HIGH-RISK SERIES Efforts Made to Achieve Progress Need to Be Maintained and Expanded to Fully Address All Areas

Appendix I: What Is the History of the High-Risk Program?

Bookmark:

In 1990, we began a program to report on government operations that we identified as “high risk.” Since then, generally coinciding with the start of each new Congress, we have reported on the status of progress addressing high-risk areas and have updated the High-Risk List. Our last high-risk update was in March 2021. That update identified 36 high-risk areas. In January 2022 and June 2022, we added two high-risk areas—HHS Leadership and Coordination of Public Health Emergencies, and Unemployment Insurance System. This year, we added one high-risk area—Strengthening Management of the Federal Prison System—and removed two which we will continue to monitor—the 2020 Decennial Census and Pension Benefit Guaranty Corporation Insurance Programs. This 2023 update identifies 37 high-risk areas.

Overall, this program has served to identify and help resolve serious weaknesses in areas that involve substantial resources and provide critical services to the public. Since our program began, the federal government has taken high-risk problems seriously and has made long-needed progress toward correcting them. In a number of cases, progress has been sufficient for us to remove the high-risk designation. A summary of changes to our High-Risk List over the past 31 years is shown in table 5.

How Can Agencies Use the Criteria to Make Progress on High-Risk Issues?

The five high-risk criteria form a road map for efforts to improve and ultimately address high-risk issues. Addressing some of the criteria leads to progress, while satisfying all of the criteria is central to removal from the list.

In March 2022, we reported on key practices for addressing the five high-risk criteria to facilitate progress on high-risk areas. See figure 6 for key practices that can help agencies demonstrate leadership commitment and sustain continuity for high-risk efforts.

What Is the History of Programs Removed from the High-Risk List?

For a summary describing actions taken that resulted in removal of high-risk areas from 1995 to 2021, please see Appendix II of High-Risk Series: Key Practices to Successfully Address HIgh-Risk Areas and Remove Them from the List.[15]

When Were Areas Added to the High-Risk List?

Appendix II: Overview for Each High-Risk Area

Bookmark:

2020 Decennial Census

Bookmark:

Why Area Was High Risk

Leadership commitment: increased to met. During the COVID-19 pandemic, the Bureau relied on a governance group to oversee several teams studying the effects on census data quality of the Bureau’s initial COVID-19 response. The Bureau plans to issue a thematic assessment report based on this governance group’s efforts in 2023. In October 2022, the Bureau launched an effort, headed by agency leaders, to transform and modernize operations to address challenges such as declining response rates. The Bureau’s executive Operating Committee members serve as champions on individual tracks of the transformation program.

Capacity: increased to met. The Bureau improved its capacity to address risks by establishing a team to combat misinformation and disinformation threats to the integrity of the 2020 Census. The team used specialized tools to monitor traditional media and social media and responded accordingly. The Bureau also leveraged the knowledge and skills of external parties during the 2020 Census. For example, the Bureau worked with a group of independent scientific consultants to assess its plans, processes, procedures, and metrics for 2020 Census data quality. The consultants also helped develop a strategy for sharing indicators of the quality of census data. In addition, the Bureau worked with the Department of Homeland Security (DHS) to protect its systems and data for the 2020 Census. DHS provided threat intelligence, vulnerability assessments, and recommendations to the Bureau to strengthen its cybersecurity efforts.

Action plan: increased to met. The Bureau has developed action plans in response to our recommendations. Moreover, it is developing a plan to improve coordination between its field office staff and the Partnership Program. This enlists community organizations to encourage census participation. The plan is due by September 2024 and is intended to address root causes of a long-standing recommendation to create mechanisms for improved coordination. The Bureau has also already begun inviting public comment on ways to improve outreach and self-response methods for the 2030 Census.

Monitoring: increased to met. The Bureau has monitored our open recommendations, scheduling regular follow-up meetings on actions taken. Bureau officials met regularly with departmental leadership to discuss actions taken to close recommendations. The Bureau provided prioritized agendas of the open recommendations, ensuring attention to our priority recommendations. In August 2019, the Bureau implemented a system to track and report variances between actual and expected cost elements. Tracking these variances helped management measure progress against planned outcomes. It will also help provide a basis for its cost estimation for the 2030 Census.

Demonstrated progress: increased to met. The Bureau curbed the past decades’ trend of steadily increasing census cost while implementing the census during a pandemic. The Bureau has also acted on nearly all of our 44 recommendations since 2017. It has made enough progress to close 25 of them. In August 2019, the Bureau provided an update to the 2020 Census cost estimate, which we found to be sufficiently reliable. In the spring of 2022, the Bureau began piloting new procedures for aligning costs of exploring its innovations for 2030 within its overall cost framework. It took significant steps to ensure that corrective actions for high-risk cybersecurity weaknesses were implemented within prescribed time frames. This increased the Bureau’s ability to address future cybersecurity weaknesses.

Monitoring 2030 Decennial Census for Emerging Risks

What Needs to Be Done to Manage Risks

In a report in February 2022, we noted the importance of the Bureau

• prioritizing IT decisions early in this decade to mitigate the cost and schedule issues experienced by the 2020 Census; and
• continuing to manage privacy and cybersecurity risks.

We recommended the Bureau should

• develop a plan to improve resiliency of its 2030 Census research and testing in response to Bureau-identified budget uncertainty. This would mitigate delays or cancellations of key activity.

We also recommended the Bureau should research and test how innovations, enhancements, or other design changes affect methodologies and time required for data collection as well as postdata collection steps.

Finally, in a report on leading practices for transformation, we found that when implementing organizational change, agency executive committee members should communicate with their respective parts of the organization to facilitate a shift toward a more holistic and less parochial and change-resistant culture. This will be important for the Bureau as it continues work on its multifaceted enterprise transformation effort.

Benefits

• In response to our findings about the reliability of the census cost estimate, the Bureau made numerous improvements in its cost estimation. In August 2019, we found the updated cost estimate was reliable;
• In 2018, we examined challenges the Bureau faced in improving its enumeration of the hard-to-count for the 2020 Census. In response to our questions about coordinating these efforts, the Bureau developed its first comprehensive look at its hard-to-count goal for the decennial. The Bureau then included it within its December 2018 Operational Plan for the 2020 Census. This plan increased visibility of the Bureau’s hard-to-count goal and helped integrate efforts across the decennial plan to reach hard–to-count populations; and
• In 2019, we found that the Bureau did not have mitigation and contingency plans for all risks that required them. In addition, the Bureau did not consistently include key information needed to manage the risks. If not properly managed, those risks, such as for cybersecurity incidents or for operations and system integration, could have affected the cost and quality of the census. In response, in March and July 2020, the Bureau updated its decennial risk management plans to include this information.

Contact Information

For additional information about this high-risk area, contact Yvonne D. Jones at (202) 512-6806 or [email protected].

Pension Benefit Guaranty Corporation (PBGC) Insurance Programs

Bookmark:

Why Area Was High Risk

Congress Took Action to Address Risks to PBGC’s Multiemployer Insurance Program

The Financial Condition of the Single-Employer Insurance Program Has Improved Gradually

PBGC Insurance Programs Has Been Removed from the High-Risk List, but Will Still Be Monitored

Multiemployer Program

Single-Employer Program

While PBGC projects the single-employer program to maintain a surplus through at least 2031, it will continue to face potentially substantial financial risks. For example, as we noted in 2021, the single-employer program is exposed to claims from underfunded plans sponsored by companies with credit ratings below investment grade. PBGC’s fiscal year 2022 financial report estimates this exposure at $52 billion. While the single-employer program has not experienced many large underfunded plan terminations recently, PBGC’s experience shows that the single-employer program’s position can change quickly and precipitously. For example, the spate of plan terminations in the airline and steel industries from 2001 through 2006 resulted in the program incurring more than $20 billion of net claims.

PBGC-wide Issues

We have previously recommended that PBGC’s board—composed of the Secretaries of Labor, the Treasury, and Commerce—be expanded to broaden its expertise in areas such as strategic risk assessment and management, and to provide more stable leadership. Further, the board’s ability to provide stable leadership is limited by the turnover of cabinet officials.

Benefits

• Legislation was enacted that included various changes consistent with our recommendations that raised the single-employer premiums that sponsors pay to PBGC and resulted in financial savings.
• PBGC took actions consistent with our recommendations to improve service delivery, for example through increased transparency of plan statements given to participants and providing key appeals information to participants.

Contact Information

For additional information about this high-risk area, contact Tranchau (Kris) T. Nguyen at (202) 512-7215 or [email protected].

Strategic Human Capital Management

Bookmark:

Why Area Is High-Risk

Mission-critical skills gaps specific to federal agencies and across the federal workforce pose a high risk to the nation. They impede the government from cost effectively serving the public and achieving desired results. This area was added to the High-Risk List in 2001. Agencies often experience skills gaps because of a shortfall in a talent management activity, such as workforce planning or training.

Government-wide skills gaps have been identified in fields such as human resources, science, technology, engineering, mathematics, cybersecurity, and acquisitions. The Office of Personnel Management is responsible for assisting agencies in addressing skills gaps within their workforces.

Leadership commitment: increased to met. OPM filled and the Senate confirmed leadership for the first time in 5 years. Since our last high-risk update in 2021, OPM has committed to and begun leading multiple efforts to address skills gaps across the federal government. In June 2021, the Senate confirmed the current OPM Director. This affords the high-level attention needed to help address skills gaps. Additionally, in July 2021, OPM resumed stewardship of the Chief Human Capital Officers Council (Council) to help connect OPM’s government-wide human capital policy efforts with agencies’ human capital leaders. For example, to assist the Council in setting its strategic objectives, OPM established an executive steering committee to advise the Council on identifying its priorities. These priorities include building capacity among the federal human resources workforce.

Furthermore, the President’s Management Agenda has placed strengthening and empowering the federal workforce among its top three priorities. The OPM Director leads efforts to address skills gaps. One way of doing this is attracting and hiring qualified applicants for federal employment who reflect the diversity of the country.

Capacity: partially met. OPM has provided agencies with guidance to develop assessment strategies to evaluate federal job applicants based on needed competencies. However, federal human capital managers have stated they experience challenges in their workforce planning efforts because their human resource staff do not have all the skills needed to conduct workforce planning. To help agencies address this challenge, OPM conducted a government-wide hiring effort to fill human resource positions. It also developed a training program for new staff.

With regard to OPM’s own workforce capacity, a recent third-party assessment of its workforce found skills gaps in areas such as project management, organizational performance, leadership development, and data analysis. The assessment concluded these skills gaps may limit OPM’s ability to successfully meet mission requirements and help other agencies close their skills gaps.

Action plan: partially met. OPM’s Fiscal Year 2022-2026 Strategic Plan includes many goals, measures, and milestones aimed at addressing skills gaps across the government in areas such as recruiting, hiring, retention, and training. However, OPM does not have a plan to address skills gaps within its own workforce. OPM’s Human Capital Operating Plan does not explicitly describe strategies for closing the skills gaps of its own workforce, as required in OPM’s guidance to other federal agencies. In February 2023, we recommended that OPM establish an action plan that addresses skills gaps identified in the workforce assessment—either as an update to its Human Capital Operating Plan or a separate effort.

Similarly, other agencies, such as the Food and Drug Administration (FDA) and the Department of the Interior’s Bureau of Land Management (BLM), have not completed plans to address their own workforce needs. In January 2022, we recommended that FDA develop an agency-wide strategic workforce plan with elements for monitoring and evaluating its progress toward its human capital goals. Developing a plan would help ensure its workforce includes the 14 mission-critical occupations with the scientific and technical skills needed to ensure the efficacy and safety of medical products. FDA concurred with our recommendation and reported that it is developing a baseline version of an agency-wide strategic workforce plan. Legislation enacted in December 2022 requires the agency to issue such a plan by the end of fiscal year 2023, and at least every 4 years thereafter. FDA concurred with our recommendation. It reported that it anticipates having a baseline version of an agency-wide strategic workforce plan by the end of fiscal year 2024.

We also recommended in November 2021 that BLM develop an agency-wide strategic workforce plan to address skills gaps partially resulting from the recent relocation of its headquarters from Washington, D.C., to Colorado. Interior concurred with our recommendation. In February 2022, BLM began exploring the use of tools to track permanent employee position vacancies within each of its state offices and in headquarters.

Monitoring: partially met. Although OPM’s strategic plan includes measures and milestones to monitor the closing of government-wide skills gaps, until it develops an action plan for its own workforce as we have recommended, OPM will lack important information needed to close its own skills gaps. OPM also must manage the risks that skills gaps pose to its mission, such as making trade-off decisions in light of resource limitations. Until it documents the risks to its ability to achieve its strategic objectives and identifies strategies to address these risks, OPM may be unable to make fully informed decisions regarding its own workforce. It also may be unable to effectively help other agencies close their skills gaps.

Additionally, in January 2021, we made several recommendations to the Department of Homeland Security’s (DHS) Chief Human Capital Officer to better monitor DHS components’ plans and efforts to improve employee engagement. DHS has consistently ranked the lowest in terms of employee engagement among similarly sized federal agencies. The President’s Management Agenda includes strategies to address skills gaps such as improving employee engagement as measured by the Federal Employee Viewpoint Survey. However, DHS is in the early stages of implementing new processes to monitor employee engagement and use resulting information to adjust, reprioritize, and identify new actions.

Demonstrated progress: not met. In addition to steps taken by OPM, individual agencies need to demonstrate improvement in agency capacity. In October 2022, OPM reported that, in January 2021, it continued its efforts to address government-wide skills gaps by (1) training agencies on conducting root cause analysis to identify skills gaps, (2) developing action plans, and (3) identifying metrics and targets. The report also stated that auditors are no longer a government-wide skills gap, in part because OPM recommended that, based on the progress that has been made, auditors and economists should be removed from the government-wide mission-critical occupations list. However, acquisition, human resource, and cybersecurity occupations are still considered government-wide skills gaps needing attention.

Our prior work indicates that progress to close skills gaps will require demonstrated improvements in agencies’ capacity to perform workforce planning, foster employee engagement, train staff effectively, and recruit and retain the appropriate number of staff with the necessary skills. As outlined in table 8, we found that agencies face challenges in these areas of human capital management. This has contributed to the designation of 22 of the 36 other areas in this update as high risk.

What Remains to Be Done

• In our May 2020 report examining drug education and treatment programs at the Bureau of Prisons (BOP), we recommended and the Department of Justice agreed that BOP develop and document methods for determining the number of additional staff needed to support the expansion of its medication-assisted drug treatment program—a key program related to inmate rehabilitation.
• Senior officials with the Department of Energy (DOE) have raised concerns that their federal acquisition workforce does not have enough staff with the right skills to manage risks associated with contracting and acquisition processes. In November 2021, we recommended and DOE agreed that the agency should conduct a thorough analysis to identify skills gaps within its acquisition workforce. It also must develop strategies to close these gaps.
• In February 2023, we recommended that OPM establish an action plan that addresses skills gaps identified in its workforce assessment, either as an update to its Human Capital Operating Plan or a separate effort. OPM agreed with our recommendation. It reported that the agency plans to develop and implement an action plan to address OPM’s specific skills and competency gaps.

Benefits

In May 2017, we recommended that the National Weather Service (NWS) develop a strategic human capital plan that includes an evaluation of its actions to reduce its hiring backlog and sustain a highly skilled workforce. In response to our recommendation, NWS developed a plan in January 2020. It includes strategies to streamline its hiring processes and metrics to evaluate whether these strategies are creating hiring efficiencies. NWS senior leadership reviews these metrics every pay period to assess whether the strategies are improving hiring efficiency, and achieving NWS’s goal to sustain the workforce capacity and skills needed to meet the agency’s evolving mission needs.

In October 2019, we recommended that the Veterans Health Administration (VHA) develop a succession planning process that focused on current and future mission requirements rather than on filling existing vacancies with people having the same occupational skills. In response to our recommendation, VHA issued a new workforce and succession plan in July 2022. It includes, among other strategies, a process for identifying a talent pool to fill potential medical center director vacancies. VHA’s succession plan and related guidance now incorporate monitoring and evaluations into VHA’s succession planning process. This, in turn, will help VHA assess the effectiveness of its planning and identify emerging challenges.

To assist in addressing workforce skills gaps, the Federal Cybersecurity Workforce Assessment Act of 2015 requires agencies, including OPM, to assign work role codes to filled and vacant positions that perform IT, cybersecurity, or cyber-related functions. In March 2019, in response to our recommendation, OPM reviewed and assigned appropriate cybersecurity codes to its IT management positions. This will ensure that the agency will have more reliable information to improve workforce planning.

Contact Information

For additional information about this high-risk area, contact Dawn G. Locke at (202) 512-6806 or [email protected].

Managing Federal Real Property

Bookmark:

Why Area Is High Risk

As we reported in October 2022, the value of deferred maintenance and repairs by civilian federal agencies increased 50 percent from fiscal year 2017 through fiscal year 2021 to $76 billion. We plan to monitor the increase in deferred maintenance through future work to determine the potential causes. We will also determine if it should be included as a part of the managing federal real property high-risk area in future high-risk updates.

Overall ratings for all five criteria remain unchanged since 2021. However, for one of the three segments that comprise this high-risk area—Excess and Underutilized Property—ratings decreased to not met for the capacity and demonstrated progress criteria. The following sections present more detailed information on the three segments summarized in the overall rating.

Excess and Underutilized Property

Capacity: decreased to not met. The Federal Assets Sale and Transfer Act of 2016 (FASTA) established a new, temporary process to increase the federal government’s capacity to, among other things, identify and dispose of unneeded assets. However, GSA and other stakeholders faced setbacks implementing the FASTA process, including delays in selling properties approved for disposal. In October 2022, we found that GSA did not have an approach to leverage knowledge gained from these setbacks. We recommended that GSA collect, share, and apply lessons learned to improve the 2024 round and future disposal efforts.

Action plan: met. OMB’s July 2022 memorandum provides an action plan for agencies to right size their assets based on workplace usage assessments.

Monitoring: partially met. OMB and GSA continue to monitor progress in meeting space-reduction targets using the government-wide real property database called the Federal Real Property Profile. However, the database is not yet sufficiently reliable to produce accurate results.

In addition, we recently concluded that, as agencies begin to assess their federal space needs after the pandemic, GSA is taking steps to make cost-effective decisions through the collection of data on how often employees report to federal offices. However, not all federal agencies have access to or are aware of information on the benefits and costs such data provide. As we recommended in September 2022, GSA should develop a plan to broadly share the information from its space utilization data collection efforts with federal agencies.

Demonstrated progress: decreased to not met. FASTA created the independent Public Buildings Reform Board (Board) to help support a new, temporary three-round process for reducing the federal government’s inventory of federal civilian real property. As we reported in 2019, the Board was sworn in and worked with OMB, GSA, and other federal agencies to identify and recommend the first round of high-value properties for disposal. However, as we reported in October 2022, GSA and other stakeholders have faced setbacks implementing the FASTA process. These setbacks include delays in selling the high-value properties and the Board did not have an executive director and the Board lacked the quorum required to make certain decisions at that time. As of November 2022, the Board reached the quorum required to conduct business.

The 2019 round required the Board to identify at least five “high-value properties” with a combined estimated total fair-market value between $500 million and $750 million for potential sales. As of October 2022, the 2019 round resulted in the sale of 10 properties for a total of $194 million. In addition, the Board submitted its initial list of recommendations for the next round in 2021. However, OMB rejected the submission because it lacked sufficient financial planning, among other issues. The round was later terminated.

Data Reliability

Action plan: met. In March 2020, the Federal Real Property Council developed and later implemented its corrective action plan to improve the location data on federal assets in response to our February 2020 report. In addition, GSA added goals to its current strategic plan to address data anomalies in the Federal Real Property Profile database.

DOD is also taking steps to improve its real property data. In February 2020, DOD shared its strategy to improve the coordination of corrective action plans to remediate discrepancies in its real property data system. While DOD’s estimated completion date for these actions was September 2022, it yet to demonstrate that these actions have been completed.

Monitoring: partially met. As part of the strategic plan to improve the accuracy of government-wide real property data, GSA set a goal to reach 75 percent accuracy for its fiscal year 2022 data set. GSA plans to release the data set later in 2023. Further, GSA found that data anomalies decreased from 15 percent in 2019 to 12 percent in 2020. However, in February 2020, we found that 67 percent of building addresses in the Federal Real Property Profile database were incorrectly formatted or incomplete. This made locating specific buildings difficult.

Demonstrated progress: not met. GSA must rely on federal agencies to submit accurate data to the Federal Real Property Profile database. However, GSA’s Validation and Verification process has ineffectively addressed key errors in the data (see figure 10). For example, GSA published the fiscal year 2021 data. However, agency officials said that the data still contain errors in geolocation information like the ones we identified in 2020. As noted earlier, GSA officials said that they expect the improvements they made to materialize in the fiscal year 2022 data that GSA will release in 2023.

Facility Security

Capacity: partially met. The Federal Aviation Administration and the Department of Veterans Affairs have taken some steps to implement our October 2017 and January 2018 recommendations to assess their facility security policies, such as drafting an updated facility security policy. However, they both need to finalize their assessments of these policies consistent with the Interagency Security Committee standards.

Action plan: met. As we reported, the relevant agencies finalized a memorandum of agreement clarifying their respective roles and responsibilities for courthouse security. In addition, FPS and GSA finalized a joint security strategy in 2020.

Monitoring: partially met. In 2019, FPS developed two systems to oversee its contract guard workforce—one that tracks training and one that manages the contract guard workforce. However, FPS has not fully implemented the system that manages the contract guard workforce. Also, the two systems are not yet fully interoperable.

In addition, in FPS’s fiscal year 2022-2026 strategic plan, FPS did not identify performance measures for its strategic objectives of modernizing the FPS infrastructure and developing the FPS workforce, such as training for FPS officials. We recommended that FPS should fully develop performance measures for each strategic objective in its strategic plan. FPS should also and ensure that each of these measures has a related performance target.

Demonstrated progress: partially met. As we reported in 2021, FPS has developed its guard management and guard training system. However, FPS must demonstrate the effectiveness of its guard management system. It also must ensure that the two systems are integrated to help FPS obtain information to assess its guard’s capability to address security risks across its portfolio.

For some federal facilities, such as the U.S. Capitol, responsibility for security is primarily handled by organizations other than FPS. Following the attack on the U.S. Capitol on January 6, 2021, we recommended in February 2022 that the Capitol Police and the Capitol Police Board—which oversees the Capitol Police—finalize and document procedures for obtaining outside assistance in an emergency, address security risks, and consider security recommendations.

What Remains to Be Done

• applying lessons from the FASTA process to improve the property disposal process; and
• sharing utilization data to improve agencies’ ability to assess how much space they need.

GSA should help federal agencies improve their data reliability and DOD should improve its data reliability by

• coordinating with agencies to ensure street address information in the public database is accurate; and
• coordinating with military services on corrective action plans to remediate discrepancies in its real property data system.

FPS, the United States Capitol Police, and the Capitol Police Board should ensure the security of federal facilities by

• ensuring FPS’s strategic plan includes performance measures for each strategic objective in its strategic plan and that each of these measures has a related performance target.
• finalizing and documenting the procedures for the United States Capitol Police and the Capitol Police Board for obtaining outside assistance in an emergency, addressing security risks, and considering security recommendations.

Benefits

• Decreased lease costs led to a narrowing in scope of this high-risk area in 2011. In 2021, we found that the Costly Leasing segment is no longer a high-risk concern. Benefits include $3.6 billion in savings and an estimated additional savings of $4.7 billion in lease cost avoidances through 2023.
• As we recommended in June 2012, OMB, in collaboration with the Federal Real Property Council, issued the 2015-2020 National Strategy for the Efficient Use of Real Property.
• As a result of the memorandum of agreement between FPS, GSA, the judiciary, and U.S. Marshals Service, FPS officials said that FPS has formed an Interagency Judicial Security Committee to establish a shared resource management strategy. FPS has also developed shared business processes and policies related to faculty security, among other initiatives.

Contact Information

For additional information about this high-risk area, contact Catina Latham at (202) 512-2834 or [email protected].

Funding the Nation’s Surface Transportation System

Bookmark:

Why Area Is High Risk

User-based funding alternatives. In January 2022, we reported on a Federal Highway Administration program that provided grants to states to pilot and research user-based revenue mechanisms to support the Highway Trust Fund as alternatives to federal motor fuel taxes. Most participating states used program funds to explore mileage fee systems, which charge drivers a fee based on their miles driven.

We found that the Federal Highway Administration has not established criteria to identify whether state pilot approaches could be expanded or applied nationwide to collect revenues to support the long-term solvency of the Highway Trust Fund. Such criteria could include examining whether the use of technologies to track and report mileage deployed in various pilot projects would be feasible or cost effective in a national system. Doing so would better position the Federal Highway Administration to provide information to Congress on the potential of a national mileage fee system to help maintain the long-term solvency of the Highway Trust Fund. DOT agreed with this recommendation. The agency plans to work with subject matter experts to develop these criteria in 2023.

Discretionary grants. IIJA authorized several new surface transportation discretionary grant programs and provided increased funding for many existing programs. In April 2022, we reported on the Infrastructure for Rebuilding America discretionary grant program. We also identified concerns about DOT’s grant review and award process. We found that DOT did not consistently detect or correct inaccurate grant application evaluations. This increased the risk of an ineligible project being awarded funds. As a result, DOT lacks assurance that it is awarding projects that will best address national priorities and achieve the department’s goals. DOT agreed with our recommendation. However, as of February 2023, DOT had not implemented it.

In our reviews over the last decade, we have found numerous challenges with DOT’s management of its discretionary grant programs. In particular, we have found DOT’s approach to evaluating and awarding its discretionary grants has been neither consistent nor transparent. In addition, its decision-making rationale has sometimes been unclear. While discretionary grant programs can help target federal transportation spending, for this to be achieved, DOT should enhance the clarity and transparency of its evaluation process and rationale for making awards.

Congressional Actions Needed

Passage by Congress of a long-term, sustainable plan for funding surface transportation—as we recommended in 2008—is the pivotal action that will determine whether this issue remains or is removed from the High-Risk List.

What Remains to Be Done

• Developing and applying criteria to assess whether state mileage fee pilot projects could be expanded or applied nationwide; and
• Developing department-wide guidance for its discretionary grant programs to ensure that awards for surface transportation projects are made consistently and transparently. In July 2022, we identified this recommendation as a priority for DOT implementation. However, as of February 2023, DOT had not implemented it.

Benefits

• The Moving Ahead for Progress in the 21st Century Act included provisions to move toward a more performance-based surface transportation program by establishing national performance goals in areas such as infrastructure condition, safety, and system performance. Prior to these actions, our work highlighted that, historically, most federal surface transportation programs inadequately tie grant awards to federal goals and performance. We recommended that Congress consider modifying federal surface transportation programs to do so.
• In 2018, DOT developed a plan that articulated the agency’s goals for the transition to a performance-based approach for funding surface transportation, as well as timelines and specific activities for achieving each goal. Our work had found that DOT needed to develop an implementation plan for the agency’s transition to a performance-based approach. We recommended that it do so.

Contact Information

For additional information about this high-risk area, contact Elizabeth Repko at (202) 512-2834 or [email protected].

Modernizing the U.S. Financial Regulatory System

Bookmark:

Why Area Is High Risk

Leadership commitment: partially met. Since policymakers enacted the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) in July 2010, financial regulators have finalized rules to implement its rulemaking requirements. While the act included provisions to better position the financial regulatory system to address financial stability risks, it generally left the financial regulatory structure unchanged. In February 2016, we reported that remaining fragmentation and overlap in the structure have created inefficiencies in regulatory processes and inconsistencies in how regulators oversee similar types of institutions. For example, securities and derivatives markets have become increasingly interconnected. In addition, regulation of these markets by separate agencies has been duplicative and inconsistent at times.

In 2023, we plan to publish a report on the regulation of blockchain-based financial products and services. This report will examine gaps in the regulatory authority of federal financial regulators and coordination across the regulators in regulating these products and services.

Capacity: partially met. The Dodd-Frank Act created the Financial Stability Oversight Council (FSOC). The act also included other provisions to increase the financial regulatory system’s capacity to identify and address risks to the nation’s financial stability. Most of these reforms have been implemented. The May 2018 Economic Growth, Regulatory Relief, and Consumer Protection Act also modified certain provisions of the Dodd-Frank Act, including by relieving small banks from certain regulatory requirements.

In February 2016, we reported that FSOC’s legal authorities may not allow it to respond effectively to certain systemic risks, such as risks from financial activities spanning multiple entities. Specifically, FSOC can recommend but not compel regulators to act with respect to systemic risk arising from such activities. In 2023, we plan to publish the results of a review of FSOC’s use of its authorities and governance structure to address threats to financial stability.

Action plan: partially met. FSOC’s annual report has served as the council’s key accountability document. Each report discusses the progress regulators have made in implementing reforms, identifies newly emerging threats, and includes recommendations to address them.

In December 2020, we reiterated our concern that FSOC’s authorities are limited with respect to risks that arise from financial activities spanning multiple entities. In addition, we reported that FSOC does not conduct scenario-based exercises where participants discuss roles and responses to hypothetical emergency scenarios. As a result, FSOC is missing an opportunity to enhance its preparedness and response to financial stability risks.

FSOC’s annual reports have highlighted the need for regulatory actions to mitigate the vulnerability of certain money market mutual funds to large and unexpected redemptions by investors (called runs). During the 2007-2009 financial crisis, such runs led to severe market disruptions. The Securities and Exchange Commission (SEC) implemented reforms in 2010 and 2014 intended to help address this vulnerability. However, many money market mutual funds experienced runs around the onset of the COVID-19 pandemic. In February 2023, we reported that SEC proposed additional reforms intended to further reduce the risk of runs. Money market mutual funds, industry associations, and other stakeholders had mixed views on whether the proposed reforms would reduce the risk of runs.

Monitoring: partially met. FSOC monitors and reports on indicators of financial stability and potential emerging threats to financial stability. In addition, in 2018, the Federal Reserve began publishing an annual financial stability report that includes its assessment of the U.S. financial system. The Federal Reserve’s stress test programs have also played a key role in supervisory efforts to evaluate and maintain financial stability.

In November 2016, we recommended that the Federal Reserve enhance the effectiveness of these stress test programs by further assessing—and adjusting as needed—the severity of the stress scenarios and other aspects of the test design. Since then, the Federal Reserve has taken steps to enhance its stress testing programs. However, continued actions are needed to improve communication and management of model risk (e.g., accounting for sensitivity of stress test model results). These actions include having a process to communicate information about sources of uncertainty in stress test results concerning financial companies. In September 2020, we also highlighted opportunities for the Department of the Treasury to improve the tracking and prioritization of cyber risk mitigation efforts in the financial services sector according to goals established by the sector. Treasury generally agreed with the recommendations, which remain open.

Demonstrated progress: partially met. The agencies and oversight bodies created under the Dodd-Frank Act have taken actions toward carrying out their missions and coordinating efforts. In March 2021, we noted that Treasury’s Office of Financial Research and the Federal Reserve had taken steps to reduce potential duplication and ensure comprehensive efforts to monitor systemic risks.

As we reported in March 2021, financial regulators can take additional steps to strengthen oversight of systemic risk and improve the efficiency and effectiveness of the financial regulatory system. For example, the Federal Reserve should continue to enhance its stress test programs. In addition, Treasury should improve tracking of its cyber risk mitigation efforts in the financial services sector.

What Remains to Be Done

• The Federal Reserve should design and implement processes to (1) communicate information about the range and sources of uncertainty surrounding the post-stress capital ratio estimates, and (2) articulate tolerance levels for key risks identified through sensitivity testing as well as the degree of uncertainty in the projected capital ratios.
• Treasury should track and prioritize the financial services sector’s cyber risk mitigation efforts and update the sector’s cyber risk mitigation plan with metrics and other information.
• We reported concerns in 2020 that FSOC does not conduct scenario-based exercises where participants discuss roles and responses to hypothetical emergency scenarios. We recommended that Treasury, in consultation with FSOC members, should incorporate regular scenario-based exercises into its risk-assessment activities to evaluate individual FSOC member and collective capabilities for responding to crises.

Congressional Actions Needed

Weaknesses in the U.S. financial regulatory structure can be further addressed through additional congressional attention and leadership. We recommended the following actions in February 2016 (GAO-16-175):

Congress should consider whether legislative changes are necessary to align FSOC’s authorities with its mission to respond to systematic risks. Congress could do so by changing FSOC’s mission, its authorities, or both, or the missions and authorities of one or more of the FSOC member agencies.

Congress should consider whether additional changes to the financial regulatory structure are needed to reduce or better manage fragmentation and overlap in the oversight of financial institutions and activities to improve (1) the efficiency and effectiveness of oversight; (2) the consistency of consumer and investor protections; and (3) the consistency of financial oversight for similar institutions, products, risks, and services.

Benefits

There are 69 benefits to the federal government due to progress in this high-risk area including improvements to:

• collaboration among FSOC and its member agencies on identifying and addressing threats to financial stability;
• the implementation of key financial stability reforms under the Dodd-Frank Act, such as stress testing for large financial institutions; and
• financial regulators’ efforts to assess the effectiveness of Dodd-Frank Act reforms including steps taken to strengthen their regulatory analyses.

Contact Information

For additional information about this high-risk area, contact Michael Clements at (202) 512-8678 or [email protected].

Resolving the Federal Role in Housing Finance

Bookmark:

Why Area Is High Risk

Leadership commitment: partially met. Housing and regulatory agencies continued to demonstrate leadership commitment. The 2019 housing finance reform plans issued by Treasury and the Department of Housing and Urban Development (HUD) identified recommendations aligning with our housing finance reform framework. They included steps to ensure Fannie Mae, Freddie Mac, and FHA’s mortgage insurance programs are financially sound. In January 2022, we reported that some steps were implemented. Additionally, the current administration has stated its interest in helping shape future reforms.

In 2022, FHFA introduced new public disclosure and reporting requirements for the enterprises. These include public quarterly quantitative and annual qualitative disclosures for areas such as risk management and capital requirements and buffers. Also, FHFA is requiring the enterprises to submit their first capital plans by May 20, 2023, including an assessment of expected sources and use of capital over the planning horizon.

Statutory changes are still needed to resolve the federal role in housing finance. While Congress held hearings on reform, it has yet to enact legislation establishing objectives for the future or a plan to end the enterprises’ conservatorship.

Capacity: partially met. The enterprises have generally operated profitably since 2012. FHFA has directed them to transfer significant credit risk to the private market. The enterprises also increased their combined capital reserves to $97 billion. However, this figure remains well below what they may need to be sufficiently capitalized. Similarly, each enterprise’s risk-based capital ratio levels remain below required levels established in the enterprise regulatory capital framework for when they exit conservatorship (or a later date established for compliance with these levels).

FHA’s Mutual Mortgage Insurance Fund has met its statutory minimum capital requirement annually since fiscal year 2014. However, the requirement is not based on a specified risk threshold. We have previously recommended that Congress consider specifying the economic conditions the fund would be expected to withstand without substantial risk of drawing on supplemental funds, and requiring FHA to comply with a capital ratio consistent with these conditions.

In 2022, Ginnie Mae implemented our recommendation to evaluate whether its guaranty fee for single-family mortgage-backed securities provides sufficient reserves to cover potential losses. In 2023, Ginnie Mae implemented our recommendations to (1) analyze the costs of using contractors for its operations and develop a plan to determine the optimal mix of contractor or in-house staff, (2) assess contract administration options to determine the most efficient and effective use of funds, and (3) assess the costs and benefits of options to revise its compensation structure. Continued growth in Ginnie Mae’s guaranteed portfolio—$150 billion from September 2021 to December 2022—and the ongoing role of nonbank securities issuers have increased its potential loss exposure.

Action plan: partially met. Federal agencies have taken steps to strengthen the mortgage finance system. In 2020, FHFA finalized a new regulatory capital framework for the enterprises to better prepare them for exiting conservatorship. In 2022, FHFA and Ginnie Mae issued updated minimum financial eligibility requirements for entities selling loans to or servicing loans for the enterprises, and for Ginnie Mae issuers. The requirements incorporated lessons learned from pandemic-related market events. Housing and regulatory agencies also took steps on most of the administrative recommendations in HUD and Treasury’s 2019 plans.

Monitoring: partially met. Federal agencies have taken steps to provide monitoring tools for assessing housing finance system changes. For example, FHFA and the Consumer Financial Protection Bureau have a joint initiative—the National Mortgage Database Program—that collects residential mortgage data. This could be used to help examine the effect of mortgage market reforms.

However, FHFA Office of Inspector General (OIG) reports found deficiencies in FHFA’s oversight and monitoring of the enterprises. These include deficiencies in the application of examination guidance, communication of quality control review results, and reporting on conservatorship activities. The FHFA OIG continues to list enterprise supervision and conservator operations among FHFA’s top performance and management challenges. It also cited the need for strengthening controls over agency operations.

Demonstrated progress: not met. It will be difficult to resolve the federal role in housing finance until Congress enacts changes to the housing finance system. Assessing progress against specific goals is not possible until Congress provides a blueprint for the future federal role or the enterprises’ future structure. The ongoing conservatorships could create uncertainties for market participants. In addition, any future economic downturns could adversely affect the enterprises’ portfolios.

What Remains to Be Done

• HUD and Treasury, as part of developing future housing finance reform plans, should consider recommendations from the 2019 plans that could help address system vulnerabilities and ensure future plans address all our framework elements.
• FHA should develop a formal plan for evaluating the outcomes of a preconveyance inspection pilot that includes key elements of evaluation design—such as evaluation objectives and measures—and uses participant feedback and control groups, as appropriate.

Congressional Actions Needed

• legislation that establishes objectives for the future federal role in housing finance, including the enterprises’ structure, and a transition plan to a reformed system that enables the enterprises to exit federal conservatorship, and considers the role of all relevant federal entities, including FHA and Ginnie Mae;
• reforming Ginnie Mae’s oversight structure to help address increasing risks; and
• specifying the economic conditions FHA’s Mutual Mortgage Insurance Fund would be expected to withstand without substantial risk of drawing on supplemental funds, and requiring FHA to specify and comply with a capital ratio consistent with these conditions.

Benefits

• By March 2022, and in response to a 2019 recommendation, Ginnie Mae had implemented a model to periodically evaluate if its guaranty fee for single-family mortgage-backed securities provides sufficient reserves to cover potential losses. This better positioned Ginnie Mae to understand its ability to absorb losses and whether its guaranty fee is set at an appropriate level.
• As of September 2021, FHA had established metrics for its reverse mortgage portfolio and evaluated foreclosure prevention options in response to a 2019 recommendation. This allows FHA to better oversee the program and inform Congress on program performance.

Contact Information

For additional information about this high-risk area, contact Jill Naamane at (202) 512-8678 or [email protected].

USPS Financial Viability

Bookmark:

The U.S. Postal Service (USPS) should continue taking steps to restore its financial viability and Congress should consider additional changes to USPS’s unsustainable business model.

Why Area Is High Risk

Ratings for three of the five criteria improved since 2021 due to significant actions taken by USPS and Congress. The ratings for Capacity, Action Plan, and Demonstrated Progress increased since 2021 due to the enactment of the Postal Service Reform Act of 2022 (the 2022 Act). In addition, USPS introduced and initiated actions under its new strategic plan.

Leadership commitment: partially met. In March 2021, USPS released a new 10-year strategic plan that provides a wide-ranging blueprint for organizational change. The plan includes numerous initiatives intended to achieve key goals, including financial viability. In addition, Congress passed the 2022 Act, which granted USPS significant financial relief. However, Congress should still consider the appropriate institutional structure for USPS, among other things, as we reported in 2020.

Capacity: increased to partially met. Since our last update to the high-risk list, the 2022 Act has improved USPS’s financial capacity. The act repealed a requirement to prepay future retiree health benefits on an annual basis and canceled billions in unpaid past due payments for such prefunding. USPS has taken steps to improve its capacity by increasing its revenue and initiating changes intended to reduce costs. USPS also paid $500 million of its required $1.6 billion fiscal year 2022 payment towards its unfunded liability for Federal Employees Retirement System pension benefits—the first such payment in 11 years.

However, USPS’s business model is still unsustainable. First, USPS’s expenses exceeded revenue by about $5.9 billion in fiscal years 2021 and 2022 due to increasing labor compensation costs and declining mail volumes even though many past due payments were canceled. Second, USPS has stated that it will need to make capital investments to ensure that it can perform its universal service mission. However, its revenue might not fully fund these investments. Finally, even after the 2022 Act’s reduction in USPS’s retiree health care benefits liability, USPS will still have to meet its remaining long-term liabilities and debt—of which USPS’s liability for retiree health and pension benefits is the largest part. As of the end of fiscal year 2022, USPS’s long-term unfunded liabilities and debt totaled about $144 billion or about 184 percent of USPS’s fiscal year 2022 revenue (see fig. 12). USPS has stated that it currently cannot provide postal services and meet all of its statutory obligations.

What Remains to Be Done

Congressional Actions Needed

Benefits

• USPS improved its capital investment process. We found that USPS did not follow all leading practices for capital investments. Subsequently, USPS revised its policy for capital investments, including a process for thorough evaluation of investment alternatives.
• USPS developed better guidance for its initiatives. Our work found that USPS estimates of expected savings from initiatives had limitations that affect their reliability. Subsequently, USPS established guidance for considering, developing, refining, and approving initiatives.

Contact Information

For additional information about this high-risk area, contact David Marroni at (202) 512-2834 or [email protected].

Management of Federal Oil and Gas Resources

Bookmark:

Why Area Is High Risk

For example, Interior faces challenges with accurately valuing offshore oil and gas tracts and making ongoing updates to regulations for methane and oil and gas measurement. These issues hamper Interior’s ability to ensure the public receives a fair return for resources extracted from federal lands and waters. Interior also faces challenges with filling vacancies within the Bureau of Land Management (BLM) and maintaining the workforce BLM needs to manage millions of acres of public lands. We added this area to our High-Risk List in 2011.

Revenue Determination and Collection

Leadership commitment: increased to partially met. In November 2021, Interior issued a report on revising its approach to setting royalty and rental rates and better accounting for methane emissions. In August 2022, Congress passed the Inflation Reduction Act. The act addressed many of the recommendations in Interior’s report, including increasing royalty and rental rates for new onshore federal oil and gas leases.[16]

However, Interior needs to issue regulations addressing methane emissions related to recommendations we made in July 2016. It also needs to issue regulations addressing oil and gas measurement related to recommendations we made in April 2015. Interior estimates it will finalize and issue these regulations in fall 2023 and spring 2024, respectively. The new regulations could better ensure accurate calculations of royalties due.

Capacity: partially met. Interior has taken some steps to improve its capacity to address the weaknesses we have identified in its ability to determine and collect revenue. For example, in 2013, we recommended Interior revise its regulations to permit flexibility in onshore oil and gas royalty rates similar to rate flexibility already available to offshore leases. Interior implemented this recommendation in November 2016 when it issued regulations providing the flexibility to set its onshore royalty rate at or above 12.5 percent for competitive leases. In June 2022, Interior used this flexibility to issue onshore leases with an 18.75 percent royalty rate.

Interior officials also stated that the department was committed to taking steps to address deficiencies in its oil and gas IT systems that we identified in May 2021. However, Interior said these steps would not be completed until spring 2023.

Action plan: increased to met. Interior tracks our open recommendations. Officials provided us time frames for implementing these recommendations. As described above, the department also has two ongoing efforts to issue regulations related to methane and oil and gas measurement.

Monitoring: partially met. Interior tracks its progress toward implementing open recommendations. However, Interior’s Office of Natural Resources Revenue (ONRR) needs to establish goals for tracking the amount of oil and gas royalties subject to compliance review, as we recommended in May 2019. ONRR also needs to develop performance measures to assess whether the cases selected for review help ONRR achieve its compliance goals. As of February 2023, Interior officials told us that ONRR planned to implement these recommendations by July 2023.

Demonstrated progress: partially met. Since 2011, Interior has implemented more than 50 of our recommendations related to revenue determination and collection. For example, BLM recently conducted training and a survey on commingling (when oil and gas are combined from multiple leases before being measured for royalty purposes). These actions were necessary to implement one of our April 2015 recommendations. Additionally, Interior is taking steps to implement the nine remaining open recommendations, according to officials.

Human Capital Challenges

Leadership commitment: increased to partially met. BLM has taken some actions to establish a full workforce planning process. This is consistent with recommendations we made in November 2021. For example, in May 2022, BLM created an executive leadership steering committee to guide the workforce planning process. BLM has also hired a contractor to create a strategic workforce plan. However, BLM has yet to develop an agency-wide strategic workforce plan that reflects emerging mission goals and includes long-term strategies for acquiring, developing, and retaining the staff it needs to achieve its programmatic goals.

Capacity: increased to partially met. After BLM merged or transferred several of its headquarters functions and relocated most of its Washington, D.C.-based headquarters staff throughout the West, headquarters vacancies more than doubled from 121 in July 2019 to 326 in March 2020. BLM officials told us they continue to work on developing an agency-wide strategic workforce plan. Completing and implementing this plan will help BLM better address ongoing challenges resulting from the surge of vacancies it experienced after the relocation.

Action plan: increased to partially met. In November 2021, we recommended that BLM develop a strategic workforce plan. BLM has hired a contractor to begin work toward such a plan. BLM needs to ensure the resulting plan aligns its human capital program with mission goals and includes long-term strategies for acquiring, developing, and retaining staff to achieve the bureau’s programmatic goals.

Monitoring: partially met. In November 2021, we recommended that BLM track data on vacancies to gain a complete picture of its staffing needs. While BLM has developed a temporary process to track vacancies, officials said they have yet to identify a tool to track vacancies with the level of accuracy they would like. As of February 2023, agency officials indicated they were continuing to explore options for an electronic vacancy tracking tool as a part of their workforce planning efforts.

Demonstrated progress: partially met. Interior has begun taking steps to address our November 2021 recommendations related to workforce planning and mitigating the effects of recent staff vacancies. For example, in February 2022, BLM began exploring vacancy-tracking tools. Until it identifies a permanent tool with the capability to track vacancies accurately, BLM is using a temporary process to track permanent employee position vacancies within each state office and in headquarters, according to agency officials.

What Remains to Be Done

• Establish an accuracy goal (such as identifying the number of companies or percentage of royalties subject to compliance activities) that aligns with the agency’s mission of collecting, accounting for, and verifying royalty payments.
• Develop performance measures (such as having a specified percentage of compliance cases identify findings of royalty noncompliance or total additional royalties) that assess whether the cases the agency is selecting are helping it achieve its compliance goals.
• Complete ongoing rulemakings related to onshore methane emissions and oil and gas measurement.

Four of our recommendations to Interior related to human capital management remain open as of February 2023, including the following:

• Ensure bureau leadership incorporates key practices for effective agency reforms prior to implementing reorganization activities at Interior bureaus.
• Develop an agency-wide strategic workforce plan that aligns the agency’s human capital program with emerging mission goals and includes long-term strategies for acquiring, developing, and retaining staff to achieve programmatic goals.

Benefits

• Interior has taken steps to assess the effectiveness of its recruitment, relocation, and retention incentives. It has also identified technical competency needs for all key oil and gas staff within BLM, the Bureau of Safety and Environmental Enforcement, and the Bureau of Ocean Energy Management. In addition, Interior developed a process to assess workforce and leadership development policy. As a result, Interior will be better positioned to recruit, train, and retain the staff it needs to oversee onshore and offshore oil and gas activities. This is particularly true if the oil and gas market shifts and industry begins hiring more employees. These actions will also help better ensure Interior is spending its hiring and training funds effectively and efficiently.
• ONRR is building, testing, and evaluating multiple risk models for selecting cases to verify accurate royalty payments in response to its March 2021 study. The study found the contractor-built risk model ONRR used was ineffective in improving ONRR’s case selection. In response to our recommendation that ONNR periodically analyze its risk model’s effectiveness at identifying potential royalty noncompliance for further review, it has stopped using an ineffective risk model. ONNR is developing new risk models to more effectively identify cases to review for compliance.
• In June 2022, BLM increased royalty rates for its federal oil and gas leases from 12.5 percent to 18.75 percent. This occurred after it previously revised its regulations to allow it flexibility to set royalty rates, as we had recommended. Although we reported in June 2017 that raising federal royalty rates for onshore oil and gas resources could decrease oil and gas production on federal lands, we also reported that higher rates are expected to increase overall federal revenues and better assure a fair return for taxpayers.

Contact Information

For additional information about this high-risk area, contact Frank Rusco at (202) 512-3841 or [email protected].

Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks

Bookmark:

Why Area Is High Risk

Since 2021, the federal government has continued to partially meet four of the five criteria. The rating for monitoring increased from not met to partially met overall. However, there were significant improvements across the five segments that comprise this high-risk area. For example, ratings for four criteria increased from not met to partially met for the segment Federal Government as Leader of National Climate Strategic Plan.

Congressional action helped lead to improvements in this high-risk area. For example, the Infrastructure Investment and Jobs Act (IIJA), enacted in 2021, among other things, required the Department of Transportation’s guidance to be updated to address resilience in certain contexts. IIJA also provided funding for predisaster hazard mitigation programs. Additionally, the Inflation Reduction Act of 2022, among other things, provided funding for programs related to climate resilience.[17]

The administration also contributed significantly to progress. For example, it issued and began implementing Executive Orders (E.O.) 14008 on Tackling the Climate Crisis at Home and Abroad (January 2021), 14030 on Climate-Related Financial Risk (May 2021), and 14057 on Catalyzing Clean Energy Industries and Jobs Through Federal Sustainability (December 2021). Also, more than 20 federal agencies released climate adaptation and resilience plans followed by initial progress reports on those plans, as directed by E.O. 14008. These executive orders and action plans were important steps toward demonstrating needed leadership commitment and planning to address the government’s fiscal exposure to climate change.

The following sections present more detailed information on the five areas summarized in the overall rating.

Federal Insurance Programs

Leadership commitment: partially met. Congress passed the Inflation Reduction Act of 2022. Among other things, the act included $24.4 billion in appropriations to the U.S. Department of Agriculture (USDA) related to agricultural conservation and forest restoration, including for hazardous fuels reduction, climate mitigation, resilience, and conservation programs. This funding may help farmers and foresters adopt conservation practices that improve climate resilience. However, the federal government needs to take additional actions to improve the long-term resilience of insured structures and crops. It also needs to address structural weaknesses in its insurance programs.

Capacity: partially met. USDA’s Climate Hubs provide information that can help agricultural producers manage climate change impacts and potentially reduce crop losses covered by the federal crop insurance program. However, to help increase capacity further, USDA needs to analyze options for enhancing climate resilience. This includes expanding technical assistance for producers. In addition, the Federal Emergency Management Agency (FEMA) needs to update its planning documents to address challenges in reflecting flood hazards.

Action plan: partially met. In October 2021, USDA and the Department of Homeland Security (DHS)—which includes FEMA—released climate adaptation and resilience plans that identify actions they plan to take to address their most significant climate risks and vulnerabilities. However, USDA needs to, as appropriate, increase its annual adjustments of federal crop insurance premium rates in areas with higher crop production risks.

Monitoring: increased to partially met. In October 2022, USDA and DHS released their first annual climate adaptation and resilience progress reports detailing their implementation of actions identified in their 2021 climate adaptation and resilience plans. However, it is too early to determine the effectiveness of these monitoring mechanisms.

Demonstrated progress: not met. The federal government has not implemented our recommendations to improve the resilience of federally insured property or address structural weaknesses in each program. This includes incorporating climate resilience into the requirements for receiving payments from federal flood and crop insurance programs, updating flood maps to reflect future hazards, and analyzing options to help enhance producers’ climate resilience and incorporating them, as appropriate, into ongoing climate resilience planning.

Disaster Aid and Resilience

Leadership commitment: partially met. The Disaster Recovery Reform Act of 2018 allows the President to set aside certain funds for predisaster hazard mitigation. As a result, FEMA established the Building Resilient Infrastructure and Communities program. Further, IIJA provided $4.5 billion over fiscal years 2022 through 2026 to FEMA for this program as well as its Flood Mitigation Assistance program. To help demonstrate better leadership, the Executive Office of the President should use information on the potential economic effects of climate change to help identify significant climate risks and craft appropriate federal responses.

Capacity: partially met. FEMA’s Building Resilient Infrastructure and Communities program has made about $3.8 billion in mitigation grants available since 2020. In addition, through the Inflation Reduction Act of 2022, Congress appropriated funding to the National Oceanic and Atmospheric Administration to, among other things, enable coastal communities to prepare for changing climate conditions. However, it is too early to tell whether these measures will improve state and local capacity for disaster aid and resilience. Moreover, FEMA has neither determined what steps are needed to address the nation’s emergency management capability gaps, nor considered options to better manage fragmentation, such as consolidating disaster recovery programs.

Action plan: increased to partially met. In October 2021, DHS released a strategic framework for addressing climate change. It also introduced a climate action plan outlining actions it plans to take to integrate climate resilience into agency activities. However, FEMA’s 2019 National Mitigation Investment Strategy does not include a strategic approach to identifying and prioritizing specific climate resilience projects for federal investment.

Monitoring: increased to partially met. In October 2022, DHS released its first annual climate adaptation and resilience progress report detailing the implementation of actions identified in the agency’s 2021 climate adaptation and resilience plans. However, it is too early to determine the effectiveness of the monitoring mechanisms described in the plan.

Demonstrated progress: not met. The federal government has not developed the information necessary to account for its fiscal exposure to climate change or a strategy to reduce this exposure.

Federal Government as Property Owner

Leadership commitment: partially met. IIJA required the Department of Transportation to revise the Federal Highway Administration’s emergency relief manual to, among other things, identify procedures states may use to incorporate resilience into emergency relief projects, in line with what we suggested. Additionally, the National Defense Authorization Act for Fiscal Year 2022 directed the Department of Defense to incorporate climate resilience into acquisition, budgeting, and infrastructure planning. The Disaster Resiliency Planning Act, enacted in 2022, required the Office of Management and Budget (OMB) to establish guidance requiring federal agencies to incorporate natural disaster resilience into real property asset management and investment decisions. Further, E.O.s 14008 (January 2021) and 14057 (December 2021) direct federal agencies, among other things, to incorporate climate resilience into their facilities and managed lands. E.O. 14030 (May 2021), among other things, reinstated a flood risk standard for federally funded projects in flood plains.

However, the federal government needs to finalize guidance on how federal agencies should consider climate change in their National Environmental Policy Act reviews when planning federally funded projects.

Capacity: increased to partially met. OMB revised Circular A-11 in August 2022 to, among other things, provide that agencies should be able to demonstrate how climate considerations are integrated in risk management and decision-making, partially addressing our recommendation. In 2020, the Department of Defense also provided guidance to its installations on how to use a site-specific database of sea level rise projections in planning and project design, as we recommended. However, the federal government needs to further increase capacity by convening federal agencies for an ongoing effort to provide the best available forward-looking climate information to standards-developing organizations for their consideration.

Action plan: partially met. In October 2021, federal agencies released climate adaptation and resilience plans that identify actions intended to address their most significant climate risks and vulnerabilities. However, the Department of Defense has yet to consider climate change impacts for its overseas installations. In addition, the Department of Transportation has yet to implement options we identified to enhance the climate resilience of federally funded roads.

Monitoring: increased to partially met. In October 2022, federal agencies released their first annual climate adaptation and resilience progress reports. These reports document the progress agencies have made implementing the actions identified in their 2021 climate adaptation and resilience plans. However, it is too early to determine the effectiveness of these monitoring mechanisms.

Demonstrated progress: not met. The federal government has not fully implemented our recommendations to improve resilience government-wide.

Federal Government as Leader of National Climate Strategic Plan

However, the federal government has not led the development of a national climate strategic plan or a strategic approach to target federal resources toward high-priority projects that manage some of the nation’s most significant climate risks.

Capacity: increased to partially met. The President’s fiscal year 2023 budget began accounting for some fiscal risks of climate change, as we recommended. OMB also revised Circular A-136 in June 2022 to, among other things, encourage agencies to report certain information related to their climate-related financial risks. However, none of these efforts include clear priorities for climate-related activities of key federal entities.

Action plan: increased to partially met. In October 2021, federal agencies developed and released adaptation and resilience plans to address their most significant climate risks and vulnerabilities, as directed by E.O. 14008. However, the federal government has not developed a strategic plan—with clear priorities and roles and responsibilities of key federal entities—to guide the nation’s efforts to adapt to climate change.

Monitoring: increased to partially met. In October 2022, major federal agencies released their first annual climate adaptation and resilience progress reports, as directed by E.O. 14008. These reports document the progress agencies have made implementing the actions identified in their 2021 climate adaptation and resilience plans. However, it is too early to determine the effectiveness of these monitoring mechanisms.

Demonstrated progress: not met. The federal government has yet to implement all of our recommendations to develop a national strategic plan with clear roles and responsibilities.

Technical Assistance to Federal, Tribal, State, Local, and Private-Sector Decision Makers

Leadership commitment: increased to partially met. Through IIJA, Congress appropriated funds to provide technical assistance for resilience. For example, these appropriations allow the Department of Transportation to provide grants to the Transportation Resilience and Adaptation Centers of Excellence to promote resilient transportation infrastructure. This includes, among other things, supporting climate vulnerability assessments. However, the federal government has not led the development of a government-wide approach for providing decision makers with the best available climate-related information and assistance with translating such information. Nor has climate resilience been incorporated in the planning of all drinking water and wastewater projects that receive financial assistance. This could help ensure that such projects adequately address risks from climate change.

Capacity: increased to partially met. In September 2022, the National Oceanic and Atmospheric Administration launched the Climate Mapping for Resilience and Adaptation portal to help communities understand real-time climate-related hazards and identify federal funds to support their climate resilience projects. However, the federal government has not developed a government-wide approach for providing decision makers with the best available climate-related information and assistance with translating climate-related data into accessible information.

Action plan: not met. The federal government has not developed a plan to implement a system to provide information to decision makers to support climate resilience.

Monitoring: not met. There are neither programs nor mechanisms to monitor government-wide progress addressing the challenges we have identified providing climate-related technical assistance.

Demonstrated progress: not met. The federal government has not demonstrated long-term improvement in its climate-related technical assistance to decision makers.

What Remains to Be Done

• Federal Insurance Programs. FEMA and USDA should incentivize climate resilience by incorporating it into the requirements for receiving payments from federal flood and crop insurance programs. FEMA should also update its mapping plans to reflect future flood hazards. USDA should further analyze options to enhance producers’ climate resilience and integrate them, as appropriate, into its ongoing climate resilience planning.
• Disaster Aid and Resilience. The federal government should develop the information needed to manage disaster assistance programs’ long-term exposure to climate change and fully implement measures that promote resilience. This includes better managing fragmentation across its disaster recovery programs.
• Federal Government as Property Owner. The federal government needs a comprehensive approach to improve the resilience of the facilities it owns and operates and land it manages. For example, our recommendations to the U.S. Postal Service, Office of Management and Budget, Council on Environmental Quality, and Departments of Commerce, Defense, and Transportation should be implemented.
• Federal Government as Leader of a National Climate Strategic Plan. The federal government could better reduce its fiscal exposure if federal efforts were coordinated and directed toward common goals, such as improving climate resilience. For example, the entities within the Executive Office of the President should use information on the potential economic effects of climate change to help identify significant climate risks and develop a strategic plan to guide the nation’s efforts to adapt to climate change.
• Technical Assistance to Federal, Tribal, State, Local, and Private-Sector Decision Makers. The federal government needs a government-wide approach for providing federal, tribal, state, local, and private-sector decision makers with the best available climate-related information and assistance with translating climate-related data into accessible information. For example, the Tennessee Valley Authority, National Marine Fisheries Service, Department of Energy, Environmental Protection Agency, and Executive Office of the President should implement our recommendations.

Congressional Actions Needed

• addressing structural challenges in federal insurance programs related to crop insurance and the National Flood Insurance Program;
• promoting disaster resilience, including establishing an independent commission to recommend reforms to the federal government’s approach to disaster recovery and providing direction or authority to FEMA to address property acquisition challenges and enhance disaster resilience;
• supporting strategic planning by establishing (1) a coordinating entity to strategically target federal investments to Alaska Native Villages facing significant environmental threats; (2) a pilot program to identify and provide assistance to climate migration projects; and (3) a federal organizational arrangement to periodically identify and prioritize climate resilience projects for federal investment; and
• ensuring infrastructure projects that receive financial assistance adequately address risks from climate change, such as considering a requirement that climate resilience be incorporated in the planning of all drinking water and wastewater projects that receive federal financial assistance.

Benefits

Over the past 10 years, the federal government has recognized nearly 30 benefits of limiting the federal government’s fiscal exposure by better managing climate change risks. These benefits include

• ensuring Department of Defense planning for installations and facilities incorporates sea level change projections, and
• providing recipients of federal funding for roads more funding and guidance for incorporating resilience into projects.

Contact Information

For additional information about this high-risk area, contact J. Alfredo Gómez at (202) 512-3841 or [email protected].

Improving the Management of IT Acquisitions and Operations

Bookmark:

Why Area Is High Risk

The executive branch has undertaken numerous initiatives to better manage the more than $100 billion that is annually invested in IT. However, federal IT investments too frequently fail to deliver capabilities in a timely manner. They also incur cost overruns or schedule slippages while contributing little to mission-related outcomes. These investments often lack disciplined and effective management in areas such as project planning, requirements definition, and program oversight and governance. Recognizing the severity of issues related to the government-wide management of IT, in December 2014, Congress and the President enacted federal IT acquisition reform legislation, commonly referred to as the Federal Information Technology Acquisition Reform Act (FITARA). In 2015, we added the government’s management of IT acquisitions and operations to the High-Risk List.

Overall, ratings for all five criteria remain unchanged since 2017. Congress and OMB continue to demonstrate leadership commitment to ensuring agencies implement IT reform initiatives. Additionally, OMB and agencies made progress in implementing our recommendations—73 percent of recommendations have been fully implemented, an increase from 65 percent reported in our 2021 HIgh-Risk List. However, challenges persist, including agencies’ efforts to address the role of their chief information officers (CIO), IT workforce issues, and weaknesses in IT planning and management practices.

Leadership commitment: met. As we reported in July 2022, sustained congressional focus on the implementation of FITARA has led to improvement, as highlighted in agencies’ FITARA implementation scores issued biannually by the House Committee on Oversight and Reform. OMB continues to demonstrate its leadership commitment by issuing guidance for covered agencies to implement FITARA provisions and optimizing federal data centers. OMB must maintain its current level of leadership support and commitment to ensure that agencies successfully execute its guidance on implementing FITARA and related IT reform initiatives.

Capacity: partially met. Progress in improving the role of agency CIOs and IT workforce practices is limited. For example, we found in August 2018 that none of the 24 major federal agencies fully addressed the role of their CIOs, consistent with federal laws and OMB’s FITARA guidance. As of February 2023, 15 of the 24 major federal agencies had yet to fully implement our recommendations.

Further, in September 2022, we compared the responsibilities of the Federal CIO and agency CIOs to private sector CIOs. We recommended that (1) Congress consider formalizing the Federal CIO position and establishing responsibilities and authorities for government-wide IT management, and (2) OMB take steps to increase collaboration between CIOs and other executives and consider managerial skills in CIO hiring criteria.

In addition, nine agencies have yet to fully implement our prior IT workforce recommendations. These include recommendations addressing key IT workforce planning practices. We have also made 24 new recommendations since our 2021 High-Risk List. This includes recommendations that would help the Departments of State and Agriculture improve their respective IT workforce practices.

The Technology Modernization Fund (TMF) was established in December 2017 by legislative provisions commonly referred to as the Modernizing Government Technology Act to assist agencies with funding to replace aging IT systems. Congress initially appropriated $175 million for TMF and appropriated an additional $1 billion to the fund in the American Rescue Plan Act of 2021. According to OMB’s TMF website, the Technology Modernization Board had approved 38 projects across 22 federal agencies, totaling about $688 million, as of February 2023.

However, we had previously identified issues with the collection of fee payments to recover TMF program operating expenses and the reliability of cost estimates for awarded projects. In addition, three of our recommendations made in December 2019 have yet to be fully implemented. In December 2021, we reported that numerous projects had yet to realize any cost savings, narrowed their scopes resulting in reduced TMF award amounts, and continued to use unreliable cost estimates. Thus, we reiterated the importance of implementing our prior recommendations.

Action plan: partially met. Agencies made some progress implementing our prior recommendations to develop plans for modernizing or replacing their legacy systems or shifting their IT services to cloud computing. However, 20 recommendations have yet to be addressed at 14 agencies. This includes recommendations for agencies to document modernization plans for selected legacy systems and better track costs and savings related to cloud computing. We also continue to identify issues with agencies’ efforts to plan their respective IT modernizations. We made 29 new recommendations to three agencies (the Coast Guard and the Departments of Health and Human Services and Defense) aimed at improving their respective IT planning practices since our 2021 High-Risk List.

Monitoring: partially met. Agencies made some progress in implementing our prior recommendations to reduce IT contract duplication, improve IT acquisition practices, and address IT budgeting weaknesses. However, 36 recommendations have yet to be addressed at five agencies. In addition, we continue to identify weaknesses in agencies’ IT management practices. Since the 2021 High-Risk List, we made 29 new recommendations to five agencies to address issues. This includes inadequate oversight of IT programs, cost estimates and schedules, testing, performance measurement, and risk management.

Demonstrated progress: partially met. As of February 2023, OMB and federal agencies had fully implemented about 73 percent of the 1,554 total recommendations we have made since fiscal year 2010 to address shortcomings in IT acquisitions and operations. This is an increase from 65 percent reported in our 2021 High-Risk List. However, agencies need to take significant actions to build on this progress.

In March 2022, we reported that all 24 major agencies met their data center consolidation savings goals for fiscal year 2020 and planned to meet their goals for fiscal year 2021. This represents a cumulative total of $6.6 billion in cost savings and avoidances from fiscal years 2012 through 2021 (as of August 2021). In addition, as of February 2023, agencies had implemented 110 of the 126 recommendations we made since 2016 to help agencies meet their data center optimization targets. However, agencies need to address the 16 recommendations that have yet to be implemented.

Agencies continue to report progress in savings from PortfolioStat. This is a key OMB initiative intended to improve the management of IT investments by consolidating and eliminating duplicative systems, among other things. Agencies have reported a total of about $4.25 billion in savings from fiscal years 2012 through 2021. This accounts for approximately 71 percent of the more than $6 billion in planned PortfolioStat savings, an increase from 45 percent reported in our 2021 High-Risk List. Agencies still have additional opportunities to make progress in savings.

What Remains to Be Done

Congressional Actions Needed

Congress should consider formalizing the Federal CIO position and establishing responsibilities and authorities for government-wide IT management, an open recommendation for this high-risk area that we suggested in September 2022.

Benefits

• Our May 2014 work on the federal government’s management of software licenses found that only two of 24 agencies had established comprehensive software license inventories. By December 2020, all 24 agencies had established comprehensive inventories and analyzed software usage to make cost-effective decisions.
• In January 2018 we found that, although 22 selected agencies reported $14.7 billion in fiscal year 2016 IT contracts, 21 of the agencies did not identify an additional $4.5 billion that we had identified in IT obligations. In addition, 14 of the agencies had not followed OMB guidance to involve the acquisition office in their process to identify IT acquisitions for CIO review. By March 2022, all of these agencies had addressed recommendations to ensure that all IT-related acquisitions are properly identified and the acquisition office is involved in this process.

Contact Information

For additional information about this high-risk area, contact Carol Harris at (202) 512-4456 or [email protected].

Improving Federal Management of Programs That Serve Tribes and Their Members

Bookmark:

Why Area Is High Risk

Federal agencies have ineffectively administered tribal education and health care programs. In addition, they have managed the development of tribal energy resources inefficiently. Therefore, we added this area to our High-Risk List in 2017. It includes three components across agencies in two departments: the Bureau of Indian Education (BIE) and Bureau of Indian Affairs (BIA), under the Department of the Interior’s Office of the Assistant Secretary–Indian Affairs, and the Indian Health Service (IHS) in the Department of Health and Human Services (HHS).

Education

Action plan: increased to met. Since our last high-risk report in 2021, BIE has developed plans for corrective actions to address a variety of high-risk challenges. For example, in January 2022, the agency developed and implemented a plan to support schools in promptly addressing facility safety issues, as we recommended in March 2016. Also, in September 2021, the Interior developed a comprehensive long-term capital asset plan to inform how it allocates school facility funds, as we recommended in May 2017.

Monitoring: partially met. Since BIE took over responsibility for all school inspections in fiscal year 2019, it has taken steps to routinely monitor its safety inspection process for schools. However, BIE’s work in addressing other monitoring deficiencies has been insufficient. For example, it has yet to establish a program to routinely monitor and assess technology needs at schools. This has contributed to major delays in providing students with distance-learning devices during the pandemic, as we found in April 2021.

Demonstrated progress: partially met. Since 2021, BIE and related Interior offices have implemented three recommendations on school construction and safety. However, significant work remains to address our nine open recommendations. This includes two recommendations on distance learning, six recommendations on special education, and one on school construction. Continued progress in addressing management weaknesses will depend on the sustained support of senior agency leaders.

Health Care

Capacity: partially met. We previously reported that IHS has made progress filling executive vacancies in health care facilities and has taken numerous steps to enhance its recruitment and retention of providers. In addition, in response to our recommendation, in 2020, IHS developed a system to track contract provider costs. IHS has been using it to make informed decisions about resource allocation and provider staffing.

However, our recent reports have identified deficiencies in IHS’s ability to achieve its mission because of weaknesses in the agency’s management and organizational infrastructure. For example, IHS has been collecting and reviewing data that would enable it to make informed decisions about tradeoffs inconsistently. This includes data about provider vacancies and patient needs. In addition, IHS has not taken steps to ensure consistent oversight and controls across its decentralized management structure. For example, we found that IHS area office practices lacked consistency in their oversight of financial decisions and provider misconduct.

Action plan: partially met. In 2019, IHS finalized a strategic plan. In 2022, it developed an action plan to improve its oversight and administration of health care programs that aligns with its strategic plan. The action plan identifies action items to address health care management weaknesses that others and we identified. This includes those related to assessing patient needs, ensuring adherence to agency policies, standardizing governance processes, and overseeing local budgetary decisions. The plan also identifies corrective actions and measureable targets with clear time frames to address these and other issues. As such, it allows IHS to demonstrate progress toward resolving known issues.

While IHS’s action plan identifies the root causes of health care management weaknesses others and we identified, it focuses on addressing these weaknesses instead of their root causes. IHS should expand its action plan to include strategies for addressing all of the root causes it has identified, such as improving management oversight in the agency and access to services. This step will help the agency ensure it addresses any problems underlying its known issues.

Monitoring: partially met. IHS has taken some steps to monitor the agency’s progress in addressing its management weaknesses. For example, it established a Chief Compliance Officer role to enhance its monitoring of area operations. These steps could significantly improve monitoring. In addition, since 2021, IHS has established a new hotline to simplify the process for reporting suspected abuse within IHS facilities or by IHS staff members. However, IHS should continue to enhance its monitoring. This includes tracking and validating the effectiveness of corrective actions noted in its action plan, and addressing the root causes of its challenges and the sustainability of those efforts.

Demonstrated progress: partially met. Since 2021, IHS has implemented three recommendations related to the management of health care programs. For example, in response to our December 2020 recommendations, IHS established a process for its headquarters to review area offices’ misconduct and substandard performance policies and training. These actions should help ensure consistency in the agency’s management of provider performance across IHS areas.

However, IHS needs to do more to improve its oversight of key areas. For example, IHS should continue to implement our four open recommendations, use data to show, both, that its action plan is being implemented and the root causes of its health care management weaknesses are being addressed, and take actions to ensure that progress is sustained.

Energy

Capacity: partially met. In November 2016, we recommended that BIA assess the critical skills of its workforce and develop a process to assess its workforce composition. This would ensure an adequate workforce with the right skills, aligned to meet the agency’s goals and Tribal priorities. In October 2021, BIA completed an assessment of two energy-related occupations and identified the need for additional training for these critical positions.

In addition, BIA worked with the Office of Personnel Management to develop a process to assess the workforce that implements programs for the Office of Trust Services. BIA initiated this assessment in three pilot regions in 2022.

To continue making progress, BIA should complete workforce assessments across all relevant offices and take steps to address issues identified through these assessments. These actions will help BIA address inadequate resources and staff at some offices that do not have the necessary skills to review energy-related documents effectively.

Action plan: partially met. In October 2022, the Indian Energy Service Center issued a strategic plan for fiscal years 2022 through 2026 that includes goals for reducing processing times for energy-related documents and streamlining policies, as we recommended in March 2022. The service center has also identified actions that could reduce processing errors and increase the timeliness and efficiency of energy-related regulatory processes. For example, the service center plans to work on updating mineral leasing regulations to allow for online lease sales.

However, BIA has not developed a comprehensive plan for assessing its processing time frames. Such a plan could identify the root causes of any delays, corrective actions, resources needed to implement the corrective actions, and measurable targets with clear time frames.

Monitoring: partially met. In response to our June 2015 recommendations, the Indian Energy Service Center established a plan to develop an inventory of pending transactions of key energy development activities at field offices. The plan also called for it to begin meeting regularly with field offices to monitor their processing of these transactions. According to this plan, the service center will review certain transaction types (rights of way and revenue sharing agreements) in fiscal year 2023 and additional transaction types in the following years.

Demonstrated progress: partially met. BIA has made progress with workforce assessment plans, agency coordination, guidance, and training. In March 2022, we reported that the Indian Energy Service Center assisted several field offices with backlogs in work associated with leasing and permitting for energy development. It also hosted training on the roles and responsibilities of Interior agencies involved in energy development to encourage consistency. As noted above, to continue making progress in this area, BIA should complete its ongoing workforce assessments across all relevant offices, monitor the timeliness and efficiency of energy-related processes, and use this information to demonstrate improvements.

What Remains to Be Done

• developing processes to guide area offices in systematically assessing how the scope of services provided by federally operated facilities will meet the medical needs of their patients; and
• developing a process to guide area offices’ review of federally operated health care facilities’ spending proposals.

BIA has no open recommendations. However, to continue making progress in meeting the remaining criteria for this area, BIA needs to complete its workforce assessment and develop an action plan to improve outcomes related to tribal energy development. BIE and IHS also need to take additional actions to meet the remaining criteria for addressing high-risk issues.

Benefits

• BIE provided schools with comprehensive training on a wide variety of areas important to student and staff safety, including promptly addressing safety problems with facilities.
• IHS developed specific agency-wide standards for patient wait times in federally operated facilities. It also created electronic dashboards to monitor wait times in these facilities.
• BIA contracted with the Office of Personnel Management to conduct competency modeling and gap analyses that included two mission-critical energy development occupations. This came after we recommended the agency assess critical skills and competencies needed to fulfill its responsibilities related to energy development.

Contact Information

For additional information about this high-risk area, contact Anna Maria Ortiz at (202) 512-3841 or [email protected]. For questions about our Tribal education work, contact Melissa Emrey-Arras at (617) 788-0534 or [email protected]. For our Tribal health work, contact Michelle Rosenberg at (202) 512-7114 or [email protected]. For our Tribal energy work, contact Frank Rusco at (202) 512-3841 or [email protected].

U.S. Government’s Environmental Liability

Bookmark:

Why Area Is High Risk

Of the estimated liability for fiscal year 2022, DOE is responsible for the largest share ($520 billion). This is related primarily to retrieving, treating, and disposing of nuclear and hazardous waste. DOD is responsible for the second-largest share ($91 billion). This is related primarily to environmental cleanup and restoration activities at or near current and former DOD installations. The remaining liability is shared among other agencies, including the Departments of Agriculture (USDA) and the Interior and National Aeronautics and Space Administration (NASA). We added this area to our High-Risk List in 2017.

EM has developed several key programmatic initiatives and guiding documents over the last 2 years, including a program plan and a 10-year strategic vision. Additionally, EM’s current leader is the longest-serving leader in its history. However, steps are needed to ensure continuity of these improvements beyond his tenure. Furthermore, frequent leadership turnover, inconsistent priorities, and organizational changes at EM over the last 3 decades have slowed cleanup progress. This, in turn, has made it harder for DOE to achieve its complex, long-term mission, as we found in May 2022. DOE also faces technical challenges to future waste retrieval. In addition, it has not developed a long-term plan for closing the waste tank farms at the Hanford Site, as we found in January 2021.

While DOD has established a long-term goal to meet certain cleanup milestones at Formerly Used Defense Sites contaminated with hazardous substances, pollutants, or contaminants, it has no similar goal for sites contaminated by military munitions, as we found in June 2022. Following our June 2022 finding, Congress mandated that DOD establish a target goal for completing cleanup of these sites. However, Congress did not set a deadline by which DOD must do so. DOD could demonstrate leadership commitment by quickly taking action to establish the required cleanup goal.

Capacity: not met. In its multiple reorganizations of EM over the past 2 decades, DOE has not used a communication strategy that ensures continuous, two-way communication among senior leadership, employees, and contractors. These frequent reorganizations have contributed to low morale among employees and slowed cleanup work, as we found in May 2022. EM needs to develop such a communication strategy to more fully engage its workforce in developing and implementing reforms.

Action plan: not met. DOE has not developed formal plans to address its growing environmental liabilities. We and others have identified numerous opportunities for DOE to address and potentially reduce its environmental liability. In 2020, EM began publishing a 10-year strategic vision for cleanup across all of its sites. In 2022, it also developed a program plan for completing cleanup at each site. We have ongoing work evaluating whether the plan meets relevant criteria.

Furthermore, several other departments, including DOD, USDA, and the Interior, could improve transparency about their total cleanup costs by reporting additional information to Congress. For example, DOD does not report information to Congress on long-term management costs for Base Realignment and Closure sites, as we found in September 2022. Similarly, USDA and the Interior do not communicate to Congress all known estimated cleanup costs for abandoned hardrock mines in their budget materials, as we reported in January 2023.

Monitoring: increased to partially met. DOE has taken some steps to improve its ability to monitor and meet cleanup milestones. For example, EM issued a new standard operating procedure that (1) standardized requirements for sites to track milestones, and (2) added a requirement for officials to annually assess root cause trends for missed milestones at sites, as we recommended in February 2019.

However, EM neither systematically tracks spending nor comprehensively evaluates outcomes when managing its research and development projects. This does not fully align with leading practices for collaboration, as we found in October 2021. Fully following these practices would enable DOE to better monitor its investments into research and development of safer, more efficient, and more effective cleanup approaches.

Other agencies have also begun efforts to better understand their growing liabilities. For example, DOD and NASA have taken initial steps to understand the scope of cleanup needed for emerging contaminants known as per- and polyfluoroalkyl substances (PFAS). As of September 2022, NASA had completed preliminary assessments of PFAS contamination at all of its sites, and DOD had completed preliminary assessments at more than 300 installations, according to NASA and DOD officials. In a June 2022 report to Congress, DOD estimated that investigating and cleaning up PFAS contamination across various installations and sites would cost $2.1 billion. DOD expects this estimate to grow as it completes initial assessments and learns more.

Demonstrated progress: not met. Agencies and policymakers have yet to take significant steps to reduce the federal government’s large environmental liability. Specifically, DOE continues to face significant cost and schedule challenges with some projects and activities. For example, DOE will need a significant increase in annual appropriations—almost $6 billion in fiscal year 2030, compared to about $1.6 billion in fiscal year 2022—to sustain its current plan to treat tank waste at Hanford, as we reported in July 2022. However, we found in December 2021 that DOE could save tens of billions of dollars by considering alternate methods of treating and disposing of certain waste at Hanford.

In addition, until policymakers resolve the impasse over a permanent solution for disposal of spent nuclear fuel from commercial reactors—in turn enabling DOE to develop and implement a disposal strategy—the federal government faces significant liability from litigation related to commercial temporary waste storage. DOE estimates this liability at $39.2 billion, which may be an underestimate, as we found in September 2021. DOE does not include these estimated litigation costs in its reported environmental liabilities. However, these costs create additional fiscal exposure for the federal government.

What Remains to Be Done

• DOE should revise cleanup policies and develop a program management plan that incorporates the essential elements of a risk-informed decision-making framework.
• DOE should continue its efforts to engage the public and finalize its draft consent-based siting process for managing commercial spent nuclear fuel.
• DOD should establish a relevant cleanup goal for Formerly Used Defense Sites contaminated by military munitions.

Congressional Actions Needed

• clarifying, in a manner that does not impair the regulatory authorities of the Environmental Protection Agency or any state, DOE’s authority to determine, in consultation with the Nuclear Regulatory Commission, whether portions of Hanford’s tank waste (including residual tank waste) can be managed as a waste type other than high-level waste and can be disposed of outside the state of Washington;
• enacting legislation to establish a new, dedicated DOE Under Secretary position for nuclear waste management and environmental cleanup; and
• enacting legislation to clarify DOE’s authority to sell depleted uranium, including any conditions connected to such sales.

Benefits

• In response to a recommendation we made in May 2015, DOE suspended work on the Low Activity Waste Pretreatment System facility at Hanford and pursued a different technology, which it completed in 2022 for a savings of $80 million.
• In August 2021, DOE published procedures that require site officials to annually assess root cause trends for modified (i.e., missed or postponed) milestones at sites, in response to our February 2019 recommendation. This guidance will help EM address the inconsistencies we found in its internal tracking of cleanup milestones. DOE will also be able to report more accurate and useful information on the status of cleanup milestones to decision makers.
• DOD officials found and corrected a formulaic error in DOD’s environmental liabilities data related to Formerly Used Defense Sites after we found anomalies in the data and alerted DOD. This error had caused information on the reasons for cost increases and decreases in DOD’s corporate database to be unreliable. DOD will now be able to provide accurate information to Congress in its future reports.

Contact Information

For additional information about this high-risk area, contact Nathan J. Anderson at (202) 512-3841, [email protected].

Emergency Loans for Small Businesses

Bookmark:

The Small Business Administration (SBA) can make additional progress to improve its oversight of emergency loans for small businesses by continuing to develop and implement its fraud risk management efforts and addressing material weaknesses reported by its financial statement auditor.

Why Area Is High Risk

This high-risk issue is being rated for the first time since it was added to the High-Risk List in 2021. Although SBA has made progress toward implementing controls to help address fraud in its emergency loans for small businesses, the following issues remain:

Further, although SBA has created a fraud risk management action plan and other review and oversight plans, it has not developed fraud risk management strategies for PPP and EIDL that meet the criteria in our Fraud Risk Framework. For example, various plans and summary documents SBA provided do not fully articulate a strategic approach to detecting and responding to fraud or communicate PPP and EIDL antifraud strategies to employees and other stakeholders.

What Remains to Be Done

We have made eight recommendations to SBA focused on this high-risk area, two of which remained open as of February 2023. In addition, SBA’s financial statement auditor made numerous recommendations to SBA in November 2022. Additional progress could be made if SBA were to complete actions to implement open recommendations, such as:

• developing fraud risk management strategies for PPP and EIDL; and
• addressing the material weaknesses identified by its financial statement auditor.

• In June 2020, we found that SBA had limited time to implement safeguards for the PPP loan approval process. Thus, it needed to develop plans to respond to risks in PPP. In response, SBA provided a master review plan for PPP in December 2020 that outlined steps it planned to take to review the PPP loans made in 2020. SBA updated the plan in January 2022 to, among other things, include oversight of loans made in 2021.
• In November 2020, we found that SBA needed to expeditiously estimate improper payments and report estimates and error rates for PPP. In response, SBA estimated and reported the improper payment amount and error rate for PPP in fiscal year 2022 annual reporting.
• In March 2021, we found that SBA had not conducted fraud risk assessments for PPP or EIDL. In response, SBA provided both assessments in September 2022.

For additional information about this high-risk area, contact William B. Shear at (202) 512-8678 or [email protected].

Strengthening Management of the Federal Prison System

Bookmark:

Why Area Is Being Added to the High-Risk List

BOP is responsible for the care, custody, safety, and rehabilitation of approximately 158,000 inmates. It is also one of the largest employers at the Department of Justice (DOJ) with more than 34,000 correctional officers and staff. In fiscal year 2023, BOP’s appropriation was a little more than $8.5 billion.[18] Human capital-related costs and programs, and services for inmates comprised the largest expenditure categories.

In March 2021, we identified management of the federal prison system as an emerging high-risk issue requiring close attention based on our oversight work and knowledge of longstanding challenges. At that time, we identified three key problem areas that continue to pose challenges:

• management of staff and resources,
• planning for new programs or initiatives that help inmates prepare for a successful return to the community, and
• monitoring and evaluation of inmate programs, which has led to imprudent spending.

In addition, BOP has consistently experienced several leadership changes over recent years. Other longstanding issues have been staffing challenges, such as vacancies and the growing use of overtime to help address them, which continue to present a serious threat to inmate and staff safety. BOP also lacks the necessary data and analytic capacity to prepare for and respond to disasters that can affect security. In addition, we found that BOP should improve its efforts to implement certain requirements from the First Step Act of 2018. The Act, among other things, directs BOP to deliver programs that may lower inmates’ risk of recidivism. It also provides inmates with opportunities to earn time credits that may allow them to reduce the amount of time they spend in a BOP facility.[19]

Finally, in December 2022, the DOJ Inspector General cited improving management of the federal prison system as a top management and performance challenge facing the department. These challenges included staffing shortages, contraband, and inmate medical care costs, as well as infrastructure maintenance and staff misconduct.

Capacity: BOP’s capacity is limited in large part because of how it has managed staffing levels and resources. For example, our February 2021 report found that BOP did not have reliable methods for assessing its staffing levels. We also found that BOP’s overtime expenses increased more than 100 percent, without adjusting for inflation, from fiscal years 2015 through 2019. We made seven recommendations to BOP. This includes that BOP develop and implement a reliable method for calculating staffing levels, or amend existing methods, and conduct a risk assessment of its overtime use. Four of the seven recommendations remain unresolved as of March 2023, including three that we designated as high priority in June 2022.

Further, in May 2020, we recommended that BOP develop and document its methods for determining the number of additional agency personnel it needed to support expansion of its medication assisted drug treatment program—a key program related to inmate rehabilitation. As of March 2023, BOP had not fully implemented this recommendation, along with two others related to inmate drug treatment efforts.

In 2021 and 2022, committees of both the House and the Senate held BOP oversight hearings focused on COVID-19 management, allegations of BOP employee misconduct, and general staffing challenges. Assessing staffing shortages will be essential for BOP to ensure it has the staff needed to offer sufficient programs—including offering certain programs and productive activities pursuant to the First Step Act. Related to this issue, in March 2023, we recommended that BOP develop a mechanism to monitor if the amount of recidivism reduction programs and activities it offers is sufficient to meet the needs of its incarcerated population. BOP agreed and we will continue to monitor BOP’s efforts to implement this recommendation.

Finally, members of Congress have raised concerns about BOP’s implementation of the First Step Act, its management of infrastructure maintenance and repair projects, and efforts to reduce recidivism. The House’s Bureau of Prisons Reform Caucus was chartered in 2020 and in February 2022, the Senate’s Prison Policy Working Group was established. In early 2023, members of the House announced the creation of the Bipartisan Second Chance Task Force to promote policies that improve reentry outcomes and reduce employment barriers for formerly incarcerated individuals.

Action plan: BOP’s plans to manage some of its key inmate rehabilitation programs are limited. Based on the latest available data, which BOP released in September 2021, nearly 45 percent of individuals were either rearrested or returned to BOP custody within 3 years of completing their federal sentences and being released to their communities.

Given that the First Step Act generally requires the Attorney General to research and analyze certain programs related to their effectiveness at reducing recidivism, it will be critically important that BOP have an effective plan to do so.[20] In March 2023, we recommended that BOP ensure its plan for evaluating recidivism reduction programs has pre-established, quantifiable goals that align with the First Step Act, and includes clear milestone dates. BOP agreed, and we will continue to monitor BOP’s efforts to implement this recommendation.

Monitoring: BOP has not evaluated many of its programs for inmates in decades, though BOP has made some recent progress in this area. In response to our July 2020 recommendation, BOP completed an evaluation of its Federal Prison Industries program in September 2021. Subsequently, BOP set a measurable goal for recidivism reduction for inmates participating in the program. This program is designed to help inmates develop marketable job skills and successfully re-enter society. Also in September 2021, BOP initiated an evaluation of its drug treatment programs. The assessment is ongoing.

In March 2023, we recommended that BOP collect and monitor participation data for unstructured productive activities that incarcerated people are able to participate in and earn First Step Act time credits. BOP did not concur with this recommendation. We believe taking such actions should be a priority and would better position BOP to know the status of each incarcerated person’s successful participation in programs for the purposes of First Step Act time credits.

In addition, BOP lacks the data collection and analytic capacity needed to prepare for disasters and protect its physical resources. In February 2022, we recommended that BOP establish cost-effective and feasible analytic features, such as project milestones and cost indicators, as well as queries and alerts. This would give BOP better visibility into disaster-related projects. In February 2023, BOP reported that it would conduct a cost-benefit analysis of adding analytical features after its transition to a new management system is completed by the end of the fiscal year.

Demonstrated progress: Since we identified BOP as an emerging high-risk issue in March 2021, the bureau has addressed 22 of our recommendations. This has included developing approaches to capture and share best practices and lessons learned related to managing COVID-19 resources, and ensure the facilities apply these practices as appropriate.

However, we have made another 26 recommendations to BOP since March 2021. In total, 28 recommendations related to this high-risk area need to be fully addressed, including those from reports issued prior to March 2021.

What Remains to Be Done

In addition to sustaining leadership commitment, BOP needs to address the four other criteria related to capacity, action plan, monitoring, and demonstrating progress. Moving forward, GAO and BOP will agree upon metrics in order to gauge progress. Within this context, BOP also needs to complete actions to implement our 28 recommendations.

For example:

Potential Benefits

Contact Information

For additional information about this high-risk area, contact Gretta L. Goodwin at (202) 512-8777 or [email protected].

DOD Weapon Systems Acquisition

Bookmark:

Why Area Is High Risk

DOD is continually challenged to rapidly deliver capabilities to its warfighters in an increasingly innovative and ever-changing global environment. Further, DOD programs are more software driven than ever before and face global cybersecurity threats. As of December 2021, DOD expected to spend more than $1.9 trillion dollars to acquire weapon systems. It identified the modernization of its weapon systems as critical to the nation’s ability to achieve competitive advantage with potential adversaries. Legislation, such as acquisition reforms outlined in the National Defense Authorization Acts for Fiscal Years 2016 and 2017, has prompted DOD to take actions to improve the outcomes of systems that were consistently costing more, taking longer to develop, and performing at lower-than-anticipated levels. We added this area to our High-Risk List in 1990.

Leadership commitment: met. DOD senior leadership continues to demonstrate a strong commitment to improving the management of its weapon systems acquisition. For example, in May 2021, the Deputy Secretary of Defense took action to address portfolio management challenges we identified in August 2015 by establishing Integrated Acquisition Portfolio Reviews. These reviews examine how multiple weapon systems fit into a broader portfolio of capabilities. Additionally, the Office of the Under Secretary of Defense for Acquisition and Sustainment and military department leadership continue to update acquisition policies and develop oversight plans since our last High-Risk Report in 2021.

Capacity: partially met. Since our 2021 report, DOD has taken steps to increase its capacity for addressing risks related to weapon systems acquisition. For example, in November 2021, DOD established the Software Modernization Senior Steering Group. This group coordinates DOD’s software modernization efforts and promotes the adoption of modern software development practices across the department. The Under Secretary of Defense for Acquisition and Sustainment, the Under Secretary of Defense for Research and Engineering, and the DOD Chief Information Officer oversee the group.

However, DOD still needs people with the necessary expertise and sufficient resources to improve weapon systems acquisition. For example, in February 2022, we reported that officials from the Office of the Under Secretary of Defense for Acquisition and Sustainment told us they had no dedicated funding for efforts to improve acquisition reporting. They also said that the office responsible had recently been directed to cut its staffing levels. Further, DOD faced reduced capacity among its leadership while awaiting the confirmation of a new Under Secretary of Defense for Acquisition and Sustainment, which occurred more than a year after the 2021 change in presidential administration.

Action plan: partially met. DOD continues to make progress in developing plans to improve certain aspects of weapon systems acquisition. For example, in February 2022, the Acting Assistant Secretary of Defense for Acquisition approved a plan explaining how DOD would assess the effects of recent acquisition reforms, as we recommended in June 2019. However, the department has yet to develop plans to address other aspects of this high-risk area. We reported in July 2022 that the department had yet to develop a consolidated and comprehensive strategy to mitigate industrial base risks such as reliance on foreign and single-source suppliers for critical materials.

Monitoring: partially met. DOD has made progress in its efforts to conduct data-driven oversight on the effectiveness of defense acquisition system changes. In February 2022, we reported on the Office of the Under Secretary of Defense for Acquisition and Sustainment’s multiyear effort to improve acquisition data management. While officials from that office described these efforts as significant, we continue to identify challenges with the data available to DOD for effectively monitoring recent acquisition reforms. For example, in February 2023, we reported that DOD’s ability to conduct effective data-driven oversight of its middle tier of acquisition pathway was hindered by a lack of clear reporting guidance and a data framework that obscured key program details. These challenges were compounded by inaccurate data provided by DOD components. An acquisition pathway allows for the rapid prototyping or fielding of capabilities.

Demonstrated progress: partially met. DOD continues to work to implement our past recommendations to help address the high-risk area. For example, in 2021 and 2022, DOD addressed recommendations through actions such as monitoring costs for programs using new acquisition pathways, developing policies and guidance to increase planning for weapon systems sustainment during the acquisition process, and improving software development for its costliest weapon program, the F-35.

However, DOD has yet to address many of our other recommendations that could help improve cost, schedule, and performance outcomes. Additionally, in our June 2022 annual weapon systems assessment, we were unable to assess DOD’s progress in reducing unplanned cost growth due to the lack of available data. We noted in our report that DOD still struggled with schedule delays despite congressional legislation and departmental efforts in recent years emphasizing the timely delivery of warfighting capabilities.

The following sections discuss the four segments related to the overall high-risk area of DOD Weapon Systems Acquisition.

Acquisition Policy and Oversight

DOD has yet to implement some of the improvements to its acquisition policies that we have identified. For example, in March 2022, we found that DOD’s acquisition policies incorporate some leading principles that private sector companies use to drive innovation and speed in product development. These principles include developing cost, schedule, and performance parameters to define goals before allocating funding. However, DOD missed opportunities for positive outcomes by not addressing others. We recommended—and DOD agreed—that the department update its acquisition policies to fully address leading principles.

Further, DOD has yet to fully determine key program oversight aspects for the Adaptive Acquisition Framework. This framework provides six acquisition pathways that are each tailored for the unique characteristics and risk profile of the capability being acquired. As a result, Congress and senior DOD leadership may lack the information they need to ensure the department’s acquisition efforts are on track. For example, in February 2023, we found that DOD components had yet to establish and document processes that DOD directed them to develop to inform execution and oversight of DOD’s middle tier of acquisition pathway. Additionally, in February 2022, we reported that many open questions remained about how DOD would track and report on program performance. We made recommendations to strengthen DOD’s efforts to improve acquisition program reporting (see figure 15).

Software Development and Cybersecurity

Cyberattacks can target any weapon system that depends on software. Software has become a key component of weapon systems. Yet DOD has been challenged to modernize its software development approach, address workforce shortfalls, and improve cybersecurity—a fact that senior DOD leadership has acknowledged. In June 2022, we reviewed 59 DOD acquisition programs. We found that these programs had made limited progress in implementing software development practices recommended by the Defense Science Board in 2018. Such practices include providing training in modern software development approaches for program managers and staff. These programs also reported continued software development workforce challenges. Nearly half of the programs said it is difficult to find staff with the required expertise. More than one-third reported difficulty hiring staff in time to perform planned work.

Further, the programs we reviewed have not fully implemented recommended cybersecurity practices. For example, they did not consistently complete certain types of testing that assess a system’s ability to execute critical missions and defend against cyber threats. In addition, in March 2021, we found that programs did not always include complete cybersecurity requirements in their contracts. We also found that DOD’s related guidance was insufficient, increasing the potential for cybersecurity risks.

Defense Industrial Base

DOD recognizes it needs a healthy defense industrial base with secure supply chains, skilled workers, robust competition, and access to innovative, cutting-edge technology to keep pace with strategic competitors. Without these elements, DOD programs could face acquisition cost overruns, schedule delays, and performance issues. For example, we reported in January 2021 that the Navy’s submarine programs rely on materials produced by an atrophied supplier base. We also found that risks in the supplier base contributed to schedule and quality challenges for the lead Columbia class submarine.

Congress has recently taken steps that help DOD address these challenges, such as providing funds that the Navy used to expand and develop the submarine supplier base. As of May 2021, the Navy’s submarine programs had budgeted nearly $900 million to address suppliers’ capacity and workforce risks and to develop additional sources of supply. However, in July 2022, we found that DOD did not have enterprise-wide performance measures to monitor the aggregate effectiveness of its numerous risk mitigation efforts, which cost billions of dollars.

We also reported that DOD’s Industrial Base Policy office does not have a consolidated and comprehensive strategy to mitigate industrial base risks. For example, we found that DOD had yet to develop an analytical framework for mitigating risks. Such a framework could support its planning efforts and was required by Congress. We also recommended in June 2022 that DOD update its industrial base assessment instruction. Such a move would ensure that DOD has greater insight into industrial base risks across the department.

Innovation Investments

Responding to threats from strategic competitors, such as China and Russia, requires DOD to invest in innovative technologies for the warfighter. DOD, however, faces challenges in delivering such innovation quickly. The department typically focuses on developing near-term, less risky, incremental innovation at the expense of long-term, disruptive innovation. DOD did not concur with our recommendations and has yet to implement our priority recommendations from June 2017 to (1) define the desired mix of incremental and disruptive innovation investments within military departments, and (2) annually assess whether that mix is achieved to better align with leading commercial companies’ approaches to innovative technology development.

In addition, in March 2021 and June 2022, we identified gaps in DOD’s leadership and oversight of innovative investments in hypersonic missiles. We also found that DOD lacked the workforce needed to support large-scale production and testing of hypersonic weapons. Further, in April 2022, we found that DOD’s prototyping plan for uncrewed maritime systems lacked key strategies to successfully transition the efforts to acquisition programs and help maximize its significant investments.

What Remains to Be Done

• update DOD acquisition policies to fully implement the key product development principles used by leading companies;
• develop and use performance measures to monitor the aggregate effectiveness of mitigation efforts for DOD-wide industrial base risks; and
• define the desired mix of incremental and disruptive innovation investments within military departments and annually assess whether that mix is achieved.

Congressional Actions Needed

• requiring DOD to report on each major acquisition program’s systems engineering status in the department’s annual budget request, beginning with the budget requesting funds to start development; and
• revising Section 224(d) of the National Defense Authorization Act for Fiscal Year 2017, Pub. L. No. 114-328, to extend DOD’s reporting requirement for Block 4 of the F-35 program until all Block 4 capabilities are fielded to ensure that Congress is aware of cost and schedule growth beyond 2023.

Benefits

Progress in the acquisition of DOD weapon systems has led to more than $250 billion in financial benefits and more than 400 other benefits. For example:

• DOD implemented the Weapons Systems Acquisition Reform Act of 2009, which codified a number of leading acquisition practices we first recommended, to avoid an estimated $36 billion in development costs and $136 billion in procurement costs over 5-year periods.
• DOD established a plan, approved in February 2022, to assess the effects of recent acquisition reform efforts. Our work found that, without such a plan, DOD risked not achieving an effective balance between oversight and accountability and efficient program management.
• In March 2022, the U.S. Army issued guidance for acquisition programs on how to incorporate tailored weapon systems cybersecurity requirements, acceptance criteria, and verification processes into contracts.
• DOD updated guidance in July 2022 to provide more useful information about the total cost of warfighting capabilities that use multiple efforts or acquisition pathways.

Contact Information

For additional information about this high-risk area, contact Shelby S. Oakley at (202) 512-4841 or [email protected].

DOD Financial Management

Bookmark:

Why Area Is High Risk

Capacity: partially met. DOD’s updated fiscal year 2022-2026 Financial Management Strategy continues to focus on the need to build and maintain a premier financial management workforce. It also continues to reduce the number of legacy financial management systems and leverage a single enterprise data and analytics platform to assist with fiscally informed decisions and management reporting. In September 2020, we reported that DOD’s Information Technology strategic plan lacked performance measures for tracking progress in achieving the strategy’s goals. We also reported that DOD could not identify a complete listing of its financial management systems that support the preparation of the department’s financial statements. DOD has not yet fully addressed these issues. Additionally, in February 2022, we reported that the U.S. Air Force did not have a systems migration plan that followed leading practices for transitioning from its legacy system to its new core accounting system.

Action plan: partially met. DOD and its components continue to take steps to prioritize audit remediation efforts and develop corrective action plans to address findings reported by its external auditors. To this end, the Secretary of Defense has targeted three priority areas in fiscal year 2022 for improving financial statement audit results: (1) Fund Balance with Treasury – to establish processes and controls to more timely record cash collections and disbursements, (2) Establish User Access Controls – to enhance security over critical IT systems, and (3) Creating a Universe of Transactions and Financial Reporting Internal Controls – to help DOD compile and validate a complete listing of transactions from all accounting systems.

However, in the recently completed FY 2022 financial statement audits, material weaknesses remain for each of these priority areas. Additionally, DOD has not yet fully addressed key deficiencies we reported in October 2020 pertaining to its corrective action plan process, such as ensuring a root cause analysis is performed and documented. Also, DOD has not yet issued the detailed implementation plans to carry out the financial management transformation strategies included in its newly issued FY 2022-2026 Financial Management Strategy.

Monitoring: partially met. DOD continues to prioritize financial statement audit remediation areas for addressing material weaknesses. In addition, DOD components are developing roadmaps for how they can achieve clean audit opinions. These roadmaps outline critical remediation tasks, dependencies, and timelines for completion. They also can serve as a mechanism for DOD’s leaders to monitor the department’s audit remediation progress. However, these roadmaps are inconsistent across the components and measures of success are vague.

Demonstrated progress: partially met. DOD continues to make some progress in addressing its financial management challenges. For example, in FY 2022, it completed its fifth entity-wide financial statement audit. However, the DOD Inspector General reported 28 material weakness in its FY 2021 and FY 2022 DOD audits compared to 26 at the time of our 2021 high-risk update. Additionally, DOD has remediated audit deficiencies at a slower rate in recent years as it works to address more complex issues such as weaknesses in its financial management systems.

What Remains to Be Done

• establishing specific time frames for developing an enterprise road map to implement DOD’s financial management systems strategy, continuing efforts to identify a complete inventory of financial management systems, and developing detailed system migration plans where new systems will replace legacy accounting systems;
• improving its corrective action plan review process, including ensuring that (1) data elements missing from corrective action plans are appropriately identified and communicated to DOD’s components and resolved; (2) Notices of Findings and Recommendations (i.e., auditors’ findings and recommendations) are appropriately linked to the appropriate corrective action plans to address them; and (3) components document their rationale for accepting the risk associated with certain deficiencies and identify such instances in the Notice of Findings and Recommendations Database; and
• continuing efforts to implement policies and procedures to address suspense account deficiencies (see fig. 16) including developing and implementing DOD-wide guidance for identifying and remediating the root causes of control deficiencies in its suspense account processes. Suspense accounts temporarily hold financial transactions—such as transactions with missing or incomplete documentation—that require further research before they are permanently recorded to the proper accounts in an accounting system.

Benefits

Contact Information

For additional information about this high-risk area, contact Asif A. Khan at (202) 512-9869 or [email protected].

DOD Business Systems Modernization

Bookmark:

The Department of Defense (DOD) needs to improve management of its business systems acquisitions and complete updates to its federated business enterprise architecture and the realignment of responsibilities previously assigned to the former Office of the Chief Management Officer (CMO).

Why Area Is High Risk

DOD’s Business Systems Acquisition Management

Leadership commitment: partially met. We reported in our 2021 High-Risk Report that the National Defense Authorization Act (NDAA) for Fiscal Year 2021 repealed the CMO position. Thus, DOD needed to implement statutory requirements regarding the roles and responsibilities for business systems acquisition management previously assigned to the CMO. DOD has begun implementing these requirements. For example, we reported that, in September 2021, the Deputy Secretary of Defense assigned the Under Secretary of Defense (Comptroller) (USD(C)) and the Chief Information Officer (CIO) with the shared responsibility for issuing supporting guidance for coordinating and making decisions about covered defense business systems.

In addition, we reported in June 2022 that a DOD official stated the department planned to change its defense business systems investment management policy and guidance for the fiscal years 2023 and 2024 investment review and approval cycles. For example, according to DOD, the guidance will require business systems to align to specific performance measures. DOD officials also stated the department plans to subsequently adjust acquisition policies and guidance.

However, DOD leaders need to exercise consistent leadership to ensure the department successfully implements its plans to update key guidance, as we have reported in our past High-Risk Report updates. Consistent with what we reported in 2019, DOD has faced frequent changes in leadership positions responsible for managing its business system investments. In addition, DOD has not taken consistent and sustained steps toward completing planned actions and addressing our long-standing open recommendations.

Capacity: partially met. In September 2021, DOD reassigned policy, guidance, and business systems investment oversight responsibilities to the DOD CIO and USD(C). As of February 2023, officials from DOD’s Offices of the Director of Administration and Management and Chief Information Officer stated that the department plans to revisit a human capital analysis previously developed by the former Office of the CMO. Additionally, they will determine the appropriate next steps for implementing the outstanding planned actions. These planned actions included reviews intended to, among other things, identify skills and other resource gaps. However, DOD officials did not provide a date for when they anticipate completing these planned actions.

Action plan: not met. In December 2022, officials within the Office of the CIO stated that the department intends to develop a plan to address this high-risk area. However, these officials did not provide a date for when they anticipate completing this action plan.

Monitoring: partially met. DOD provides information to the federal IT dashboard. This dashboard is a public website that allows federal agencies and the public to view details of federal IT investments and to track their progress over time. It may allow the department to document progress in improving business system acquisition outcomes. However, DOD does not have the means to monitor broader progress in improving its business systems acquisition management efforts. It does not have an action plan with milestones and metrics to allow the agency to measure progress.

Demonstrated progress: partially met. DOD has had mixed success in delivering business systems investments that meet cost, schedule, and performance commitments. For example, we reported in June 2022 that each of the 25 major DOD business IT programs had identified metrics for reporting performance on the federal IT dashboard. However, we also reported that major DOD business IT programs were not reporting complete data to the federal IT dashboard. For example, as figure 17 shows, six programs fully reported performance data, eight programs reported incomplete data, and 11 programs did not report performance data. Officials from the Office of the CIO stated that programs that have performance measures should be reporting them to the dashboard.

DOD’s Business Systems Investment Management Process

Leadership commitment: partially met. As we reported in our 2021 High-Risk Report, the NDAA for Fiscal Year 2021 repealed the CMO position. Thus, DOD needed to implement statutory requirements regarding the roles and responsibilities for business systems acquisition management previously assigned to the CMO. In response, in September 2021, the Deputy Secretary of Defense directed a broad realignment of the responsibilities previously assigned to the CMO. As a result, DOD leadership needs to re-establish momentum for addressing our recommendations regarding the investment process.

DOD’s Federated Business Enterprise Architecture

However, since our 2021 High-Risk Report, the department has again revamped its efforts to improve its business enterprise architecture. DOD needs to ensure that it exercises consistent leadership over the business enterprise architecture. It also needs to ensure that planned updates to the architecture are competed. For example, we reported in June 2022 that DOD officials stated the department was reviewing its portfolio management processes. They added that DOD is also working to integrate those processes with the business enterprise architecture and the associated information enterprise architecture. In January 2023, officials from the Office of the DOD CIO stated that DOD will begin coordinating the modernized business enterprise architecture framework across the department no later than March 2023.

Capacity: partially met. DOD’s business enterprise architecture is a tool to provide DOD with the capacity to make sound investment decisions. It also serves as a blueprint for the department’s business transformation efforts. However, we reported in July 2015 that DOD’s business architecture was not fully achieving its intended outcomes. As of February 2023, the offices taking on former CMO responsibilities have yet to update the business enterprise architecture.

Action plan: decreased to not met. In December 2022, officials within the Office of the DOD CIO stated that the department will develop a plan intended to include specific actions and associated milestones to address this high-risk area. However, these officials did not provide a date for when they anticipate completing this action plan.

Monitoring: decreased to not met. As of February 2023, the department had not developed a plan with tasks and associated milestones to monitor its efforts to update its business enterprise architecture.

Demonstrated progress: partially met. DOD has established the capacity to identify potentially duplicative investments. It also provided examples of benefits attributed, at least in part, to its business enterprise architecture. Nevertheless, the department is revamping its approach to its business enterprise architecture. It has yet to demonstrate that it is assessing potential duplication and overlap actively and consistently to eliminate duplicative systems. Further, DOD needs to demonstrate progress in addressing our remaining open recommendations. These include solidifying its approach to improving the business enterprise architecture and integrating its business and IT architectures.

What Remains to Be Done

Benefits

• DOD cancelled the Air Force’s Expeditionary Combat Support System because of increased oversight, issues with program life-cycle costs, and implementation weaknesses. As a result, DOD avoided almost $1 billion in planned program expenditures.
• DOD completed business process re-engineering documentation for the Integrated Personnel and Pay – Army system. This helps ensure that its business processes are streamlined and as efficient as practicable.
• DOD improved the information used to develop its budget requests and make oversight decisions. This reduces the risk that it will make investment decisions based on unreliable information.

Contact Information

For additional information about this high-risk area, contact Vijay A. D’Souza at (202) 512-7650 or [email protected].

DOD Approach to Business Transformation

Bookmark:

Why Area Is High Risk

The council supports business transformation by overseeing the coordination of DOD business planning and reporting and aligning both with business operation plans and resources. The Defense Business Council is tri-chaired by the Director of Administration and Management, the Under Secretary of Defense (Comptroller)/Chief Financial Officer, and the Chief Information Officer. Council membership consists of the Under Secretaries of Defense, DOD General Counsel, the Director of Cost Assessment and Program Evaluation, the Director of the Joint Staff, and the Military Departments’ Chief Management Officers. DOD has also taken steps to build performance improvement efforts into core department operations, such as the Planning, Programming, Budgeting, and Execution process and performance evaluations of DOD’s Senior Executive Service members. In part because of these actions, DOD has taken sufficient action to close our 2015 recommendation that it ensure the COO leads Agency Priority Goal meetings.

Moving forward, it will be important for DOD to demonstrate that this new leadership approach, focused on the Deputy Secretary, allows for crosscutting department-wide reforms, where needed, to be developed and implemented. DOD officials have stated that the Director/Performance Improvement Officer will use the Deputy Secretary’s priorities and reforms identified at the component levels to identify potential sources for crosscutting reforms. The Director/Performance Improvement Officer does not plan to initiate crosscutting reforms because as Office of the Director of Administration and Management (Director’s Office) officials told us, they do not have the authority to direct specific reform efforts without direction from the Deputy Secretary of Defense. They also said that their work is inherently cross functional. They are currently re-establishing relationships across the department since the disestablishment of the CMO position. Moving forward, we will assess the extent to which DOD’s new leadership approach, focused on the Deputy Secretary, allows for department-wide reforms to be developed and implemented.

Capacity: partially met. DOD established the Performance Improvement Directorate within the Director of Administration and Management’s Office in February 2022. As of December 2022, Director’s Office officials stated they were still hiring staff and building capacity to oversee DOD reform efforts. Director’s Office officials stated that a recent reorganization put DOD’s Audit Management function under Director’s Office control. They say they expect this to augment their office’s capacity. As a result, these officials stated that the office is budgeted for 45 full-time equivalent staff. As of December 2022, the officials stated that the office had filled 35 of these positions. It will be important for the Director’s Office to fill open positions and ensure its full-time equivalent staff is sufficient to support the office’s responsibilities to monitor reform initiatives across the agency effectively.

In addition, DOD’s new approach to business transformation places greater emphasis on the involvement of component heads and principal staff assistants. This includes the Under Secretaries of Defense and other Office of the Secretary of Defense officials who report directly to the Secretary or Deputy Secretary of Defense. Such action will allow for the development and implementation of reform efforts. As a result, the capacity of these organizations to fulfill these responsibilities directly affects the department’s overall capacity to engage in business reforms. For example, an official from the Office of the Under Secretary of Defense for Acquisition and Sustainment stated that the dissolution of the CMO position shifted responsibility for one reform effort to his office. This, in turn, he said limited his office’s capacity to implement this effort. In addition, according to Navy officials, the Navy office responsible for overseeing reform efforts was considerably downsized from a team of 21 staff to four. This occurred after DOD’s CMO position was eliminated because of a shift in Navy priorities. The Navy has recently begun rebuilding that office’s team up to nine staff according to Navy officials. Further, as discussed in our other high-risk areas involving DOD business operations, such as business systems modernization, the capacity of the department to address ongoing challenges within these operations remains a concern.

Action plan: met. DOD released its Strategic Management Plan in August 2022. The plan replaced its previous National Defense Business Operation Plan, which was in place through fiscal year 2022. The Strategic Management Plan reflects the department’s new approach of incorporating performance improvement efforts into existing processes and forums. It includes reforms to specific business areas within some of its identified goals, such as modernizing and consolidating DOD networks and services. Other reforms include ensuring supply chain resilience and implementing health care transformation efforts. Department officials are now implementing the Strategic Management Plan and its related Performance Improvement Framework, including developing more detailed guidance and reporting tools.

Monitoring: partially met. DOD continues to enhance its monitoring efforts by, among other things, developing new management frameworks and expanding its data analytics platform called Advana. DOD’s Strategic Management Plan includes a framework for monitoring progress on the plan, including establishing performance baselines. In addition, DOD’s Performance Improvement Framework provides a new approach to identifying, tracking, and reporting on reform efforts in the department.

In November 2022, the Director/Performance Improvement Officer and the Under Secretary of Defense (Comptroller) issued guidance for data collection to support reporting under the Performance Improvement Framework using an application housed in the Advana platform. DOD plans to use an Advana application called Pulse for reporting under the framework, as well as for monitoring implementation of the Strategic Management Plan. Pulse will also incorporate DOD’s existing Business Health Metrics application. This application provides DOD leadership with an overview of how the department’s business operations are performing. According to Director’s Office officials, parts of the reporting tools in Pulse are still under development. In addition, regular reporting using them has yet to begin.

Demonstrated progress: partially met. Consistent with statutory requirements, DOD has made progress in transitioning the former CMO’s responsibilities to appropriate elements and organizations within the department, such as the Director/Performance Improvement Officer and other principal staff assistants. In addition, Director’s Office efforts over the last year to integrate performance improvement into key institutional functions show that department officials are working to ensure that any progress in reform efforts can be sustained across fiscal years and across administrations. The work to lay this foundation, which Director’s Office officials stated will take years to fully implement, has taken place concurrently with reorganizing and reassigning responsibilities that had been the purview of the CMO. This contributed to delays in issuing both the Strategic Management Plan and the Performance Improvement Framework. They were initially required to be issued in February 2022 (the required date for the Framework was later extended) but were issued in August and October 2022, respectively.

According to Director’s Office officials, responsibility for reform initiatives previously led by cross-functional teams that reported to the CMO were moved to the relevant DOD offices. For example, responsibility for the effort to improve and standardize the department’s time-to-hire measure, as a part of its human resources service delivery, moved to the Office of the Under Secretary of Defense for Personnel and Readiness. However, it is unclear whether these offices have maintained the efforts. As a part of its data collection for the Performance Improvement Framework in November 2022, the Director/Performance Improvement Officer has requested information on the status of these initiatives.

Staff from the military departments and offices within the Office of the Secretary of Defense told us that some of their individual reform efforts continued during the period of CMO dissolution. However, some staff also told us that reform was de-emphasized when the CMO position was disestablished. They added that they were awaiting guidance from the Director/Performance Improvement Officer on how to define and report on the ongoing efforts.

DOD’s Annual Performance Report for Fiscal Year 2021 reported progress on various business reform efforts in support of the department’s strategic goals. This includes data center consolidation, business system modernization, and improvements to financial management. However, the report lacked outcome-oriented reporting on business reform efforts because, according to Director’s Office officials, the group responsible for monitoring these efforts was disbanded at the same time the CMO was disestablished.

According to Director’s Office officials, full reporting under the new Performance Improvement Framework will not begin until fiscal year 2024. However, they plan to issue an initial report in 2023. DOD officials have stated that they are placing less emphasis on financial savings as the primary indicator of progress. Instead, they are considering other performance indicators to determine progress. We will monitor reporting under the new framework to assess the extent to which DOD reform efforts are demonstrating meaningful progress, whether financial or otherwise.

What Remains to Be Done

• routinely and comprehensively monitor and evaluate ongoing efficiency initiatives, including establishing baselines from which to measure progress, periodically reviewing progress made, and evaluating results; and
• consistently report reform savings based on definitions of reform.

In addition, DOD should continue to implement the Performance Improvement Framework. This includes integrating it into relevant department processes and following through on the development of implementing guidance where required.

DOD should also demonstrate that its new leadership approach allows for crosscutting department-wide reforms, where needed, to be developed and effectively implemented.

Benefits

Progress in the DOD approach to business transformation high-risk area totaled more than $50 million as a result of DOD’s increased use of private labels at its commissaries and nearly 20 other benefits to the federal government.

It will be important for DOD to continue to ensure that it updates and follows through on actions that yielded these benefits in the past.

Contact Information

For additional information about this high-risk area, contact Elizabeth Field at (202) 512-2775 or [email protected].

Ensuring the Cybersecurity of the Nation

Bookmark:

Federal agencies can strengthen cybersecurity by fully establishing and effectively implementing a comprehensive national cyber strategy, a government-wide cyber workforce plan, strategies for monitoring privacy programs, and critical infrastructure cyber protections.

Why Area Is High Risk

The rating for Leadership Commitment increased from partially met to met as a result of Congress establishing the Office of the National Cyber Director in the White House to lead the nation’s cybersecurity effort. The remaining four criteria ratings remain unchanged since 2021. Although federal agencies have made some improvements, continued issues challenge the federal government’s efforts to ensure the cybersecurity of the nation, including the urgent need for

Capacity: partially met. Federal agencies have made progress in improving their cybersecurity workforce practices. For example, 18 agencies have taken steps to identify and categorize all of their vacant IT and cyber-related positions. However, federal agencies need to take additional action to address challenges faced by federal and nonfederal critical infrastructure entities in hiring, training, and retaining their cybersecurity and privacy workforces. For example,

• The Office of Management and Budget needs to develop a government-wide workforce plan that addresses the federal cybersecurity workforce shortage.
• Eleven of the 24 Chief Financial Officer Act agencies need to continue to identify cyber workforce needs and fully implement key IT workforce planning practices.
• Thirteen of the 24 Chief Financial Officer Act agencies need to fully define and document processes for privacy workforce management, including assessing and addressing the hiring, training, and professional development needs of the agency with respect to privacy.

Action plan: partially met. Federal agencies have issued several plans to outline actions that need to be taken to address cybersecurity and privacy challenges, such as the current administration’s May 2021 cybersecurity executive order. However, we recommended in September 2020 that the federal government should develop a national cybersecurity strategy that addresses all of the desirable characteristics of national strategies. On March 2, 2023, the White House issued the National Cybersecurity Strategy to articulate the administration’s planned approach to managing the nation’s cybersecurity. In particular, the National Cybersecurity Strategy includes goals and objectives focused on securing critical infrastructure, disrupting malicious cyber threat actors, and advancing U.S. interests in cyberspace through continued international diplomacy, among others.

The goals and strategic objectives included in the recently issued strategy provide a good foundation towards establishing a more comprehensive strategy, but more effort is needed to address all of the desirable characteristics of national strategies (e.g., milestones, performance measures, resources needed to carry out goals and objectives, and fully defined roles and responsibilities). According to the National Cybersecurity Strategy, the Office of the National Cyber Director will work with federal agencies to develop an implementation plan to articulate the lines of effort needed to implement this strategy. Until the federal government fully establishes and carries out an implementation plan for the National Cybersecurity Strategy, overall progress in addressing this urgent area will remain limited.

Monitoring: partially met. Federal agencies continue to monitor progress toward meeting cybersecurity-related targets for cross-agency priority goals and implementing effective cybersecurity programs. However, federal agencies need to take additional action to measure the performance of their cybersecurity and privacy programs, as well as progress that critical infrastructure organizations are taking to manage cyber risk. For example:

• The federal government needs to fully establish and implement a comprehensive national cyber strategy that includes, among other things, assigning roles and responsibilities.
• Six of the nine sector risk management agencies—agencies that assist in protecting critical infrastructure owners and operators, including enhancing cybersecurity—need to better measure the progress that critical infrastructure entities are making toward addressing cybersecurity risk.
• Federal financial regulatory agencies need to improve practices needed to monitor privacy protections, such as maintaining a full inventory of personally identifiable information for all agency-owned applications and establishing metrics to monitor privacy controls.

Demonstrated progress: partially met. Although agencies have made some improvements, they need to urgently address the 10 critical actions associated with four major cybersecurity challenges that we have identified (see figure 18).

• fully establish and implement a comprehensive national cyber strategy to have a clear roadmap for overcoming the cyber and privacy challenges facing our nation;
• fully establish and implement cyber risk management programs;
• develop methods for determining the level and type of adoption of the National Institute of Standards and Technology’s Framework for Improving Critical Infrastructure Cybersecurity by the critical infrastructure entities; and
• fully establish privacy programs by appointing a senior-level official with privacy as a primary area of responsibility.

What Remains to Be Done

• fully establish and implement the national strategy;
• fully establish and implement cybersecurity risk management programs;
• increase their efforts to develop methods for determining the level and type of adoption of National Institute of Standards and Technology’s cybersecurity framework by the critical infrastructure entities; and
• fully establish privacy programs to ensure that they are consistently implementing privacy protections for sensitive information.

Congressional Actions Needed

• consider legislation to designate a senior privacy official—a position with the organizational placement necessary to coordinate with other agencies and the necessary authority to ensure that privacy requirements are implemented—at agencies that currently lack such a position;
• provide the Federal Trade Commission with civil penalty authority to ensure that the agency can enforce the privacy and safeguarding provisions of the Gramm-Leach-Bliley Act more effectively;
• strengthen the consumer privacy framework to reflect the effects of changes in technology and the marketplace and review issues such as the adequacy of consumers’ ability to access, correct, and control their personal information, and privacy controls related to new technologies; and
• amend laws, such as the Privacy Act of 1974 and the E-Government Act of 2002, because they may not consistently protect personally identifiable information.

Benefits

• In September 2020, we recommended that Congress consider legislation to designate a leadership position in the White House that will lead the nation’s efforts to protect its cyber critical infrastructure. In 2021, Congress enacted legislation that established the Office of the National Cyber Director to serve as the principal advisor to the President on cybersecurity policy and strategy.
• In December 2018, we reported numerous deficiencies in the Centers for Disease Control and Prevention’s cybersecurity program and controls. These deficiencies placed sensitive information at risk, including unauthorized disclosure and modification. In response, the Centers for Disease Control and Prevention implemented all of the 195 recommendations we made to strengthen its cybersecurity controls.
• In December 2018 and June 2019, we reported that the Transportation Security Administration’s pipeline security program had several weaknesses, including not having a documented process to update pipeline security guidance regularly. In response, the Transportation Security Administration fully addressed 10 of 13 recommendations by clarifying its pipeline security guidelines and improving performance monitoring, among other areas.

Contact Information

For additional information about this high-risk area, contact Marisol Cruz Cain at (202) 512-5017 or [email protected].

Strengthening Department of Homeland Security IT and Financial Management Functions

Bookmark:

The Department of Homeland Security (DHS) has made progress addressing major management challenges but needs to address remaining challenges in IT—specifically IT security controls and information systems—and financial management.

Why Area Is High Risk

Since the 2021 High-Risk List, the criteria ratings are unchanged. While DHS demonstrated substantial progress in some of its management functions, it has critical additional work to do in the areas of IT and financial management.

• Human capital management and acquisition management. Since our 2021 High-Risk List, DHS has fully addressed its human capital management outcomes. DHS implemented a strategic human capital plan, established a mechanism to centrally collect training data from across the department, and used training data to inform management decisions.

  However, like many other federal agencies, DHS continues to face broader challenges in workforce planning, employee skills gaps, and employee morale. We will continue to monitor DHS’s efforts to address these workforce issues, including its efforts to improve employee engagement, as a part of government-wide efforts in our Strategic Human Capital Management high-risk work and through our priority recommendations to DHS.

  DHS has also taken steps to fully address its remaining outcomes in acquisition management including maturing its requirements development process and improving its acquisitions workforce management. DHS has also implemented new policies and processes to improve acquisition data quality and oversight to help ensure that its major programs achieve their cost, schedule, and capability goals.

• IT management. DHS has made progress implementing recommendations from DHS’s Office of Inspector General (OIG) and addressing our high-risk IT management outcomes. However, more work remains for DHS to strengthen its information security program.

  For instance, in 2022, the OIG found that DHS’s information security program was ineffective for fiscal year 2021 because it did not apply security patches and updates in a timely manner, among other things. Additionally, in 2022, DHS’s financial statement auditor continued to designate deficiencies in IT systems control as material weaknesses for financial reporting purposes. These deficiencies included ineffective design and implementation of controls to address security management, access controls, configuration management, and segregation of duties.

  To help address these long-standing issues, DHS’s July 2021 Improving Cybersecurity Implementation Report to the Office of Management and Budget mentioned that the department implemented a model to guide how it measures cybersecurity maturity. DHS also consolidated security and network operations to improve operational and security situational awareness.

  DHS also has plans to improve its cybersecurity in response to the 2020 compromise of SolarWinds Orion, an enterprise network management software suite that was the target of a widespread hacking campaign. For example, DHS plans to strengthen its threat identification and response capability by implementing an endpoint detection and response tool. This will allow it to effectively monitor and protect against malicious activities in its networks that an anti-virus software or host-based intrusion prevention tool was unable to monitor.

  However, until DHS mitigates the vulnerabilities identified by its OIG and financial statement auditor, the data maintained on its systems will remain at increased risk of unauthorized modification and disclosure and systems will remain at risk of disruption.

• Financial management. DHS received an unmodified (clean) audit opinion on its consolidated financial statements for 10 consecutive years—fiscal years 2013 to 2022. However, DHS continued to receive a separate adverse opinion on its internal controls over financial reporting also for the 10^th consecutive year because it did not design and fully implement control activities to provide reasonable assurance its financial management systems would produce reliable reporting of financial information.

  The fiscal year 2022 audit found that prior material weaknesses in internal controls in the areas of (1) financial reporting, and (2) IT controls and information systems remain unresolved. Further, because of persistent issues related to insurance liabilities, the auditor reported this area as a material weakness, elevating it from a significant deficiency as reported in fiscal year 2021. In addition, for fiscal year 2022, a fourth material weakness was reported for the U.S. Coast Guard’s newly implemented financial management system’s ineffective design of controls over review of obligations incurred and the accuracy of expenditure records. The DHS auditor also continued to report that agency financial management systems did not comply substantially with Federal Financial Management Improvement Act of 1996 requirements. This includes federal financial management system requirements, applicable federal accounting standards, and the U.S. Standard General Ledger at the transaction level.

  Much work remains to modernize DHS components’ financial management systems and business processes. FEMA and ICE’s modernization efforts remain in the planning stages, with the estimated implementation initially planned for 2025 and 2026, respectively. In addition, the Coast Guard needs to resolve (1) internal control issues identified by the auditor related to the implementation of its new system, and (2) other serious findings identified in its system testing results prior to declaring full operational capability. Without implementing modernized systems with fully effective controls, DHS is at an increased risk of errors and inconsistent or incomplete financial information from the use of manual and other control solutions.

• Management Integration. DHS has implemented actions in each of its four management functions. It is working to address its remaining challenges. To fully address the remaining management integration outcome, DHS must continue to demonstrate sustainable progress integrating its management functions within and across the department. This is particularly true with respect to integrating its financial management and IT systems. DHS must also address the remaining seven outcomes in financial and IT management.

What Remains to Be Done

• making improvements to its IT security program,
• continuing its financial system modernization efforts and remediating known issues; and
• continuing efforts to ensure key controls are in place to address material weaknesses.

Benefits

• Our work found that DHS acquisition programs were not matching their needs with available resources before starting product development. We recommended DHS update its acquisition policy, which it did in 2021.
• Our work identified a need for DHS and component human capital officials to examine the root causes of its employee engagement data and to link its results to action plans. DHS addressed these by establishing a committee and using new survey analysis techniques.
• Our work found a need for improvements in how DHS develops operational requirements for its acquisitions. In response, DHS issued a policy directive requiring components’ requirements development policies to be consistent with agency level policy, and that these policies be shared within DHS to ensure alignment with DHS policy.

Contact Information

For additional information about this high-risk area, contact Chris Currie at (404) 679-1875 or [email protected].

Ensuring the Effective Protection of Technologies Critical to U.S. National Security Interests

Bookmark:

Why Area Is High Risk

Leadership commitment: increased to met. DOD has taken actions to improve its leadership in this high-risk area. For example, DOD officials assigned the responsibility for overseeing protection of critical programs and technologies to the Office of the Under Secretary of Defense for Research and Engineering. This move addressed a recommendation we made in January 2021.

Since then, Research and Engineering has taken an active role in overseeing protection actions, including coordinating with senior military service leaders to create an annual list of critical programs and technologies. In addition, in July 2022, the office issued a Technology and Program Protection Guidebook. This guidebook provides guidance to science and technology managers and engineers on implementing a DOD instruction on technology and program protection. According to DOD officials, the office is also updating a DOD-wide instruction that will standardize definitions and clarify terms used in technology protection. Military service leaders said that they are also updating their policies that guide service actions to protect critical programs and technologies. Further, the White House identified core technologies that need to be protected by updating its National Strategy for Critical and Emerging Technologies in 2022.

Capacity: partially met. In April 2021, Treasury officials stated that the agency coordinated with member agencies of the Committee on Foreign Investment in the United States to assess their staffing requirements, as we recommended in February 2018. Treasury officials said additional resources—including those authorized by the Foreign Investment Risk Review Modernization Act of 2018—have improved the committee’s ability to carry out core functions. In addition, DOD Research and Engineering officials told us that their department received a few additional staff to help carry out functions relating to the protection of critical programs and technologies, in addition to other office activities.

However, DOD officials said they have yet to determine the full costs of implementing measures to protect critical programs and technologies across the department. Also, DOD is continuing efforts to build capacity to conduct cost assessments and train its workforce.

Action plan: partially met. DOD is continuing to implement the four-step process it uses as its action plan to identify and protect critical programs and technologies (see fig. 20). For example, in January 2021, the Deputy Secretary of Defense issued guidance detailing how DOD would communicate its annual list of critical programs and technologies internally and with other federal agencies, as we previously recommended.

Commerce and State provided additional guidance and outreach related to university-specific export control issues that addresses recommendations we made in May 2020. U.S. Immigration and Customs Enforcement also acted to protect against sensitive technology transfer and unauthorized exports by implementing recommendations we made in June 2022.

As of February 2023, Commerce and the Federal Bureau of Investigation indicated that they are taking actions to address measures in university-related export control recommendations, and we are currently in the process of evaluating those efforts. Specifically, we recommended that agencies periodically assess the relevance and sufficiency of risk factors they use to identify universities at greater risk for sensitive technology transfers and unauthorized exports.

Monitoring: partially met. DOD took some initial steps to monitor the effectiveness of protection efforts. For example, in 2021, DOD began partnering with a federally funded research and development center to develop metrics for assessing protection measures, as we recommended in January 2021. A DOD official stated that it will likely take a couple of years before the metrics are developed. Officials said that DOD also initiated—but has not completed—actions to develop corresponding metrics for and measure progress of its antitamper program. This is intended to deter or delay exploitation of critical programs and technologies by foreign adversaries.

Demonstrated progress: partially met. Agencies made some progress protecting critical programs and technologies. For example, the Office of Research and Engineering seeks to help stakeholders improve the protection of sensitive, unclassified information related to critical programs and technologies. In addition, DOD officials told us they have put increased emphasis on identifying technologies that need protection early in the acquisition life cycle. This focus has resulted in a significant increase in the number of technologies included on DOD’s list, according to DOD officials.

However, DOD is in the early stages of implementing its process to identify and protect critical programs and technologies. It also needs metrics to determine the effectiveness of protection efforts. Further, as of February 2023, we continue to assess other agencies’ actions to protect sensitive, unclassified information, including research conducted in a university setting.

What Remains to Be Done

• identifying, developing, and periodically reviewing appropriate metrics to assess the implementation and sufficiency of the assigned protection measures; and
• identifying, sharing, and assessing relevant risk factors to identify universities at greater risk for sensitive technology transfers, including unauthorized deemed exports.

Benefits

• DOD designated the Office of the Under Secretary of Defense for Research and Engineering to oversee the protection of critical programs and technologies. This involves the protection of controlled unclassified information.
• DOD formalized a process to share its list of critical technologies with other federal agencies and ensure consistent protection across the government.
• The Committee on Foreign Investment in the United States received additional resources to increase its efficiency in reviewing covered transactions such as certain foreign acquisitions and mergers.

Contact Information

For additional information about this high-risk area, contact William Russell at (202) 512-4841 or [email protected]

Improving Federal Oversight of Food Safety

Bookmark:

Why Area Is High Risk

Leadership commitment: partially met. Since 2021, USDA and the Department of Health and Human Services (HHS) have demonstrated leadership by continuing to include crosscutting food safety efforts in their strategic and planning documents, as we recommended in December 2014. For example, in 2021, FDA issued a plan to improve its response to foodborne outbreaks. According to the plan, FDA will work with other federal agencies to identify strains of foodborne pathogens.

However, federal agencies have developed neither a national plan nor strategy for food safety. The Food Safety Working Group (FSWG) previously provided a mechanism for a government-wide strategic approach. FSWG was established in 2009 to coordinate federal efforts and develop goals to make food safer. However, as we reported in 2014, the group had not met since 2011 (see fig. 21).

Furthermore, Congress has not directed the Office of Management and Budget to develop a government-wide performance plan for food safety to address our December 2014 matter. In addition, the administration has developed neither such a plan nor, alternatively, a national strategy for food safety, as we recommended in January 2017.

Identifying resources needed to carry out the food safety mission is an important part of a government-wide performance plan or, alternatively, a national strategy for food safety that includes nonfederal stakeholders. Developing such a plan or strategy that encompasses the contributions of all federal agencies with a food safety role would increase federal capacity to improve food safety oversight. It could also address our December 2014 matter and our January 2017 recommendation.

Action plan: not met. The lack of a government-wide performance plan or a national strategy for food safety hampers decision makers in identifying agencies and programs that address similar missions. It also prevents them from setting priorities, allocating resources, and restructuring federal efforts, as needed, to achieve long-term goals. Without such a centralized collaborative mechanism, agencies are limited in their ability to develop broad-based food safety goals and objectives.

Monitoring: not met. A government-wide performance plan or national strategy for food safety could facilitate effective monitoring of federal food safety efforts. This is particularly true for those involving more than one agency. Such a plan or strategy could also better inform Congress and the public. In addition, it could identify areas needing corrective measures.

Demonstrated progress: partially met. FDA and USDA continue to collaborate on food safety through joint working groups and information sharing practices, such as the Interagency Risk Assessment Consortium. While these types of collaborations can help the federal government move toward developing a government-wide performance plan for food safety, the current agency-by-agency focus does not provide the integrated perspective necessary to guide decision-making and inform the public. A government-wide performance plan or national strategy could enhance collaboration among agencies that have a food safety role, such as CDC, the National Marine Fisheries Service, and Customs and Border Protection.

What Remains to Be Done

There has not been appreciable progress since our last update. No entity has assumed leadership responsibility for coordinating food safety efforts across the federal government. Since we added food safety to our High-Risk List in 2007, we have made numerous recommendations to enhance collaboration among agencies with food safety responsibilities. As of February 2023, three recommendations remain open, of which one is significant for removing this area from the High-Risk List:

• In January 2017, we recommended that appropriate entities within the Executive Office of the President, in consultation with relevant federal agencies and other stakeholders, develop a national strategy for food safety that, among other things, establishes high-level sustained leadership, identifies resource requirements, and describes how progress will be monitored. The Executive Office of the President did not provide comments on our recommendation.

Congressional Actions Needed

• directing the Office of Management and Budget to develop a government-wide performance plan for food safety that includes results-oriented goals and performance measures, and a discussion of strategies and resources; and
• formalizing the FSWG to help ensure sustained leadership across food safety agencies over time.

If weaknesses in food safety oversight persist, Congress may wish to consider

• commissioning the National Academy of Sciences or a blue ribbon panel to conduct a detailed analysis of alternative organizational food safety structures and report the results of such an analysis to Congress.

Benefits

• In 2020, FDA and USDA each took actions to clarify that FDA will oversee cell-cultured seafood other than catfish, in response to our April 2020 recommendation. The public and other key stakeholders now have greater clarity on the agencies’ oversight responsibilities in this area.
• Also in 2020, FDA and USDA began ongoing discussions of relevant food safety research, including detection methods in contaminants in food. We found that the agencies did not have a mechanism to coordinate their research on such methods. These discussions will help FDA and USDA enhance their ability to use their resources efficiently and avoid potentially duplicative efforts.

Contact Information

For additional information about this high-risk area, contact Steve Morris at (202) 512-3841 or [email protected].

Protecting Public Health through Enhanced Oversight of Medical Products

Bookmark:

The Food and Drug Administration (FDA) needs to take steps to ensure drug availability and oversee the quality of global medical product supply chains.

Why Area Is High Risk

Overall ratings for all five criteria remain unchanged since our last high-risk report in 2021. The following sections present more detailed information on actions that FDA has taken since then to address the oversight of medical products.

Capacity: partially met. FDA increased its reliance on alternative sources of information to maintain oversight of medical products when it paused routine inspections during the COVID-19 pandemic. For example, FDA relied on documentation from manufacturers and reports from other regulators’ inspections for oversight information. In January 2021, we recommended that FDA fully assess these alternatives and consider their applicability for future use. FDA agreed. In June 2022, it reported it had initiated a workgroup to assess these alternatives. FDA also developed guidance for industry and agency staff.

To help recruit and retain a sufficient level of medical product staff, FDA leveraged hiring and pay flexibilities. It also followed some leading practices for effective workforce planning. However, we recommended in January 2022 that FDA develop an agency-wide strategic workforce plan with elements for monitoring and evaluating its progress toward its human capital goals. Legislation enacted in December 2022 requires the agency to issue such a plan by the end of fiscal year 2023, and at least every 4 years thereafter. Additionally, to address persistent vacancies, we also recommended in January 2022 that FDA fully develop tailored strategies focused on recruiting and retaining investigators who conduct inspections in overseas facilities (see fig. 22). As of March 2023, FDA had made significant progress implementing a workgroup and strategies in response to this recommendation.

Action plan: partially met. We identified multiple areas in which additional planning would benefit FDA’s oversight of medical products. For example, in January 2021, we recommended that when developing inspection plans for future years, FDA should identify, analyze, and respond to issues resulting from a delay in routine inspections during the COVID-19 pandemic. Since then, FDA issued a plan for addressing this inspection backlog, though we will continue to monitor its implementation.

Additionally, FDA still needs to take action to respond to our May 2016 recommendation to address shortcomings in broader strategic planning efforts. It could enhance coordination between the centers overseeing medical products. Some of this coordination has been paused because of leadership changes and the agency responding to the pandemic.

Monitoring: partially met. FDA has been taking steps to better monitor drug manufacturers such as by refining its process for identifying and prioritizing foreign establishments subject to inspection. However, in January 2021, we found that gaps persist in the drug manufacturing information the agency needs to help identify and mitigate supply chain vulnerabilities. FDA is in the process of implementing a CARES Act requirement that companies report the amount of drugs they manufacture. However, implementation of this reporting requirement has been delayed. In addition, FDA has indicated that the requirement will not fully address the gaps we identified. It does not expressly require manufacturers to provide detailed information about their respective supply chains. FDA has also sought additional authority from Congress to collect more complete drug manufacturing information.

Additionally, FDA has made progress in its efforts to assess the effectiveness of its foreign offices as we recommended in September 2010 and December 2016. In December 2022, FDA described multiple planning efforts it was undertaking, including development of performance measures. As of March 2023, FDA had implemented these performance measures, with targets, related to the contribution of the offices toward helping FDA follow up on prior inspections that identified deficiencies.

Demonstrated progress: partially met. The collective steps FDA has taken to improve its oversight of medical products demonstrate some progress. The agency has overcome long-standing challenges to conducting foreign inspections. For example, FDA has created a pilot program to study if the agency’s practice of giving foreign manufacturers notice of an inspection affects inspection quality. However, these steps are preliminary and the pandemic has impeded their progress. Moreover, FDA still needs to take actions to fully implement our other recommendations to improve its oversight of medical products.

What Remains to Be Done

• ensuring it fully develops tailored strategies focused on recruiting and retaining investigators to conduct foreign drug inspections;
• ensuring that future inspection plans identify, analyze, and respond to the issues presented by the delay in routine inspections that occurred during the COVID-19 pandemic; and
• developing a set of performance goals and measures that can be used to demonstrate foreign office contributions to outcomes related to the regulation of imported products.

Benefits

• Our work had identified concerns that FDA was not initially consistent in the information it made available on drugs and biologics that received emergency use authorizations during the COVID-19 pandemic. By uniformly disclosing the evidence to support these authorization decisions, as we recommended, FDA improved the transparency with which it makes such decisions. This potentially increases the public’s trust in these products during an emergency.
• In response to our suggestion, Congress required manufacturers to notify FDA 6 months in advance of any plans to discontinue manufacturing certain critical drugs, or if they anticipate an interruption in manufacturing that is likely to lead to a meaningful disruption in the drug’s supply. This requirement was enacted in July 2012. It has allowed FDA to take steps to prevent and mitigate shortages of these critical drugs more quickly.
• Our work found that FDA needed to conduct more inspections to ensure that foreign establishments are inspected at a frequency comparable to domestic establishments with similar characteristics. In response, FDA expanded the number of staff dedicated to conducting foreign drug inspections. It also implemented a risk-based model for selecting establishments for inspection, regardless of their foreign or domestic location.

Contact Information

For additional information about this high-risk area, contact Mary Denigan-Macauley at (202) 512-7114 or [email protected] or John E. Dicken at (202) 512-7114 or [email protected].

Transforming EPA’s Process for Assessing and Controlling Toxic Chemicals

Bookmark:

The Environmental Protection Agency (EPA) needs to strengthen workforce planning to assess and control toxic chemicals that pose risks to human health and the environment more effectively.

Why Area Is High Risk

Overall ratings for four criteria—leadership commitment, capacity, action plan, and demonstrated progress—remain unchanged since 2021.The overall rating for monitoring increased to partially met. For IRIS, leadership commitment, monitoring, and demonstrated progress increased to partially met. For TSCA, leadership commitment increased to met and action plan and monitoring increased to partially met. The following sections present more detailed information on the two segments summarized in the overall rating.

Integrated Risk Information System (IRIS)

Leadership commitment: increased to partially met. As we reported in March 2019 and December 2020, EPA senior leadership in the Office of Research and Development (ORD), changed the program’s workload and processes without input from program staff. ORD houses the IRIS Program. Since 2021, IRIS leadership has improved how the program meets user needs across the agency. For example, it times requests for assessment nominations to better match timelines for completing IRIS assessments.

Additionally, in 2021, IRIS leadership began clearly outlining the criteria the program uses to accept nominations for chemical assessments. This greater transparency helps EPA offices plan their nominations better. However, ORD leadership has yet to gather timely information from the IRIS Program about its resource and workforce needs and how changes to resource levels might affect its ability to meet user needs.

Capacity: partially met. In 2019, ORD reorganized its Health and Environmental Risk Assessment (HERA) national research area, of which the IRIS Program’s work is a part. The reorganization was designed to better reflect the breadth of its topics, research areas, and outputs. As updated in October 2022, HERA’s strategic research plan describes its efforts to integrate with other research programs across EPA and with external partners. Additionally, ORD’s strategic plan called for a focus on workforce planning. In February 2023, the IRIS Program provided us with a resource analysis that examined human and financial resources needed to carry out programmatic work outlined in the HERA strategic research plan. The analysis concluded that the program does not have sufficient resources to carry out its current workload, and future demand for IRIS assessments and other HERA assessments is not expected to decrease.

Action plan: partially met. The IRIS Program has continued actions to coordinate its work with other chemical assessment producers internal and external to EPA, such as EPA’s Office of Chemical Safety and Pollution Prevention (OCSPP). This helps avoid duplicative efforts and ensures that standards for chemical assessments are consistent across EPA offices. Additionally, ORD’s strategic plan includes many goals, but lacks specific actions and metrics to measure progress. As such, ORD and the IRIS Program may be unable to ensure accountability for improvement efforts.

Monitoring: increased to partially met. This rating increased to partially met because the IRIS Program implemented our recommendation to assess its chemical nomination survey in 2021. It also adjusted the survey schedule to align with the time needed to produce an IRIS assessment. However, the program has yet to systemically monitor its activities to validate the effectiveness and sustainability of its assessment production process. For example, as of February 2023, the program has begun to analyze the resources required to effectively produce chemical assessments, but it has not yet defined metrics to evaluate the effectiveness of workforce recruitment and retention strategies, and other efforts.

Demonstrated progress: increased to partially met. This rating increased to partially met because of the IRIS Program’s efforts to standardize assessments, release assessments, and meet EPA user needs. It does this by offering assessments and related products to support EPA’s wide-ranging statutory and regulatory needs. Since 2021, IRIS has increased coordination with other EPA offices. For example, the program worked with OCSPP to develop methodologies for assessing new or data-poor chemicals. The collaboration also ensures systematic review processes—the backbone of chemical assessments—are consistent across EPA offices.

Additionally, the IRIS Program has released three final assessments and made progress on several others. The program is also using several assessment products to meet user needs, including Provisional Peer-Reviewed Toxicity Assessments and Integrated Science Assessments. These other assessments are typically faster to produce. The program has been able to use this mix of assessment types to deliver toxicity values to users on timelines that meet user needs.

To continue making progress, the IRIS Program needs to issue final IRIS assessments and other products and make those products easy for internal and external users to find. In addition, ORD leadership needs to examine its current workforce to determine the resources it needs to help better meet its goal of supporting chemical risk management across EPA.

Toxic Substances Control Act (TSCA)

Capacity: not met. According to EPA officials, since 2016, the agency has missed TSCA chemical review deadlines primarily due to resource constraints, including insufficient capacity in mission-critical occupations. In February 2023, we reported that EPA’s workforce for implementing its TSCA responsibilities included 305 full-time equivalent staff for fiscal year 2022. EPA requested funding to support 532 full-time equivalent staff for these activities in fiscal year 2023. In addition, we reported that OPPT has faced challenges filling some positions in mission-critical occupations, such as toxicologists and biologists.

Action plan: increased to partially met. Since 2019, EPA has taken additional planning steps to implement its TSCA responsibilities. For example, OPPT published its overarching Strategic Plan FY 2021 – FY 2023. The report describes how the office plans to fulfill its obligations under TSCA and other statutes. However, OCSPP has yet to develop a strategic workforce plan to help ensure the agency meets TSCA chemical review deadlines and develops long-term strategies for recruiting, developing, and retaining staff. The officials noted that they are developing a comprehensive plan to ensure employees have the training they need to complete new chemical reviews more consistently.

Monitoring: increased to partially met. OPPT has identified some workforce planning and monitoring improvements for implementing its TSCA responsibilities. In March 2021, OPPT completed a skills gap assessment to provide hiring targets and anticipated attrition counts for mission-critical and other occupations for fiscal years 2021, 2022, and 2025. OCSPP officials told us they plan to hire a contractor to help the office update its assessment. The assessment no longer reflects current workforce needs.

Additionally, OPPT’s strategic plan includes elements related to workforce planning. For example, according to the plan, OPPT’s division that conducts new chemical risk evaluations aims to improve how it allocates resources and develops its workforce. It also identifies some performance indicators associated with these improvements, such as updating human health training materials and developing standard operating procedures. However, the strategic plan does not address other key workforce planning challenges, such as recruitment targets for filling mission-critical occupations.

Demonstrated progress: partially met. Although EPA has taken some steps toward completing existing and new chemical reviews on time, it has missed most statutory deadlines. TSCA, as amended, established specific deadlines for evaluating and managing the risks of certain existing chemicals.[21] For example, as we reported in February 2023, although EPA met the first two evaluation-related deadlines for the initial 10 existing chemicals, it missed all but one of the subsequent deadlines for those chemicals.[22] Moreover, among those new chemical pre-manufacture reviews that EPA completed from 2017 through 2022, the agency typically completed the reviews within the 90-day TSCA review period less than 10 percent of the time. In addition, some of these reviews remained under review years after EPA received them.

OPPT has planned or has ongoing efforts to address these missed deadlines for new chemical reviews. For example, in July 2022, EPA conducted a webinar for external stakeholders to provide an in-depth look at common issues that cause missed deadlines for new chemical submissions.

What Remains to Be Done

• Periodically assessing the demand for chemical assessments and the resources needed to produce IRIS assessments.
• Developing a process and timeline to ensure EPA’s workforce planning efforts fully align with relevant planning principles and incorporating the results, as appropriate, into EPA’s annual plan for chemical risk evaluations under TSCA. This will help ensure the agency can effectively implement its TSCA review responsibilities. We have reported that strategic workforce planning is essential in helping agencies align their workforces with their current and emerging missions. It also helps them develop long-term strategies for recruiting, developing, and retaining staff.

Congressional Actions Needed

Benefits

• The IRIS Program increased its coordination with other EPA offices and external federal entities. This will help ensure the offices avoid duplicative work on chemical assessments, can assist each other with obtaining chemical data, and use many of the same chemical evaluation tools and techniques for greater consistency in final products.
• OPPT completed a skills gap assessment in March 2021 that included hiring targets and anticipated attrition counts for various years. This helped EPA better understand its future workforce needs for implementing TSCA and informed its budget request for fiscal year 2023.

Contact Information

For additional information about this high-risk area, contact J. Alfredo Gómez at (202) 512-3841 or [email protected].

Government-wide Personnel Security Clearance Process

Bookmark:

Why Area Is High Risk

Capacity: partially met. The PAC issued the Trusted Workforce 2.0 Implementation Strategy in April 2022. It states that executive branch agencies’ implementation plans should account for a fully trained personnel security workforce (investigators, adjudicators, personnel vetting practitioners). In addition, the Defense Counterintelligence and Security Agency established a milestone of September 2023 to complete strategic workforce planning for its personnel-vetting workforce. As of February 2023, the agency had completed two of seven steps in its planning process— leadership interviews and competency workshops. It is working on three additional steps: workforce data analysis, a competency assessment, and the development of mitigation strategies to address current and future workforce competency gaps and challenges. By September 2023, the Defense Counterintelligence and Security Agency plans to complete the two remaining steps to refine its mitigation strategies and develop a report with its strategic workforce plan.

The Defense Counterintelligence and Security Agency is also continuing to develop the National Background Investigation Services (NBIS) system. This IT system will be a key component of personnel vetting reform. Since early in fiscal year 2021, the agency has introduced some NBIS capabilities to selected personnel responsible for personnel vetting at an increasing number of federal agencies and industry organizations. However, we found in 2021 that the Defense Counterintelligence and Security Agency lacked a reliable schedule to help manage the NBIS program. We are assessing the NBIS program schedule and plan to report our findings in 2023.

Action plan: partially met. The PAC made key progress through the issuance of several planning documents for the personnel vetting reform. These documents include the Federal Personnel Vetting Investigative Standards in May 2022, the Common Principles in Applying Federal Personnel Vetting Adjudicative Standards in July 2022, and the Federal Personnel Vetting Performance Management Standards in September 2022. However, the PAC has neither developed nor issued performance measures for all phases of the security clearance process that align with the key attributes of successful performance measures such as including a measureable target. The PAC has also not issued updated adjudicative guidelines for the reform.

Monitoring: partially met. The PAC continues to monitor and report publicly on the progress of the personnel vetting reform through www.performance.gov/trusted-workforce/. The Office of the Director of National Intelligence (ODNI) also collects data from agencies to oversee the security clearance process as the government-wide Security Executive Agent. The principal executive order regarding the personnel vetting processes designates the Director of National Intelligence as the Security Executive Agent with responsibilities, functions, and authorities for various aspects of the personnel security clearance process. This includes directing the oversight of the process.

Based on our analysis and comparison of data from selected executive branch agencies with data submitted by ODNI, we found that ODNI’s clearance timeliness data are not sufficiently reliable to enable us to determine the percentage of executive branch agencies that met timeliness objectives. For example, we analyzed ODNI summary statistics on agencies’ timeliness and case-level data from three agencies. We found that some of ODNI’s summary statistics were inconsistent with the corresponding statistics we calculated using the agencies’ case-level data. We also found that some case-level data contained errors, which would inadvertently affect summary statistics. Additionally, we contacted two agencies that could not provide case-level data.

Demonstrated progress: partially met. As of January 2023, executive branch agencies have enrolled about 4.5 million personnel in continuous vetting programs. Agencies use these processes to regularly review the background of personnel with a security clearance to ensure they continue to meet security clearance requirements. While this and other steps to implement personnel vetting reform is promising, the PAC has not fully implemented all of the recommendations we have made to address (1) challenges regarding the timely processing of clearances, (2) a lack of performance measures to assess quality in all stages of the process, and (3) challenges with IT systems.

What Remains to Be Done

Since we added this area to our High-Risk List in 2018, we have made multiple recommendations to ODNI and the Department of Defense. As of March 2023, we have eight recommendations that remain open, including some that led to the decision to add this area to our High-Risk list, as follows:

• the Director of the Defense Counterintelligence and Security Agency revise the NBIS system schedule to meet all the characteristics of a reliable schedule as defined in our best practice guides for scheduling and Agile software development,
• the Director of National Intelligence develop performance measures for assessing the quality of all phases of the personnel security clearance process that align with the key attributes of successful performance measures,
• the Director of the Defense Counterintelligence and Security Agency issue a strategic workforce plan for the agency’s entire personnel vetting workforce, and
• the Director of the Office of Personnel Management should improve the timeliness of validating evidence associated with actions taken to address recommendations made by the U.S. Computer Emergency Readiness Team.

Congressional Actions Needed

Congress should consider requiring that the Director of National Intelligence ensure that agencies submit reliable data on the time they take to complete the initiation, investigation, and adjudication phases of the security clearance process to ODNI to assist it in overseeing agencies’ performance in meeting clearance timeliness objectives.

Benefits

Contact Information

For additional information about this high-risk area, contact Alissa H. Czyz at (202) 512-3058 or [email protected].

National Efforts to Prevent, Respond to, and Recover from Drug Misuse

Bookmark:

Federal agencies must effectively coordinate and implement a strategic national response to drug misuse and make progress toward reducing rates of drug misuse, overdose deaths, and the resulting harmful effects to society.

Why Area Is High Risk

This high-risk issue is being rated for the first time since it was added to the High-Risk List in 2021. Since then, the President nominated and the Senate confirmed a new Director of the Office of National Drug Control Policy (ONDCP) who helped develop and issue the 2022 National Drug Control Strategy. The following issues currently present challenges for the federal government in fully addressing the five high-risk criteria:

In addition, HHS established a Behavioral Health Coordinating Council in 2021. It includes an overdose prevention subcommittee involving the National Institutes of Health and Food and Drug Administration. However, it is important for the federal government to coordinate across additional levels of government and private sector. The 2022 Strategy highlights the need to strengthen such coordination.

Capacity: not met. While the federal drug control budget for fiscal year 2022 was $39 billion, the 2022 Strategy highlights the need for the federal government to expand resources for the prevention, treatment, and recovery from drug misuse. However, our review of the Strategy, Budget Summary, and accompanying documents found that not all relevant federal agencies listed the resources necessary to implement a plan to expand treatment for substance use disorders, as required by law.[23]

The availability of treatment for substance use disorders remains a long-standing challenge, particularly for low-income individuals and in rural areas. The COVID-19 pandemic has exacerbated concerns about access to treatment and workers affected by opioid misuse.

According to the 2022 Strategy, government estimates suggest the substance use disorder workforce will continue to experience staffing shortages. The estimates also highlight the need for additional substance use disorder treatment workforce and infrastructure.

Action plan: partially met. In June 2021, ONDCP developed a plan to help it meet all statutory requirements related to the development and promulgation of the National Drug Control Strategy. This Strategy is to set forth a comprehensive plan to address drug misuse.

While the 2022 Strategy, and its accompanying documents, fully addressed some of the statutory requirements, it partially or did not meet others. For example, it did not include a systematic plan for increasing data collection.[24]

Monitoring: partially met. Federal agencies have taken some actions to improve their monitoring and data collection efforts. For example, the Department of Justice, Drug Enforcement Administration (DEA), and Organized Crime Drug Enforcement Task Force addressed our recommendations to include outcome- or results-oriented measures in their strategies to combat illicit opioids.

However, while the Substance Abuse and Mental Health Services Administration (SAMHSA) assesses the State Opioid Response grant program annually, its assessments do not address potential limitations or fully leverage available information for a more in-depth assessment.

Further, while the 2022 Strategy includes comprehensive, long-range, quantifiable goals and specific targets to accomplish goals, it did not include a performance evaluation plan, as statutorily required.[25]

Demonstrated progress: not met. The effects of the COVID-19 pandemic have intensified concerns about the number of people in the U.S. affected by substance use disorders. Based on provisional data, the Centers for Disease Control and Prevention reported nearly 107,000 drug overdose deaths during the 12-month period ending in September 2022—one of the highest number of deaths ever reported in a 12-month period (see fig. 25).

While the 2022 Strategy highlights the need for federal agencies’ actions to address drug misuse, ONDCP has yet to issue its evaluation of agencies’ progress toward meeting the Strategy’s goals. This was statutorily required to be submitted by February 6, 2023.[26] As of February 24, 2023, ONDCP has not issued the evaluation.

What Remains to Be Done

• ONDCP should ensure future iterations of the National Drug Control Strategy include all statutorily required elements.
• HHS, Department of Education, and ONDCP should clarify how grants that support drug prevention education programs contribute to the goals of the National Drug Control Strategy.
• SAMHSA should further analyze existing State Opioid Response grant program information, such as by disaggregating data by client groups, to provide a more comprehensive, in-depth assessment of program performance. It should then use this information to identify opportunities for program improvement.

Benefits

There were nine benefits to the federal government due to progress in this high-risk area since it was added to the list in 2021. For example:

• Our work found that the federal government identified expanding access to Medication Assisted Treatment as important for reducing opioid use disorders and overdoses. However, some state and federal policies can restrict Medicaid beneficiaries’ access to Medication Assisted Treatment medications. In response, the Centers for Medicare and Medicaid Services issued guidance in December 2020 to state health officials about the existing requirement that states cover all forms of drugs approved for Medication Assisted Treatment. In March 2021, all states had begun to take actions to address this issue.
• Our work found certain limitations in DEA’s tool that can be used by registrants—such as manufacturers and distributors of controlled substances—to better support their efforts to identify and report suspicious opioid orders. In May 2021, DEA took actions to address these limitations. This helped ensure that registrants had the most useful information to assist in identifying and reporting suspicious orders.
• In December 2021, we reported that we could not verify ONDCP’s actions to assess for duplication, overlap, and fragmentation among drug control grants because ONDCP has not documented its process. In response, ONDCP developed guidance for its assessment of duplication, overlap, and fragmentation for federally funded drug control grants in May 2022. This helped it ensure it maintained organizational knowledge of its process and demonstrated its effectiveness.

Contact Information

For additional information about this high-risk area, contact Triana McNeil at (202) 512-8777 or [email protected], Alyssa M. Hundrup at (202) 512-7114 or [email protected], or Thomas Costa at (202) 512-4769 or [email protected].

Department of Health and Human Services’ Leadership and Coordination of Public Health Emergencies

Bookmark:

The Department of Health and Human Services (HHS) must improve its leadership and coordination of public health emergencies to save lives, mitigate severe economic impacts, and prepare the nation to respond to multiple simultaneous threats.

Why Area Is High Risk

As we reported in January 2022, for more than a decade, our body of work has found persistent deficiencies in HHS’s ability to perform its role of leading the nation’s preparedness for, and response to, public health emergencies.

Leadership commitment: Sustained leadership is the critical element for initiating and sustaining progress and making the types of management and operational improvements required for narrowing or removing high-risk areas. Our work has identified the need for the Secretary of Health and Human Services and the leaders of HHS agencies—including the Administration for Strategic Preparedness and Response (ASPR), Centers for Disease Control and Prevention (CDC), Food and Drug Administration (FDA), and National Institutes of Health (NIH), among others—to take action to better position the department to fulfill its lead role in preparing the nation for, and responding to, public health emergencies. This includes demonstrating commitment to addressing the deficiencies we have identified. HHS’s efforts have fallen short in five key areas of an effective national response, as depicted in figure 26.

We have identified key agency reform practices from June 2018. These practices indicate that agencies can successfully change if they have clear goals, follow a process to develop proposed reforms, allocate implementation resources, and consider workforce needs during and after the reform.

Capacity: In January 2022, we reiterated concerns about HHS’s capacity to lead and coordinate public health emergencies. For example, we noted that ASPR could only support a response to two simultaneous events occurring in different areas in the continental U.S. for 30 days. ASPR relies on other response partners but does not have a complete understanding of their capabilities and limitations.

Additionally, in January 2022, we found that FDA did not have an agency-wide strategic workforce plan to coordinate human capital efforts across the agency. Further, in April 2022, we reported that ASPR had not undertaken key workforce planning steps to support the mission and goals of the new office it created to address medical product supply vulnerabilities highlighted during the pandemic. Workforce planning will be important as ASPR reorganizes. This is especially true since ASPR cited improved hiring and contracting capacities as an outcome of this effort. HHS needs to meet the key principles of strategic human capital planning. These include determining the critical skills and competencies needed to achieve an agency’s current and future programmatic results, and developing strategies to address gaps in the number of staff and their skills and competencies to meet those results.

Action plan: The administration has released broad plans and strategies related to the public health supply chain, COVID-19 guidelines, and pandemic preparedness. For example, in October 2022, the administration released an updated National Biodefense Strategy and Implementation Plan. However, HHS needs to develop specific action plans that define root causes, solutions, interim milestones, necessary resources, and steps for implementing corrective measures to address the persistent deficiencies we have identified. In April 2022, we observed HHS’s intention for such action plans in its National Strategy for a Resilient Public Health Supply Chain. However, it was too early to know if they would be implemented as intended.

Monitoring: An action plan, including steps required to implement corrective measures, is needed before HHS can monitor corrective actions. Our work has shown that, as agencies develop their monitoring strategies, they should ensure they can collect, analyze, and communicate accurate, useful, and timely information, and track actions to implement our recommendations to indicate progress, among other things.

Demonstrated progress: HHS has not had much time to demonstrate progress since this area was recently added to our High-Risk List in January 2022. While HHS addressed some of our recommendations, other concerns have arisen. This includes findings from our April 2022 report that CDC has not defined action steps to achieve its data modernization efforts. We will continue to evaluate HHS’s response to threats as they emerge, such as extreme weather events, and agency reform efforts to determine whether progress has been made to address the systemic deficiencies we identified.

What Remains to Be Done

As of February 2023, 92 of the 155 recommendations we have made in this area since fiscal year 2007 remain open.[27] These recommendations highlight steps HHS can take to address areas of concern that have arisen in preparing for and responding to public health emergencies, including the following:

• HHS should take steps to standardize ongoing data collection and reporting standards across federal agencies to help respond to the COVID-19 pandemic and prepare for future pandemics.
• HHS should prioritize the development of an interoperable network of systems for near real-time public health situational awareness—to include designating a lead office for implementing it and clearly defining roles and responsibilities.
• ASPR should develop a transparent and deliberative process for the body of experts who make recommendations related to purchasing vaccines and other public health and medical supplies for the Strategic National Stockpile to aid emergency response.

Potential Benefits

Improving HHS’s leadership and coordination of public health emergencies will better prepare the nation for future emergencies and help mitigate devastating public health and economic effects. During the COVID-19 pandemic alone, more than 1.1 million U.S. deaths were reported as of February 2023. About $4.6 trillion have been appropriated in relief funds for response and recovery efforts.

Contact Information

For additional information about this high-risk area, contact Mary Denigan-Macauley at (202) 512-7114 or [email protected].

Acquisition and Program Management for DOE’s National Nuclear Security Administration and Office of Environmental Management

Bookmark:

The National Nuclear Security Administration (NNSA) and the Office of Environmental Management (EM) need to improve oversight of their acquisition processes and better manage their portfolios, programs, and projects.

Why Area Is High Risk

Since our 2021 High-Risk Report, the rating for one criterion—leadership commitment—increased from partially met to met. The other four criteria remain unchanged. The following sections present more detailed information on NNSA and EM.

Acquisition and Program Management for the National Nuclear Security Administration (NNSA)

Leadership commitment: met. NNSA has continued to show leadership commitment to improving acquisition and program management. However, in July 2022, it reorganized its former Acquisition and Project Management office to separate management functions for acquisitions and projects into dedicated offices. Leadership from this office had played a central role in NNSA’s recent improvements in acquisition and project management. As we found in January 2023, the reorganization was initiated without first identifying a mission need for such a change. This reorganization may have implications for acquisition or project management as it is implemented.

Capacity: partially met. Senior NNSA officials have raised concerns that they do not have enough staff with the right skills in their acquisition workforce to oversee contracts. NNSA needs to perform a complete and thorough evaluation of gaps in skills and competencies across its acquisition workforce, as we recommended in November 2021. Implementing this recommendation is particularly important in light of NNSA’s July 2022 reorganization of its former Acquisition and Project Management office. Additionally, the recently enacted congressional amendment of the statutory cap on NNSA’s federal staffing levels, which the agency had requested, could help address these concerns.[28]

Action plan: partially met. NNSA has taken some steps to identify the root causes of some of its long-standing acquisition and management challenges. For example, NNSA recompeted a contract for the management and operation of one of its sites due to safety concerns, as we found in June 2022. The new contractor took positive steps to increase safety at the site, such as improving policies and practices related to reporting safety issues. However, NNSA’s July 2022 reorganization of its Office of Acquisition and Project Management was a broad change rather than an action to solve a specific problem. NNSA should establish specific outcome-oriented goals for this change, as we recommended in January 2023.

Monitoring: partially met. NNSA continues to improve its efforts to monitor project performance and identify construction projects that are not meeting cost or schedule baselines and contractors whose performance needs improvement. However, the number of construction projects not meeting cost and schedule baselines has increased since 2020, including for nonmajor projects. We had previously removed this category from this high-risk area. According to NNSA officials, some of these issues are because of the pandemic and supply chain challenges. We plan to continue to evaluate this issue.

Additionally, the contractors that manage and operate NNSA’s sites have monitored subcontractor cybersecurity measures inconsistently because some contractors do not believe they are required to do so, as we found in September 2022. NNSA’s annual contractor performance assessments do not emphasize the importance of such oversight. NNSA plans to enhance contractor and subcontractor cybersecurity by including a requirement in the next version of its governing cybersecurity directive that contractors implement a standardized cybersecurity framework for unclassified systems. However, it is unclear when NNSA will do so because it has delayed issuing the directive for more than 2 years. NNSA attributed the delay to its lengthy internal process for major revisions and recent administrative changes to key stakeholders.

Demonstrated progress: partially met. NNSA continues to improve its collection of financial information. This has led to improvements in program management. However, NNSA has not communicated expectations for using the data or developed a process to report total costs for a program, as we recommended in February 2022. Taking such measures would allow NNSA to collect information useful to each office.

In addition, NNSA’s development and use of important program management tools has been uneven. For example, NNSA is re-establishing its plutonium pit production capability—likely to become its most expensive weapons production infrastructure program to date (see fig. 27). However, NNSA has developed neither a comprehensive schedule nor cost estimate for the integrated activities needed to achieve the desired capability, as we reported in January 2023. Such estimates could improve NNSA and congressional decision-making. It could also support NNSA’s efforts to achieve a production rate of 80 pits per year.

Acquisition and Program Management for the Office of Environmental Management (EM)

We have continued to highlight areas where sustained leadership commitment is needed. For example, in May 2022, we found that past frequent turnover in EM leadership created challenges to achieving DOE’s complex and long-term cleanup mission. These challenges include inconsistent and incomplete initiatives and a focus on short-term actions over long-term priorities. Departmental leadership, and possibly congressional action, is also needed to pursue risk-informed alternatives that could save tens of billions of dollars or more. This includes different tank waste treatment approaches at DOE’s Hanford Site.

Finally, we note that DOE acquisition and program management issues have been on our High-Risk List since its inception in 1990. DOE has recently shown strong leadership commitment at the highest levels of the department. The agency needs to sustain this commitment for it to address the other high-risk criteria adequately. These criteria include having the right number of staff to oversee contractors, corrective action programs that prevent problems from recurring, and complete and reliable information to hold contractors accountable for cleanup progress.

Capacity: partially met. EM has taken some steps to implement leading practices for effective strategic workforce planning and assess its acquisition workforce. However, it continues to face staffing shortages and related problems. EM needs to fully identify skill and competency gaps—including the types and numbers of positions required to close these gaps—for its acquisition workforce, as we found in November 2021. In addition, EM’s limited staff capacity contributed to issues for three capital asset projects—two of which are expected to overrun their cost and schedule baselines—as we found in May 2022.

Action plan: partially met. EM has taken some action to develop corrective action plans that address root causes. For example, in August 2022, EM took steps to ensure that certain projects develop corrective action plans and that DOE assesses and validates the extent to which such corrective actions resolve root causes.

EM’s efforts to address the root causes of its long-standing acquisition and program management challenges continue to contain gaps. For example, as we found in January 2021, EM does not have an action plan—a leading practice—for its efforts to retrieve nuclear waste from underground tanks at the Hanford Site. This may impede EM’s ability to prepare for technical challenges.

In September 2022, EM issued a program plan that describes strategies for completing its cleanup mission. It is too early to determine the extent to which the strategies outlined in the plan and EM’s actions to implement them will effectively address its long-standing acquisition and management challenges.

However, EM continues to face challenges with monitoring the effectiveness of its actions to address acquisition and management challenges. In September 2022, we found weaknesses with DOE’s implementation of its new End State Contracting Model. This model is intended to improve EM’s contracting approach and move cleanup sites closer to completion. Specifically, EM had not developed a formal, structured process to assess the model’s effectiveness. Given the model’s scope and scale and EM’s preference for using it for future large-dollar environmental cleanup contracts, it is critical that EM assess the model’s effectiveness.

Demonstrated progress: partially met. EM has taken steps to address our recommendations to improve its activities and has made progress in its environmental cleanup activities at some sites. For example, EM revised its environmental cleanup policy to follow program and project management leading practices, as we recommended in February 2019.

However, EM continues to face problems associated with its oversight of its acquisitions and management of its cleanup mission. For example, unless EM addresses a number of significant risks at its Hanford Site, a key program to treat a portion of the site’s radioactive liquid waste faces delays and increased costs, as we found in June 2022. EM has prior experience with constructing facilities to treat liquid waste at the Idaho National Laboratory. It should use this as a model for its management of the Hanford Site. We will monitor whether EM implements the corrective measures we recommended. In addition, EM has yet to take all the actions necessary to implement our September 2019 recommendations that it incorporate essential elements of risk-informed decision-making in its acquisition and management of major projects and operations activities. EM needs to complete all these actions to make meaningful progress in addressing high-risk issues.

What Remains to Be Done

• developing an approach to ensure all NNSA program elements are included in total program costs;
• taking steps to ensure EM’s cost and schedule estimates are developed and updated in accordance with our best practices; and
• systematically assessing EM’s End State Contracting Model to ensure future contracts under this model are effectively implemented.

Congressional Actions Needed

• clarifying—in a manner that does not impair the regulatory authorities of the Environmental Protection Agency and any state—DOE’s authority to determine, in consultation with the U.S. Nuclear Regulatory Commission, whether portions of Hanford’s tank waste can be managed as a waste type other than high-level radioactive waste, and can be disposed of outside the state of Washington.

Benefits

• NNSA issued a revised directive on responsibilities for conducting independent cost estimates to include requirements to document and justify key decisions;
• DOE issued a policy memorandum to help improve the collection and dissemination of project management lessons learned; and
• EM revised its environmental cleanup policy to follow program and project management leading practices.

Contact Information

For additional information about this high-risk area, contact Allison Bawden at (202) 512-3841 or [email protected] and Nathan Anderson at (202) 512-3841 or [email protected].

NASA Acquisition Management

Bookmark:

The National Aeronautics and Space Administration (NASA) needs to continue implementing its Action Plan with a focus on reducing acquisition risk and improving project cost and schedule performance for its most expensive and complex projects.

Why Area Is High Risk

The rating for capacity increased from partially met to met. The other four criteria remain unchanged since 2021. NASA has increased its capacity by completing initiatives in its action plan intended to strengthen its cost and schedule estimating workforce. The agency, however, continues to face challenges in its ability to manage and oversee its most expensive and complex projects. Specifically, NASA has had difficulty controlling cost growth and schedule delays for projects that exceed $2 billion in life-cycle costs. These include projects needed for NASA to conduct Artemis missions. These missions will return astronauts to the moon, build a sustainable lunar presence, and ultimately bring humans to Mars.

• Elevated its Chief Acquisition Officer position to the NASA Deputy Administrator. This change elevates acquisition planning and oversight to the attention of one of the agency’s most senior officials. It is intended to help ensure appropriate levels of consideration are applied to major acquisitions. NASA also established a Chief Program Management Officer, intended to improve project management across the agency and strengthen program management policies, among other things.
• Committed to establishing cost and schedule baselines for additional lunar program capabilities, such as the Space Launch System and Exploration Ground Systems; and
• Committed to creating a cost estimate for its mission to return U.S. astronauts to the moon, known as Artemis III.

Capacity: increased to met. In the past 2 years, NASA demonstrated it has improved its capacity to reduce acquisition risk by completing relevant corrective action plan initiatives. Since updating the plan in 2018, NASA has completed nine of these initiatives. In addition, it is actively implementing six additional initiatives aimed at improving the capacity of its workforce and tools. For example, NASA completed initiatives to improve training for its cost and schedule estimating workforce and develop a schedule repository to improve access to historical and analogous project schedules for planning purposes.

Further, NASA senior leaders committed to implementing or have implemented several of our recommendations related to how the agency oversees and manages missions that could further build capacity. For example, based on our May 2021 recommendation, NASA documented the program and technical management practices and tools that it will apply to its lunar missions. This will help reduce the risk that NASA will discover gaps late in development.

NASA also plans to improve schedule management and workforce planning guidance for Artemis missions, which are planned through the 2030s, based on our September 2022 recommendations. Schedule management guidance for these multiprogram missions will help ensure that senior NASA leaders have quality, risk-informed schedule information for decision-making. Additionally, developing guidance that identifies a regular and recurring process for long-term Artemis workforce scenario planning to address future uncertainties will help NASA better address longer-term workforce challenges that could affect Artemis mission success.

Action plan: met. NASA continues to update its corrective action plan and implement plan initiatives. As of February 2023, the agency completed five of six initiatives from its 2020 plan. In August 2022, NASA updated its action plan and began six new initiatives. Two of these initiatives build on prior initiatives to improve scheduling and increase transparency into the long-term costs and affordability of human spaceflight programs.

Monitoring: met. NASA continues to monitor progress against its corrective action plan. This process includes tracking and briefing senior leaders on the progress made on action plan initiatives. It also calls for reporting progress against its action plan and other cost and schedule performance metrics to us and NASA senior leadership semiannually.

In addition, NASA took two additional steps to increase monitoring of major projects since our 2021 high-risk update by (1) creating the new Chief Program Management Officer, who is responsible for strengthening enterprise-wide oversight and management of projects; and (2) establishing an earned value management data surveillance requirement, which will help NASA to improve the reliability and utility of its earned value management data. These data help management monitor project performance by measuring the value of work accomplished in a given period and comparing it to the planned value of work scheduled for that period and the actual cost of work accomplished.

Demonstrated progress: partially met. NASA’s progress across its portfolio of major projects continues to be mixed since our 2021 high-risk update.

Since March 2021, NASA has launched or completed nine projects. Two of these projects launched within both their cost and schedule baselines. One launched within its schedule baseline, but not its cost baseline. Six projects exceeded both their cost and schedule baselines. Most notably during this period, NASA successfully launched the James Webb Space Telescope, one of the agency’s most complex science missions. It also launched the Orion crew capsule and NASA’s newest rocket, the Space Launch System, as part of efforts to return to the moon.

The overall cost and schedule performance of NASA’s portfolio of major projects continues to decline. We reported in June 2022 that the cost growth had deteriorated for the sixth consecutive year while the average schedule delay increased for the second consecutive year. NASA’s most expensive and complex projects, known as category 1 projects, drove the cumulative development cost overruns and schedule delays. Each category 1 project has a life-cycle cost estimate of more than $2 billion, uses significant radioactive material, or is intended for human spaceflight. Nearly all of the $12 billion in cumulative development cost overruns we reported in June 2022 are attributed to cost overruns on the nine category 1 projects out of a total of 21 projects in the portfolio.

What Remains to Be Done

Benefits

Contact Information

For additional information about this high-risk area, contact William Russell at (202) 512-4841 or [email protected].

DOD Contract Management

Bookmark:

Why Area Is High Risk

Service Acquisitions

Capacity: partially met. DOD has or intends to revise responsibilities for some key service acquisition positions. However, it is too early to tell whether these personnel will have the necessary capacity to perform their responsibilities. For example, in October 2022, DOD designated the responsibility for category management—an Office of Management and Budget (OMB)-led initiative intended to help agencies buy more strategically and achieve efficiencies—to the Principal Director of Defense Pricing and Contracting. DOD plans to issue additional guidance on how the department can use category management to better manage service acquisitions by the end of fiscal year 2023. DOD also recently transferred oversight responsibility for service requirements review boards from the Chief Management Officer—whose office was dissolved in October 2021—to the Under Secretary of Defense for Acquisition and Sustainment. However, DOD has neither demonstrated that its category management leaders have the capacity to implement the planned guidance nor that the Under Secretary of Defense for Acquisition and Sustainment has the personnel necessary to establish annual services requirements review processes to oversee service requirements. As of February 2023, we have ongoing work to assess whether some of these changes will address previously identified capacity shortfalls related to key leadership positions having multiple responsibilities and minimal effect on how DOD manages service acquisitions.

Action plan: partially met. While DOD has recognized challenges in the acquisition of services, it has yet to develop a corrective action plan to fully address these challenges. DOD has identified two needed areas where it has taken or plans to take actions to address issues. First, DOD plans to better identify roles and responsibilities and issue guidance to clarify how category management will be used to more efficiently manage service acquisition spending. Second, DOD plans to implement guidance to collect and report on budget needs for service acquisitions beyond the current budget year. However, DOD’s guidance does not identify how the budget needs collected during service requirements review boards will be communicated or used to inform forecasts required for fiscal year budget submissions.

Monitoring: partially met. DOD continued its efforts to collect data and monitor service acquisitions. For example, DOD’s January 2020 revision to its service acquisition policy requires that the results from service requirements review boards be tracked. It also advises the use of metrics to measure service acquisition performance. DOD is also planning to restart an annual assessment of service requirements review processes. In addition, it is developing a dashboard to track its spending trends for service acquisitions. However, DOD has yet to demonstrate how the information from these efforts will be aggregated and used given the recent transfer of oversight responsibility to the Under Secretary of Defense for Acquisition and Sustainment.

Demonstrated progress: partially met. DOD demonstrated progress by clarifying responsibilities for category management in October 2022. It also exceeded OMB’s fiscal year 2022 category management goals for obligations considered to be strategically managed after falling short the preceding 2 fiscal years. DOD also issued guidance in June 2022 to begin forecasting budget needs for service acquisitions in its fiscal year 2024 budget submission. The guidance requires all DOD components to forecast budget needs for service acquisitions over a 5-year period. As of February 2023, DOD’s effort to collect the data to forecast budget needs is underway. We are assessing its progress as part of our ongoing work.

Operational Contract Support

Demonstrated progress: partially met. DOD continues to make progress addressing our priority recommendations for OCS. For example, in July 2022 DOD addressed a December 2018 recommendation by issuing a directive to provide department-wide guidance on vendor threat mitigation. This directive formalized DOD policy and responsibilities related to assessing and responding to risks posed by vendors who oppose U.S. interests. At the same time, DOD extended the use of its related interim guidance until December 2023. Also, two combatant commands—Africa and Indo-Pacific—issued command-specific vendor threat mitigation guidance. However, after several years, DOD has yet to revise its instruction on how OCS should be integrated throughout the department, including into operational plans and training. DOD officials said they expect to issue the revised instruction by the end of March 2023.

What Remains to Be Done

• establish a mechanism, such as a working group of key stakeholders, to coordinate efforts to develop budget forecasts for service acquisitions using consistent data. Completing a plan—which was due by June 1, 2022—to implement a statutory requirement to forecast budget needs for services could help the department implement this recommendation by assigning responsibilities, identifying needed changes to budget guidance, and establishing milestones to track progress.[29]
• issue military department guidance on how to collect and report forecasted budget needs for service acquisitions across a 5-year time span in each budget submission.
• issue department-wide guidance for OCS detailing how OCS should be integrated throughout the department, including into operational plans and training.

Benefits

• DOD’s and other federal agencies’ increased use of category management has resulted in more than $35 billion in cost savings. In 2016, we recommended that OMB set and report on goals for using category management, which DOD exceeded for fiscal year 2022.
• DOD increased the size and skills of its acquisition workforce and implemented solutions to improve and institutionalize operational contract support capabilities.
• From 2011 to 2022, DOD implemented solutions to institutionalize and improve OCS capabilities, including the development of nine annual action plans to track progress toward key goals to address capability shortfalls in training, education, lessons learned, policy changes, and emerging requirements.

Contact Information

For additional information about this high-risk area, contact William Russell at (202) 512-4841 or [email protected].

VA Acquisition Management

Bookmark:

Why Area Is High Risk

However, VA will need sustained leadership commitment to ensure it has clearly-established authorities, roles, and responsibilities for implementing the action plan. The plan requires ongoing efforts by a number of different individuals and organizations across the agency. In addition, clear accountability mechanisms will be needed to ensure consistent execution. Further, as we reported in August 2022, VA’s effort to implement its new acquisition framework—a key part of its action plan—faces challenges that will require leadership engagement. This includes ensuring framework compliance and identifying which programs will be subject to the new oversight framework.

Capacity: partially met. VA continues to make progress in building capacity to address its acquisition management challenges. For example, in July 2021, VA implemented training and developed comprehensive guidance for contracting staff in its Federal Supply Schedule program, in response to our recommendations. VA uses the Federal Supply Schedule to purchase billions of dollars in medical supplies each year. In May 2020, VA also developed an acquisition knowledge portal that provides standardized acquisition guidance and tools for the entire acquisition community.

However, we reported in August 2022 that VA identified acquisition workforce gaps that affected VA programs’ ability to manage major acquisitions. In September 2022, we reported that VA lacks comprehensive data to track the totality and characteristics of its acquisition workforce. Addressing these issues would help enable VA to implement its planned acquisition framework, and make data-driven human capital decisions. We recommended that VA conduct an enterprise-wide workforce assessment to identify any gaps, and take steps to ensure it keeps up-to-date and accurate acquisition workforce records.

VA also needs to develop additional capacity to manage its supply chain. In March 2021, we reported that VA was pursuing multiple major initiatives to modernize its supply chain. However, VA still faces challenges in implementing these efforts to ensure they will result in a modern and efficient supply chain for VA. VA has yet to fully address our recommendation to develop a comprehensive supply chain strategy. This, in turn, has hindered VA’s efficient acquisition management and its mission to meet veterans’ needs.

Action plan: increased to met. VA improved in this criterion since our last high-risk update. In March 2021, VA issued its initial action plan to address acquisition management challenges. These challenges include managing contracting officer workload and lack of reliable contracting and financial data systems, and supply chain modernization. For example, VA identified root causes of these issues, corrective actions, and metrics intended to track progress. It has continued to update that plan, most recently in September 2022.

Monitoring: increased to partially met. VA improved in this criterion because it identified corrective actions, goals, and performance metrics that it will use to measure progress in improving acquisition management. However, VA has yet to fully develop a monitoring program to validate the effectiveness and sustainability of corrective actions. This is because some of the metrics in its action plan measure interim steps, rather than VA’s desired outcomes.

Our recent work highlighted specific areas where VA could improve its monitoring. For example:

• In July 2021, we reported that VA’s senior procurement leader relies on process-oriented metrics—such as competition rates and small business utilization—to manage the department’s procurement organizations. We recommended VA use a balanced set of performance metrics to manage the department’s procurement organizations. VA concurred with this recommendation.
• In August 2022, we recommended that the Chief Acquisition Officer (1) establish key measures for performance of its planned framework for managing major acquisitions, (2) collect and analyze data related to these measures, and (3) report results. Developing performance measures would better position VA to evaluate its progress and make changes as needed. VA is currently preparing to implement the new framework.

Demonstrated progress: increased to partially met. VA demonstrated some progress by implementing 15 recommendations related to acquisition management. For example:

• In September 2018, we reported that VA had few mechanisms for monitoring subcontracting limitations and the potential for fraud in implementing its Veterans First Program. This program implements VA’s statutory preferences for veteran-owned small businesses when awarding contracts. We recommended that VA conduct a fraud risk assessment for the program. VA completed its fraud risk assessment in April 2022.
• In September 2016, we found that VA’s procurement policy framework was outdated and fragmented. We recommended that VA identify measures to expedite the revision of the Veterans Affairs Acquisition Regulation (VAAR), which had been ongoing for many years. As of March 2022, VA has published the final or draft rules for all 41 VAAR parts that it is updating.

However, VA still needs to address some recommendations that will take more time and effort to implement. This includes developing a comprehensive supply chain strategy and taking steps to ensure the success of its planned framework for managing its major acquisitions. Additionally, VA continues to develop desired outcomes and performance measures for its high-risk plan. It will need time to monitor and demonstrate sustained progress.

What Remains to Be Done

Benefits

• Developed a mechanism to consistently obtain and analyze user feedback on the Federal Supply Schedule program. This feedback will provide information on users’ experience. This, in turn, will help program officials ensure the program is meeting VA’s needs for goods and services to support veterans’ health care.
• Conducted a contracting fraud risk assessment and developed a plan that will help VA assess subcontracting risk for its Veterans First Program moving forward.
• Developed and implemented training for its Federal Supply Schedule program. This helps ensures that contracting staff are prepared to award contracts efficiently and effectively.

Contact Information

For additional information about this high-risk area, contact Shelby S. Oakley at (202) 512-4841 or [email protected].

Enforcement of Tax Laws

Bookmark:

The Internal Revenue Service (IRS) needs to increase its capacity to implement new initiatives, improve ongoing enforcement and taxpayer service programs, and combat identity theft (IDT) refund fraud.

Why Area Is High Risk

Overall ratings for all five criteria remain unchanged since 2021. The monitoring criterion for Refund Fraud Related to Identity Theft increased to a met rating. The following sections present more detailed information on the two segments summarized in the overall rating.

Addressing the Tax Gap

Capacity: not met. IRS continues to face challenges with skills gaps and an aging technology infrastructure. It has not fully implemented strategic workforce planning initiatives, such as conducting workforce analysis. IRS has also further delayed implementing its workforce plan until March 2024.

In May 2022, IRS officials attributed reduced staffing due to decreased funding as the primary reason for declining audit rates shown in figure 30. Enacted in August 2022, the statute commonly known as the Inflation Reduction Act of 2022 provides IRS with about $80 billion in additional funding over the next decade.[30] In August 2022, the Secretary of the Treasury directed IRS to deliver a plan for the funds within 6 months of its request. In April 2023, IRS delivered its plan. In refining and carrying out the plan, IRS should work towards implementing our open recommendations for improving tax enforcement, particularly those that it previously said the agency lacked resources to implement.

Action plan: partially met. IRS is developing a strategy to improve the services it provides to make voluntary compliance easier for taxpayers and ensure taxes owed are paid. IRS’s Fiscal Year 2022–2026 Strategic Plan includes two goals for providing taxpayers a better service experience. However, IRS still needs to clearly state agency-wide and division performance goals for improvements in the taxpayer experience and specify its related measures with targets.

Monitoring: partially met. IRS continues to use tax gap data to study compliance behaviors and update formulas designed to identify tax returns with a high likelihood of noncompliance. However, IRS could strengthen third-party information reporting for sole proprietors, the largest portion of the underreporting tax gap.

Demonstrated progress: partially met. IRS implemented some corrective measures to improve compliance and reduce the tax gap, including its use of the Return Review Program to screen individual returns claiming refunds. However, IRS lacks specific quantitative goals to reduce the tax gap or improve voluntary compliance. This makes it more difficult to determine the success of its strategies.

Refund Fraud Related to Identity Theft

Capacity: partially met. IRS has developed a prerefund system that can detect IDT fraud. However, to fully expand IDT refund fraud prevention, it needs to digitize information from paper returns at intake. This would allow IRS to reduce processing time, use the prerefund system’s fraud filters on all paper and electronic forms, and allow more prerefund compliance checks or investigations, among other benefits.

Additionally, in January 2020, we found that IRS does not resolve all business IDT cases within its guidelines. We also found that the agency lacked customer service-oriented performance goals for resolving cases. In November 2021, IRS set a new 120-day average time frame standard for processing individual and business IDT cases.[31] However, its latest guidance acknowledges its case resolution time averages 360 days due to challenges created by the COVID-19 pandemic and an increase in its identity theft inventories. In October 2022, IRS stated that it would be unable to achieve the 120-day time frame until 2024.

Action plan: met. IRS’s Fiscal Year 2022–2026 Strategic Plan acknowledges its responsibility to safeguard taxpayer and IRS data. It also states that technological and security investments help ensure that IRS delivers a high-quality taxpayer experience while safeguarding taxpayer data. IRS exceeded the Department of the Treasury’s priority goal for reducing IDT refund fraud in 2019 and 2020.

Monitoring: increased to met. IRS has improved its ability to monitor IDT fraud. For example, it improved its ability to track outcomes of taxpayer authentication conducted by phone or in person, such as rates and reasons why taxpayers may have difficulty authenticating their identity. IRS also established a policy and schedule to assess risks to phone, in-person, and correspondence authentication channels. This may help identify emerging risks to the tax environment. Additionally, IRS updated its monitoring reports and annual estimates of dollars protected and lost to fraud to include business IDT fraud.

Demonstrated progress: partially met. IRS has demonstrated some progress by

• developing tools and programs to further detect and prevent IDT refund fraud, such as the Return Review Program;
• implementing its foundational authentication initiatives and monitoring required resources to complete them; and
• working to implement new federal online authentication standards.

However, IRS lacks the governance structure to coordinate all aspects of its efforts to protect taxpayer information held by third-party providers. It also lacks a dedicated entity—with defined responsibilities and the necessary authority to perform its role—to oversee business IDT efforts.

What Remains to Be Done

Congressional Actions Needed

• expanding third-party information reporting for certain payments that rental real estate owners make to service providers, such as contractors who perform repairs on their rental properties;
• providing IRS with authority—with appropriate safeguards—to correct math errors and discrepancies between information from taxpayers and government databases;
• establishing requirements for paid tax return preparers to help improve the accuracy of the tax returns they prepare;
• requiring that returns prepared electronically but filed on paper include a scannable code printed on the return to better leverage the Return Review Program’s capabilities; and
• providing IRS with explicit authority to establish security requirements for the information systems of paid preparers and Authorized e-file Providers.

Benefits

• Congress addressed our recommendation to require more third-party reporting for payments made to online platform workers.[32] The increased reporting will improve tax compliance by providing IRS with better information about platform workers’ incomes, and making it easier for certain taxpayers to complete tax returns.
• Our recommendation that IRS assess the costs and benefits of accelerating W-2 deadlines and provide the information to Congress led to substantial financial benefits. Congress took action to advance the deadline for employers to file W-2s to January 31.[33] By improving its ability to conduct compliance checks before issuing refunds, IRS prevented more than $5 billion in invalid refunds in the first 4 years since it implemented the new W-2 filing deadline.

Contact Information

For additional information about this high-risk area, contact James R. McTigue, Jr., or Jessica Lucas-Judy at (202) 512-6806 or [email protected] or [email protected].

Medicare Program & Improper Payments

Bookmark:

The Centers for Medicare & Medicaid Services (CMS) has taken some action to reduce improper payments but needs to do more to address Medicare’s financial and oversight challenges.

Why Area Is High Risk

Overall ratings for all five criteria remain unchanged since 2021. The following sections present more detailed information about Medicare improper payments plus three additional broad segments—(1) payments, provider incentives, and program management under Medicare fee-for-service (FFS); (2) Medicare Advantage (MA) and other Medicare health plans; and (3) design and oversight of the Medicare program and the effects on beneficiaries.

Medicare Program & Improper Payments

Monitoring: partially met. CMS continues to make progress in monitoring some areas. However, it needs to improve efforts to monitor provider enrollment screening processes, documentation requirements, and improper payments to MA plans. MA plans are private plans under contract with CMS to provide health care coverage to Medicare beneficiaries. CMS should take steps to routinely assess how variations in the documentation requirements between Medicare and Medicaid may affect estimates of improper payment rates. We also have made a number of recommendations to prompt CMS action to improve MA monitoring and oversight. This includes recommendations related to audits to identify and recover improper payments to MA organizations.

Demonstrated progress: partially met. Estimated improper payment rates for Medicare FFS increased by slightly more than 1 percentage point from fiscal year 2021 to 2022 to 7.5 percent—and decreased by about one-tenth of a percentage point to 1.5 percent for Medicare Part D (see fig. 31). For fiscal year 2022, CMS reported an MA improper payment rate of 5.4 percent. According to CMS, the agency refined its MA improper payment rate methodology for fiscal year 2022. As a result, the rate should not be compared with prior years’ rates. In total, Medicare improper payments were estimated to be about $46.8 billion in fiscal year 2022. Reducing improper payments in Medicare is critical to safeguarding federal funds.

Payments, Provider Incentives, and Program Management under Medicare FFS

Merit-Based Incentive Payment System. Under Medicare’s Merit-based Incentive Payment System, doctors and other providers may receive increases or decreases to their Medicare FFS payments based on factors like the cost and quality of care they provide. In October 2021, we found that, from 2017 to 2019, more than 90 percent of providers earned a small increase (less than 2 percent) to their Medicare payments. Providers we interviewed noted some strengths and challenges of the incentive payment system. For example, some said certain design aspects of the system helped smaller practices participate. Others said they were unsure if it helped improve the quality of care.

Hospital Value-Based Purchasing Program. In June 2017, we reported that under CMS’s Hospital Value-Based Purchasing Program, some hospitals with high efficiency scores received bonuses despite having relatively low quality scores. The CMS Hospital Value-Based Purchasing Program is intended to reward acute-care hospitals providing high-quality care at a lower cost. We have two open recommendations to help ensure the program accomplishes its goals.

Medicare Advantage and Other Medicare Health Plans

Encounter data. In June 2022, we reported that CMS was using encounter data—claims-like data collected from the sponsors of MA plans—in its methodology for risk adjusting payments to MA plans. Yet, it had neither addressed our recommendation from July 2014 nor implemented all the steps necessary to validate encounter data for completeness and accuracy.

MA plan payment adjustments. We reported in January 2012 that the inaccuracy of CMS’s adjustments to MA plan payment rates—which account for differences between FFS and MA providers’ coding of medical diagnoses—resulted in billions of excess payments to MA plans. We have an open recommendation to improve the accuracy of these adjustments.

Design and Oversight of the Medicare Program and the Effects on Beneficiaries

Medicare FFS’s benefit design and CMS’s oversight of it affect both beneficiaries’ out-of-pocket costs and the quality and safety of care they receive. Medicare FFS’s benefit design does not include a cap on the maximum cost-sharing amount a beneficiary can be responsible for during a given year for covered services. As we reported in January 2018, this could leave beneficiaries vulnerable to catastrophic costs, especially if they lack supplemental insurance.

Although Medicare FFS beneficiary premiums for calendar year 2023 were reduced, this is likely to be a temporary reprieve for Medicare beneficiaries. Medicare premiums are expected to continue increasing in the long term. Medicare premiums are based, in part, on changes to federal Medicare spending. In 2022, the Medicare Trustees have estimated that federal Medicare spending will grow at a faster rate than workers’ earnings and the economy overall in the long term. This could significantly burden Medicare beneficiaries facing these higher premiums.

In addition to its responsibility for oversight of the Medicare program, CMS must also ensure the quality of care beneficiaries receive. As noted below, CMS has made progress in certain areas, but we identified gaps in oversight of other areas.

Skilled nursing facilities. In July 2021, we recommended that CMS report on its Care Compare website weekend decreases in nurse staffing levels along with minimum staffing thresholds needed to ensure quality of care. As of May 2022, information on weekend nurse staffing has been incorporated into the Care Compare website. As a result, beneficiaries have an improved ability to make informed choices among skilled nursing facilities when choosing a facility for their care.

Hospice provider oversight. In October 2019, we reported that additional opportunities exist to strengthen CMS’s oversight of hospice providers. CMS collects data on the quality of hospice care but does not instruct hospice surveyors—those who conduct the program inspections—to use those data to inform their inspections. We have one open recommendation to improve CMS’s identification of quality of care issues in hospice programs. In addition, in December 2022, we reported on gaps in requirements for reporting allegations of abuse or neglect for individuals in hospice care. We have one open recommendation to address these gaps.

What Remains to Be Done

As of February 2023, 82 recommendations related to the Medicare program remain open. These recommendations include those related to improper payments. For example, we recommended that the Administrator of CMS seek legislative authority to permit payment for recovery auditors to conduct prepayment claims reviews. Reviewing Medicare claims before payments are processed can prevent improper payments. We also recommended that CMS develop policies and procedures for future emergencies, such as postponing rather than waiving fingerprint-based criminal background checks during future emergencies. In addition, we have recommended several actions to CMS to strengthen other aspects of the Medicare program, including that the Administrator of CMS should:

• account for Medicaid payments made when making Medicare uncompensated care payments to individual hospitals.
• improve its ability to identify self-referral of advanced imaging services.
• take steps to improve the accuracy of MA plan payment adjustments to reflect coding differences between FFS and MA providers’ coding of medical diagnoses by, for example, accounting for additional beneficiary characteristics such as sex and health status.
• complete all of the steps necessary to validate MA encounter data, including performing statistical analyses, reviewing medical records, and providing MA organizations with summary reports on findings.
• require that states survey agencies, which oversee nursing homes, submit abuse and perpetrator type information to CMS and that CMS systematically assess trends in these data.

Congressional Actions Needed

• directing the Secretary of HHS to implement additional reductions in payments to skilled nursing facilities that generate Medicare spending on potentially preventable critical incidents. Under current law, CMS is directed to make reductions of up to 2 percent to certain skilled nursing facilities’ payments to incentivize them to improve care. However, additional reductions are not authorized.
• equalizing payment rates that are higher for certain types of services provided in hospital outpatient departments rather than physicians’ offices. As of September 2022, Congress has yet to fully address this matter.

Benefits

• We have reported that CMS’s Fraud Prevention System has helped speed up certain investigation processes. The Fraud Prevention System analyzes claims to identify health care providers with suspect billing patterns. Further, the Healthcare Fraud Prevention Partnership has helped improve information sharing among payers inside and outside of the government. As of August 2022, the partnership has grown to include 259 federal partners, law enforcement, private payers, and other partners.
• Beginning on January 1, 2022, Medicare prescription drug plan sponsors are required to report actions related to inappropriate opioid prescribing to CMS, in response to our October 2017 recommendation. As a result, CMS can now gather more complete information on inappropriate opioid prescribing. This, in turn, can help inform progress made in achieving the agency’s goals to reduce this risk.
• In June 2021, we recommended that the Administrator of CMS review disenrollments by MA beneficiaries in the last year of life because we found that they disenrolled to join Medicare FFS at higher rates than other MA beneficiaries. Stakeholders also told us that, among other reasons, these beneficiaries may disenroll because of limitations accessing specialized care under MA. CMS has since analyzed these disenrollments and plans to continue doing so annually. This will allow CMS to better identify and address potential concerns regarding the care provided to MA beneficiaries in the last year of life.
• In December 2015, we suggested that Congress consider equalizing payment rates that are higher for certain types of services provided in hospital outpatient departments rather than physicians’ offices. Congress passed and the President signed multiple laws that partially addressed our concerns in 2015 and 2016. This includes legislation that created site-neutral payment rates for some off-campus hospital outpatient departments. In turn, an estimated cost savings of $4.4 billion in fiscal years 2017 through 2021 occurred.[34] Additionally, in November 2018 and in 2019, CMS issued final rules capping rates for certain Medicare services furnished by off-campus hospital outpatient departments; the agency estimated cost savings of about $1.5 billion in fiscal years 2019 through 2021.

Contact Information

For additional information about this high-risk area, contact Leslie V. Gordon at (202) 512-7114 or [email protected].

Strengthening Medicaid Program Integrity

Bookmark:

The Centers for Medicare & Medicaid Services (CMS) needs to strengthen its oversight of Medicaid expenditures to reduce improper payments and ensure the appropriate use of program dollars.

Why Area Is High Risk

Overall ratings for all five criteria remain unchanged since 2021 and are all partially met. The following sections present more-detailed information on the three segments that comprise the overall high-risk area: reducing improper payments, ensuring the appropriate use of program dollars, and improving program data.

Improper Payments

Leadership commitment: met. CMS continues to demonstrate leadership commitment to oversight of improper payments. It has taken additional steps to assess program risk and target its oversight accordingly. In March 2022, CMS outlined plans to use our fraud risk framework to help inform its approach to managing fraud risk across Medicaid. CMS prioritized risk assessments for program areas such as nonemergency medical transportation. Continued actions to identify program risks can help CMS develop strategies to mitigate these risks.

Capacity: partially met. CMS has issued guidance to help increase states’ capacity to identify improper payments. Nearly one quarter of Medicaid improper payments in 2020 related to nonenrolled providers and states’ noncompliance with provider screening and enrollment requirements. CMS issued guidance in June 2021 outlining information states were to submit to demonstrate compliance with these requirements. However, it allowed states to waive these requirements during the public health emergency. All states opted to do so.

Action plan: partially met. CMS has taken additional actions aimed at reducing improper payments in Medicaid. For example, it issued a proposed rule in September 2022 aimed at streamlining eligibility. CMS also released guidance to support state efforts to resume normal Medicaid eligibility and enrollment operations suspended during the COVID-19 public health emergency.[35] However, given known weaknesses in states’ eligibility processes, these efforts need to be balanced with those to prevent improper payments to beneficiaries who are ineligible for the program. CMS also outlined new requirements for nonemergency medical transportation providers designed to help prevent fraud and abuse.

Monitoring: partially met. While CMS has monitored some efforts to address improper payments in Medicaid, other important aspects of oversight are not being monitored. For example, CMS reviewed all states’ Medicaid plans for noncompliance with third-party liability requirements. These requirements help assure that Medicaid remains the payer of last resort for services. CMS directed noncompliant states to update their plans. However, in February 2021, we reported concerns with Puerto Rico’s Medicaid procurement processes, noting CMS’s lack of oversight of Medicaid procurements in states and territories. Because procurements constitute at least 50 percent of Medicaid program spending, such monitoring is critical to improving program oversight. In September 2021, we reported that CMS guidance for the certified community behavioral health clinics demonstration lacked clear and consistent information on aligning payment rates with costs and preventing duplicate payments.

Demonstrated progress: partially met. CMS’s overall estimated Medicaid improper payment rate increased slightly from 21.4 percent in fiscal year 2020 to 21.7 percent in fiscal year 2021. This rate decreased to 15.6 percent in fiscal year 2022. The Department of Health and Human Services (HHS) stated that the 2021 and 2022 rates reflect certain flexibilities afforded to states during COVID-19. These flexibilities include postponed eligibility determinations and reduced provider enrollment requirements. HHS also stated that fiscal year 2021 marked the first time CMS had a complete national estimate of improper payments due to eligibility errors in 7 years. However, the managed care component of the error rate continues to not account for all program risks.

Appropriate Use of Medicaid Dollars

The Consolidated Appropriations Act, 2021, required additional state reporting on supplemental payments made to eligible providers. CMS issued guidance indicating that it would begin collecting these data quarterly. In January 2022, it anticipated publicly reporting these data annually. This additional reporting, however, does not include information on the sources of funds used to finance the nonfederal share. In December 2020, we recommended CMS include this information because, without it, CMS cannot adequately determine whether payments are (1) consistent with statutory requirements for economy and efficiency, and (2) financed with permissible sources of funds.

Capacity: partially met. CMS has taken some actions toward building oversight capacity but needs stronger processes to ensure the appropriate use of state-directed payments to providers under managed care. CMS revised its review process for approving these payments. It now requires states’ proposals to include additional information, such as the estimated amount of the payments and plans to finance the nonfederal share of those payments. However, we reported in June 2022 that CMS does not require states to report the actual amounts of these payments. This leaves a gap in information needed for oversight. Oversight of state-directed payments will be increasingly important, given widespread approval of these proposals nationwide since 2017 (see fig. 32).

Action plan: partially met. CMS continues to implement scheduled policy changes to ensure budget neutrality of demonstrations. The most recent significant change began in 2021. The timing for other planned actions is unknown. While CMS indicated it needed to modify its financial reporting systems to capture new supplemental payment information, it did not provide a time frame for completion. Additionally, in August 2018, we recommended that CMS conduct a national assessment of resources needed to review state expenditure reporting. However, the agency’s plan to conduct the assessment has been suspended since 2019.

Monitoring: partially met. CMS has taken steps to improve its ability to monitor federal demonstration spending. In May 2021, CMS reported that states continued using a standardized budget neutrality monitoring tool. The agency is developing standard operating procedures to document its process for overseeing budget neutrality. For supplemental payments, however, CMS continues to lack a strategy for systematically identifying questionable provider payments—for example, payments exceeding a facility’s total costs, as identified in our prior work.

Demonstrated progress: partially met. CMS’s actions reduced total demonstration spending limits by an estimated $210 billion for 2016 through 2020, of which the federal share was more than $124 billion. An additional policy that took effect on January 1, 2021, should further reduce federal liabilities. CMS also issued a policy for its review and clearance of evaluations of demonstrations for public release. It has posted more than 30 related reports on its website as of February 2023, consistent with our January 2018 recommendation.

It is too early to determine the extent to which CMS’s new requirements for state reporting on supplemental payments will better ensure the appropriate use of Medicaid dollars. We continue to examine the widespread approval of state-directed payments.

Medicaid Data

Leadership commitment: met. CMS continues to demonstrate leadership commitment through its efforts to improve the quality and availability of Medicaid data. This includes its ongoing efforts to implement the Transformed Medicaid Statistical Information System (T-MSIS). These efforts include ensuring that all 50 states, the District of Columbia, and two U.S. territories submit monthly T-MSIS eligibility and claims data. Of these submissions, 37 states and territories met targets for submitting critical and high-priority data, as well as expenditure data, as of January 2023. In addition, CMS issued a proposed rule to implement a requirement for states to report annually on certain health care quality measures for the Medicaid population.[36] In July 2022, CMS released its first quality measure set to promote consistent quality measurement across states’ Medicaid home and community-based services programs.

Capacity: partially met. CMS took steps to increase states’ capacity to report Medicaid data. In June 2021, CMS announced it would release reporting templates and technical assistance toolkits. It also developed a web-based portal for states to submit required annual managed care reports. These steps provide more consistent and comprehensive information to hold states and managed-care organizations accountable for meeting program goals. In addition, CMS revised the process states use to report children’s receipt of screening, diagnostic, and treatment services. The revision allows states to have CMS use T-MSIS data to document these services on their behalf beginning in 2021. Nineteen states opted to do so. However, CMS has yet to define the required scope and methodology for independent audits of managed care data, as we recommended in October 2018.

Action plan: partially met. CMS has not developed a plan with time frames for using T-MSIS data for broad program oversight, as we recommended in December 2017. However, we reported in January 2021 that CMS has used T-MSIS data to oversee aspects of the Medicaid program, such as the number of beneficiaries receiving substance use disorder services. Additionally, during the public health emergency, CMS allowed all states to make temporary changes to their home and community-based services programs to maintain access to services and help prevent disease spread. However, in September 2021, we reported that CMS had no plan for evaluating these changes nor their effects after the public health emergency ends. Such a plan could help CMS better prepare for future emergencies.

Monitoring: partially met. CMS has taken some steps to improve its use of data to monitor Medicaid utilization and quality of care. However, more work remains. In June 2021, CMS began requiring states to submit annual managed care data assessments. It provided states with a series of tools to improve the monitoring and oversight of managed care programs. In addition, CMS has used T-MSIS data to monitor the effects of the COVID-19 public health emergency on enrollment and utilization.

However, in March 2022, we reported that despite a sizable increase in the use of telehealth services since the pandemic began, CMS neither assesses nor reports information on how telehealth affects the quality of care beneficiaries receive. Collecting and analyzing such data would be consistent with how CMS has encouraged states to use data on quality of care to identify disparities in health care and target opportunities to advance health equity. In May 2021, we also reported that data limitations complicated HHS’s efforts to assess the effectiveness of Certified Community Behavioral Health Clinics in providing behavioral health care services to beneficiaries.

Demonstrated progress: partially met. CMS continues to assess and improve T-MSIS data quality and expedite their use for program oversight. However, its assessments of T-MSIS data highlight areas where limitations persist and where states do not meet agency standards. Additionally, our March 2022 review of selected states’ T-MSIS data identified incomplete race and ethnicity data in all but one of the selected states. In addition, in one state, the data could not properly link beneficiaries with the services they received. CMS has also made T-MSIS research-ready analytic files publicly available. It introduced a means by which states and researchers can explore data quality by topic, such as enrollment, expenditures, and utilization.

What Remains to Be Done

• expand its review of states’ implementation of provider screening and enrollment requirements and, for states not fully compliant with the requirements, annually monitor their implementation progress;
• improve oversight of Medicaid procurements;
• collect sufficient provider-specific information from states on Medicaid payments to providers, including supplemental payments, and the sources of funds states use to finance their share of the payments, and specify what criteria should be used to ensure that Medicaid payments at the provider level are economical and efficient;
• complete an assessment and take steps to assure that resources to oversee state-reported expenditures are adequate and allocated according to risk; and
• continue efforts to assess and improve T-MSIS data and articulate specific plans and associated time frames for using these data for broad program oversight.

Congressional Actions Needed

Congressional action could improve oversight of Medicaid expenditures. In January 2008, we recommended Congress consider establishing statutory requirements for HHS to improve the demonstration review process to more clearly outline the methods used to demonstrate budget neutrality.

Benefits

• In multiple reports since the 1990s, we reported that HHS allowed states to use questionable methods that resulted in inflated demonstration spending limits and increased the federal government’s fiscal liability. In response, HHS issued a new policy in 2017 to better ensure that these demonstration projects are budget neutral. HHS estimated that this policy reduced the federal government’s fiscal liability in 10 states by $29.5 billion for 2020.
• In 2021 and 2022, CMS provided us with documentation of Risk Assessment Frameworks for Medicaid. These frameworks outline CMS’s approach for conducting fraud risk assessments using a standard format to document vulnerabilities, risk levels, residual risks, and mitigation strategies, among other topics. These actions met the intent of our 2017 recommendation and are consistent with leading practices identified in our fraud risk framework.
• To improve oversight of states’ payment structures for Medicaid managed care, we recommended that CMS require all states to collect and report on progress toward achieving managed care program goals. CMS issued guidance in June 2021 that triggered a requirement for states to submit annual reports on their Medicaid managed care programs. This, in turn, gives CMS more consistent and comprehensive information on states’ performance in meeting managed care program goals.

Contact Information

For additional information about this high-risk area, contact Catina Latham at (202) 512-7114 or [email protected] and Michelle Rosenberg at (202) 512-7114 or [email protected].

Improving and Modernizing Federal Disability Programs

Bookmark:

Why Area Is High Risk

In addition, both agencies rely on outdated criteria to decide whether individuals qualify for benefits. They also experienced delays in their efforts to update criteria. Beyond these benefit programs, we reported in June 2012 that the government has a patchwork of more than 40 employment support programs, which lack a unified vision, strategy, or set of goals to guide their outcomes.

Managing Disability Claims Workloads (SSA)

Although SSA has continued to reduce its appeals backlog, it has neither updated its plan for managing it since 2019 nor produced a similar plan for addressing a backlog of initial disability claims that grew during the COVID-19 pandemic. Such plans are especially important now, given expected workload increases as a result of the pandemic and ongoing service delivery changes. We reported in November 2022 that SSA lacks a plan for managing a possible future increase in claims due to COVID-19-related illnesses and other factors. We also reported that SSA’s transition to more remote services has presented new challenges for vulnerable populations.

Monitoring: decreased to partially met. This rating decreased from met to partially met. SSA continues to monitor and report on its progress toward achieving goals for timely processing of initial disability claims and appeals. However, the agency cannot fully monitor progress on its new initiatives to address capacity challenges without a detailed plan, which—as discussed above—SSA lacks.

Demonstrated progress: partially met. SSA has demonstrated mixed progress managing initial disability claims and appeals. During most of the pandemic, SSA completed fewer claims than it received (see fig. 33). At the end of fiscal year 2022, SSA’s cumulative inventory of pending initial claims was about 64 percent higher than its prepandemic average. According to SSA’s annual performance report, pandemic-related disruptions and staff attrition contributed to this increase. In contrast, SSA’s inventory of pending appeals decreased by 40 percent from the end of fiscal year 2019 to the end of fiscal year 2022.

Managing Disability Claims Workloads (VA)

Capacity: partially met. VA has improved its capacity to address initial claims and appeals workloads by enhancing its ability to predict workloads, improving information technology, and hiring thousands of staff. However, several planned actions have yet to be completed. Specifically, VA has yet to (1) fully implement activities intended to mitigate surges in workloads; (2) complete the planned hiring of veteran law judges; and (3) fully assess risks against timeliness, accuracy, and other goals, as called for in our March 2018 report.

Action plan: increased to met. This rating increased from partially met to met. Since 2021, VA has enhanced its action plan to manage its workload and refined metrics and milestones needed to track progress. For example, VA’s August 2022 action plan more clearly described how VA analyzes workload demand and staffing needs. It will remain important for the department to continue maintaining and refining its action plan, such as by further detailing the Board of Veterans’ Appeals’ (Board) plans to manage workload risks associated with fluctuations in demand.

Monitoring: increased to met. This rating increased from partially met to met. Since 2021, VA has improved its monitoring of and reporting on the timeliness of initial claims and appeals, among other performance metrics. For example, VA established processes to monitor progress toward implementing its corrective actions. Moreover, in December 2022, the Board set a goal to measure the quality of decisions in the new appeals process, as called for in our March 2018 report.

Demonstrated progress: partially met. While VA has reduced its backlog and inventory for initial disability claims and appeals under the old process, it has faced continuing challenges managing workloads. For example, VA reported a decline in its backlog of initial claims from a high of about 611,000 in March 2013 to about 151,000 in November 2022. However, VA workloads have fluctuated during this time period, particularly when legislative changes have been made to the disability compensation program. VA expects another workload surge related to veterans exposed to toxins in Iraq and elsewhere due to a new 2022 law.[37] In addition, the appeals inventory continues to grow, particularly for hearings. When claims and appeals inventories have spiked in the past, VA has taken years to resolve its workloads.

Updating Disability Benefit Eligibility Criteria (SSA)

Updating Disability Benefit Eligibility Criteria (VA)

Programs with Unified Strategies and Goals (Office of Management and Budget)

Demonstrated progress: partially met. In June 2020 we reported that the federal government exceeded a prior government-wide goal for hiring people with disabilities. Further, the Office of Personnel Management recently implemented our recommendation from that report to routinely track and report retention data for employees with disabilities. However, neither OMB nor the subcommittee have goals for or track progress toward increasing the employment of people with disabilities outside of the federal sector.

What Remains to Be Done

• SSA should develop an agency-wide plan for managing anticipated increases in its disability workloads.
• VA should improve its management of its workloads by assessing the performance of the new appeals process and address its associated risks.
• OMB should establish a set of measurable, government-wide goals for employment of people with disabilities, an action we identified in a 2012 report on opportunities to reduce overlap and duplication in the federal government.

Benefits

• VA improved its project planning for implementing its new appeals process. Our work identified that VA’s implementation plan did not include all key activities and was not supported by detailed planning. Implementing our recommendation helped ensure the agency was well positioned to implement the new appeals process.
• SSA implemented our recommendation to mitigate risks and assess costs for implementing and maintaining its occupational information system. This helped SSA ensure that it could devote sufficient resources to maintaining its system going forward.

Contact Information

For additional information about this high-risk area, contact Elizabeth H. Curda at (202) 512-7215 or [email protected].

National Flood Insurance Program

Bookmark:

Why Area Is High Risk

• Congress has yet to enact comprehensive program reforms related to the six areas we identified in 2017, including premium rates, affordability, and debt, which is shown in figure 34.

Action plan: increased to met. Since our 2021 High-Risk update, FEMA has completed two planning efforts that address the fiscal exposure created by NFIP. First, FEMA completed its Sound Financial Framework. This framework identifies actions to improve NFIP’s financial resilience, among other things. Second, FEMA completed a comprehensive legislative proposal that identifies actions Congress can take to address financial resilience as well as other actions we have suggested. Our suggestions included providing means-based assistance to homeowners with difficulty affording premium rates.

Demonstrated progress: partially met. Since our prior report, FEMA has implemented an October 2008 recommendation to revise its rate-setting methodology to better reflect a property’s expected losses from a flood. It has also continued to take actions to address other outstanding recommendations. Congress has passed multiple short-term reauthorizations of the program, most recently when it passed an authorization set to expire on September 30, 2023. However, Congress has yet to enact comprehensive reforms related to the six areas we identified in April 2017 (program debt, full-risk-rates, affordability, consumer participation, private-sector involvement, and flood resilience).

What Remains to Be Done

• Annually analyze the amounts of actual expenses and profit in relation to the estimated amounts used in setting Write-Your-Own insurers’ payment rates.
• Assess different approaches, in addition to community assistance visits, for using existing resources to ensure communities’ compliance with NFIP requirements.
• Determine what information is available related to the mandatory purchase requirement. Then, in turn, use that information to develop strategies for increasing consumer participation in the flood insurance market.

Congressional Actions Needed

• enacting comprehensive reform, which could include actions in six areas: (1) addressing the current debt; (2) removing existing legislative barriers to FEMA’s ability to revise premium rates to reflect the full risk of loss; (3) addressing affordability; (4) increasing consumer participation; (5) removing barriers to private-sector involvement; and (6) protecting NFIP flood resilience efforts.
• requiring FEMA to evaluate how comprehensive and up-to-date flood risk information could be used to determine which properties should be subject to the mandatory purchase requirement.
• providing FEMA direction or authority to implement one or more options identified to address property acquisition challenges, such as preapproval of properties for acquisition or streamlining the acquisition process, among others.

Benefits:

• the annual amount that NFIP collects in premiums is generally insufficient to cover high losses, especially in years of catastrophic flooding. In response, in April 2021, FEMA adjusted its rate-setting methodology. This improved the accuracy of the premiums charged and reduced financial risk to the taxpayers and federal government.
• FEMA’s legacy data system had significant weaknesses. These weaknesses included a lengthy data submission and validation process, limited reporting capabilities, and erroneous and unreliable data. In response, in October 2019, FEMA launched a modernized data system to help administer NFIP effectively.

Contact Information

For additional information about this high-risk area, contact Alicia Puente Cackley at (202) 512-8678 or [email protected].

Managing Risks and Improving VA Health Care

Bookmark:

Why Area Is High Risk

VA has continued to face system-wide challenges since our 2021 High-Risk Report. These challenges include overseeing patient safety and access to care, addressing critical staffing, and meeting future infrastructure needs. Additionally, VA has a number of major modernization initiatives that are still in the early stages of implementation, including those related to financial management and electronic health records.

Ambiguous Policies and Inconsistent Processes

Leadership commitment: increased to met. VA has improved from a partially met rating as it integrated previously established Veterans Health Administration (VHA) policy management initiatives into an updated VHA policy management directive in March 2022. For example, VA now has finalized processes to ensure local policy is consistent with national policy by standardizing and requiring continual monitoring of local policy documents. Further, VA has now addressed all recommendations from our September 2017 report on VHA policy management.

Capacity: partially met. VA has maintained policy procedures it previously established, such as using a process to address funding needs for new national policies. To help accomplish its policy management initiatives, VA officials stated it uses contracts—an estimated $10 million in fiscal year 2022—to support its capacity needs, including the use of professional policy writers to assist program offices. VA notes that its ability to meet some of its projected timelines for these efforts depends on continued contract support.

Action plan: increased to met. VA has improved from a partially met rating. VA’s updated August 2022 action plan presents a clear road map for addressing the root causes of ambiguous policies and inconsistent processes, including elements that will demonstrate progress on its goals. For example, VA uses a metric to show if it is achieving its goal to review national policies before they reach their 5-year expiration dates.

Monitoring: increased to partially met. VA has improved from a not met rating as it identified some activities for tracking progress in this area, such as surveying users on its policy development processes. VA also established overall monitoring procedures and tools, such as a metrics dashboard, to address all high-risk efforts.

Demonstrated progress: increased to partially met. VA has improved from a not met rating as it implemented 20 policy-related recommendations since our last high-risk update in 2021. Also, VA has begun to use some data to show actions taken to implement its action plan. For example, VA successfully reduced the number of expired policies by 32 percent between March 2021 and August 2022. This helped to address issues with untimely policy management. It will be important for VA to further refine its metrics to demonstrate that root causes are being addressed and progress is sustained over time.

VA should also continue to implement our other recommendations. Since March 2021, we have made 14 new recommendations, four of which have been implemented. For example, we recommended that VA establish a national policy to document complaints about community living center care so they can be tracked and resolved.

Inadequate Oversight and Accountability

Demonstrated progress: increased to partially met. VA has improved from a not met rating as it has implemented 42 oversight-related recommendations since March 2021. It has begun to use some data to show actions taken to implement its action plan. For example, VA deployed a platform for staff to input and categorize risks. In turn, it has begun reporting these data to help address fragmented oversight. VA must continue to expand its use of data to demonstrate that root causes are being addressed and progress is sustained over time. It also must continue implementing our recommendations. For example, since March 2021, we have made 35 recommendations to address continued oversight and accountability issues. This includes five recommendations related to counseling services VHA provides through 300 Vet Centers to help eligible veterans, service members, and their families readjust to civilian life or to continued military service.

Information Technology Challenges

Action plan: partially met. Since 2021, VA underwent an effort to reassess the root causes of IT challenges. It also updated its action plan to better respond to our 2015 High-Risk Report concerns related to the outdated, inefficient nature of certain systems, and incorporate VA’s current IT strategic initiatives. While VA’s updated action plan includes some actions, milestones, and measures that will show progress toward reaching its goals, it lacks certain details. For example, VA has not included any corrective actions, milestones, or performance measures related to deploying its EHR system. Figure 35 depicts how VA’s EHR modernization will enable sharing of veteran health data with the Department of Defense through the shared EHR system. This key effort has faced continued delays since our 2021 High-Risk Report, affecting the implementation of this $16.1 billion initiative.

Demonstrated progress: increased to partially met. VA has improved from a not met rating as it has implemented 11 IT-related recommendations since March 2021. It has begun to produce some data related to its metrics. However, VA needs to further develop its metrics to show how it is implementing its action plan and that the actions taken are addressing root causes. VA also should continue to implement our recommendations. Since March 2021, we have made eight recommendations to address IT issues. This includes two recommendations in February 2022 related to data management challenges VA needs to address for its EHR system. One called for VA to establish and use performance measures and goals to ensure the quality of migrated data. VA concurred with our recommendations, both of which remain open.

Inadequate Training for VA Staff

Since March 2021, we have made three recommendations to address training issues. For example, in January 2022, we found that VA cannot readily track all memorandums of agreement it uses to partner with nongovernmental entities focused on mental health and suicide prevention efforts. We recommended that VA require training and provide a more comprehensive user guide to officials using the application it designed to document agreement information. VA concurred with our recommendation, which remains open. One of the three training recommendations has been implemented by VA.

Unclear Resource Needs and Allocation Priorities

Since March 2021, we have made nine recommendations to address resource allocation issues. This includes two recommendations in February 2022 related to data limitations for determining supply and demand for community care in 96 health care markets nationwide. We recommended VA review the data to identify any gaps and take steps to address data completeness. VA concurred with our recommendations, both of which remain open.

What Remains to Be Done

• We recommended in June 2018 that VHA establish a metric for its Veterans Community Care Program to monitor whether veterans are receiving community care within time frames comparable to those at VA facilities. The Consolidated Appropriations Act, 2023, requires VHA to apply designated access standards as an overall performance measure for community care. This will allow VHA to monitor timeliness under the Veterans Community Care Program.[38] We plan to review VHA’s implementation of this requirement.
• We recommended in February 2019 that VHA develop policies and guidance for employing providers who had registrations for prescribing controlled substances revoked or surrendered for cause.
• In September 2019, we found that some of VHA’s 18 regional networks of medical centers and clinics increased funding allocations to facilities experiencing declining or flat workloads. We recommended VA revise its guidance requiring regional networks to submit approaches to improve these facilities’ efficiencies, such as adjusting the level of services offered.

Benefits

• VHA implemented new tools for tracking and overseeing VA medical center reporting of providers with clinical care concerns. This will better ensure VHA is sharing information about serious quality and safety concerns, and its providers are competent to provide safe, high-quality care to veterans.
• VA collected data on community care appointment scheduling challenges. This included documenting if no providers were available or no providers were available within VA’s timeliness standards. This will help it monitor data and ensure veterans receive timely community care.
• In addition, VHA clearly defined roles for resolving pending enrollment applications and timely processing of applications and accurate enrollment determinations. These actions will help prevent veterans from experiencing unnecessary delays when enrolling for health care benefits. They will also ensure that deficiencies are being addressed appropriately.

Contact Information

For additional information about this high-risk area, contact Sharon Silas at (202) 512-7114 or [email protected].

Unemployment Insurance System

Bookmark:

Why Area Is High Risk

In June 2022, we designated the Unemployment Insurance (UI) system—a joint federal-state program—as high risk. We found that UI’s administrative and program integrity challenges pose significant risks to service delivery and expose the system to significant financial losses. Long-standing challenges with UI administration and outdated IT systems have affected states’ ability to meet the needs of unemployed workers, especially during economic downturns. Such challenges have also contributed to impaired service, declining access, and disparities in benefit distribution. DOL recently estimated UI improper payments decreased from $78.1 billion in fiscal year 2021 to $18.9 billion in fiscal year 2022. However, the estimated improper payment rate increased during the same period from 18.9 percent to 22.2 percent respectively. Some of these estimated improper payments were reportedly due to fraud.

In June 2022, we reported that DOL has some activities planned and underway that may address the risks we identified in the UI system. However, additional action is needed. DOL’s UI modernization plan and its efforts to work with states to address fraud, advance equity, and modernize IT systems are steps in the right direction. However, further efforts and sustained action to address recurring UI issues would help stabilize the system and prevent future disruptions to UI administration during economic downturns. Therefore, we designated the UI system as high risk in June 2022. Since this is a recently designated area, we will not rate DOL’s progress until our next High-Risk Report in 2025.

Leadership commitment: We and the DOL Office of Inspector General (OIG) have found that DOL needs to improve its leadership and coordination of actions addressing risks to UI service delivery and program integrity. DOL leadership has acknowledged the need for significant reform of the UI system. In August 2021, DOL established the Office of Unemployment Insurance Modernization within the Office of the Secretary to provide strategic leadership as the department implements its UI modernization plan.

While this action is promising, the office is temporary, consists of a small leadership team, and lacks long-term timelines for planned activities. A long-term strategic plan and sustained leadership are critical to fulfilling the vision outlined in DOL’s UI modernization plan.

Capacity: Limitations in state and federal capacity have been recurring findings in our UI reports and those of the DOL OIG, especially related to ensuring the UI system responds effectively to economic downturns. Between 2009 and 2017, to help states modernize their IT infrastructure, DOL provided funding for consortiums (i.e., multiple states that develop a single common system), among other efforts. However, we previously reported that states faced challenges using this approach, such as managing differences in state laws and business processes. According to the National Association of State Workforce Agencies, when the pandemic began in 2020, many states were still relying on outdated IT systems. Our June 2022 report identified staffing limitations, outdated IT infrastructure, and the limited effectiveness of benefit triggers during economic downturns as some of the capacity challenges faced by the UI system.

DOL has used funding from the American Rescue Plan Act of 2021 to support states in modernizing their IT systems, including the early development of modular technology solutions that can be integrated with state IT systems and a blueprint for the UI customer experience. However, lasting and system-wide solutions are important to meet the vision for infrastructure improvements outlined in DOL’s UI modernization plan.

Action plan: DOL outlined several principles for UI system reform in its fiscal year 2022 and 2023 congressional budget justifications. In addition, in April 2022, DOL released an Equity Action Plan. The plan outlined existing barriers to equitable outcomes in the UI system and summarized DOL’s ongoing and planned actions to advance equity. However, we reported in June 2022 that DOL has yet to conduct comprehensive analyses of the extent of or potential causes for system-wide disparities in benefit receipt or options for supporting nontraditional workers and reflecting a modern economy.

In addition, we found that DOL has not comprehensively assessed UI fraud risks in alignment with leading practices as provided in our Fraud Risk Framework. Clear plans to identify root causes and potential solutions to the challenges underlying DOL’s reform principles are necessary for long-term progress. Action plans can also support DOL’s monitoring efforts and help ensure progress.

Monitoring: DOL collects data from states on UI claims, compensation, payment timeliness, and overpayments, among other information. However, we have identified some limitations in the completeness and accuracy of these data and made related recommendations for improvement. DOL will need high-quality and potentially new data to monitor the effectiveness of UI modernization activities.

Demonstrated progress: DOL needs to make progress reducing the improper payment rate; better managing fraud risk; advancing equity, including across racial and ethnic groups and states; better reaching current worker populations and reflecting the modern economy; restoring prepandemic payment timeliness levels; and improving its response to economic downturns. DOL can demonstrate progress in these areas by implementing our UI-related recommendations and those of the DOL OIG, which align with DOL’s principles and vision for UI reform and are critical for resolving significant risks. Moving forward, it also will be important that DOL’s approach is coordinated—involving state and federal stakeholders, as appropriate—to ensure significant progress in improving the UI system’s performance and integrity.

What Remains to Be Done

• develop and execute a transformation plan that meets our high-risk criteria. The plan should outline coordinated and sustained actions to address known issues related to providing effective service and mitigating financial risk, including ways to demonstrate improvements; and
• designate a dedicated entity and document its responsibilities for managing the process of assessing fraud risks to the UI program, consistent with leading practices as provided in our Fraud Risk Framework.

Potential Benefits

Strengthening the UI system can improve service to unemployed workers and reduce exposure of the system to financial risks. By addressing audit recommendations, including developing and executing a plan that meets our high-risk criteria for transformation, DOL has the potential to achieve quantifiable results in reducing improper payment rates, including those related to fraud; improving efficiency in claims processing and restoring pre-pandemic payment timeliness levels; better reaching current worker populations; and enhancing equity in benefit distributions.

Contact Information

For additional information about this high-risk area, contact Thomas Costa at (202) 512-4769 or [email protected].

Appendix III: GAO’s 2023 High-Risk List

Bookmark:

Appendix IV: Image and Figure Sources

Bookmark:

GAO produced all dashboards depicting changes in high-risk areas, as seen in the following example: