these and other actions DOD now meets the action plan criterion for this high-risk area Page 30 GAO-19-157SP High-Risk Series As of December 2018 23 recommendations related to this high-risk area remain open DOD continues to partially meet the criteria for capacity monitoring and demonstrated progress See appendix II for additional detail on this high-risk area including more details on actions that need to be taken • DOD Financial Management Since our 2017 High-Risk Report ratings for the DOD Financial Management high-risk area improved for the criteria of leadership commitment and monitoring For the leadership commitment criterion the high-risk area rating improved from partially met to met in 2019 due to several DOD leadership actions For example in 2018 DOD leadership met the goal of undergoing an agency-wide financial statement audit and established a process to remediate any audit findings—ultimately to improve the quality of financial information that is most valuable in managing the department’s day-to-day operations In addition according to a DOD official audit remediation efforts have produced benefits in certain inventory processes that have led to operational improvements DOD leadership demonstrated its commitment to making needed improvements by developing a database that tracks hundreds of findings and recommendations that came out of the audits In addition senior leadership has been meeting bimonthly with military services’ leadership for updates on the status of corrective action plans to address audit findings and recommendations and the Under Secretary of Defense Comptroller has been meeting frequently with the Secretary of Defense to review the plans These same DOD actions also led to the high-risk area’s rating for the criterion of monitoring to improve from not met to partially met For example the database mentioned above is intended to capture prioritize and assign responsibility for auditor findings and related corrective action plans which are meant to be used to measure progress towards achieving a clean audit opinion Further DOD leadership has held frequent meetings to discuss the status of corrective action plans In addition DOD also established councils in certain areas e g financial reporting to review the status of audit remediation activities and challenges All of these actions demonstrate an improvement in DOD’s monitoring activities for its financial management function However DOD’s efforts to improve its financial management continue to be impaired by long-standing issues—including its decentralized environment cultural resistance to change lack of skilled financial Page 31 GAO-19-157SP High-Risk Series management staff ineffective processes systems and controls incomplete corrective action plans and the need for more effective monitoring and reporting DOD remains one of the few federal entities that cannot accurately account for and report on its spending or assets As of December 2018 53 recommendations for this high-risk area are open The DOD Financial Management high-risk area continues to partially meet the capacity and action plan criteria and not meet the demonstrated progress criterion See appendix II for additional detail on this high-risk area including more details on actions that need to be taken • DOD Business Systems Modernization DOD spends billions of dollars each year to acquire modernized systems including systems that address key areas such as personnel financial management health care and logistics This high-risk area includes three critical challenges facing DOD 1 improving business system acquisition management 2 improving business system investment management and 3 leveraging DOD’s federated business enterprise architecture DOD’s capacity for modernizing its business systems has improved over time and since our 2017 High-Risk Report DOD’s overall rating for the criterion of action plan improved from not met to partially met in 2019 DOD established a plan for improving its federated business enterprise architecture i e description of DOD’s current and future business environment and a plan for transitioning to the future environment Specifically the rating improved for DOD’s federated business enterprise architecture segment of the high-risk area because DOD’s assistant deputy chief management officer approved a business architecture improvement plan in January 2017 Since 2017 we have made 10 recommendations related to this high-risk issue As of December 2018 27 recommendations are open The leadership capacity monitoring and demonstrated progress criteria remain partially met as in 2017 See appendix II for additional detail on this high-risk area including more details on actions that need to be taken • DOE's Contract Management for the National Nuclear Security Administration and Office of Environmental Management DOE oversees a broad range of programs related to nuclear security science energy and waste cleanup among other areas As the largest civilian contracting agency in the federal government DOE relies primarily on contractors to carry out its programs For instance DOE spends about 90 Page 32 GAO-19-157SP High-Risk Series percent of its annual budget on contracts and acquiring capital assets In fiscal year 2018 DOE’s budget was $34 5 billion The high-risk area focuses on contracts as well as major projects—those with an estimated cost of $750 million or greater—managed by DOE’s National Nuclear Security Administration NNSA and Office of Environmental Management EM Since our 2017 High-Risk Report DOE has made progress by improving from a not met to a partially met rating for the demonstrated progress criterion Specifically through its Office of Cost Estimating and Program Evaluation NNSA has enhanced its capability to estimate costs and schedules and to assess alternatives for programs and projects among other things NNSA also made progress by adopting best practices in several areas such as those for estimating costs and schedules in nuclear weapons refurbishment activities and capital asset acquisitions For example we determined that DOE’s revised cost estimate of $17 2 billion to construct a Mixed Oxide Fuel Fabrication Facility to dispose of surplus weapons-grade plutonium substantially met best practices— providing assurance that the estimated costs could be considered reliable This finding contributed to DOE’s reevaluation of the project and ultimate termination in October 2018 in favor of a potentially less costly disposal approach Fifty-one of our recommendations were open as of December 2018 15 recommendations were made since the last high-risk update in February 2017 DOE continues to meet the criterion of leadership commitment partially meet the criteria for action plan and monitoring and not meet the criterion for capacity See appendix II for additional detail on this high-risk area including more details on actions that need to be taken • Medicare Program Improper Payments In calendar year 2017 Medicare which is overseen by the Centers for Medicare Medicaid Services CMS financed $702 billion worth of health services for approximately 58 million elderly and disabled beneficiaries Medicare faces a significant risk with improper payments—payments that either were made in an incorrect amount or should not have been made at all— which reached an estimated $48 billion in fiscal year 2018 Since our 2017 High-Risk Report estimated improper payment rates declined more than one percent across the Medicare program In addition CMS’ rating for the capacity criterion of the improper payments segment improved from partially met to met in 2019 due to several actions First the Center for Program Integrity’s CPI budget and Page 33 GAO-19-157SP High-Risk Series resources have increased over time and the agency has established work groups and interagency collaborations to extend its capacity For example CMS allocated more staff to CPI after Congress provided additional funding CPI’s full-time equivalent positions increased from 177 in 2011 to 419 in 2017 Additionally in August 2017 we reported that CMS’s Fraud Prevention System which analyzes claims to identify health care providers with suspect billing patterns helped speed up certain fraud investigation processes Further the Healthcare Fraud Prevention Partnership helped improve information sharing among payers inside and outside of the government Since 1990 when we added Medicare to our High-Risk List we have made many recommendations related to the Medicare program 28 of which were made since the last high-risk update in February 2017 As of December 2018 more than 80 recommendations remain open CMS continues to meet the criterion of leadership commitment and to partially meet the remaining three criteria of action plan monitoring and demonstrated progress See appendix II for additional detail on this high-risk area including more details on actions that need to be taken Congressional Action Aided Progress on HighRisk Issues Congress enacted several laws since our last report in February 2017 to help make progress on high-risk issues Table 5 lists selected examples of congressional actions taken on high-risk areas Page 34 GAO-19-157SP High-Risk Series Table 5 Examples of Congressional Actions Taken on High-Risk Areas High-risk area Congressional actions taken How GAO work contributed to Impact on high-risk area congressional actions Department of Defense DOD Approach to Business Transformation Section 901 c of the National Defense Authorization Act NDAA for Fiscal Year 2017 created the position of Chief Management Officer CMO within DOD effective February 1 2018 a The 2016 passage of the NDAA is consistent with our February 2005 report in which we identified the need for DOD to have a full-time CMO position created through legislation with responsibility authority and accountability for DOD’s overall business transformation efforts Based on congressional direction DOD established and is beginning to restructure its CMO office to fulfill its responsibilities given by Congress Continued leadership commitment at the highest levels will help sustain focus on this business transformation The longer this critical position is filled by someone in an acting capacity the greater the risk that DOD’s transformation efforts could be impacted Leadership commitment Improving the Management of Information Technology IT Acquisitions and Operations Subtitle G of title X of the NDAA for Fiscal Year 2018 established a Technology Modernization Fund and Board and allowed agencies to establish agency information technology system modernization and working capital funds b We identified the need to better manage the billions of dollars the federal government spends annually on legacy IT when we added this area to the High-Risk List in 2015 We further examined the government’s heavy reliance on legacy IT systems in our 2016 report These provisions 1 allowed agencies to establish working capital funds for use in transitioning away from legacy IT systems and 2 created a technology modernization fund to help agencies retire and replace legacy systems as well as acquire or develop new systems Capacity Government-wide Personnel Security Clearance Process Section 925 k of the NDAA for Fiscal Year 2018 requires the Director of National Intelligence in coordination with the Chair and other principals of the Suitability Security and Credentialing Performance Accountability Council to provide an annual assessment of any impediments to the timely processing of personnel security clearances c The 2017 passage of the NDAA is consistent with our December 2017 report in which we asked Congress to consider both reinstating and adding to the requirement in the Intelligence Reform and Terrorism Prevention Act of 2004 for the executive branch to report to appropriate congressional committees annually on its background investigation process Annual assessments will help Congress monitor the timeliness of the executive branch’s background investigations to monitor its own timeliness The act requires the executive branch to report the length of time for initiating and conducting investigations and finalizing adjudications and case load composition and costs among other matters deemed relevant by Congress Monitoring Page 35 GAO-19-157SP High-Risk Series High-risk area Congressional actions taken How GAO work contributed to Impact on high-risk area congressional actions Mitigating Gaps in Weather Satellite Data Provisions of the NDAA for Fiscal Year 2015 limited the availability of certain funds until the Secretary of Defense submitted to congressional defense committees a plan related to weather satellites d Similarly the NDAA for Fiscal Year 2016 limited the availability of certain funds until 1 the Secretary of Defense briefed the congressional defense committees on a plan for cloud characterization and theater weather imagery and 2 the Chairman of the Joint Chiefs of Staff certified to the committees that the plan would meet DOD requirements without negatively affecting commanders of combatant commands e We found that DOD was slow to establish plans for its Weather System Follow-on–Microwave program in our 2017 High-Risk Report We also found it had made little progress in determining how it would meet weather satellite requirements for cloud descriptions and areaspecific weather imagery These provisions 1 encouraged DOD to develop and implement plans to address its weather satellite requirements and 2 helped Congress monitor DOD plans and actions to address these requirements Action plan Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks Section 1234 a 5 of the Disaster Recovery Reform Act of 2018 allows the President to set aside with respect to each major disaster a percentage of certain grants to use for pre-disaster hazard mitigation Section 1206 a 3 makes federal assistance available to state and local governments for building code administration and enforcement f We found that federal investments in resilience could be more effective if postdisaster hazard mitigation efforts were balanced with resources for pre-disaster hazard mitigation as part of a comprehensive resilience investment strategy We also found that enhancing state and local disaster resilience could help reduce federal fiscal exposure These provisions could improve state and local resilience to disasters by increasing the amount of funding available for pre-disaster hazard mitigation and increasing state and local adoption and enforcement of the latest building codes Capacity Ensuring the Cybersecurity of the Nation An explanatory statement accompanying the Consolidated Appropriations Act 2018 directed the National Protection and Programs Directorate to brief the appropriations committees on its specific plans to address GAO recommendations including the National Cybersecurity and Communications Integration Center’s NCCIC implementation of the recommendations for ensuring that it fulfills its statutory functions such as sharing information about cyber threats by timely reporting information that is relevant and actionable and establishing appropriate performance metrics g We reported that NCCIC had taken steps to perform each of the Department of Homeland Security’s DHS statutorily required cybersecurity functions However the extent to which NCCIC performed the actions was unclear in part because the center had not yet established metrics and methods by which to evaluate its performance As of January 2019 DHS had fully addressed two of the nine recommendations we made to enhance the effectiveness and efficiency of NCCIC and had taken initial actions toward addressing several others Demonstrated progress Page 36 GAO-19-157SP High-Risk Series High-risk area Congressional actions taken How GAO work contributed to Impact on high-risk area congressional actions Managing Risks and Improving VA Health Care The No Veterans Crisis Line Call Should Go Unanswered Act directs the Department of Veterans Affairs VA to develop a quality assurance document for carrying out the toll-free Veterans Crisis Line and requires VA to develop a plan to ensure that each telephone call text message and other communication received is answered in a timely manner h About 6 months prior to the passage of this legislation our May 2016 report identified the need for VA to take several steps to better test track and assess the performance of the Veterans Crisis Line in order to improve the timeliness and quality of its responses to veterans and others In July 2017 VA updated a quality assurance plan with measurable targets and time frames for key performance indicators needed to assess Veterans Crisis Line performance VA also established an Executive Leadership Council in March 2017 to monitor data on the key performance indicators These two actions will assist with the oversight and accountability of the Veterans Crisis Line and the services provided to veterans Leadership commitment Action plan and Monitoring Improving Federal Management of Programs that Serve Tribes and Their Members An explanatory statement accompanying the Consolidated Appropriations Act 2018 directed the Indian Health Service IHS to report to the appropriations committees on the status of its efforts on improving wait times for patients seeking primary and urgent care including an explanation of how these efforts will address GAO recommendations i We found that IHS had not conducted any systematic agency-wide oversight of the timeliness of primary care in its federally operated facilities and recommended that IHS communicate specific agencywide standards for patient wait times monitor patient wait times and ensure corrective actions are taken when standards are not met IHS developed specific standards for patient wait times and developed a plan and timeline for implementing an agency-wide standard for patient wait times It is also in the process of updating its patient wait time policy to include emergency department wait times and developing automated data collection for wait times Leadership commitment Action plan Monitoring Source GAO analysis GAO-19-157SP a Pub L No 114-328 § 901 c 130 Stat 2000 2341 2016 b Pub L No 115-91 §§ 1076–1078 131 Stat 1283 1586–1594 2017 c Pub L No 115-91 § 925 k 1 F 3 I 131 Stat 1283 1530 1532 2017 d Carl Levin and Howard P “Buck” McKeon National Defense Authorization Act for Fiscal Year 2015 Pub L No 113-291 § 1612 128 Stat 3292 3628 2014 e National Defense Authorization Act for Fiscal Year 2016 Pub L No 114-92 § 1615 129 Stat 726 1105 2015 f FAA Reauthorization Act of 2018 Pub L No 115-254 div D §§ 1206 a 3 1234 a 5 132 Stat 3186 3440 3462 2018 g Chairman Rodney P Frelinghuysen of the Committee on Appropriations of the House of Representatives filed an explanatory statement relating to the House amendment of H R 1625 in the Congressional Record on March 22 2016 164 Cong Rec H2045 H2557 Section 4 of the Consolidated Appropriations Act 2018 states that this explanatory statement shall have the same effect with respect to the allocation of funds and implementation of divisions A through L of the act as if it were a joint explanatory statement of a committee of conference Pub L No 115-141 § 4 132 Stat 348 350 2018 h Pub L No 114-247 130 Stat 996 2016 Page 37 GAO-19-157SP High-Risk Series i Chairman Rodney P Frelinghuysen of the Committee on Appropriations of the House of Representatives filed an explanatory statement relating to the House amendment of H R 1625 in the Congressional Record on March 22 2016 164 Cong Rec H2045 H2628 Section 4 of the Consolidated Appropriations Act 2018 states that this explanatory statement shall have the same effect with respect to the allocation of funds and implementation of divisions A through L of the act as if it were a joint explanatory statement of a committee of conference Pub L No 115-141 § 4 132 Stat 348 350 2018 Congressional oversight also plays a vital role in addressing high-risk issues For example at a May 2018 hearing we testified that the Census Bureau’s Bureau cost estimate was not reliable and that the actual cost could be higher than planned 7 Further the Secretary of Commerce created a dedicated team to provide oversight and guidance to the Bureau on cost estimation In addition to its instrumental role in supporting progress in individual high-risk areas Congress also enacted the following statutes that if implemented effectively will help foster progress on high-risk issues government-wide • Fraud Reduction and Data Analytics Act of 2015 FRDAA 8 FRDAA is intended to strengthen federal antifraud controls FRDAA requires OMB to use our Fraud Risk Framework 9 to create guidelines for federal agencies to identify and assess fraud risks and then design and implement control activities to prevent detect and respond to fraud Agencies as part of their annual financial reports beginning in fiscal year 2017 are further required to report on their fraud risks and their implementation of fraud reduction strategies which should help Congress monitor agencies’ progress in addressing and reducing fraud risks To aid federal agencies in better analyzing fraud risks FRDAA requires OMB to establish a working group tasked with developing a plan for creating an interagency library of data analytics and data sets to facilitate the detection of fraud and the recovery of improper payments This working group and the library should help agencies coordinate their fraud detection efforts and improve their ability to use data analytics to monitor databases for potential improper payments The billions of dollars in improper payments some of which may be a result of fraud are a central 7 GAO 2020 Census Actions Needed to Mitigate Key Risks Jeopardizing a Cost-Effective and Secure Enumeration GAO-18-543T May 8 2018 8 Pub L No 114-186 130 Stat 546 2016 9 GAO A Framework for Managing Fraud Risks in Federal Programs GAO-15-593SP Washington D C July 2015 Page 38 GAO-19-157SP High-Risk Series part of the Medicare Program Medicaid Program and Enforcement of Tax Laws Earned Income Tax Credit high-risk areas We reported in 2018 that among other things OMB did not involve all agencies subject to the act as required by FRDAA or hold the required minimum number of working-group meetings in 2017 10 As shown in figure 4 a majority of the 72 agencies surveyed indicated a lack of involvement with and information from the working group as challenges in implementing FRDAA We made three recommendations including that OMB ensure the working group meets FRDAA’s requirements to involve all agencies that are subject to the act and ensure that mechanisms to share controls best practices and data-analytics techniques are in place OMB did not concur with our recommendations We continue to believe the recommendations are valid as discussed in the 2018 report Figure 4 Percentage of Agencies That Identified Their Involvement with the Fraud Reduction and Data Analytics Act of 2015 Working Group as a Great or Moderate Challenge 10 GAO Fraud Risk Management OMB Should Improve Guidelines and Working-Group Efforts to Support Agencies’ Implementation of the Fraud Reduction and Data Analytics Act GAO-19-34 Washington D C December 4 2018 Page 39 GAO-19-157SP High-Risk Series • IT Acquisition Reform statutory provisions known as the Federal Information Technology Acquisition Reform Act FITARA 11 FITARA enacted in December 2014 was intended to improve how agencies acquire IT and better enable Congress to monitor agencies’ progress in reducing duplication and achieving cost savings Since the enactment of these provisions OMB and federal agencies have paid greater attention to IT acquisition and operation resulting in improvements to the government-wide management of this significant annual investment These efforts have been motivated in part by sustained congressional support for improving implementation of this law as highlighted in agencies’ FITARA implementation scores issued biannually by the House Committee on Oversight and Reform This continuing oversight has produced positive results For example in the committee’s December 2018 FITARA implementation scorecard 18 of the 24 major federal agencies received the highest possible rating for their efforts to improve the management of software licenses of which we have found there are thousands annually across the government Seven months earlier in the prior scorecard only eight agencies had achieved this rating Moreover federal agencies have taken actions to address 106 of the 136 related recommendations that we have made in this area since 2014 FITARA includes specific requirements related to seven areas the federal data center consolidation initiative enhanced transparency and improved risk management agency Chief Information Officer authority enhancements portfolio review expansion of training and use of IT acquisition cadres government-wide software purchasing and maximizing the benefit of the federal strategic sourcing initiative In November 2017 Congress extended or removed the sunset dates of several of these statutory requirements that were originally to end in 2018 and 2019 12 While all of the 24 federal agencies covered by this law have developed FITARA implementation plans the agencies need to effectively execute these plans Successfully addressing FITARA requirements is central to making progress in Improving the Management of IT Acquisitions and Operations which has been on our High-Risk List since 2015 11 FITARA was enacted into law as part of the Carl Levin and Howard P “Buck” McKeon National Defense Authorization Act for Fiscal Year 2015 Pub L No 113-291 2014 div A title VIII subtitle D §§ 831-837 128 Stat 3292 3438-3450 12 FITARA Enhancement Act of 2017 Pub L No 115-88 131 Stat 1278 2017 Page 40 GAO-19-157SP High-Risk Series • Program Management Improvement Accountability Act PMIAA 13 Enacted in December 2016 the act is intended to improve program and project management in certain larger federal agencies Among other things the act requires the Deputy Director for Management of OMB to adopt and oversee implementation of government-wide standards policies and guidelines for program and project management in executive agencies The act also requires the Deputy Director to conduct portfolio reviews to address programs we identify as high-risk It further creates a Program Management Policy Council to act as the principal interagency forum for improving practices related to program and project management The council is to review programs identified as high-risk and make recommendations to the Deputy Director or designee OMB has produced a general strategy for implementing the law through 2022 and met some initial milestones required by PMIAA For example in June 2018 OMB issued OMB Memorandum M-18-19 which includes 1 agency guidance for implementing PMIAA 2 a five-year strategic outline for improving program and project management and 3 initial program management standards and principles 14 Further agencies have designated Program Management Improvement Officers to guide their implementation of PMIAA According to OMB it began implementing PMIAA’s requirement to conduct portfolio reviews on high-risk areas by requiring relevant agencies to provide several items for discussion during the 2018 Strategic Review meetings These annual meetings are to consist primarily of a discussion of agency progress towards each of the strategic objectives outlined in their strategic plans but also cover other management topics such as enterprise risk management and high-risk area progress According to OMB documents in advance of these meetings OMB required agencies to provide a high-level summary of 1 any disagreements with our recommendations 2 progress barriers and 3 actions needed by OMB other agencies or Congress to help the agency achieve progress towards removal from our High-Risk List OMB officials told us their 2018 Strategic Review meetings did not address each high-risk area but did address government-wide high-risk areas such as cybersecurity information technology and strategic human capital as they related to the President’s Management Agenda 13 Pub L No 114-264 130 Stat 1371 2016 14 Office of Management and Budget Improving the Management of Federal Programs and Projects through Implementing the Program Management Improvement Accountability Act PMIAA OMB Memorandum M-18-19 Washington D C June 25 2018 Page 41 GAO-19-157SP High-Risk Series In the past senior management officials from OMB applicable agencies and our agency have met to address areas where additional management attention could be beneficial to high-risk issues These trilateral meetings beginning in 2007 and pre-dating PMIAA’s 2016 enactment have continued across administrations However OMB has organized only one of these high-risk meetings since the last high-risk update in 2017 on the Government-wide Personnel Security Clearance Process In November 2018 OMB told us of plans to hold additional meetings on priority high-risk areas including the 2020 Decennial Census Strategic Human Capital Management Ensuring the Cybersecurity of the Nation National Aeronautics and Space Administration NASA Acquisition Management and Managing Federal Real Property Effective implementation of PMIAA provides an important opportunity to enhance progress on high-risk areas by focusing leadership attention through the portfolio reviews and trilateral meetings Further a number of high-risk areas have longstanding or significant program and project management concerns including the acquisition-related high-risk areas for DOD DOE NASA and VA These and other programs can benefit from improving program and project management In December 2019 we will report on OMB’s progress in implementing PMIAA including what further steps it has taken to use the portfolio review process required in PMIAA to address issues on our High-Risk List Executive Branch Action on Our Recommendations Aided Progress on HighRisk Issues Agency leaders took actions to implement our recommendations These resulted in numerous improvements to programs and operation and improved service Further these actions to implement our recommendations resulted in significant financial benefits Table 6 shows some examples of the financial benefits achieved since our last High-Risk Report Page 42 GAO-19-157SP High-Risk Series Table 6 Examples of GAO High-Risk Area Recommendations Leading to Financial Benefits High-risk area GAO recommendations leading to financial benefits Financial benefits achieved Strengthening Medicaid Program Integrity In multiple reports we found that demonstration spending limits approved by the Department of Health and Human Services HHS often were not budget neutral as required by HHS policy This increased the federal government’s fiscal liability by billions of dollars We recommended that HHS better ensure that valid methods are used to determine spending limits HHS responded by limiting the amount of unspent funds states may accrue and reducing the federal government’s fiscal liability As a result the Centers for Medicare Medicaid Services was able to identify a total of $23 5 billion in financial benefits for fiscal year FY 2017 Improving the Management of Information Technology IT Acquisitions and Operations In multiple reports we made recommendations for improving the management of IT portfolios which resulted in reduced agency commodity IT spending and fewer duplicative investments Agencies have achieved about $2 5 billion in savings from fiscal years 2012 to 2017 through the Office of Management and Budget’s PortfolioStat that was intended to consolidate and eliminate duplicative systems Agencies have the potential to achieve about $3 5 billion in additional savings Resolving the Federal Role in Housing Finance In June 2013 we recommended actions for the Federal Housing Administration FHA to increase returns on sales of foreclosed properties with FHAinsured mortgages FHA’s actions in response to our recommendations improved its returns and led to financial benefits totaling about $1 3 billion in 2017 Medicare Program Improper Payments In December 2015 we recommended that Congress consider directing the Secretary of HHS to equalize payment rates between physician offices and hospital outpatient departments for evaluation and management services and to return the associated savings to the Medicare program This change in reimbursement resulted in estimated cost savings to the program of $1 6 billion in FYs 2017 and 2018 and will result in additional savings going forward Enforcement of Tax Laws In June 2015 we expressed concerns to Internal Revenue Service IRS officials about fraudsters potentially using taxpayer account information stolen in the 2014 and 2015 “Get Transcript” online service data breach to file multiple fraudulent returns and receive refunds In response IRS changed its authentication and monitoring procedures for accounts affected by the breach As a result of our suggestion and the new authentication procedures in August 2017 we found that IRS prevented paying a total of $480 2 million in fraudulent refunds in FYs 2015 and 2016 In 2018 we found that IRS prevented an additional $110 million in FY 2017 National Flood Insurance Program Staff from the Federal Emergency Management Administration FEMA identified a number of actions that the agency has taken or has underway to address issues we raised related to its rate-setting methods in June 2011 In response to a congressional matter we made congressional staff notified us that Congress passed the Biggert-Waters Flood Insurance Reform Act of 2012 which eliminated or phased out subsidized premium rates for several types of properties As a result of changes FEMA has made in rates for certain subsidized properties we estimate that policyholders with these subsidized premiums paid $338 4 million net present value more in premiums as of the end of FY 2017 than they would have paid prior to the enactment of the Biggert-Waters Act Source GAO analysis GAO-19-157SP Page 43 GAO-19-157SP High-Risk Series Enterprise Risk Management Can Help Agencies Address HighRisk Challenges Successful outcomes in highly uncertain environments require leadership and commitment to managing risks and other complex outcomes Enterprise Risk Management ERM is the practice of identifying and managing risks that cover an entire organization including how risks interact as an interrelated portfolio To help ensure that agencies are effectively managing risks that could affect the achievement of agency strategic objectives OMB added ERM in its Circular A-11 on budget preparation in July 2014 and its Circular A-123 on agencies’ responsibility for ERM and Internal Control in July 2016 In the spring of 2018 agencies were to follow the OMB guidance to profile their top risks as part of the discussion in OMB’s required Strategic Review meetings To further assist agencies in managing their risks in December 2016 we identified six essential elements of ERM—along with agency good practices—that federal leaders can use to implement and sustain an effective risk management program 15 The consistent and regular use of ERM can help agency leaders identify and manage risks including highrisk issues Figure 5 shows the six essential elements we identified 15 GAO Enterprise Risk Management Selected Agencies' Experiences Illustrate Good Practices in Managing Risk GAO-17-63 Washington D C December 1 2016 Page 44 GAO-19-157SP High-Risk Series Figure 5 Essential Elements of Federal Government Enterprise Risk Management High-Risk Areas Needing Significant Attention In the 2 years since our last High-Risk Report three areas—NASA Acquisition Management Transforming EPA's Process for Assessing and Controlling Toxic Chemicals and Limiting the Federal Government's Fiscal Exposure By Better Managing Climate Change Risks—have regressed in their ratings against our criteria for removal from the HighRisk List In addition while progress is needed across all high-risk areas we have identified nine additional areas that require significant attention to address imminent longstanding or particularly broad issues affecting the nation Page 45 GAO-19-157SP High-Risk Series Three High-Risk Areas That Regressed NASA plans to invest billions of dollars in the coming years to explore space improve its understanding of the Earth’s environment and conduct aeronautics research among other things We designated NASA’s acquisition management as high risk in 1990 in view of NASA’s history of persistent cost growth and schedule delays in the majority of its major projects NASA Acquisition Management Following several years of continuing a generally positive trend of limiting cost growth and schedule delays for its portfolio of major projects we found that NASA’s average launch delay increased from 7 to 12 months between May 2017 and May 2018 Further the overall development cost growth increased from 15 6 percent to at least 18 8 percent over the same time period NASA’s largest science project the James Webb Space Telescope has experienced schedule delays of 81 months and cost growth of 95 percent since the project’s cost and schedule baseline was first established in 2009 NASA is at risk for continued cost growth and schedule delays in its portfolio of major projects Since our 2017 high-risk update we have lowered NASA acquisition management from meeting the rating to partially meeting the rating in two criteria—leadership commitment and monitoring The other three criteria ratings remained the same as in 2017 Ratings for capacity and demonstrated progress remain partially met and the rating for action plan remains met Over the next several years NASA plans to add new large and complex projects to the portfolio including a lunar Gateway—currently being discussed as a platform in a lunar orbit to mature deep space exploration capabilities In addition many of NASA’s current major projects including some of the most expensive ones are in the phase of their life cycles when cost growth and schedule delays are most likely NASA acquisition management requires significant attention for the following reasons • NASA leadership has approved risky programmatic decisions for complex major projects which compounded technical challenges For example leadership has approved some programs to proceed 1 with low cost and schedule reserves 2 with overly aggressive schedules Page 46 GAO-19-157SP High-Risk Series and 3 without following best practices for establishing reliable cost and schedule baselines • NASA leadership has also not been transparent about cost and schedule estimates for some of its most expensive projects Without transparency into these estimates both NASA and Congress have limited data to inform decision making • NASA has not yet instituted a program for monitoring and independently validating the effectiveness and sustainability of the corrective action measures in its new action plan which NASA finalized in December 2018 In addition while NASA has taken some steps to build capacity to help reduce acquisition risk including updating tools aimed at improving cost and schedule estimates other areas still require attention For example we reported in May 2018 that several major NASA projects experienced workforce challenges including not having enough staff or staff with the right skills NASA has also identified capability gaps in areas such as scheduling earned value management and cost estimating and has efforts underway to try to improve capacity in these areas Since 2017 we have made 9 recommendations on this high-risk area and as of December 2018 15 recommendations remain open These recommendations include that NASA needs to improve transparency of major project cost and schedule estimates especially for its human spaceflight programs as well as continue to build capacity to reduce acquisition risk NASA will also need to implement its new action plan and track progress against it See appendix II for additional detail on this highrisk area including more details on actions that need to be taken Transforming EPA's Process for Assessing and Controlling Toxic Chemicals The Environmental Protection Agency’s EPA’s ability to effectively implement its mission of protecting public health and the environment is dependent on it assessing the risks posed by chemicals in a credible and timely manner Such assessments are the cornerstone of scientifically sound environmental decisions policies and regulations under a variety of statutes Based on our work since our 2017 High-Risk Report the overall rating for leadership commitment decreased from met to partially met due to limited information for completing chemical assessments and proposed budget cuts in the Integrated Risk Information System IRIS Program The ratings for the remaining four criteria remain unchanged and are partially met Page 47 GAO-19-157SP High-Risk Series The EPA Acting Administrator indicated his commitment to fulfill the agency’s obligations under the Toxic Substances Control Act TSCA as amended by the 2016 Frank R Lautenberg Chemical Safety for the 21 Century Act Lautenberg Act and ensure chemicals in the marketplace are safe for human health and the environment Nonetheless EPA needs to give more attention to several areas to fully realize the benefits of the new law and to demonstrate additional progress in the IRIS Program such as • While EPA released a document in late December 2018 called the IRIS Program Outlook the Outlook fails to list the projected date for most of the assessments and includes no information regarding assessment prioritization—including how these assessments will meet program and regional office needs • The Lautenberg Act increases both EPA’s responsibility for regulating chemicals and its workload EPA recently issued a rule under the act to collect fees from certain companies to defray a portion of the implementation costs but it is unclear whether the fees collected will be sufficient to support relevant parts of the program • EPA issued a First Year Implementation Plan in June 2016 noting that this document is intended to be a roadmap of major activities EPA will focus on during the initial year of implementation As of mid-February 2019 the plan has not been updated according to publically available information although EPA had indicated that it is a living document that will be further developed over time EPA needs to ensure that the people and resources dedicated to the IRIS Program and TSCA implementation are sufficient Our March 2019 report on chemical assessments provides information on what remains to be done to address challenges in the IRIS program and implement the Lautenberg Act 16 Since we added this area to our High-Risk List in 2009 we have made 12 recommendations to EPA related to IRIS and TSCA As of February 2019 seven recommendations remain open See appendix II for additional detail on this high-risk area including actions that need to be taken 16 GAO Chemical Assessments Status of EPA’s Efforts to Produce Assessments and Implement the Toxic Substances Control Act GAO-19-270 Washington D C March 4 2019 Page 48 GAO-19-157SP High-Risk Series Limiting the Federal Government's Fiscal Exposure by Better Managing Climate Change Risks Numerous studies have concluded that climate change poses risks to many environmental and economic systems and creates a significant fiscal risk to the federal government The rising number of natural disasters and increasing reliance on the federal government for assistance is a key source of federal fiscal exposure As of December 2018 total federal funding for disaster assistance since 2005 is approaching half a trillion dollars about $430 billion most recently for catastrophic hurricanes flooding wildfires and other losses in 2017 and 2018 The costliness of disasters is projected to increase as extreme weather events become more frequent and intense due to climate change There are five areas where government-wide action is needed to reduce federal fiscal exposure including but not limited to the federal government’s role as 1 the insurer of property and crops 2 the provider of disaster aid 3 the owner or operator of infrastructure 4 the leader of a strategic plan that coordinates federal efforts and informs state local and private-sector action and 5 the provider of data and technical assistance to decision makers Neither global efforts to mitigate climate change causes nor regional adaptation efforts currently approach the scales needed to avoid substantial damages to the U S economy environment and human health over the coming decades according to the November 2018 Fourth National Climate Assessment Government-wide action is needed to improve the nation’s resilience to natural hazards and reduce federal fiscal exposure to climate change impacts Congress continues to show its commitment to progress on this high-risk issue by enacting legislation such as the National Defense Authorization Act of 2018 which among other things required DOD to report on climate impacts to its installations 17 However the federal government has not made measurable progress since 2017 to reduce its fiscal exposure to climate change and in some cases has revoked prior policies designed to do so Specifically since 2017 the ratings for four criteria remain unchanged—three at partially met and one at not met The rating for one criterion—monitoring—regressed to not met Limiting the federal government’s fiscal exposure to climate change requires significant attention because the federal government has revoked prior policies that had partially addressed this high-risk area and has not implemented several of our recommendations that could help 17 Pub L No 115-91 § 335 131 Stat 1283 1357 2017 Page 49 GAO-19-157SP High-Risk Series reduce federal fiscal exposure For example since our 2017 high-risk update the federal government • revoked Executive Order 13690 which had established a governmentwide federal flood risk management standard to improve the resilience of communities and federal assets against the impacts of flooding This action could increase federal fiscal exposure as taxpayer-funded projects may not last as long as intended because they are not required to account for future changes in climate-related risk • rescinded its guidance directing agencies to consider climate change in their National Environmental Policy Act of 1969 reviews for certain types of federal projects • has not implemented our July 2015 recommendation to establish a comprehensive investment strategy identifying prioritizing and implementing federal disaster resilience investments that could reduce federal fiscal exposure to climate change • has not implemented our November 2015 recommendations to create a national climate information system providing authoritative accessible information useful for state local and private-sector decision making We have made 62 recommendations related to this high-risk area 12 of which were made since our February 2017 high-risk update As of December 2018 25 remain open The federal government needs a cohesive strategic approach with strong leadership and the authority to manage climate change risks across the entire range of federal activities See appendix II for additional detail on this high-risk area including actions that need to be taken Additional High-Risk Areas That Need Significant Attention Ensuring the Cybersecurity of the Nation Federal agencies and the nation’s critical infrastructures—such as energy transportation systems communications and financial services— are dependent on information technology systems to carry out operations The security of these systems and the data they use is vital to public confidence and national security prosperity and well-being The risks to systems underpinning the nation’s critical infrastructure are increasing as security threats evolve and become more sophisticated Page 50 GAO-19-157SP High-Risk Series We first designated information security as a government-wide high-risk area in 1997 This was expanded to include protecting cyber critical infrastructure in 2003 and protecting the privacy of personally identifiable information in 2015 In 2018 we updated this high-risk area to reflect the lack of a comprehensive cybersecurity strategy for the federal government Since 2010 we have made over 3 000 recommendations to agencies aimed at addressing cybersecurity shortcomings including protecting cyber critical infrastructure managing the cybersecurity workforce and responding to cybersecurity incidents Of those 3 000 recommendations 448 were made since our last high-risk update in February 2017 Although many recommendations have been addressed about 700 have not yet been implemented Despite the number of unimplemented recommendations since our 2017 High-Risk Report the administration has made progress in this high-risk area as it continues to meet the leadership commitment criterion through various actions These include the President issuing 1 an executive order in May 2017 requiring federal agencies to take a variety of actions including better managing their cybersecurity risks and coordinating to meet reporting requirements related to cybersecurity of federal networks and critical infrastructure 18 and 2 a National Security Strategy in December 2017 citing cybersecurity as a national priority and identifying needed actions Further the administration issued a government-wide reform plan and reorganization recommendations in June 2018 with among other things proposals for solving the federal cybersecurity workforce shortage Additionally the administration released a National Cyber Strategy in September 2018 outlining activities such as securing critical infrastructure federal networks and associated information However additional actions are needed We have identified four major cybersecurity challenges facing the nation 1 establishing a comprehensive cybersecurity strategy and performing effective oversight 2 securing federal systems and information 3 protecting cyber critical infrastructure and 4 protecting privacy and sensitive data To address the four major cybersecurity challenges we identified 10 critical actions the federal government and other entities need to take These critical actions include for example developing and executing a more 18 Executive Order 13 800 82 Fed Reg 22 391 May 16 2017 Page 51 GAO-19-157SP High-Risk Series comprehensive federal strategy for national cybersecurity and global cyberspace addressing cybersecurity workforce management challenges and strengthening the federal role in protecting the cybersecurity of critical infrastructure see figure 6 Page 52 GAO-19-157SP High-Risk Series Figure 6 Ten Critical Actions Needed to Address Four Major Cybersecurity Challenges Page 53 GAO-19-157SP High-Risk Series Until these shortcomings are addressed federal agencies’ information and systems will be increasingly susceptible to the multitude of cyberrelated threats that exist See appendix II for additional detail on this highrisk area including more details on actions that need to be taken Resolving the Federal Role in Housing Finance The expanded federal role in housing finance that began during the 2007–2009 financial crisis has substantially increased the government’s exposure to potential mortgage losses Federally supported mortgages include those backed by the Federal National Mortgage Association Fannie Mae and the Federal Home Loan Mortgage Corporation Freddie Mac —collectively the enterprises—which the Federal Housing Finance Agency FHFA placed into government conservatorships in 2008 Federal support also occurs through Federal Housing Administration FHA mortgage insurance and Government National Mortgage Association Ginnie Mae guarantees on mortgage-backed securities The substantial financial assistance the enterprises required during and after the crisis coupled with the large fiscal exposure they and other federal mortgage entities represent today underscore the need to reform the federal role in housing finance Delay in resolving the federal role in housing finance poses considerable risks Through the enterprises FHA and Ginnie Mae the federal government is exposed to potential losses on several trillion dollars in mortgage debt A severe economic downturn could trigger significant taxpayer assistance to one or more of these entities Congress and federal agencies have taken some steps to facilitate the transition to a revised federal role such as holding hearings introducing legislation issuing regulations and developing market monitoring tools For example in 2013 and 2014 housing and regulatory agencies finalized rules designed to prevent a recurrence of risky practices in originating and securing mortgages that contributed to the financial crisis Additionally FHFA and the Consumer Financial Protection Bureau have developed a representative database of mortgage information that could be useful for examining the effect of mortgage market reforms However overall progress on resolving the federal role will be difficult to achieve until Congress provides further direction by enacting changes to the housing finance system Several issues contribute to the risks facing federal housing finance including the following Page 54 GAO-19-157SP High-Risk Series • More than 10 years after entering federal conservatorships the enterprises’ futures remain uncertain and billions of taxpayer dollars remain at risk Under agreements with the Department of the Treasury Treasury the enterprises have received $191 4 billion in capital support as of the end of fiscal year 2018 and have paid dividends to the department exceeding that amount If they were to incur major additional losses they would draw required amounts from their remaining $254 1 billion in Treasury commitments In addition prolonged conservatorships could hinder development of the broader mortgage securities market by creating uncertainty and crowding out private investment • Nonbanks lenders and loan servicers that are not depository institutions have played an increasingly large role in the mortgage market in recent years While nonbanks have helped provide access to mortgage credit they also may pose additional risks in part because they are not federally regulated for safety and soundness However FHFA lacks statutory authority to examine nonbank mortgage servicers and other third parties who do business with and pose potential risks to the enterprises • The statutory 2 percent capital requirement for FHA’s $1 26 trillion mortgage insurance fund is not based on a specified risk threshold such as the economic conditions the fund would be expected to withstand As a result it may not provide an adequate financial cushion under scenarios in which Congress may anticipate the fund would be selfsufficient During the last housing downturn the fund’s capital ratio fell below the required level and remained there for 6 consecutive years At the end of fiscal year 2013 the fund required supplemental funds—about $1 7 billion—for the first time in its history Six of our federal housing recommendations remain open including those we made in June 2015 on assessing the effects of mortgage reforms already in place Further as we previously recommended in November 2016 and January 2019 Congress should consider housing finance reform legislation that • establishes objectives for the future federal role in housing finance including the role and structure of the enterprises within the housing finance system • provides a transition plan to a reformed system that enables the enterprises to exit federal conservatorship and • addresses all relevant federal entities including FHA and Ginnie Mae As we recommended in March 2016 and November 2017 respectively Congress also should consider granting FHFA explicit authority to Page 55 GAO-19-157SP High-Risk Series examine nonbank servicers and other third parties that do business with the enterprises and specifying the economic conditions FHA’s insurance fund would be expected to withstand without a substantial risk of requiring supplemental funds See appendix II for additional detail on this high-risk area including more details on actions that need to be taken Due to the significance and risk associated with Resolving the Federal Role in Housing Finance we are separating it from the high-risk area of Modernizing the U S Financial Regulatory System These areas were combined in our 2017 High-Risk report Pension Benefit Guaranty Corporation Insurance Programs The Pension Benefit Guaranty Corporation PBGC is responsible for insuring the defined benefit pension plans for nearly 37 million American workers and retirees who participate in about 24 800 private sector plans PBGC faces an uncertain financial future due in part to a longterm decline in the number of traditional defined benefit plans and the collective financial risk of the many underfunded pension plans that PBGC insures PBGC’s financial portfolio is one of the largest of all federal government corporations While PBGC’s single employer program had a net surplus of about $2 4 billion at the end of fiscal year 2018 its multiemployer program had a net deficit of about $54 billion—or a combined net accumulated financial deficit of over $51 billion Its deficit has increased by nearly 45 percent since fiscal year 2013 PBGC has estimated that without additional funding its multiemployer insurance program will likely be exhausted by 2025 as a result of current and projected pension plan insolvencies The agency’s single-employer insurance program is also at risk due to the continuing decline of traditional defined benefit pension plans as well as premiums that are not well aligned to the financial risk presented by the plans it insures While Congress and PBGC have taken significant and positive steps to strengthen the agency in the past 5 years challenges related to PBGC’s funding and governance structure remain Congress established a temporary Joint Select Committee on multiemployer pension plans in 2018—with the goal of improving the solvency of the multiemployer program However the committee did not release draft legislation Addressing the significant financial risk and governance challenges that PBGC faces will require additional congressional action Over the years since we added PBGC to the High-Risk List we have suggested a number of matters for congressional consideration Page 56 GAO-19-157SP High-Risk Series including 1 authorizing a redesign of PBGC’s single employer program premium structure to better align premium rates with sponsor risk 2 adopting additional changes to PBGC’s governance structure—in particular expanding the composition of its board of directors 3 strengthening funding requirements for plan sponsors as appropriate given national economic conditions 4 working with PBGC to develop a strategy for funding PBGC claims over the long term as the defined benefit pension system continues to decline and 5 enacting additional structural reforms to reinforce and stabilize the multiemployer system and balance the needs and potential sacrifices of contributing employers participants and the federal government Absent additional steps to improve PBGC’s finances the long-term financial stability of the agency remains uncertain and the retirement benefits of millions of American workers and retirees could be at risk of dramatic reductions See appendix II for additional detail on this high-risk area including more details on actions that need to be taken Managing Risks and Improving VA Health Care VA operates one of the largest health care delivery systems in the nation through its Veterans Health Administration VHA with 172 medical centers and more than 1 000 outpatient facilities organized into regional networks VA has faced a growing demand by veterans for its health care services—due in part to the needs of an aging veteran population—and that trend is expected to continue The total number of veterans enrolled in VA’s health care system rose from 7 9 million to more than 9 million from fiscal year 2006 through fiscal year 2017 Over that same period VHA’s total budgetary resources have more than doubled from $37 8 billion in fiscal year 2006 to $92 3 billion in fiscal year 2017 Given the importance of VHA’s mission coupled with its lack of progress in addressing its high-risk designation we continue to be concerned about VHA’s ability to ensure its resources are being used effectively and efficiently to improve veterans’ timely access to safe and high-quality health care We have identified five areas of concern 1 ambiguous policies and inconsistent processes 2 inadequate oversight and accountability 3 IT challenges 4 inadequate training for VA staff and 5 unclear resource needs and allocation priorities VHA has begun to address each of these areas but prior to Secretary Robert Wilkie’s July 2018 confirmation its efforts were impeded by leadership instability Since taking office Secretary Wilkie has demonstrated his commitment to addressing the department’s high-risk designation by among other things creating an office to direct an integrated focused high-risk Page 57 GAO-19-157SP High-Risk Series approach and communicating to VA leaders the importance of addressing our recommendations While VHA completed root cause analyses for each area of concern and developed an action plan in response the plan lacks milestones and metrics needed to effectively monitor its implementation and demonstrate progress made in addressing the high-risk designation Additionally many of VHA’s capacity-building initiatives are either in the initial stages of development or are lacking necessary funding and resources As such VHA has not made sufficient progress since our 2017 update to improve its overall ratings as two high-risk criteria remain partially met and three criteria remain unmet We remain concerned about VHA’s ability to oversee its programs hold its workforce accountable and avoid ambiguous policies and inconsistent processes that jeopardize its ability to provide safe high-quality care to veterans • In November 2017 we reported that due in part to misinterpretation or lack of awareness of VHA policy VA medical center officials did not always document or conduct timely required reviews of providers when allegations were made against them As a result we concluded that VA medical center officials may have lacked necessary information to reasonably ensure that their providers were competent to provide safe high-quality care to veterans and to grant approvals about these providers’ privileges to perform specific clinical services at VA medical centers We made four recommendations related to this and other findings all of which remain open • In June 2018 we reported that VHA could not systematically monitor the timeliness of veterans’ access to Veterans Choice Program VCP care because it lacked complete reliable data to do so We also found that veterans who were referred to the VCP for routine care because health care services were not available in a timely manner could potentially wait for care up to 70 calendar days if the maximum amount of time allowed by VA processes is used This wait time exceeds the statutory requirement that veterans receive VCP care within 30 days of the dates their VA health care providers indicated they should receive appointments or if no such date existed within 30 days of the veteran’s preferred date We made 10 recommendations related to this and other findings all of which remain open • Similarly in July 2018 we reported that VA collected data related to employee misconduct and disciplinary actions but data fragmentation Page 58 GAO-19-157SP High-Risk Series and reliability issues impeded department-wide analysis of those data Additionally we found that VA did not consistently ensure that allegations of misconduct involving senior officials were reviewed according to its investigative standards or ensure these officials were held accountable We made 16 recommendations related to this and other findings all of which remain open • In November 2018 we reported that VHA’s suicide prevention media outreach activities declined in recent years due to leadership turnover and reorganization Additionally we found that VHA did not assign key leadership responsibilities or establish clear lines of reporting for its suicide prevention media outreach campaign which hindered its ability to oversee the campaign Consequently we concluded that VHA may not be maximizing its reach with suicide prevention media content to veterans especially those who are at-risk This is inconsistent with VHA’s efforts to reduce veteran suicides which is VA’s highest clinical priority We made two recommendations related to this and other findings both of which remain open VA needs to further develop its capacity-building initiatives and establish metrics to monitor and measure its progress addressing the high-risk areas of concern It is also important that our recommendations continue to be implemented The department has implemented 209 of the 353 recommendations related to VA health care that we made from January 1 2010 through December 2018 but more than 125 recommendations remain open as of December 2018 This includes 17 that are older than 3 years In addition to addressing our recommendations VA needs to make systemic change to department management and oversight in order to fully address the high-risk issues and improve the health care provided to our nation’s veterans See appendix II for additional detail on this high-risk area including more details on actions that need to be taken Strategic Human Capital Management Mission-critical skills gaps both within federal agencies and across the federal workforce impede the government from cost-effectively serving the public and achieving results For example the difficulties in recruiting and retaining skilled health care providers and human resource staff at VHA’s medical centers make it difficult to meet the health care needs of more than 9 million veterans As a result VHA’s 168 medical centers have large staffing shortages including physicians registered nurses physician assistants psychologists physical therapists as well as human resource specialists and assistants Page 59 GAO-19-157SP High-Risk Series OPM continues to demonstrate top leadership commitment through its numerous efforts to assist agencies’ in addressing mission-critical skills gaps within their workforces This includes providing guidance training and on-going support for agencies on the use of comprehensive data analytic methods for identifying skills gaps and the development of strategies to address these gaps However since we first added strategic human capital management to our High-Risk List in 2001 we have reported on the need for agencies to address their workforce skills gaps As of December 2018 OPM had not fully implemented 29 of our recommendations made since 2012 relating to this high-risk area Staffing shortages and the lack of skills among current staff not only affect individual agencies but also cut across the entire federal workforce in areas such as cybersecurity and acquisition management Skills gaps caused by insufficient number of staff inadequate workforce planning and a lack of training in critical skills are contributing to our designating other areas as high-risk As table 7 shows of the 34 other high-risk areas covered in this report skills gaps played a significant role in 16 of the areas Table 7 Skills Gaps Related to High-Risk Areas High-risk area Examples of skills gaps and causes 2020 Decennial Census Staffing Lack of staff to oversee the $886 million contract for integrating the Information Technology IT systems needed to conduct the 2020 Census Strengthening DHS Management Functions Workforce Planning Lack of guidance on how to identify critical cybersecurity and acquisition skills needed to support its new IT delivery model Training Insufficient technical skills to support its biometric identification services program DOD Business Systems Modernization Workforce Planning Incomplete assessment of the extent to which DOD personnel meet IT management knowledge and skill requirements Staffing Slow and inefficient hiring processes have led to challenges in recruiting and retaining qualified chief information officers CIO and IT personnel Training Statutorily required guidance and training for cross-functional team members and presidential appointees not completed DOD Financial Management Staffing Financial management staff remains insufficient in number qualifications and expertise DOD Contract Management Staffing Challenges in recruiting talent for acquisition management DOE’s Contract Management for the National Nuclear Security Administration and Office of Environmental Management Workforce Planning Unmet critical staffing needs and evidence that the agency is understaffed across all functions Staffing Competing agency priorities and limited hiring have contributed to critical staff shortages to manage and oversee strategic materials programs Page 60 GAO-19-157SP High-Risk Series High-risk area Examples of skills gaps and causes U S Government’s Environmental Liability Workforce Planning Lack of information to evaluate overall project and program performance including number of staff and skills needed to meet its environmental management cleanup mission Improving Federal Management of Programs that Serve Tribes and Their Members Staffing Lack of expert staff to review proposals for wind and solar projects or petroleum engineers to review oil and gas proposals Additionally shortages of health care providers including physicians nurses midwives dentists and pharmacists Training Limited funding and lack of a safety training plan contributed to incomplete training to protect Bureau of Indian Education schools Management of Federal Oil and Gas Resources Workforce Planning Lacks plan for identifying key oil and gas positions and their respective technical competencies No evaluation of the effectiveness of its recruitment and retention incentives as well as its student loan repayment program Training No evaluation of its training needs training effectiveness or opportunities for its bureaus to share training resources NASA Acquisition Management Staffing and Skills Lacks staff or staff with skills in the areas of avionics flight software systems engineering business management software development for certain acquisition projects as well as gaps in areas such as cost estimating and earned value management capabilities Protecting Public Health Through Enhanced Oversight of Medical Products Staffing At times significant gaps in staffing still remain during the time staff complete necessary processes to be stationed overseas Improving and Modernizing Federal Disability Programs Staffing SSA’s disability appeals plan calls for increased hiring to reduce disability appeals backlogs and improve timeliness and VA has not completed hiring and planning efforts to ensure it has the capacity to comprehensively update its disability eligibility criteria VA Acquisition Management Training Lack of training for contracting officers Managing Risks and Improving VA Health Care Workforce Planning No annual tracking and reviewing of data related to IT skills needed in the future Staffing Insufficient number of community care staff and medical support assistants Training No assessment of the training needs or monitoring of completed training for patient advocate positions Ensuring the Cybersecurity of the Nation Staffing and Training The administration’s June 2018 government reform plan includes recommendations for solving the federal cybersecurity workforce shortage including prioritizing and accelerating efforts to reform how the federal government recruits evaluates selects pays and places cyber talent Improving the Management of IT Acquisitions and Operations Workforce Planning None of the 24 major federal agencies had IT management policies that fully addressed the role of their CIOs The majority of the agencies minimally addressed or did not address their CIO’s role in assessing agency IT workforce needs and developing strategies and plans for meeting those needs Source GAO analysis GAO-19-157SP Over the years since we added this area to our High-Risk List in addition to recommendations to address critical skills gaps in individual high-risk areas we have made numerous recommendations to OPM related to this high-risk issue 29 of which remain open Agencies also need to take action to address mission-critical skills gaps within their own workforces – a root cause of many high-risk areas See appendix II for additional detail on this high-risk area including more details on actions that need to be taken Page 61 GAO-19-157SP High-Risk Series 2020 Decennial Census The 2010 Census was the costliest in history at about $12 3 billion as of October 2017 the 2020 Census is projected to cost about $15 6 billion a 27 percent increase For the 2020 Census the U S Census Bureau Bureau plans to implement several innovations including new IT systems Implementing these innovations along with other challenges puts the Bureau’s ability to conduct a cost-effective census at risk The decennial census is mandated by the U S Constitution and provides vital data for the nation Census data are used among other purposes to apportion seats in the Congress and allocate billions of dollars in federal assistance to state and local governments To ensure its success this complicated and costly undertaking requires careful planning risk management and oversight Census activities some of which are new for the 2020 cycle must be carried out on schedule to deliver the state apportionment counts to the President by December 31 2020 The Bureau and the Department of Commerce Commerce have strengthened leadership commitment with executive-level oversight of the 2020 Census by holding regular meetings on the status of IT systems and other risk areas In addition in 2017 Commerce designated a team to assist senior Bureau management with cost estimation challenges These examples demonstrate both the Bureau’s and Commerce’s strong leadership commitment to implementing the 2020 Census One of the Bureau’s major challenges is to control any further cost growth and develop cost estimates that are reliable and reflect best practices for the 2020 Census According to the Bureau the total cost of the 2020 Census is now estimated to be approximately $15 6 billion more than $3 billion higher than previously estimated by the Bureau The higher estimated life-cycle cost is due in part to the Bureau’s failure to previously include all cost associated with the decennial census The Bureau’s schedule for developing IT systems has experienced delays that have compressed the time available for system testing integration testing and security assessments These schedule delays have contributed to systems experiencing problems after deployment as well as cybersecurity challenges For example as of December 2018 the Bureau had identified nearly 1 100 system security weaknesses that needed to be addressed Continued schedule management challenges may compress the time available for the remaining system testing and security assessments and increase the risk that deployed systems will either not function as intended have security vulnerabilities or both Page 62 GAO-19-157SP High-Risk Series As of January 2019 30 of our recommendations related to this high-risk area had not been implemented To make continued progress the Bureau needs to ensure that its approach to strategic planning IT management cybersecurity human capital management internal collaboration knowledge sharing as well as risk and change management are all aligned toward delivering more cost-effective outcomes Among other things the Bureau needs to ensure cost growth is controlled and that the development and testing of key systems is completed and fully integrated with all census operations before the 2020 Census In addition the Bureau needs to address cybersecurity weaknesses in a timely manner and ensure that security risks are at an acceptable level before systems are deployed See appendix II for additional detail on this high-risk area including more details on actions that need to be taken Medicare Medicaid and Earned Income Tax Credit Improper Payments An improper payment is any payment that should not have been made or that was made in an incorrect amount including overpayments and underpayments under statutory contractual administrative or other legally applicable requirements Reducing improper payments—such as payments to ineligible recipients or duplicate payments—is critical to safeguarding federal funds However the federal government has consistently been unable to determine the full extent of improper payments and reasonably assure that appropriate actions are taken to reduce them Since 2003—when certain agencies were required by statute to begin reporting improper payments—cumulative improper payment estimates have totaled about $1 5 trillion As shown in figure 7 for fiscal year 2018 federal entities estimated about $151 billion in improper payments Medicare and Medicaid improper payments and the Earned Income Tax Credit EITC improper payments—a part of the Enforcement of Tax Laws high-risk area—accounted for about 68 5 percent of this total Federal spending for Medicare programs and Medicaid is expected to significantly increase in the coming years so it is especially critical to take appropriate measures to reduce improper payments in these programs Internal Revenue Service estimates also show that the EITC has consistently had a high improper payment rate OMB has designated Medicare programs Medicaid and EITC as high-priority programs for improper payments indicating they are amongst the highest-risk programs where the government can achieve the greatest return on investment for the taxpayer by ensuring that improper payments are eliminated Page 63 GAO-19-157SP High-Risk Series Figure 7 Improper Payment Estimates Were Concentrated in Three Areas in Fiscal Year 2018 Our work has identified a number of strategic and specific actions agencies can take to reduce improper payments which could yield significant savings and help ensure that taxpayer funds are adequately safeguarded Continued agency attention is needed to 1 identify susceptible programs 2 develop reliable methodologies for estimating improper payments 3 report as required by statute and 4 implement effective corrective actions based on root cause analysis Absent such continued efforts the federal government cannot be assured that taxpayer funds are adequately safeguarded See appendix II for additional detail on the Medicare Program Improper Payments Strengthening Medicaid Program Integrity and Enforcement of Tax Laws high-risk areas including more details on actions that need to be taken Enforcement of Tax Laws The Internal Revenue Service IRS continues to face two pressing challenges in enforcing tax laws addressing the tax gap—amounting to hundreds of billions of dollars each year when some taxpayers fail to pay the taxes that they owe—and combatting identity theft IDT refund fraud Enforcement of Tax Laws has been on GAO’s high risk list since 1990 Page 64 GAO-19-157SP High-Risk Series IRS enforcement of tax laws helps fund the U S government by collecting revenue from noncompliant taxpayers and perhaps more importantly promoting voluntary compliance by giving taxpayers confidence that others are paying their fair share In 2016 IRS estimated that the average annual net tax gap the difference between taxes owed and taxes paid on time was $406 billion on average for tax years 2008-2010 While IRS continues to demonstrate top leadership support to address the tax gap IRS’s capacity to implement new initiatives and improve ongoing enforcement and taxpayer service programs remains a challenge For example IRS’s strategic plan includes a goal to facilitate voluntary compliance and deter noncompliance that could address the tax gap However IRS could do more to identify specific efforts for improving compliance in its strategic plan measure the effects of compliance programs—such as those used for large partnerships—and develop specific quantitative goals to reduce the tax gap Such efforts would help IRS make more effective use of its resources and gauge the success of its strategies The second challenge facing IRS is IDT refund fraud which occurs when an identity thief files a fraudulent tax return using a legitimate taxpayer’s identifying information and claims a refund IRS estimates that at least $12 2 billion in individual IDT tax refund fraud was attempted in 2016 of which it prevented at least $10 5 billion 86 percent Of the amount attempted IRS estimated that at least $1 6 billion 14 percent was paid IRS’s ability to combat IDT fraud continues to be challenged as more personally identifiable information has become readily available as a result of large-scale cyberattacks on various entities This makes it more difficult for IRS to distinguish between fraudsters and legitimate taxpayers While IRS has demonstrated some progress by developing tools and programs to further detect and prevent IDT refund fraud it has not completed updating its authentication procedures to be in compliance with new government standards As a result IRS may be missing an opportunity to implement the most secure robust technologies to protect taxpayers As of December 2018 189 GAO recommendations related to this highrisk area had not been implemented To make continued progress on closing the tax gap IRS needs to re-establish goals for improving voluntary compliance and develop and document a strategy that outlines Page 65 GAO-19-157SP High-Risk Series how it will use its data to help address this issue Reducing the tax gap will also require targeted legislative actions including additional thirdparty information reporting enhanced electronic filing expanded math error authority also referred to as correctible error authority and paid preparer regulation To help stay on top of IDT refund fraud IRS should develop a comprehensive process to evaluate alternative options for improving taxpayer authentication Given that IDT refund fraud continues to be a challenge targeted legislative action such as requiring a scannable code on returns prepared electronically but filed on paper could help IRS address such fraud See appendix II for additional detail on this high-risk area including more details on actions that need to be taken Improving the Management of IT Acquisitions and Operations The federal government currently invests more than $90 billion annually in IT and OMB has implemented several key initiatives intended to help better manage this investment Additionally enactment of FITARA in conjunction with greater attention paid to the acquisition and operation of IT has helped further improve the government-wide management of this significant annual investment 19 OMB’s current level of top leadership support and commitment to ensure that agencies successfully execute its guidance on implementing FITARA and related IT initiatives has helped this high-risk area meet the leadership commitment high-risk criteria Additional positive government-wide actions have enabled this high-risk area to partially meet the four remaining high-risk criteria For example OMB has established an IT Dashboard—a public website that provides detailed information on major IT investments at 26 federal agencies—and agencies’ data center consolidation efforts have resulted in a total savings of slightly more than 80 percent of the agencies’ planned $5 7 billion in savings since 2011 However major federal agencies have yet to fully address the requirements of FITARA and realize billions of dollars in planned or possible savings and improved government performance through more efficient budgeting and management of IT As government-wide spending on IT increases every year the need for appropriate stewardship of that investment increases as well However OMB and federal agencies have not made significant progress since 19 FITARA was enacted into law as part of the Carl Levin and Howard P “Buck” McKeon National Defense Authorization Act for Fiscal Year 2015 Pub L No 113-291 div A title VIII subtitle D §§ 831-837 128 Stat 3292 3438-3450 2014 Page 66 GAO-19-157SP High-Risk Series 2017 in taking the steps needed to improve how these financial resources are budgeted and utilized While OMB has continued to demonstrate its leadership commitment through guidance and sponsorship of key initiatives agencies still have not fully implemented all requirements of FITARA such as putting into place authorities the law requires for chief information officers CIO Additionally while the President’s Management Agenda has a goal to improve IT spending transparency agencies are underreporting IT contract obligations by billions of dollars OMB and the agencies also have not yet implemented hundreds of our recommendations on improving shortcomings in IT acquisitions and operations In an August 2018 review of the 24 federal agencies covered by FITARA none had IT management policies that fully addressed the role of their CIOs consistent with federal laws and guidance Specifically the majority of the agencies only minimally addressed or did not address their CIO’s role in assessing agency IT workforce needs and developing strategies and plans for meeting those needs Correspondingly the majority of the 24 CIOs acknowledged that they were not fully effective at implementing IT management responsibilities such as IT strategic planning and investment management Further in January 2018 we reported that the majority of 22 agencies did not identify all of their IT acquisition contracts totaling about $4 5 billion in IT-related contract obligations beyond those reported by agencies In addition in November 2018 we reported that four selected agencies lacked quality assurance processes for ensuring that billions of dollars requested in their IT budgets were informed by reliable cost information Until agencies properly identify IT contracts and establish processes for ensuring the quality of cost data used to inform their budgets agency CIOs are at risk of not having appropriate oversight of IT acquisitions and may lack adequate transparency into IT spending to make informed budget decisions As of December 2018 OMB and federal agencies had fully implemented only 59 percent of the recommendations we have made since fiscal year 2010 to address shortcomings in IT acquisitions and operations OMB and agencies should work toward implementing our remaining 456 open recommendations related to this high-risk area These remaining recommendations include 12 priority recommendations to agencies to among other things report all data center consolidation cost savings to OMB plan to modernize or replace obsolete systems as needed and Page 67 GAO-19-157SP High-Risk Series improve their implementation of PortfolioStat—an initiative that is to consolidate and eliminate duplicative systems OMB and agencies need to take additional actions to 1 implement at least 80 percent of our open recommendations related to the management of IT acquisitions and operations 2 ensure that a minimum of 80 percent of the government’s major IT acquisitions deliver functionality every 12 months and 3 achieve at least 80 percent of the over $6 billion in planned PortfolioStat savings See appendix II for additional detail on this high-risk area including more details on actions that need to be taken Our high-risk program continues to be a top priority at GAO and we will maintain our emphasis on identifying high-risk issues across government and on providing recommendations and sustained attention to help address them by working collaboratively with Congress agency leaders and OMB As part of this effort we hope to continue to participate in regular meetings with the OMB Deputy Director for Management and with top agency leaders to discuss progress in addressing high-risk areas Such efforts have been critical for the progress that has been made We are providing this update to the President and Vice President congressional leadership other Members of Congress OMB and the heads of major departments and agencies Gene L Dodaro Comptroller General of the United States Page 68 GAO-19-157SP High-Risk Series Appendix I Background Appendix I Background What Is the History of the High-Risk Program In 1990 we began a program to report on government operations that we identified as “high risk ” Since then generally coinciding with the start of each new Congress we have reported on the status of progress addressing high-risk areas and have updated the High-Risk List Our last high-risk update was in February 2017 1 That update identified 34 highrisk areas Since then we added a high-risk area outside of our normal biennial reporting cycle in 2018—Government-wide Personnel Security Clearance Process In 2019 we separated one high-risk area— Modernizing the U S Financial Regulatory System and Federal Role in Housing Finance—into two high-risk areas—Modernizing the U S Financial Regulatory System and Resolving the Federal Role in Housing Finance—to provide additional clarity on what needs to be done to address both areas Overall this program has served to identify and help resolve serious weaknesses in areas that involve substantial resources and provide critical services to the public Since our program began the federal government has taken high-risk problems seriously and has made longneeded progress toward correcting them In a number of cases progress has been sufficient for us to remove the high-risk designation A summary of changes to our High-Risk List over the past 29 years is shown in table 8 This 2019 update identifies 35 high-risk areas Table 8 Changes to the High-Risk List 1990-2019 Number of areas Original High-Risk List in 1990 14 High-risk areas added since 1990 48 High-risk areas removed since 1990 26 High-risk area separated out from existing area 1 High-risk areas consolidated since 1990 2 High-Risk List in 2019 35 Source GAO GAO-19-157SP 1 GAO High-Risk Series Progress on Many High-Risk Areas While Substantial Efforts Needed on Others GAO-17-317 Washington D C Feb 15 2017 Page 69 GAO-19-157SP High-Risk Series Appendix I Background How Can Agencies Use the Criteria to Make Progress on High-Risk Issues The five high-risk criteria form a road map for efforts to improve and ultimately address high-risk issues Addressing some of the criteria leads to progress while satisfying all of the criteria is central to removal from the list Our April 2016 report provided additional information drawn from our 2015 high-risk update on how agencies had made progress addressing high-risk issues 2 We provided illustrative actions that agencies took that led to progress or removal from our High-Risk List This information provides additional guidance to agencies whose programs are on the High-Risk List Figure 8 shows the five criteria and illustrative actions taken by agencies to address the criteria as cited in that report Importantly the actions listed are not “stand alone” efforts taken in isolation from other actions to address high-risk issues That is actions taken under one criterion may be important to meeting other criteria as well For example top leadership can demonstrate its commitment by establishing a corrective action plan including long-term priorities and goals to address the high-risk issue and using data to gauge progress—actions which are also vital to monitoring criteria 2 GAO High-Risk Series Key Actions to Make Progress Addressing High-Risk Issues GAO-16-480R Washington D C Apr 25 2016 Page 70 GAO-19-157SP High-Risk Series Appendix I Background Figure 8 Criteria for Removal from the High-Risk List and Examples of Actions Leading to Progress Page 71 GAO-19-157SP High-Risk Series Appendix I Background What Is the History of Programs Removed from the High-Risk List A summary of areas removed from our High-Risk List over the past 29 years is shown in figure 9 Figure 9 History of Areas Removed from the High-Risk List Page 72 GAO-19-157SP High-Risk Series Appendix I Background When Were Areas Added to the High-Risk List The areas on our 2019 High-Risk List and the year each was designated as high risk are shown in figure 10 Figure 10 Areas on GAO’s 2019 High-Risk List Were Designated as High Risk by Year Added Page 73 GAO-19-157SP High-Risk Series Appendix II Overview for Each High-Risk Area Appendix II Overview for Each High-Risk Area The following pages provide overviews of the 35 high-risk areas on our updated list Each overview discusses 1 why the area is high risk 2 the actions that have been taken and that are under way to address the problem since our last update in 2017 and 3 what remains to be done Each of these high-risk areas is also described on our High-Risk List website http www gao gov highrisk overview Page 74 GAO-19-157SP High-Risk Series Strategic Human Capital Management Strategic Human Capital Management The Office of Personnel Management and federal agencies must continue developing the capacity to measure and address existing mission-critical skills gaps and use workforce analytics to predict and mitigate future gaps so agencies can effectively carry out their missions Why Area Is High Risk Mission-critical skills gaps both within federal agencies and across the federal workforce pose a high risk to the nation because they impede the government from cost-effectively serving the public and achieving results This area was added to the High-Risk List in 2001 We along with OPM and individual agencies have identified skills gaps in such government-wide occupations in the fields of science technology engineering mathematics cybersecurity and acquisitions Causes for these skills gaps vary however they often occur due to a shortfall in one or more talent management activities such as robust workforce planning or training Additionally the changing nature of federal work and the high percentage of employees eligible for retirement could produce gaps in leadership and institutional knowledge and could threaten to aggravate the problems created from existing skills gaps For example 31 6 percent of permanent federal employees who were on board as of September 30 2017 will be eligible to retire in the next five years with some agencies having particularly high levels of employees to retire Mission-critical skills gaps are a contributing factor in making other areas across the government high risk Of the 34 other high-risk areas skill gaps played a significant role in 16 areas such as veterans’ health care Contact Information For additional information about this high-risk area contact Robert Goldenkoff at 202 512-2757 or goldenkoffr@gao gov or Yvonne D Jones at 202 512-2717 or jonesy@gao gov For this high-risk area all five criteria remain unchanged since our previous report in 2017 Leadership commitment met The Office of Personnel Management OPM continues to demonstrate top leadership commitment through its numerous efforts to assist agencies in addressing mission-critical skills gaps within their workforces OPM’s regulation on strategic human capital management which took effect in April 2017 requires executive branch agencies to issue human capital operating plans that in part must describe the agencies’ skills gaps and the strategies to be used for closing these gaps OPM has provided guidance training and on-going support for agencies on the use of comprehensive data analytic methods for identifying skills gaps and the development of strategies to address these gaps Additionally the Director of OPM uses the Chief Human Capital Officers CHCO Council’s quarterly meetings to review and discuss agency data on the closure of agency-specific skills gaps Capacity partially met OPM and the CHCO Council continue supporting the efforts of the Federal Agency Skills Teams FAST which consist of occupational leaders and CHCO representatives who are responsible for setting goals for closing skills gaps and using measureable targets and appropriate metrics OPM staff meet quarterly with FASTs to provide guidance on the development of action plans and use of OPM’s multi-factor model a methodology for identifying skills gaps In mid-2019 OPM plans to launch an automated version of the multi-factor model to facilitate and promote its use among FASTs Action plan partially met On a quarterly basis OPM staff review and provide feedback to FASTs on the content of their action plans such as the identification of the root causes for the skills gap assignment of roles and responsibilities for implementing strategies and the creation of outcome-oriented performance metrics Additionally OPM staff stated that they continue to train FAST members on applying OPM’s multi-factor model developing a sound action plan and identifying strategies for addressing identified skills gaps Page 75 GAO-19-157SP High-Risk Series Strategic Human Capital Management Monitoring partially met On a quarterly basis OPM provides to agencies’ management and FASTs a data dashboard of 12 metrics which gives a snapshot of agencies’ progress on closing identified skills gaps In March 2019 OPM plans to begin a “midterm” review of agencies’ efforts to mitigate skills gaps by issuing a memo to agencies asking for the status on their specific skills gaps and a description of challenges encountered during their efforts Demonstrated progress not met On the one hand OPM has among other actions issued a regulation and developed tools and processes that could help agencies better identify and address current and newly emerging skills gaps Additionally senior agency leaders are required to meet annually with OPM officials to hold high-level data-driven discussions on agencies’ progress towards meeting their human capital goals On the other hand OPM needs to ensure that individual agencies implement guidance tools and training and fully develop and implement effective strategies to mitigate and close skills gaps within their own workforces For instance the inability of the Veterans Health Administration’s human resource staff to implement an effective recruitment strategy has affected the ability of its medical centers to maintain an adequate team of medical professionals to meet veterans’ health care needs Agencies’ critical skills gaps contributed to 16 other high-risk areas and are noted throughout this report They include 2020 Decennial Census Strengthening DHS Management Functions DOD Business Systems Modernization DOD Financial Management DOD Contract Management DOE’s Contract Management for the National Nuclear Security Administration and Office of Environmental Management U S Government’s Environmental Liability Improving Federal Management of Programs that Serve Tribes and Their Members Management of Federal Oil and Gas Resources NASA Acquisition Management Protecting Public Health through Enhanced Oversight of Medical Products Improving and Modernizing Federal Disability Programs VA Acquisition Management Managing Risks and Improving VA Health Care Ensuring the Cybersecurity of the Nation and Improving the Management of IT Acquisitions and Operations What Remains to Be Done Over the years since we added this area to our High-Risk List in addition to recommendations to address critical skills gaps in individual high-risk areas we have made numerous recommendations to OPM related to this high-risk issue 29 of which remain open OPM needs to fully address the recommendations in our January 2015 report which call on the Director of OPM to make more strategic use of government workforce data to build a predictive capacity for identifying and mitigating emerging skills gaps Page 76 GAO-19-157SP High-Risk Series Strategic Human Capital Management across government Our January 2015 report also recommended that OPM work with agency CHCOs to bolster the ability of agencies to assess workforce competencies by sharing competency surveys lessons learned and other tools and resources Agencies also need to take action to address mission-critical skills gaps within their own workforces—a significant factor contributing to many high-risk areas Related GAO Products Embassy Construction Pace is Slower Than Projected and State Could Make Program Improvements GAO-18-653 Washington D C September 25 2018 Tax Administration Opportunities Exist to Improve Monitoring and Transparency of Appeal Resolution Timeliness GAO-18-659 Washington D C September 21 2018 Information Technology IRS Needs to Take Actions to Address Significant Risks to Tax Processing GAO-18-298 Washington D C June 28 2018 Cybersecurity Workforce Agencies Need to Improve Baseline Assessments and Procedures for Coding Positions GAO-18-466 Washington D C June 14 2018 Defense Acquisition Workforce Opportunities Exist to Improve Practices for Developing Program Managers GAO-18-217 Washington D C February 15 2018 Cybersecurity Workforce Urgent Need for DHS to Take Actions to Identify Its Position and Critical Skill Requirements GAO-18-175 Washington D C February 6 2018 Bureau of Prisons Better Planning and Evaluation Could Help Ensure Effective Use of Retention Incentives GAO-18-147 Washington D C December 7 2017 National Weather Service Actions Have Been Taken to Fill Increasing Vacancies but Opportunities Exist to Improve and Evaluate Hiring GAO-17-364 Washington D C May 24 2017 Strategic Human Capital Management NRC Could Better Manage the Size and Composition of Its Workforce by Further Incorporating Leading Practices GAO-17-233 Washington D C April 27 2017 Veterans Health Administration Actions Needed to Better Recruit and Retain Clinical and Administrative Staff GAO-17-475T Washington D C March 22 2017 Page 77 GAO-19-157SP High-Risk Series Managing Federal Real Property Managing Federal Real Property The federal government would save millions of dollars by disposing of unneeded buildings and reducing lease costs Federal departments and agencies should also improve data reliability and federal facility security Why Area Is High Risk The federal government’s real estate portfolio is vast and diverse—including about 267 000 domestic buildings as of September 2016 that cost billions of dollars annually to operate and maintain OMB and GSA both provide management support to agencies OMB establishes federal policies and chairs the Federal Real Property Council GSA provides space for federal tenants and collects data on real property Additionally DHS has management-level responsibilities through the DHS-chaired Interagency Security Committee ISC that sets security standards and its Federal Protective Service FPS protects about 9 000 federal buildings Federal managers however rely on other agencies to reduce unneeded properties produce reliable data and follow ISC standards Since federal real property management was placed on the High-Risk List in 2003 the federal government has given high-level attention to this issue however federal agencies continue to face long-standing challenges including 1 effectively disposing of excess and underutilized property 2 relying too heavily on leasing 3 collecting reliable real property data for decision making and 4 protecting federal facilities Contact Information For additional information about this high-risk area contact Lori Rectanus at rectanusl@gao gov or 202 512-2834 Since our 2017 High-Risk Report overall the five criteria remain unchanged although there was progress within some individual segments Three agencies involved in managing tracking and protecting federal real property government-wide— Office of Management and Budget OMB General Services Administration GSA and Department of Homeland Security DHS —have made steady progress over multiple administrations in addressing federal real property challenges However momentum has slowed due to delayed implementation of the Federal Assets Sale and Transfer Act of 2016 FASTA and decreased implementation of reforms by federal agencies Over the years since we added this area to our High-Risk List we have made numerous recommendations related to this high-risk issue 40 of which were made since the last high-risk update in February 2017 As of December 2018 63 recommendations are open Excess and Underutilized Property Ratings for this segment remain unchanged since our 2017 High-Risk Report Leadership commitment met In 2015 OMB implemented our recommendation to issue government-wide guidance—the National Strategy for the Efficient Use of the Real Property National Strategy — which identified actions to reduce the size of the federal real property portfolio by prioritizing consolidation co-location and disposal actions consistent with the Reduce the Footprint policy that required agencies to set goals for reducing unneeded space An OMB official said that the National Strategy and Reduce the Footprint Policy are still in place Page 78 GAO-19-157SP High-Risk Series Managing Federal Real Property In 2016 FASTA established a 7-member civilian board to recommend unneeded federal buildings for disposal However the administration has not yet appointed a chair a full board or staff In 2018 the Administration released its plan on Delivering Government Solutions in the 21st Century As part of this plan the Administration proposed a series of improvements to streamline and accelerate the disposal of excess federal property These improvements include reducing the number of steps needed to dispose of unneeded federal property and creating incentives for disposals by allowing agencies to retain the proceeds from sales Capacity partially met As noted in our 2017 high-risk update OMB created the National Strategy and the Reduce the Footprint Policy to assist agencies which represented positive steps However the National Strategy does not address the extent to which underlying challenges such as budget limitations impede agencies’ abilities to dispose of or better use real property nor does it offer guidance on how agencies can overcome these challenges Once the board is appointed FASTA has the potential to increase the federal government’s capacity by establishing a process for identifying and disposing of unneeded federal buildings Action plan met We noted in 2017 that OMB had through the Reduce the Footprint policy established a government-wide action plan to 1 use property as efficiently as possible and 2 reduce portfolios through annual reduction targets Monitoring partially met OMB and GSA monitor progress in meeting space reduction targets using the government-wide real property database called the Federal Real Property Profile FRPP However the database is not yet sufficiently reliable to produce accurate results The Department of Defense DOD has almost half of the federal government’s buildings However OMB chose not to use DOD’s real property data in reporting the 2017 results of the Reduce the Footprint policy—the most recent year for which data is available—because the data were not sufficiently reliable We reported in 2018 that weaknesses in the quality of the DOD’s real property data result in part because DOD has not developed a strategy to identify and address risks with accompanying time frames and performance metrics Without such a strategy DOD may miss the opportunity to reasonably ensure that the information needed for effective decision making by DOD Congress and other federal agencies is available to meet real property accountability and reporting objectives Demonstrated progress partially met The fiscal year 2016 results from Reduce the Footprint show progress with the federal government more than doubling its reduction goal However in fiscal year 2017 the Page 79 GAO-19-157SP High-Risk Series Managing Federal Real Property federal government failed to reach the halfway point of its more modest reduction goal What Remains to Be Done As part of the reforms that OMB is considering it should • identify alternative approaches to address underlying causes of real property problems and address the extent to which challenges impede progress as we recommended in 2016 and • refocus agency attention on meeting space reduction targets as discussed Additionally the Administration needs to appoint vacant FASTA board positions and hire staff The ratings for capacity and action plan improved since our 2017 High-Risk Report and the remaining three criteria remain unchanged Costly Leasing Leadership commitment met OMB and GSA continue to take action to reduce costly leasing For example OMB proposed the creation of a capital revolving fund designed to facilitate ownership over operating leases for large-dollar buildings although no action has been taken to implement it An OMB staff member said that the legislative proposal to establish a capital fund was similar to an option we identified in a 2014 report Additionally GSA has developed a strategy to reduce leasing costs by a projected $4 7 billion by fiscal year 2023 through steps that include focusing resources on high-value lease renewals Capacity partially met GSA made improvements and now partially meets the capacity criterion Specifically GSA implemented our September 2013 recommendation to develop a strategy to increase ownership investments for a prioritized list of high-value leases These leases are for properties where it would be less expensive in the long run to own GSA plans to purchase at least one leased building in 2019 In addition as noted in our 2017 high-risk update GSA could potentially help tenant agencies save millions of dollars from some leases by loaning them funds to improve newly leased spaces instead of agencies financing these costs with private-sector owners at private-sector interest rates While GSA officials agreed that doing so would save money in interest fees it has not yet developed a legislative proposal to obtain the needed authority as we recommended in 2016 Page 80 GAO-19-157SP High-Risk Series Managing Federal Real Property Action plan met GSA has made improvements and now meets the action plan criterion GSA created an action plan to purchase buildings when it is more cost-effective than leasing by establishing criteria to rank and prioritize leased spaces that would benefit from federal ownership as discussed above Additionally GSA is implementing strategies to better manage leases that include avoiding short-term extensions and identifying opportunities to enter into long-term and lower cost leases Monitoring partially met GSA continues to partially meet this criterion through implementation of the National Strategy as noted in our 2017 high-risk update However GSA should also implement our recommendations to reduce the costs to tenants by exploring strategies to enhance competition for GSA leases and reducing unneeded fees Additionally GSA has identified actions to better monitor leases at different points along the process in order to minimize the need to enter into short-term costly lease extensions Demonstrated progress partially met GSA has made some progress in reducing the long-term costs of leasing by stemming the growth in leasing according to GSA data and committing to further reducing leasing costs However GSA must follow through on its plans to purchase leased buildings and reduce costs GSA could also further reduce costs by loaning tenant agencies the funds needed to improve newly leased spaces but still needs to develop a legislative proposal to obtain authority to do so What Remains to Be Done GSA should develop a legislative proposal to obtain authority to loan agencies funds needed to improve newly leased spaces as we recommended in 2016 Ratings for one criterion improved since our 2017 High-Risk Report and the other four criteria remain unchanged Data Reliability Leadership commitment met In December 2017 GSA continued efforts to improve data reliability by completing a major effort to make the Federal Real Property Profile FRPP public Also as we reported in our 2017 High-Risk Report GSA issued its Federal Real Property Data Validation and Verification V V Guidance in May 2016 and required agencies to address 13 257 data anomalies it found in fiscal year 2016 data Page 81 GAO-19-157SP High-Risk Series Managing Federal Real Property Capacity met OMB and GSA continue to help agencies’ increase their capacity to submit accurate data For example GSA revised certain data elements’ definitions in 2016 and incorporated them in the 2018 FRPP Data Dictionary In addition OMB and GSA have further increased the capacity of FRPP to act as a government-wide database since additional agencies are required to report Action plan met GSA has made progress by developing an action plan in 2017 for federal agencies to develop processes to assess address and track FRPP data quality Specifically this plan identifies data elements to appropriately indicate data quality identifies best practices and other methods that help agencies measure and assess improvements and enables federal agencies to develop performance metrics Monitoring partially met While GSA required agencies to research the anomalies it found in its V V process only some agencies have identified and committed to correct mistakes Further of the 13 257 anomalies GSA identified in the fiscal year 2016 data agencies overall acknowledged that less than 8 percent of the anomalies 1 004 anomalies represented erroneous data to be corrected while indicating that the others were correct Furthermore some agencies acknowledged less than 1 percent of the anomalies represented erroneous data In addition we found in 2018 that DOD did not correct discrepancies identified by its own V V process Demonstrated progress partially met While GSA and some agencies have taken action to correct data serious data reliability challenges remain with some individual agencies that undermine the reliability of the FRPP In 2018 we found that DOD’s real property data continue to be inaccurate and incomplete and that DOD lacks a plan for making the necessary improvements What Remains to be Done OMB and GSA should continue working with federal agencies to improve the reliability of their real property data through V V efforts and encouraging agencies to implement action plans to better assess address and track data quality as discussed in the above action plan In particular DOD should take steps to ensure that DOD improves the reliability of its real property data as we recommended in 2018 Page 82 GAO-19-157SP High-Risk Series Managing Federal Real Property Ratings for this segment remain unchanged since our 2017 High-Risk Report Physical Security Leadership commitment met DHS’s Federal Protective Service FPS continues to take action to address our recommendations The Interagency Security Committee ISC an organization chaired by DHS that sets standards for physical security for federal nonmilitary facilities also continues to implement the updated Risk Management Process—a consolidated set of standards for physical security at federal facilities In addition in 2018 GSA the Administrative Office of the U S Courts AOUSC the U S Marshals Service and FPS implemented our 2017 recommendation to establish a national-level working forum for courthouse security known as the Interagency Judicial Security Council Capacity partially met FPS has taken several actions to address identified physical security issues since our 2017 High-Risk Report For example in 2018 FPS improved its risk assessment tool to incorporate all necessary elements recommended by the ISC which has now certified it In 2018 FPS also addressed our recommendation related to improving training for instructors and identified actions to address our recommendations associated with tracking guard training Finally in 2018 FPS also implemented several actions associated with our recommendation to develop human capital-related performance measures to evaluate progress towards agency goals Some agencies may not have the capacity to conduct adequate risk assessments because their processes do not fully align with the ISC Risk Management Process To improve their capacity the U S Customs and Border Protection Federal Aviation Administration and the Department of Veterans’ Affairs still need to complete an assessment of their policies against the ISC’s standards in response to our 2017 and 2018 recommendations Action plan partially met In September 2018 FPS and GSA signed a memorandum of agreement MOA clarifying their respective roles and responsibilities for federal facility security However FPS GSA and the Department of Justice have not yet addressed our 2011 recommendation to address a number of courthouse security challenges Specifically FPS the U S Marshals Service AOUSC and GSA are still working to finalize the draft MOA on courthouse security Page 83 GAO-19-157SP High-Risk Series Managing Federal Real Property Monitoring partially met FPS continues to develop a system that will allow FPS to verify independently that FPS’s contract guards are current on all training and certification requirements and are taking steps to close this recommendation as implemented FPS expects that system to be in place in 2019 In 2018 we also found that actions were needed to better address various emerging security threats to federal facilities Demonstrated progress not met The federal government has not demonstrated progress to improve physical security Although agencies have taken some actions time is needed for agencies to demonstrate the results of these actions Additionally agencies need to complete other actions For example once FPS the U S Marshals Service AOUSC and GSA sign their MOA on courthouse security they will be able to better protect federal facilities Further once FPS fully implements its guard management system and it interacts with its training system FPS will be able to obtain information to assess its guards’ capability to address physical security risks across its portfolio What Remains to be Done Related GAO Products To improve the physical security of federal buildings the following steps are necessary • Clarify roles and responsibilities for the protection of federal facilities by finalizing the MOA for federal courthouse security between GSA FPS the U S Marshals and AOUSC as we recommended in 2011 • FPS must validate training information being entered to ensure that guards are getting critical training as we recommended in 2012 • Implement our recommendations for agencies to improve their monitoring of collaborative efforts to protect federal facilities as we recommended in 2015 • Take actions to better address emerging security threats to federal facilities as we recommended in 2018 Federal Facility Security Actions Needed to Better Address Various Emerging Threats GAO-19-32SU Washington D C October 17 2018 Defense Real Property DOD Needs to Take Additional Actions to Improve Management of Its Inventory Data GAO-19-73 Washington D C November 13 2018 Federal Buildings More Consideration of Operations and Maintenance Costs Could Better Inform the Design Excellence Program GAO-18-420 Washington D C May 22 2018 Page 84 GAO-19-157SP High-Risk Series Managing Federal Real Property Federal Real Property Agencies Make Some Use of Telework in Space Planning but Need Additional Guidance GAO-18-319 Washington D C March 22 2018 Federal Buildings Agencies Focus on Space Utilization As They Reduce Office and Warehouse Space GAO-18-304 Washington D C March 8 2018 VA Facility Security Policy Review and Improved Oversight Strategy Needed GAO-18-201 Washington D C January 11 2018 Federal Facility Security Selected Agencies Should Improve Methods for Assessing and Monitoring Risk GAO-18-72 Washington D C October 26 2017 Federal Real Property GSA Should Inform Tenant Agencies When Leasing High-Security Space from Foreign Owners GAO-17-195 Washington D C January 3 2017 Page 85 GAO-19-157SP High-Risk Series Funding the Nation’s Surface Transportation System Funding the Nation’s Surface Transportation System Congress needs to pass a long-term sustainable solution for funding surface transportation Why Area Is High Risk The nation’s surface transportation system—including highways transit maritime ports and rail systems that move both people and freight—is under growing strain Further the cost to repair and upgrade the system to meet current and future demand is estimated in the hundreds of billions of dollars The oldest portions of the Interstate Highway System are over 60 years old and almost 9 percent of the nation’s bridges were rated as structurally deficient in 2017 These challenges are intensified by a range of factors such as shifting demographics a growing economy and rapid development of new technologies This issue has been on our High-Risk List since 2007 These surface transportation challenges come at a time when traditional funding sources are eroding and the federal government lacks a long-term sustainable strategy for funding surface transportation Funding is further complicated by the federal government’s financial condition and fiscal outlook The nation is on an unsustainable longterm fiscal path of deficits and debt and Congress and the administration face difficult policy choices about federal revenues spending and investment choices that need to be accompanied by a broader fiscal plan to put the government on a more sustainable longterm fiscal path Contact Information For additional information about this high-risk area contact Susan Fleming at 202 512-2834 or flemings@gao gov We are not rating this high-risk area because addressing the identified issues primarily involves congressional action Motor fuel taxes and additional truck-related taxes that support the Highway Trust Fund—the major source of federal surface transportation funding—are eroding Federal motor fuel tax rates have not increased since 1993 and we reported in 2012 that drivers of passenger vehicles with average fuel efficiency paid about $96 per year in federal gasoline taxes Because of inflation the 18 4 centper-gallon federal tax on gasoline has about one-third less purchasing power than it did when the tax was last raised in 1993 To maintain spending levels of about $45-50 billion a year for highway and transit programs and to cover revenue shortfalls Congress transferred a total of about $141 billion in general revenues to the Highway Trust Fund on eight occasions from 2008 through 2015 These transfers each represented a one-time infusion of funding not a sustainable long-term source of revenues This funding approach effectively ended the long-standing principle of “users pay” in highway finance breaking the link between the taxes paid and the benefits received by highway users Most recently the Fixing America’s Surface Transportation FAST Act authorized around $70 billion of the $141 billion in transfers for 2015 through 2020 After 2021 the gap between projected revenues and spending will recur In January 2019 the Congressional Budget Office estimated that $159 billion in additional funding would be required to maintain current spending levels plus inflation from 2022 through 2029 as shown in figure 11 Page 86 GAO-19-157SP High-Risk Series Funding the Nation’s Surface Transportation System Figure 11 Projected Cumulative Highway Trust Fund Balance Fiscal Years 2022 through 2029 Note This projection assumes no further augmentation of highway-related taxes to the Highway Trust Fund after 2021 from general revenues or other sources By law the Highway Trust Fund cannot incur negative balances A long-term sustainable plan for funding surface transportation requires congressional action and remains the pivotal action that will determine whether this issue remains on or is removed from our High-Risk List However it is also important that federal funding for surface transportation be spent wisely and efficiently Over the last decade we have noted opportunities to improve performance and accountability in how surface transportation funds are spent by maximizing the use of existing resources and linking funding to performance These opportunities include 1 implementing a performance-based approach to surface transportation funding and 2 improving how surface transportation projects are selected through DOT’s discretionary grant programs Performance-based approach to surface transportation funding Historically spending for surface transportation programs has not effectively addressed key challenges such as deteriorating infrastructure conditions and increasing congestion and freight demand This is because federal goals and roles have been unclear programs have lacked links to performance and programs have not used the best tools and approaches to ensure effective investment decisions Beginning in 2008 we suggested that Congress consider a fundamental reexamination of these programs to improve performance and accountability by Page 87 GAO-19-157SP High-Risk Series Funding the Nation’s Surface Transportation System clarifying federal goals and roles establishing performance links and improving investment decision-making Provisions enacted in 2012 in the Moving Ahead for Progress in the 21st Century Act MAP-21 and affirmed in the 2015 FAST Act have begun to address these key challenges Specifically MAP-21 included provisions to move toward a more performance-based surface transportation program by establishing national performance goals in areas such as infrastructure condition safety and system performance The act and its implementing regulations set forth a three-stage process in which 1 DOT establishes performance measures and standards 2 states and other grantees set targets based on these performance measures and states report progress to DOT and 3 DOT evaluates whether grantees have met or made significant progress toward their targets DOT has been implementing the performance-based approach envisioned in MAP-21 For example in January 2017 the Federal Highway Administration FHWA finalized the last of six interrelated rules establishing performance measures in the areas of safety pavement and bridge conditions and system performance States and other grantees began setting targets in 2018 In July 2017 we reported that without a formal plan guiding and coordinating FHWA’s efforts the agency might struggle to articulate the goals and purpose of the transition and to identify and address the activities best suited to help states and others overcome challenges As a result we recommended that FHWA develop an implementation plan—including strategic goals for the transition to a performance-based approach specific efforts FHWA plans to take to help states and other grantees successfully make the transition and a timetable for when these efforts would be completed In July 2018 FHWA publicly released an implementation plan that addressed the issues we identified and the recommendation we made in 2017 Discretionary grants Discretionary grants are an important component in improving the performance and accountability of transportation funding decisions We have reported that the historic approach to funding surface transportation in particular highways poses challenges because funding has been principally provided through formulas designed largely to return revenues to their attributed state of origin in order to closely align the states’ contributions to the Highway Trust Fund with the funding they receive The FAST Act authorized about a dozen new discretionary grant programs For example the FAST Act established a grant program to fund freight and highway projects of regional or national importance and in 2016 DOT awarded nearly $760 million for the Fostering Advancements in Shipping and Transportation for the Long-term Achievement of National Efficiencies FASTLANE grant program to 18 projects While over 90 percent of spending from the Highway Trust Fund will continue to be distributed by formula the FAST Act represents a Page 88 GAO-19-157SP High-Risk Series Funding the Nation’s Surface Transportation System promising development to address national and regional transportation priorities We have found challenges with DOT’s implementation of discretionary grant programs including problems with the transparency of the application review and selection process and a lack of documentation of key decisions For example in November 2017 we reported that due to inconsistencies in assessing applications for the FASTLANE program we were unable to determine the rationale DOT used to award $759 2 million to the 18 projects it selected Similarly in December 2016 we found that the Federal Transit Administration FTA did not document key decisions in awarding $3 6 billion in discretionary grants for projects to increase the resilience of transit systems to withstand future disasters in areas affected by Hurricane Sandy We have raised concerns about the lack of documentation of key decisions in DOT discretionary grant programs since 2011 Given the continuing challenges we have found with DOT discretionary grant programs and the number of new programs authorized by the FAST Act we recommended in December 2016 that the Secretary of Transportation issue a directive governing department-wide and modal administration discretionary grant programs Such a directive should include requirements to among other things 1 develop an up-front plan for evaluating project proposals to ensure DOT reviews applications consistently and 2 document key decisions including the reason for any rating changes as well as how high-level concerns raised during the process were addressed DOT concurred with the recommendation and stated it planned to implement it in 2019 by updating its Financial Assistance Guidance Manual In order to fully implement this recommendation DOT needs to issue a directive that incorporates all of the elements identified above Congressional Actions Needed Congress and the administration need to agree on a long-term plan for funding surface transportation Continuing to augment the Highway Trust Fund with general revenues may not be sustainable given competing demands and the federal government’s long-term fiscal challenges A sustainable solution would balance revenues to and spending from the Highway Trust Fund New revenues from users can come only from taxes and fees ultimately major changes in transportation spending or in revenues or in both will be needed to bring the two into balance In 2008 we reported that Congress should consider addressing the imbalance between federal surface transportation revenues and spending That matter has not been addressed and the current authorization for surface transportation funding expires in October 2020 Page 89 GAO-19-157SP High-Risk Series Funding the Nation’s Surface Transportation System What Remains to Be Done Related GAO Products While passage by Congress of a long-term sustainable plan for funding surface transportation is the pivotal action that is needed to remove this issue from our High-Risk List it is also increasingly important that the effectiveness of surface transportation programs be improved by maximizing the use of existing resources and linking funding to performance Specifically DOT can • continue to make progress implementing the performance-based framework established in MAP-21 and • enhance the management of its discretionary grant programs and respond to our recommendation to develop a directive to help ensure the integrity of future DOT discretionary grant programs Discretionary Transportation Grants DOT Should Take Actions to Improve the Selection of Freight and Highway Projects GAO-18-38 Washington D C November 2 2017 Surface Transportation A Comprehensive Plan Could Facilitate Implementation of a National Performance Management Approach GAO-17-638 Washington D C July 27 2017 DOT Discretionary Grants Problems with Hurricane Sandy Transit Grant Selection Process Highlight the Need for Additional Accountability GAO-17-20 Washington D C December 14 2016 Surface Transportation DOT Is Progressing Toward a PerformanceBased Approach but States and Grantees Report Potential Implementation Challenges GAO-15-217 Washington D C January 16 2015 Surface Transportation Actions Needed to Improve Documentation of Key Decisions in the TIGER Discretionary Grant Program GAO-14-628R Washington D C May 28 2014 Highway Trust Fund Pilot Program Could Help Determine the Viability of Mileage Fees for Certain Vehicles GAO-13-77 Washington D C December 13 2012 Highway Trust Fund All States Received More Funding Than They Contributed in Highway Taxes from 2005 to 2009 GAO-11-918 Washington D C September 8 2011 Surface Transportation Restructured Federal Approach Needed for More Focused Performance-Based and Sustainable Programs GAO-08-400 Washington D C March 6 2008 Page 90 GAO-19-157SP High-Risk Series Modernizing the U S Financial Regulatory System Modernizing the U S Financial Regulatory System Financial regulators need to strengthen systemic risk oversight and monitor progress on reforms and Congress may want to consider options to address inefficiencies that hamper the financial regulatory system Why Area Is High Risk The U S financial regulatory structure remains complex with responsibilities fragmented among a number of regulators that have overlapping authorities The current structure introduces significant challenges for efficient and effective oversight of financial institutions and activities Moreover in the decades leading up to the financial crisis of 2007—2009 the financial regulatory system failed to adapt to significant changes First although the financial sector increasingly had become dominated by large interconnected financial conglomerates no single regulator was tasked with monitoring and assessing the risks that these firms' activities posed across the entire financial system Second entities that had come to play critical roles in the financial markets were not subject to sufficiently comprehensive regulation and oversight Third the regulatory system was not effectively providing key information and protections for new and more complex financial products for consumers and investors Consequently we added this area to the High-Risk List in 2009 Modernizing the U S financial regulatory system and aligning it to current conditions is essential to reducing the likelihood that our nation will experience another major financial crisis Contact Information For additional information about this high-risk area contact Lawrance Evans Jr at 202 512-8678 or evansl@gao gov Since our 2017 High-Risk Report ratings for all five criteria remain unchanged Actions are needed by financial regulators and Congress to address this high-risk area Leadership commitment partially met Since policymakers enacted the Dodd-Frank Wall Street Reform and Consumer Protection Act Dodd-Frank Act in July 2010 financial regulators have shown leadership commitment by finalizing rules to implement most of the DoddFrank Act’s rule-making requirements While the act included provisions to better position the financial regulatory system to address key financial stability risks it generally left the financial regulatory structure unchanged In February 2016 we reported that remaining fragmentation and overlap in the structure have created inefficiencies in regulatory processes and inconsistencies in how regulators oversee similar types of institutions We also reported that while the Dodd-Frank Act created the Financial Stability Oversight Council FSOC to identify and address threats to financial stability FSOC’s legal authorities may not allow it to respond effectively to systemic risks Capacity partially met The Dodd-Frank Act created FSOC and included other provisions intended to increase the capacity of the financial regulatory system to identify and address risks to the stability of the financial system While most of these reforms have been implemented rulemakings for certain reforms have only recently been finalized or taken effect while others are currently being modified under the May 2018 Economic Growth Regulatory Relief and Consumer Protection Act In addition FSOC and the Department of the Treasury’s Office of Financial Research OFR have not completed steps to clarify their respective responsibilities for monitoring financial stability risks Action plan partially met FSOC’s annual reports have served as the council’s key accountability document as each report 1 discusses the progress regulators have made in implementing reforms 2 identifies newly emerging threats and 3 includes recommendations to address Page 91 GAO-19-157SP High-Risk Series Modernizing the U S Financial Regulatory System them While FSOC can respond to certain potential systemic risks primarily through its designation authority FSOC cannot compel regulators to act with respect to other sources of systemic risk This presents a challenge to holding FSOC and the financial regulators accountable for addressing systemic risk In addition financial regulators are required to conduct retrospective reviews of the effects of their regulations However some have not yet developed plans for how these reviews will incorporate quantitative analysis and identify opportunities for streamlining bodies of regulation Monitoring partially met FSOC monitors and reports on indicators of financial stability and potential emerging threats to financial stability Since the financial crisis the Board of Governors of the Federal Reserve System’s Federal Reserve stress test programs have played a key role in supervisory efforts to evaluate and maintain financial stability In November 2016 we recommended that the Federal Reserve enhance the effectiveness of these stress test programs by further assessing—and adjusting as needed—the severity of the stress scenarios and other aspects of the test design Demonstrated progress partially met The new agencies and oversight bodies created under the Dodd-Frank Act have taken actions to carry out their missions For example FSOC meets regularly to discuss issues related to risks to the U S financial system The Federal Reserve and the OFR have taken steps to reduce potential duplication and ensure comprehensive efforts to monitor systemic risks For example the two agencies coordinated semi-annual meetings to jointly discuss views from their respective monitoring of the financial system In our continuing work to monitor this area we determined that federal financial regulators could take additional steps to improve the efficiency and effectiveness of the financial regulatory system For example additional progress is needed in the areas of planning for retrospective reviews of rules and implementing the Federal Reserve’s stress test programs What Remains to Be Done • Over the years since we added this area to our high-risk list we have made numerous recommendations related to this area As of December 2018 26 of these recommendations remain open FSOC and its member agencies should implement our open recommendations related to strengthening oversight of risks to financial stability and assessing the effectiveness of Dodd-Frank Act reforms FSOC and the OFR should clarify their respective responsibilities to monitor risks to financial stability to avoid gaps and duplication in these efforts Page 92 GAO-19-157SP High-Risk Series Modernizing the U S Financial Regulatory System • To improve the effectiveness of its stress test programs the Federal Reserve should further assess key aspects of stress scenario design and take steps to improve its ability to manage model risk the potential for adverse consequences from decisions based on incorrect or misused model outputs Although the Federal Reserve has taken responsive actions related to some of our recommendations in this area taking the additional steps we recommended can help the Federal Reserve identify and manage the risks introduced into its models and account appropriately for uncertainty and sensitivity of model results • Under their authority FSOC should work with federal financial regulators to establish formal coordination policies that clarify issues such as when interagency coordination should occur around rulemakings and the role FSOC should play in facilitating that coordination • The Federal Reserve and the Office of the Comptroller of the Currency should develop plans for how they will conduct required retrospective analyses of rulemakings including how and when they will collect analyze and report needed data Congressional Actions Needed • Addressing weaknesses in the U S financial regulatory structure will require additional congressional leadership in the following two areas as suggested in our reports Addressing fragmentation and overlap in the regulatory structure Congress should consider whether additional changes to the financial regulatory structure are needed to reduce or better manage fragmentation and overlap in the oversight of financial institutions and activities to improve 1 the efficiency and effectiveness of oversight 2 the consistency of consumer and investor protections and 3 the consistency of financial oversight for similar institutions products risks and services For example Congress could consider consolidating the number of federal agencies involved in overseeing the safety and soundness of depository institutions combining the entities involved in overseeing the securities and derivatives markets and determining the optimal federal role in insurance regulation among other considerations • Clarifying FSOC’s authorities and mission Congress should consider whether legislative changes are necessary to align FSOC’s authorities with its mission to respond to systematic risks Congress could do so by making changes to FSOC’s mission its authorities or both or to the missions and authorities of one or more of the FSOC member agencies to support a stronger link between the responsibility and capacity to respond to systemic risks Page 93 GAO-19-157SP High-Risk Series Modernizing the U S Financial Regulatory System Related GAO Products Community Banks and Credit Unions Regulators Could Take Additional Steps to Address Compliance Burdens GAO-18-213 Washington D C February 13 2018 Federal Reserve Additional Actions Could Help Ensure the Achievement of Stress Test Goals GAO-17-48 Washington D C November 15 2016 Resolution Plans Regulators Have Refined Their Review Processes but Could Improve Transparency and Timeliness GAO-16-341 Washington D C April 12 2016 Financial Regulation Complex and Fragmented Structure Could Be Streamlined to Improve Effectiveness GAO-16-175 Washington D C February 25 2016 Dodd-Frank Regulations Impacts on Community Banks Credit Unions and Systemically Important Institutions GAO-16-169 Washington D C December 30 2015 Bank Regulation Lessons Learned and a Framework for Monitoring Emerging Risks and Regulatory Response GAO-15-365 Washington D C June 25 2015 Financial Stability Oversight Council Further Actions Could Improve the Nonbank Designation Process GAO-15-51 Washington D C November 20 2014 Financial Stability New Council and Research Office Should Strengthen the Accountability and Transparency of Their Decisions GAO-12-886 Washington D C September 11 2012 Dodd-Frank Act Regulations Implementation Could Benefit from Additional Analyses and Coordination GAO-12-151 Washington D C November 10 2011 Financial Regulation A Framework for Crafting and Assessing Proposals to Modernize the Outdated U S Financial Regulatory System GAO-09-216 Washington D C January 8 2009 Page 94 GAO-19-157SP High-Risk Series Resolving the Federal Role in Housing Finance Resolving the Federal Role in Housing Finance Congress should consider establishing objectives for the future federal role in housing finance and establishing a transition plan that enables Fannie Mae and Freddie Mac—to exit federal conservatorship Additionally housing and regulatory agencies need to take actions to help manage mortgage-related risk Why Area Is High Risk The expanded federal role in housing finance began during the 2007–2009 financial crisis and has substantially increased the government’s fiscal exposure Because objectives for the future role have not been established we designated resolving the federal role in housing finance as a high-risk area in 2013 In recent years the federal government has supported more than two-thirds of the value of new home mortgages FHFA placed the enterprises into conservatorships in 2008 due to concern that their deteriorating financial condition threatened economic stability As of September 2018 the enterprises had received $191 4 billion in capital support from the Department of the Treasury Treasury and paid dividends to Treasury exceeding that amount If they were to incur major additional losses they would draw required amounts from their remaining $254 1 billion in Treasury commitments The federal government also supports mortgages through insurance and guarantee programs FHA has an insured portfolio that exceeds $1 2 trillion and that required about $1 7 billion in supplemental funds in 2013 Ginnie Mae guarantees the performance of almost $2 trillion in securities backed by mortgages with FHA or other federal agency support Contact Information For additional information about this high-risk area contact Daniel GarciaDiaz at 202 512-8678 or garciadiazd@gao gov Our ratings for the five criteria remain unchanged from our 2017 High-Risk Report Actions are needed by housing and regulatory agencies and by Congress to address this highrisk area Leadership commitment partially met Housing and regulatory agencies have demonstrated some leadership commitment For example in January 2013 and December 2014 respectively agencies finalized “qualified mortgage” and “qualified residential mortgage” regulations designed to prevent a recurrence of risky practices in originating and securitizing mortgages that contributed to the financial crisis Resolving the federal role in housing finance will require statutory changes Congress held hearings and developed legislative proposals on housing finance reform since our 2017 High-Risk Report However it has not enacted legislation establishing objectives for the future federal role in housing finance or a transition plan that enables the enterprises—the Federal National Mortgage Association Fannie Mae and Federal Home Loan Mortgage Corporation Freddie Mac —to exit federal conservatorship Also some prior proposals have not had a system-wide focus For example some proposals address the enterprises but do not consider other entities such as the Federal Housing Administration FHA and the Government National Mortgage Association Ginnie Mae Capacity partially met Under the Federal Housing Finance Agency’s FHFA conservatorship the enterprises—which guarantee more than $5 trillion in mortgage-backed securities—generally have operated profitably since 2012 FHFA also has taken actions to assess the financial capacity of the enterprises and mitigate some of their risks by overseeing annual stress tests and directing them to take actions that have transferred increasing amounts of credit risk to private market entities However FHFA lacks statutory authority to examine nonbank mortgage servicers nondepository institutions that collect loan payments among Page 95 GAO-19-157SP High-Risk Series Resolving the Federal Role in Housing Finance other functions and other third parties who do business with and pose potential risks to the enterprises Also prolonged conservatorships could create uncertainties for market participants and hinder the development of the broader mortgage securities market FHA has enhanced its risk-management practices in response to our recommendations and while the agency’s Mutual Mortgage Insurance Fund did not meet its statutory minimum capital requirement in fiscal years 2009–2014 it has met the requirement each subsequent year FHA’s capital requirement however is not based on a specified risk threshold such as the economic conditions the fund would be expected to withstand A severe economic downturn could strain the capacity of FHA and the enterprises and require taxpayer funds to cover actual or expected losses as occurred during the financial crisis and associated housing market crash Action plan partially met Although fundamental changes to the housing finance system have yet to be enacted federal agencies have taken some planning steps to facilitate the transition to a future federal role For example FHFA has continued efforts to create a common securitization platform for the enterprises with the ultimate goal of building an infrastructure that could be used by other market participants in the future Additionally in July 2016 the Department of the Treasury FHFA and the Department of Housing and Urban Development of which FHA is a component issued a report with guiding principles for future efforts to mitigate mortgage losses based on lessons from the financial crisis If Congress enacts changes to the housing finance system relevant federal agencies will need to develop action plans to effectively implement the changes Monitoring partially met Federal agencies have taken some steps to provide the types of monitoring that may aid assessment of the effects of changes to the housing finance system For example FHFA and the Consumer Financial Protection Bureau monitor different aspects of the mortgage market including emerging risks and consumer challenges through activities such as examinations of regulated entities and analysis of consumer complaints FHFA and the Consumer Financial Protection Bureau also have continued a joint initiative—the National Mortgage Database Program— that could be useful for examining the effect of mortgage market reforms One component is developing a representative database of loan-level information on the terms and performance of mortgages as well as characteristics of the associated borrowers and properties Another Page 96 GAO-19-157SP High-Risk Series Resolving the Federal Role in Housing Finance component is a quarterly national survey of a representative sample of recent borrowers about their experiences in obtaining a mortgage But housing and regulatory agencies have not taken all necessary steps including specifying metrics and methods to assess the effects of key mortgage regulations implemented in response to the last housing crisis Demonstrated progress not met Overall progress on resolving the federal role in housing finance will be difficult to achieve until Congress provides further direction by enacting changes to the housing finance system Assessing progress against specific goals is not yet possible because Congress has not provided an overall blueprint for the future federal role in housing finance or determined the specific roles federal agencies will play What Remains to Be Done Housing and regulatory agencies should implement our previous recommendations designed to help manage mortgage-related risks and assess the effects of mortgage reforms already in place • The Department of Housing and Urban Development should develop a plan that identifies the metrics baselines and analytical methods needed to conduct retrospective reviews of its qualified mortgage regulations i e analyze how well the regulations work in practice consistent with Executive Orders and Office of Management and Budget guidance • Agencies responsible for the qualified residential mortgage regulations— including the Federal Deposit Insurance Corporation Board of Governors of the Federal Reserve System Office of the Comptroller of the Currency and Department of Housing and Urban Development—should develop plans that identify the metrics baselines and analytical methods to be used for retrospective reviews Over the years since we added this area to the High-Risk List we have made numerous recommendations related to this high-risk issue two of which were made since the last high-risk update in February 2017 As of December 2018 six recommendations are open Congressional Actions Needed Congressional actions we have previously recommended will be needed to help resolve the federal role in housing finance and manage federal fiscal exposure to the mortgage market Specifically Congress should consider housing finance reform legislation that • establishes objectives for the future federal role in housing finance including the role and structure of the enterprises within the housing finance system • provides a transition plan to a reformed system that enables the enterprises to exit federal conservatorship and Page 97 GAO-19-157SP High-Risk Series Resolving the Federal Role in Housing Finance • considers all relevant federal entities including FHA and Ginnie Mae Congress also should consider other actions we have previously recommended to help manage mortgage risks such as Related GAO Products • granting FHFA explicit authority to examine nonbank servicers and other third parties that do business with the enterprises and • specifying the economic conditions that FHA’s Mutual Mortgage Insurance Fund would be expected to withstand without substantial risk of drawing on supplemental funds and require FHA to specify and comply with a capital ratio consistent with these conditions Housing Finance Prolonged Conservatorships of Fannie Mae and Freddie Mac Prompt Need for Reform GAO-19-239 Washington D C January 18 2019 Federal Housing Administration Capital Standards and Stress Testing Practices Need Strengthening GAO-18-92 Washington D C November 9 2017 Federal Housing Finance Agency Objectives Needed for the Future of Fannie Mae and Freddie Mac After Conservatorships GAO-17-92 Washington D C November 17 2016 Nonbank Mortgage Servicers Existing Regulatory Oversight Could Be Strengthened GAO-16-278 Washington D C March 10 2016 Mortgage Reforms Actions Needed to Help Assess Effects of New Regulations GAO-15-185 Washington D C June 25 2015 Housing Finance System A Framework for Assessing Potential Changes GAO-15-131 Washington D C October 7 2014 Page 98 GAO-19-157SP High-Risk Series USPS Financial Viability USPS Financial Viability Comprehensive legislative reform and additional cost-cutting are needed for the U S Postal Service USPS to achieve sustainable financial viability Why Area Is High Risk USPS’s financial viability has been on our High-Risk List due to the need for action to address USPS’s poor financial condition In July 2009 we reported that USPS’s financial condition needed attention by Congress and the executive branch to achieve broad-based restructuring Currently one open Matter for Congressional Consideration is related to this high-risk area USPS financial viability continues to be high-risk because USPS cannot fund its current level of services and financial obligations from its revenues As an independent establishment in the executive branch USPS has long been expected to provide affordable quality and universal postal service to all parts of the country while remaining selffinancing Specifically USPS is expected to be financially self-sufficient by covering its expenses through revenues generated from the sale of its products and services However USPS is no longer able to do so USPS’s most profitable product— First-Class Mail—is expected to continue declining for the foreseeable future and USPS faces increasing competition in its less profitable package shipping business Meanwhile key costs such as compensation and benefits are rising Contact Information For additional information about this high-risk area contact Lori Rectanus at 202 512-2834 or rectanusl@gao gov Since our 2017 High-Risk Report ratings for one criterion improved one regressed and three remain unchanged The monitoring progress criterion is now met but the demonstrated progress criterion regressed to not met Removal of USPS’s financial viability from the High-Risk List would require fundamental changes Both Congress and USPS need to act to put it on a sustainable financial footing USPS has lost $69 0 billion over the past 11 fiscal years— including $3 9 billion in fiscal year 2018—and has budgeted for a $6 6 billion net loss in fiscal year 2019 Leadership commitment partially met USPS continues to seek some legislative changes intended to improve its financial condition For example USPS has sought legislation that would integrate its retiree health program with Medicare which would significantly reduce its total unfunded liabilities USPS also has sought legislation that would require a rate increase for most mail Further USPS is seeking the elimination of the price cap that generally limits rate increases for most mail to the rate of inflation USPS has implemented limited initiatives to manage its labor costs such as a small reduction to its workforce in fiscal year 2018 through attrition USPS has stated that opportunities for further cost savings are limited under the existing legal framework and would do little to close its financial gap Capacity partially met USPS plans to increase capital spending in the coming decade to replace and modernize its infrastructure after years of reduced capital investment For example USPS plans to replace its aging fleet of delivery vehicles which is intended to increase its capacity to deliver mail and packages in a more cost-efficient manner However given the uncertainty of USPS’s financial situation the ability to carry out this spending may require tradeoffs with other commitments USPS is only able to make capital investments and pay for its ongoing Page 99 GAO-19-157SP High-Risk Series USPS Financial Viability operations by not making certain required federal payments to fund accrued retirement benefits Action plan partially met USPS issued its 5-year strategic plan for fiscal years 2017 to 2021 outlining its strategy for making progress towards financial viability and developed annual performance plans that specify goals for each fiscal year However these plans fall short of maximizing what USPS can do within its existing authority to operate more efficiently and reduce its costs For example USPS has no plans to resume consolidating its processing facilities recognizing that actions such as this would likely face stakeholder resistance Monitoring met USPS regularly monitors its financial condition and issues quarterly and independently-audited annual financial reports The independent audits have consistently found that USPS’s financial statements conform with U S generally accepted accounting principles and fairly present in all material aspects USPS’s financial position at the end of each fiscal year as well as the results of its operations and cash flows USPS’s quarterly and annual financial reports provide information on key trends and measures such as 1 revenues and expenses 2 unfunded liabilities and 3 debt obligations USPS publishes the reports on its public website and provides quarterly public webcasts on its financial results Demonstrated progress not met USPS’s overall financial condition is deteriorating and unsustainable The savings from USPS cost-reduction efforts have dwindled in recent years and although USPS has stated it will aggressively reduce costs within its control USPS’s plans will not achieve the kind of savings necessary to significantly reduce current operating costs USPS expenses are now growing faster than its revenues in part due to rising compensation and benefits costs combined with continuing declines in First-Class Mail Further USPS’s total unfunded liabilities and debt were $143 billion at the end of fiscal year 2018 an amount double its annual revenue As we testified in February 2017 a comprehensive package of legislative actions is needed to improve USPS’s financial viability In that testimony we also stated that USPS’s financial situation leaves Congress with difficult choices and trade-offs to achieve the broad-based restructuring that will be necessary for USPS to become financially sustainable In addition USPS has missed $48 2 billion in required payments for postal retiree health and pension benefits through fiscal year 2018 including $42 6 billion in missed payments for retiree health benefits since fiscal year 2010 and $5 6 billion for pension benefits since fiscal year 2014 USPS has stated that it missed these payments to minimize the risk of running out of cash citing its precarious financial condition and the need to cover current and anticipated costs and any contingencies Page 100 GAO-19-157SP High-Risk Series USPS Financial Viability USPS appears likely to miss required payments for retiree health benefits for the foreseeable future Based on Office of Personnel Management projections the fund supporting postal retiree health benefits would be depleted in fiscal year 2030 if USPS continues to miss all payments If the fund is depleted USPS would be required by law to make the payments necessary to cover its share of health benefits premiums for postal retirees However current law does not address what would happen if USPS misses those payments Depletion of the fund together with USPS’s potential inability to make remaining contributions could affect postal retirees as well as USPS customers and other stakeholders including the federal government What Remains to Be Done As USPS has stated it needs to aggressively pursue additional costreduction initiatives in areas in which it has managerial discretion Because USPS actions under its existing authority will be insufficient to restore its financial viability a balanced package of legislative reform continues to be needed Congressional Actions Needed Congress should consider a comprehensive package of legislative actions to improve USPS’s financial viability including 1 facilitating USPS’s ability to better align costs with revenues 2 putting postal retiree health benefits on a more sustainable financial footing and 3 requiring any binding arbitration in the negotiation process for USPS labor contracts to take USPS’s financial condition into account Congress should consider various options to better align USPS costs with revenues and address constraints and legal restrictions that limit USPS's ability to reduce costs and improve efficiency Related GAO Products Postal Retiree Health Benefits Unsustainable Finances Need to Be Addressed GAO-18-602 Washington D C August 31 2018 U S Postal Service Projected Capital Spending and Processes for Addressing Uncertainties and Risks GAO-18-515 Washington D C June 28 2018 International Mail Information on Changes and Alternatives to the Terminal Dues System GAO-18-112 Washington D C October 12 2017 U S Postal Service Key Considerations for Potential Changes to USPS’s Monopolies GAO-17-543 Washington D C June 22 2017 U S Postal Service Key Considerations for Restoring Fiscal Sustainability GAO-17-404T Washington D C February 7 2017 Page 101 GAO-19-157SP High-Risk Series USPS Financial Viability U S Postal Service Continuing Financial Challenges and the Need for Postal Reform GAO-16-651T Washington D C May 11 2016 U S Postal Service Financial Challenges Continue GAO-16-268T Washington D C January 21 2016 Page 102 GAO-19-157SP High-Risk Series Management of Federal Oil and Gas Resources Management of Federal Oil and Gas Resources To enhance its oversight of oil and gas development on federal lands and waters the Department of the Interior Interior needs to accurately determine and collect royalties resolve its human capital challenges and address leadership commitment deficiencies within the Bureau of Safety and Environmental Enforcement Why Area Is High Risk Management of federal oil and gas resources was added to the High-Risk List in 2011 based on challenges we identified in Interior’s management of oil and gas on leased federal lands and waters This high-risk area has three segments royalty determination and collection human capital challenges and restructuring of offshore oil and gas oversight Royalty determination and collection Interior lacks reasonable assurance that it is collecting its fair share of revenue from oil and gas produced on federal lands and waters Human capital Interior continues to experience problems hiring training and retaining sufficient staff to oversee and manage oil and gas operations on federal lands and waters Restructuring of offshore oil and gas oversight Interior’s restructuring of BSEE has made limited progress addressing long-standing deficiencies in the bureau’s investigative environmental compliance and enforcement capabilities Additionally BSEE has struggled to implement strategic initiatives to improve offshore oversight and internal management Contact Information For additional information about this high-risk area contact Frank Rusco 202 512-4597 ruscof@gao gov Since our 2017 update Interior has partially met all criteria for this high-risk area This high-risk area is composed of three segments royalty determination and collection human capital and restructuring of offshore oil and gas oversight Under human capital for example Interior has taken steps to assess its special salary rates but has not provided evidence that it evaluated its bureaus' training needs training effectiveness or opportunities for the bureaus to share training resources Each of our five recommendations related to human capital such as annually evaluating the bureaus' training programs also remain open In February 2016 we reported that BSEE had not addressed longstanding oversight deficiencies In March 2017 we reported that BSEE needed to improve its leadership commitment toward completing strategic initiatives for enhancing offshore oversight and internal management These reports were the basis for adding the third segment to this High-Risk area in 2017 Over the years since we added this area to our High-Risk List we have made numerous recommendations related to this high-risk issue 4 of which were made since the last high-risk update in February 2017 As of December 2018 17 recommendations are open or unimplemented Page 103 GAO-19-157SP High-Risk Series Management of Federal Oil and Gas Resources Ratings for this segment remain largely unchanged since our previous High-Risk Report in 2017 though the rating for leadership commitment has been revised from met to partially met due to recent regulatory actions Ratings for the four remaining criteria remain unchanged Royalty Determination and Collection Leadership commitment partially met We revised the rating from met to partially met in light of recent regulatory actions addressing methane emissions and oil and gas measurement that may adversely affect the agency’s past efforts to implement our recommendations In October 2010 and July 2016 we found that Interior could take steps to better account for and manage methane emissions and issued several recommendations For example in October 2010 we found that economically capturing onshore vented and flared methane could increase federal royalty payments by $23 million annually In response Interior took steps to implement our recommendations Specifically in November 2016 Interior issued regulations intended to reduce wasteful methane emissions from onshore oil and gas production which were consistent with our recommendations In June 2017 however Interior postponed compliance dates with relevant sections of the new regulations and then suspended certain requirements in December 2017 Interior subsequently issued revised regulations in September 2018 Interior’s revised regulations were not consistent with our prior work because they eliminated certain regulations that would potentially have addressed our recommendations Better methane control is important for ensuring the federal government receives all the royalties it is due In April 2015 we found that Interior had not updated several oil and gas measurement and site security regulations in over 25 years As a result Interior’s measurement regulations did not reflect current measurement technologies and standards and its site security regulations did not require the tracking of the number or location of its royalty measurement points This hampered Interior’s ability to have reasonable assurance that oil and gas production was being accurately measured and verified raising concerns about whether the federal government was receiving the royalties it was due Accordingly we recommended that Interior update those regulations In response Interior issued new regulations consistent with our recommendations which went into effect in January 2017 Later that month Interior announced a new rulemaking effort to begin in January 2019 to revise its oil and gas measurement and site security regulations It is uncertain whether these revisions will be consistent with Page 104 GAO-19-157SP High-Risk Series Management of Federal Oil and Gas Resources our prior work and provide reasonable assurance that the federal government is receiving the royalties it is due We will continue to monitor Interior’s regulatory actions and reevaluate its progress to regulate methane emissions and measurement and site security Capacity partially met Interior has an uneven capacity to address weaknesses in its ability to determine and collect royalties Interior was unable to consistently meet its oil and gas measurement goals—an important control for ensuring accurate royalty payments—for fiscal years 2014 through 2017 In September 2018 Bureau of Land Management BLM officials stated that while BLM had generally met its goals for highpriority oil and gas measurement inspections for fiscal years 2014 through 2017 it was unable to meet its goals for low-priority inspections in part due to insufficient staff Action plan partially met In March 2017 the Secretary of the Interior established the Royalty Policy Committee which is tasked with providing advice to the Secretary on the fair market value of and on the collection of revenues derived from development of energy and natural resources on Federal lands Since then the Committee has met several times This effort is ongoing Monitoring partially met Interior has undertaken efforts to monitor its performance addressing royalty determination and collection weaknesses For instance Interior has implemented a majority of our recommendations addressing royalty determination and collection However it is uncertain if the effect of Interior’s recent regulatory actions on methane emissions and oil and gas measurement will be consistent with our prior work Additionally BLM has still not completed a planned internal review to assess the overall effectiveness of previously issued guidance on commingling requests—requests to combine oil or gas from public state or private leases prior to royalty measurement Demonstrated progress partially met Interior has demonstrated progress addressing weaknesses in its revenue collection policies and practices As of December 2018 Interior fully implemented 47 of our 50 recommendations However the effect of Interior’s recent regulatory actions on methane emissions and oil and gas measurement may not be consistent with our prior work Our recommendations related to methane emissions and oil and gas measurement are important for ensuring the government collects the royalties it is due Interior may hinder its demonstrated progress if its recent regulatory actions jeopardize its prior efforts to implement our recommendations Page 105 GAO-19-157SP High-Risk Series Management of Federal Oil and Gas Resources What Remains to Be Done Interior has made good progress addressing our recommendations yet needs to 1 continue to consider how to ensure the public gets a fair return from oil and gas produced from onshore and offshore leases 2 complete its rulemaking to replace its recently issued onshore oil and gas measurement and site security regulations 3 continue to assess technologies to minimize methane emissions where applicable 4 meet its goals for onshore and offshore oil and gas measurement inspections and 5 consider technological options to more efficiently and effectively receive oil and gas volume data from companies As of December 2018 3 of the 50 recommendations we have made related to this segment remain unimplemented Interior generally concurred with the remaining unimplemented recommendations However as stated above some of Interior’s recent regulatory actions may not be consistent with our prior work We will continue to monitor Interior’s regulatory actions and reevaluate its progress to regulate methane emissions and measurement and site security Interior continues to partially meet all criteria for this segment as it did in 2017 Human Capital Challenges Leadership commitment partially met Interior has taken steps to implement each of our five recommendations related to human capital such as evaluating the need for and viability of a certification program for BSEE inspectors But Interior officials need to provide the guidance and direction to ensure Interior continues to work toward full implementation of these recommendations Capacity partially met In January 2017 Interior stated that it would direct BLM BSEE and the Bureau of Ocean Energy Management to identify their technical competency needs for key oil and gas personnel and develop a plan with milestones In May 2018 Interior said it asked the bureaus to provide a plan for identifying key oil and gas positions and their respective technical competencies As of December 2018 Interior had not provided us with a plan for developing technical competencies Action plan partially met Among other actions Interior has taken initial steps to assess the effectiveness of its special salary rates by examining hiring and retention data from the fiscal year 2017 hiring cycle However as of December 2018 Interior had not evaluated the bureaus' training needs training effectiveness or opportunities for the bureaus to share training resources Monitoring partially met In September 2016 Interior outlined steps it will take to assess the effectiveness of special salary rates as well as Page 106 GAO-19-157SP High-Risk Series Management of Federal Oil and Gas Resources recruitment relocation and retention incentives by tracking measures such as turnover and acceptance rates As of December 2018 the three bureaus had taken initial steps to regularly evaluate the effectiveness of the special salary rates incentive by examining data from fiscal year 2017 but had not yet evaluated the effectiveness of recruitment relocation and retention incentives or its student loan repayment program Demonstrated progress partially met In September 2016 we reported on Interior’s progress to hire train and retain staff and made five recommendations Interior has agreed with one recommendation partially agreed with three and disagreed with the remaining one The agency has made some progress but all recommendations remain open What Remains to Be Done In 2016 we made five recommendations to Interior and all remain open Interior needs to fully implement our recommendations to address its human capital challenges To help ensure Interior can hire retain and train needed staff we recommended that Interior 1 regularly evaluate the effectiveness of incentives such as special salary rates to hire and retain key oil and gas staff 2 annually evaluate the bureaus' training programs including training needs and effectiveness and potential opportunities for the bureaus to share training resources 3 develop technical competencies for all key oil and gas staff 4 evaluate the need for and viability of a certification program for BSEE inspectors and 5 create or use an existing mechanism to facilitate collaboration across the three bureaus in addressing their shared hiring retention and training challenges Restructuring of Offshore Oil and Gas Oversight We added this segment to our 2017 HighRisk List and are rating it for the first time Leadership commitment partially met In March 2017 we reported that BSEE leadership had started several initiatives to improve its safety and environmental oversight capabilities but its limited efforts to obtain and incorporate input from within the bureau hindered its progress In March 2017 we recommended that BSEE establish a mechanism for management to obtain and incorporate input from bureau personnel and any external parties that can affect the bureau's ability to achieve its objectives We highlighted this recommendation as a top priority for the Secretary of the Interior BSEE has taken some actions to address our concerns including establishing an Ombudsman position within the bureau in May 2017 an Employee Engagement Council in February 2018 and an Innovation Page 107 GAO-19-157SP High-Risk Series Management of Federal Oil and Gas Resources Program in April 2018 However BSEE has not yet demonstrated that these actions represent an enduring institutionalization of improved communication throughout the bureau Capacity partially met Since March 2017 BSEE has taken some actions for management to obtain and incorporate input from bureau personnel and any external parties that can affect the bureau's ability to achieve its objectives However BSEE has not completed other actions such as a risk analysis of the regional-based reporting structure of the Environmental Compliance Division including actions to mitigate any identified risk Action plan partially met In September 2016 BSEE issued a plan with milestones for implementing its case management system for investigations of offshore incidents However BSEE has not completed other actions such as developing a plan to address documented environmental oversight staffing needs Monitoring partially met In April 2016 BSEE issued a bureau manual chapter regarding the review and adjustment of civil penalty amounts and in February 2018 added a supplementary standard operating procedure that defines business practices for civil penalty inflation adjustment and identifies specific bureau roles responsibilities and timelines However BSEE has not completed other actions For example BSEE has not coordinated with the Administrator of the Environmental Protection Agency to consider existing interagency agreements for monitoring operator compliance with National Pollutant Discharge Elimination System permits on the Outer Continental Shelf and if necessary update them to reflect current oversight needs Demonstrated progress partially met We made a total of 13 recommendations to improve BSEE oversight capabilities and internal management 9 of which remain open regarding its implementation of oversight divisions ability to meet strategic objectives and efforts to improve organizational trust What Remains to be Done Interior should implement all open recommendations to complete the restructuring of BSEE’s oversight functions and improve leadership commitment to its key strategic initiatives for improving offshore oversight and internal management Interior neither agreed nor disagreed with our recommendations Related GAO Products Oil and Gas Lease Management BLM Could Improve Oversight of Lease Suspensions with Better Data and Monitoring Procedures GAO-18-411 Washington D C June 4 2018 Page 108 GAO-19-157SP High-Risk Series Management of Federal Oil and Gas Resources Oil and Gas Wells Bureau of Land Management Needs to Improve Its Data and Oversight of Its Potential Liabilities GAO-18-250 Washington D C May 16 2018 Oil and Gas Development Improved Collection and Use of Data Could Enhance BLM's Ability to Assess and Mitigate Environmental Impacts GAO-17-307 Washington D C April 25 2017 Oil and Gas Management Stronger Leadership Commitment Needed at Interior to Improve Offshore Oversight and Internal Management GAO-17-293 Washington D C March 21 2017 Oil and Gas Oversight Interior Has Taken Steps to Address Staff Hiring Retention More Evaluative and Collaborative Approach GAO-16-742 Washington D C September 29 2016 Oil and Gas Interior Could Do More to Account for and Manage Natural Gas Emissions GAO-16-607 Washington D C July 7 2016 Oil and Gas Management Interior’s Bureau of Safety and Environmental Enforcement has Not Addressed Long-Standing Oversight Deficiencies GAO-16-245 Washington D C February 10 2016 Oil and Gas Resources Interior’s Production Verification Efforts and Royalty Data Have Improved but Further Actions Needed GAO-15-39 Washington D C April 7 2015 Oil and Gas Updated Guidance Increased Coordination and Comprehensive Data Could Improve BLM’s Management and Oversight GAO-14-238 Washington D C May 5 2014 Oil and Gas Resources Actions Needed for Interior to Better Ensure a Fair Return GAO-14-50 Washington D C December 6 2013 Oil and Gas Management Interior’s Reorganization Complete but Challenges Remain in Implementing New Requirements GAO-12-423 Washington D C July 30 2012 Page 109 GAO-19-157SP High-Risk Series Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks To reduce its fiscal exposure the federal government needs a cohesive strategic approach with strong leadership and the authority to manage risks across the entire range of related federal activities Why Area Is High Risk Numerous studies have concluded that climate change poses risks to many environmental and economic systems and creates a significant fiscal risk to the federal government For example according to the November 2018 National Climate Assessment report the continued increase in the frequency and extent of high-tide flooding due to sea level rise threatens America’s trilliondollar coastal property market and public infrastructure with cascading impacts to the larger economy We added this area to the High-Risk List in 2013 There are five areas where governmentwide action is needed to reduce federal fiscal exposure including but not limited to the federal government’s role as 1 the insurer of property and crops 2 the provider of disaster aid 3 the owner or operator of infrastructure 4 the leader of a strategic plan that coordinates federal efforts and informs state local and private-sector action and 5 the provider of data and technical assistance to decision makers We have made 62 recommendations related to this high-risk area 12 of which were made since the February 2017 high-risk update As of December 2018 25 remain open Contact Information For additional information about this high-risk area contact J Alfredo Gómez at 202 512-3841 or gomezj@gao gov The rising number of natural disasters and increasing reliance on federal assistance is a key source of federal fiscal exposure Since 2005 federal funding for disaster assistance is approaching half a trillion dollars about $430 billion most recently for catastrophic hurricanes flooding wildfires and other losses in 2017 and 2018 Disaster costs are projected to increase as extreme weather events become more frequent and intense due to climate change—as observed and projected by the U S Global Change Research Program and the National Academies of Sciences Engineering and Medicine One way to reduce federal fiscal exposure is to enhance resilience by reducing or eliminating long-term risk to people and property from natural hazards For example we reported that elevating homes and strengthened building codes in Texas and Florida prevented greater damages during the 2017 hurricane season Additionally in October 2018 the Disaster Recovery Reform Act of 2018 was enacted which among other things allows the President to set aside with respect to each major disaster a percentage of certain grants to use for pre-disaster hazard mitigation However for some Native American tribes and communities such as Alaska Native villages climate change impacts are an immediate threat and we and others have reported on institutional barriers that limit proactive responses We have ongoing work examining how to identify and prioritize resilience projects According to the November 2018 Fourth National Climate Assessment neither global efforts to reduce emissions nor regional resilience efforts approach the scales needed to avoid substantial damages over the coming decades However beginning in 2017 the administration revoked policies that had identified addressing climate change as a priority and demonstrated top leadership support for executive branch action Although leadership commitment remains partially met due to congressional action since our 2017 High-Risk Report the federal Page 110 GAO-19-157SP High-Risk Series Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks government has not made measurable progress to reduce its fiscal exposure to climate change As a result ratings for four criteria remain unchanged and monitoring has regressed to not met Federal Insurance Programs Federal flood and crop insurance programs were not designed to generate sufficient funds to fully cover all losses and expenses The flood insurance program for example was about $21 billion in debt to the Treasury as of September 2018 Further the Congressional Budget Office estimated in January 2017 that federal crop insurance would cost the federal government an average of about $8 billion annually from 2017 through 2026 Implementing our prior recommendations to improve the long-term resiliency of insured structures and crops and address structural weaknesses may decrease federal fiscal exposure to climate change The ratings for this segment remain unchanged at partially met or not met Leadership commitment partially met Leadership commitment remains partially met to reflect action by Congress such as passage of the Biggert-Waters Flood Insurance Reform Act of 2012 Specifically the Biggert-Waters Act created the Technical Mapping Advisory Council TMAC and directed it to produce a “Future Conditions Risk Assessment and Modeling Report” with recommendations on how to ensure that 1 rate maps incorporate the best available climate science and 2 the Federal Emergency Management Agency FEMA uses the best available methodology to consider the impact of rising sea levels and future development on flood risk In its 2015 report TMAC made several recommendations to FEMA for how to incorporate climate science into FEMA’s maps and tools on an advisory basis which FEMA has plans to implement However our rating for top leadership support within the executive branch has regressed because related executive orders have been rescinded For example the March 2017 E O 13783 Promoting Energy Independence and Economic Growth revoked E O 13653 which we previously found had partially met this criterion Specifically we had found that E O 13653 demonstrated top leadership support for federal agencies such as FEMA and the United States Department of Agriculture USDA to incorporate adapting to climate change risks into their planning efforts Page 111 GAO-19-157SP High-Risk Series Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks Capacity partially met FEMA and USDA continue to take actions to improve stakeholder capacity to increase their resilience to climate change For instance FEMA reported progress at developing information on future conditions for flood maps in June 2017 Additionally USDA’s Climate Hubs continue to deliver relevant science-based knowledge that may improve producers’ capacity to manage climate change impacts for crop insurance Action plan partially met FEMA and USDA have previously identified actions to address aspects of climate change in their programs on an advisory basis in FEMA’s 2015 TMAC Future Conditions report and USDA’s 2016 Building Blocks for Climate Smart Agriculture and Forestry initiative In its 2017 annual report TMAC identified additional actions FEMA could take to advance its development of future conditions products and services such as assessing stakeholders’ highest-priority needs Monitoring not met FEMA has yet to publish metrics and milestones to assess its progress incorporating future conditions into flood map products USDA established milestones for certain actions to improve resilience from 2016 through 2018 but it no longer monitors its progress Demonstrated progress not met The federal government has not implemented our recommendations to improve the resilience of federallyinsured property or address structural weaknesses in each program as described in the following section What Remains to Be Done The federal government needs to incentivize climate resilience by incorporating it into the requirements for federal insurance programs Specifically we made the following recommendations in October 2014 • FEMA should consider amending the floodplain management minimum standards to incorporate forward-looking requirements similar to the minimum flood risk reduction standard adopted by the Hurricane Sandy Rebuilding Task Force FEMA agreed with this recommendation and plans to start implementing it in 2020 • USDA should consider working with agricultural experts to incorporate long-term resilience into the good farming practices that are required for claim payments USDA neither agreed nor disagreed with this recommendation as of this report USDA has not implemented it Congressional Actions Needed Reducing federal fiscal exposure to climate change risks will also require congressional action to address other structural challenges in these insurance programs that send inaccurate price signals to policyholders about their risk of loss or increase the cost of these programs to taxpayers For example Page 112 GAO-19-157SP High-Risk Series Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks Disaster Aid and Resilience • In April 2017 we reported that Congress should consider comprehensive reform to the flood insurance program to improve its solvency and enhance the nation’s resilience to floods including funding for flood mitigation and flood mapping • In July 2017 we reported that Congress should consider repealing certain provisions in the Agricultural Act of 2014 that hinder the crop insurance program’s ability to adjust participating private insurers’ rate of return and share of premiums as changing conditions warrant In September 2018 we reported that the four near-sequential hurricane and wildfire disasters in 2017 created an unprecedented demand for federal disaster resources and that hurricanes Harvey Irma and Maria ranked among the top five costliest hurricanes on record Subsequently fall of 2018 brought additional catastrophic disasters such as Hurricanes Florence and Michael and devastating California wildfires with further needs for federal disaster assistance We have also reported that disaster costs are a key source of federal fiscal exposure and will likely continue to rise Implementing our prior recommendations to improve state and local resilience and adopting adequate budgeting procedures to account for the costs of disasters could help decision makers better manage federal fiscal exposure to climate change In October 2018 the Disaster Recovery Reform Act DRRA of 2018 was enacted DRRA among other things allows the President to set aside with respect to each major disaster a percentage of the estimated aggregate amount of certain grants to use for pre-disaster hazard mitigation and makes federal assistance available to state and local governments for building code administration and enforcement It is too early to tell what impact the implementation of the act will have on state and local resilience and this high-risk rating Additionally we have ongoing work examining managed retreat from vulnerable areas as an option to reduce communities’ exposure to climate change impacts The ratings for this segment remain unchanged at partially met or not met Leadership commitment partially met Leadership commitment remains partially met to reflect action by Congress such as passage of DRRA in October 2018 Additionally according to FEMA’s 2018–2022 Strategic Plan the agency will work with Congress and others to Page 113 GAO-19-157SP High-Risk Series Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks incentivize investments that reduce risk including pre-disaster mitigation and increase the number of properties covered by flood insurance However top leadership support within the executive branch has regressed as related executive orders have been rescinded For example the August 2017 E O 13807 Establishing Discipline and Accountability in the Environmental Review and Permitting Process for Infrastructure Projects revoked E O 13690 which we previously found had partially met this criterion E O 13690 had established a governmentwide federal flood risk management standard to improve the resilience of communities and federal assets against the impacts of flooding Capacity partially met FEMA has continued to improve federal capacity by implementing our July 2015 recommendation to improve its Public Assistance delivery model Additionally as noted previously DRRA allows the president to set aside certain funding for pre-disaster hazard mitigation efforts and requires FEMA to issue guidance on the acquisition of property for open space as a mitigation measure which may improve state and local capacity for resilience Action plan not met The federal government has yet to implement our July 2015 priority recommendation to establish a comprehensive investment strategy to identify prioritize and implement federal disaster resilience investments FEMA and its partners have developed a draft National Mitigation Investment Strategy NMIS that may address this recommendation but it is too early to assess its responsiveness because it has not been finalized although FEMA plans to do so in February 2019 Additionally FEMA’s 2018–2022 strategic plan—issued in March 2018— established the performance targets of doubling the number of properties covered by flood insurance and quadrupling the amount of pre-disaster mitigation by 2022 However without a comprehensive strategy in place to identify and prioritize FEMA’s resilience investments it is unclear whether these efforts will reduce federal fiscal exposure Monitoring not met The federal government has not established a mechanism to track the effectiveness of federal investments in disaster resilience government-wide Demonstrated progress not met The federal government has not developed the information necessary to account for its fiscal exposure to climate change nor a strategy to reduce this exposure as described below What Remains to Be Done The federal government needs to develop the information needed to manage disaster assistance programs’ long-term exposure to climate change and fully implement measures that promote resilience from our Page 114 GAO-19-157SP High-Risk Series Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks prior recommendations and the recently enacted DRRA Specifically the federal government should • implement our April 2018 recommendation to provide concurrent with any future climate change funding reports to Congress funding information for federal programs with fiscal exposure to climate change including costs for disaster assistance programs OMB disagreed with this recommendation and has not implemented it as of this report • implement our July 2015 priority recommendation to develop a comprehensive strategy for identifying prioritizing and implementing investments for disaster resilience by incorporating these elements into the draft NMIS and finalizing it which FEMA plans to do in February 2019 • implement our September 2012 priority recommendation to update the methodology for assessing jurisdictions’ capability to respond and recover from a disaster without federal assistance In 2017 FEMA had proposed establishing a disaster deductible but abandoned this effort in August 2018 in response to public comments FEMA is currently exploring alternative options to update its methodology but it has not provided a timetable for their implementation • implement our March 2011 recommendation to complete a national preparedness assessment of capability gaps at each jurisdiction’s level based on tiered capability-specific performance objectives to enable better prioritization of FEMA grant funding to states and localities FEMA reported that it plans on implementing a new methodology to assess core capabilities by December 2019 and will be able to provide complete assessment results in 2020 • implement our 2003 recommendation to adopt adequate budgeting and forecasting procedures to account for fiscal exposures such as major disaster costs as part of the federal budget process These procedures should provide a comprehensive view of overall funding and the tradeoffs between spending with long-term benefits such as resilience investments and short-term benefits such as post-disaster repairs and recovery OMB neither agreed nor disagreed with this recommendation and has not taken any action to implement it as of this report • consistent with our criteria for removal from the High-Risk List implement its efforts to manage disaster assistance programs’ long-term exposure by 1 defining the responsibilities of federal and other partners 2 identifying the resources necessary to sustain its efforts and 3 tracking its results Page 115 GAO-19-157SP High-Risk Series Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks Federal Government as Property Owner The federal government owns and operates hundreds of thousands of facilities and manages millions of acres of land that could be affected by a changing climate and represent a significant federal fiscal exposure For example the Department of Defense DOD owns and operates domestic and overseas infrastructure with an estimated replacement value of about $1 trillion In September 2018 Hurricane Florence damaged Camp Lejeune and other Marine Corps facilities in North Carolina with a preliminary Marine Corps repair estimate of $3 6 billion One month later Hurricane Michael devastated Tyndall Air Force Base in Florida with a preliminary Air Force repair estimate of $3 billion and upwards of five years to complete the work Implementing our prior recommendations to improve the resilience of federally-owned and operated property by accounting for climate change impacts in planning processes and decisions could reduce federal fiscal exposure to climate change Two ratings for this segment regressed to not met and three others remain unchanged at partially met and not met Leadership commitment partially met Leadership commitment remains partially met to reflect action by Congress such as passage of the National Defense Authorization Act for Fiscal Year 2018 which requires DOD to report on climate change impacts to its installations and to provide an overview of mitigation actions to address them However top leadership support within the executive branch has regressed as executive orders and agencies revoked policies indicating leadership support The August 2017 E O 13807 revoked E O 13690 which we previously found had established a standard for reducing the flood risk of federally-funded projects in flood plains This action potentially increases the federal government’s fiscal exposure to climate change as taxpayer-funded projects may not last as long as intended because they are not required to account for future climate-related changes in risk Capacity not met The May 2018 E O 13834 Regarding Efficient Federal Operations revoked E O 13693 which we previously found had partially met this criterion because it directed federal agencies to incorporate resilient design elements into their facilities as part of federal sustainability goals Additionally in April 2017 the Council on Environmental Quality CEQ rescinded its guidance directing agencies to consider climate change in their National Environmental Policy Act of 1969 NEPA reviews for certain types of federal projects We had Page 116 GAO-19-157SP High-Risk Series Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks previously found that this guidance helped partially meet this criterion Without such guidance agencies no longer have White House direction to consider climate change impacts such as sea level rise when planning federally-funded infrastructure Action plan partially met DOD has made some progress implementing our May 2014 recommendations to consider climate change impacts for its domestic installations In November 2017 we made six recommendations to DOD to also consider climate change impacts for its overseas installations DOD partially concurred with four of these recommendations and non-concurred with two All six recommendations remain open as of this report Further as mentioned above the National Defense Authorization Act for Fiscal Year 2018 requires DOD to provide an overview of mitigation actions to address climate change impacts Monitoring not met E O 13834 revoked E O 13693 which we previously found had partially met this criterion because it established a mechanism for OMB to monitor agencies’ progress toward sustainability goals These goals included federal facilities’ resilience to climate change impacts Demonstrated progress not met The federal government has not implemented our recommendations to improve resilience governmentwide as described in the following section What Remains to be Done The federal government needs a comprehensive approach to improve the resilience of the facilities it owns and operates and land it manages This involves incorporating climate change resilience into agencies’ infrastructure and facility planning processes such as DOD’s efforts to implement our prior recommendations It also involves accounting for climate change in NEPA analyses and working with relevant professional associations to incorporate climate change information into structural design standards We made the following recommendations • In April 2013 we recommended that CEQ should finalize guidance on how federal agencies can consider climate change in their evaluations of proposed federal actions under NEPA CEQ neither agreed nor disagreed with this recommendation but in August 2016 CEQ implemented it by issuing final guidance However in April 2017 CEQ rescinded this guidance • In November 2016 we recommended that the Department of Commerce should convene federal agencies to provide the best available forwardlooking climate information to standards-developing organizations Commerce neither agreed nor disagreed with this recommendation and as of May 2018 Commerce had not implemented it Page 117 GAO-19-157SP High-Risk Series Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks Additionally in our 2017 High-Risk Report we reported that implementing the January 2015 federal flood risk management standard—which required all future federal investments in and affecting floodplains to meet a certain elevation level—would have enhanced federal flood resilience by ensuring agencies addressed current and future flood risk The August 2017 E O 13807 rescinded this standard Further once the federal government provides leadership support to improve the resilience of federal property it should identify the resources necessary to implement its plans sustain its efforts over time and track its results Federal Government as Leader of National Climate Strategic Plan As noted previously as of December 2018 federal obligations and appropriations for disaster assistance are approaching half a trillion dollars since 2005 However the federal government is currently not well organized to address the fiscal exposure presented by climate change partly because of the inherently complicated crosscutting nature of the issue Implementing our prior recommendations such as developing a strategic approach to guide federal adaptation efforts and providing information on related fiscal exposures to Congress could improve the nation’s ability to prepare for and adapt by reducing the government’s fiscal exposure Additionally we have ongoing work on how the federal government could identify and prioritize adaptation projects of national significance Four ratings regressed to not met and one remains unchanged at not met since our 2017 update Leadership commitment not met The March 2017 Executive Order E O 13783 revoked policies including the Climate Action Plan and E O 13653 that we previously found had demonstrated leadership support for reducing aspects of fiscal exposure to climate change Capacity not met The May 2018 E O 13834 revoked E O 13693 which we had previously found partially met this criterion Specifically E O 13693 had directed the Office of Personnel Management to include resilience in federal training and also directed the creation of interagency workgroups to address among other things resilience planning in coordination with states and other stakeholders Page 118 GAO-19-157SP High-Risk Series Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks Action plan not met Executive orders 13783 and 13834 withdrew previous direction to develop adaptation plans and strategic sustainability performance plans that identified agency actions to prepare for climate change impacts and improve resilience As previously mentioned FEMA and its partners have developed a draft National Mitigation Investment Strategy NMIS that may partially meet this criterion if the final version includes a strategy to identify prioritize and implement federal disaster resilience investments However it is too early to assess the NMIS because it has not been finalized although FEMA plans to do so in February 2019 Monitoring not met Executive orders 13783 and 13834 also eliminated monitoring mechanisms that we previously found had partially met this criterion Specifically E O 13783 revoked E O 13653 which had directed agencies to submit adaptation plans to CEQ and OMB for review and E O 13834 revoked E O 13693 which had directed OMB to evaluate agencies’ strategic sustainability performance Demonstrating progress not met The federal government has not implemented key recommendations in this area as described in the following section What Remains to be Done The federal government could better reduce its fiscal exposure if federal efforts were coordinated and directed toward common goals such as improving climate resilience For example entities within the Executive Office of the President EOP including OMB should • implement our May 2011 recommendation to develop a strategic plan to guide the nation’s efforts to adapt to climate change which includes clear priorities that reflect the full range of climate-related federal activities as well as establishes clear roles responsibilities and working relationships among federal state and local governments • implement our September 2017 recommendation to use information on potential economic effects from climate change to help identify significant climate risks and craft appropriate federal responses and • implement our April 2018 recommendation to provide information on fiscal exposures related to climate change to Congress in conjunction with future reports on climate change funding EOP neither agreed nor disagreed with our 2011 recommendation to develop a strategic plan to guide adaptation efforts and our 2017 recommendation to use information on potential economic effects from climate change to identify significant risks and responses OMB disagreed with our 2018 recommendation to provide information on fiscal exposures related to climate change to Congress in conjunction with any future Page 119 GAO-19-157SP High-Risk Series Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks climate change funding reports As of this high-risk update EOP and OMB have not implemented any of these recommendations Further to meet our criteria for removal from the High-Risk List the federal government’s approach will need to include measurable goals identify the responsibilities and relationships among federal state and other entities determine how such efforts will be funded and staffed over time and establish mechanisms to monitor and demonstrate its progress Because decisions at the state and local levels drive much of the federal government’s fiscal exposure coordination between levels of government is essential Technical Assistance to Federal State Local and PrivateSector Decision Makers Decision makers at all levels of government can affect federal fiscal exposure to climate change Specifically state local and private-sector decision makers can drive federal fiscal exposures because they are responsible for planning constructing and maintaining certain types of vulnerable infrastructure paid for with federal funds insured by federal programs or eligible for federal disaster assistance For example the federal government annually invests billions of dollars in infrastructure that state and local governments plan and build To reduce fiscal exposure the federal government has a role to play in providing information to decision makers at all levels so they can make more informed choices about how to manage climate change risks Two ratings for this segment regressed to not met and three others remain unchanged at not met Leadership commitment not met The March 2017 E O 13783 revoked the Climate Action Plan and E O 13653 that we previously found had partially met this criterion because they demonstrated top leadership support for federal technical assistance Capacity not met Under the Global Change Research Act of 1990 the administration released the Fourth National Climate Assessment in November 2018 which summarizes the impacts of climate change on the U S and provides some web-based tools to help people understand and manage their climate-related risk However this criterion remains not met because the resources and government-wide structure for providing technical assistance to decision makers—with clear roles responsibilities and working relationships among federal state local and private-sector entities—remain undefined We have made multiple recommendations to Page 120 GAO-19-157SP High-Risk Series Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks the EOP to address these issues however the EOP has yet to make progress implementing them Additionally E O 13783 revoked E O 13653 which had directed federal agencies to develop and provide authoritative and accessible climate information to support federal and nonfederal decision makers Action plan not met We had previously found that E O 13653 and the Climate Action Plan had partially met this criterion because they outlined some steps for federal agencies to provide information to support resilience However these policies were revoked by E O 13783 Monitoring not met There are still no programs or mechanisms to monitor government-wide progress in addressing the challenges we have identified related to the federal government’s role in providing climaterelated technical assistance These challenges include clarifying the roles responsibilities and working relationships among federal state local and private-sector entities identifying the necessary resources and establishing the government-wide structure necessary to implement plans and addressing the fragmentation of federal climate information across individual agencies that use the information in different ways to meet their missions Demonstrated progress not met The federal government has not implemented our recommendations to improve its technical assistance to decision makers as described in the following section What Remains to be Done The federal government needs a government-wide approach for providing federal state local and private-sector decision makers with 1 the best available climate-related information and 2 assistance for translating climate-related data into accessible information In November 2015 we found that federal efforts such as the National Climate Assessment provide useful information about climate change impacts However we also found that these efforts did not fully meet the climate information needs of federal state local and private sector decision makers which hinders their planning efforts We found that these decision makers would benefit from a national climate information system that would develop and update authoritative climate observations and projections specifically for use in decision-making As a result we recommended that EOP should • designate a federal entity to develop and periodically update a set of authoritative climate observations and projections for use in federal decision-making which other decision makers could also access and Page 121 GAO-19-157SP High-Risk Series Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks • designate a federal entity to create a national climate information system with defined roles for federal agencies and nonfederal entities with existing statutory authority EOP neither agreed nor disagreed with our recommendations and as of this report has not implemented them Related GAO Products 2017 Hurricanes and Wildfires Initial Observations on the Federal Response and Key Recovery Challenges GAO-18-472 Washington D C September 4 2018 Climate Change Analysis of Reported Federal Funding GAO-18-223 Washington D C April 30 2018 Climate Change Adaptation DOD Needs to Better Incorporate Adaptation into Planning and Overseas Installations GAO-18-206 Washington D C November 13 2017 Disaster Assistance Opportunities to Enhance Implementation of the Redesigned Public Assistance Grant Program GAO-18-30 Washington D C November 8 2017 Climate Change Information on Potential Economic Effects Could Help Guide Federal Efforts to Reduce Fiscal Exposure GAO-17-720 Washington D C September 28 2017 Crop Insurance Opportunities Exist to Improve Program Delivery and Reduce Costs GAO-17-501 Washington D C July 26 2017 Flood Insurance Comprehensive Reform Could Improve Solvency and Enhance Resilience GAO-17-425 Washington D C April 27 2017 Climate Change Improved Federal Coordination Could Facilitate Use of Forward-Looking Climate Information in Design Standards Building Codes and Certifications GAO-17-3 Washington D C November 30 2016 Climate Information A National System Could Help Federal State Local and Private Sector Decision Makers Use Climate Information GAO-16-37 Washington D C November 23 2015 Climate Change Better Management of Exposure to Potential Future Losses Is Needed for Federal Flood and Crop Insurance GAO-15-28 Washington D C October 29 2014 Page 122 GAO-19-157SP High-Risk Series Improving the Management of IT Acquisitions and Operations Improving the Management of IT Acquisitions and Operations To better manage billions of dollars in information technology IT investments the Office of Management and Budget OMB and other federal agencies should further implement the requirements of federal IT acquisition reforms Why Area Is High Risk The executive branch has undertaken numerous initiatives to better manage the more than $90 billion that is annually invested in IT However federal IT investments too frequently fail or incur cost overruns and schedule slippages while contributing little to mission-related outcomes These investments often suffered from a lack of disciplined and effective management such as project planning requirements definition and program oversight and governance In 2015 we added the government’s management of IT acquisitions and operations to the High-Risk list Recognizing the severity of issues related to the government-wide management of IT in December 2014 Congress and the President enacted federal IT acquisition reform legislation in November 2017 the sunset dates of several of these statutory provisions were extended or removed Among other things these laws require covered agencies to 1 enhance agency CIO authority 2 enhance transparency and improve risk management 3 consolidate federal data centers 4 review IT investment portfolios 5 purchase government-wide software licenses 6 maximize the benefit of federal strategic sourcing and 7 expand training and use of IT acquisition cadres Contact Information For additional information about this high-risk area contact Carol Harris at 202-512-4456 or harriscc@gao gov Since our 2017 High-Risk Report ratings for all five criteria remain unchanged Leadership commitment met OMB continues to demonstrate its leadership commitment by 1 issuing guidance for covered departments and agencies agencies to implement statutory provisions commonly referred to as the Federal Information Technology Acquisition Reform Act FITARA 2 optimizing federal data centers and 3 acquiring and managing software licenses It will be important for OMB to maintain its current level of top leadership support and commitment to ensure that agencies successfully execute OMB’s guidance on implementing FITARA and related IT initiatives Sustained Congressional focus on implementing FITARA has led to improvement as highlighted in agencies’ FITARA implementation scores issued biannually by the House Committee on Oversight and Reform However further Executive branch and Congressional attention is required Capacity partially met OMB has established guidance for FITARA and related IT management practices that addresses how agencies are to implement roles and responsibilities The guidance covers among other things enhancing the authority of federal chief information officers CIO and ensuring that program staff has the necessary knowledge and skills to effectively acquire IT As we reported in August 2018 none of the 24 major federal agencies had IT management policies that fully addressed the role of their CIOs consistent with federal laws and guidance The majority of the agencies minimally addressed or did not address their CIO’s role in assessing agency IT workforce needs and developing strategies and plans for meeting those needs Correspondingly the majority of the 24 CIOs acknowledged they were not fully effective at implementing IT workforce responsibilities In November 2016 we reported that while the five agencies we reviewed had demonstrated important progress in implementing key IT workforce planning activities each had shortfalls For example four agencies had Page 123 GAO-19-157SP High-Risk Series Improving the Management of IT Acquisitions and Operations not demonstrated an established IT workforce planning process All five agencies either agreed or partially agreed with our recommendations and identified planned actions to address our recommendations to improve their IT workforce planning However as of December 2018 none of our recommendations had been fully implemented Action plan partially met In addition to requiring covered agencies to conduct self-assessments OMB’s FITARA implementation guidance requires agencies to develop and implement plans describing changes they will make to ensure that IT management responsibilities for CIOs and other senior agency officials are effectively implemented These plans are to address the areas of IT management that we have identified as high risk such as reviewing poorly performing investments managing agencies’ IT portfolios and implementing incremental development While all 24 major federal agencies have developed FITARA implementation plans the agencies need to demonstrate additional progress in effectively implementing these plans As of December 2018 our continuing work to monitor progress in this area showed that 22 of the 24 major federal agencies had publicly reported at least partial completion of their FITARA milestones however all 22 of those agencies also reported incomplete milestones Significant work remains for federal agencies to establish action plans to modernize or replace obsolete IT investments In May 2016 we reported that agencies were using systems which had components that were in some cases at least 50 years old To address this issue we recommended that 12 agencies identify and plan to modernize or replace legacy systems including establishing time frames activities to be performed and system functions to be replaced or enhanced Of the 12 agencies 10 either concurred or partially concurred with our recommendations while 2 stated they had no comment However as of December 2018 only 3 of the 12 agencies had implemented our recommendation and made progress in planning to modernize their legacy systems Monitoring partially met The President’s Management Agenda identified improving IT spending transparency as one of the Administration’s 14 cross-agency priority goals and tasked OMB with leading the drive towards better agency reporting on IT spending In January 2018 we reported that the majority of 22 agencies that we reviewed did not identify all of their IT contracts leaving about $4 5 billion in IT-related contract obligations beyond those reported by agencies Further in November 2018 we reported that four selected agencies lacked quality assurance processes for ensuring that billions of dollars requested in their IT budgets were informed by reliable cost information We made recommendations for those agencies to improve how IT Page 124 GAO-19-157SP High-Risk Series Improving the Management of IT Acquisitions and Operations acquisitions are identified and to establish procedures for ensuring IT budgets are informed by reliable cost information Until agencies properly identify IT acquisitions and establish processes for ensuring the quality of cost data used to inform their IT budgets agency CIOs are at risk of not having appropriate oversight of IT acquisitions worth billions of dollars and not having adequate transparency into IT spending to make informed budget decisions OMB has taken action to improve monitoring through its IT Dashboard—a public website that provides detailed information on major IT investments at 26 federal agencies including ratings from CIOs that should reflect the level of risk facing each investment However in June 2016 we reported that our assessments of IT Dashboard risk ratings showed more risk on the majority of agency IT investments we sampled than did the associated CIO ratings Consequently we made 25 recommendations to 15 agencies to improve their CIO’s risk ratings 12 agencies generally agreed with or did not comment on our recommendations and 3 disagreed As of December 2018 only 14 of the recommendations had been fully implemented Agencies should continue to fully and accurately report on these risks to ensure their IT investments receive appropriate oversight An additional area of concern regarding the monitoring of IT acquisitions is agencies’ reported use of incremental development OMB policy requires that IT investments deliver functionality in 6-month increments However our May 2014 report found that delivery rate to be challenging for agencies and thus we recommended that OMB instead require increments of 12 months While OMB disagreed with our recommendation our continuing work in this area has found that most agencies have reported progress in improving the rate at which their IT acquisitions deliver functionality at the 12-month rate Nonetheless in November 2017 we reported that most agencies lacked the required policies intended to ensure adequate consideration of incremental development approaches for major IT investments and we made 19 recommendations to 17 agencies to address this issue Eleven agencies agreed with our recommendations 1 partially agreed and 5 did not state whether they agreed or disagreed As of December 2018 11 of our 19 recommendations remained open Demonstrated progress partially met In our 2017 high-risk update we identified agency plans to save $5 3 billion from data center consolidation a number which included $3 3 billion planned through fiscal year 2015 Agencies subsequently reported achieving $2 8 billion of that amount In 2016 OMB issued new guidance on consolidating data centers and subsequently a number of agencies revised their planned savings resulting in $2 4 billion planned from fiscal years 2016 through 2018 As of August 2018 our continuing work to monitor progress in this area has Page 125 GAO-19-157SP High-Risk Series Improving the Management of IT Acquisitions and Operations shown that over $1 9 billion of that savings had been achieved The total achieved savings of $4 7 billion represents slightly more than 80 percent of the agencies’ planned $5 7 billion in savings since 2011 In our 2017 high-risk update we cited this 80 percent target as one of several actions that should be taken and recognize the positive government-wide progress this demonstrates However improvement is still needed in other areas Since fiscal year 2010 we have made 1 242 recommendations to address shortcomings in IT acquisitions and operations 514 since this area was added to the High-Risk List in February 2015 As of December 2018 OMB and federal agencies had fully implemented only 735 or about 59 percent of the total recommendations and only 169 about 33 percent of the recommendations made since February 2015 In addition agencies have made progress in achieving about $2 5 billion in savings across a key OMB initiative—PortfolioStat—intended to improve the management of IT investments by consolidating and eliminating duplicative systems among other things Through fiscal year 2016 agencies had saved almost $1 8 billion with more than $754 million in fiscal year 2017 Nevertheless agencies have approximately $3 5 billion in their reported planned savings still to be achieved What Remains to Be Done As we have recommended OMB and covered federal agencies should further implement the requirements of FITARA OMB will need to provide sustained oversight to ensure that agency actions are completed and the desired results are achieved • Beyond implementing FITARA and OMB’s guidance to improve the capacity to address our high-risk area agencies need to implement our recent recommendations related to improving CIO authorities as well as past recommendations on improving IT workforce planning practices • Agencies must establish action plans to modernize or replace obsolete IT investments • Agencies need to implement our recommendations to address weaknesses in their IT Dashboard reporting of investment risk and incremental development implementation • OMB and agencies should work toward implementing our remaining 456 open recommendations related to this high-risk area These remaining recommendations include 12 priority recommendations for agencies to among other things report all data center consolidation cost savings to OMB plan to modernize or replace obsolete systems as needed and improve their implementation of PortfolioStat OMB and agencies need to take additional actions to 1 implement at least 80 percent of our open recommendations related to the management of IT acquisitions and operations 2 ensure that a minimum of 80 percent of the government’s Page 126 GAO-19-157SP High-Risk Series Improving the Management of IT Acquisitions and Operations major IT acquisitions deliver functionality every 12 months and 3 achieve at least 80 percent of the over $6 billion in planned PortfolioStat savings Related GAO Products Information Technology Departments Need to Improve Chief Information Officers’ Review and Approval of IT Budgets GAO-19-49 Washington D C November 13 2018 Federal Chief Information Officers Critical Actions Needed to Address Shortcomings and Challenges in Implementing Responsibilities GAO-18-93 Washington D C August 2 2018 Data Center Optimization Continued Agency Actions Needed to Meet Goals and Address Prior Recommendations GAO-18-264 Washington D C May 23 2018 Information Technology Agencies Need to Involve Chief Information Officers in Reviewing Billions of Dollars in Acquisitions GAO-18-42 Washington D C January 10 2018 Information Technology OMB Needs to Report On and Improve Its Oversight of the Highest Priority Programs GAO-18-51 Washington D C November 21 2017 Information Technology Reform Agencies Need to Improve Certification of Incremental Development GAO-18-148 Washington D C November 7 2017 Data Center Optimization Agencies Need to Address Challenges and Improve Progress to Achieve Cost Savings Goal GAO-17-448 Washington D C August 15 2017 Data Center Optimization Agencies Need to Complete Plans to Address Inconsistencies in Reported Savings GAO-17-388 Washington D C May 18 2017 Information Technology Opportunities for Improving Acquisitions and Operations GAO-17-251SP Washington D C April 11 2017 Page 127 GAO-19-157SP High-Risk Series Improving Federal Management of Programs that Serve Tribes and Their Members Improving Federal Management of Programs that Serve Tribes and Their Members The Bureau of Indian Education BIE Indian Health Service IHS and Bureau of Indian Affairs BIA have demonstrated some progress in all high-risk area segments All three agencies continue to face challenges retaining permanent leadership and a sufficient workforce Why Area Is High Risk Because our work has shown federal agencies have ineffectively administered Indian education and health care programs and inefficiently met their responsibility for managing the development of Indian energy resources we added this area to our High-Risk List in 2017 It includes three components across agencies in two departments including BIE and BIA under Interior’s Office of the Assistant-Secretary of Indian Affairs Indian Affairs and IHS in Health and Human Services Education BIE challenges included poor conditions at BIE school facilities that endangered students and the agency’s weak oversight of school spending Health care HHS’s inadequate oversight has hindered IHS’s ability to ensure that Indian communities have timely access to quality health care Energy BIA mismanagement of Indian energy resources held in trust limited opportunities for tribes and their members to use those resources to create economic benefits and improve the well-being of their communities Contact Information For additional information about this high-risk area and our Indian Education work contact Melissa Emrey-Arras at 617 788-0534 or emreyarrasm@gao gov for our Indian Health work contact Jessica Farb at 202 512-7114 or farbj@gao gov and for our Indian Energy work contact Frank Rusco at 202 512-3841 or ruscof@gao gov We added this area to our HighRisk List in 2017 and are assessing all three segments against our high-risk criteria for the first time Overall the three agencies have partially met the leadership commitment capacity action plan monitoring and demonstrated progress criteria for the education health care and energy areas Since we added this area to our High-Risk List in 2017 we have testified at seven congressional hearings We believe that it is vital for Congress to maintain its focus on improving the effectiveness with which federal agencies meet their responsibilities to serve tribes and their members in these areas When we added this area to our High-Risk List in February 2017 there were 39 open recommendations Since then we added 13 recommendations As of December 2018 32 recommendations remain open Education The education segment has partially met all five criteria for addressing high-risk issues Leadership commitment partially met Indian Affairs leaders have shown commitment to addressing key weaknesses in the management of BIE schools For example the BIE Director formed an internal working group convened meetings with other senior leaders within Indian Affairs and publicly stated that his agency is committed to implementing our recommendations We also met with the new Assistant Secretary-Indian Affairs who expressed her commitment to supporting the agency’s efforts Page 128 GAO-19-157SP High-Risk Series Improving Federal Management of Programs that Serve Tribes and Their Members to address weaknesses in the management of BIE schools However frequent turnover in key leadership positions in recent years has hampered Indian Affairs’ efforts to make improvements to Indian education Capacity partially met BIE and other Indian Affairs offices that support BIE schools have made some progress in increasing their capacity to address risks to Indian education For example BIE officials hired a full-time program analyst to coordinate the agency’s working group and help oversee the implementation of our recommendations However about 50 percent of all BIE positions have not been filled and the bureau has not completed a workforce plan to address staffing and training gaps as we previously recommended BIE officials told us they are developing a workforce plan which they plan to complete by the end of 2018 Action plan partially met Among other actions BIE implemented a new action plan including written procedures and risk criteria for overseeing BIE school expenditures which fully addressed two priority recommendations However Indian Affairs has not provided documentation that it has developed and put in place action plans on other important issues such as a comprehensive long-term capital asset plan to inform its allocation of school facility funds which we recommended Monitoring partially met Indian Affairs in consultation with Department of Interior’s Office of Occupational Safety and Health has taken actions to monitor corrective measures that address weaknesses with the agency’s safety program—which covers safety at BIE schools However the agency has not yet demonstrated that it is monitoring several other areas such as whether relevant employees are being held to the agency’s required performance standards for safety inspections Demonstrated progress partially met Since our 2017 High-Risk report Indian Affairs has fully addressed 11 of our 23 outstanding recommendations on Indian education Overall this represents a substantial increase in implementing our recommendations on Indian education since we identified the area as high-risk Significant work however remains to address our outstanding recommendations in several key areas such as workforce planning and accountability for BIE school safety and school construction projects What Remains to Be Done Continued progress will depend on sustained direction and support of top management in Indian Affairs and BIE In addition to increase its capacity to support functions related to administering and overseeing BIE schools BIE needs to conduct strategic workforce planning and determine how Page 129 GAO-19-157SP High-Risk Series Improving Federal Management of Programs that Serve Tribes and Their Members best to align its human capital program with its mission and programmatic goals as we have recommended As of December 2018 12 recommendations related to this high-risk area remain open and Indian Affairs concurred with all 12 recommendations IHS has partially met all five criteria to address the health care high-risk segment Health Care Leadership commitment partially met IHS officials have demonstrated leadership commitment by regularly meeting with us to discuss the agency’s progress in addressing our recommendations In addition IHS has chartered a policy advisory council that will focus on issues related to strategic direction recommended policy and organizational adjustments According to IHS this advisory council will among other things serve as a liaison among IHS leadership for issues involving strategic direction and policy as well as monitor and facilitate related policy workgroups However IHS still does not have permanent leadership—including a Director of IHS Capacity partially met Among other actions IHS officials stated that the agency is expanding the role of internal audit staff within its enterprise risk management program to augment internal audits and complement both the Department of Health and Human Services Inspector General and our audits In addition IHS has developed a new Office of Quality which is expected to develop and monitor agency-wide quality of care standards However according to IHS there are still vacancies in several key positions Action plan partially met IHS is in the final stages of developing a strategic plan and a related work plan to address certain root causes of management challenges and define solutions and corrective measures for the agency The draft strategic plan divides these challenges into three categories 1 access to care 2 quality of care and 3 program management and operations We will examine the final strategic plan and related work plan to determine whether they contain the needed elements of an action plan once issued Monitoring partially met IHS has taken some steps toward monitoring the agency’s progress in addressing the root causes of their management weaknesses In addition to developing its new Office of Quality IHS has taken steps to develop a patient experience of care survey as well as standards for tracking patient wait times These efforts should be Page 130 GAO-19-157SP High-Risk Series Improving Federal Management of Programs that Serve Tribes and Their Members reflected in the agency’s corrective plan as part of an overall framework for monitoring progress that includes goals and performance measures to track their efforts and ultimately verify the effectiveness of their efforts Demonstrated progress partially met IHS has made progress in implementing corrective actions related to the management of health care programs Specifically since our 2017 High-Risk report IHS implemented four of our 13 open recommendations For example in response to our April 2013 recommendation to ensure that IHS’s payment rates for contracted services do not impede patient access to physician and other nonhospital care IHS developed an online tool that enables the agency to track providers that do not accept IHS’s payment rates In addition IHS officials told us that they plan to complete the implementation of additional recommendations in 2019 What Remains to Be Done We have identified several priority actions for IHS in its role of providing accessible health care services to Indian tribes • IHS needs to ensure stable permanent leadership that can assign the tasks needed to address weaknesses and hold individuals accountable for progress • IHS needs to continue to develop a corrective action plan that defines root causes identifies solutions and provides for substantially completing corrective measures • IHS needs to set up goals and performance measures to monitor the outcomes from its action plan • IHS needs to continue to address our open recommendations in this area including 1 ensuring that agency-wide standards for the quality of care are developed that facility performance in meeting these standards is systematically monitored over time and that enhancements are made to its adverse event reporting system and 2 monitoring patient wait times and ensuring corrective actions are taken when standards are not met As of December 2018 7 out of the 13 recommendations in our 2017 High-Risk report remain open and we have added one additional recommendation—for a total of 8 open recommendations related to this high-risk area IHS fully concurred with these 8 recommendations Congressional Actions Needed We have an open matter for Congress to consider requiring IHS to develop and use a new method to more equitably allocate Purchased Referred Care program funds—which allow patients to receive care from external providers—across areas Page 131 GAO-19-157SP High-Risk Series Improving Federal Management of Programs that Serve Tribes and Their Members BIA has partially met all five criteria to address the energy high-risk segment Energy Leadership commitment partially met In June 2018 a permanent Assistant Secretary for Indian Affairs was confirmed This action provided an opportunity to improve Indian Affairs’ oversight of federal actions associated with energy development However BIA does not have a permanent Director and BIA’s Office of Trust Services—which has significant responsibility over Indian energy activities—does not have a permanent Director or Deputy Director Capacity partially met In November 2016 we recommended that BIA establish a documented process for assessing the workforce at its agency offices BIA conducted a survey to identify workforce needs related to energy development to support staffing decisions at the new Indian Energy Service Center However BIA officials said the agency does not have the staff or resources to implement a comprehensive workforce planning system to ensure it has staff in place at its agency offices to meet its organization needs Action plan partially met BIA officials met with us several times in fiscal year 2018 to discuss actions and plans for implementing our recommendations related to Indian energy resources BIA officials told us that they proposed several modifications to the bureau’s land records data management system that will enable increased tracking and monitoring of key documents that BIA must review prior to the development of Indian energy resources However the agency does not have a comprehensive plan in place to identify causes of long-standing management weaknesses or an action plan to address the problems Monitoring partially met BIA has taken steps to improve monitoring by holding frequent meetings assessing its progress in implementing our recommendations However BIA has not taken steps to monitor its progress addressing the root causes of management weaknesses Demonstrated progress partially met BIA has shown significant progress developing data collection instruments and processes needed to track and review response times for a number of different actions associated with energy development However more needs to be done to close open recommendations as discussed below Page 132 GAO-19-157SP High-Risk Series Improving Federal Management of Programs that Serve Tribes and Their Members What Remains to be Done BIA needs to 1 provide decision makers with key information on resources needed to assess the composition of its workforce and implement a comprehensive workforce planning system and 2 continue to identify causes of weaknesses with the management of Indian energy and mineral resources and develop a plan to address these problems with clear milestones well-defined performance measures and a monitoring approach As of December 2018 12 of the 14 recommendations in our 2017 High-Risk report remain open BIA fully concurred with all 12 recommendations Related GAO Products Indian Health Service Agency Faces Ongoing Challenges Filling Provider Vacancies GAO-18-580 Washington D C August 15 2018 High Risk Agencies Need to Continue Efforts to Address Management Weaknesses of Federal Programs Serving Indian Tribes GAO-18-616T Washington D C June 13 2018 High Risk Status of Prior Recommendations on Federal Management of Programs Serving Indian Tribes GAO-17-790T Washington D C September 13 2017 Indian Affairs Further Actions Needed to Improve Oversight and Accountability for School Safety Inspections GAO-17-421 Washington D C May 24 2017 Indian Affairs Actions Needed to Better Manage Indian School Construction Projects GAO-17-447 Washington D C May 24 2017 Indian Health Service Actions Needed to Improve Oversight of Quality of Care GAO-17-181 Washington D C January 9 2017 Indian Energy Development Additional Actions by Federal Agencies Are Needed to Overcome Factors Hindering Development GAO-17-43 Washington D C November 10 2016 Indian Health Service Actions Needed to Improve Oversight of Patient Wait Times GAO-16-333 Washington D C March 29 2016 Page 133 GAO-19-157SP High-Risk Series 2020 Decennial Census 2020 Decennial Census For the 2020 Census the U S Census Bureau Bureau plans to implement several innovations including new IT systems The challenges associated with successfully implementing these innovations along with other challenges puts the Bureau’s ability to conduct a cost-effective census at risk Why Area Is High Risk The U S Census is mandated by the Constitution and provides vital data for the nation Census data are used among other purposes to apportion the seats of the U S House of Representatives redraw congressional districts in each state and allocate billions of dollars each year in federal financial assistance Further businesses use census data to market new services and products and to tailor existing ones to demographic changes The Bureau is seeking to control the cost of the census which has been escalating with each decade The 2020 Census is now estimated to cost approximately $15 6 billion Moreover the average cost for counting a housing unit increased from about $16 in 1970 to around $92 in 2010 in 2020 constant dollars in part because the nation’s population is more difficult to count The Bureau is also implementing several new innovations that require managing the processes of acquiring and developing new and modified IT systems In addition because the 2020 Census involves collecting personal information from over a hundred million households it will be important that the Bureau addresses system security weaknesses in a timely manner and that risks are at an acceptable level before systems are deployed Contact Information For additional information about this high-risk area contact Robert Goldenkoff at 202-512-2757 or goldenkoffr@gao gov or Nick Marinos at 202-512-9342 or marinosn@gao gov The 2020 Decennial Census was first added in 2017 as a high-risk area Since then the Bureau has met the criterion for leadership commitment and made progress on the other four criteria Leadership commitment met The Bureau and the Department of Commerce have strengthened this area with executive-level oversight of the 2020 Census by holding regular meetings on the status of IT systems and other risk areas In addition in 2017 the Department of Commerce designated a team to assist senior Bureau management with cost estimation challenges Moreover on January 2 2019 a new Director of the Census Bureau took office a position that had been vacant since June 2017 and in June 2018 the once-vacant Deputy Director position was filled Capacity partially met To enhance the capacity of its Decennial Directorate the Bureau brought in new leadership in October 2017 with significant experience in program execution The Bureau also improved the cost estimation process of the decennial when it established guidance including • roles and responsibilities for oversight and approval of cost estimation processes • procedures requiring a detailed description of the steps taken to produce a high-quality cost estimate and • a process for updating the cost estimate and associated documents over the life of a project However the Bureau continues to experience skills gaps in the government program management office overseeing the $886 million contract for integrating the IT systems needed to conduct the 2020 Census Specifically as of November 2018 21 of 44 positions in this office were vacant These vacant positions add risk that the office may not be able to provide adequate oversight of contractor cost schedule and performance Page 134 GAO-19-157SP High-Risk Series 2020 Decennial Census Action plan partially met In December 2018 the Bureau issued an updated operational plan for the 2020 Census that laid out risks decisions made issues to be resolved and related milestones for each of its major operations However the 2020 Census schedule lacks a risk assessment and certain other best scheduling practices which affects its overall reliability In addition during the 2018 End-to-End Test we found the Bureau’s data management reporting system did not always provide accurate information because of a software issue As a result Bureau staff had to rely on multiple systems to manage field operations making monitoring inefficient Monitoring partially met The Department of Commerce holds biweekly meetings with Bureau leadership to discuss the status of 2020 Census operations including our open recommendations To track performance of decennial census operations the Bureau relied on reports to track progress against pre-set goals for a test conducted in 2018 According to the Bureau these same reports will be used in 2020 to track progress The Bureau has also taken steps to improve its cost estimation process for 2020 however it needs to implement a system to track and report variances between actual and expected cost elements Further the Bureau’s schedule for developing IT systems during the 2018 End-to-End Test experienced delays that compressed the time available for system testing integration testing and security assessments These schedule delays contributed to systems experiencing problems after deployment as well as cybersecurity challenges For example as of December 2018 the Bureau had identified nearly 1 100 system security weaknesses that needed to be addressed Demonstrated progress partially met According to Department of Commerce officials in the summer of 2018 the Bureau began conducting an analysis of oversight recommendations including ours to determine the root cause of shortfalls and set a timeline for addressing those recommendations and related root causes We have standing quarterly meetings with Senior Bureau officials to discuss the status and expected actions for our open recommendations related to the 2020 Census We also periodically meet with the Under Secretary for Economic Affairs to discuss the Department of Commerce’s oversight of the decennial census The Bureau is also using the cost estimate as a management tool for making decisions and assessing tradeoffs For example the cost estimate served as the basis for the fiscal year 2019 funding request developed by the Bureau The Bureau also said it used the 2020 Census cost estimate to establish cost controls during budget formulation activities and to monitor spending levels for fiscal year 2019 activities Page 135 GAO-19-157SP High-Risk Series 2020 Decennial Census While these actions and others are important steps forward we found that the Bureau scaled back testing of new innovations in 2017 and 2018 Specifically the Bureau cancelled the field portion of the 2017 test and then conducted a full operational test in only one site—Providence County Rhode Island—instead of three test sites as originally planned Moreover the Bureau did not test all 2020 Census systems and IT capabilities during its operational test Not fully testing innovations and IT systems as designed increases the risk that innovations and IT systems will not function as intended during the 2020 Census What Remains to Be Done As of January 2019 we have made 97 recommendations related to the 2020 Census The Bureau has implemented 67 of these recommendations and 30 remain open The Department of Commerce generally agreed with our recommendations and is taking steps to implement them Moreover in our April 2018 priority recommendation letter to the Department of Commerce we identified 15 recommendations as priority—seven of which have been closed as implemented over the past year To make continued progress the Bureau needs to ensure its approach to strategic planning IT management cybersecurity human capital management internal collaboration knowledge sharing as well as risk and change management are aligned toward delivering more costeffective outcomes Specifically the Bureau needs to • fill vacant positions in its government program management office as needed to oversee the IT integration contractor • implement best practices for scheduling the thousands of activities that make up the 2020 Census • improve the management and oversight of its IT systems in order to meet milestones for system development and testing and be ready for the major operations of the 2020 Census • address cybersecurity weaknesses in a timely manner and ensure that risks are at an acceptable level before systems are deployed • implement cost estimation best practices including a system to track and report variances between actual and expected costs for its 2020 Census cost estimate • resolve implementation issues that have arisen during testing prior to the 2020 Census and • continue to address our recommendations especially those designated priority recommendations Congressional Actions Needed In 2017 and 2018 we testified in five congressional hearings focused on the progress of the Bureau’s preparations for the decennial census Going forward continued congressional oversight will be needed to ensure decennial efforts stay on track the Bureau has needed resources Page 136 GAO-19-157SP High-Risk Series 2020 Decennial Census and Bureau officials are held accountable for implementing the enumeration as planned Related GAO Products 2020 Census Additional Steps Needed to Finalize Readiness for Peak Field Operations GAO-19-140 Washington D C December 10 2018 2020 Census Continued Management Attention Needed to Address Challenges and Risks with Developing Testing and Securing IT Systems GAO-18-655 Washington D C August 30 2018 2020 Census Census Bureau Improved the Quality of Its Cost Estimation but Additional Steps Are Needed to Ensure Reliability GAO-18-635 Washington D C August 17 2018 2020 Census Bureau Has Made Progress with Its Scheduling but Further Improvement Will Help Inform Management Decisions GAO-18-589 Washington D C July 26 2018 2020 Census Actions Needed to Address Challenges to Enumerating Hard-to-Count Groups GAO-18-599 Washington D C July 26 2018 2020 Census Actions Needed to Improve In-Field Address Canvassing Operation GAO-18-414 Washington D C June 14 2018 2020 Census Actions Needed to Mitigate Key Risks Jeopardizing a CostEffective and Secure Enumeration GAO-18-543T Washington D C May 8 2018 2020 Census Continued Management Attention Needed to Mitigate Key Risks Jeopardizing a Cost-Effective and Secure Enumeration GAO-18-416T Washington D C April 18 2018 2020 Census Actions Needed to Mitigate Key Risks Jeopardizing a CostEffective Enumeration GAO-18-215T Washington D C October 31 2017 2020 Census Continued Management Attention Needed to Oversee Innovations Develop and Secure IT Systems and Improve Cost Estimation GAO-18-141T Washington D C October 12 2017 2020 Census Bureau Is Taking Steps to Address Limitations of Administrative Records GAO-17-664 Washington D C July 26 2017 Page 137 GAO-19-157SP High-Risk Series U S Government’s Environmental Liability U S Government’s Environmental Liability The federal government’s environmental liability is vast and growing and the Departments of Energy DOE and Defense DOD which bear the bulk of this liability need to take steps to address the environmental risks and to monitor report on and better understand this liability Why Area Is High Risk The federal government's environmental liability has been growing for the past 20 years and this rise is likely to continue even as billions are spent each year on cleanup efforts For fiscal year 2017 the federal government's estimated environmental liability was $465 billion— up from $212 billion since fiscal year 1997 We added this area to our HighRisk List in 2017 DOE is responsible for the largest share of the liability $384 billion or about 83 percent related primarily to retrieving treating and disposing of nuclear and hazardous waste DOD is responsible for the second-largest share $68 billion or about 15 percent related primarily to environmental cleanup and restoration activities at its installations The remaining liability is shared among other agencies including the Departments of Transportation Veterans Affairs Interior and Agriculture DOE’s liability grew by $110 billion to $494 billion in fiscal year 2018 primarily due to an increase in the estimated cost of the cleanup at the Hanford Site in Washington State The total liability for the rest of the federal government in fiscal year 2018 was not available at the time this report was published Even with the increase however DOE’s cleanup responsibilities may be underestimated because under federal accounting standards environmental liability estimates do not include cost estimates for work for which reasonable estimates cannot currently be generated Contact Information For additional information about this high-risk area contact David Trimble at 202-512-3841 or trimbled@gao gov The U S Government’s Environmental Liability was first added in 2017 as a high-risk area Since then DOD and DOE have partially met the leadership commitment criteria but have not met any of the other criteria Leadership commitment partially met Officials at both DOE and DOD have taken steps to focus more attention on the environmental liabilities of their respective agencies For example in July 2017 DOE’s Office of Environmental Management DOE-EM issued a new cleanup policy that established requirements for DOE’s environmental management cleanup program In addition the Assistant Secretary for Environmental Management acknowledged in September 2018 that additional work needs to be done to address DOE’s growing environmental liabilities and announced plans to develop a strategic plan as well as specific plans for each of its sites DOD established an Environmental Liabilities Working Group in 2014 that is co-chaired by senior DOD officials and provides a forum for DOD and its components to share liability estimating methodologies best practices and lessons learned In November 2018 as part of a department-wide audit conducted by the DOD Inspector General DOD’s environmental liabilities were audited by an independent public accounting firm for the first time The Inspector General issued a disclaimer of opinion on the department-wide financial statements with environmental liabilities identified as one of the material weaknesses Capacity not met Both DOE and DOD have significant gaps in their ability to effectively address their portions of the environmental liability For instance DOE-EM does not collect or maintain reliable cost schedule or milestone data on its projects Therefore it lacks the information needed to evaluate overall project and program performance and assess whether it has sufficient staff—or the staff with the right skills—to carry out the cleanup mission In addition DOE’s budget requests do not disclose the future funding it anticipates needing to meet its schedule milestones for cleanup of legacy defense waste Page 138 GAO-19-157SP High-Risk Series U S Government’s Environmental Liability The recent audit of DOD’s environmental liabilities found that DOD did not consistently design document and implement controls over its environmental and disposal liabilities and did not appropriately prepare cost estimates for certain types of environmental liabilities For example auditors found that in developing its environmental liabilities cost estimates DOD did not 1 include all required cost elements 2 adjust the estimates to reflect current dollars 3 use current data and the correct inputs and 4 ensure estimates were reviewed by an estimator with the appropriate training Action plan not met Neither DOE nor DOD has fully identified the causes of their growing environmental liability or developed a formal plan to address it DOE has made at least two attempts recently to prioritize cleanup activities but neither has been fully implemented First in August 2017 DOE-EM instituted a 45-day review to gather input from sites regarding cleanup activities that could be completed quickly However this effort stalled with no action plan or report issued Second officials acknowledged they have not analyzed in detail the root causes of the growth in its environmental liability and in August 2018 DOE-EM asked the sites to identify the key obstacles each faced in carrying out its cleanup mission Senior DOE-EM leaders stated that they are developing corrective actions based on this information This effort may provide some insights into challenges at each site but it is not comprehensive enough to reveal why each year DOE’s environmental liabilities are increasing faster than DOE’s spending on cleanup efforts Without a comprehensive effort that incorporates prior DOE efforts to conduct root cause studies regarding contract and project management issues it is not clear that DOE will have the information to develop an action plan to effectively address its environmental liabilities At DOD officials acknowledged that the agency will likely incur costs for restoration initiatives in conjunction with base closures and with returning overseas DOD facilities to host nations However DOD reported that it is unable to provide a reasonable estimate of those costs because the extent of required restoration is unknown Specifically DOD has not 1 fully estimated costs for all its liabilities because the cost to clean up some known sites is not yet estimable 2 fully inventoried all sites and general property plant and equipment needing cleanup and 3 established a consistent methodology to adequately gather data and develop estimates Monitoring not met DOE and DOD do not have the information needed to monitor the effectiveness of their actions to address the environmental liabilities facing their departments In February 2019 we found that DOE’s performance measures for cleanup activities do not provide a clear Page 139 GAO-19-157SP High-Risk Series U S Government’s Environmental Liability picture of overall performance Specifically the systems used by DOE and its contractors to track cleanup progress do not follow project management best practices and do not link performance to cost and schedule In April 2018 we found that DOE-EM does not have adequate quality control processes in place at Hanford’s Waste Treatment and Immobilization Plant—the largest project in DOE’s cleanup program—to monitor engineering and construction deficiencies As a result some problems have recurred causing cost increases and schedule delays DOD continues to face challenges in developing reliable information on its environmental liabilities In April 2018 DOD provided guidance on a department-wide audit strategy and methodology for the military services and its components to use in developing auditable environmental liability estimates that would standardize the business practices for reporting environmental liabilities department-wide However in November 2018 the DOD Inspector General identified deficiencies within DOD’s environmental liabilities audit approach specifically related to DOD’s ability to substantiate the completeness and amount of its environmental liability estimate As a result the Inspector General identified DOD’s environmental liability as a material weakness Demonstrated progress not met DOE has made proposals to address some waste and legal challenges but Congress may need to take action to provide more clarity on DOE’s authority in this area for it to demonstrate progress as we noted in May 2017 DOE has begun to explore a less expensive waste treatment alternative—grouting waste rather than turning it into glass—aimed at reducing the overall cost of the cleanup at one of its largest and most expensive cleanup site at Hanford in Washington State However DOE’s effort to demonstrate alternative technologies for treating waste was not funded in the fiscal year 2019 budget Overall DOE’s environmental liability continues to grow In the past two fiscal years DOE has spent over $12 billion on cleanup activities while the reported liability has grown by $122 billion Similarly DOD’s liability has remained largely unchanged in recent years despite billions spent on environmental cleanup projects More remains to be done by DOE and DOD to demonstrate progress toward fully understanding disclosing and reducing their environmental liability What Remains to Be Done Both DOE and DOD have open recommendations that if implemented would improve the quality of the environmental liability estimates and begin to address the growing liability Among these are the following key recommendations Page 140 GAO-19-157SP High-Risk Series U S Government’s Environmental Liability DOE should • develop a program-wide strategy that outlines how DOE will direct available resources to address human health and environmental risks across and within sites • include information on annual growth in environmental liability estimates by site and the causes of that growth in DOE-EM’s Future Years Defense Environmental Management Plan as well as an explanation of significant differences between lifecycle cost estimates in DOE-EM’s annual budget submission with the environmental liability estimates and • disclose the funding needed to meet all of its enforceable cleanup milestones in for example supplemental reports or the annual FutureYears Defense Environmental Management Plan DOD should • effectively implement its program for financial management review approval assessment and monitoring of the estimation and reporting processes for environmental liabilities • improve compliance with federal accounting standards and Financial Management Regulations guidance • design a process and controls at the department level to reconcile installation-level environmental records to installation property records and then using the corrected site inventories to determine that all sites with cleanup or corrective action costs are included in its financial reports of environmental liabilities and • report all costs required to complete environmental cleanup at each base realignment and closure installation In addition to taking the actions listed above attention to open recommendations will be key to making progress to address this high-risk area As of December 2018 29 of our recommendations related to this high-risk area had not been implemented 17 of which were made since we last reported on this high-risk area in 2017 Congressional Actions Needed Congress should consider clarifying in a manner that does not impair the regulatory authorities of EPA and the state of Washington and in consultation with the Nuclear Regulatory Commission DOE’s authority at Hanford to determine whether portions of the supplemental low activity waste can be managed as other high-level waste Providing clear authority to DOE may allow it to use alternative waste treatment approaches to treat Hanford’s supplemental low activity waste which could reduce certain risks by neutralizing the waste faster and save tens of billions of dollars Page 141 GAO-19-157SP High-Risk Series U S Government’s Environmental Liability Related GAO Products Nuclear Waste Cleanup DOE Could Improve Program and Project Management by Better Classifying Work and Following Leading Practices GAO-19-223 Washington D C February 19 2019 Department of Energy Program-Wide Strategy and Better Reporting Needed to Address Growing Environmental Cleanup Liability GAO-19-28 Washington D C January 29 2019 Hanford Waste Treatment Plant DOE Needs to Take Further Actions to Address Weaknesses in Its Quality Assurance Program GAO-18-241 Washington D C April 24 2018 Department of Energy Continued Actions Needed to Modernize Nuclear Infrastructure and Address Management Challenges GAO-18-374T Washington D C Feb 6 2018 Drinking Water DOD Has Acted on Some Emerging Contaminants but Should Improve Internal Reporting on Regulatory Compliance GAO-18-78 Washington D C Oct 18 2017 Nuclear Waste Opportunities Exist to Reduce Risks and Costs by Evaluating Different Waste Treatment Approaches at Hanford GAO-17-306 Washington D C May 3 2017 Military Base Realignments and Closures DOD Has Improved Environmental Cleanup Reporting but Should Obtain and Share More Information GAO-17-151 Washington D C Jan 19 2017 Military Base Closures Opportunities Exist to Improve Environmental Cleanup Cost Reporting and to Expedite Transfer of Unneeded Property GAO-07-166 Washington D C Jan 30 2007 Environmental Liabilities Long-Term Fiscal Planning Hampered by Control Weaknesses and Uncertainties in the Federal Government’s Estimates GAO-06-427 Washington D C Mar 31 2006 Page 142 GAO-19-157SP High-Risk Series DOD Weapon Systems Acquisition DOD Weapon Systems Acquisition The Department of Defense DOD can get better returns on its over one trillion dollar weapon system investments by following knowledge-based practices and developing an action plan for performance measures Why Area Is High Risk In April 2018 we reported that the DOD expects to invest $1 66 trillion in total to develop and procure its portfolio of 86 major defense acquisition programs Congress and DOD have long sought to improve how major weapon systems are acquired yet many DOD programs continue to fall short of cost schedule and performance goals Consequently DOD often pays more than anticipated buys less than expected and in some cases delivers fewer capabilities to the warfighter We added this area to our High-Risk List in 1990 Given substantial defense modernization and recapitalization needs DOD must get better returns on its weapon system investments and find ways to deliver capabilities to the warfighter on time and within budget Contact Information For additional information about this high-risk area contact Michael J Sullivan Director Contracting and National Security Acquisitions at 202 512-4841 or sullivanm@gao gov or Shelby S Oakley Director Contracting and National Security Acquisitions at 202 512-4841 or oakleys@gao gov Since our 2017 High-Risk Report our assessment of DOD’s performance against our five criteria remains unchanged Leadership commitment met DOD has implemented reforms in its acquisition policies and undertaken initiatives aimed at improving program outcomes DOD’s reforms included a 2015 update of its acquisition instruction and a series of Better Buying Power initiatives implemented between 2010 and 2015 The Office of the Under Secretary of Defense for Acquisition Technology and Logistics led these efforts however in response to congressional direction DOD dissolved this office in February 2018 Since then DOD has developed a new organizational structure that refocuses the Office of the Secretary of Defense’s principal role from program oversight to one intended to ensure that major DOD investments produce integrated technically superior capability that consistently outpaces global threats Within this structure the new Under Secretary of Defense for Acquisition and Sustainment has retained milestone decision authority over 11 major defense acquisition programs including the F-35 Lightning II Joint Strike Fighter—DOD’s most expensive program Service acquisition executives in each of the three military departments are authorized to make milestone decisions for all other current major defense acquisition programs Although DOD’s executives share a collective commitment to improve program performance specifics about the new organizational structure have not been fully determined Capacity partially met In February 2018 we reported that the military services aligned extensively with 4 of the 10 key practices leading organizations use to select train mentor and retain program managers We recommended that the military services improve practices that do not align extensively with leading practices incorporate lessons learned from the Army’s experience with the Civilian Acquisition Workforce Personnel Demonstration Project and make greater use of existing financial awards for good performance DOD officials agreed with the recommendations and have identified its plans to implement them Page 143 GAO-19-157SP High-Risk Series DOD Weapon Systems Acquisition Action plan partially met DOD reported to Congress in August 2017 that the department was at risk of not being able to acquire and sustain major weapon systems at sufficient levels due to increasing costs To counter this risk DOD’s new position of Under Secretary of Defense for Acquisition and Sustainment is to focus on major defense acquisition program performance and on reducing costs to free up resources for further investment Although DOD has not yet identified a plan with specific goals or performance measures its Better Buying Power initiatives address several steps DOD can take across its acquisition portfolio to achieve better results These initiatives include measures such as setting and enforcing affordability constraints instituting a long-term investment plan for portfolios of weapon systems implementing “should cost” management to control contract costs and eliminating redundancies within portfolios The initiatives also emphasize the need to adequately grow and train the acquisition workforce Monitoring partially met In December 2008 GAO DOD and the Office of Management and Budget agreed on a set of metrics to measure DOD program cost growth over time We have reported on those metrics since 2011 however DOD no longer agrees with their use In July 2018 GAO and DOD initiated discussions which will continue in 2019 to develop a new set of metrics DOD is also generally required under statute to submit selected acquisition reports to Congress that detail the cost schedule and performance status of individual major defense acquisition programs DOD generally prepares these reports annually in conjunction with submission of the President’s Budget Further from 2013 to 2016 DOD assessed and reported publicly on performance across its full portfolio of programs DOD has not issued the portfolio reports since 2016 relying instead on its selected acquisition reports to provide information to Congress Demonstrated progress partially met In fiscal year 2017 we analyzed the cost growth of weapon systems in development since 2009 when DOD began implementing major acquisition reforms We compared that to cost growth over the 10-years prior to acquisition reform and reported a 75 percent reduction in cost growth that totaled $36 billion Similarly we reported in April 2018 that DOD programs initiated since 2010 had better cost performance between 2016 and 2017 than the rest of the portfolio— an estimated $5 6 billion decrease versus a $60 3 billion increase At the same time we reported that most DOD programs continue to not fully implement knowledge-based acquisition practices which increases the risk of undesirable cost and schedule outcomes What Remains to Be Done Over the years since we added this area to our High-Risk List we have made numerous recommendations related to this high-risk issue As of November 2018 88 recommendations remain open 43 of which we made since the last high-risk update in February 2017 To improve its Page 144 GAO-19-157SP High-Risk Series DOD Weapon Systems Acquisition performance in the above areas DOD should implement our recommendations on 1 knowledge-based acquisition practices 2 defined cost and schedule goals and 3 more extensive alignment with commercial practices on hiring and retaining quality program managers Further DOD should address our related open priority recommendations which call for DOD to Related GAO Products • Prepare cost and funding summaries for each individual ship in the Fordclass aircraft carrier program CVN 78 within Selected Acquisition Reports • Track the costs to correct defects after ship delivery to help determine cases in which warranties could contribute to improvements in the cost and quality of Navy ships • Revise the Navy’s ship delivery policy to clarify what types of deficiencies need to be corrected what capabilities must be achieved and when The Navy should also clearly define what constitutes a complete ship and when that status should be achieved • Require the Missile Defense Agency to make its cost estimates more comprehensive to stabilize its element and program baselines by better understanding requirements before setting a baseline and—once a baseline is set—to track revisions to enable meaningful comparisons over time • Establish a pilot program involving several current or new major defense acquisition programs to test on a broad scale different streamlined approaches for providing decision makers with only the most essential information needed to make decisions at each milestone throughout the acquisition process • Implement leading practices for managing science and technology programs by defining the appropriate mix of innovative breakthrough technologies and more moderate incremental technology enhancements assessing whether that mix is achieved using existing flexibilities to more quickly initiate or discontinue projects in response to the rapid pace of innovation incorporating acquisition stakeholders into technology development programs and promoting advanced prototyping of breakthrough technologies Weapon Systems Cybersecurity DOD Just Beginning to Grapple with Scale of Vulnerabilities GAO-19-128 Washington D C October 9 2018 F-35 Joint Strike Fighter Development Is Nearly Complete but Deficiencies Found in Testing Need to Be Resolved GAO-18-321 Washington D C June 13 2018 Navy Shipbuilding Past Performance Provides Valuable Lessons for Future Investments GAO-18-238SP Washington D C June 6 2018 Page 145 GAO-19-157SP High-Risk Series DOD Weapon Systems Acquisition Missile Defense The Warfighter and Decision Makers Would Benefit from Better Communication about the System's Capabilities and Limitations GAO-18-324 Washington D C May 30 2018 Weapon Systems Annual Assessment Knowledge Gaps Pose Risks to Sustaining Recent Positive Trends GAO-18-360SP Washington D C April 25 2018 Defense Acquisition Workforce Opportunities Exist to Improve Practices for Developing Program Managers GAO-18-217 Washington D C February 15 2018 Columbia Class Submarine Immature Technologies Present Risks to Achieving Cost Schedule and Performance Goals GAO-18-158 Washington D C December 21 2017 Global Positioning System Better Planning and Coordination Needed to Improve Prospects for Fielding Modernized Capabilities GAO-18-74 Washington D C December 12 2017 Defense Science and Technology Adopting Best Practices Can Improve Innovation Investments and Management GAO-17-499 Washington D C June 29 2017 Ford-Class Aircraft Carrier Follow-On Ships Need More Frequent and Accurate Cost Estimates to Avoid Pitfalls of Lead Ship GAO-17-575 Washington D C June 13 2017 Page 146 GAO-19-157SP High-Risk Series DOD Financial Management DOD Financial Management The Department of Defense DOD needs to assure that leaders across the department continue to improve their efforts to address long-standing financial management problems Why Area Is High Risk DOD’s financial management continues to face long-standing issues—including its decentralized environment cultural resistance to change lack of skilled financial management staff ineffective processes systems and controls incomplete corrective action plans and the need for more effective monitoring and reporting DOD financial management was first added to our High-Risk List in 1995 DOD remains one of the few federal entities that cannot accurately account for and report on its spending or assets DOD’s discretionary spending makes up about half of the federal government’s discretionary spending and its assets represent more than 70 percent of the federal government’s physical assets Sound financial management practices and reliable useful and timely financial and performance information would help ensure DOD’s accountability over its extensive resources and more efficient management of its assets and budgets Contact Information For additional information about this high-risk area contact Asif Khan 202 512-9869 khana@gao gov Since our previous High-Risk Report progress has been made to meet the criterion of leadership commitment and partially meet the criterion for monitoring The other three criteria remain unchanged Leadership commitment met In 2018 DOD leadership met the goal of undergoing the first agency-wide financial statement audit and established a process to remediate any audit findings—ultimately to improve the quality of financial information that is most valuable in managing the department’s day-today operations The audit effort aligns with the department’s new national defense strategy which includes a priority to reform the department’s business practices DOD’s fiscal year 2018 financial statement audit resulted in a disclaimer of opinion—the auditors were unable to express an opinion due to insufficient evidence That said according to a DOD official audit remediation efforts have produced benefits in certain inventory processes that have led to operational improvements We support DOD’s efforts to improve its financial management and will continue to oversee and monitor the financial statement audit results and provide constructive input through recommendations related to remediation efforts DOD leadership also demonstrated its commitment to make needed improvements by developing a database that tracks hundreds of findings and recommendations that came out of the audit In addition senior leadership has been meeting bimonthly with military services’ leadership for updates on the status of corrective action plans to address audit findings and recommendations and the Under Secretary of Defense Comptroller has been meeting frequently with the Secretary of Defense to review the plans As a result of these actions this criterion has moved from partially met in 2017 to met in 2019 Capacity partially met According to DOD Office of Inspector General OIG ineffective information technology systems’ controls hinder DOD’s ability to produce accurate timely and reliable financial information DOD’s auditors issued more than 1 100 systems-related findings and recommendations during the fiscal year 2018 financial statement audit Page 147 GAO-19-157SP High-Risk Series DOD Financial Management and the DOD OIG has reported multiple material financial systems that do not comply with federal systems requirements These weaknesses pose a significant risk to DOD operations and could for example result in payments and collections being lost stolen or duplicated They may also open the department up to other cyber threats across different networks and systems To conduct audits and support remediation of findings DOD allocated the resources to complete its fiscal year 2018 financial statement audit undergo a 2019 audit and initiate related remediation efforts These audits are expected to help guide DOD’s overall efforts to improve its financial information which is needed to support operational readiness For example the Navy expanded its use of automatic data feeds to prepare for the audit and improve its efficiency and operations As a result the Navy has avoided $65 million of charges for service provider support that manual data entry would have required Action plan partially met In the past several years the Army Navy and Air Force have all undergone numerous audits and have developed corrective action plans in varying detail to address some of their audit findings DOD developed a centralized database to summarize information about the audit findings recommendations and related corrective action plans The Financial Improvement and Audit Remediation FIAR directorate plans to use this information to describe specific actions that DOD plans to take to address audit findings Audit remediation efforts have already provided some operational benefits For example according to a DOD official during an initial audit the Army found 39 Blackhawk helicopters that had not been recorded in the property system Similarly the Air Force identified 478 buildings and structures at 12 installations that were not in the real property systems These benefits demonstrate how the department is leveraging audit findings to support the National Defense Strategy effort to reform business practices for greater performance and affordability That said hundreds of the same problems were identified again in the fiscal year 2018 audits and hundreds of the same recommendations were re-issued In addition the military services have been addressing deficiencies in how they remediate audit findings and recommendations However the Army and Air Force continued to have deficiencies in how they identify track and prioritize financial management-related findings and recommendations and develop and monitor the status of corrective action plans Monitoring partially met DOD’s centralized database will be used to capture prioritize and assign responsibility for auditor findings and the related corrective action plans—used to measure progress towards achieving a clean audit opinion A clean or unmodified opinion is the Page 148 GAO-19-157SP High-Risk Series DOD Financial Management opinion expressed by the auditor when the auditor concludes that the financial statements are presented fairly in all material respects in accordance with the applicable financial reporting framework DOD expects the database to improve its oversight and monitoring of pervasive deficiencies as well as their related remediation efforts However because the database is still being populated with findings and recommendations it is too early to assess whether DOD will be able to successfully prioritize the findings and related corrective action plans and report information to stakeholders In addition DOD leadership has held frequent meetings to discuss the status of corrective action plans DOD also established councils in certain areas e g financial reporting to review the status of audit remediation activities and challenges The DOD OIG reported that corrective action plans have not been developed for all long-standing material weaknesses Without such plans to monitor and measure progress these long-standing material weaknesses may continue to affect DOD’s ability to improve its financial management and get to a clean audit opinion Demonstrated progress not met The DOD OIG’s disclaimer of opinion on DOD’s fiscal year 2018 financial statement was partially based on the disclaimers of opinion for the Army Navy Air Force U S Marine Corps Defense Health Program Defense Logistics Agency U S Transportation Command and U S Special Operations Command The DOD OIG also reported 20 material weaknesses in internal control across the department contributing to its disclaimer of opinion Some of these—such as an inability to account for its property and equipment—are examples of long-standing weaknesses that DOD has been unable to address In addition the DOD OIG reported on several findings and recommendations regarding inventory and related property that could have operational impacts for DOD For example the auditor found • 107 rotor blades for Blackhawk helicopters that could not be used but remained on the inventory records • 24 Gyro Electronics for military aircraft that should not be used but remained in the inventory records • 20 fuel injector assemblies for Blackhawk helicopters did not have supporting documentation to demonstrate which military service owned them The results of prior audits and examinations further show the extent and complexity of improvements needed to provide reliable information for financial reporting and operational readiness For example DOD has multiple material financial management systems that do not comply with federal systems requirements Further complicating this issue DOD lacks internal controls over many of its financial systems which hinders its Page 149 GAO-19-157SP High-Risk Series DOD Financial Management ability to generate accurate reliable and timely financial and performance information However DOD has seen some early signs of progress For example in preparing for and undergoing its first financial statement audit Navy’s Commander U S Pacific Fleet strengthened internal controls to improve its operations The initiative strengthened internal controls that resulted in freeing up purchasing power to fund $4 4 million in ship repair costs Further DOD reports that Army successfully implemented a materialitybased physical inventory best practice to Army depot asset counts This process improvement ensures a more accurate inventory count and Army avoids approximately $10 million of future cost annually What Remains to Be Done Related GAO Products Over the years since we added this area to our High-Risk List we have made numerous recommendations related to this issue 9 of which were made since the last high-risk update in February 2017 As of December 2018 53 recommendations are open To address its complex array of financial management challenges DOD needs to take action in all areas of concern such as • DOD should continue to develop and deploy enterprise resource planning systems with appropriate functionality as a critical component of DOD’s financial improvement In addition DOD should make changes to the remaining legacy systems to satisfy audit requirements and improve data used for day-to-day decision making • DOD needs to continue building a workforce with the level of training and experience needed to support and sustain sound financial management • Army and Air Force should continue to follow the steps in OMB’s guidance for addressing financial management related findings and recommendations reported by external auditors including steps to identify prioritize and track them develop effective action plans to remediate them and monitor the implementation status of the plans • DOD leadership needs to work on its centralized monitoring and reporting process by populating the database with all of the open financial management related findings and recommendations as well as their associated corrective action plans and to prioritize them and track their completion • DOD will also need to continue to ensure that it has corrective action plans to address all of its material weaknesses Foreign Military Sales Financial Oversight of the Use of Overhead Funds Needs Strengthening GAO-18-553 Washington D C July 30 2018 Page 150 GAO-19-157SP High-Risk Series DOD Financial Management DOD Financial Management The Navy Needs to Improve Internal Control over Its Buildings GAO-18-289 Washington D C May 10 2018 DOD Financial Management Additional Actions Needed to Complete the Army’s Analyses of Unsupported Accounting Entries for Its General Fund GAO-18-27 Washington D C October 20 2017 DOD Financial Management Significant Efforts Still Needed for Remediating Audit Readiness Deficiencies GAO-17-85 Washington D C February 9 2017 Page 151 GAO-19-157SP High-Risk Series DOD Business Systems Modernization DOD Business Systems Modernization The Department of Defense DOD needs to improve management of its business system acquisitions improve management of its portfolio of business system investments and leverage its federated business enterprise architecture to identify and address potential duplication and overlap across systems Why Area Is High Risk DOD spends billions of dollars each year to acquire modernized systems including ones that address key areas such as personnel financial management health care and logistics While DOD’s capacity for modernizing its business systems has improved over time significant challenges remain We first added this area to our High-Risk List in 1995 This high-risk area includes three critical challenges facing DOD 1 improving business system acquisition management 2 improving business system investment management and 3 leveraging DOD’s federated business enterprise architecture Improving business system acquisition management would contribute to better cost schedule and performance outcomes for DOD systems Improving business system investment management would allow DOD to more effectively and efficiently manage its portfolios of business system investments Enhanced use of its federated business enterprise architecture would help DOD identify and address potential duplication and overlap across its business systems environment Contact Information For additional information about this high-risk area contact Carol C Harris at 202 512-4456 or harriscc@gao gov Since our 2017 High-Risk Report DOD has made improvements in this high-risk area by moving from a not met rating on the action plan criterion to a partially met rating The department accomplished this by developing a plan for making improvements to its business enterprise architecture However DOD lacks a plan to address both the business system acquisition management and investment management process segments of this high-risk area Our assessment of the leadership capacity monitoring and demonstrated progress criteria remains partially met DOD’s Business System Acquisition Management Ratings for this segment of the high-risk area remain unchanged since our previous High-Risk Report in 2017 with DOD partially meeting three criteria elements and not meeting the remaining two Act for Fiscal Year 2016 Leadership commitment partially met Since our 2017 High-Risk Report DOD has developed updated policy and guidance for managing business system investments that reflects changes called for by the National Defense Authorization In addition DOD’s April 2018 National Defense Business Operations Plan included a commitment that it would establish quantifiable measures for improvements to the business system environment by the end of fiscal year 2018 but DOD did not demonstrate that it established such metrics as planned DOD has also faced frequent turnover in leadership positions associated with managing its business system investments and has not Page 152 GAO-19-157SP High-Risk Series DOD Business Systems Modernization yet demonstrated how it intends to implement legislative provisions designating the chief management officer CMO as the chief information officer CIO for all DOD business systems Regarding the legislative provisions in November 2018 the acting CMO stated that she has a collaborative relationship with the DOD CIO and they are working to define their respective responsibilities Capacity not met The Office of the CMO which establishes policy and guidance for business system investments and oversees a subset of business system investments has not demonstrated that it has conducted a human capital analysis as we recommended in May 2013 In addition the Office of the CMO does not have a plan to analyze and address skill gaps thus limiting its capacity to lead improvement initiatives in these areas In August 2018 we reported that the DOD CIO had only partially addressed roles and responsibilities associated with its information technology IT workforce such as 1 annually assessing the extent to which DOD personnel meet IT management knowledge and skill requirements and 2 developing strategies for hiring and training to rectify any knowledge and skill deficiencies Action plan not met DOD continues to lack a plan that includes specific actions and associated milestones to address what remains to be done for this segment of the high-risk area As a result DOD does not have a common baseline to document DOD-wide commitments and their associated timeframes Monitoring partially met DOD has begun to leverage the federal IT Dashboard to document progress in improving its business system acquisition outcomes However without an approved action plan for addressing gaps described in this segment of the high-risk area DOD lacks the means to monitor broader progress in making improvements to its business system acquisition management efforts Demonstrated progress partially met Since our 2017 High-Risk Report DOD has had mixed success in delivering business system investments that meet cost schedule and performance commitments For example we reported in May 2018 that the Global Combat Support System–Army met all six of its performance targets but was delayed by 10 months We also reported that the Defense Enterprise Accounting and Management System Increment 1 met three out of four performance targets but increased in cost by 60 percent In addition DOD has made progress in addressing certain of our recommendations associated with making improvements in this area For example since February 2017 DOD has implemented recommendations aimed at addressing best practices in risk management project Page 153 GAO-19-157SP High-Risk Series DOD Business Systems Modernization monitoring and IT acquisition for a subset of its business system investments DOD has also made progress in addressing recommendations associated with implementing incremental development However DOD still needs to address our long-standing recommendations associated with the establishment of timelines and issue monitoring that impact efficient and effective use of other specific systems and another recommendation aimed at making further improvements associated with its use of incremental development What Remains to Be Done DOD needs to take various steps including • developing an action plan for addressing this high-risk area • following through with its commitment to develop measures to demonstrate improvements in its business systems environment • demonstrating improved success in meeting business system cost schedule and performance expectations and • addressing our various open recommendations associated with this highrisk area including recommendations aimed at improving human capital management CIO oversight of IT incremental development and recommendations associated with specific business systems DOD’s Business System Investment Management Process Ratings for this segment remain unchanged since our 2017 High-Risk Report with DOD partially meeting three criteria and not meeting the remaining two Leadership commitment partially met DOD has made progress complying with legislative provisions for managing business system investments in the National Defense Authorization Act for Fiscal Year 2016 but more remains to be done In addition DOD has faced frequent turnover in leadership positions associated with managing its business system investments and it has not yet demonstrated how it intends to implement legislative provisions designating the CMO as the CIO for all DOD business systems Capacity partially met DOD has established an investment review board and guidance for overseeing its largest business system investments However as we reported in April 2018 required guidance has yet to be developed at all levels throughout the agency In addition Page 154 GAO-19-157SP High-Risk Series DOD Business Systems Modernization the Office of the CMO has not demonstrated that it has conducted a human capital analysis as we recommended in May 2013 and does not have a plan to analyze and address skill gaps Action plan not met DOD continues to lack a plan with specific actions and associated milestones to address what remains to be done for this segment of the high-risk area As a result DOD does not have a common baseline to document DOD-wide commitments and their associated timeframes Monitoring not met Without an approved action plan for addressing this segment of the high-risk area DOD lacks a means to monitor progress in making improvements to its business system investment management process Demonstrated progress partially met Since our 2017 High-Risk Report DOD has taken steps to improve its business system investment management process by addressing some associated recommendations For example DOD has defined criteria for reviewing defense business systems at an appropriate level based on factors such as cost and risk in support of the business system certification and approval process However DOD needs to show continued progress in addressing our remaining associated recommendations such as developing improved investment management guidance and functional strategies including measurable targets over the next 3 to 5 years What Remains to Be Done DOD should implement our recommendations on improving its business system investment management efforts including • taking a strategic approach to human capital management for the Office of the CMO • improving investment management policy and guidance at all levels of the organization and • ensuring that functional strategies include all of the critical elements identified in DOD investment management guidance Ratings for this segment have improved for two of the five high-risk criteria elements since our 2017 High-Risk Report DOD’s Federated Business Enterprise Architecture Leadership commitment partially met Since our 2017 High-Risk Report DOD’s assistant deputy CMO approved an improvement plan for DOD’s business enterprise architecture i e description of DOD’s current and future business Page 155 GAO-19-157SP High-Risk Series DOD Business Systems Modernization environment and plans for transitioning to the future environment This plan is intended to improve DOD’s ability to achieve architecture-related outcomes including identifying and reusing existing systems across the department The plan demonstrates that DOD leadership is committed to making needed improvements However DOD has faced frequent turnover in leadership positions associated with managing its business system investments and has not yet demonstrated how it will implement legislative provisions designating the CMO as the CIO for all DOD business systems Capacity met As reported in our 2017 High-Risk Report DOD has met the criterion for capacity In particular it has established tools and processes that are intended to improve its efforts to identify potentially duplicative systems Action plan partially met DOD has developed a project plan for how it will make improvements to its business enterprise architecture However it has not revised its plan to reflect updated milestones Monitoring partially met DOD has developed a plan for making needed improvements to its business enterprise architecture and receives monthly contractor status reports However monthly reports do not discuss progress relative to the plan and the plan has not been revised to reflect updated milestones Demonstrated progress partially met DOD has established the capacity to identify potentially duplicative investments and has developed a plan to further improve its capacity DOD has also provided examples of benefits attributed at least in part to its business enterprise architecture Nevertheless DOD has not yet demonstrated that it is actively and consistently using assessments of potential duplication and overlap to eliminate duplicative systems DOD’s business architecture improvement plan acknowledges this gap and identifies steps it intends to take to improve its ability to use the business enterprise architecture to achieve its intended goals What Remains to be Done Over the years since we added this area to our High-Risk List we have made numerous recommendations related to this high-risk issue 10 of which were made since the last high-risk update in February 2017 As of December 2018 27 recommendations are open DOD needs to continue to execute its plan for making needed improvements to its business enterprise architecture and demonstrate that it is actively and consistently using assessments of potential duplication and overlap to identify and eliminate duplicative systems Page 156 GAO-19-157SP High-Risk Series DOD Business Systems Modernization Related GAO Products Federal Chief Information Officers Critical Actions Needed to Address Shortcomings and Challenges in Implementing Responsibilities GAO-18-93 Washington D C August 2 2018 Defense Management DOD Senior Leadership Has Not Fully Implemented Statutory Requirements to Promote Department-Wide Collaboration GAO-18-513 Washington D C June 25 2018 DOD Major Automated Information Systems Adherence to Best Practices Is Needed to Better Manage and Oversee Business Programs GAO-18-326 Washington D C May 24 2018 Defense Business Systems DOD Needs to Continue Improving Guidance and Plans for Effectively Managing Investments GAO-18-130 Washington D C April 16 2018 DOD Major Automated Information Systems Improvements Can Be Made in Applying Leading Practices for Managing Risk and Testing GAO-17-322 Washington D C March 30 2017 Page 157 GAO-19-157SP High-Risk Series DOD Support Infrastructure Management DOD Support Infrastructure Management The Department of Defense DOD needs to better align its infrastructure capacity with its force structure needs and achieve efficiencies by reducing both excess infrastructure and base support costs and maximizing the use of its underutilized facilities Why Area Is High Risk DOD manages a portfolio of real property assets that as of fiscal year 2017 reportedly included about 586 000 facilities—including barracks maintenance depots commissaries and office buildings The combined replacement value of this portfolio is almost $1 2 trillion and includes about 27 million acres of land at nearly 4 800 sites worldwide This infrastructure is critical to maintaining military readiness and the cost to build and maintain it represents a significant financial commitment Since designating this area as high-risk in 1997 we have reported on various long-term challenges DOD faces in managing its infrastructure Specifically DOD has experienced obstacles reducing excess infrastructure more efficiently using underutilized facilities and reducing base support costs DOD has used the BRAC process primarily to reduce excess infrastructure readjust bases to accommodate changes in the size and structure of DOD’s forces and produce cost savings Since 1988 Congress has authorized five BRAC rounds most recently in 2005 Based on our analysis of the 2005 BRAC round we found that opportunities exist for DOD and the Congress to improve future BRAC rounds Contact Information For additional information about this high-risk area contact Brian J Lepore at 202-512-4523 or leporeb@gao gov Since our 2017 High-Risk Report DOD has made progress in two areas meeting the criteria of leadership commitment and action plan Our assessment of the other three criteria remains unchanged Leadership commitment met DOD has demonstrated leadership commitment by 1 agreeing to improve certain cost estimating processes in future Base Realignment and Closure BRAC rounds by implementing for example our recommendation to better forecast initial BRAC costs for military construction 2 committing to improve its excess capacity estimating method by implementing for example our recommendation to use reasonable assumptions in estimating excess capacity 3 pursuing an effort to relocate from costly commercial leased space to nearby installations when possible and 4 highlighting its need to dispose of unneeded infrastructure by requesting and completing BRAC rounds As a result the rating for the leadership commitment criteria for this high-risk area has improved from partially met in 2017 to met Between 2013 and 2017 DOD requested BRAC rounds to address excess capacity which Congress did not authorize DOD did not request a BRAC round in 2018 However in the John S McCain National Defense Authorization Act for Fiscal Year 2019 Congress provided DOD with additional authority to realign or close certain military installations if the governor of the relevant state or entity including the District of Columbia Puerto Rico and Guam recommends that the Secretary carry out the military installation’s realignment or closure This authority includes several requirements including statements of support for the realignment or closure from the local government a plan for reuse and a cost cap of $2 0 billion DOD also has authority to close or realign installations under other circumstances subject to certain civilian personnel thresholds and other statutory requirements It will be important for DOD and Congress to work together to determine infrastructure needs in light of any force structure changes and to take action to dispose of excess infrastructure as appropriate Page 158 GAO-19-157SP High-Risk Series DOD Support Infrastructure Management DOD officials have also stated that they intend to address key recommendations we have made by for example 1 better forecasting the initial BRAC costs for military construction information technology and relocating military personnel and equipment 2 better aligning infrastructure to DOD force structure needs by for example improving the accuracy and sufficiency of its excess capacity estimates and 3 pursuing an effort to consolidate and standardize leases which includes analyzing whether it is feasible to relocate functions from commercial leased space to existing space on an installation thereby reducing leases and better utilizing excess space As the responsibilities of the Assistant Secretary of Defense for Energy Installations and Environment are transferred to the recently established Assistant Secretary of Defense for Sustainment it will be important for DOD to maintain its leadership commitment to aligning support infrastructure with the needs of its forces and achieving efficiencies Capacity partially met In 2017 we reported that DOD had demonstrated its capacity to align infrastructure with DOD force structure needs by disposing of excess infrastructure during past BRAC rounds and by consolidating some installation services at joint bases among other efforts However we also reported that DOD needed to improve the accuracy of its real property data including data on the utilization rates of its facilities In November 2018 we reported that DOD’s Real Property Assets Database contained inaccurate data and lacked completeness although certain data that we reviewed had improved in accuracy We found that the percentage of DOD facilities with missing utilization data improved in fiscal year 2016 14 4 percent compared to fiscal year 2014 23 3 percent However DOD continues to be missing utilization data for about 93 600 facilities To address incomplete and inaccurate data in DOD’s database we recommended that the department fully monitor its data recording processes develop and implement corrective actions for identified data discrepancies and develop a strategy to address risk associated with data quality DOD generally concurred with these recommendations and identified a series of steps the department would take to implement them Action plan met We reported in 2017 that DOD had developed plans such as its Real Property Efficiency Plan to better identify excess infrastructure and thus be positioned to dispose of it This plan includes DOD’s goals for reducing the footprint of its real property inventory and metrics to gauge progress The plan is scheduled to be implemented by the end of 2020 However in 2018 the reduction numbers targeted for DOD under the Office of Management and Budget’s Reduce the Footprint Strategy could not be calculated because according to Performance gov which tracks the goals and objectives of the President’s Management Page 159 GAO-19-157SP High-Risk Series DOD Support Infrastructure Management Agenda the data that DOD submitted was not of sufficient accuracy to support the calculation of its Reduce the Footprint portfolio relative to its baseline In October 2018 we reported that DOD had begun using intergovernmental support agreements between military installations and local governments to obtain installation services such as waste removal grounds maintenance and stray animal control In our 2018 analysis of a sample of these agreements we found that DOD was achieving cost savings and cost avoidances DOD agreed to monitor whether installations are evaluating opportunities to use these agreements stating that the military services will update their policies and procedures to include a process for conducting such monitoring In June 2017 DOD also directed the joint bases to stop using the higher cost joint base common standards for installation services and instead use the standards of the military service in charge of providing services at any given joint base In March 2009 we had reported that joint base costs were likely to increase because the services had not routinely funded installation support at amounts needed to meet joint base common standards Since DOD directed the joint bases to stop using common standards these expected increased costs are less likely to occur As a result these actions the rating for the action plan criteria for this high-risk area has improved from partially met in 2017 to met Monitoring partially met We reported in 2017 that DOD had committed to improve its monitoring of any future BRAC rounds and had demonstrated some ability to monitor its efforts to achieve reductions and efficiencies in infrastructure In May 2018 we reported that DOD needed to improve the accuracy of its excess capacity estimates In response the department agreed to update the baseline used for such estimates clearly lay out any assumptions used and their rationale and update guidance definitions and implementing instructions and apply them in a manner that ensures consistency but with necessary flexibility We also reported in November 2018 that DOD still does not have fully reliable data in its Real Property Assets Database to effectively monitor its property needed for informed management decision-making For example we found that over 22 percent of DOD’s facilities about 125 000 facilities did not have a physical inspection date in the last 5 years as required for properties not designated as historic Additionally DOD has not yet committed to implementing some related prior recommendations for any future BRAC rounds For example DOD has not agreed to limit the practice of bundling multiple stand-alone realignments or closures into single BRAC recommendations We reported in 2013 that such bundling did not itemize the costs and savings associated with each separate major action within the bundle and thus Page 160 GAO-19-157SP High-Risk Series DOD Support Infrastructure Management limited the visibility into the estimated costs and savings for individual closures and realignments Demonstrated progress partially met DOD has demonstrated some progress in aligning its infrastructure to its force structure needs by reducing excess infrastructure through five BRAC rounds between 1988 and 2005 and by disposing of and demolishing excess facilities DOD has also begun taking other actions that could demonstrate progress in more efficiently using underutilized facilities and reducing base support costs For example as of March 2017 DOD and the General Services Administration had begun sharing information about the potential use of available space on DOD installations by other federal agencies Additionally in December 2017 a DOD official told us that the department had begun reviewing opportunities to relocate DOD organizations currently in commercial leased space to nearby installations with available space thereby ending lease payments by the tenant organizations Finally DOD has started to reduce some installation support costs by using intergovernmental support agreements to obtain installation services from local governments at lower costs However DOD’s ability to demonstrate further progress continues to be challenged by unreliable real property data as we reported in November 2018 For example as of fiscal year 2016 nearly half of the facilities that have been identified as excess in DOD’s Real Property Assets Database do not have a date for when that determination was made and thus their status cannot be verified as accurate Additionally we found facilities that existed but were not recorded in the military services’ data systems as well as disposed facilities that no longer existed but were still reflected as active in the database DOD has also not committed to setting targets for eliminating excess capacity in any future BRAC rounds which would help DOD measure its reduction of excess infrastructure As DOD examines and adjusts its force structure it is important that DOD also assess how its infrastructure capacity aligns with its infrastructure needs and work with Congress as needed to reduce any excess infrastructure What Remains to Be Done Over the years since we added this area to the High-Risk List we have made numerous recommendations related to this high-risk issue 17 of which were made since the last high-risk update in February 2017 As of December 2018 23 recommendations are open DOD needs to • fully identify the cost requirements for military construction information technology relocating personnel and equipment and alternatively financed projects for any future BRAC round Page 161 GAO-19-157SP High-Risk Series DOD Support Infrastructure Management • limit the practice of bundling multiple stand-alone BRAC realignments or closures into single recommendations • establish targets for eliminating excess capacity for any future BRAC • improve the accuracy of its excess capacity estimates by reliably updating the baseline for estimating excess infrastructure capacity using reasonable assumptions in estimating excess capacity and developing guidance to improve its analysis and ensure consistency • implement processes for monitoring the benefits from intergovernmental support agreements and whether installations are evaluating opportunities to use those agreements and • improve the accuracy and completeness of its real property data by fully monitoring its processes for recording all required real property information developing and implementing corrective actions for identified data discrepancies and developing a strategy to address risks associated with data quality and information accessibility DOD should continue to assess its infrastructure needs in light of ongoing changes in DOD force structure including military service personnel numbers and work with Congress as needed to reduce any excess infrastructure Congressional Actions Needed If Congress were to authorize additional BRAC rounds we have suggested that it consider amending BRAC legislation to require the Secretary of Defense to formally establish specific goals for a BRAC process Congress may also want to consider requiring DOD to implement all our applicable recommendations related to BRAC We have also suggested that Congress consider directing DOD to evaluate the purpose of the joint basing program to help ensure it achieves its goals and leverages additional opportunities to reduce duplication of effort Related GAO Products Defense Real Property DOD Needs to Take Additional Actions to Improve Management of Its Inventory Data GAO-19-73 Washington D C November 13 2018 DOD Installation Services Use of Intergovernmental Support Agreements Has Had Benefits but Additional Information Would Inform Expansion GAO-19-4 Washington D C October 23 2018 Defense Infrastructure DOD Needs to Improve the Accuracy of Its Excess Capacity Estimates GAO-18-230 Washington D C May 24 2018 Military Bases Opportunities Exist to Improve Future Base Realignment and Closure Rounds GAO-13-149 Washington D C March 7 2013 Page 162 GAO-19-157SP High-Risk Series DOD Approach to Business Transformation DOD Approach to Business Transformation The Department of Defense DOD should accurately track efficiencies gained and costs reduced as it transforms its business functions through a transition to shared services and other efficiency initiatives Why Area Is High Risk DOD spends billions of dollars each year to maintain key business operations intended to support the warfighter including systems and processes related to the management of contracts finances the supply chain support infrastructure and weapon systems acquisition Weaknesses in these areas adversely affect DOD’s efficiency and effectiveness and render its operations vulnerable to waste fraud and abuse DOD’s approach to transforming these business operations is linked to DOD’s ability to perform its overall mission directly affecting the readiness and capabilities of U S military forces We added DOD’s overall approach to managing business transformation as a high-risk area in 2005 because DOD had not taken the necessary steps to achieve and sustain business reform on a broad strategic department-wide and integrated basis Further DOD’s historical approach to business transformation has not proven effective in achieving meaningful and sustainable progress in a timely manner Also DOD did not have an integrated plan for business transformation with specific goals measures and accountability mechanisms to monitor progress and achieve improvements Contact Information For additional information about this high-risk area contact Elizabeth Field at 202-512-2775 or fielde1@gao gov Since our 2017 High-Risk Report DOD has met the action plan criteria Ratings for the leadership commitment monitoring and demonstrated progress criteria are unchanged at partially met and the rating for capacity declined to partially met Leadership commitment partially met In February 2017 the Secretary of Defense announced that DOD would undertake an effort to identify business services and tasks that no longer merit individual military department approaches In January 2018 DOD issued its National Defense Strategy which included reforming the department’s business practices for greater performance and affordability DOD has taken steps to achieve efficiencies in its business services and to implement certain statutory requirements in the National Defense Authorization Acts NDAA for Fiscal Years 2017 through 2019 However as we discuss in more detail below the structure and processes and the involvement of a key leader on DOD’s Reform Management Group RMG have changed and remain unclear Additionally with the resignation of the Chief Management Officer CMO the Deputy Chief Management Officer DCMO assumed the role of the Acting CMO in December 2018 Given the importance of the CMO to achieving business reform these developments raise concerns about the extent to which the department will be successful in its approach to business transformation Congress included a provision in the National Defense Authorization Act for Fiscal Year 2018 to create a CMO position that is distinct from the Deputy Secretary of Defense eliminated the position of DCMO and provides a number of key responsibilities set forth in section 132a of title 10 of the U S Code In February 2018 the Secretary of Defense implemented the statutory provision to establish the CMO position and disestablished the position of DCMO Among other responsibilities the CMO is responsible for 1 managing DOD’s enterprise business operations and shared services and 2 directing the secretaries of the military departments and the defense agencies and field activities Page 163 GAO-19-157SP High-Risk Series DOD Approach to Business Transformation DAFAs that provide shared business services for the department or with regard to other matters for which the CMO is responsible In February 2017 the Secretary of Defense also issued a memorandum tasking the Deputy Secretary of Defense with leading an effort to identify business services and tasks that no longer merit individual military department approaches In May 2018 DOD issued its National Defense Business Operations Plan outlining the department's strategic goals and objectives for improving performance and reforming business operations These actions demonstrate a leadership commitment to business transformation However it will be important for the department to sustain its focus on this effort at the highest levels In April 2005 we testified on the importance of a full-time leadership position at the right level dedicated to the planning integration and execution of business transformation efforts The longer this critical position is filled by someone in an acting capacity the greater the risk that DOD’s transformation efforts could be impacted Capacity partially met We have downgraded the capacity criterion from met in 2017 to partially met in 2019 In 2017 we reported that the DCMO had taken several steps to improve its capacity to monitor DOD’s business transformation efforts including conducting a business process and systems review However with the planned establishment of the CMO position in February 2018 we reported that it would be critical that the Office of the CMO OCMO have the personnel and other resources needed to fulfill its significant responsibilities While DOD has since established the OCMO and taken some steps to build its capacity such as hiring a new Chief Data Officer and establishing plans to restructure the OCMO around its enhanced responsibilities the OCMO may not yet have the capacity to perform certain key functions For example section 921 of the John S McCain NDAA for Fiscal Year 2019 requires the CMO to review the budgets of certain defense agencies and field activities beginning in fiscal year 2020 OCMO officials told us they are working to develop a process for this review and to determine which DAFAs would be subject to the review Until the OCMO has developed the process and determined how many DAFA budgets the review will include it will not know what if any resource implications this requirement has for the office Data show that DOD’s budget request for OCMO has declined from fiscal year 2017 to fiscal year 2019 At the same time the CMO’s authorities and responsibilities have expanded For example the NDAA for Fiscal Year 2018 assigns the CMO the responsibility to serve as DOD’s Chief Information Officer for defense business systems According to OCMO officials DOD is still determining which responsibilities if any will transfer from the CIO to the CMO and what the resource implications of that Page 164 GAO-19-157SP High-Risk Series DOD Approach to Business Transformation transfer will be Moving forward we will closely monitor the OCMO’s ability to assume these and other responsibilities Additionally DOD established nine reform teams led by senior-level functional officials throughout the department who are charged with identifying and implementing initiatives to consolidate the department’s business operations Our recent work indicates that some reform teams have encountered challenges that could impede their progress For example as we reported in January 2019 the OCMO did not request funding for reform team initiatives and reform teams reported that they lack funding needed to implement some of their initiatives OCMO officials told us that the teams submitted nine requests for funding in fiscal year 2018 but OCMO did not have funding to support four of these requests as of the end of fiscal year 2018 Reform team membership relies on the military services’ and DAFAs’ continued willingness to provide members for each of the teams Further DOD senior leaders told us they plan to move many of the teams out of the OCMO to the components responsible for the functions they are trying to reform This development raises questions about whether the teams will be fully empowered and sufficiently independent to drive change We will continue to closely monitor development of the OCMO and progress of the reform teams to assess the extent to which they have the capacity to achieve their goals Action plan met In our February 2017 High-Risk Report we stated among other things that DOD should refine its performance action plan or develop a corrective action plan that identifies the processes systems personnel and other resources needed to implement reform initiatives As previously stated in May 2018 DOD issued its National Defense Business Operations Plan This plan establishes a strategic goal of reforming the department’s business practices for greater performance and affordability The strategic objectives supporting that goal are to 1 improve and strengthen business operations through a move to DODenterprise or shared services and reduce administrative and regulatory burden 2 optimize organizational structures and 3 undergo an audit and improve the quality of budgetary and financial information As a result of these actions the rating for the action plan criteria for this high-risk area has improved from partially met in 2017 to met DOD’s Fiscal Year 2019 DOD Annual Performance Plan identifies performance goals and measures to achieve the strategic goals and objectives described in the National Defense Business Operations Plan including the goal of reforming the department’s business practices The Performance Plan designates several business reform team leaders as responsible for meeting performance goals and measures For example the leader of the Information Technology and Business Systems Reform Team is responsible for transforming how the department delivers secure Page 165 GAO-19-157SP High-Risk Series DOD Approach to Business Transformation stable and resilient information technology infrastructure in support of warfighter lethality This goal is consistent with the team’s overarching objective to plan and execute the transformation of all business systems affecting support areas within the department Moving forward it will be important for DOD to demonstrate that it is using its National Defense Business Operations Plan to guide its reform efforts Monitoring partially met According to officials DOD established a Reform Management Group RMG in summer 2017 it was initially chaired by the Deputy Secretary of Defense and co-chaired by the CMO and the Director of Cost Assessment and Program Evaluation CAPE to identify opportunities for reform and provide support to the nine reform teams The RMG was intended to 1 provide oversight and guidance 2 make decisions on reform team recommendations and 3 monitor the reform teams’ progress However according to officials the structure and processes of the group have changed over time and remain unclear For example in October 2018 the Director of CAPE told us and a senior OCMO official later confirmed he was no longer co-chairing the group In addition OCMO officials are considering whether the RMG should meet bi-weekly rather than weekly and whether teams should meet with the RMG only when a team is chartered and when it briefs the proposed solution for its initiatives rather than throughout implementation as has been the case It is unclear at this point what effect these and other changes may have on oversight of the teams’ progress DOD has also developed a dashboard containing project milestones and metrics for monitoring reform team progress Although not completely populated in September 2018 when we received a demonstration the dashboard will indicate whether each of the initiative’s project milestones and metrics are on track While these steps demonstrate progress in the area of monitoring we remain concerned that the department has not clearly established reliable baselines for measuring progress and verifying cost savings estimates In July 2017 we reported that DOD did not have a reliable estimate to support the cost savings it had identified for its past efficiency initiatives As recently as May 2018 DOD provided a progress report to Congress on past efficiencies that included inconsistent documentation raising questions about the accuracy of its prior cost savings estimates According to the John S McCain NDAA for Fiscal Year 2019 the CMO is required by not later than January 2020 to develop a baseline of costs to perform certain business activities such as real estate management We will be reviewing this baseline to assess the extent to which it includes all elements required under the NDAA and helps DOD track cost reductions effectively DOD is also working to develop a cost management framework to estimate cost savings for its reform efforts but it is unclear what effect Page 166 GAO-19-157SP High-Risk Series DOD Approach to Business Transformation this framework will have on improving the accuracy of the department’s future cost savings estimates Without a reliable cost estimate that includes a cost baseline DOD will be unable to determine and accurately report actual savings achieved from its reform efforts For example we reported in July 2017 that DOD’s projected cost savings estimates were unreliable because DOD-provided documentation when compared with best practices for cost estimates was not sufficiently detailed to support the estimates Demonstrated progress partially met As noted above DOD established nine reform teams aligned to its functional lines of business in February 2017 to achieve its goal of reforming business practices for greater performance and affordability These include functional lines such as financial management supply chain and logistics human resources and information technology and business systems Each of these reform teams is to implement initiatives in its respective line of business that will transform some aspect of the department’s business operations and free up resources to reinvest in warfighter priorities However it remains to be seen how effective these reform teams or the other reform initiatives in the department will be Notably DOD has not met many of its internal goals and milestones for business operation reform and the absence of a clear process for identifying and prioritizing available funding for reform teams may impede their progress In November 2018 CMO officials told us they planned on narrowing the scope of reform efforts to focus on four areas 1 fourth estate or those organizations other than the military departments or combatant commands such as the Office of the Secretary of Defense the Joint Staff the defense agencies and DOD field activities 2 information technology 3 health care and 4 DOD’s approach to buying goods and services more efficiently and cost effectively called category management This reduction in scope raises questions about the extent to which enterprise reform will be made in the areas that were deemphasized such as human resources What Remains to Be Done Since we added this area to our High-Risk List we have made numerous recommendations related to this high-risk issue including 9 since the last high-risk update in February 2017 As of December 2018 all 9 remain open In order to make progress in its approach to business transformation DOD should • provide department-wide guidance on the CMO’s roles responsibilities and authorities Page 167 GAO-19-157SP High-Risk Series DOD Approach to Business Transformation Related GAO Products • implement and communicate a process for providing resources to the reform teams including funding to implement reform initiatives as needed • demonstrate that the National Defense Business Operations Plan is being used and updated as needed to guide reform efforts • ensure that the Reform Management Group continues to monitor and oversee reform team progress • fully populate and actively use the dashboard and the associated milestones and metrics to gauge team success in identifying and achieving efficiencies and cost savings • establish the cost baseline required by section 921 of the John S McCain NDAA for Fiscal Year 2019 and use it to accurately estimate savings anticipated within the business functions covered under the NDAA • develop additional cost baselines modeled on the baseline created in accordance with the NDAA for Fiscal Year 2019 to accurately track actual savings resulting from implementation of reform initiatives in additional business functions such as health care management • effectively consolidate key business functions in the department and show cost savings from the consolidation and • demonstrate progress in implementing reform efforts outlined in the National Defense Business Operations Plan including those not covered by the reform teams Defense Management DOD Needs to Implement Statutory Requirements and Identify Resources for Its Cross-Functional Reform Teams GAO-19-165 Washington D C January 17 2019 Defense Efficiency Initiatives Observations on DOD’s Reported Reductions to Its Headquarters and Administrative Activities GAO-18-688R Washington D C September 24 2018 Defense Management DOD Needs to Address Inefficiencies and Implement Reform across Its Defense Agencies and DOD Field Activities GAO-18-592 Washington D C September 6 2018 Defense Management DOD Senior Leadership Has Not Fully Implemented Statutory Requirements to Promote Department-Wide Collaboration GAO-18-513 Washington D C June 25 2018 Defense Management DOD Needs to Take Additional Actions to Promote Department-Wide Collaboration GAO-18-194 Washington D C February 28 2018 Page 168 GAO-19-157SP High-Risk Series DOD Approach to Business Transformation Defense Management DOD Has Taken Initial Steps to Formulate an Organizational Strategy but These Efforts Are Not Complete GAO-17-523R Washington D C June 23 2017 Page 169 GAO-19-157SP High-Risk Series Government-wide Personnel Security Clearance Process Government-wide Personnel Security Clearance Process The government-wide personnel security clearance process continues to face challenges in the timely processing of clearances measuring the quality of investigations and ensuring the security of related information technology IT systems Why Area Is High Risk We placed the government-wide personnel security clearance process on the High-Risk List in January 2018 because it faces significant challenges related to 1 the timely processing of clearances 2 measuring investigation quality and 3 ensuring IT security among other things Timeliness The executive branch has been unable to process personnel security clearances within established timeliness objectives contributing to a backlog that the NBIB reported to be approximately 565 000 cases as of February 2019 Quality A high-quality personnel security clearance process minimizes the risks of unauthorized disclosures of classified information and helps ensure that information about individuals with criminal histories or other questionable behavior is identified and assessed While the executive branch has taken some steps to address quality it has not established measures to ensure the quality of background investigations and adjudications and instead focused on reducing the backlog and redesigning the investigation process IT Security DOD is building and managing the development of the NBIS but security concerns posed by DOD regarding OPM legacy IT systems may delay planned milestones for the new system OPM did not effectively monitor actions taken to remediate identified weaknesses in its IT systems to ensure that key security controls are in place and operating as intended Contact Information For additional information about this high-risk area contact Brenda S Farrell 202-512-3604 or farrellb@gao gov Since we added the governmentwide personnel security clearance process to our High-Risk List in January 2018 the executive branch has taken some action and made some progress addressing our criteria for removal The executive branch has met the criterion for leadership commitment partially met the capacity monitoring and demonstrated progress criteria and has not met the action plan criterion In addition the administration proposed transferring the background investigation function from the Office of Personnel Management’s OPM National Background Investigations Bureau NBIB to the Department of Defense DOD in June 2018 and plans to issue an Executive Order regarding the transfer Leadership commitment met The Security Clearance Suitability and Credentialing Performance Accountability Council PAC chaired by the Deputy Director for Management of the Office of Management and Budget OMB is the government-wide entity responsible for driving the implementation of and overseeing security clearance reform among other reform efforts The chair of the PAC who is concurrently serving as the Acting Director of OPM stated that the security clearance reform process is one of her top three government-wide priorities Further according to officials the PAC assembled teams of stakeholders who meet regularly to focus on developing solutions to specific problems within the security clearance process OPM and the Office of the Director of National Intelligence ODNI also issued a memo in June 2018 containing measures to reduce the backlog of background investigations While the PAC has prioritized the prompt reduction of the backlog it has not finalized a plan to reduce it to a manageable level or prioritized improving the timeliness of investigations Senior DOD officials expressed commitment to the administration’s June 2018 transfer proposal and have planning efforts underway related to the transfer and the modernization of the personnel vetting process Continued and coordinated leadership by the PAC will be important as it Page 170 GAO-19-157SP High-Risk Series Government-wide Personnel Security Clearance Process works to complete other long-standing key reform initiatives including the government-wide implementation of continuous evaluation Focused leadership will also be critical throughout the transition of background investigative functions from OPM to DOD as proposed by the administration particularly during senior leadership changes at OPM and DOD Capacity partially met NBIB officials reported that NBIB has increased its workforce to approximately 8 700 federal and contract investigators to help address the investigations backlog However NBIB has not reported goals for increasing total investigator capacity or completed the development and implementation of a comprehensive strategic workforce plan as we have recommended Completing the workforce plan would better position the bureau to meet current and future demands for its services In addition in August 2017 DOD submitted to the congressional defense committees a plan for the transfer of certain DOD background investigations from OPM’s NBIB to DOD This plan included estimates of the number of full-time equivalent employees necessary to execute the transfer However officials told us in November 2018 that the department is no longer using the plan because it was overcome by the administration’s June 2018 organizational reform proposal for the complete transfer of the NBIB background investigation program from OPM to DOD According to officials DOD is now preparing for the transfer of all NBIB investigative functions by developing a new plan which is based on the total inventory of OPM’s background investigations In preparation for the transfer DOD should consider our recommendation to the Director of NBIB to develop a strategic workforce plan as it assumes these responsibilities Executive Order 13467 as amended which establishes the PAC among other things assigns the Secretary of Defense the role of developing and securely operating IT systems that support all background investigation processes conducted by NBIB Exec Order No 13467 § 2 6 b as amended through Exec Order No 13764 82 Fed Reg 8115 8126 Jan 17 2017 In addition the National Defense Authorization Act NDAA for Fiscal Year 2018 included a provision that DOD conduct a review of the National Background Investigation Services NBIS the IT system it is developing to support background investigations to determine whether certain enhancements are necessary see Pub L No 115-91 § 925 f 2017 According to officials DOD has in place the resources needed for the development of NBIS is actively identifying necessary system capabilities and has begun small preliminary pilots of its services However according to officials the necessary resources for full implementation of NBIS and the administration’s transfer proposal remain unclear Page 171 GAO-19-157SP High-Risk Series Government-wide Personnel Security Clearance Process Action plan not met The leaders of the reform effort have developed various plans for more than a decade to improve the process Most recently in March 2018 the Director of National Intelligence DNI issued implementation guidelines for continuous evaluation—a process to review the background of clearance holders and individuals in sensitive positions at any time during the eligibility period Further DOD has begun reorganizing certain entities within the department that will enable DOD to begin the transfer of investigative functions from OPM’s NBIB While the DNI and OPM have issued a joint Executive Correspondence that contains measures clarifying and adjusting certain elements of investigation requirements the PAC lacks plans including goals and milestones to 1 reduce the backlog to a manageable level 2 meet timeliness objectives for security clearance investigations and adjudications and 3 assess and address the potential effects of continuous evaluation on agency resources Officials from ODNI DOD and the PAC told us they are working on an initiative called Trusted Workforce 2 0 an effort to transform the fundamental approach to workforce vetting and supporting policies that will also overhaul business processes and modernize the IT architecture According to officials this effort is an expansion of reform since our January 2018 high-risk designation that will consider both risk and trust PAC and ODNI officials said Trusted Workforce 2 0 will focus on timeliness and quality goals in a future phase after reducing the clearance backlog to a manageable level The DNI and former Director of OPM committed to issuing this new policy framework and plans to transform vetting for the Executive Branch by the end of 2018 Officials told us in early 2019 that the issuance of related policies is expected throughout the calendar year Monitoring partially met The NDAA for Fiscal Year 2018 required the DNI in coordination with the other PAC principals to annually report for the prior fiscal year on the timeliness of initiations investigations and adjudications by clearance level This report is to cover both initial investigations and periodic reinvestigations for government and contractor employees see Pub L No 115-91 § 925 k 1 In November 2018 the DNI informed executive branch agencies that it intends to fulfill this and other legislative reporting requirements through a consolidated data call In September 2018 NBIB reported to Congress for each clearance level 1 the size of the investigation backlog 2 the average length of time to conduct an initial investigation and a periodic reinvestigation and 3 a discussion of the factors contributing to investigation timeliness The PAC is also reporting publicly on the progress of key reforms through www performance gov where OMB began tracking security clearance and suitability reform as a cross-agency priority goal in March 2014 For fiscal year 2018 www performance gov contains quarterly action plans Page 172 GAO-19-157SP High-Risk Series Government-wide Personnel Security Clearance Process and progress updates which present figures on the average timeliness of initial investigations and periodic reinvestigations for the executive branch as a whole investigation workload and backlog and investigator headcounts Our analysis of the latest available timeliness data showed that the number of executive branch agencies meeting investigative and adjudicative objectives decreased from fiscal years 2012 through 2018 Furthermore the PAC has not implemented our December 2017 recommendation to conduct an evidence-based review of the investigation and adjudication timeliness objectives for completing the fastest 90 percent of initial secret and initial top secret security clearances In addition the PAC has not yet established performance measures to monitor investigation and adjudication quality continuous evaluation implementation and government-wide reciprocity Demonstrated progress partially met The PAC has demonstrated progress in some areas specifically related to a reduction in the backlog of background investigations NBIB officials report that the backlog decreased from almost 715 000 cases in January 2018—when we added the process to our High-Risk List—to approximately 565 000 cases in February 2019 Those officials credit an Executive Memorandum—issued jointly in June 2018 by the DNI and the Director of OPM and containing measures to reduce the investigation backlog—as a driver in backlog reduction The measures adjust investigative requirements by for example temporarily allowing for video or telephone interviews in certain circumstances We will continue to monitor the backlog and efforts to reduce it While members of the PAC have taken positive steps to improve continuous evaluation and reciprocity including the DNI’s March 2018 continuous evaluation implementation guidelines and November 2018 guidance providing requirements for reciprocity the PAC has not demonstrated sustained progress to address other weaknesses we have identified For example PAC leaders have not completed the development of quality measures for investigations and PAC officials told us they had not made plans to report quality to Congress Further the PAC has not demonstrated measurable improvements with regards to the timeliness of background investigations and adjudications In fiscal year 2018 the percent of agencies meeting the timeliness objectives in which the fastest 90 percent are to be completed within a specified number of days are presented in Table 9 below Page 173 GAO-19-157SP High-Risk Series Government-wide Personnel Security Clearance Process Table 9 Percent of Executive Branch Agencies Meeting Security Clearance Processing Timeliness Objectives in Fiscal Year 2018 Phase Type Investigation Initial Secret Adjudication Objective Percentage Meeting Objective 40 days 3 percent Initial Top Secret 80 days 13 percent Periodic reinvestigations 150 days 13 percent Initial Secret 20 days 44 percent Initial Top Secret 20 days 44 percent Periodic reinvestigations 30 days 65 percent Source GAO analysis of Office of the Director of National Intelligence data GAO-19-157SP Agencies without delegated authority rely on OPM to conduct their background investigations while agencies with delegated authority have been authorized to conduct their own background investigations As such investigative phase timeliness data for agencies without delegated authority is generally a reflection of OPM’s timeliness While the data ODNI provided shows that timeliness continues to decline OPM officials stated that NBIB internal monitoring shows recent improvement in investigation timeliness What Remains to Be Done We have made numerous recommendations to PAC members to address risks associated with the personnel security clearance process between 2011 when we removed DOD’s personnel security clearance program from the High-Risk List and 2018 when we placed the government-wide personnel security clearance process on the High-Risk List We consider 27 of those recommendations key to addressing the high-risk designation Eight recommendations key to the high-risk designation have been implemented including three since January 2018 Most recently those recommendations implemented include ODNI formalizing plans and guidance for continuous evaluation As of December 2018 19 of these key recommendations remain open Of the open recommendations ODNI stated that it did not concur with our December 2017 recommendations on addressing investigation quality and timeliness but did not provide specific information to explain why it did not concur In addition in March 2018 we outlined necessary actions and outcomes—anchored in each of our five criteria for removal from the High-Risk List—and our prior recommendations that need to be addressed for this area to be removed These actions and outcomes are outlined below and should be considered by all four agencies unless a lead agency is indicated Page 174 GAO-19-157SP High-Risk Series Government-wide Personnel Security Clearance Process To continue to meet the leadership commitment criterion these agencies should • continue to demonstrate that the PAC is prioritizing the 1 prompt reduction of the government-wide investigative backlog to a manageable level 2 improvement of the timeliness of background investigations and 3 completion of long-standing key reform initiatives • continue participating regularly in leadership meetings of the PAC principals • provide the necessary oversight and support to PAC members to effectively accomplish assigned reform initiatives in accordance with the roles and responsibilities outlined in Executive Order 13467 as amended as Chair of the PAC OMB and • oversee and support NBIB and DOD during the transition period while DOD stands up background investigative functions to include supporting resource needs To make progress on meeting capacity these agencies should • develop and implement a comprehensive strategic workforce plan that identifies the workforce needed to meet the current and future demand for its services as well as reduce the current backlog to a manageable level OPM DOD • coordinate with responsible executive branch agencies to identify the resources needed to effectively implement personnel security clearance reform effort initiatives within established timeframes OMB ODNI DOD and • develop long-term funding estimates for changes to the federal government’s investigation practices resulting from the implementation of the 2012 Federal Investigative Standards These long-term funding estimates should include but not be limited to 1 costs related to IT adjustments to enable government-wide data sharing 2 costs related to implementing continuous evaluation and 3 costs related to the changed frequency of periodic reinvestigations OMB To make progress on an action plan these agencies should • develop a plan including goals and milestones for reducing the backlog of background investigations to a manageable level • develop a government-wide plan including goals and interim milestones to meet timeliness objectives for initial personnel security clearances periodic reinvestigations and adjudications and • assess the potential effects of continuous evaluation on agency resources and develop a plan to address those effects such as modifying the scope of periodic reinvestigations changing the frequency Page 175 GAO-19-157SP High-Risk Series Government-wide Personnel Security Clearance Process of periodic reinvestigations or replacing periodic reinvestigations for certain clearance holders ODNI To make progress on monitoring these agencies should • develop and report to Congress annually on government-wide resultsoriented performance measures for the quality of security clearance background investigations and adjudications ODNI • develop performance measures for continuous evaluation that agencies must track and regularly report to ODNI • develop metrics and government-wide baseline data for reciprocity determinations to measure the extent of reciprocity within the executive branch and report on those metrics to Congress ODNI and • monitor the implementation of remedial actions intended to resolve known cybersecurity vulnerabilities to include updating remedial action plans to reflect expected completion dates and improve the timeliness of validating the effectiveness of actions taken to mitigate cybersecurity vulnerabilities that exposed agency information to cybersecurity incidents OPM To improve on demonstrating progress these agencies should • develop government-wide performance measures for the quality of background investigations and adjudications OMB ODNI • conduct an evidence-based review of the investigation and adjudication timeliness objectives for completing the fastest 90 percent of initial secret and initial top secret security clearances and take action to adjust the objectives if appropriate • conduct an evidence-based review of the timeliness goal of 195 days for completing the fastest 90 percent of periodic reinvestigations and the associated goals for the different phases of periodic reinvestigations and adjust the goal if appropriate and • improve and secure personnel security clearance IT systems including implementing further security improvements to its IT environment including contractor-operated systems to ensure that key security controls are in place and operating as intended OPM Congressional Actions Needed The annual assessments of timeliness and quarterly briefings required by the NDAA for Fiscal Year 2018 will serve as mechanisms for Congress and the executive branch to monitor timeliness costs and continuous evaluation among other things Related GAO Products Personnel Security Clearances Additional Actions Needed to Implement Key Reforms and Improve Timely Processing of Investigations GAO-18431T Washington D C March 7 2018 Page 176 GAO-19-157SP High-Risk Series Government-wide Personnel Security Clearance Process Personnel Security Clearances Additional Actions Needed to Ensure Quality Address Timeliness and Reduce Investigation Backlog GAO-1829 Washington D C December 12 2017 Personnel Security Clearances Plans Needed to Fully Implement and Oversee Continuous Evaluation of Clearance Holders GAO-18-117 Washington D C November 21 2017 Information Security OPM Has Improved Controls but Further Efforts Are Needed GAO-17-614 Washington D C August 3 2017 Information Security Agencies Need to Improve Controls over Selected High-Impact Systems GAO-16-501 Washington D C May 18 2016 Personnel Security Clearances Funding Estimates and Government-wide Metrics Are Needed to Implement Long-Standing Reform Efforts GAO15-179SU Washington D C April 23 2015 Page 177 GAO-19-157SP High-Risk Series Ensuring the Cybersecurity of the Nation Ensuring the Cybersecurity of the Nation Federal agencies and other entities need to take urgent actions to implement a comprehensive cybersecurity strategy perform effective oversight secure federal systems and protect cyber critical infrastructure privacy and sensitive data Why Area Is High Risk Federal agencies and our nation’s critical infrastructures—such as energy transportation systems communications and financial services—are dependent on information technology IT systems and electronic data to carry out operations and to process maintain and report essential information The security of these systems and data is vital to public confidence and national security prosperity and well-being Because many of these systems contain vast amounts of personally identifiable information PII agencies must protect the confidentiality integrity and availability of this information In addition they must effectively respond to data breaches and security incidents when they occur The risks to IT systems supporting the federal government and the nation’s critical infrastructure are increasing including insider threats from witting or unwitting employees escalating and emerging threats from around the globe and the emergence of new and more destructive attacks We have designated information security as a government-wide high-risk area since 1997 We expanded this high-risk area in 2003 to include protection of critical cyber infrastructure and in 2015 to include protecting the privacy of PII Contact Information For additional information about this high-risk area contact Nick Marinos at 202 512-9342 or marinosn@gao gov Gregory C Wilshusen at 202 512-6244 or wilshuseng@gao gov or Vijay D'Souza at 202 512-6240 or dsouzav@gao gov Since our previous 2017 HighRisk Report our assessment of efforts to address all five criteria remains unchanged Leadership commitment met In May 2017 the President issued an executive order requiring federal agencies to take a variety of actions including better managing their cybersecurity risks and coordinating to meet reporting requirements related to cybersecurity of federal networks and critical infrastructure Further in December 2017 the President issued a National Security Strategy citing cybersecurity as a national priority and identifying needed actions such as identifying and prioritizing risk and building defensible government networks The administration further described its planned approach to cybersecurity with the release of a National Cyber Strategy in September 2018 This national strategy outlines activities such as securing critical infrastructure federal networks and associated information as well as developing the cybersecurity workforce To lead the nation’s cybersecurity response activities in November 2018 the President signed the Cybersecurity and Infrastructure Security Agency Act of 2018 into law Among other things the law enables the Department of Homeland Security DHS to restructure the existing cybersecurity components within the National Protection and Programs Directorate to create a new cyber-focused agency Capacity partially met In June 2018 the administration issued a government-wide reform plan and reorganization recommendations that included among other things proposals for solving the federal cybersecurity workforce shortage In particular the plan notes the administration’s intent to prioritize and accelerate ongoing efforts to reform the way that the federal government recruits evaluates selects pays and places cyber talent The plan further states that by the end of the first quarter of fiscal year 2019 all 24 major federal agencies in coordination with DHS and the Office of Management and Budget OMB are to develop a critical list of vacancies across their organizations Page 178 GAO-19-157SP High-Risk Series Ensuring the Cybersecurity of the Nation Nevertheless the federal government continues to face challenges in ensuring that the nation’s cybersecurity workforce has the appropriate skills For example we have previously reported that DHS and the Department of Defense had not fully addressed cybersecurity workforce management requirements set forth in federal laws Further as of June 2018 most of the 24 major federal agencies had not fully implemented all requirements associated with the Federal Cybersecurity Workforce Assessment Act of 2015 For example three agencies had not conducted a baseline assessment to identify the extent to which their cybersecurity employees held professional certifications As a result these agencies may not be able to effectively gauge the competency of individuals who are charged with ensuring the confidentiality integrity and availability of federal information and information systems Action plan partially met In response to the May 2017 presidential executive order DHS issued a cybersecurity strategy in May 2018 that articulated seven goals the department plans to accomplish in support of its mission related to managing national cybersecurity risks over the next 5 years Further OMB issued the Federal Cybersecurity Risk Assessment and Action Plan in August 2018 The assessment stated that OMB and DHS examined the capabilities of 96 civilian agencies across 76 cybersecurity metrics and found that 71 agencies had cybersecurity programs that were either at risk or at high risk The assessment also stated that agencies were not equipped to determine how malicious actors seek to gain access to their information systems and data The assessment identified core actions to address cybersecurity risks across the federal enterprise Additionally the September 2018 National Cyber Strategy outlined the administration’s approach to cybersecurity through a variety of priority actions such as centralizing management and oversight of federal civilian cybersecurity However the strategy lacks key elements that we have previously reported can enhance the usefulness of a national strategy including clearly defined roles and responsibilities and information on the resources needed to carry out the goals and objectives Although the strategy states that National Security Council staff are to coordinate with departments agencies and OMB to determine the resources needed to support the strategy’s implementation it is unclear what official maintains overall responsibility for coordinating these efforts especially in light of the elimination of the White House Cybersecurity Coordinator position in May 2018 1 1 The White House Cybersecurity Coordinator position was created in December 2009 to among other things coordinate interagency cybersecurity policies and strategies and to develop a comprehensive national strategy to secure the nation’s digital infrastructure Page 179 GAO-19-157SP High-Risk Series Ensuring the Cybersecurity of the Nation Going forward it will be critical for the White House to clearly define the roles and responsibilities of key agencies and officials in order to foster effective coordination and hold agencies accountable for carrying out planned activities to address the cybersecurity challenges facing the nation We have work underway examining federal roles and responsibilities for protecting the nation against cyber threats including the implications of the decision to eliminate the cybersecurity coordinator position We expect to report on the results of our work by the end of fiscal year 2019 Monitoring partially met DHS has established the National Cybersecurity and Communications Integration Center NCCIC which functions as the 24 7 cyber monitoring incident response and management center for the federal civilian government The United States Computer Emergency Readiness Team one of several subcomponents of the NCCIC is responsible for operating the National Cybersecurity Protection System Operationally known as Einstein this system is intended to provide DHS with situational awareness related to cybersecurity of entities across the federal government through intrusion detection and prevention capabilities Nevertheless DHS has continued to be challenged in measuring how the NCCIC is performing its functions in accordance with mandated implementing principles For example NCCIC is to provide timely technical assistance risk management support and incident response capabilities to federal and nonfederal entities however as of December 2018 it had not established measures or other procedures for ensuring the timeliness of these assessments as we previously recommended We also continued to find persistent weaknesses in federal agencies’ monitoring of their information security programs The Federal Information Security Modernization Act of 2014 and its predecessor the Federal Information Security Management Act of 2002 requires federal agencies in the executive branch to develop document and implement an information security program and evaluate it for effectiveness Our numerous security control audits have identified hundreds of deficiencies related to agencies’ implementation of effective security controls Demonstrated progress partially met Since 2010 we have made over 3 000 recommendations to agencies aimed at addressing cybersecurity challenges facing the government—448 of which were made since the last high-risk update in February 2017 Nevertheless many agencies face challenges in safeguarding their information systems and information in part because many of these recommendations have not been fully implemented Of the roughly 3 000 recommendations made since 2010 nearly 700 had not been fully implemented as of December 2018 We have also designated 35 as priority recommendations meaning that we believe these recommendations warrant priority attention from heads of Page 180 GAO-19-157SP High-Risk Series Ensuring the Cybersecurity of the Nation key departments and agencies As of December 2018 26 of our priority recommendations had not been fully implemented What Remains to Be Done Based on our prior work we have identified four major cybersecurity challenges 1 establishing a comprehensive cybersecurity strategy and performing effective oversight 2 securing federal systems and information 3 protecting cyber critical infrastructure and 4 protecting privacy and sensitive data To address these challenges we have identified 10 critical actions that the federal government and other entities need to take see figure 12 Page 181 GAO-19-157SP High-Risk Series Ensuring the Cybersecurity of the Nation Figure 12 Ten Critical Actions Needed to Address Four Major Cybersecurity Challenges Congressional Actions Needed We also have previously suggested that Congress consider amending laws such as the Privacy Act of 1974 and the E-Government Act of 2002 because they may not consistently protect PII Specifically we found that while these laws and guidance set minimum requirements for agencies they may not consistently protect PII in all circumstances of its collection and use throughout the federal government and may not fully adhere to Page 182 GAO-19-157SP High-Risk Series Ensuring the Cybersecurity of the Nation key privacy principles However the relevant revisions to the Privacy Act and the E-Government Act had not yet been enacted as of the date of this report Further we suggested that Congress consider strengthening the consumer privacy framework and review issues such as the adequacy of consumers’ ability to access correct and control their personal information and privacy controls related to new technologies such as web tracking and mobile devices However these suggested changes had not yet been enacted as of the date of this report Related GAO Products Information Security OPM Has Implemented Many of GAO’s 80 Recommendations but Over One-Third Remain Open GAO-19-143R Washington D C November 13 2018 Cybersecurity Office of Federal Student Aid Should Take Additional Steps to Oversee Non-School Partners’ Protection of Borrower Information GAO-18-518 Washington D C September 17 2018 High-Risk Series Urgent Actions Are Needed to Address Cybersecurity Challenges Facing the Nation GAO-18-622 Washington D C September 6 2018 Information Security IRS Needs to Rectify Control Deficiencies That Limit Its Effectiveness in Protecting Sensitive Financial and Taxpayer Data GAO-18-391 Washington D C July 31 2018 Data Protection Actions Taken by Equifax and Federal Agencies in Response to the 2017 Breach GAO-18-559 Washington D C August 30 2018 High-Risk Series Urgent Actions Are Needed to Address Cybersecurity Challenges Facing the Nation GAO-18-645T Washington D C July 25 2018 Information Security Supply Chain Risks Affecting Federal Agencies GAO-18-667T Washington D C July 12 2018 Electronic Health Information CMS Oversight of Medicare Beneficiary Data Security Needs Improvement GAO-18-210 Washington D C March 6 2018 Critical Infrastructure Protection Additional Actions Are Essential for Assessing Cybersecurity Framework Adoption GAO-18-211 Washington D C February 15 2018 Page 183 GAO-19-157SP High-Risk Series Ensuring the Cybersecurity of the Nation Cybersecurity Workforce Urgent Need for DHS to Take Actions to Identify Its Position and Critical Skill Requirements GAO-18-175 Washington D C February 6 2018 Page 184 GAO-19-157SP High-Risk Series Strengthening Department of Homeland Security Management Functions Strengthening Department of Homeland Security Management Functions The Department of Homeland Security DHS needs to continue implementing its Integrated Strategy for HighRisk Management with a particular focus on building its capacity in the areas of acquisition information technology IT and financial management Why Area Is High Risk In 2003 we designated implementing and transforming DHS as high risk because the department had to transform 22 agencies—several with major management challenges—into one department Given the significant effort required to build and integrate a department as large and complex as DHS our initial high-risk designation addressed the department’s implementation and transformation efforts to include associated management and programmatic challenges Failure to effectively address these challenges could have serious consequences for U S national and economic security Since 2003 the focus of this high-risk area has evolved in tandem with DHS’s maturation and evolution In September 2011 we reported in our assessment of DHS’s progress that the department had implemented key homeland security operations and achieved important goals in many areas but continuing weaknesses in DHS’s management functions had been a key theme impacting the department’s implementation efforts As a result in our 2013 high-risk update we narrowed the scope of the high-risk area to strengthening and integrating DHS management functions human capital acquisition information technology and financial Contact Information For additional information about this high-risk area contact Chris Currie 404 679-1875 or curriec@gao gov Since our 2017 High-Risk Report ratings for all five criteria remain unchanged DHS has continued its efforts to strengthen and integrate its acquisition information technology financial and human capital management functions It has continued to meet three out of five criteria for removal from the High-Risk List leadership commitment action plan and monitoring and partially meet the remaining two criteria capacity and demonstrated progress Leadership commitment met DHS top leadership including the Secretary and Deputy Secretary of Homeland Security has continued to demonstrate exemplary commitment and support for addressing the department’s management challenges They have also taken actions to institutionalize this commitment to help ensure the long-term success of the department’s efforts One such effort is the Under Secretary for Management’s Integrated Priorities initiative to strengthen the integration of DHS’s business operations across the department During monthly leadership meetings with the Under Secretary for Management the department’s Chief Executive Officers have been providing status updates on their respective actions to address this high-risk designation Capacity partially met With regard to acquisition staffing DHS has analyzed components’ acquisition program staffing assessments but has yet to conduct an in-depth analysis across components or develop a plan to address any gaps With regard to IT staffing DHS has not identified or reported to Congress or the Office of Personnel Management OPM on its department-wide cybersecurity specialty areas of critical needs such as cybersecurity management or incident response as required by law In February 2018 we recommended that DHS take steps to ensure that 1 its cybersecurity workforce procedures identify position vacancies and responsibilities 2 cybersecurity workforce data are complete and accurate and 3 plans for reporting critical needs are developed DHS concurred and stated it planned to provide further evidence addressing the recommendations by Page 185 GAO-19-157SP High-Risk Series Strengthening Department of Homeland Security Management Functions the end of the first quarter of fiscal year 2019 which we will assess upon receipt With regard to financial management capacity DHS has continued its efforts to identify and allocate resources for financial management but additional progress is needed For example DHS’s financial statement auditor has identified several capacity-related issues including resource limitations and inadequate management and staff training as causes for the material weaknesses reported Action plan met In January 2011 DHS produced its first Integrated Strategy for High-Risk Management and has issued 14 updated versions most recently in September 2018 The September 2018 strategy describes DHS’s progress to-date and planned corrective actions to further strengthen its management functions DHS’s strategy and approach if effectively implemented and sustained provides a path for DHS to be removed from our High-Risk List Monitoring met In the most recent September 2018 Integrated Strategy for High-Risk Management DHS included performance measures to monitor key management initiatives For example DHS monitors the percentage of components demonstrating effective internal controls for significant business processes as a way of gauging progress toward improving financial management In addition DHS is also better positioned to monitor its financial system modernization projects since it established a joint program management office in October 2017 This office is to among other things centralize program governance and streamline its decision-making processes and provide DHS management with regular updates on the department’s financial system modernization efforts Demonstrated progress partially met In 2010 we identified and DHS agreed that achieving 30 specific outcomes would be critical to addressing the challenges within the department’s management areas As of September 2018 DHS has fully addressed 17 of the 30 needed outcomes mostly addressed 4 partially addressed 6 and initiated actions to address the remaining 3 Since our 2017 High-Risk Report DHS has taken steps to fully address two human capital outcomes by demonstrating that components are basing hiring decisions and promotions on human capital competencies and strengthening employee engagement efforts In addition DHS has fully addressed two IT outcomes by 1 providing ongoing oversight and support to troubled IT investments to help improve their cost schedule and performance and 2 demonstrating significant progress in implementing its IT strategic workforce planning initiative Page 186 GAO-19-157SP High-Risk Series Strengthening Department of Homeland Security Management Functions Important progress and work remaining in key areas include • Acquisition management DHS continues to face challenges in funding its acquisition portfolio In May 2018 we found that recent enhancements to DHS’s acquisition management resource allocation and requirements policies largely reflect key portfolio management practices However we also found that of the 24 major acquisition programs we assessed with approved schedule and cost goals only 10 were on track to meet those goals during 2017—a decrease from 2016 In addition we found that DHS’s portfolio of major acquisition programs is not affordable from fiscal years 2018 to 2022 DHS has taken steps to strengthen requirements development across the department such as reestablishing the Joint Requirements Council in June 2014 However opportunities remain to further strengthen DHS’s acquisition process by using the Joint Requirements Council to impact DHS’s budget The council could better fulfill its mission by identifying overlapping or common requirements and by making recommendations to senior leadership to help ensure that DHS uses its finite investment resources wisely and maintains a balanced portfolio of investments that combine near-term operational improvements with long-term strategic planning • IT management DHS has updated its approach for managing its portfolios of IT investments across all components As part of the revised approach the department is utilizing its capital planning and investment control process and the Joint Requirements Council to assess IT investments across the department on an ongoing basis For example as part of its capital planning process for the fiscal year 2020 budget the Office of the Chief Information Officer worked with the components to assess each major IT investment to ensure alignment with DHS’s functional portfolios and to identify opportunities to share capabilities across components This updated approach should enable DHS to identify potentially duplicative investments and opportunities for consolidating investments as well as reduce component-specific investments Additionally DHS has continued to take steps to enhance its information security program In November 2018 the department’s financial statement auditor reported that DHS had made progress in correcting its prior year IT security weaknesses However for the 15th consecutive year the auditor designated deficiencies in IT systems controls as a material weakness for financial reporting purposes Work also remains in implementing our six open recommendations concerning DHS’s cybersecurity workforce assessment requirements • Financial management DHS received a clean audit opinion on its financial statements for 6 consecutive years—fiscal years 2013 to 2018 However its auditor reported two material weaknesses in the areas of financial reporting and information technology controls and financial systems as well as instances of non-compliance with laws and regulations These deficiencies hamper DHS’s ability to provide Page 187 GAO-19-157SP High-Risk Series Strengthening Department of Homeland Security Management Functions reasonable assurance that its financial reporting is reliable and the department is in compliance with applicable laws and regulations In addition much work remains to modernize components' financial management systems and business processes • Human capital management DHS has continued to strengthen its employee engagement efforts by implementing our 2012 recommendation to establish metrics of success within components’ action plans for addressing its employee satisfaction problems Further DHS has conducted audits to better ensure components are basing hiring decisions and promotions on human capital competencies In addition OPM’s 2018 Federal Employee Viewpoint Survey data showed that in the past 2 years DHS’s score on the Employee Engagement Index EEI increased by 4 points—from 56 in 2016 to 60 in 2018—which was 1 point more than the government wide increase over the same period While this improvement is notable DHS’s current EEI score is 1 point below its EEI baseline score in 2010 suggesting that DHS is still working to regain lost ground after an 8 point drop between 2010 and 2015 DHS has considerable work ahead to improve its employee engagement as its 2018 EEI score ranked 20th among 20 large and very large federal agencies • Management integration Since 2015 DHS has focused its efforts to address crosscutting management challenges through the establishment and monitoring of Integrated Priorities The department updated these priorities in September 2017 Each priority includes goals objectives and measurable action plans that are monitored at monthly leadership meetings led by senior DHS officials including the Under Secretary for Management To achieve this outcome DHS needs to continue to demonstrate sustainable progress integrating its management functions within and across the department as well as fully address the other 13 outcomes it has not yet fully achieved What Remains to Be Done Over the years we have made hundreds of recommendations related to DHS management functions and many have been implemented Continued progress for this high-risk area depends primarily on addressing the remaining outcomes In the coming years DHS needs to continue implementing its Integrated Strategy for High-Risk Management to show measurable sustainable progress in implementing corrective actions and achieving outcomes In doing so it remains important for DHS to • maintain its current level of top leadership support and sustained commitment to ensure continued progress in executing its corrective actions through completion • continue to identify the people and resources necessary to make progress towards achieving outcomes work to mitigate shortfalls and Page 188 GAO-19-157SP High-Risk Series Strengthening Department of Homeland Security Management Functions prioritize initiatives as needed and communicate to senior leadership critical resource gaps Related GAO Products • continue to implement its plan for addressing this high-risk area and periodically provide assessments of its progress to us and Congress • closely track and independently validate the effectiveness and sustainability of its corrective actions and make midcourse adjustments as needed and • make continued progress in achieving the 13 outcomes it has not fully addressed and demonstrate that systems personnel and policies are in place to ensure that progress can be sustained over time DHS Acquisitions Additional Practices Could Help Components Better Develop Operational Requirements GAO-18-550 Washington D C August 8 2018 Homeland Security Acquisitions Leveraging Programs’ Results Could Further DHS’s Progress to Improve Portfolio Management GAO-18-339SP Washington D C May 17 2018 Cybersecurity Workforce Urgent Need for DHS to Take Actions to Identify Its Position and Critical Skill Requirements GAO-18-175 Washington D C February 6 2018 DHS Financial Management Better Use of Best Practices Could Help Manage System Modernization Project Risks GAO-17-799 Washington D C September 26 2017 Homeland Security Progress Made to Implement IT Reform but Additional Chief Information Officer Involvement Needed GAO-17-284 Washington D C May 18 2017 Homeland Security Acquisitions Identifying All Non-Major Acquisitions Would Advance Ongoing Efforts to Improve Management GAO-17-396 Washington D C April 13 2017 Homeland Security Acquisitions Earlier Requirements Definition and Clear Documentation of Key Decisions Could Facilitate Ongoing Progress GAO-17-346SP Washington D C April 6 2017 Page 189 GAO-19-157SP High-Risk Series Ensuring the Effective Protection of Technologies Critical to U S National Security Interests Ensuring the Effective Protection of Technologies Critical to U S National Security Interests Agencies within this portfolio of programs have made some progress towards ensuring the effective protection of technologies but several areas remain unaddressed including improved interagency coordination Why Area Is High Risk The Department of Defense spends billions of dollars each year to develop and acquire sophisticated technologies that provide an advantage for the warfighter during combat or other missions Many of these technologies are also sold or transferred to promote U S economic foreign policy and national security interests These technologies can also be acquired by foreign entities through investment in the U S companies that develop or manufacture them In addition they are targets for unauthorized transfer such as theft espionage reverse engineering and illegal export To identify and protect technologies critical to U S interests the U S government has a number of programs and activities These include export controls—those developed to regulate exports and ensure that items and information are transferred to foreign parties consistent with U S interests—as well as other activities including the Foreign Military Sales program antitamper policies the National Industrial Security Program and the Committee on Foreign Investment in the United States These activities are administered by multiple federal agencies including the Departments of Defense Commerce Homeland Security Justice State and the Treasury We designated this area as high risk in 2007 because these programs established decades ago were ill-equipped to address the evolving 21st century challenge of balancing national security concerns and economic interests Contact Information For additional information about this high-risk area contact William T Woods at 202 512-4841 or woodsw@gao gov Since our 2017 High-Risk Report ratings for all five criteria remain unchanged Additional leadership commitment is still needed to promote interagency collaboration across the portfolio of critical technology programs Officials at both the multi-agency Committee on Foreign Investment in the United States and the Department of Defense’s National Industrial Security Program need to take action to clarify resource needs Additional efforts are also needed to implement recommendations we made in March 2012 May 2017 and August 2017 to develop and track metrics to monitor program performance for both export controls and other programs Over the years since this area was added to the High-Risk List we have made numerous recommendations related to this high-risk issue 16 of which were made since the last high-risk update in February 2017 As of December 2018 25 recommendations are open Export Controls Since our 2017 High-Risk Report ratings for all five criteria remain unchanged Leadership commitment met An interagency review to fundamentally reform the U S export control system—the Export Control Reform Initiative—was established in 2010 and it has demonstrated strong leadership commitment Many of the actions under this initiative are complete and leaders at key federal agencies continue to focus on remaining steps Page 190 GAO-19-157SP High-Risk Series Ensuring the Effective Protection of Technologies Critical to U S National Security Interests Capacity partially met The initial review of all 21 United States Munitions List categories is nearing completion and the transition to a single information technology system—USXPORTS—is complete However the absence of key stakeholders’ participation has slowed progress for other efforts The 15 federal agencies that are part of the Export Enforcement Coordination Center E2C2 continue to coordinate and exchange investigation-related information but according to E2C2 officials procedures for coordination between the investigative export control enforcement agencies and the intelligence community have not been finalized Action plan met While the Export Control Reform Initiative is no longer formally active leaders at key federal agencies told us they continue to implement efforts under the initiative—with reforms to export control lists enforcement and information technology Monitoring partially met We made four recommendations in March 2012 that departments with responsibilities for export control enforcement take steps to more effectively monitor resources spent on export control enforcements activities and develop and implement metrics for monitoring their effectiveness Of the four recommendations one remains open for Homeland Security to establish procedures to facilitate data sharing between the enforcement agencies and the intelligence community to measure illicit transshipment activity Homeland Security officials told us that the department has not yet formalized its planned intelligence analytical unit and as a result is unable to establish baseline and trend data analysis Demonstrated progress partially met Important steps have been completed for improving the efficiency and effectiveness of the export control process For example the export control licensing agencies have reviewed all of the 21 United States Munitions List categories to determine which items in those categories should remain under Department of State control or move to Department of Commerce control According to State Department officials the public comment period ended in July 2018 for categories I-III firearms artillery and ammunition respectively and a final decision on transfer of these items is expected in 2019 In March 2019 we expect to issue a report reviewing export controls of firearms Progress in export enforcement has stalled however because the enforcement and intelligence communities have not yet formally coordinated and the E2C2 does not yet have a designated Intelligence Community Liaison This liaison was mandated by Executive Order 13558 which directed the establishment of the E2C2 and identified the participating departments and agencies Specifically the E2C2 has not yet implemented all seven of its standard operating procedures including Page 191 GAO-19-157SP High-Risk Series Ensuring the Effective Protection of Technologies Critical to U S National Security Interests collaboration with the intelligence agencies According to Homeland Security officials currently the E2C2 is performing only de-confliction a forum for sharing information among multiple export enforcement agencies and identifying and resolving conflicts between them What Remains to Be Done The need for action remains in addressing Capacity Monitoring and Demonstrated Progress The E2C2 is performing a critical role in coordinating export control enforcement activities with participation across a wide breadth of federal agencies However according to Homeland Security officials the E2C2 and the intelligence community’s lack of formal coordination limits E2C2’s effectiveness stalling its efforts to develop standard operating procedures Until this coordination occurs the E2C2 is limited in its ability to realize its full potential to facilitate enhanced coordination and intelligence sharing Congressional Actions Needed Key agencies have taken necessary steps to reconcile various definitions regulations and policies for export controls If the agencies choose to proceed with consolidation activities initially planned under the 2010 Export Control Reform Initiative Congressional action will be required For example because there are currently separate statutory bases for the Departments of State and Commerce to review and issue export licenses legislation would be required to consolidate the current system into a single licensing agency Since our 2017 High-Risk Report ratings for all five criteria remain unchanged This segment was previously referred to as nonexport controls Other Programs Leadership commitment partially met Recent Congressional action may facilitate forward movement in this area The John S McCain National Defense Authorization Act for Fiscal Year 2019 included a requirement for the Department of Defense DOD to develop and annually update a critical technologies list which has the potential to improve coordination among the critical technology programs The act also made changes related to the Committee on Foreign Investment in the United States an interagency group that reviews certain foreign acquisitions mergers or takeovers of U S businesses to determine their effects on U S national security Capacity partially met In February 2018 we reported on capacity concerns at the Committee on Foreign Investment in the United States Page 192 GAO-19-157SP High-Risk Series Ensuring the Effective Protection of Technologies Critical to U S National Security Interests noting that from 2011 to 2016 the number of transactions reviewed by this committee grew by 55 percent while the staff assigned to the reviews increased by 11 percent In the John S McCain National Defense Authorization Act for Fiscal Year 2019 Congress cited our findings and provided for actions such as assessing whether adequate resources are needed for the committee and its member agencies Likewise in May 2018 we reported that officials responsible for the National Industrial Security Program—which safeguards federal government classified information that current or prospective contractors may access—faced resource challenges including an inability to manage staff workloads and complete necessary trainings We recommended that they identify the resources needed by the program among other things and DOD concurred Action plan partially met In May 2018 we reported on Defense Security Service plans to transition to a new approach for the National Industrial Security Program We cited challenges that the program is beginning to address Similarly we reported in May 2017 that DOD has issued policies and guidance that require planning for anti-tamper protections—which help preserve U S technological superiority from exploitation when weapon systems are lost on the battlefield or exported—early in the weapon system acquisition process Monitoring partially met In May 2017 we reported that DOD lacked metrics for tracking the effectiveness of changes to policies and procedures supporting anti-tamper protections DOD concurred with our recommendation that it determine how to measure progress and develop corresponding metrics but has not yet done so Similarly in August 2017 we found that DOD had addressed most of our past recommendations on the Foreign Military Sales program but had not collected relevant data necessary to measure program performance Demonstrated progress partially met We reported in 2015 that the portfolio of critical technology programs is fragmented and poorly coordinated across the government Individual programs and departments have taken steps to improve coordination individually within their agency or program but collective coordination across the critical technologies portfolio still needs improvement and overall direction What Remains to Be Done The need for action remains both at the individual program level and the portfolio level In February 2015 we made recommendations aimed at improving coordination among the programs that are designed to protect technologies critical to national security While progress has been made challenges remain in several key areas In particular following up on resource recommendations to the Committee on Foreign Investment in the United States and the National Industrial Security Program could lead Page 193 GAO-19-157SP High-Risk Series Ensuring the Effective Protection of Technologies Critical to U S National Security Interests to significant improvements in capacity Similarly following up on data collection and tracking recommendations for the anti-tamper program and the Foreign Military Sales program could better enable these programs to monitor their efforts Related GAO Products Committee on Foreign Investment in the United States Action Needed to Address Evolving National Security Concerns Facing the Department of Defense GAO-18-494 Washington D C July 10 2018 Defense Industrial Base Integrating Existing Supplier Data and Addressing Workforce Challenges Could Improve Risk Analysis GAO-18-435 Washington D C June 13 2018 Protecting Classified Information Defense Security Service Should Address Challenges as New Approach Is Piloted GAO-18-407 Washington D C May 14 2018 Committee on Foreign Investment in the United States Treasury Should Coordinate Assessments of Resources Needed to Address Increased Workload GAO-18-249 Washington D C February 14 2018 Foreign Military Sales DOD Needs to Improve Its Use of Performance Information to Manage the Program GAO-17-703 Washington D C August 22 2017 DOD Critical Technologies Additional Actions Needed to Ensure Consistent Protection of Weapon Systems GAO-17-292SU Washington D C May 9 2017 Critical Technologies Agency Initiatives Address Some Weaknesses but Additional Interagency Collaboration Is Needed GAO-15-288 Washington D C February 10 2015 Page 194 GAO-19-157SP High-Risk Series Improving Federal Oversight of Food Safety Improving Federal Oversight of Food Safety A government-wide approach is needed to address fragmentation in the federal food safety oversight system Why Area Is High Risk The safety and quality of the U S food supply both domestic and imported are governed by a highly complex system stemming from at least 30 federal laws that are collectively administered by 15 federal agencies For more than four decades we have reported on the fragmented federal food safety oversight system which has caused inconsistent oversight ineffective coordination and inefficient use of resources We added federal oversight of food safety to the High-Risk List in 2007 In recent years moreover we have made recommendations aimed at helping to reduce fragmentation in federal food safety oversight As of November 2018 two of three recommendations related to this high-risk area had not been implemented A 2011 estimate by the Centers for Disease Control and Prevention CDC — its most recent estimate—indicates that as a result of foodborne illness roughly 1 in 6 Americans 48 million people gets sick each year 128 000 are hospitalized and 3 000 die CDC data also show that the number of reported multistate foodborne illness outbreaks is increasing Although multistate outbreaks make up a small proportion of total outbreaks they affect greater numbers of people CDC cites several potential contributors to the increase in reported multistate outbreaks including greater centralization of food processing practices wider food distribution and improved detection and investigation methods Contact Information For additional information about this high-risk area contact Steve Morris at morriss@gao gov or 202 512-3841 Since our 2017 High-Risk Report ratings for all five criteria remain unchanged Leadership commitment partially met The Department of Health and Human Services HHS demonstrated leadership by updating its strategic and performance-planning documents to better address crosscutting food safety efforts as we recommended in December 2014 As of November 2018 however the U S Department of Agriculture USDA had not fully implemented our recommendation to update its strategic and planning documents although it agreed with our recommendation and took some steps to implement it Moreover in June 2018 the President proposed reorganizing USDA’s Food Safety and Inspection Service and the food safety functions of HHS’s Food and Drug Administration into a single agency While a reorganization could be a step toward addressing our prior recommendations additional information about the proposal as well as additional executive and legislative branch actions would be needed before such a proposal could be implemented Capacity partially met USDA has the capacity to more fully address crosscutting food safety efforts in its individual strategic and performance planning documents however Office of Management and Budget OMB action would be needed to build on HHS and USDA documents to develop a government-wide performance plan on food safety Such action could address our March 2011 recommendation for a government-wide plan and our December 2014 matter for congressional consideration for government-wide planning OMB has not taken action to develop such a plan Federal food safety agencies also have the capacity to participate in a centralized collaborative mechanism on food safety such as the Food Safety Working Group FSWG which the President established in 2009 to coordinate federal food safety efforts This group however is no longer meeting Congressional action would be required to formalize such a mechanism through statute Page 195 GAO-19-157SP High-Risk Series Improving Federal Oversight of Food Safety Action plan not met Without a government-wide performance plan for food safety Congress program managers and other decision makers are hampered in their ability to identify agencies and programs addressing similar missions and to set priorities allocate resources and restructure federal efforts as needed to achieve long-term goals Moreover without a centralized collaborative mechanism—like the FSWG—to address food safety there is no forum for agencies to reach agreement on a set of broad-based food safety goals and objectives that could be articulated in a government-wide performance plan on food safety Development of a national strategy for food safety could also fulfill these government-wide planning and leadership needs Such a strategy should among other things have a clearly stated purpose establish sustained leadership identify resource requirements and describe how progress will be monitored Monitoring not met Without a government-wide performance plan for food safety federal food safety efforts are not clear and transparent to the public Congress program managers other decision makers and the public must first understand what the federal government is currently doing to ensure the safety of the food supply To do so they must access attempt to make sense of and reconcile individual documents across the many federal agencies responsible for administering the numerous federal statutes governing food safety and quality A government-wide performance plan would also enable Congress and the agencies to monitor the effectiveness of their food safety programs particularly those involving more than one agency and call attention to areas needing corrective measures The need for government-wide monitoring could also be addressed through a national strategy for food safety Demonstrated progress partially met In January 2018 USDA and FDA signed an agreement to formalize ongoing coordination and collaboration efforts in the areas of produce safety and regulation of biotechnology products and other areas This agreement is a positive step However the development of a broader government-wide performance plan or a national strategy for food safety is still needed and could involve additional agencies such as those that we have previously identified as having a role in food safety These other agencies include 1 the Centers for Disease Control and Prevention which is responsible for preventing the transmission dissemination and spread of foodborne illness to protect the public health 2 the Department of Commerce’s National Marine Fisheries Service which provides voluntary fee-forservice examinations of seafood for safety and quality and 3 the Department of Homeland Security’s Customs and Border Protection which among other things inspects imports including food products plants and live animals for compliance with U S law and assists all federal agencies in enforcing their regulations at the border Such a Page 196 GAO-19-157SP High-Risk Series Improving Federal Oversight of Food Safety document could also more comprehensively fulfill government-wide planning and leadership needs and foster sustained progress in addressing fragmentation in the federal food safety oversight system What Remains to Be Done Actions are needed to address this high-risk area Specifically • As we recommended in January 2017 the appropriate entities within the Executive Office of the President EOP in consultation with relevant federal agencies and other stakeholders should develop a national strategy for food safety that among other things establishes sustained leadership identifies resource requirements and describes how progress will be monitored The EOP did not provide comments on our recommendation • USDA should implement our priority recommendation to more fully implement GPRA Modernization Act of 2010 requirements by providing in its strategic and performance planning documents additional detail on interagency food safety-related collaborations as we recommended in December 2014 USDA agreed with this recommendation Congressional Actions Needed Congress should consider directing OMB to develop a government-wide performance plan for food safety that includes results-oriented goals performance measures and a discussion of strategies and resources Congress should also consider formalizing the Food Safety Working Group through statute to help ensure sustained leadership across food safety agencies over time In addition if weaknesses in the food safety system persist over the next several years Congress may wish to consider commissioning a detailed analysis of alternative organizational structures for food safety Related GAO Products Food Safety Federal Efforts to Manage the Risk of Arsenic in Rice GAO-18-199 Washington D C March 16 2018 Imported Seafood Safety FDA and USDA Could Strengthen Efforts to Prevent Unsafe Drug Residues GAO-17-443 Washington D C September 15 2017 Food Safety A National Strategy Is Needed to Address Fragmentation in Federal Oversight GAO-17-74 Washington D C January 13 2017 Food Safety FDA Coordinating with Stakeholders on New Rules but Challenges Remain and Greater Tribal Consultation Needed GAO-16-425 Washington D C May 19 2016 Federal Food Safety Oversight Additional Actions Needed to Improve Planning and Collaboration GAO-15-180 Washington D C December 18 2014 Page 197 GAO-19-157SP High-Risk Series Protecting Public Health through Enhanced Oversight of Medical Products Protecting Public Health through Enhanced Oversight of Medical Products The Food and Drug Administration FDA needs to increase monitoring of medical products manufactured overseas and improve planning for drug shortages Why Area Is High Risk Millions of medical products—drugs biologics and medical devices—are used daily by Americans at home in the hospital and in other health care settings FDA has the vital mission of protecting the public health by overseeing the safety and effectiveness of these products marketed in the United States The agency’s responsibilities begin long before a product is brought to market and continue after FDA approves a product regardless of whether it is manufactured in the United States or abroad In recent years FDA has been confronted with multiple challenges including 1 rapid changes in science and technology 2 globalization as more products are manufactured abroad 3 unpredictable public health crises 4 an increasing workload and 5 the continuing need to monitor the safety of thousands of marketed medical products The oversight of medical products was added to our High-Risk List in 2009 because these obstacles threatened to compromise FDA’s ability to protect public health While progress has been made challenges remain related to FDA’s ability to respond to globalization and to help ensure the availability of drugs Contact Information For additional information about this high-risk area contact Mary DeniganMacauley or John E Dicken at 202 512-7114 or deniganmacauleym@gao gov or dickenj@gao gov Since our 2017 High-Risk Report our assessment of efforts to address ratings for all five criteria remains unchanged FDA continues to demonstrate top leadership support for improving its oversight of medical products for both the globalization and drug availability segments However the agency has not fully met the remaining criteria While the overall rating has not changed FDA has now met the capacity criterion for the globalization segment as FDA increased inspections of foreign manufacturers However FDA must continue to take actions to monitor foreign establishments and its foreign offices to meet the criterion for demonstrating progress In addition while the overall rating has not changed FDA now meets the monitoring criterion for the drug availability segment as it has implemented and consistently used a new drug shortages information system and established procedures for using this system FDA also now has a procedure to evaluate its response to drug shortages However FDA’s capacity and lack of an action plan to address drug availability remains a challenge including the agency not using its drug shortage information system to also analyze trends and identify patterns to help predict future shortages Response to Globalization Since our 2017 High-Risk Report ratings for one criterion improved and four remain unchanged FDA continues to meet the leadership commitment and action plan criteria and has now met the criterion for capacity Leadership commitment met FDA met this criterion in 2015 The agency has demonstrated leadership commitment by 1 creating an office dedicated to Page 198 GAO-19-157SP High-Risk Series Protecting Public Health through Enhanced Oversight of Medical Products confronting the challenges of globalization and 2 identifying a goal of expanding its regulatory presence and partnerships overseas Capacity met FDA’s recent actions have met this criterion Since 2015 FDA has consistently conducted an increased number of inspections of foreign manufacturers and selected facilities for inspection based on risk In addition FDA reported in 2018 that it reduced the number of foreign drug establishments with no inspection history from approximately 1 000 to just over 100 Further the agency has also improved the capacity of its overseas offices Overall vacancy rates for these offices have declined in recent years though significant gaps in staffing still remain at times while staff complete necessary processes to be stationed overseas FDA also signed mutual recognition agreements with many European countries that have allowed it to gain capacity by using information from inspectors from these countries Action plan met FDA met this criterion in 2015 The agency has developed an action plan for building a stronger more secure global product safety net It also developed a plan to partner with other foreign regulatory authorities to leverage their resources FDA has since determined that 20 foreign regulators are capable of conducting inspections that meet FDA’s requirements and as of November 13 2018 had reviewed 50 inspections conducted by foreign regulators Monitoring partially met In December 2016 we reported that FDA took steps to better monitor its program for inspecting foreign and domestic establishments Since then FDA has taken steps to improve the accuracy and completeness of information used for that program Starting in 2017 FDA began an effort to inspect within 3 years all establishments for which it had no prior history of inspection FDA has made progress in inspecting these sites and expects to complete this task in fiscal year 2019 FDA has also made progress monitoring the contributions of its overseas offices though it has not fully developed measures that allow it to systematically track how office activities contribute to drug safety outcomes Demonstrated progress partially met FDA has taken a variety of steps to respond to globalization including improving the accuracy and completeness of its information on foreign manufacturers and deciding that it will no longer allow more than 5 years to elapse between inspections at a specific establishment However FDA must continue to demonstrate that it can sustain its capacity to conduct more inspections What Remains to Be Done Over the years since we added this area to our High-Risk List we have made numerous recommendations related to the agency’s response to globalization As of December 2018 two recommendations remain open Page 199 GAO-19-157SP High-Risk Series Protecting Public Health through Enhanced Oversight of Medical Products FDA should implement our recommendations to 1 develop performance measures and 2 assess the effectiveness of the foreign offices’ contributions by systematically tracking information to measure whether the offices’ activities specifically contribute to drug safety-related outcomes such as inspecting facilities issuing import alerts to block potentially dangerous products and sending warning letters to manufacturers with significant regulatory violations In addition to our two open recommendations FDA should complete its efforts to inspect all establishments without an inspection history and ensure all establishments continue to be inspected at an appropriate frequency Since our 2017 High-Risk Report ratings for one criterion improved and four remain unchanged FDA continues to meet the criteria of leadership commitment and has now met the criterion for monitoring Drug Availability Leadership commitment met In the 2015 High-Risk Report we recognized FDA demonstrated leadership commitment by issuing a strategic plan for preventing and mitigating drug shortages and also by including the agency’s ability to respond to drug shortages in its strategic priorities FDA’s commitment to addressing this public health concern continues to be strong as evidenced by its recent formation of a drug shortages task force The task force is charged with delving more deeply into the reasons for persistent shortages and seeking solutions to address their underlying causes FDA also held a public meeting in November 2018 to obtain advice from stakeholders on ways to avert drug shortages Capacity partially met As noted in prior years FDA improved its capacity to respond to drug shortages by increasing the number of dedicated personnel devoted to responding to drug shortages and prioritized its review of applications to market generic drugs However with the median time to approve prioritized generic drug applications at over a year this approach is not an effective short-term solution While FDA is taking steps to address drug shortages it is important to recognize that FDA cannot resolve them alone In the past 2 years several agency actions may help support industry’s capacity to prevent or mitigate shortages related to manufacturing problems First using the authority it was given in 2016 through the 21st Century Cures Act FDA has awarded research grants to several universities to study continuous manufacturing This approach has the potential to shorten production times and improve the efficiency of manufacturing processes Second Page 200 GAO-19-157SP High-Risk Series Protecting Public Health through Enhanced Oversight of Medical Products FDA established its Emerging Technology Program to help encourage the industry to develop new technologies that may improve manufacturing and reduce the chance of supply disruptions Through the program industry representatives can meet with FDA staff to discuss potential concerns related to these new technologies such as the development of ultra-long-acting oral formulations before seeking agency approval However according to FDA officials the agency may not have sufficient resources available to ensure the availability of drugs more broadly Specifically in 2017 FDA noted that its resources to conduct its over-thecounter drug responsibilities were inadequate A lengthy regulatory process has hindered the availability of new drug ingredients to the U S market such as those included in sunscreen Consequently the agency noted that it has not allowed the marketing of many new over-the-counter drugs or made timely changes to existing over-the-counter drugs based on emerging safety issues or evolving science Action plan partially met FDA implemented a new data system in 2016 to track potential and existing drug shortages and manage its workload While it uses this system for monitoring FDA has not made plans to use these data to analyze trends or identify patterns to help predict future shortages to assist with managing efforts The formation of FDA’s new drug shortages task force may provide the opportunity to plan future actions strategically According to FDA the task force will evaluate the reimbursement policies of the Centers for Medicare Medicaid Services and other payers that could be making it difficult for companies to manufacture certain drugs profitably It is also exploring ways to receive more timely information about potential supply disruptions Nonetheless FDA still needs to take actions to address shortcomings in its broader strategic planning efforts related to its oversight of drugs and other medical products Also in May 2016 we found weaknesses in the agency’s lack of measurable goals for advancing regulatory science—the science supporting its effort to assess the safety efficacy quality and performance of the products it regulates Monitoring met FDA has met this criterion through its recent actions In June 2017 we determined while following up on open recommendations that FDA was consistently using its new drug shortage information system to track potential and existing shortages This system remains in use for monitoring purposes In addition the agency established formal procedures for using the system and performance measures to evaluate its ability to respond when shortages occur Also in June 2018 FDA issued its annual report on drug shortages This report contained a full year’s worth of data and provided policymakers with the ability to more closely monitor shortage information and obtain a more realistic view of this public health problem Page 201 GAO-19-157SP High-Risk Series Protecting Public Health through Enhanced Oversight of Medical Products Demonstrated progress partially met FDA has implemented some of our recommendations including consistently using its drug shortage information system to improve its ability to respond to drug shortages However drug shortages remain a public health concern and FDA has not fully addressed the recommendations that we have made such as periodically analyzing its shortage data to proactively identify risk factors and better collecting tracking and analyzing data related to safety of drugs after they are marketed What Remains to Be Done Related GAO Products Over the years since we added this area to our High-Risk List we have made numerous recommendations related to drug availability 5 of which were made since the last high-risk update in February 2017 As of December 2018 12 recommendations remain open Although FDA alone cannot guarantee drug availability the agency can take important steps to help ensure that safe and effective drugs are accessible to patients FDA should implement our recommendations including to • conduct periodic analyses to assess drug shortage information to proactively identify risk factors for potential drug shortages • develop comprehensive plans including goals and time frames to correct problems with its data for monitoring safety after a product is on the market and ensure that these data can be easily used for oversight • plan strategically to identify challenges that cut across FDA’s multiple centers that oversee medical products and document how the agency will achieve measurable goals and objectives in these areas and • develop and document measurable goals such as targets and time frames for FDA’s regulatory science efforts so it can consistently assess and report on the agency's progress in regulatory science efforts Generic Drugs FDA Should Make Public Its Plans to Issue and Revise Guidance on Nonbiological Complex Drugs GAO-18-80 Washington D C December 14 2017 Sunscreen FDA Reviewed Applications for Additional Active Ingredients and Determined More Data Needed GAO-18-61 Washington D C November 15 2017 Investigational New Drugs FDA Has Taken Steps to Improve the Expanded Access Program but Should Further Clarify How Adverse Events Data Are Used GAO-17-564 Washington D C July 11 2017 Generic Drug User Fees Application Review Times Declined but FDA Should Develop a Plan for Administering Its Unobligated User Fees GAO-17-452 Washington D C May 25 2017 Page 202 GAO-19-157SP High-Risk Series Protecting Public Health through Enhanced Oversight of Medical Products Antibiotics FDA Has Encouraged Development but Needs to Clarify the Role of Draft Guidance and Develop Qualified Infectious Disease Product Guidance GAO-17-189 Washington D C January 31 2017 Drug Safety FDA Has Improved Its Foreign Drug Inspection Program but Needs to Assess the Effectiveness and Staffing of Its Foreign Offices GAO-17-143 Washington D C December 16 2016 Drug Shortages Public Health Threat Continues Despite Efforts to Help Ensure Product Availability GAO-14-194 Washington D C February 10 2014 Page 203 GAO-19-157SP High-Risk Series Transforming EPA’s Process for Assessing and Controlling Toxic Chemicals Transforming EPA’s Process for Assessing and Controlling Toxic Chemicals The Environmental Protection Agency EPA has taken steps to manage chemicals that pose risks to human health and the environment but leadership and implementation challenges remain Why Area Is High Risk EPA’s ability to effectively implement its mission of protecting public health and the environment is dependent on assessing the risks posed by chemicals in a credible and timely manner Such assessments are the cornerstone of scientifically sound environmental decisions policies and regulations under a variety of statutes such as the Safe Drinking Water Act and the Clean Air Act EPA prepares assessments of chemical hazards to human health under its IRIS Program among others The importance of IRIS has increased over time as EPA program offices and regions have relied on the program’s toxicity assessments in making environmental protection and risk management decisions EPA is also authorized under TSCA to obtain information on the risks of chemicals and to control chemicals the agency determines pose an unreasonable risk This act was amended in 2016 by the Frank R Lautenberg Chemical Safety for the 21st Century Act The Lautenberg Act provides EPA with greater authority to address chemical risks but implementation will take years because of the complexity and scope of the legislation Because EPA had not developed sufficient chemical assessment information under these programs to limit exposure to many chemicals that may pose substantial health risks we added this issue to the High-Risk List in 2009 as a government program in need of broad-based transformation Contact Information For additional information about this high-risk area contact J Alfredo Gómez at 202 512-3841 or gomezj@gao gov Since our 2017 High-Risk Report four criteria remain unchanged However the leadership commitment rating decreased from met to partially met in 2019 For more information on EPA’s recent progress toward producing chemical assessments and implementing TSCA see our March 2019 chemical assessments report GAO-19-270 Integrated Risk Information System IRIS Since our 2017 High-Risk Report ratings for capacity action plan monitoring and demonstrated progress remain unchanged However the rating for leadership commitment declined to partially met Leadership commitment partially met This rating has declined from met in 2017 In our 2017 High-Risk Report we reported that the EPA Administrator demonstrated leadership commitment to the IRIS Program by identifying action on toxics and chemical safety as one of her top seven priorities for the agency—priorities that included the IRIS Program However current EPA leadership has not made a similar statement While EPA released a document in late December 2018 called the IRIS Program Outlook identifying ongoing chemical assessments EPA leadership also proposed significant cuts to the program’s budget For the past two years EPA’s budget justification for human health risk assessment work was reduced to about $22 million from its fiscal year 2017 budget of $40 5 million contributing to a lower rating than we gave in 2017 Congress did not support these reductions Specifically according to the joint explanatory statements accompanying the Page 204 GAO-19-157SP High-Risk Series Transforming EPA’s Process for Assessing and Controlling Toxic Chemicals Consolidated Appropriations Act 2018 and Consolidated Appropriations Act 2019 Congress has agreed to continue providing funding at fiscal year 2017 enacted levels EPA leadership’s long-term accountability for actions has been limited as demonstrated by four IRIS assessments that were in the later stages of development on the 2015 Multi-Year agenda but have not been released or included on the December 2018 list of assessments EPA provided no information on the status of these assessments or whether it plans to discontinue working on them or restart them at another time As we have previously reported an overarching factor that affects EPA’s ability to complete IRIS assessments in a timely manner is that once a delay in the assessment process occurs work that has been completed can become outdated necessitating rework throughout some or all of the assessment process Thus it remains to be seen when these assessments can be expected to move to the next step in the IRIS process or be completed Capacity partially met As our March 2019 chemical assessments report indicates the IRIS program has made progress in addressing some challenges to its assessment process including adopting project management principles and new software streamlining the peer review process implementing systematic review and making changes to the frequency and type of communication among others It will take resources to implement all of these process improvements We will continue to monitor EPA’s efforts and assess the progress the agency is making Our previous work has shown that decision makers in the United States and around the world rely on information from IRIS assessments Because of this key role we are concerned that without adequate funding untimely implementation of IRIS assessments could have profound impacts on chemical risk management activities Action plan partially met As we reported in our 2017 High-Risk Report EPA had not evaluated the demand for IRIS toxicity assessments with input from users inside and outside EPA EPA issued an IRIS Multi-Year Agenda in December 2015 According to EPA the purpose of the 2015 agenda was to 1 identify IRIS assessments currently under way and their status 2 prioritize IRIS assessments that will be initiated over the next few years and 3 evaluate assessment needs and develop an updated process for existing IRIS values In December 2018 EPA issued the IRIS Program Outlook but it was missing some key information The Outlook identifies assessments currently underway and lists the next anticipated step in the IRIS process However the Outlook fails to list the projected date for most of the assessments and includes no information regarding assessment prioritization—including how these assessments will meet program and regional office needs Moreover we recommended in May 2013 that EPA should develop an Action Plan or strategy among other things to address the needs of EPA program offices and regions Page 205 GAO-19-157SP High-Risk Series Transforming EPA’s Process for Assessing and Controlling Toxic Chemicals when IRIS toxicity assessments are not available the agency is still working to do so Monitoring met The IRIS Program produced a report to Congress which offered an overview of progress in January 2018 and took part in a National Academies of Sciences NAS review of the program in February 2018 which offered a third-party assessment of the program’s efforts The resulting NAS report provided a supportive assessment of ongoing transformations aimed at ensuring data quality new systematic approaches for data analysis and expanded stakeholder engagement efforts and increasing efficiency of assessments According to the report NAS reviewers were impressed with the changes being instituted in the IRIS Program since 2014 including substantive reforms by new IRIS Program leadership such as the development implementation and use of systematic review methods to conduct IRIS assessments For EPA to sustain the rating for the monitoring criterion the agency will need to provide clear milestones and metrics for its action plan and monitor progress toward them Demonstrated progress partially met EPA provided a list of chemicals in the December 2018 IRIS Program Outlook However it is not clear what data and priorities EPA used to establish its current priorities or when it will assign time frames and future resources to ensure sustained performance For example according to the 2015 IRIS Multi-Year Agenda the formaldehyde assessment was being revised to incorporate elements of systematic review and was to be released for public comment and external peer review However the December 2018 IRIS Program Outlook does not list the formaldehyde assessment and provides no explanation of why the assessment was not included The IRIS Program issued an assessment of Hexahydro-1 3 5-trinitro-1 3 5-triazine RDX in August 2018 although it took almost 2 decades What Remains to Be Done Since we added the IRIS Program to our High-Risk List in 2009 we have made nine recommendations related to the IRIS segment of this high-risk issue As of mid-February 2019 six recommendations remain open EPA will need to implement these recommendations along with meeting the High-Risk criteria discussed above to make progress As noted in several of our recommendations EPA should among other things • Assess the feasibility and appropriateness of the established time frames for each step in the IRIS assessment process including whether different time frames should be established for different types of IRIS assessments • Publish IRIS agendas on which chemicals EPA is actively assessing and when it plans to start assessments of the other listed chemicals to demonstrate progress Page 206 GAO-19-157SP High-Risk Series Transforming EPA’s Process for Assessing and Controlling Toxic Chemicals • Develop a strategy to address the needs of EPA Program Offices and regions when IRIS toxicity assessments are not available In addition our March 2019 chemical assessments report provides information on what remains to be done to address challenges e g producing assessments in the IRIS Program Congressional Actions Needed EPA and Congress should continue to ensure that the resources dedicated to IRIS are sufficient to implement it and to maintain a viable database of chemical assessments Since our 2017 High-Risk Report ratings for capacity monitoring and demonstrated progress progressed to partially met The rating for leadership commitment remains unchanged at met and for action plan at partially met Toxic Substances Control Act TSCA Leadership commitment met In January 2019 the Acting Administrator indicated his commitment to fulfill EPA obligations under TSCA He stated that EPA had among other things released guidance and policy on confidential business information a strategy to reduce animal testing and a final mercury reporting rule In addition EPA's First Year Implementation Plan identified actions taken to meet the deadlines in the new law such as 1 identifying the initial 10 work plan chemicals to be assessed under TSCA 2 establishing a process and criteria for identifying high-priority chemicals for risk evaluation under TSCA and 3 issuing a rule that establishes EPA’s process for evaluating risks from high-priority chemicals under TSCA Further as of December 2018 EPA had implemented two of our recommendations made in 2013 regarding TSCA As we elaborate in our March 2019 chemical assessments report EPA has encountered some challenges in implementing the Lautenberg Act and as of mid-February 2019 several lawsuits were pending In our chemical assessments report we discuss for example EPA's capacity to implement the program collect appropriate fees and demonstrate progress How EPA addresses these matters will be key to continuing to meet the leadership criterion in the future Capacity partially met The Lautenberg Act provides EPA with greater authority to address chemical risks but in turn increases both EPA’s responsibility for regulating chemicals and its workload EPA recently issued a rule under the act to collect fees from certain companies to defray a portion of TSCA implementation costs but it is unclear whether Page 207 GAO-19-157SP High-Risk Series Transforming EPA’s Process for Assessing and Controlling Toxic Chemicals the fees collected will be sufficient to support relevant parts of the program According to EPA the agency will be tracking its costs and use that information to adjust future fees if appropriate As required by law EPA will evaluate and readjust if necessary the fees every 3 years Action plan partially met EPA’s strategic plan discusses general approaches for meeting statutory requirements and mandatory deadlines of TSCA EPA issued a First Year Implementation Plan in June 2016 noting that this document is intended to be a roadmap of major activities EPA will focus on during the initial year of implementation As of midFebruary 2019 the plan had not been updated although EPA had indicated that the plan would be further developed over time Monitoring partially met The Lautenberg Act provided EPA with significant new authorities to regulate chemicals but EPA's full implementation will take many years EPA has partially met the criterion for monitoring because it is too soon to determine whether EPA’s approach to managing chemicals within the new TSCA authorities will position the agency to achieve its goal of ensuring the safety of chemicals We will continue to monitor TSCA as the agency implements this important legislation Demonstrated progress partially met As our chemical assessments report describes EPA has responded to many of the new provisions in the Lautenberg Act For example EPA has issued rules governing the prioritization and conduct of chemical assessments under TSCA In addition EPA told us about efforts to engage EPA offices in a variety of ways to obtain information necessary to conduct risk evaluations and to leverage the expertise and experience of experts within the agency However EPA did not provide us with documentation that these activities have occurred Moreover EPA has additional Lautenberg Act requirements to address in the years ahead What Remains to Be Done Since we added TSCA implementation to our High-Risk List in 2009 we have made three recommendations related to this high-risk issue EPA will need to implement one open recommendation along with meeting the high-risk criteria discussed above to make progress As noted in several criteria above EPA needs to maintain leadership commitment and ensure that it has the resources and plans in place to facilitate progress For example for the demonstrated progress criterion EPA will need to respond to provisions in the Lautenberg Act such as having 20 ongoing risk evaluations by December 2019 and making findings on the safety of all new chemicals In addition our March 2019 chemical assessments report discusses what remains to be done to address challenges e g process improvements in implementing the Lautenberg Act Page 208 GAO-19-157SP High-Risk Series Transforming EPA’s Process for Assessing and Controlling Toxic Chemicals Congressional Actions Needed EPA and Congress should consider ensuring that the resources dedicated to TSCA activities are sufficient to implement TSCA reform activities Related GAO Products Chemical Assessments Status of EPA’s Efforts to Produce Assessments and Implement the Toxic Substances Control Act GAO-19-270 Washington D C March 4 2019 Chemical Innovation Technologies to Make Processes and Products More Sustainable GAO-18-307 Washington D C February 8 2018 Chemicals Management Observations on Human Health Risk Assessment and Management by Selected Foreign Programs GAO-16111R Washington D C October 9 2015 Chemical Assessments Agencies Coordinate Activities but Additional Action Could Enhance Efforts GAO-14-763 Washington D C September 29 2014 Chemical Regulation Observations on the Toxic Substances Control Act and EPA Implementation GAO-13-696T Washington D C June 13 2013 Chemical Assessments An Agencywide Strategy May Help EPA Address Unmet Needs for Integrated Risk Information System Assessments GAO-13-369 Washington D C May 10 2013 Toxic Substances EPA Has Increased Efforts to Assess and Control Chemicals but Could Strengthen Its Approach GAO-13-249 Washington D C March 22 2013 Chemical Assessments Challenges Remain with EPA’s Integrated Risk Information System Program GAO-12-42 Washington D C December 9 2011 Chemical Assessments Low Productivity and New Interagency Review Process Limit the Usefulness and Credibility of EPA’s Integrated Risk Information System GAO-08-440 Washington D C March 7 2008 Page 209 GAO-19-157SP High-Risk Series VA Acquisition Management VA Acquisition Management The Department of Veterans Affairs VA Acquisition Management is a new high-risk area as VA must demonstrate greater leadership commitment and strategic planning to ensure efficient use of its acquisition funding and staffing resources Why Area Is High Risk VA spends tens of billions of dollars to procure a wide range of goods and services—including medical supplies and construction—to meet its mission of providing health care and other benefits to millions of veterans In fiscal year 2019 the VA received the largest discretionary budget in its history—$86 5 billion About a third of VA’s discretionary budget in fiscal year 2017 or $26 billion has been used to contract for goods and services VA has one of the most significant acquisition functions in the federal government both in obligations and number of contract actions VHA provides medical care to veterans and is VA’s largest administration Since 2015 we have made 31 recommendations 10 have been implemented 21 remain open to address challenges in VA’s acquisition management including 1 outdated acquisition regulations and policies 2 lack of an effective medical supplies procurement strategy 3 inadequate acquisition training 4 contracting officer workload challenges 5 lack of reliable data systems 6 limited contract oversight and incomplete contract file documentation and 7 leadership instability In light of these challenges and given the significant taxpayer investment it is imperative that VA use its funding in the most efficient manner possible when acquiring goods and services As such we have added VA Acquisition Management as a new highrisk area in 2019 Contact Information For additional information about this high-risk area contact Shelby S Oakley at 202-512-4841 or oakleys@gao gov We are adding VA Acquisition Management as a new high-risk area in light of numerous contracting challenges and given the significant investment in resources to fulfill its critical mission of serving veterans The department needs to use these resources in the most efficient manner possible when acquiring goods and services to meet the needs of those who served our country Outdated acquisition regulations and policies VA’s procurement policies have historically been outdated disjointed and difficult for contracting officers to use In September 2016 we reported that 1 the acquisition regulations contracting officers currently follow have not been fully updated since 2008 and 2 VA had been working on completing a comprehensive revision of its acquisition regulations since 2011 VA’s delay in updating this fundamental source of policy has impeded the ability of contracting officers to effectively carry out their duties We recommended in September 2016 that VA identify measures to expedite the revision of its acquisition regulations and clarify what policies are currently in effect VA concurred with this recommendation and has made some progress in updating its acquisition regulations and rescinding outdated policies but more work remains to be done over the next several years Of the 41 parts in the new version of VA’s acquisition regulations VA reports that • 14 have been published as final rules • 5 have completed the public comment process and VA is addressing the comments received • 1 is undergoing further evaluation by the Office of Management and Budget and Page 210 GAO-19-157SP High-Risk Series VA Acquisition Management • 21 are at an earlier stage of the rulemaking process VA reported that it is unsure when all parts will be out for public comment but the updated final version of its acquisition regulations will not be complete until April 2021 VA has also reported that it has rescinded many irrelevant policy documents and updated those that remain relevant Officials said they plan to rescind or update the few remaining outdated policy documents in January 2019 Lack of an effective medical supplies procurement strategy VA’s program for purchasing medical supplies has not been effectively executed nor is it in line with practices at leading hospitals To support more efficient purchasing of medical supplies for its 172 medical centers that serve the needs of about 9 million veterans VA launched the Medical Surgical Prime Vendor-Next Generation MSPV-NG program in December 2016 MSPV-NG was part of its overall effort to transform its supply chain and achieve $150 million in cost avoidance In November 2017 we reported that VA’s approach to developing its catalog of supplies was rushed lacked key stakeholder involvement and buy-in and relied on establishing non-competitive blanket purchase agreements for the overwhelming majority of products resulting in low utilization by medical centers VA had set a target that medical centers would order 40 percent of their supplies from the MSPV-NG catalog but utilization rates were below this target with a nationwide average utilization rate across medical centers of about 24 percent as of May 2017 This low utilization adversely affected VA’s ability to achieve its cost avoidance goal We recommended in November 2017 that VA develop document and communicate to stakeholders an overarching strategy for the program VA concurred with this recommendation and reported that it would develop and communicate a new medical supplies procurement strategy to clinical and logistics staff This strategy was originally planned to be completed by December 2017 but has now been delayed to March 2019 Inadequate acquisition training VA acquisition training at times has not been comprehensive nor provided to staff that could benefit from it A 2006 statute required and a 2016 Supreme Court decision Kingdomware Technologies Inc v United States reaffirmed that VA is to give preference to veteran-owned small businesses when competitively awarding contracts—a program known as Veterans First In September 2018 we reported that training on VA’s Veterans First policy did not address some of its more challenging aspects For example many of the contracting officers we interviewed were uncertain about how to balance the preference for veteran-owned small businesses with fair and reasonable price determinations when lower prices might be found on the open market Page 211 GAO-19-157SP High-Risk Series VA Acquisition Management In addition VA provided several installments of online training sessions on the Veterans First policy to contracting officers but did not make them mandatory As a result only 52 percent of VA contacting officers completed the follow-up training by the spring of 2018 We recommended in September 2018 that VA provide more targeted training to contracting officers on how to implement the Veterans First policy particularly in the area of making fair and reasonable price determinations and assess whether this training should be designated as mandatory VA concurred with these recommendations and stated that it is taking steps to implement them Contracting officer workload challenges The majority of our reviews since 2015 have highlighted workload as a contributing factor to the challenges that contracting officers face Most recently in September 2018 we reported that about 54 percent of surveyed VA contracting officers said their workload was not reasonable and found that workload stresses have exacerbated the struggles that they face implementing the department’s Veterans First policy In addition in September 2016 we reported that the contracting officers at the Veterans Health Administration VHA processed a large number of small dollar-value actions to support medical center operations many of which involve emergency procurements of routine items to support immediate patient care Contracting officers and the department’s Acting Chief Acquisition Officer CAO told us that these frequent and urgent small-dollar transactions reduce contracting officers’ efficiency and ability to take a strategic view of VHA’s overarching procurement needs We reported in November 2017 that emergency procurements accounted for approximately 20 percent—$1 9 billion—of VHA’s overall contract actions in fiscal year 2016 Figure 13 shows the percent of VHA contract actions designated as emergencies in fiscal year 2016 by each network contracting office Page 212 GAO-19-157SP High-Risk Series VA Acquisition Management Figure 13 Percent of VHA Contract Actions Designated as Emergencies Fiscal Year 2016 a Veterans Integrated Service Networks VISNs organizations that manage medical centers and associated clinics across a given geographic area are served by a corresponding network contracting office Some VISNs have been consolidated over time and in fiscal year 2016 there were 19 VISNs despite being numbered up to 23 As of fiscal year 2017 there are only 18 in total We recommended in November 2017 that VHA network contracting offices work with medical centers to identify opportunities to more strategically purchase goods and services frequently purchased on an emergency basis VA concurred with this recommendation and reported in December 2018 that it is utilizing a supply chain dashboard to track items purchased on an emergency basis and determine which of those items to include on the catalog VA noted that it added 13 300 items to the catalog from June 2018 to December 2018 including items often purchased on an emergency basis We requested documentation showing that items added to the catalog were previously purchased on an emergency basis but as of January 2019 VA had not yet provided it If implemented this would allow for both greater contracting officer efficiency and cost savings For example based on a similar recommendation we made in 2012 VA reported about $10 billion in savings over a 5-year period Lack of reliable data systems The lack of accurate data has been a long-standing problem at VA In September 2016 we reported that VA had not integrated its contract management and accounting systems resulting in duplicative efforts on the part of contracting officers and increased risk of errors We and VA’s Inspector General each recommended that VA perform data checks between the two systems VA concurred with this recommendation and some VA contracting organizations have made efforts to address this risk Further VA reported Page 213 GAO-19-157SP High-Risk Series VA Acquisition Management in December 2016 that it had selected the Department of Agriculture as the service provider for a new integrated financial system but told us in June 2018 that the new system would not be piloted until fiscal year 2020 In November 2017 we reported that the MSPV-NG program office relied almost exclusively on flawed data to identify medical and surgical items to be included in the catalog The program office estimated that the items in the initial release of the MSPV-NG catalog would meet 80 percent or more of the medical centers’ needs However the contracting office managing the program indicated that as of June 2017 only a third of the items in the initial MSPV-NG catalog would meet medical centers’ needs Senior VHA acquisition officials attributed this mismatch to shortcomings with VA’s historical purchase data Limited contract oversight and incomplete contract file documentation VA has had difficulty ensuring that its contracts are properly monitored and documented In September 2018 we reported that although VA obligated $3 9 billion to veteran-owned small businesses in fiscal year 2017 its contracting officers were not effectively monitoring compliance with key aspects of the department’s Veterans First policy such as limits on subcontracting which ensure that the goal of the program—to promote opportunities for veteran-owned businesses—is not undermined In many cases we found that clauses requiring compliance were not included in the VA’s contracts and orders with veteran businesses because the contracting officers either forgot to include them or were unaware of the requirement The contracting officers we spoke with also said that they do not have sufficient time or knowledge to conduct oversight Through limited reviews VA has identified a number of violations that would warrant a broader assessment of the fraud risks to the program We recommended in September 2018 that VA establish a mechanism to ensure that mandatory subcontracting-related clauses be consistently incorporated into set-aside contracts with veteran-owned businesses and that VA conduct a fraud risk assessment for the Veterans First program VA concurred with these recommendations and is taking steps to implement them We also reported in September 2016 that a number of VA contract files we reviewed were missing key documents increasing the risk that key processes and regulations were not followed We recommended that VA focus its internal compliance reviews to ensure that required contract documents are properly prepared and documented VA concurred with this recommendation and stated that it plans to hold quarterly reviews of compliance review results in order to improve the quality of contract file documentation Page 214 GAO-19-157SP High-Risk Series VA Acquisition Management Leadership instability We have previously reported most recently in September 2018 that procurement leadership instability has made it difficult for the VA to execute and monitor the implementation of key acquisition programs and policies For example changes in senior procurement leadership including the CAO and VHA’s Chief Procurement and Logistics Officer occurred during the implementation of MSPV-NG and similar instability in leadership affected the MSPV-NG program office itself Overall the MSPV-NG program office has had four directors two of whom served in an acting capacity since its inception in 2014 To address this instability we recommended in November 2017 that VA appoint a non-career employee as the CAO and prioritize the hiring of the MSPV-NG program office’s director position on a permanent basis VA concurred with these recommendations and implemented them in 2018 Stable leadership should help bring consistent and much needed direction to the MSPV-NG program but we recently identified other areas within the VA where sustained leadership is also needed For instance in September 2018 we reported there have been six Acting Directors within the past two and a half years within an oversight office that helps assess whether VA is in compliance with aspects of its Veterans First policy What Remains to Be Done Since 2015 we have made 31 recommendations to improve VA acquisition management As of December 2018 VA has implemented 10 of these recommendations 21 of them remain open including those listed below We have identified the following steps among others that VA needs to take to demonstrate greater leadership commitment and strategic planning to ensure efficient use of its acquisition funding and staffing resources VA should • prioritize completion of the revision of its acquisition regulations which has been in process since 2011 • develop document and communicate to stakeholders a strategy for the Medical Surgical Prime Vendor program to achieve overall program goals • provide targeted training for the more challenging aspects of implementing the Veterans First policy • identify opportunities to strategically purchase goods and services that are frequently purchased on an emergency basis • update its contract management system’s functionality and • conduct a fraud risk assessment of its Veterans First program Page 215 GAO-19-157SP High-Risk Series VA Acquisition Management Related GAO Products Veterans First Program VA Needs to Address Implementation Challenges and Strengthen Oversight of Subcontracting Limitations GAO-18-648 Washington D C September 24 2018 Veterans Affairs Contracting Improvements in Buying Medical and Surgical Supplies Could Yield Cost Savings and Efficiency GAO-18-34 Washington D C November 9 2017 Veterans Affairs Contracting Improvements in Policies and Processes Could Yield Cost Savings and Efficiency GAO-16-810 Washington D C September 16 2016 Veterans Affairs Contracting Improved Oversight Needed for Certain Contractual Arrangements GAO-15-581 Washington D C July 2 2015 Strategic Sourcing Improved and Expanded Use Could Save Billions in Annual Procurement Costs GAO-12-919 Washington D C September 20 2012 Page 216 GAO-19-157SP High-Risk Series DOE’s Contract and Project Management for the National Nuclear Security Administration and Office of Environmental Management DOE’s Contract and Project Management for the National Nuclear Security Administration and Office of Environmental Management The National Nuclear Security Administration NNSA has made progress in a number of areas However the Office of Environmental Management EM needs to take action to understand the root causes of its challenges and incorporate program and project management best practices into its policies Why Area Is High Risk The Department of Energy DOE oversees a broad range of programs related to nuclear security science energy and waste cleanup among other areas As the largest civilian contracting agency in the federal government DOE relies primarily on contractors to carry out its programs DOE spends approximately 90 percent of its annual budget on contracts and acquiring capital assets In fiscal year 2018 DOE’s budget was $34 5 billion In 1990 we designated DOE’s contract management—which has included both contract administration as well as project and program management—as a highrisk area because DOE’s record of inadequate management and oversight of contractors left the department vulnerable to fraud waste abuse and mismanagement In January 2009 recognizing the progress at DOE’s Office of Science we narrowed the focus of DOE’s high-risk designation to two DOE program elements—NNSA and EM In February 2013 we further narrowed the focus of the high-risk designation to NNSA’s and EM’s contracts as well as major projects—those with an estimated cost of $750 million or greater—to acknowledge progress made in managing nonmajor projects Contact Information For additional information about this high-risk area contact David C Trimble at 202 512-3841 or trimbled@gao gov or Allison B Bawden at 202 512-3841 or bawdena@gao gov Since our 2017 High-Risk Report DOE has made progress in the demonstrated progress criterion Our assessment of the ratings for the four other criteria remains unchanged Leadership commitment met In September 2018 the Deputy Secretary of Energy issued a memorandum laying out a series of reforms to improve the department’s management of major contracts including NNSA and EM To ensure leadership engagement on major contracts DOE plans to either expand the scope of the Energy Systems Acquisition Advisory Board or establish a second board to review them This effort is recent and we will follow DOE’s progress in implementing these reforms In addition in September 2017 NNSA agreed to implement our recommendation to strengthen its program management by applying lifecycle cost and schedule management to one of its major programs One of NNSA’s core offices the Office of Defense Programs strengthened program management by further implementing its Program Execution Instruction which applies to the management of billions of dollars of nuclear weapons science and production efforts In July 2017 EM issued a new cleanup policy that requires EM senior leadership approval of any contracts for $200 million or more In December 2017 DOE reorganized EM under the Office of Science—the third move for EM in 10 years The Assistant Secretary for the Office of Environmental Management also announced an intention to develop a strategic plan to address EM’s large and growing environmental liabilities as well as a new approach to contracting focused on accelerating the cleanup and closure of sites Capacity not met In August 2018 a statutorily required internal review of NNSA’s capacity identified unmet critical staffing needs especially Page 217 GAO-19-157SP High-Risk Series DOE’s Contract and Project Management for the National Nuclear Security Administration and Office of Environmental Management staffing to manage and oversee work on the agency’s uranium and plutonium missions which are expected to grow In addition in June 2018 an Office of Personnel Management OPM study found that the agency was understaffed across all functions The number of additional staff that OPM recommended in the study would exceed the statutory cap on NNSA’s full-time equivalent employees DOE revised its program and project management guidance in May 2016 to direct that capital asset acquisitions have adequate oversight staff In recent years NNSA has increased the number of oversight staff in some of its major project management offices including for the Uranium Processing Facility in Tennessee and the Mixed Oxide Fuel Fabrication Facility in South Carolina However EM has not benefitted from this change because it does not follow DOE’s program and project management requirements for the majority of its cleanup activities In addition EM’s July 2017 cleanup policy does not sufficiently address the need for EM to have adequate staff for its work Action plan partially met The Deputy Secretary’s 2018 contract management reform memorandum lists several areas for improvement— including increasing capacity and improving performance measures— which if realized will strengthen DOE’s management of major contracts After a comprehensive review of lessons learned from a multi-billion dollar warhead life extension program NNSA has also implemented management reforms to support similar programs EM continues to need to identify the root causes of its contract and project management problems DOE has conducted multiple studies over the years and closed many corrective actions plans as successful However these plans were not comprehensive and their results were not linked to each other In June 2017 EM initiated a 45-day review to identify decision-making priorities at each site but this study was never finalized In August 2018 EM initiated an ad-hoc root cause analysis— DOE’s fourth since 2008 EM officials stated that they are working on a continuous improvement plan based on the 2018 ad-hoc analysis but this effort did not connect to DOE’s previously identified problems or previous corrective measures Until EM takes steps to identify the root causes of its problems developing an effective action plan will be challenging Notably EM’s 2017 cleanup policy does not direct EM to develop a root cause analysis and corrective action plan at either a program or project level when there is evidence that a cost or schedule baseline will not be met or there are cost overruns Monitoring partially met NNSA continues to make progress most notably in managing contracts For example as it renews or recompetes contracts NNSA has taken steps to include new contract clauses that strengthen management oversight and reporting of management Page 218 GAO-19-157SP High-Risk Series DOE’s Contract and Project Management for the National Nuclear Security Administration and Office of Environmental Management information NNSA has also taken steps to more actively monitor and address contract performance that does not meet expectations for example by recompeting one multibillion-dollar contract early after two instances of poor performance In addition NNSA has taken steps to implement our recommendation to re-establish a process for reviewing the effectiveness of field offices' contractor oversight by conducting four peer reviews as of October 2018 with more planned NNSA has also taken action to manage all contract documentation in a central recordkeeping system as we recommended in August 2018 However we reported in February 2019 that cost performance information was not a significant performance measure in NNSA’s review and monitoring of some types of contract evaluations NNSA agreed with our recommendation that it should include quality cost information in its contractor performance evaluations to enable better performance assessments In contrast to NNSA’s progress EM’s monitoring continues to face challenges In February 2019 we found that EM’s 2017 cleanup policy does not follow most selected best practices for program or project management For example the policy does not require that DOE offices outside EM conduct independent project reviews as is the case for capital asset projects over $50 million We also found that the data and metrics EM uses to monitor its work do not accurately reflect cleanup performance leaving decision makers without adequate information about what EM is achieving with its funding EM agreed with our recommendations that it incorporate program and project management leading practices—especially by directing independent monitoring and oversight of its cleanup operations—into its 2017 cleanup policy and generally agreed that it should integrate its data and metrics to provide a clear picture of performance DOE generally concurred with our March 2017 recommendation to implement leading practices for managing its risk of fraud and other improper payments but has not taken sufficient steps to implement it The Deputy Secretary’s 2018 contract management reform memorandum which commits DOE to using objective performance measures including cost controls indicates that the agency plans to take steps to improve its future monitoring Demonstrated progress partially met Through its Office of Cost Estimating and Program Evaluation NNSA has enhanced its capability to estimate costs and schedules and to assess alternatives for programs and projects among other things NNSA also made progress by implementing best practices in several areas such as those for estimating costs and schedules in nuclear weapons refurbishment activities and capital asset acquisitions For example we determined that Page 219 GAO-19-157SP High-Risk Series DOE’s Contract and Project Management for the National Nuclear Security Administration and Office of Environmental Management DOE’s revised cost estimate of $17 2 billion to construct a Mixed Oxide Fuel Fabrication Facility to dispose of surplus weapons-grade plutonium substantially met best practices—providing assurance that the estimated costs could be considered reliable This finding contributed to DOE’s reevaluation of the project and ultimate termination in October 2018 in favor of a potentially less costly disposal approach However NNSA’s cost estimates for a new uranium enrichment capability—an effort that could cost billions of dollars—did not fully meet best practices Also while NNSA has taken steps to implement statutorily required common financial reporting across the nuclear security enterprise we found in January 2019 that NNSA’s plan for this effort does not follow leading project management practices—including having a detailed schedule and budget for implementing the project NNSA generally agreed with our recommendations that it should follow leading practices in its approach to planning and implementing common financial reporting EM is close to completing one major cleanup project—the River Corridor Closure Project in Washington However another major EM cleanup project continues to face significant cost and schedule challenges In particular construction of the Waste Treatment and Immobilization Plant WTP at the Hanford site in Washington has faced persistent challenges including quality assurance problems that have delayed it by decades and increased costs well beyond its last total program cost estimate of $17 billion Six years after major nuclear safety and quality issues were discovered we found in April 2018 that the contractor has not fully implemented all planned corrective measures Furthermore EM has not ensured that all WTP quality assurance problems—such as engineering errors and construction deficiencies— have been identified and some previously identified problems are recurring DOE generally agreed with our recommendations that it require the contractor to determine the extent of problems in WTP structures systems and components and order work stops when problems recur Even so in December 2018 DOE announced that EM had increased its estimate of the total costs to clean up the Hanford site by $82 billion—to a total of $242 billion—with part of that increase attributed to WTP construction and operating costs What Remains to Be Done Fifty-one recommendations were open as of December 2018 15 recommendations were made since the last high-risk update in February 2017 DOE including NNSA and EM should implement our recommendations to use sound contract program and project management practices to enhance oversight and reduce the risk of fraud waste and abuse Page 220 GAO-19-157SP High-Risk Series DOE’s Contract and Project Management for the National Nuclear Security Administration and Office of Environmental Management Congressional Actions Needed Congress should consider working with NNSA to ensure that the statutory cap on staffing is re-examined and consistent with NNSA’s human capital needs as evaluated in two recent studies Related GAO Products Department of Energy Performance Evaluations Could Better Assess Management and Operating Contractor Costs GAO-19-5 Washington D C February 26 2019 Nuclear Waste Cleanup DOE Could Improve Program and Project Management by Better Classifying Work and Following Leading Practices GAO-19-223 Washington D C February 19 2019 National Nuclear Security Administration Additional Actions Needed to Collect Common Financial Data GAO-19-101 Washington D C January 31 2019 Project Management DOE and NNSA Should Improve Their LessonsLearned Process for Capital Asset Projects GAO-19-25 Washington D C December 21 2018 Management Report Actions Needed to Improve National Nuclear Security Administration Contract Document Management GAO-18-246R Washington D C August 1 2018 Hanford Waste Treatment Plant DOE Needs to Take Further Actions to Address Weaknesses in Its Quality Assurance Program GAO-18-241 Washington D C April 24 2018 Department of Energy Continued Actions Needed to Address Management Challenges GAO-18-438T Washington D C March 14 2018 Nuclear Nonproliferation NNSA Needs to Improve Its Program Management Policy and Practices GAO-17-773 Washington D C September 28 2017 Nuclear Waste Opportunities Exist to Reduce Risks and Costs by Evaluating Different Waste Treatment Approaches at Hanford GAO-17-306 Washington D C May 3 2017 Department of Energy Use of Leading Practices Could Help Manage the Risk of Fraud and Other Improper Payments GAO-17-235 Washington D C March 30 2017 Page 221 GAO-19-157SP High-Risk Series NASA Acquisition Management NASA Acquisition Management In light of deteriorating cost and schedule performance the National Aeronautics and Space Administration NASA needs to address management weaknesses and implement an action plan Why Area Is High Risk NASA plans to invest billions of dollars in the coming years to explore space and conduct aeronautics research among other things We designated NASA’s acquisition management as high-risk in 1990 in view of NASA’s history of persistent cost growth and schedule delays in the majority of its major projects We have identified management weaknesses that have exacerbated the inherent technical and engineering risks faced by NASA’s largest projects In more recent years we found that NASA had taken steps to improve its management of its major projects—those projects and programs with an estimated life-cycle cost over $250 million However we reported in May 2018 that the cost and schedule performance of NASA’s portfolio of major projects deteriorated One of NASA’s largest projects the James Webb Space Telescope has experienced delays of 81 months and cost growth of 95 percent since 2009 In 2018 we found that additional cost and schedule growth is likely for the portfolio Many major projects including some of the most expensive ones are in the phase of their life cycles when cost and schedule growth is most likely Further NASA faces significant challenges largely driven by the need to improve the completeness and reliability of its cost and schedule estimates update cost and schedule estimates as new risks emerge and ensure that programmatic decisions are not increasing risks to projects Contact Information For additional information about this high-risk area contact Cristina T Chaplain at 202 512-4841 or chaplainc@gao gov Since our 2017 High-Risk Report we have lowered two criteria ratings for NASA’s acquisition management from met to partially met—leadership commitment and monitoring Our assessment of the other three criteria remains the same Capacity and demonstrated progress remain partially met and corrective action plan remains met Leadership commitment partially met NASA is no longer fully meeting the criteria for leadership commitment because of 1 a lack of transparency in major project cost and schedules especially for its human spaceflight programs 2 a lack of information on long-term human exploration program costs and 3 leadership approval of risky programmatic decisions for complex major projects When we determined that NASA met the criteria in 2015 NASA’s senior leadership had implemented key components of the agency’s action plan which had resulted in improvements in the cost and schedule performance of its major projects for several years Specifically NASA is no longer meeting the criteria for leadership commitment in 2019 for the following reasons • In our May 2018 assessment of major projects we were unable to determine the cost performance for NASA’s portfolio of major projects for the first time because NASA lacked a current cost estimate for its Orion Multi-Purpose Crew Vehicle Orion —one of the largest projects in the portfolio In addition the approved cost estimate for the Space Network Ground Segment Sustainment project underestimated the expected life-cycle cost because it did not include the full scope of the project’s effort Further we reported in July 2018 that the Commercial Crew Program did not provide Congress with the results of its schedule analysis showing a risk of schedule delays beyond what each of its two contractors’ had previously provided As a result Congress does not have complete information for decision-making regarding U S access to the International Space Station • NASA has not taken action on several recommendations we made related to understanding the long-term costs of its human exploration Page 222 GAO-19-157SP High-Risk Series NASA Acquisition Management programs For example two human spaceflight programs— Exploration Ground Systems EGS and Space Launch System SLS —do not have a cost and schedule baseline that covers activities beyond the first planned flight In addition the third program—Orion—does not have a baseline beyond the second planned flight As a result NASA is now committing itself to spend billions of dollars for missions that do not have a cost and schedule baseline against which to assess progress • NASA leadership has approved programmatic decisions that compounded technical challenges These decisions included establishing insufficient cost and schedule reserves operating under aggressive schedules and not following best practices for establishing reliable cost and schedule baselines for some of its most expensive major projects including Orion SLS and the James Webb Space Telescope As a result these programs have been at risk of cost growth and schedule delays since NASA approved their baselines Further the Mars 2020 project experienced cost growth stemming from technical challenges on a technology demonstration instrument designed to convert carbon dioxide to oxygen NASA approved the project to proceed through its preliminary design review without maturing a critical technology for this instrument In our prior work on best practices for systems entering product development we have found that such decisions can increase risk for these systems Capacity partially met NASA has taken steps to build capacity to reduce acquisition risk including updating tools aimed at improving cost and schedule estimates but continues to experience challenges For example • NASA has not always followed best practices in areas such as estimating costs and schedules and earned value management and projects are reluctant to update their cost and schedule estimates as new risks emerge For example NASA partially agreed with our July 2016 recommendation that the Orion program should update its joint cost and schedule confidence analysis—a point-in-time estimate that among other things includes all cost and schedule elements and incorporates and quantifies known risks that support each program’s cost and schedule baseline In January 2018 however NASA officials stated that they have no plans to update this analysis An updated analysis would be beneficial given numerous conditions and risks have changed since the analysis was completed including delays to its first planned flight • In our May 2018 assessment of major projects we found that several NASA major projects experienced workforce challenges including not having enough staff or staff with the right skills NASA has also identified capability gaps in areas such as scheduling earned value Page 223 GAO-19-157SP High-Risk Series NASA Acquisition Management management and cost estimating and has efforts underway to try to improve capacity in these areas Action plan met NASA is meeting the criteria for a corrective action plan as the agency finalized a new plan in December 2018 NASA determined that it was necessary to develop a new plan because several of its highest-profile missions recently experienced cost and schedule growth The plan contains several initiatives that could help the agency manage its acquisitions if implemented For example NASA plans to implement a training program to increase the agency’s programmatic capabilities including those related to cost and schedule estimation and assessment In addition the agency plans to establish new requirements for projects over $1 billion to conduct a joint cost and schedule confidence level assessment at additional reviews throughout a project’s lifecycle or as required by the Associate Administrator Further the plan includes an effort to improve portfolio analysis and planning for NASA human spaceflight programs by enhancing cross-portfolio assessments We plan to follow up with NASA to better understand how this effort could help improve outcomes for these programs and enhance transparency into human exploration program costs Monitoring partially met NASA is no longer fully meeting the criteria for monitoring because it will need to institute a program for monitoring and independently validating the effectiveness and sustainability of corrective action measures in conjunction with its new action plan NASA has been reporting metrics for its prior action plan to us on a semiannual basis however the agency is not performing within some of the parameters outlined in the plan—such as meeting metrics for cost and schedule performance In addition NASA officials stated that they plan to revise these metrics because they are outdated Demonstrated progress partially met We reported in May 2018 that the cost and schedule performance of NASA’s portfolio of major projects had deteriorated The average launch delay increased from 7 months in our May 2017 report to 12 months in our May 2018 report As mentioned above we were not able to determine the extent of cost performance deterioration because NASA lacked a current cost estimate for its Orion crew capsule Even without including expected Orion cost growth the overall development cost growth for the portfolio of 17 development projects increased to 18 8 percent up from 15 6 percent in 2017 We found that the decline in cost and schedule performance was driven by major projects encountering technical issues that were compounded by risky program management decisions technical challenges that resulted in delays in the integration and test phase and factors largely outside of the projects’ control such as delays related to their launch vehicles In addition NASA approved new cost and schedule commitments for the James Webb Space Telescope project in June 2018 As a result the project has experienced total schedule delays of 81 months and cost Page 224 GAO-19-157SP High-Risk Series NASA Acquisition Management growth of 95 percent since the project’s cost and schedule baseline was first established in 2009 The project office updated its cost and schedule estimates after experiencing a series of delays largely due to complications with spacecraft element integration and various technical and workmanship issues The project’s ability to execute to its new schedule will continue to be tested through the remainder of its challenging integration and test phase which includes executing several first-time activities such as integrating the spacecraft and telescope elements Further we reported in May 2018 that NASA’s portfolio of major projects was at risk for continued cost growth and schedule delays as new large and complex projects enter the portfolio and expensive projects remain in the portfolio for longer than expected For example NASA expects to begin development on a lunar Gateway—currently being discussed as a platform in a lunar orbit to mature deep space exploration capabilities What Remains to Be Done Since we initially designated this area as high-risk we have made numerous recommendations As of December 2018 15 recommendations related to this high-risk area remain open Of the 9 recommendations we have made since the last high-risk update in February 2017 6 remain open NASA should take action in the following areas to reduce acquisition risk to its portfolio of major projects and demonstrate progress • Increase transparency of project costs and decline to approve cost and schedule baselines or programmatic decisions that increase risk to projects This includes not approving project cost and schedule baselines that do not meet best practices and that do not have adequate cost and schedule reserves • Implement recommendations related to the long-term costs of its human exploration programs This will be especially important for NASA to determine the affordability of its portfolio especially now that it plans to begin developing other large complex projects • Build capacity by ensuring that NASA’s workforce has the right skills to develop project cost and schedule estimates that meet best practices • Ensure that NASA updates project cost and schedule estimates as risks change • Implement the new corrective action plan and track progress against it Continue to develop and refine outcome metrics for the human spaceflight portfolio analysis and planning effort to provide better metrics to assess improvements in program outcomes Page 225 GAO-19-157SP High-Risk Series NASA Acquisition Management • In conjunction with its new corrective action plan institute a program for monitoring and independently validating the effectiveness and sustainability of corrective measures Congressional Actions Needed In October 2017 we raised a matter for Congressional consideration that Congress should consider requiring the NASA Administrator to direct the Exploration Systems Development organization within the Human Exploration and Operations Mission Directorate to establish separate cost and schedule baselines for work required to support Space Launch System and Exploration Ground Systems for the second combined exploration mission and establish separate cost and schedule baselines for each additional capability that encompass all life-cycle costs to include operations and sustainment We made this a matter for Congressional consideration because NASA has not acted on our May 2014 recommendation to establish baselines for these programs or for capabilities beyond NASA’s first test flight and does not have plans to do either Related GAO Products NASA Commercial Crew Program Plan Needed to Ensure Uninterrupted Access to the International Space Station GAO-18-476 Washington D C July 11 2018 NASA Major Projects Portfolio Is at Risk for Continued Cost Growth and Schedule Delays GAO-18-576T Washington D C June 14 2018 NASA Assessments of Major Projects GAO-18-280SP Washington D C May 1 2018 James Webb Space Telescope Integration and Test Challenges Have Delayed Launch and Threaten to Push Costs Over Cap GAO-18-273 Washington D C February 28 2018 NASA Commercial Crew Program Continued Delays Pose Risks for Uninterrupted Access to the International Space Station GAO-18-317T Washington D C January 17 2018 NASA Preliminary Observations on the Management of Space Telescopes GAO-18-277T Washington D C December 6 2017 NASA Human Space Exploration Integration Approach Presents Challenges to Oversight and Independence GAO-18-28 Washington D C October 19 2017 NASA Assessments of Major Projects GAO-17-303SP Washington D C May 16 2017 NASA Human Space Exploration Delay Likely for First Exploration Mission GAO-17-414 Washington D C April 27 2017 Page 226 GAO-19-157SP High-Risk Series DOD Contract Management DOD Contract Management The Department of Defense DOD faces challenges in how it defines strategically manages and budgets for its contracted services which typically account for about half of the department’s $300 billion in annual contract obligations Why Area Is High Risk DOD obligates hundreds of billions of dollars annually on contracts for goods and services We added DOD’s contract management to our High-Risk List in 1992 and have identified three major areas of challenges acquisition workforce service acquisitions and operational contract support DOD reduced the size of its acquisition workforce in the mid-1990s as defense budgets decreased Amid concerns about skill gaps and a growing reliance on contractors DOD has been rebuilding its workforce since 2009 A skilled acquisition workforce is vital to maintaining military readiness increasing DOD’s buying power and achieving savings DOD’s long-standing challenges in managing service contracts are evident in its difficulties clearly defining requirements a fragmented and uncoordinated approach to acquiring services and limited information on what the department plans to spend on specific types of contracted services in its budget forecasts DOD has spent billions of dollars on contractors to support military activities it conducts around the world Since 2010 we have reported that DOD has faced difficulties in identifying capability gaps developing guidance and integrating operational contractor support into plans and training Contact Information For additional information about this high-risk area contact Timothy J DiNapoli at 202 512-4841 or dinapolit@gao gov Since our 2017 High-Risk Report our assessment of all five criteria remains unchanged for DOD Contract Management DOD continues to demonstrate top leadership support for addressing challenges in its 1 acquisition workforce 2 service acquisitions and 3 operational contract support OCS which is defined as planning for and obtaining supplies services and construction from commercial sources in support of joint operations DOD has taken steps to improve its capacity but continues to face challenges DOD’s progress on the action plan criterion was mixed across the segments While the monitoring criterion remains partially met overall we saw significant improvement within the OCS segment as DOD changed its strategy for addressing tasks that we previously found would be difficult to monitor DOD continues to take action to meet the demonstrated progress criterion—with additional management attention needed for service acquisition Over the years since we added this area to our High-Risk List we have made numerous recommendations related to this high-risk issue 18 of which were made since the last high-risk update in February 2017 As of November 2018 41 recommendations related to this high-risk area are open Page 227 GAO-19-157SP High-Risk Series DOD Contract Management Ratings for this segment remain unchanged since our 2017 High-Risk Report with DOD meeting one criterion and making mixed progress on the other four criteria Acquisition Workforce Leadership commitment met DOD continues to exhibit leadership commitment to sustaining the size and improving the professionalism of its acquisition workforce Specifically DOD issued an updated acquisition workforce strategic plan in October 2016 Additionally DOD issued a workforce rationalization plan in September 2017 which reinforces the need for the department to ensure that the civilian workforce is sized appropriately to complement its military personnel and to avoid artificial constraints on civilian workforce size and arbitrary reductions Capacity partially met DOD increased the size of its acquisition workforce beyond its initial 2015 target of 147 000 to more than 169 000 as of the third quarter of fiscal year 2018 It has also taken steps to ensure that the acquisition workforce has the requisite skills tools and training to perform key tasks For example DOD is conducting follow-up career field competency assessments to determine which skill gaps identified in initial assessments have been addressed based on a recommendation we made in December 2015 However other improvements need to be made For example while DOD’s October 2016 strategic plan provides an overall framework for the acquisition workforce it does not identify time frames metrics or projected budgetary requirements associated with key goals or strategic priorities Further in a February 2018 report we recommended ways the military departments could improve how they train mentor retain and ultimately select program managers—a critical acquisition career field— based upon practices used by leading organizations The military departments agreed with those recommendations but have not yet identified a strategy for how they will be implemented Action plan partially met In October 2016 DOD issued an updated acquisition workforce strategic plan which among other things assessed its current capacity and capability and identified risks that DOD needed to manage to meet future needs In addition in September 2017 DOD issued its workforce rationalization plan However neither the October 2016 strategic plan nor the September 2017 workforce rationalization plan established specific targets Further we reported in March 2018 that the military departments generally had not developed plans to use an annual inventory of Page 228 GAO-19-157SP High-Risk Series DOD Contract Management contracted services for workforce and budget decisions as statutorily required Using an annual inventory could help it make more strategic decisions about the right workforce mix of military civilian and contractor personnel and better align resource needs through the budget process to achieve that mix DOD stated in its comments on that report that it is committed to improving its inventory processes Monitoring partially met DOD continues to track workforce growth metrics as well as education and training metrics on a quarterly basis DOD acknowledged that it will need to develop and implement other metrics to track progress toward meeting the goals identified in its October 2016 strategic workforce plan including those related to shaping the future acquisition workforce Demonstrated progress partially met Metrics tracked by DOD provide evidence that DOD is sustaining the size of the acquisition workforce and making progress in improving the workforce quality DOD has not however verified that the current composition of the workforce will meet its future requirements Until DOD develops metrics to track progress associated with shaping the future acquisition workforce such as workforce targets as a whole or by specific career fields it will not be able to demonstrate that their strategic workforce planning efforts and associated initiatives are successful What Remains to Be Done As of November 2018 14 recommendations related to this high-risk area had not been implemented To help ensure DOD’s acquisition workforce has sufficient capacity and capability to meet future needs DOD needs to • conduct follow-up competency assessments to assess whether identified skill gaps have been closed and • continue efforts to improve the utility of the inventory of contracted services Ratings for this segment have not changed since our 2017 High-Risk Report DOD has met one criterion and made mixed progress on the other four criteria Service Acquisitions Leadership commitment met DOD has demonstrated sustained leadership commitment through its ongoing efforts to revise its January 2016 service acquisition instruction This instruction established policy assigned responsibilities and provided procedures for defining assessing reviewing and validating requirements for service acquisitions The Page 229 GAO-19-157SP High-Risk Series DOD Contract Management instruction formalized a hierarchical approach to more strategically manage service acquisitions at both the DOD and the component level Our August 2017 report concluded that DOD’s efforts simply stated were not successful in part because it was met with strong cultural resistance to changing DOD’s traditional decentralized approach to managing services Our prior work had cautioned that a top-down one-size-fits-all approach may not work Further our August 2017 report showed that certain commands already managed or awarded the majority of a particular service and were more closely aligned to the commanders that are responsible for executing the mission In turn this finding suggested that these commands might be in a better position to strategically manage specific service portfolios A DOD official stated that DOD expects to issue a revised instruction by early to mid-2019 Further DOD’s Chief Management Office is assessing ways to improve how it manages service acquisitions including aligning its portfolios with those established under the Office of Management and Budget’s OMB’s category management initiative Capacity partially met In 2013 DOD established leadership positions in the Office of the Secretary of Defense OSD and at the military departments that were intended to strategically manage service acquisitions by portfolio In August 2017 we reported however that individuals in these positions had multiple responsibilities and limited capacity to do so We recommended DOD reassess the roles responsibilities authorities and organizational placement of these positions DOD concurred and is rewriting its 2016 service acquisition instruction to address our recommendation among other things Action plan not met DOD does not have a comprehensive action plan but has or is undertaking a number of specific efforts to improve how it acquires services These efforts however have produced limited results For example DOD’s January 2016 services acquisition instruction required that OSD-level leaders for each portfolio of services develop appropriate metrics to actively manage and report improvements in service acquisition Similarly senior leaders at the component level were to use portfolio metrics and data to effectively monitor cost and postaward performance to improve the efficiency and effectiveness of the contracted services Further the instruction developed a process to implement Services Requirements Review Boards to prioritize and approve services in a portfolio-based manner but we found that they had minimal effect on supporting trade-off decisions within and across service portfolios or helping inform budgeting decisions DOD is revising its instruction in part to address these issues which it hopes to issue by early- to mid-2019 As part of its ongoing efforts DOD intends to align its services portfolios with OMB’s category management initiative which is intended to Page 230 GAO-19-157SP High-Risk Series DOD Contract Management streamline and manage entire categories of spending across the government more like a single enterprise DOD has established goals and metrics associated with the use of OMB’s designated “best-in-class” contracting vehicles contracting vehicles recommended for agency use and the amount of services that it considers to be strategically managed DOD is also assessing ways to include its projected spending on services in its future-years defense plan which we recommended in 2016 Relatedly Congress has mandated that effective October 2021 DOD include certain information on amounts requested for services contracts in the future-years defense program Monitoring partially met Because DOD lacks an action plan and cannot determine how future budgetary requirements are affected by its ongoing initiatives it is not yet positioned to fully assess its progress in improving service acquisition overall DOD is monitoring however its use of best-in-class vehicles and the amount of services it considers to be strategically managed under the category management initiative Demonstrated progress partially met While DOD’s fiscal year 2018 performance results are not expected to be finalized until January 2019 a DOD official reported that DOD expects that it will meet OMB’s target that nearly $60 billion in DOD contract obligations would be considered to be strategically managed but will fall short of OMB’s target that about $12 billion would be obligated under OMB’s designated best-in-class vehicles What Remains to Be Done As of November 2018 10 recommendations related to this high-risk area had not been implemented To improve the acquisition of services DOD needs to • define desired outcomes for service acquisitions by establishing goals and measures and obtaining data needed to measure progress • ensure that components revise their requirements review processes so that service acquisitions are prioritized and approved in a comprehensive portfolio-based manner • reassess the roles responsibilities and organizational placement of key leadership positions as it revises its January 2016 instruction and • establish milestones to measure progress toward achieving the statutory requirement to include projected spending on services in its future-years defense program Page 231 GAO-19-157SP High-Risk Series DOD Contract Management For this segment the monitoring criterion improved to met since our 2017 High-Risk Report The ratings for the other four criteria remain unchanged Operational Contract Support Leadership commitment met DOD continues to demonstrate sustained commitment and strong leadership support in addressing OCS issues For example in August 2018 the Joint Requirements Oversight Council issued an OCS memorandum approving 15 critical actions to institutionalize OCS across DOD strengthen DOD’s ability to perform OCS and ensure OCS contributes to all phases and ranges of joint military operations DOD transitioned OCS responsibilities of the Deputy Assistant Secretary of Defense Program Support to the newly established Office of the Deputy Assistant Secretary of Defense Logistics in the summer of 2018 DOD officials stated that this change was due to the reorganization of the Office of the Under Secretary of Defense Acquisition Technology and Logistics Moving forward it will be important for DOD to demonstrate that this reorganization supports a continued commitment to OCS at the level of senior leadership DOD officials stated in November 2018 that the Functional Capabilities Integration Board would still serve as the governance forum for OCS issues DOD is in the process of revising and expanding the board’s charter which it anticipates completing in 2019 Capacity partially met DOD continues to face challenges in OCS capability shortfalls that create risk to operational effectiveness timelines and resource expenditures and prevent DOD from reaching full OCS capacity However efforts are underway to address these shortfalls For example one of the 15 critical actions identified in the August 2018 Joint Requirements Oversight Council memorandum is the development of a functional competency model to capture OCS skill sets that according to DOD will be used to inform DOD-wide budgeting and manpower decisions Action plan met In September 2017 DOD issued its fifth OCS Action Plan which is organized around 10 capability gaps that needed to be closed to institutionalize OCS capability The action plan is DOD’s primary mechanism for measuring progress toward closing the capability gaps Monitoring met DOD monitors and documents progress against the OCS Action Plan’s identified tasks and goals Because of these efforts DOD has now met the monitoring criterion In addition DOD adjusted certain approaches to allow it to better gauge progress For example in Page 232 GAO-19-157SP High-Risk Series DOD Contract Management our 2017 High-Risk Report we reported that some of the subtasks in a Joint Staff annex supplementing the 2016 OCS Action Plan were not clearly defined and would be difficult to monitor In response the 2017 action plan noted that those efforts would be addressed directly under a logistics working group that would track performance measures To better integrate OCS into guidance the 2017 OCS Action Plan identified a new effort to develop and implement procedures to analyze update and create tools to support integration of OCS data into 1 planning and deployment systems and 2 training on accessing and using OCS data Demonstrated progress partially met DOD continues to make progress in addressing recommendations we have previously identified as high priority For example DOD issued a directive-type memorandum in April 2018 that identified several key DOD offices to jointly develop comprehensive department-wide vendor vetting guidance among other things A dedicated working group is developing the guidance Additionally DOD is revising instructions detailing how OCS should be integrated into plans and training among other things Senior DOD officials expect to issue the instruction in 2019 Moreover in response to our recommendation that the military departments develop OCS guidance the Army Air Force Navy and Marine Corps have done so What Remains to be Done Related GAO Products As of November 2018 17 recommendations related to this high-risk area had not been implemented To enhance DOD’s ability to effectively manage OCS for current and future operations DOD needs to • address identified OCS capability shortfalls • develop comprehensive vendor vetting guidance and • integrate lessons learned into existing OCS guidance Operational Contract Support Actions Needed to Strengthen DOD Vendor Vetting Efforts GAO-19-37C Washington D C December 20 2018 DOD Contracted Services Long-Standing Issues Remain about Using Inventory for Management Decisions GAO-18-330 Washington D C March 29 2018 Defense Acquisition Workforce Opportunities Exist to Improve Practices for Developing Program Managers GAO-18-217 Washington D C February 15 2018 Defense Contracted Services DOD Needs to Reassess Key Leadership Roles and Clarify Policies for Requirements Review Boards GAO-17-482 Washington D C August 31 2017 Page 233 GAO-19-157SP High-Risk Series DOD Contract Management Operational Contract Support Actions Needed to Enhance Capabilities in the Pacific Region GAO-17-428 Washington D C June 23 2017 Defense Acquisition Workforce DOD Has Opportunities to Further Enhance Use and Management of Development Fund GAO-17-332 Washington D C March 28 2017 Page 234 GAO-19-157SP High-Risk Series Enforcement of Tax Laws Enforcement of Tax Laws The Internal Revenue Service IRS needs to increase its capacity to implement new initiatives improve ongoing enforcement and taxpayer service programs and combat identity theft refund fraud Why Area Is High Risk This high-risk area added to the list in 1990 comprises two pressing challenges for IRS—addressing the tax gap and combatting IDT refund fraud In 2016 IRS estimated that the average annual net tax gap the difference between taxes owed and taxes paid on time was $406 billion on average for tax years 2008-2010 IRS enforcement of the tax laws helps fund the U S government by collecting revenue from noncompliant taxpayers and perhaps more importantly promoting voluntary compliance by giving taxpayers confidence that others are paying their fair share IDT refund fraud occurs when an identity thief files a fraudulent tax return using a legitimate taxpayer’s identifying information and claims a refund IRS estimates that at least $12 2 billion in individual IDT tax refund fraud was attempted in 2016 of which it prevented at least $10 5 billion 86 percent Of the amount attempted IRS estimated that at least $1 6 billion 14 percent was paid Contact Information For additional information about this high-risk area contact James R McTigue Jr or Jessica Lucas-Judy at 202-512-9110 or mctiguej@gao gov or lucasjudyj@gao gov Since our 2017 High-Risk Report ratings for all five criteria remain unchanged IRS continues to demonstrate top leadership commitment for improving tax compliance and has made strides in improving tax gap data The agency has also taken steps to address identity theft IDT refund fraud through continued development and deployment of the Return Review Program RRP a system which screens returns for potential IDT and other refund fraud before IRS issues refunds However IRS’s capacity to implement new initiatives carry out ongoing enforcement and taxpayer service programs and combat IDT refund fraud remains a challenge IRS continues to take actions toward meeting three other criteria for removal from our High-Risk List developing a corrective action plan monitoring and demonstrating progress Addressing the Tax Gap Ratings for this segment of the high-risk area remain unchanged since our previous High-Risk Report in 2017 with IRS meeting one criterion partially meeting three and not meeting one Leadership commitment met IRS adopted a more strategic approach to identifying and selecting budget program priorities among other steps For instance IRS’s fiscal year 2018-2022 strategic plan includes a goal to facilitate voluntary compliance and deter noncompliance that could help address the tax gap Capacity not met IRS continues to face capacity challenges because it does not calculate return on investment estimates for each enforcement Page 235 GAO-19-157SP High-Risk Series Enforcement of Tax Laws program—information IRS could use to inform resource allocation decisions IRS has also not evaluated the costs and benefits of expanding RRP to address more tax enforcement activities such as underreporting and noncompliance more broadly Moreover IRS still faces challenges for implementing new initiatives and carrying out ongoing enforcement and taxpayer service programs under an uncertain budgetary environment Action plan partially met IRS has a strategic plan that discusses general approaches to make voluntary compliance easier for taxpayers and to ensure taxes owed are paid However in some areas the strategic plan does not include specific efforts for improving compliance In addition IRS has not documented a comprehensive strategy that shows how it intends to use National Research Program NRP data to develop or improve compliance strategies IRS collects data through NRP audits to measure and report tax compliance for different types of taxes and taxpayers Monitoring partially met IRS continues to use tax gap data to study compliance behaviors and update formulas designed to identify tax returns with a high likelihood of noncompliance In addition the Large Business and International division is implementing a new approach to compliance that focuses on specific issues such as partnerships that underreport certain types of income However IRS does not adequately measure the effect of some compliance programs such as those used for large partnerships because it has not clearly defined them tracked the results from auditing such entities or analyzed how to better use audit resources for these types of returns Demonstrated progress partially met IRS implemented some corrective measures to improve compliance and reduce the tax gap including its use of RRP to screen individual returns claiming refunds but more work remains to meet this criterion IRS also lacks specific quantitative goals to reduce the tax gap or improve voluntary compliance Without long-term quantitative voluntary compliance goals and related performance measures it will be more difficult for IRS to determine the success of its strategies What Remains to Be Done • Over the years since we added this area to our high-risk list we have made numerous recommendations related to this high-risk issue 103 of which were made since the last high-risk update in February 2017 As of December 2018 189 recommendations are open IRS should implement all of our recommendations on improving audit effectiveness and resource investments such as re-establishing goals for improving voluntary compliance and developing and documenting a strategy that outlines how it will use its data to update compliance strategies that could help address the tax gap Page 236 GAO-19-157SP High-Risk Series Enforcement of Tax Laws • developing and documenting plans to assess the NRP employment tax study results to estimate the current state of the employment tax gap and • evaluating the costs and benefits of expanding RRP to analyze individual returns not claiming refunds to support other enforcement activities Congressional Actions Needed Given that the tax gap has been a persistent issue reducing the tax gap will require targeted legislative actions including additional third-party information reporting enhanced electronic filing math error authority and paid preparer regulation Specifically Congress should consider • expanding third-party information reporting to IRS which could increase voluntary tax compliance For example reporting could be required for certain payments that rental real estate owners make to service providers such as contractors who perform repairs on their rental properties and for payments that businesses make to corporations for services • requiring additional taxpayers to electronically file tax and information returns to help IRS improve compliance efficiency • providing IRS with authority—with appropriate safeguards—to correct math errors and to correct errors in cases where information provided by the taxpayer does not match information in government databases among other things could help IRS correct errors and avoid burdensome audits and taxpayer penalties and • establishing requirements for paid tax return preparers to help improve the accuracy of the tax returns they prepare Ratings for this segment of the high-risk area remain unchanged since our previous High-Risk Report in 2017 with IRS meeting two criteria and partially meeting the other three Refund Fraud Related to Identify Theft Leadership commitment met IRS has demonstrated leadership commitment in addressing IDT refund fraud For example IRS has taken significant actions to facilitate information sharing with states and industry partners through the Identity Theft Tax Refund Fraud Information Sharing and Analysis Center Capacity partially met In October 2016 IRS began operating RRP as its primary pre-refund system for detecting IDT and other refund fraud automating some of IRS’s manual processes for screening returns and identifying fraud schemes Although IRS can adjust RRP during the filing season to respond to emerging threats or other concerns IRS’s ability to combat IDT fraud continues to be challenged as a result of large-scale Page 237 GAO-19-157SP High-Risk Series Enforcement of Tax Laws cyberattacks on various entities However identity theft refund fraud is an evolving and costly problem the risks of which have increased as more personally identifiable information has become readily available Action plan met IRS has a strategic plan that identifies refund fraud and IDT as major challenges facing the nation’s tax system over the next several years IRS has also identified several strategic objectives relevant to its efforts to combat IDT Further IRS is using RRP to automatically detect IDT and other refund fraud in individual returns and is working to expand RRP to detect fraud in business returns Monitoring partially met Following a security breach with the Get Transcript program IRS changed its authentication procedures for affected taxpayers and has prevented a total of about $591 million in fraudulent payments between fiscal years 2015 through 2017 In addition RRP prevented about $4 4 billion in invalid refunds during the 2017 filing season However in July 2018 we found ways to improve and expand the program—such as increasing the amount of data available including loading W-2 data into it more frequently and digitizing paper returns As we reported in June 2018 IRS also lacks internal controls to effectively monitor telephone in-person and correspondence authentication Demonstrated progress partially met IRS has demonstrated some progress by developing tools and programs to further detect and prevent IDT refund fraud such as RRP which uses advanced analytic techniques and business rules to compare taxpayer-reported information to W-2s IRS has also improved telephone authentication procedures and enhanced its authentication efforts for some online services by requiring a multi-factor process using the Secure Access platform However in June 2018 we reported that IRS could further demonstrate progress by updating its authentication procedures to be in compliance with new government standards Further IRS has not articulated priorities for its foundational authentication initiatives or the resources it will require to complete them sufficiently assessed and monitored risks or developed a comprehensive process to evaluate potential new authentication technologies and approaches As a result IRS may be missing an opportunity to implement the most secure robust technologies to protect taxpayers What Remains to Be Done IRS should implement all of our recommendations for addressing IDT refund fraud including • finding ways to improve and expand RRP such as increasing the frequency at which incoming W-2 information is available to the program • assessing the benefits and costs of additional uses and applications of W-2 data for pre-refund compliance checks such as other fraud or noncompliance before issuing refunds Page 238 GAO-19-157SP High-Risk Series Enforcement of Tax Laws • prioritizing foundational authentication initiatives and the resources required to complete them and • developing a comprehensive process to identify and evaluate alternative options for improving taxpayer authentication Congressional Actions Needed Related GAO Products Given that IDT refund fraud has been an ongoing issue combating it will require targeted legislative actions including • requiring that returns prepared electronically but filed on paper include a scannable code printed on the return to better leverage RRP’s capabilities and • providing the Secretary of the Treasury with the regulatory authority to lower the threshold for electronic filing of W-2s from 250 returns annually to between 5 to 10 returns as appropriate Tax Fraud and Noncompliance IRS Could Further Leverage the Return Review Program to Strengthen Tax Enforcement GAO-18-544 Washington D C July 24 2018 Identity Theft IRS Needs to Strengthen Taxpayer Authentication Efforts GAO-18-418 Washington D C June 22 2018 Tax Fraud and Noncompliance IRS Can Strengthen Pre-refund Verification and Explore More Uses GAO-18-224 Washington D C January 30 2018 Identity Theft Improved Collaboration Could Increase Success of IRS Initiatives to Prevent Refund Fraud GAO-18-20 Washington D C November 28 2017 Tax Gap IRS Needs Specific Goals and Strategies for Improving Compliance GAO-18-39 Washington D C October 31 2017 Employment Taxes Timely Use of National Research Program Results Would Help IRS Improve Compliance and Tax Gap Estimates GAO-17-371 Washington D C April 18 2017 IRS Return Selection Improved Planning Internal Controls and Data Would Enhance Large Business Division Efforts to Implement New Compliance Approach GAO-17-324 Washington D C March 28 2017 2016 Filing Season IRS Improved Telephone Service but Needs to Better Assist Identity Theft Victims and Prevent Release of Fraudulent Returns GAO-17-186 Washington D C January 31 2017 Page 239 GAO-19-157SP High-Risk Series Enforcement of Tax Laws Tax Debt Collection IRS Needs to Define Field Program Objectives and Assess Risks in Case Selection GAO-16-787 Washington D C September 13 2016 IRS 2017 Budget IRS Could Improve Presentation of Budget Data in Its Congressional Justification GAO-16-695 Washington D C July 21 2016 Page 240 GAO-19-157SP High-Risk Series Medicare Program Improper Payments Medicare Program Improper Payments The Centers for Medicare Medicaid Services CMS made some progress reducing improper payments but needs to take further action to address Medicare’s financial and oversight challenges Why Area Is High Risk In calendar year 2017 Medicare financed $702 billion worth of health services for approximately 58 million elderly and disabled beneficiaries This represents approximately 17 percent of federal spending and spending is expected to increase significantly over the next ten years Due to its size complexity and susceptibility to mismanagement and improper payments we first designated Medicare as a high-risk program in 1990 Medicare continues to challenge the federal government because of 1 its outsized impact on the federal budget and the health care sector as a whole 2 the large number of beneficiaries it serves and 3 the complexity of its administration Medicare also faces a significant risk with improper payments—payments that either were made in an incorrect amount or should not have been made at all— which reached an estimated $48 billion in fiscal year 2018 CMS—which administers and oversees the Medicare program—should continue to take actions to prevent and reduce improper payments in the program Contact Information For additional information about this high-risk area contact James Cosgrove or Jessica Farb at 202 512-7114 or cosgrovej@gao gov and farbj@gao gov Since our 2017 High-Risk Report Medicare program officials have continued to address challenges in managing the program better First CMS has made progress in addressing improper payments Specifically CMS has demonstrated it is now meeting the capacity criterion has maintained its leadership commitment to addressing Medicare improper payments and partially meets the remaining three criteria The Medicare program has faced challenges in three additional broad segments— 1 payments provider incentives and program management under Medicare fee-for-service FFS 2 Medicare Advantage MA and other Medicare health plans and 3 design and oversight of the Medicare program and the effects on beneficiaries We are not rating CMS’s progress against the high-risk criteria for the remaining three segments for two main reasons First the Medicare program is subject to frequent legislative updates to provider payments and other policies This active congressional participation in the details of the program means that many factors are outside of the agency’s control Second the Medicare program is in a profound state of transition from a payment system that rewards providers based on the volume and complexity of health care services they deliver to one that ties payments to the quality and efficiency of care While this shift ultimately may save money and lead to beneficiaries receiving better care it may be several years before we can judge the results Since we added Medicare to our High-Risk List in 1990 we have made more than 700 recommendations related to this high-risk area 28 of which were made since the last high-risk update in February 2017 As of December 2018 more than 80 recommendations remain open Page 241 GAO-19-157SP High-Risk Series Medicare Program Improper Payments Since our 2017 High-Risk Report the capacity criterion has progressed from partially met to met and ratings for the remaining four criteria remain unchanged Improper Payments Leadership commitment met CMS has continued to demonstrate leadership commitment by naming a new Director for the Center for Program Integrity CPI — CMS’s centralized entity for Medicare and Medicaid program integrity issues—and implementing some of our recommendations In December 2017 we reported CMS has committed to reducing fraud—one source of improper payments—by creating an organizational culture and structure conducive to fraud risk management Capacity met CPI’s budget and resources have increased over time and the agency has established work groups and interagency collaborations to extend its capacity For example CMS allocated additional staff to CPI after Congress provided additional funding CPI’s full-time equivalent positions increased from 177 in 2011 to 419 in 2017 In August 2017 we reported CMS’s Fraud Prevention System which analyzes claims to identify health care providers with suspect billing patterns has also helped speed up certain investigation processes Further the Healthcare Fraud Prevention Partnership has helped improve information sharing among payers inside and outside of the government Action plan partially met CMS continues to identify and report progress on corrective actions related to Medicare improper payments It reported this progress in the Department of Health and Human Services’ HHS annual Agency Financial Report and started a Medicare FFS action plan based on our suggestions However work remains to be done to meet this criterion As of October 2018 CMS’s action plan had yet to include clear metrics and timeframes as we suggested and does not address MA—the private plan alternative to FFS or Medicare Part D—the outpatient prescription drug program In addition as we reported in December 2017 CMS has neither conducted a complete fraud risk assessment nor created a risk-based antifraud strategy for Medicare This strategy if implemented would allow the agency to better ensure it is addressing the full portfolio of risks and strategically targeting the most significant fraud Monitoring partially met CMS made progress to improve monitoring in some areas such as its oversight of Medicare provider education efforts However to make further progress CMS needs to implement our open recommendations related to overseeing its enrollment screening process and evaluating Medicare Administrative Contractor effectiveness in Page 242 GAO-19-157SP High-Risk Series Medicare Program Improper Payments preventing improper payments CMS should also monitor metrics developed for its improper payment action plan Demonstrated progress partially met Estimated improper payment rates declined more than one percent from fiscal year 2016 to 2018 for all parts of Medicare—to 8 12 percent 8 10 percent and 1 66 percent for FFS MA and Medicare Part D respectively However according to the Office of Management and Budget the rate and amount of improper payments made in Medicare still represent some of the highest in the government Many of our recommendations that could further lower these rates remain open For example CMS has not implemented recommendations to improve MA improper payment recovery or sought legislative authority to permit payment for recovery auditors to conduct prepayment claims reviews Reviewing Medicare claims before payment can prevent improper payment Further CMS made some progress implementing recommendations related to expanding the use of prior authorizations based on our April 2018 report However CMS has yet to fully implement prior authorization expansion to additional items and services with high improper payment rates What Remains to Be Done To better prevent identify and recover improper payments across all parts of the Medicare program CMS should fully implement our open recommendations related to Medicare program integrity CMS should • seek legislative authority to allow the Recovery Auditors to conduct prepayment reviews in addition to postpayment claims reviews • provide Medicare Administrative Contractors—contractors that process and pay Medicare claims—with written guidance on how to accurately calculate and report savings from prepayment claim reviews • improve the processes for selecting contracts to include in its risk adjustment data validation audits—audits of MA organizations that help CMS recover improper payments in cases where beneficiary diagnoses are unsupported by medical records • take steps based on the results from evaluations to continue prior authorization such as by resuming paused demonstrations extending demonstrations or by identifying new opportunities to expand prior authorization to additional items and services and • provide and require fraud-awareness training to its employees conduct fraud risk assessments and create an antifraud strategy for Medicare including an approach for evaluation Page 243 GAO-19-157SP High-Risk Series Medicare Program Improper Payments Payments Provider Incentives and Program Management under Medicare Fee-forservice As CMS progresses towards full implementation of its value-based payment system it will be important for the agency to use reliable quality and efficiency measures and methodological approaches that maximize the number of physicians for whom value can be determined We have not rated this segment because 1 the Medicare program is subject to frequent legislative updates to provider payments and other policies and 2 the Medicare program is currently in a state of transition from a payment system that rewards providers based on volume and complexity of health care services to one that ties payment to the quality and efficiency of care Appeals process In May 2016 we reported Medicare had seen significant growth in the number of appeals submitted by providers beneficiaries and others dissatisfied with the program’s decisions to deny or reduce payments for claims While CMS has implemented a more efficient way to adjudicate repetitive claims as we had recommended other recommendations regarding the appeals process remain open as discussed later in this section Medicare program management CMS has faced challenges managing the Medicare program including efforts to improve program efficiency and provide better service to beneficiaries For example we reported in September 2016 that implementation of the Durable Medical Equipment Prosthetics Orthotics and Supplies Competitive Bidding Program had resulted in Medicare savings and available evidence did not indicate widespread effects on beneficiary access however stakeholders have reported some specific access issues such as difficulty locating contract suppliers that will furnish certain items CMS suspended its competitive bidding program as of January 1 2019 to further assess concerns raised by stakeholders and to determine whether changes were needed to improve the program’s overall effectiveness Hospital value-based purchasing program The Hospital Value-Based Purchasing program provides financial incentives to acute-care hospitals to provide efficient high-quality care to Medicare beneficiaries In June 2017 we reported some hospitals with high efficiency scores received bonuses despite having relatively low quality scores This contradicts CMS’s intention to reward high-quality care provided at a lower cost We have an open recommendation related to the hospital value-based purchasing program discussed later in this section Cancer hospitals Unlike teaching hospitals paid under Medicare’s prospective payment systems PPS the methodology for paying PPSexempt cancer hospitals PCH provides little incentive for efficiency In our February 2015 report we recommended Congress consider requiring Medicare to pay PCHs in the same manner it pays PPS teaching hospitals or provide the Secretary of HHS with the authority to otherwise Page 244 GAO-19-157SP High-Risk Series Medicare Program Improper Payments modify how Medicare pays PCHs We have an open matter related to cancer hospitals discussed later in this section Hospital-physician consolidation Because Medicare often pays more for services performed in a hospital outpatient department than a physician’s office hospitals may have an incentive to acquire physician practices and hire physicians as salaried employees—a financial arrangement known as vertical consolidation In December 2015 we reported that from 2007 through 2013 the number of vertically consolidated hospitals increased from about 1 400 to 1 700 and the number of vertically consolidated physicians increased from 96 000 to 182 000 In our December 2015 report we recommended Congress direct the Secretary of HHS to equalize payment rates between hospital outpatient departments and physician offices for evaluation and management office visits and other services as appropriate We have an open matter related to hospital-physician consolidation discussed later in this section While Congress enacted legislation to exclude services furnished by offcampus hospital outpatient departments from higher payment this exclusion does not apply to services furnished by providers under construction or billing as hospital outpatient departments prior to November 2015 or to services provided by on-campus hospital outpatient departments However CMS has taken some action In November 2018 CMS issued a final rule capping payment rates for certain services furnished by off-campus hospital outpatient departments existing or under construction in 2015 at the physician fee schedule rate Since these services furnished by these off-campus hospital outpatient departments are currently paid under a higher rate the payment cap would equalize payment rates for clinical visits between settings The application of the payment cap will take place over 2 years In 2019 50 percent of the payment reduction will be applied and in 2020 and subsequent years 100 percent of the payment reduction will be applied However CMS’s authority to implement this rule has been challenged in federal district court What Remains to Be Done We have recommended to the Secretary of HHS or CMS several actions including the following • The Secretary of HHS should direct relevant agencies to modify the various Medicare appeals data systems to collect consistent data including data on appeal categories and appeal decisions • CMS should revise the formula for calculating a hospital’s total performance score under the Hospital Value-Based Purchasing Program or take other actions so the efficiency score does not have a disproportionate effect on the total performance score Page 245 GAO-19-157SP High-Risk Series Medicare Program Improper Payments Congressional Actions Needed Medicare Advantage and Other Medicare Health Plans We have also identified areas that would require Congressional actions to be addressed • In our February 2015 report we recommended that Congress consider requiring Medicare to pay PCHs as it pays PPS teaching hospitals or provide the Secretary of HHS with the authority to otherwise modify how Medicare pays PCHs In doing so Congress should provide that all forgone outpatient payment adjustment amounts be returned to the Supplementary Medical Insurance Trust Fund • As mentioned above Medicare pays for evaluation and management services in all hospital outpatient departments regardless of whether they are deemed on-campus or off-campus Congress should consider equalizing payment rates Medicare pays for certain health care services as we suggested in December 2015 between all hospital outpatient settings and return the associated savings to the Medicare program The MA program provides health care coverage to Medicare beneficiaries through private health plans The number and percentage of Medicare beneficiaries enrolled in MA has grown steadily over the past several years increasing from approximately 10 million 21 percent of all Medicare beneficiaries in 2008 to about 19 million 32 percent of all Medicare beneficiaries in 2017 Similar to the FFS program the MA program has been in a period of transition For example in April 2018 CMS finalized guidance for 2019 intended to provide more flexibility to sponsors of MA plans in how they design plans such as by expanding the types of supplemental benefits plans can offer to include services that compensate for physical impairments We have not rated this segment because 1 the Medicare program is subject to frequent legislative updates to provider payments and other policies and 2 the Medicare program is currently in a state of transition from a payment system that rewards providers based on volume and complexity of health care services to one that ties payment to the quality and efficiency of care Network adequacy In August 2015 we reported on shortcomings in CMS’s criteria for determining network adequacy how the agency oversees MA organizations’ adherence to its requirements and how it ensures enrollees are properly notified about provider network changes We have an open recommendation related to network adequacy discussed later in this section MA plan payment adjustments In January 2012 and 2013 we reported that CMS’s adjustments to account for differences between FFS and MA providers’ coding of medical diagnoses were too low resulting in billions of excess payments to MA plans We have an open recommendation related to MA plan payment adjustments discussed later in this section Page 246 GAO-19-157SP High-Risk Series Medicare Program Improper Payments Encounter data As we reported in January 2017 CMS has begun to use encounter data—claims-like data collected from the sponsors of MA plans—in its methodology for risk adjusting payments to MA plans While the encounter data were intended to improve the accuracy of risk adjustment the data have yet to be fully validated We have an open recommendation related to the encounter data discussed later in this section What Remains to be Done Design and Oversight of the Medicare Program and the Effects on Beneficiaries We have recommended to CMS several actions including to • augment MA network adequacy criteria to address provider availability • take steps to improve the accuracy of risk score adjustments by for example accounting for additional beneficiary characteristics such as sex and health status and • 1 establish specific plans and time frames for using encounter data for all purposes other than risk adjusting payments to MA organizations and 2 complete all the steps necessary to validate the data including performing statistical analyses reviewing medical records and providing MA organizations with summary reports on findings The design and CMS’s oversight of the Medicare program affect both beneficiaries’ out-of-pocket costs and the quality and safety of care they receive Medicare FFS’s benefit design does not include a cap on the maximum cost-sharing amount a beneficiary can be responsible for during a given year for covered services which could leave beneficiaries vulnerable to catastrophic costs especially if they do not have supplemental insurance In addition Medicare spending can affect the premiums beneficiaries pay In 2018 the Medicare Trustees estimated Medicare spending will grow at a faster rate than workers’ earnings and the economy overall which will impose a significant burden on many Medicare beneficiaries and the country With regard to quality CMS reported that Medicare Quality Improvement Organizations provided oversight that helped to prevent tens of thousands of beneficiaries from being admitted or readmitted to hospitals and reduced the number of nursing home patients with pressure ulcers or who were restrained from fiscal years 2011 through 2014 We have not rated this segment because 1 the Medicare program is subject to frequent legislative updates to provider payments and other policies and 2 the Medicare program is currently in a state of transition from a payment system that rewards providers based on volume and complexity of health care services to one that ties payment to the quality and efficiency of care End-stage renal disease In October 2015 we reported that only a small fraction of Medicare patients had used the Kidney Disease Education Page 247 GAO-19-157SP High-Risk Series Medicare Program Improper Payments benefit which provides pre-dialysis education intended to inform treatment decisions Benefit utilization may be limited because of statutory limitations on the types of providers who are permitted to furnish the benefit and on the patients eligible to receive it We have an open recommendation related to the Kidney Disease Education benefit discussed later in this section Prescription Opioids In October 2017 we reported that while CMS oversees the prescribing of drugs at a high risk of abuse it does not analyze data specifically on opioids We have three open recommendations related to prescription opioids one of which is discussed later in this section What Remains to be Done Related GAO Products We have recommended to CMS several actions including to • examine the Kidney Disease Education benefit and if appropriate seek legislation to revise provider and patient eligibility criteria for the benefit and • take three actions related to prescription opioids including Identifying the number of at-risk beneficiaries receiving high doses of opioids Medicare CMS Should Take Actions to Continue Prior Authorization Efforts to Reduce Spending GAO-18-341 Washington D C April 20 2018 Medicare and Medicaid CMS Needs to Fully Align Its Antifraud Efforts with the Fraud Risk Framework GAO-18-88 Washington D C December 5 2017 Prescription Opioids Medicare Needs to Expand Oversight Efforts to Reduce the Risk of Harm GAO-18-15 Washington D C October 6 2017 Medicare CMS Fraud Prevention System Uses Claims Analysis to Address Fraud GAO-17-710 Washington D C August 30 2017 Hospital Value-Based Purchasing CMS Should Take Steps to Ensure Lower Quality Hospitals Do Not Qualify for Bonuses GAO-17-551 Washington D C June 30 2017 Medicare Advantage CMS Should Use Data on Disenrollment and Beneficiary Health Status to Strengthen Oversight GAO-17-393 Washington D C April 28 2017 Page 248 GAO-19-157SP High-Risk Series Medicare Program Improper Payments Medicare Provider Education Oversight of Efforts to Reduce Improper Billing Needs Improvement GAO-17-290 Washington D C March 10 2017 Page 249 GAO-19-157SP High-Risk Series Strengthening Medicaid Program Integrity Strengthening Medicaid Program Integrity The Centers for Medicare Medicaid Services CMS has taken steps but further efforts are needed to reduce improper payments ensure the appropriate use of program dollars and improve program data Why Area Is High Risk The size growth and diversity of the joint federal-state Medicaid program present oversight challenges and we designated Medicaid a high-risk program in 2003 Since then we have made more than 270 recommendations related to the program In fiscal year 2018 Medicaid covered an estimated 75 million low-income and medically needy individuals at a cost of $629 billion of which $393 billion was financed by the federal government Services are increasingly delivered through managed care under which organizations are paid a set amount per beneficiary for care Our recent work highlights oversight challenges in three areas improper payments appropriate use of program dollars and data First Medicaid improper payments represented about 9 8 percent of federal program spending—$36 2 billion—in fiscal year 2018 Second CMS can waive certain Medicaid requirements and authorize states to incur new types of expenditures through demonstrations as of November 2016 CMS had done so for nearly threequarters of states Supplemental payments—made to providers such as local government hospitals and not linked to specific beneficiary services— grew to over $48 billion in 2016 the most recent year for which data are available Third CMS’s oversight of Medicaid often relies on state-reported expenditure and utilization data Incomplete and inconsistent state data complicate program oversight Contact Information For additional information about this high-risk area contact Carolyn L Yocom at 202 512-7114 or yocomc@gao gov Since our 2017 High-Risk Report CMS has taken important steps to strengthen Medicaid program integrity Further leadership has demonstrated a commitment to continuing these efforts by outlining a high-level program integrity strategy Still work remains to fully “meet” all of the high-risk criteria As of November 2018 more than 70 of our recommendations related to Medicaid remain open and several major steps remain to improve Medicaid program integrity For example more efforts are needed to mitigate the risks not captured in CMS’s improper payment estimate—particularly for managed care CMS can also do more to target risk in overseeing the use of program dollars and to expedite the use of improved Medicaid data in program oversight For this report we are rating three segments of the Medicaid program all of which are priority areas identified by CMS CMS has met our criteria for leadership commitment for improper payments the one segment we rated in 2017 and the other four criteria remain partially implemented For the remaining two segments—the appropriate use of Medicaid dollars and Medicaid data—CMS partially meets nearly all criteria Improper Payments Since our 2017 High-Risk Report we have increased one of the five criteria Leadership commitment met CMS has shown an increased commitment to oversight of improper payments In June 2018 CMS communicated the agency’s strategy for improving program integrity including plans for a number of new and enhanced efforts to detect and respond to improper payments For example the strategy highlighted a commitment to Page 250 GAO-19-157SP High-Risk Series Strengthening Medicaid Program Integrity enhanced auditing efforts and monitoring compliance with new managed care rules established in 2016 Further CMS has taken important steps towards coordinating oversight with state auditors as a means of expanding its oversight of improper payments Capacity partially met CMS has taken actions to enhance the resources and guidance available to states for program integrity purposes Based on its reviews of states’ program integrity activities CMS has targeted high-risk areas in each state including managed care and expanded federal-state collaborative audits to include Medicaid managed care organizations MCO In 2018 CMS reported working to improve federal-state collaborative audits such as by meeting with all states to discuss how operational audit issues will be handled moving forward including planning for new collaborative audits However efforts to date do not ensure CMS can estimate an improper payment rate for managed care that reflects all program risks Additionally as we reported in July 2018 impediments to conducting audits of managed care—such as a focus on states with certain provisions around overpayments in MCO contracts—continue Action plan partially met In June 2018 CMS outlined a strategy to reduce Medicaid improper payments including plans to check the accuracy of MCO’s financial statements assist states with screening Medicaid providers and initiate audits of certain state beneficiary eligibility determinations If fully implemented these steps could address some of the concerns we raised in January 2017 and May 2018 However CMS has not detailed the scope and timing of this strategy For example the strategy does not include how many states will be part of the targeted audits for MCO financial statements nor does it specify implementation dates Monitoring partially met Our work has detailed concerns related to the accuracy of provider eligibility and beneficiary enrollment both of which can have an impact on CMS’s ability to monitor improper payments To improve the effectiveness of managed care provider screening CMS analyzed 22 databases used by MCOs and formally incorporated 6 into the agency’s provider screening process However efforts to enhance screening are ongoing and the agency does not require states to report MCO overpayments Gaps also remain in CMS’s efforts to ensure that only eligible individuals are enrolled and expenditures for enrollees mainly those eligible through the Patient Protection and Affordable Care Act expansion are matched appropriately by the federal government Demonstrated progress partially met CMS’s overall estimated Medicaid improper payment rate declined from 10 5 percent in fiscal year 2016 to 9 8 percent in fiscal year 2018 This rate is comprised of three components 1 fee-for-service FFS payments to providers 2 payments to MCOs and 3 the accuracy of beneficiary eligibility Page 251 GAO-19-157SP High-Risk Series Strengthening Medicaid Program Integrity determinations The FFS component of the error rate is 14 3 percent primarily due to state’s non-compliance with provider screening enrollment and identification requirements The reduction in the overall error rate occurred as spending shifted from FFS to managed care where estimates of improper payments—at 0 22 percent in 2018—do not account for all program risks In particular CMS’s estimates of MCO improper payments do not include a medical review of services or reviews of MCO records or data which likely minimizes the appearance of program risks in Medicaid managed care The beneficiary eligibility component of the error rate is 3 1 percent a rate that CMS has not updated since 2014 raising further questions regarding the accuracy of the overall rate CMS plans to resume eligibility component measurement in 2019 What Remains to Be Done Since designating Medicaid as a high-risk area in 2003 we have made at least 45 recommendations related to improper payments 17 of which were open as of November 2018 To reduce improper payments CMS needs to • mitigate program risks not measured through its estimate of MCO improper payments such as overpayments and unallowable costs—such efforts could include actions such as revising the payment error rate methodology or focusing additional audit resources on managed care • expedite the issuance of planned guidance on MCO program integrity address impediments to MCO audits and ensure states account for overpayments when setting future payment rates and • review federal determinations of Medicaid eligibility for accuracy use the information obtained from the eligibility reviews to inform expenditure reviews and increase assurances that expenditures for different eligibility groups are correctly reported and appropriately matched We are rating this segment for the first time CMS has taken important steps—such as improved reporting of payments and steps to mitigate federal financial exposure—to better ensure the appropriate use of Medicaid dollars Our work has identified risks—and potential actions to mitigate these risks— related to oversight of demonstration spending under section 1115 of the Social Security Act supplemental payments and Medicaid expenditures more broadly Appropriate Use of Medicaid Dollars Leadership commitment partially met With respect to demonstrations CMS began implementing a policy in 2016 that significantly improves efforts to assure demonstrations are budget neutral—that is that the Page 252 GAO-19-157SP High-Risk Series Strengthening Medicaid Program Integrity demonstration does not increase federal costs Further as we previously recommended in June 2013 and April 2017 the agency issued guidance to states in August 2018 articulating the agency’s budget neutrality policy which improves transparency in how CMS approves demonstration spending limits and consistency in oversight of demonstration spending However additional policy changes are needed to address other questionable methods—particularly relying on hypothetical rather than actual expenditures—used to set spending limits and to provide policymakers with timely findings from evaluations of demonstrations With regard to supplemental payments—payments made to providers such as local government hospitals and other providers in addition to claims-based payments—CMS anticipates issuing a proposed rule in early 2019 designed to increase transparency by establishing new requirements for states However until CMS issues a final rule its potential effect on program integrity efforts will remain unclear Capacity partially met With regard to demonstrations CMS actions show promise but are to date incomplete As of November 2018 CMS had developed a standard reporting tool to ensure that states consistently report the data elements needed for CMS to assess compliance with demonstration spending limits and was beginning to test this tool The agency also was developing procedures for CMS staff to consistently track spending compared with spending limits Until these procedures are fully implemented the impact on oversight of demonstrations remains unclear With regard to supplemental payments as of November 2018 CMS had issued letters to some states clarifying that the distribution of supplemental payments must be linked to the provision of Medicaidcovered services Because supplemental payments are not linked directly to services for beneficiaries there is risk that they may not be made for Medicaid activities or services CMS has not taken action on our recommendation that the agency issue guidance on the appropriate distribution of supplemental payments to all states nor has it issued other needed guidance including criteria to assure that payments meet statutory requirements With regard to oversight of states’ reported expenditures and in response to our findings CMS plans to conduct a national assessment of whether oversight resources are adequate and target areas of greatest risk This is critical as the complexity of expenditure reporting has increased while staff resources used to review states’ expenditures has decreased thus hindering CMS’s ability to target risk and protect federal and state dollars Action plan partially met With respect to demonstrations the agency has issued guidance to states in 2017 and 2018 with the intent to improve efforts to ensure demonstrations are budget neutral and effectively Page 253 GAO-19-157SP High-Risk Series Strengthening Medicaid Program Integrity evaluated However this guidance addresses some but not all of the concerns we raised in January 2018 about how CMS sets spending limits and evaluates demonstrations For example CMS has not yet implemented its plan to establish written procedures for all states to submit a final evaluation report at the end of each demonstration cycle nor has it established criteria for when the agency will allow limited evaluations Further CMS has not made progress with regard to an action plan for improving its oversight of supplemental payments Monitoring partially met For demonstrations CMS has begun assessing the effect of its new budget neutrality policy with the renewal of each demonstration Agency officials told us that CMS has developed a reporting tool for states that will allow for monitoring of the policy over time Until CMS implements the tool it will lack the data it needs to effectively monitor this new policy For supplemental payments CMS has taken action when we and others identified questionable payments payments where the appropriateness of the amounts or use of funds were questionable CMS reviewed excessive payments we identified in April 2015 in New York and made retroactive payment reductions totaling more than $1 5 billion of which the federal share was about $771 million However CMS continues to lack a strategy for systematically identifying questionable payments Demonstrated progress partially met CMS has not made significant progress towards improving its oversight of supplemental payments for which reporting remains incomplete With regard to oversight of demonstration spending CMS estimated its budget neutrality policy reduced total demonstration spending limits by $109 billion for 2016 through 2018 the federal share of which is $62 9 billion Another component of that policy does not take effect until 2021 and will be implemented as demonstrations come up for renewal—which should further reduce federal liabilities What Remains to Be Done • Since designating Medicaid as a high-risk area in 2003 we have made at least 55 recommendations related to the appropriate use of program dollars 18 of which were open as of November 2018 CMS needs to take the following steps to better assure the appropriate use of Medicaid dollars address questionable methods—particularly relying on hypothetical rather than actual expenditures—used to set demonstration spending limits develop and document standard operating procedures for monitoring spending under demonstrations assure timely state evaluation of demonstrations and develop a policy for publicly releasing findings from federal evaluations of demonstrations Page 254 GAO-19-157SP High-Risk Series Strengthening Medicaid Program Integrity • ensure complete and accurate reporting on supplemental payments made to individual hospitals and institutional providers as well as the sources of funds states use to finance their share of Medicaid payments outline clear criteria data and a review process to ensure supplemental payments are economical and efficient and write guidance clarifying its policy that requires a link between the distribution of supplemental payments and Medicaid-covered services and • complete a risk assessment and take steps as needed to assure that resources to oversee expenditures reported by states are adequate and allocated according to risk Congressional Actions Needed Medicaid Data Congressional action could improve oversight of Medicaid expenditures particularly related to supplemental payments and demonstrations • Congress should consider establishing statutory requirements for the Secretary of the Department of Health and Human Services to improve the demonstration review process to more clearly outline the methods used to demonstrate budget neutrality and • Congress should consider broadening supplemental payment requirements around reporting and auditing to include all types of supplemental payments We are rating the Medicaid data segment for the first time CMS has taken steps to improve data quality across the Medicaid program primarily through a reenvisioning of states’ data reporting However CMS needs to take additional steps to ensure data quality and specify how and when it will use improved data for oversight Accurate and complete data on beneficiary access and use of services and the costs of providing such services are critical to effectively managing and overseeing this multibillion dollar program Leadership commitment partially met CMS has made progress in improving Medicaid data through the ongoing implementation of the Transformed Medicaid Statistical Information System T-MSIS As of June 2018 all states the District of Columbia and Puerto Rico were submitting at least some T-MSIS data However we reported in December 2017 that these data were not complete nor were they comparable across states We recommended CMS take steps to expedite the use of T-MSIS data for oversight CMS noted in July 2018 that its primary goal is to improve data quality and more work is needed before it can use these data for oversight Page 255 GAO-19-157SP High-Risk Series Strengthening Medicaid Program Integrity Capacity partially met The 2016 managed care final rule includes several requirements that could improve the reliability of state-collected MCO utilization data known as encounter data These requirements include requiring states to conduct an independent audit of the encounter data reported by each MCO providing CMS with an annual assessment of these data and validating data reliability However it remains unclear whether state efforts to validate encounter data will be sufficient in part because CMS has not provided minimum standards to states for doing so Action plan not met CMS needs to develop an action plan for using quality program data for program oversight In December 2017 we recommended CMS articulate a plan and associated time frames for using T-MSIS data for oversight The agency concurred but has yet to specify such a plan It notes the use of these data for oversight is contingent upon ongoing CMS and state efforts to ensure their quality Similarly in January 2017 we recommended CMS develop a plan for using data on personal care services PCS —assistance with activities of daily living such as bathing dressing and toileting for beneficiaries with limited ability to care for themselves—to inform oversight efforts CMS has yet to develop this plan Monitoring partially met In February 2018 CMS issued guidance on Medicaid PCS reported by states which suggests that states include key data elements in PCS claims reported through T-MSIS and could address information gaps we identified T-MSIS also includes data elements for states to report provider-specific supplemental payments which CMS did not previously collect However we reported in December 2017 that several selected states were not reporting all these data elements Without complete information CMS’s oversight of PCS and supplemental payments will be limited Demonstrated progress partially met The ongoing implementation of T-MSIS has been a significant multi-year effort With all states now reporting at least some T-MSIS data CMS is focused on assessing and improving data quality CMS identified 12 top priority items and issued a State Health Official letter in August 2018 that informed states they are expected to resolve data quality issues related to these priority items within 6 months CMS stated that it will request states that do not meet this time frame to submit a corrective action plan CMS also noted that it intends to expand data reviews beyond the 12 top priority items but has not specified a time frame for completing this and other data quality efforts or its plans for using these data for oversight What Remains to be Done Since designating Medicaid as a high-risk area in 2003 we have made over 35 recommendations related to Medicaid data 13 of which were Page 256 GAO-19-157SP High-Risk Series Strengthening Medicaid Program Integrity open as of November 2018 To improve the quality of Medicaid data for use in program oversight CMS needs to Related GAO Products • provide states with guidance that includes minimum standards for encounter data validation procedures • provide states with information on scope and methodology requirements for MCO encounter data audits required content of the annual assessment report and circumstances for deferring or disallowing matching funds in response to noncompliant encounter data submissions and • continue efforts to assess and improve T-MSIS data such as refining the overall data priority areas to identify those variables most critical for reducing improper payments and articulate specific plans and associated timeframes for using T-MSIS data Medicaid Managed Care Additional CMS Actions Needed to Help Ensure Data Reliability GAO-19-10 Washington D C October 19 2018 Medicaid CMS Needs to Better Target Risks To Improve Oversight of Expenditures GAO-18-564 Washington D C August 6 2018 Medicaid Managed Care Improvements Needed to Better Oversee Payment Risks GAO-18-528 Washington D C July 26 2018 Medicaid Demonstrations Evaluations Yielded Limited Results Underscoring Need for Changes to Federal Policies and Procedures GAO-18-220 Washington D C January 19 2018 Medicaid Further Action Needed to Expedite Use of National Data for Program Oversight GAO-18-70 Washington D C December 8 2017 Medicaid Demonstrations Federal Action Needed to Improve Oversight of Spending GAO-17-312 Washington D C April 3 2017 Medicaid Program Oversight Hampered by Data Challenges Underscoring Need for Continued Improvements GAO-17-173 Washington D C January 6 2017 Medicaid Federal Guidance Needed to Address Concerns About Distribution of Supplemental Payments GAO-16-108 Washington D C February 5 2016 Medicaid Additional Efforts Needed to Ensure that State Spending is Appropriately Matched with Federal Funds GAO-16-53 Washington D C October 16 2015 Page 257 GAO-19-157SP High-Risk Series Strengthening Medicaid Program Integrity Medicaid CMS Oversight of Provider Payments is Hampered by Limited Data and Unclear Policy GAO-15-322 Washington D C April 10 2015 Medicaid More Transparency of and Accountability for Supplemental Payments Are Needed GAO-13-48 Washington D C November 26 2012 Medicaid Demonstration Waivers Recent HHS Approvals Continue to Raise Cost and Oversight Concerns GAO-08-87 Washington D C January 31 2008 Page 258 GAO-19-157SP High-Risk Series Improving and Modernizing Federal Disability Programs Improving and Modernizing Federal Disability Programs Management attention and efforts are needed across the government to ensure that disability programs provide benefits in a timely manner reflect current ideas about disability and achieve positive employment outcomes Why Area Is High Risk An estimated one in six working-age Americans reported a disability in 2010 Many of these Americans need help finding or retaining employment or rely on cash benefits if they cannot work However federal disability programs struggle to meet their needs Three of the largest federal disability programs—two managed by SSA and one by VA—dispensed about $270 billion in cash benefits to 21 million people with disabilities in fiscal year 2017 Both agencies struggle to manage their workloads specifically appealed claims In addition when determining whether individuals qualify for disability benefits SSA and VA rely on outdated criteria While both agencies have efforts underway to update medical or occupational information used to make eligibility decisions they continue to rely on information that can be decades old In addition to the aforementioned cash benefit programs we previously identified over 40 programs managed by nine different agencies that provide a patchwork of employment support for people with disabilities We reported in 2012 that these programs lacked a unified vision strategy or set of goals to guide their outcomes We designated improving and modernizing federal disability programs as high risk in 2003 Contact Information For additional information about this high-risk area contact Elizabeth H Curda at 202 512-7215 or curdae@gao gov Since our 2017 High-Risk Report our assessment of ratings for all five criteria remains unchanged Both the Social Security Administration SSA and the Department of Veterans Affairs VA made mixed progress in addressing their claims workloads Leadership of both agencies demonstrated commitment to reducing backlogs in their appeals workloads However these backlogs remain large and persistent shortcomings in agency plans and capacity challenges could hinder progress Both SSA and VA demonstrated leadership commitment toward updating the criteria on which their disability determinations are made However action plans for both lack details on some necessary tasks that could result in delays in updating disability criteria now and in the future The Office of Management and Budget OMB reported that the administration is pursuing additional legislative and administrative changes and demonstration projects to increase workforce participation for people with disabilities However many efforts are still underway and OMB continues to lack a larger vision for coordinating disability programs which includes creating appropriate government-wide goals and strategies Page 259 GAO-19-157SP High-Risk Series Improving and Modernizing Federal Disability Programs Since our 2017 High-Risk Report our assessment of ratings for all five criteria remains unchanged Managing Disability Claims Workloads SSA Leadership commitment met SSA leadership set a goal to process appeals within 270 days by fiscal year 2022 and made reducing its disability appeals backlog a key initiative in its fiscal year 2019 annual performance plan Capacity partially met SSA continues to face capacity challenges in addressing its disability appeals backlog SSA’s 2017 disability appeals plan called for increased hiring and other measures to reduce disability appeals backlogs and improve timeliness SSA has also transferred appeals cases between offices to better utilize its capacity to make decisions However we reported in July 2018 that SSA lacks metrics to assess the effect of transfers on timeliness and SSA agreed with our recommendation to implement such metrics We also reported that SSA hiring freezes could affect its capacity Action plan partially met SSA’s 2017 appeals plan addresses large disability appeals workloads through improvements in information technology and business processes and through increased hiring However it is too early to determine the extent to which this plan will allow SSA to achieve its goal of processing claims within 270 days More broadly SSA’s Vision 2025 strategic plan recognizes the need to provide a number of different service delivery methods including online However in 2017 we reported that that SSA had not developed performance measures for or analyzed common issues with online services SSA agreed with our recommendations to do so but had not completed its efforts as of January 2019 Monitoring met SSA continues to monitor and report on the timeliness of processing its initial disability claims and appeals workloads Demonstrated progress partially met While SSA has seen a decline in applications for benefits in recent years SSA’s inventory of initial disability claims increased somewhat from 523 000 at the end of fiscal year 2017 to 565 000 at the end of fiscal year 2018 The number of pending appeals declined from approximately 1 1 million at the end of fiscal year 2017 to 858 000 in fiscal year 2018 and average processing times improved from 605 days to 595 days during this same period However additional progress is needed if SSA is to meet its goal of processing appeals within 270 days by the end of fiscal year 2022 Page 260 GAO-19-157SP High-Risk Series Improving and Modernizing Federal Disability Programs What Remains to Be Done Since 2003 we have made 35 recommendations related to this high-risk segment As of December 2018 10 remain open SSA should continue to make and implement plans for managing its workloads This includes continuing to • refine and implement plans to address its disability appeals backlog and • operationalize its long-term strategic plan to ensure that the agency is well positioned to serve its customers in the future Since our 2017 High-Risk Report our assessment of ratings for all five criteria remains unchanged Managing Disability Claims Workloads VA Leadership commitment met VA has maintained leadership focus on managing initial disability claims and appeals workloads through various initiatives to improve benefits processing and reduce backlogs Enhancing and modernizing VA’s disability claims and appeals processes are goals in its 2018–2024 strategic plan Capacity partially met VA has continued building the capacity to process initial disability claims such as using an electronic system to distribute claims ready for decisions to available staff On appeals VA is reforming its process onboarding hundreds of new staff and implementing new technology However as we reported in March 2018 VA’s appeals planning does not provide reasonable assurance that it will have the capacity to implement the new process and manage risks VA agreed with our recommendation to better assess risks associated with appeals reform Action plan partially met VA continues to implement plans to reduce the initial disability claims backlog For appeals reform VA submitted its appeals plan in November 2017 and provided several progress reports throughout 2018 In December 2018 we reported that while VA had taken steps it had not fully addressed our recommendations on planning the new appeals process and assessing its efficacy As of December 2018 VA officials said they continue to address our recommendations Monitoring partially met VA monitors the timeliness of initial disability claims and legacy appeals and has set timeliness goals for three of five appeal options under the new process VA’s plans also signal how it intends to monitor the allocation of staff for concurrent workloads in its Page 261 GAO-19-157SP High-Risk Series Improving and Modernizing Federal Disability Programs legacy and new appeals processes However as of December 2018 VA had not established complete metrics and interim goals for all appeal options and it was unclear how and when VA will monitor implementation and efficacy of the new appeal process Demonstrated progress partially met VA reported it reduced the backlog of initial disability claims from 611 000 in March 2013 to just over 85 000 in August 2018 However VA’s Office of Inspector General reported in September 2018 that VA overstated its performance by only reporting about 79 percent of the backlog For appeals VA addressed some gaps in its plan for implementing appeals reform in accordance with our 2017 and 2018 recommendations and has prioritized processing of legacy appeals However as of August 2018 VA still had a backlog of over 400 000 appeals What Remains to Be Done Since 2003 we have made 65 recommendations related to managing VA workloads As of December 2018 13 remain open VA should continue updating and implementing plans to address its initial disability claims and appeals workloads at both levels This includes • maintaining focus on initial claims and appeals processing • ensuring VA has detailed plans for creating capacity and reforming its appeals process including modifications to information technology systems and • determining how well the new process is performing relative to the legacy process Since our 2017 High-Risk Report ratings for the action plan criterion regressed while the other four remain unchanged Updating Disability Benefit Eligibility Criteria SSA Leadership commitment met SSA has maintained leadership focus on updating both the medical and occupational criteria used to determine eligibility for Social Security disability benefits Capacity met Consistent with our past recommendations in June 2012 SSA continues to leverage the Bureau of Labor Statistics to develop an occupational information system OIS to replace SSA’s outdated Dictionary of Occupational Titles to assist in making disability determination decisions Page 262 GAO-19-157SP High-Risk Series Improving and Modernizing Federal Disability Programs Action plan partially met SSA has developed project plans to guide the completion of OIS and update its medical criteria now and in the future However we are lowering SSA’s prior rating of met to partially met Since our 2017 high-risk update SSA told us that it began work on its Vocational Regulations Modernization VRM initiative—an effort SSA says will update its vocational rules to reflect labor market changes—but has not released a plan or any supporting documentation related to VRM Monitoring met SSA continues to monitor progress toward updating its medical criteria and has a timetable against which to monitor OIS development Demonstrated progress partially met A September 2018 status report from SSA stated that the agency promulgated final regulations for 13 of the 14 body systems listings of diseases and disorders in each part of the body and proposed a rule for comprehensively updating the last body system SSA also reported that once the final rule is complete it will begin targeting updates to body systems per its plans to review and update them every 3 to 5 years For OIS SSA reported it planned to complete its final year of occupational data collection in 2018 and expects to start using it in deciding disability claims in calendar year 2020 What Remains to be Done Since 2003 we have made seven recommendations related to this highrisk segment all of which were implemented SSA should continue to develop and implement plans to update its disability criteria Specifically SSA should • develop an action plan for implementing its VRM initiative that addresses when and how updates to its vocational rules will align with implementation of OIS and • finalize its comprehensive updates of medical criteria and begin using occupational data collected through its OIS Since our 2017 High-Risk Report ratings for the action plan and monitoring criteria regressed while the other three remain unchanged Updating Disability Benefit Eligibility Criteria VA Leadership commitment met VA has sustained leadership focus on updating its Veterans Affairs Schedule for Rating Disabilities VASRD —used to assign degree of disability and compensation levels for veterans with military service-connected Page 263 GAO-19-157SP High-Risk Series Improving and Modernizing Federal Disability Programs injuries or conditions—to reflect advances in medicine and labor market changes Capacity partially met In August 2017 VA officials told us that it had taken actions to hire more staff for the regulations updates and leverage outside researchers to evaluate veterans’ loss of earnings in the current economy However as of September 2018 the agency was still working to hire these staff Moreover VA’s current earnings loss study covers only 8 of over 900 diagnostic codes and 2 of 15 body systems VA needs to continue its current hiring and earnings loss planning efforts to ensure it has the capacity to comprehensively update the VASRD Action plan partially met As of August 2018 VA’s efforts to update the VASRD included new plans to conduct earnings loss studies for eight diagnostic codes under two body systems The agency intends to determine whether its current approach for evaluating earnings loss is applicable to updating other diagnostic codes However we are lowering VA’s prior rating of met to partially met because its August 2018 updated plan issued since our 2017 high-risk update provides limited detail on key planned activities For example VA’s plans do not indicate how and when VA will assess the applicability of its current approach and does not include plans for updating earnings loss information for the remaining diagnostic codes and body systems Monitoring partially met According to VA officials VA continues to track its progress toward finishing the medical updates by fiscal year 2020 and has updated its project plan to reflect delayed timeframes However we are lowering VA’s prior rating for this criterion from met to partially met because VA’s plans have changed since our last update and although it is conducting a study to update earnings loss information for some diagnostic codes and body systems its plan does not include timetables for monitoring these or future updates to earnings loss information Demonstrated progress partially met VA reported that as of December 2018 it promulgated final regulations for 6 of 15 body systems proposed regulations for 2 and is reviewing draft regulations for the remaining 7 However VA has fallen about 4 years behind in its efforts to fully update the VASRD and has not completed earnings loss updates What Remains to be Done Since 2003 we have made three recommendations related to modernizing disability criteria all of which were implemented VA should continue to develop and implement plans for updating medical criteria and earnings loss information This includes Page 264 GAO-19-157SP High-Risk Series Improving and Modernizing Federal Disability Programs • ensuring sufficient resources are dedicated to this effort • developing a viable plan for monitoring progress in updating earnings loss information and • refining plans to revisit criteria at least once every 10 years Programs with Unified Strategies and Goals OMB Since our 2017 High-Risk Report our assessment of ratings for all five criteria remains unchanged Leadership commitment partially met In September 2018 OMB reported that the administration is pursuing several legislative changes administrative actions and demonstration projects intended to either improve collaboration across multiple federal agencies or address the relatively low levels of employment of people with disabilities However OMB continues to lack a larger vision for coordinating over 40 programs that support employment of people with disabilities and establishing overarching goals to improve employment of people with disabilities in both federal and non-federal sectors Capacity partially met According to OMB the administration has proposed continued funding for several interagency demonstration projects that have potential to inform the development of reasonable goals and measures for federal programs that support employment for people with disabilities However it is too early to conclude whether these demonstrations will inform government-wide goals and measures and OMB has not indicated that it will build capacity for establishing government-wide goals and improving agency coordination Action plan not met OMB has yet to establish government-wide goals and associated plans for the employment of people with disabilities outside of the federal sector Monitoring partially met Since 2017 some progress has been made toward monitoring the hiring of individuals with disabilities in the federal sector For example in 2018 OMB reported that it would have sufficient data by the end of the year to assess progress toward a goal the Department of Labor set in 2013 that individuals with disabilities should comprise 7 percent of the workforce for federal contractors and subcontractors Demonstrated progress partially met While progress has been made on previous goals related to federal-sector hiring OMB has yet to develop Page 265 GAO-19-157SP High-Risk Series Improving and Modernizing Federal Disability Programs government-wide goals for all federal programs that support employment of people with disabilities across all sectors What Remains to be Done As of December 2018 two actions related to this high-risk segment had not been fully addressed from our 2012 annual report on opportunities to reduce fragmentation overlap and duplication for the federal government Moving forward OMB should develop a set of unifying government-wide goals for employment of people with disabilities OMB’s efforts to this end might benefit from an action plan In general agencies can make progress in addressing high-risk areas by developing action plans that identify and analyze the root causes of problems and identify critical actions and outcomes to address those root causes Related GAO Products VA Disability Benefits Some Progress but Further Steps Needed to Improve Appeals Reform Planning GAO-18-661T Washington D C July 24 2018 Social Security Disability Better Timeliness Metrics Needed to Assess Transfers of Appeals Work GAO-18-501 Washington D C July 19 2018 VA Disability Benefits Improved Planning Practices Would Better Ensure Successful Appeals Reform GAO-18-352 Washington D C March 22 2018 Social Security Disability Additional Measures and Evaluation Needed to Enhance Accuracy and Consistency of Hearings Decisions GAO-18-37 Washington D C December 7 2017 Social Security Administration Improvements Needed in Facilities Planning and Service Delivery Evaluation GAO-17-597 Washington D C July 25 2017 VA Disability Benefits Additional Planning Would Enhance Efforts to Improve the Timeliness of Appeals Decisions GAO-17-234 Washington D C March 23 2017 Page 266 GAO-19-157SP High-Risk Series Pension Benefit Guaranty Corporation Insurance Programs Pension Benefit Guaranty Corporation Insurance Programs The financial stability of the Pension Benefit Guaranty Corporation’s PBGC single- and multiemployer programs faces many structural challenges that require congressional action Why Area Is High Risk With over $112 billion in assets PBGC’s portfolio is one of the largest of any federal government corporation Through its single-employer and multiemployer insurance programs PBGC insures the pension benefits of nearly 37 million American workers and retirees who participate in about 24 800 private-sector defined benefit plans PBGC’s financial future remains uncertain due in part to a long-term decline in the number of traditional defined benefit plans and the collective financial risk of the many underfunded pension plans PBGC insures We designated the singleemployer program as high risk in 2003 and the multiemployer program in 2009 Since fiscal year 2013 PBGC’s financial deficit has increased by nearly 45 percent At the end of fiscal year 2018 PBGC’s net accumulated financial deficit was over $51 billion—an increase of about $16 billion since 2013 The singleemployer program composed of about 23 400 plans accounted for a surplus of $2 4 billion—an improvement of about $30 billion since 2013 The multiemployer program composed of about 1 400 plans accounted for a deficit of about $54 billion In addition PBGC estimated that its exposure to potential future losses for underfunded plans in both the single- and multiemployer programs was nearly $185 billion According to past PBGC projections it is nearly certain that the multiemployer program does not have the needed resources to satisfy the agency's long-term obligations Contact Information For additional information about this high-risk area contact Charles A Jeszeck at 202 512-7215 or jeszeckc@gao gov As with our last High-Risk Report in 2017 we are not rating this high-risk area because addressing the identified issues primarily involves congressional action While PBGC faces a long-term challenge with its single-employer program it faces an immediate and critical challenge with its multiemployer program In a March 2013 report on PBGC’s multiemployer program we recommended that Congress consider comprehensive and balanced structural reforms to reinforce and stabilize the multiemployer system In 2014 Congress took action to address this growing crisis by passing the Multiemployer Pension Reform Act MPRA that enacted several reforms responsive to our report Specifically MPRA provided severely underfunded plans under certain conditions and only with the approval of federal regulators the option to reduce the retirement benefits of current retirees to avoid plan insolvency The act also expanded PBGC’s ability to intervene when plans are in financial distress In addition MPRA more than doubled the flat-rate or per participant premiums paid by multiemployer plans from $12 per participant in plan year 2014 to $26 per participant in plan year 2015 and provided for future increases indexed to inflation For plan year 2019 the per participant flat-rate premium is $29 Even though these reforms were intended to improve the program’s financial condition PBGC's projections suggest that the insolvency of the multiemployer program remains highly likely within the next 6 years Since 2013 the agency’s net financial deficit for the multiemployer program has grown nearly sixfold see figure 14 Prior to passage of MPRA PBGC estimated that the multiemployer insurance fund would likely be exhausted by 2022 as a result of current and projected plan insolvencies In February 2017 we reported that PBGC officials said that the act did not fully address the crisis in the multiemployer program Officials predicted the act's changes would only forestall insolvency by about an additional 3 years As of year-end 2018 25 multiemployer plans Page 267 GAO-19-157SP High-Risk Series Pension Benefit Guaranty Corporation Insurance Programs submitted under MPRA 34 applications to suspend previously accrued and protected benefits Of the applications submitted for Treasury review 10 have been approved 5 have been denied 12 have been withdrawn and 7 are pending review or awaiting determination Figure 14 Pension Benefit Guaranty Corporation’s PBGC Net Financial Position of the Single-Employer and Multiemployer Programs Combined Fiscal Years 1990 through 2018 While changes were made with passage of MPRA PBGC's projections of the multiemployer program's pending insolvency have become more concerning since 2017 Based on fiscal year 2017 projections PBGC officials believe there is an over 40 percent chance that the multiemployer program will be insolvent by the year 2024 After that the risk of insolvency rises rapidly—reaching over 90 percent by 2025 and 99 percent by 2026 If the multiemployer program becomes insolvent participants in insolvent pension plans that receive financial assistance from PBGC will receive a small fraction of current statutory guarantees Though guaranteed benefits depend on the years of service a participant earned through qualifying work the maximum guarantee is currently $12 870 per year for a retiring participant that had 30 years of service PBGC estimates that under its projection most participants would receive less than $2 000 per year and in many cases much less Page 268 GAO-19-157SP High-Risk Series Pension Benefit Guaranty Corporation Insurance Programs The Bipartisan Budget Act of 2018 established a Joint Select Committee on Solvency of Multiemployer Pension Plans The goal of the joint committee is to improve the solvency of multiemployer pension plans and PBGC The joint committee held five hearings on the multiemployer system and PBGC as well as how stakeholders—particularly current workers retirees and employers—are likely to be affected by potential insolvencies The act tasked the joint committee which by law was set to terminate by December 31 2018 with voting on a report that includes any findings conclusions and recommendations—as well as proposed legislative language to carry out any recommendations—by November 30 2018 However the co-chairmen of the joint committee released a statement committing to working to solve the multiemployer pension crisis past the November 30th deadline On January 9 2019 the chairman of the House Ways and Means Committee introduced legislation with bipartisan co-sponsorship that would establish a new agency within Treasury that would be tasked with providing and overseeing loans to certain troubled multiemployer plans Although the net deficit for the single-employer program has improved significantly since we last reported PBGC continues to face longstanding structural funding challenges due to an overall decline in the defined benefit pension system While tens of thousands of companies continue to offer traditional defined benefit plans the number of singleand multiemployer plans and participants have declined significantly Since 1985 there has been a 78 percent decline in the number of plans insured by PBGC—from about 114 400 plans to about 24 800 plans in 2018 In addition nearly 13 million fewer workers are actively participating in these plans While the PBGC's single-employer program currently is in surplus it is not certain that the program will remain in surplus into the future Further PBGC's net financial position is highly sensitive to prevailing economic conditions PBGC's past experience with large claims shows that the single-employer program’s condition can change quickly and precipitously For example the spate of plan terminations in the airline and steel industries from 2001 through 2006 resulted in more than $20 billion of net claims The possibility for large future claims persists as underfunded plans sponsored by companies with credit ratings below investment grade represent $175 billion in potential exposure as of fiscal year-end 2018 The structure of PBGC’s premium rates—a key component of its funding—has long been another area of concern Despite periodic increases in premium rates which are set according to statute the premiums do not align with the multiplicity of risks PBGC insures against Currently plan underfunding is the only risk factor currently considered in determining a sponsor’s premium rate Under the current premium Page 269 GAO-19-157SP High-Risk Series Pension Benefit Guaranty Corporation Insurance Programs structure for its single-employer program PBGC collects from sponsors a per-participant flat-rate premium and a variable-rate premium that is based on a plan’s level of underfunding To date no legislation incorporating additional risk factors such as company financial health or plan investment mix into PBGC’s premium structure has been enacted PBGC’s governance structure is another area of weakness noted in several of our past reports In particular we have long recommended that PBGC’s board—currently composed of the Secretary of the Treasury the Secretary of Labor and the Secretary of Commerce—be expanded to include additional members who possess diverse knowledge and expertise useful to PBGC’s mission In addition the National Academy of Public Administration recommended in a 2013 report to Congress that PBGC's board be expanded if PBGC is provided greater responsibility over its policies We have long emphasized that PBGC requires strong and stable leadership to ensure it can meet its future financial challenges What Remains to Be Done Although Congress and PBGC have taken significant and positive steps to strengthen the agency over the past 5 years since the passage of MPRA concerns are becoming increasingly urgent with particular respect to the multiemployer program and PBGC’s overall funding structure and governance Also the premium structure for PBGC’s single-employer program continues to result in rates that do not align with the risk the agency insures against Absent additional steps to improve PBGC’s finances the long-term financial stability of the agency remains uncertain and the retirement benefits of millions of American workers and retirees could be at risk of dramatic reductions Congressional Actions Needed As we have previously recommended over the years since we added PBGC to the High-Risk List Congress should consider improving the long-term financial stability of both of PBGC’s insurance programs by • authorizing a redesign of PBGC’s single-employer program premium structure to better align premium rates with sponsor risk • adopting additional changes to PBGC’s governance structure—in particular expanding the composition of its board of directors • strengthening funding requirements for plan sponsors as appropriate given national economic conditions • working with PBGC to develop a strategy for funding PBGC claims over the long term as the defined benefit pension system continues to decline and • enacting additional structural reforms to reinforce and stabilize the multiemployer system and balance the needs and potential sacrifices of contributing employers participants and the federal government Page 270 GAO-19-157SP High-Risk Series Pension Benefit Guaranty Corporation Insurance Programs Related GAO Products Central States Pension Fund Investment Policy Decisions and Challenges Facing the Plan GAO-18-106 Washington D C June 4 2018 Pension Plan Valuation Views on Using Multiple Measures to Offer a More Complete Financial Picture GAO-14-264 Washington D C September 30 2014 Private Pensions Timely Action Needed to Address Impending Multiemployer Plan Insolvencies GAO-13-240 Washington D C March 28 2013 Private Pensions Multiemployer Plans and PBGC Face Urgent Challenges GAO-13-428T Washington D C March 5 2013 Pension Benefit Guaranty Corporation Redesigned Premium Structure Could Better Align Rates with Risk from Plan Sponsors GAO-13-58 Washington D C November 7 2012 Pension Benefit Guaranty Corporation Asset Management Needs Better Stewardship GAO-11-271 Washington D C June 30 2011 Pension Benefit Guaranty Corporation Improvements Needed to Strengthen Governance Structure and Strategic Management GAO-11182T Washington D C December 1 2010 Private Pensions Changes Needed to Better Protect Multiemployer Pension Benefits GAO-11-79 Washington D C October 18 2010 Page 271 GAO-19-157SP High-Risk Series National Flood Insurance Program National Flood Insurance Program Congress should consider comprehensive reform of the National Flood Insurance Program NFIP to improve the program’s solvency and enhance the nation’s resilience to floods The Federal Emergency Management Agency FEMA should also take steps to complete the implementation of improvements to its rate-setting methods and compensation of insurance companies among other actions Why Area Is High Risk NFIP has experienced significant challenges because FEMA is tasked with two competing goals—keeping flood insurance affordable and keeping the program fiscally solvent Emphasizing affordability has led to premium rates that in many cases do not reflect the full risk of loss and produce insufficient premiums to pay for claims In turn this has transferred some of the financial burden of flood risk from individual property owners to taxpayers as a whole Accordingly we added this area to our High-Risk List in 2006 NFIP has had to borrow from the Department of the Treasury to pay claims from major natural disasters As of September 2018 FEMA’s debt stood at $20 5 billion despite Congress having canceled $16 billion in debt in October 2017 Without reforms the financial condition of NFIP could continue to worsen Contact Information For additional information about this high-risk area contact Alicia Puente Cackley at 202-512-8678 or cackleya@gao gov Since our 2017 High-Risk Report there have been no changes to the five criteria ratings because action on open recommendations has not yet been completed by FEMA and comprehensive reform of the program has not yet been enacted by Congress Leadership commitment partially met FEMA leadership continues to show a commitment to implementing our recommendations for example by eliminating some potential barriers to the private flood insurance market FEMA also took steps to protect the program’s financial stability such as purchasing reinsurance However Congress has yet to enact comprehensive program reforms Capacity partially met FEMA’s capacity remains strained as it deals with multiple challenges including responding to multiple natural disasters and implementing provisions of recent legislation and leadership changes in the flood insurance program Action plan partially met FEMA identified actions to address our recommendations and tracks outstanding recommendations through an internal controls program to guide its own efforts and provide us with status updates For example they track and provide us with regular updates on their efforts to update their methodology for calculating premium rates However FEMA lacks a comprehensive plan to address the issues that placed NFIP on our High-Risk List Such a plan could help FEMA define causes and identify effective solutions Monitoring partially met FEMA has a process to monitor progress in implementing our recommendations including regular discussions at FEMA and the Department of Homeland Security However FEMA lacks a process to evaluate the effectiveness of those actions Additional monitoring would help ensure appropriate corrective actions are taken Demonstrated progress partially met FEMA has taken steps to implement many of our recommendations for example by addressing a Page 272 GAO-19-157SP High-Risk Series National Flood Insurance Program potential challenge to consumers who wish to purchase private flood insurance However FEMA’s efforts to address our recommendations in other areas are in progress or could take years to complete For example FEMA is in the process of updating its premium rate-setting methodology but these changes will not begin until 2020 Congress held hearings on reforming NFIP and passed several short-term reauthorizations However Congress has yet to enact reforms related to the six areas we identified in April 2017 program debt full-risk-rates affordability consumer participation private-sector involvement and flood mitigation What Remains to Be Done Over the years since we added this area to our High-Risk List we have made numerous recommendations related to this high-risk issue As of December 2018 13 recommendations are open The flood insurance program has improved in a number of areas but to demonstrate progress FEMA should • complete implementation of the Biggert-Waters Flood Insurance Reform Act of 2012 and Homeowner Flood Insurance Affordability Act of 2014 • develop a comprehensive plan for removing NFIP from the High-Risk List • initiate broader monitoring of the effectiveness and sustainability of actions to implement our recommendations • continue ongoing efforts to improve NFIP rate-setting methods and evaluate approaches to obtain flood risk information needed to determine full-risk rates for properties with previously subsidized rates and • complete efforts to establish a new information technology system for NFIP Congressional Actions Needed We have an open matter for Congress to consider from our April 2017 report that examined actions Congress and FEMA could take to reduce federal fiscal exposure and improve resilience to floods We stated that Congress should consider comprehensive reform which could include actions in six areas 1 addressing the current debt 2 removing existing legislative barriers to FEMA’s ability to revise premium rates to reflect the full risk of loss 3 addressing affordability 4 increasing consumer participation 5 removing barriers to private-sector involvement and 6 protecting NFIP flood resilience efforts Related GAO Products Flood Insurance Comprehensive Reform Could Improve Solvency and Enhance Resilience GAO-17-425 Washington D C April 27 2017 Flood Insurance FEMA Needs to Address Data Quality and Consider Company Characteristics When Revising Its Compensation Methodology GAO-17-36 Washington D C December 8 2016 Page 273 GAO-19-157SP High-Risk Series National Flood Insurance Program Flood Insurance Potential Barriers Cited to Increased Use of Private Insurance GAO-16-611 Washington D C July 14 2016 National Flood Insurance Program Continued Progress Needed to Fully Address Prior GAO Recommendations on Rate-Setting Methods GAO-16-59 Washington D C March 17 2016 National Flood Insurance Program Options for Providing Affordability Assistance GAO-16-190 Washington D C February 10 2016 Page 274 GAO-19-157SP High-Risk Series Managing Risks and Improving VA Health Care Managing Risks and Improving VA Health Care The Department of Veterans Affairs VA has taken steps to maintain its leadership commitment and develop its action plan but still needs to demonstrate capacity and establish metrics to monitor and demonstrate progress addressing VA health care concerns Why Area Is High Risk The VA operates one of the largest health care delivery systems in the nation providing health care to more than 9 million veterans Since we designated VA health care as a high-risk area in 2015 VA has begun to address each of the identified five areas of concern 1 ambiguous policies and inconsistent processes 2 inadequate oversight and accountability 3 information technology challenges 4 inadequate training for VA staff and 5 unclear resource needs and allocation priorities Since we issued our 2017 High-Risk Report VA has undergone significant transition Prior to Secretary Wilkie’s confirmation in July 2018 VA’s leadership was in a state of flux with numerous senior-level vacancies including the Secretary Under Secretary for Health Chief Financial Officer Chief Information Officer and the Deputy Under Secretary for Health for Community Care positions During this period of leadership instability VA began implementing several major modernization initiatives It is transitioning to the same electronic health record system the Department of Defense is currently deploying and VA’s community care program has undergone major structural change and received significant funding increases Contact Information For additional information about this high-risk area contact Debra A Draper at 202 512-7114 or draperd@gao gov or Sharon Silas at 202 512-7114 or silass@gao gov Since our 2017 High-Risk Report ratings for all five criteria remain unchanged Specifically the leadership commitment and action plan criteria remain partially met Although VA has experienced leadership instability over the past 2 years in several senior positions a new Secretary was confirmed in July 2018 Secretary Robert Wilkie has demonstrated his commitment to addressing the department’s high-risk designation by among other things creating an office to direct an integrated focused high-risk approach and communicating to VA leaders the importance of addressing our recommendations The Secretary’s actions to date have allowed the department to maintain its leadership commitment rating The action plan criterion also remains partially met In March 2018 VA submitted an action plan to address the underlying causes of its high-risk designation but the plan did not clearly link actions to stated outcomes and goals or establish a framework to assess VA’s progress VA officials have indicated that they are currently working to revise their action plan and that the January 2019 draft VHA Plan for Modernization is intended among other things to address our long-standing concerns The monitoring demonstrated progress and capacity criteria remain unmet since our 2017 High-Risk Report In order to address the monitoring and demonstrated progress criteria VA’s ongoing revisions to its action plan need to include the addition of certain essential components including metrics milestones and mechanisms for monitoring and demonstrating progress in addressing the high-risk areas of concern VA’s capacity rating also remains not met Though the department took steps to establish offices workgroups and initiatives to address its high-risk designation many of these efforts are either in the initial stages of development or resources have not been allocated We have made 353 recommendations related to VA health care since 2010 175 of which were made after VA health care was put on the HighRisk List in 2015 As of December 2018 the department has Page 275 GAO-19-157SP High-Risk Series Managing Risks and Improving VA Health Care implemented nearly 60 percent of the recommendations related to VA health care made since January 2010 Since our 2017 High-Risk Report ratings for all five criteria remain unchanged Ambiguous Policies and Inconsistent Processes Leadership commitment partially met VA has implemented a structure for leadership input into the policy process such as at the Veterans Health Administration VHA Chief of Staff level However senior leadership has lacked the stability needed to ensure issued policy meets agency goals Capacity not met Since 2017 VA has issued an updated directive on policy management and put in place procedures to train staff and obtain input from all levels on policy development However VA continues to face challenges in this area because it is reliant on contracts and information technology IT resources which if delayed can impede progress toward meeting goals Action plan partially met Since 2017 VA has further refined its root cause analysis for this area of concern VA relied on these root causes as the foundational drivers for a January 2019 draft of the VHA Plan for Modernization However VA has not used the root cause analysis to develop and prioritize appropriate milestones and metrics in the action plan Additionally VA’s action plan did not include all goals and substantive actions taken For example in its March 2018 action plan VA described its future plans to determine the roles of national and local policy in agency operations However VA’s action plan did not reflect the October 2017 establishment of an inventory of approximately 55 000 local policies which set a baseline for understanding policy burden or explain how it will use that inventory to inform the pilot process for national policy development that is mentioned in the action plan Monitoring not met Since the March 2018 action plan lacked specific metrics and mechanisms for assessing and reporting progress it is not clear how VA is monitoring its progress Demonstrated progress not met Our work continues to indicate VA is not yet able to demonstrate progress in this area Since its 2015 high-risk designation we have made 48 new recommendations in this area of concern 30 of which were made since our 2017 report was issued For example in September 2017 we found that VHA does not have a process to systematically ensure that local policies align with national policies Without such a process VHA may be unable to ensure that its Page 276 GAO-19-157SP High-Risk Series Managing Risks and Improving VA Health Care facilities consistently implement national policies as intended to ensure timely high-quality care for the nation’s veterans As a result we recommended that VHA establish a standard process to periodically monitor that local policies align with national policies VA concurred with this recommendation which remains open What Remains to Be Done We have made 90 recommendations related to this area of concern since 2010 As of December 2018 35 recommendations remain open In addition to implementing those recommendations VA should improve its policies and processes by building capacity and finalizing its action plan Inadequate Oversight and Accountability Since our 2017 High-Risk Report ratings for one criterion improved and four remain unchanged Leadership commitment partially met Since this area of concern’s 2015 designation VA has made organizational changes including establishing the Office of Integrity to standardize and streamline the agency’s oversight of its programs and personnel However since 2017 the lack of stability in the Under Secretary for Health position has hindered its ability to demonstrate sustained commitment to improving this area of concern Capacity not met VA has begun to implement capacity-building initiatives directed at improving oversight and accountability For example VHA’s Office of Internal Audit and Risk Assessment a key component of the department’s oversight and accountability model began conducting audits in 2018 However according to VA’s action plan the department has yet to allocate resources for this office such as sufficient staff to carry out its activities Action plan partially met In 2018 VA conducted an analysis of the root causes contributing to findings of inadequate oversight and accountability an important step in identifying the underlying factors contributing to this area of concern However the resulting action plan lacked key elements including clear metrics to monitor and assess progress Monitoring not met The March 2018 action plan lacked specific metrics and mechanisms for assessing and reporting progress in this area Demonstrated progress not met Our work continues to indicate VA is not demonstrating progress in this area Since its 2015 designation we made 85 new recommendations in this area of concern 50 of which were Page 277 GAO-19-157SP High-Risk Series Managing Risks and Improving VA Health Care made since our 2017 report was issued For example in June 2018 we reported that VHA could not systematically monitor the timeliness of veterans’ access to Veterans Choice Program care because it lacked complete reliable data to do so As a result we recommended that VA take steps to improve its oversight of the future consolidated community care program that will replace the Veterans Choice Program when authority sunsets on June 6 2019 VA concurred with this recommendation which remains open What Remains to Be Done We have made 148 recommendations related to this area of concern since 2010 As of December 2018 59 recommendations remain open In addition to implementing those recommendations VA should demonstrate commitment to oversight and accountability by building capacity and finalizing its action plan Congressional Actions Needed Congress should consider continuing to hold hearings and receive periodic updates from VA through which it can examine and address VA health care challenges and bring increased visibility to VA’s progress in addressing its high-risk designation Since our 2017 High-Risk Report ratings for one criterion regressed one improved and three remain unchanged Information Technology Challenges Leadership commitment not met In January 2019 the Senate confirmed a new VA Chief Information Officer This is the fourth official to lead VA’s IT organization since our 2017 High-Risk Report and the frequent turnover in this position raises concerns about VA’s ability to address the department’s IT challenges Capacity not met In May 2018 VA awarded a contract to acquire the same commercial electronic health record system as the Department of Defense DOD However VA is early in the transition and its actions are ongoing Additionally VA has developed a strategy for decommissioning its legacy IT systems which are tying up funds that could be reallocated for new technology to enable improved veteran care but has made limited progress in implementing this effort Action plan partially met In 2018 VA conducted an analysis to identify the root causes of IT challenges which informed the goals in its action plan However VA’s action plan contained significant information gaps including missing interim milestone dates These information gaps raise Page 278 GAO-19-157SP High-Risk Series Managing Risks and Improving VA Health Care questions about VA’s commitment to addressing IT-related root causes and need to be addressed before we can consider this criterion met Monitoring not met The March 2018 action plan lacked specific metrics and mechanisms for assessing and reporting progress Demonstrating progress not met Our work continues to indicate VA is not yet able to demonstrate progress in this area Since its 2015 high-risk designation we have made 14 new recommendations in this area 12 of which were made since our 2017 report was issued For example in June 2017 to address deficiencies we found related to VA’s pharmacy system we recommended that VA take 6 actions to provide clinicians and pharmacists with improved tools to support pharmacy services to veterans and reduce risks to patient safety including assessing the extent to which the interoperability of VA and DOD’s pharmacy systems impacts transitioning service members VA generally concurred with these recommendations all of which remain open What Remains to be Done We have made 25 recommendations related to this area of concern since 2010 As of December 2018 15 recommendations remain open In addition to implementing those recommendations VA should demonstrate commitment to addressing its IT challenges by stabilizing senior leadership building capacity and finalizing its action plan Since our 2017 High-Risk Report ratings for one criterion improved and four remain unchanged Inadequate Training for VA Staff Leadership commitment not met VA officials have reported progress in establishing a process to develop an enterprise-wide annual training plan to better ensure that VA staff are adequately trained to provide high-quality care to veterans However the actions necessary to complete and implement this training plan are not reflected in VA’s March 2018 action plan for the training area of concern raising questions about the process through which it will be developed The lack of progress in setting clear goals for improving training demonstrates that VA lacks leadership commitment to address our concerns in this area Capacity not met VA has created working groups and task forces— such as the Learning Organization Transformation Subcommittee in the National Leadership Council—with specific responsibilities However VA’s ability to demonstrate capacity is limited because according to VA’s Page 279 GAO-19-157SP High-Risk Series Managing Risks and Improving VA Health Care March 2018 action plan the department relies on external contractor support services to meet training goals and that funding has not been allocated Action plan partially met VA completed a root cause analysis for training deficiencies which informed the goals underlying its action plan resulting in an increased rating However the action plan continues to have deficiencies identified in 2017 For example not all goal descriptions correspond to planned actions and the action plan lacks detail about how and which data will be collected to assess progress Monitoring not met The March 2018 action plan lacked specific metrics and mechanisms for assessing and reporting progress Demonstrated progress not met Our work continues to indicate that VA is not yet able to demonstrate progress in this area Since its 2015 designation we have made 10 new recommendations in this area of concern 2 of which were made since our 2017 report was issued For example in April 2018 we reported that while the department has recommended training for patient advocates—staff members who receive and document feedback from veterans or their representatives—it has not developed an approach to routinely assess their training needs or monitored training completion The failure to conduct these activities increases VA’s risk that staff may not be adequately trained to advocate on behalf of veterans As a result we recommended VHA develop an approach to routinely assess training needs and monitor training completion VA concurred with our recommendations which remain open What Remains to be Done We have made 16 recommendations related to this area of concern since 2010 As of December 2018 3 recommendations remain open In addition to implementing those recommendations VA should improve training by stabilizing senior leadership finalizing its action plan and allocating necessary resources Since our 2017 High-Risk Report ratings for one criterion improved and four remain unchanged Unclear Resource Needs and Allocation Priorities Leadership commitment partially met In December 2017 a VA Chief Financial Officer CFO was confirmed after the department spent over 2 5 years under an interim CFO In addition VA is in the process of establishing a new office to estimate workforce resource requirements Page 280 GAO-19-157SP High-Risk Series Managing Risks and Improving VA Health Care Capacity not met VA has established functions intended to inform cost analyses of major VA initiatives including a new financial management process to replace its outdated financial systems However it is unclear in its action plan the extent to which VA has identified the resources needed to establish and maintain these functions Action plan partially met Since our 2017 High-Risk Report VA conducted a root cause analysis of this area of concern However VA’s action plan lacks metrics for monitoring progress and does not include all of VA’s ongoing actions such as efforts to assess current and future regional demand for veterans’ health care services Monitoring not met Since VA’s action plan lacks specific metrics and mechanisms for assessing and reporting progress it is not clear how VA is monitoring its progress Demonstrating progress not met Our work continues to indicate VA is not yet able to demonstrate progress in this area Since its 2015 designation we have made 16 new recommendations in this area of concern 10 of which were made since our 2017 report For example in May 2017 we reported identifying several limitations with VA’s clinical productivity metrics and statistical models for tracking clinical efficiency that limit VA’s ability to assess whether resources are being used effectively to serve veterans We recommended VA establish an ongoing process to systematically review its medical centers’ plans for addressing low clinical productivity and inefficiency and ensure that the plans are being successfully implemented VA concurred with this recommendation which remains open What Remains to be Done We have made 64 recommendations related to this area of concern since 2010 As of December 2018 13 recommendations remain open In addition to implementing those recommendations VA should improve resource allocation by building capacity identifying and allocating needed staff and funds and finalizing its action plan Related GAO Products VA Health Care Improvements Needed in Suicide Prevention Media Outreach Campaign Oversight and Evaluation GAO-19-66 Washington D C November 15 2018 Veterans Choice Program Improvements Needed to Address AccessRelated Challenges as VA Plans Consolidation of its Community Care Programs GAO-18-281 Washington D C June 4 2018 VA Health Care Actions Needed to Improve Oversight of CommunityBased Outpatient Clinics GAO-18-375 Washington D C April 12 2018 Page 281 GAO-19-157SP High-Risk Series Managing Risks and Improving VA Health Care VA Health Care Improved Guidance and Oversight Needed for the Patient Advocacy Program GAO-18-356 Washington D C April 12 2018 VA Health Care Improved Policies and Oversight Needed for Reviewing and Reporting Providers for Quality and Safety Concerns GAO-18-63 Washington D C November 15 2017 Veterans Health Administration Better Data and Evaluation Could Help Improve Physician Staffing Recruitment and Retention Strategies GAO-18-124 Washington D C October 19 2017 Veterans Health Care Additional Actions Could Further Improve Policy Management GAO-17-748 Washington D C September 22 2017 VA Health Care Improvements Needed in Data and Monitoring of Clinical Productivity and Efficiency GAO-17-480 Washington D C May 24 2017 VA Health Care Actions Needed to Ensure Medical Facility Controlled Substance Inspection Programs Meet Agency Requirements GAO-17-242 Washington D C February 15 2017 Page 282 GAO-19-157SP High-Risk Series Appendix III GAO’s 2019 High-Risk List Appendix III GAO’s 2019 High-Risk List Table 10 GAO’s 2019 High-Risk List Strengthening the Foundation for Efficiency and Effectiveness • Strategic Human Capital Management • Managing Federal Real Property • Funding the Nation’s Surface Transportation Systema • Modernizing the U S Financial Regulatory Systema • Resolving the Federal Role in Housing Financea • USPS Financial Viabilitya • Management of Federal Oil and Gas Resources • Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risksa • Improving the Management of IT Acquisitions and Operations • Improving Federal Management of Programs That Serve Tribes and Their Membersa • 2020 Decennial Censusa • U S Government Environmental Liabilitya Transforming DOD Program Management • DOD Weapon Systems Acquisition • DOD Financial Management • DOD Business Systems Modernization • DOD Support Infrastructure Managementa • DOD Approach to Business Transformation Ensuring Public Safety and Security • Government-wide Personnel Security Clearance Process new a • Ensuring the Cybersecurity of the Nationa • Strengthening Department of Homeland Security Management Functions • Ensuring the Effective Protection of Technologies Critical to U S National Security Interestsa • Improving Federal Oversight of Food Safetya • Protecting Public Health through Enhanced Oversight of Medical Products • Transforming Environmental Protection Agency’s Processes for Assessing and Controlling Toxic Chemicalsa Managing Federal Contracting More Effectively • VA Acquisition Management new • DOE’s Contract Management for the National Nuclear Security Administration and Office of Environmental Managementa • NASA Acquisition Managementa • DOD Contract Management Assessing the Efficiency and Effectiveness of Tax Law Administration • Enforcement of Tax Lawsa Page 283 GAO-19-157SP High-Risk Series Appendix III GAO’s 2019 High-Risk List Modernizing and Safeguarding Insurance and Benefit Programs • Medicare Program Improper Paymentsa • Strengthening Medicaid Program Integritya • Improving and Modernizing Federal Disability Programs • Pension Benefit Guaranty Corporation Insurance Programsa • National Flood Insurance Programa • Managing Risks and Improving VA Health Carea Source GAO GAO-19-157SP a Legislation is likely to be necessary in order to effectively address this area Page 284 GAO-19-157SP High-Risk Series GAO Related Products GAO Related Products The following GAO reports reflect our High-Risk Series reports issued since 2000 For additional GAO related products issued specific to each of the 35 high-risk areas on our updated list see our High-Risk List website http www gao gov highrisk High-Risk Series Progress on Many High-Risk Areas While Substantial Efforts Needed on Others GAO-17-317 Washington D C February 15 2017 High-Risk Series Key Actions to Make Progress Addressing High-Risk Issues GAO-16-480R Washington D C April 25 2016 High-Risk Series An Update GAO-15-290 Washington D C February 11 2015 High-Risk Series An Update GAO-13-283 Washington D C February 14 2013 High-Risk Series An Update GAO-11-278 Washington D C February 16 2011 High-Risk Series An Update GAO-09-271 Washington D C January 22 2009 High-Risk Series An Update GAO-07-310 Washington D C January 31 2007 High-Risk Series An Update GAO-05-207 Washington D C January 1 2005 High-Risk Series An Update GAO-03-119 Washington D C January 1 2003 High-Risk Series An Update GAO-01-263 Washington D C January 1 2001 Determining Performance and Accountability Challenges and High Risks GAO-01-159SP Washington D C November 1 2000 102080 Page 285 GAO-19-157SP High-Risk Series GAO’s Mission The Government Accountability Office the audit evaluation and investigative arm of Congress exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people GAO examines the use of public funds evaluates federal programs and policies and provides analyses recommendations and other assistance to help Congress make informed oversight policy and funding decisions GAO’s commitment to good government is reflected in its core values of accountability integrity and reliability Obtaining Copies of GAO Reports and Testimony The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO’s website https www gao gov Each weekday afternoon GAO posts on its website newly released reports testimony and correspondence To have GAO e-mail you a list of newly posted products go to https www gao gov and select “E-mail Updates ” Order by Phone The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white Pricing and ordering information is posted on GAO’s website https www gao gov ordering htm Place orders by calling 202 512-6000 toll free 866 801-7077 or TDD 202 512-2537 Orders may be paid for using American Express Discover Card MasterCard Visa check or money order Call for additional information Connect with GAO Connect with GAO on Facebook Flickr Twitter and YouTube Subscribe to our RSS Feeds or E-mail Updates Listen to our Podcasts Visit GAO on the web at https www gao gov To Report Fraud Waste and Abuse in Federal Programs Contact FraudNet Website https www gao gov fraudnet fraudnet htm Automated answering system 800 424-5454 or 202 512-7700 Congressional Relations Orice Williams Brown Managing Director WilliamsO@gao gov 202 512-4400 U S Government Accountability Office 441 G Street NW Room 7125 Washington DC 20548 Public Affairs Chuck Young Managing Director youngc1@gao gov 202 512-4800 U S Government Accountability Office 441 G Street NW Room 7149 Washington DC 20548 Strategic Planning and External Liaison James-Christian Blockwood Managing Director spel@gao gov 202 512-4707 U S Government Accountability Office 441 G Street NW Room 7814 Washington DC 20548 Please Print on Recycled Paper