Search

The Office of Personnel Management (OPM) manages the systems that process retirement benefits for most federal civilian employees. In fiscal year 2003, over 198,000 claims were processed and over $50 billion in benefits was paid through OPM's retirement systems. OPM is trying to modernize these systems through a program called Retirement Systems Modernization (RSM). The conference report accompanying the fiscal year 2004 OPM appropriations act directed us to review the management of and challenges facing RSM. Specifically, our objectives were to determine (1) the current status of and plans for OPM's RSM program and (2) the challenges OPM faces in successfully managing the program. The Office of Personnel Management (OPM) is in the midst of an effort known as Retirement Systems Modernization (RSM). OPM's goals, through this program, are to improve customer service, reduce calculation errors, and reduce the amount of paper-based and manual processing. OPM expects RSM's total cost to be about $294 million from fiscal year 1997 to fiscal year 2008, when the agency expects to have most of RSM implemented and integrated. As currently envisioned, RSM comprises four major components: licensed technology for pension benefits administration, data conversion of paper files and development of electronic processes for capture and storage of data, coverage determination and other applications, and foundation and infrastructure elements. GAO's experience with major systems acquisitions such as RSM has shown that having sound systems acquisition, change management, and investment management processes in place increases the likelihood of the acquisitions meeting cost and schedule estimates as well as performance requirements. However, GAO found that many of the processes in these areas for RSM are not sufficiently developed, are still under development, or are planned for future development. For example, OPM lacks needed processes for developing and managing requirements, planning and managing project activities, managing risks, and providing sound information to investment decision makers. Without these processes in place, RSM is at increased risk of not being developed and delivered on time and within budget and falling short of promised capabilities. [ABSTRACT FROM AUTHOR]

Pursuant to a legislative requirement, GAO reviewed the internal control requirements in Title 6, "Pay, Leave, and Allowances of the GAO Policy and Procedures Manual for Guidance of Federal Agencies" as they relate to the Air Force's Air Mobility Command's employee time and attendance (T&A) system, focusing on whether: (1) military leave records must be maintained in paper form containing handwritten signatures; and (2) it is permissible to have the supervisor approve staff leave requests on the Air Force's proposed T&A system by using an user identification code or a password in lieu of the electronic signature required in Title 6. GAO noted that: (1) Title 6 does not prescribe the form in which records must be maintained, but recognizes that agency records of T&A data are maintained in hard copy, automated files, or a combination of the two; (2) it is permissible for the proposed system to include user identification codes and passwords for the supervisor; (3) the cost of implementing electronic signatures meeting certain criteria is prohibitive and not cost effective compared to the benefits such signatures provide; (4) the requirement in section 3.6 of Title 6 that supervisors use electronic signatures is based on the risks associated with automated records and approvals; (5) however, the requirement is forward looking with a view toward evolving, affordable technology; (6) in the interim, before widespread application of cost effective electronic signatures is readily available, T&A systems should be designed to ensure that approved T&A data are protected against loss or alteration; and (7) the proposed system can provide for compensating controls to minimize the risks of intentional or unintentional alteration of approved T&A data and to ensure the accuracy of the data. [ABSTRACT FROM AUTHOR]

The decennial census is a constitutionally mandated activity, with immutable deadlines. It produces data used to allocate about $200 billion yearly in federal financial assistance, reapportion the seats of the House of Representatives, and provide a profile of the nation's people to help guide policy decisions. The U.S. Census Bureau (Bureau) estimates the 2010 Census will cost $11.3 billion, making it the most expensive census in the nation's history, even after adjusting for inflation. Based primarily on GAO's issued reports, this testimony addresses the extent to which the Bureau has (1) developed detailed and timely cost data for effective oversight and cost control, (2) reduced nonresponse mail follow up costs, and (3) produced risk mitigation plans to address identified challenges. The Bureau's most recent life-cycle cost estimate for the 2010 Census does not reflect the most current information from testing and evaluation nor provide complete information on how changing assumptions may affect cost. As GAO reported in January 2004, the Bureau derived its initial cost estimate by considering the cost of the 2000 Census along with certain assumptions that drive costs, such as staffing needs, the nonresponse rate for mailing back the census questionnaire, census worker productivity and pay rates, and inflation; however, GAO's ongoing work has found that the most recent (September 2005) estimate does not incorporate current information on certain 2001 assumptions. For example, the 2004 Census Test suggests some assumptions about staffing and space associated with new technology have changed. Specifically, Bureau evaluations indicate that more staff at the local census office was needed to support the use of the new hand-held mobile computing device (MCD) and additional storage space was needed for the MCDs. Since 2000, the Bureau has reengineered the decennial census and has begun new initiatives to reduce nonresponse follow up costs. Key to the Bureau's steps to reduce the costs of nonresponse follow up is successfully using the MCDs to eliminate millions of paper questionnaires and maps. Importantly, the Bureau must first resolve the MCD's technological challenges. During 2004 and 2006 tests, the MCDs had significant reliability problems. For example, in the 2004 test the MCDs experienced transmission problems, memory overloads, and difficulties with the map ping feature. Bureau officials have contracted the design and implementation for a new MCD that will not be ready until the 2008 Dress Rehearsal. If after the Dress Rehearsal the MCD is found not to be reliable, the Bureau could be faced with the remote but daunting possibility of having to revert to the costly paper-based Census used in 2000. The Bureau does not have risk mitigation plans to address certain identified challenges to a cost-effective census. Most notably, the Bureau does not have a plan to assess additional resources that may be needed to update the... [ABSTRACT FROM AUTHOR]

The National Defense Authorization Act for Fiscal Year 2004 requires GAO to report on the timeliness of Department of Defense (DOD) payments made to small businesses. GAO's report focuses on (1) whether, at DOD payment centers for which data were available, small business invoices were more likely to be paid late; (2) whether systemic weaknesses in DOD payment processes result in late payments to contractors--including small business contractors; and (3) the impact of late payments on small businesses. To calculate timeliness rates, GAO used the data DOD was able to provide for 9 of its 20 vendor payment locations as well as its one contract pay location. GAO used a case study approach for the third objective because data limitations did not permit the use of statistically reliable sampling techniques for assessing the experiences of DOD small business contractors as a whole. Case study contractors were selected because they experienced a high frequency of late payments and may not be reflective of all small businesses. DOD paid small business invoices late more often than all invoices paid at the nine locations for which data were available. Ten percent of all invoices at these locations were paid late--compared with 14.5 percent of small business invoices. According to DOD officials, the disparity may have occurred because DOD's cash management and prioritization practices tend to favor paying larger vendors first. Although DOD has reported significant improvements in its metrics related to late payments, these improvements have come through dedicating additional resources to the problem and not through addressing the underlying weaknesses that cause late payments. Resolving the payment timing disparity will involve improving the overall timeliness of DOD payments to contractors regardless of size. Systemic weaknesses in DOD's payment processes result in late payments to contractors, including small business contractors. DOD continues to process mostly paper payment documents, which can often result in redundant data entry; misplaced documents; higher than necessary transaction processing fees; and ultimately, payment delays. To its credit, DOD has invested in a Web-based tool, WAWF, that could facilitate the electronic exchange of payment data and documents, but the initiative lacks the requisite management focus and strategic direction needed to be successful. For example, the WAWF program lacks performance metrics and does not have a clear strategy for ensuring that WAWF will be effectively utilized. Finally, in many cases, the military services and defense agencies are not required to acknowledge receipt and acceptance electronically. Instead, they submit paper documents that must be matched with contractor invoices to complete the payment transaction, which can lead to payment delays. Disruptions of cash flow caused by late payments--depending on the extent and duration--can significantly affect the day-to-day operations... [ABSTRACT FROM AUTHOR]

The Department of Housing and Urban Development (HUD) provides subsidies, known as housing assistance payments, under contracts with privately owned, multifamily projects so that they are affordable to low-income households. Project owners have expressed concern that HUD has chronically made late housing assistance payments in recent years, potentially compromising owners'ability to pay operating expenses, make mortgage payments, or set aside funds for repairs. GAO was asked to discuss the timeliness of HUD's monthly housing assistance payments, the factors that affect payment timeliness, and the effects of delayed payments on project owners. From fiscal years 1995 through 2004, HUD disbursed three-fourths of its monthly housing assistance payments on time, but thousands of payments were late each year, affecting many property owners. Over the 10-year period, 8 percent of payments were delayed by 2 weeks or more. Payments were somewhat more likely to be timely in more recent years. The process for renewing HUD's subsidy contracts with owners can affect the timeliness of housing assistance payments, according to many owners, HUD officials, and contract administrators that HUD hires to work with owners. HUD's renewal process is largely a manual, hard-copy paper process that requires multiple staff to complete. Problems with this cumbersome, paper-intensive process may delay contract renewals and cause late payments. Also, a lack of systematic internal processes for HUD staff to better estimate the amounts that HUD needs to obligate to contracts each year and monitor contract funding levels on an ongoing basis can contribute to delays in housing assistance payments. Although HUD allows owners to borrow from reserve accounts to lessen the effect of delayed housing assistance payments, 3 of 16 project owners told GAO that they had to make late payments on their mortgages or other bills--such as utilities, telephone service, or pest control--as a result of HUD's payment delays. Owners who are heavily reliant on HUD's subsidy to operate their properties are likely to be more severely affected by payment delays than other, more financially stable, owners. Owners reported receiving no warning from HUD when payments would be delayed, and several told GAO that such notification would allow them to mitigate a delay. Nonetheless, project owners, industry group officials, and HUD officials generally agreed that late housing assistance payments would be unlikely to cause an owner to leave HUD's housing assistance programs, because such a decision is generally driven primarily by local market factors. [ABSTRACT FROM AUTHOR]

This testimony outlines (1) the impact of the recent increased operational tempo on the process used to reimburse Army Guard soldiers for travel expenses and the effect that travel reimbursement problems have had on soldiers and their families; (2) the adequacy of the overall design of controls over the processes, human capital, and automated systems relied on for Army Guard travel reimbursements; (3) whether the Department of Defense's (DOD) current efforts to automate its travel reimbursement process will resolve the problems identified; and (4) other DOD actions to improve the accuracy and timeliness of Army Guard travel reimbursements. Mobilized Army Guard soldiers have experienced significant problems getting accurate, timely, and consistent reimbursements for out-of-pocket travel expenses. These weaknesses were more glaring in light of the sustained increase in mobilized Guard soldiers following the terrorist attacks of September 11, 2001. To its credit, the Defense Finance and Accounting Service (DFAS) hired over 200 new personnel to address travel voucher processing backlogs and recently upgraded their training. However, Guard soldiers in our case study units reported a number of problems they and their families endured due to delayed or unpaid travel reimbursements, including debts on their personal credit cards, trouble paying their monthly bills, and inability to make child support payments. The soldier bears primary responsibility for travel voucher preparation, including obtaining paper copies of various types of authorizations. DFAS data indicate that it rejected and asked soldiers to resubmit about 18 percent of vouchers during fiscal year 2004--a churning process that added to delays and frustration. Also, existing guidance did not clearly address the sometimes complex travel situations of mobilized Army Guard soldiers, who were often housed off-post due to overcrowding on military installations. Further, DOD continued to be noncompliant with a law that requires payment of late payment interest and fees when soldiers' travel reimbursements are not timely. With respect to human capital, GAO found a lack of oversight and accountability and inadequate training. Automated systems problems, such as nonintegration of key systems involved in authorizing and paying travel expenses and failure to automate key processes, also contributed to the inefficient, error-prone process. DOD has been developing and implementing the Defense Travel System (DTS) to resolve travel-related deficiencies. However, DTS will not address some of the key systems flaws. For example, DTS is currently not able to process mobilized soldier travel authorizations and vouchers and identify and calculate late payment interest and fees. [ABSTRACT FROM AUTHOR]

This report responds to a Congressional request that, in conjunction with our audit of the Internal Revenue Service's (IRS) fiscal year 2004 financial statements, we review the agency's procedures for handling and processing receipts and taxpayer information at the Brookhaven service center campus. As a result of the increased percentage of taxpayers filing returns electronically, IRS designed a detailed business plan to reduce the number of service center campuses that process paper returns. In fiscal year 2004, Brookhaven became the first service center campus to downsize its submission processing function, leading to changes in its operations and a significant reduction in the volume of taxpayer receipts and information processed. Congress requested this review in light of these significant changes in operations and IRS's desire to benefit from the Brookhaven experience in planning for future submission processing rampdowns. Specifically, we were asked to (1) review the policies and procedures IRS developed to safeguard and process taxpayer receipts and information at the modified Brookhaven operation and (2) offer recommendations, if any, for improving internal controls at Brookhaven and at other submission processing centers that will undergo future rampdowns. To accommodate the request, we agreed to add a review of the mail control function at the Brookhaven service center campus to our tests of internal controls conducted as part of our audit of IRS's fiscal year 2004 financial statements. We have performed extensive work in reviewing internal controls designed to safeguard taxpayer receipts and information as part of our annual financial audits of IRS. In performing this work, we have come to recognize the significance and importance of the submission processing function to IRS and the potential for loss, theft, or misuse of taxpayer receipts and information if controls are not properly designed and effectively implemented. Our audits have identified weaknesses in internal controls over the safeguarding of taxpayer receipts and information related to submission processing activities at IRS's service center campuses, lockbox banks, and field offices. In reviewing the Brookhaven rampdown procedures, we considered the internal control weaknesses previously found at other service center campuses. We found that IRS completed the rampdown at Brookhaven without any significant disruptions in service. However, we did identify several areas where improvements could be made to internal controls at the Brookhaven service center campus residual mail processing unit, as well as to the process for estimating mail volumes. These issues are also relevant to IRS as it proceeds in ramping down future submission processing functions. Specifically, we found that IRS developed standard operating procedures for employees processing incoming mail at Brookhaven during the rampdown. However, we found that these procedures did not include detailed instructions for (1) tracking taxpayer receipts and information forwarded to other service center campuses for further processing and (2) handling cash receipts found during the extraction process. The absence of these instructions increases the risk that employees with significant internal control responsibilities over high-risk and vulnerable assets are not aware of the correct procedures to be followed in safeguarding and processing taxpayer receipts and information, thereby increasing the risk of their theft, loss, or misuse. Staff at the Brookhaven location did not always follow the required procedures to safeguard taxpayer receipts and information in its facilities. We found that (1) access rights allowed to visitors were not always appropriately restricted; (2) trash, which included taxpayer information, was not always sufficiently secured; and (3) candling was not always properly performed. The lack of adherence to IRS's procedures increases the risk of theft, loss, or misuse of taxpayer receipts and information. IRS did not have a documented methodology for estimating post-rampdown mail volumes at service center campuses selected for rampdowns. The lack of a documented methodology increases the risk that adequate mail volume information will not be gathered, maintained, and appropriately considered as estimates are prepared to assist IRS management in making decisions related to sites selected for future rampdowns and assessing their ultimate success. [ABSTRACT FROM AUTHOR]

Ineffective oversight and management of the Department of Defense's (DOD) travel card program, which GAO previously reported on, have led to concerns about airline tickets DOD purchased but did not use and for which it did not claim refunds. GAO was asked to (1) determine whether, and to what extent, airline tickets purchased through the centrally billed accounts were unused and not refunded and (2) determine whether DOD's internal controls provided reasonable assurance that all unused tickets were identified and submitted for refunds. Control breakdowns over the centrally billed accounts resulted in DOD paying for airline tickets that were not used and not processed for refund. DOD was not aware of this problem before our audit and did not maintain data on unused tickets. We determined, based on airline data, that DOD had purchased--primarily in fiscal years 2001 and 2002--about 58,000 tickets with a residual (unused) value of more than $21 million that remained unused and not refunded as of October 2003. We also identified more than 81,000 partially unused airline tickets with a purchase price of about $62 million that will require additional analysis to determine the residual value. Based on further analysis of the limited data, it is possible that DOD purchased at least $100 million in airline tickets that it did not use and for which it did not claim refunds from fiscal years 1997 through 2003. Although GAO asked DOD's five most frequently used airlines for fiscal year 2001 and 2002 unused ticket data, the airlines did not provide uniform, complete, or consistent responses. For example, one airline did not provide partially unused ticket data, another airline's fiscal year 2001 data covered only September 2001, while yet another airline provided data on electronic tickets dating back to November 1998. Although additional data on unused tickets may be available from the airlines' archives, our attempts to obtain additional information were unsuccessful. DOD's unused ticket problems were caused by a flawed process that relied extensively on DOD personnel to report unused tickets to the travel offices. Although it appears that many unused tickets were processed for a refund, the internal controls DOD had in place did not detect millions of dollars of unused airline tickets. Specifically, DOD did not systematically implement compensating procedures to identify instances in which DOD personnel did not report unused tickets, or reconcile the centrally billed accounts to travel claims to determine whether airline tickets were used. Although some units had instituted a process by fiscal year 2002 to more systematically identify instances of unused tickets, the process was not implemented DOD-wide, DOD did not verify that units were consistently implementing the process, and the process could only identify unused electronic--not paper--tickets. [ABSTRACT FROM AUTHOR]

Testifying before Congress in 2002, military beneficiary groups and civilian managed care support contractors described problems with the processing of TRICARE claims for civilian-provided care. These problems included slow payments and procedures that made claims processing inefficient. The Bob Stump National Defense Authorization Act of 2003 required GAO to review improvements to TRICARE claims processing and continuing impediments to claims processing efficiency. Specifically, GAO describes (1) efforts to improve claims processing and changes in processing timeliness and (2) Department of Defense (DOD) procedures and data that continue to affect claims processing efficiency. To identify improvements to claims processing and impediments to processing efficiency, GAO analyzed 1999 and 2002 claims data for changes in processing timeliness. GAO also interviewed and analyzed claims processing documentation from DOD officials, managed care support contractors, and claims processors. In an effort to improve TRICARE claims processing, DOD and its managed care support (MCS) contractors have made changes that are designed to make it more efficient. First, they have jointly identified--and then eliminated or changed--certain DOD requirements they deemed inefficient and nonessential to accurate claims processing. For example, contractors are no longer required to hold claims with incomplete information and request the missing information from the provider or beneficiary. Instead, contractors may now return some claims with missing information. In another change, DOD eliminated preauthorization requirements for certain procedures and gave the MCS contractors more latitude for determining when preauthorizations are appropriate. To encourage providers to submit their claims electronically, DOD gave MCS contractors the authority to decide whether to adjudicate electronically submitted claims sooner than those submitted on paper. Further, MCS contractors have worked with their claims processors to implement new technologies for data input, claims routing, customer service, and claims submission. Finally, MCS contractors and their claims processors have improved the timeliness with which they process claims. In fiscal year 2002, claims processors processed over 97 percent of claims in 30 days or less--an improvement over fiscal year 1999, when 91 percent of claims were processed in 30 days or less. Although DOD and its MCS contractors have made changes to improve claims processing, some DOD procedures and inaccuracies in its data continue to create inefficiencies in TRICARE claims processing. Some DOD procedures may create inefficiencies by inadvertently increasing the demand for customer service, which claims processors are required to provide. Additionally, inaccuracies in DOD eligibility data--data that are needed to process TRICARE claims--can contribute to claims processing delays or rework if, for example, claims must be reprocessed when errors are identified. Finally, some DOD procedures lead to rework for claims processors, either in the form of reprocessing claims or reprogramming processing software. For example, when DOD makes program changes to TRICARE to alter or create a health benefit, it does not adhere to any schedule. In 2002, DOD made 123 program changes on 19 different dates throughout the year. Given the fact that implementing these changes often involves reprogramming and testing processing software, this approach can create rework for claims processors when DOD issues similar or related changes on separate occasions. [ABSTRACT FROM AUTHOR]

This is the first amendment to Government Auditing Standards, commonly known as the "Yellow Book." It establishes a new field work standard requiring documentation in the planning of financial statements audits in certain circumstances. Specifically, this new standard requires auditors to document in their working papers the reasons for assessing control risk at the maximum level for assertions involving material account balances, transaction classes, and disclosure components of financial statements when such assertions depend on computer systems. It also requires auditors to document their consideration that the planned audit procedures are designed to achieve audit objectives and reduce audit risk to an acceptable level. [ABSTRACT FROM AUTHOR]

The National Transportation Safety Board (NTSB) plays a vital role in advancing transportation safety by investigating accidents, determining their causes, issuing safety recommendations, and conducting safety studies. To support its mission, NTSB's training center provides training to NTSB investigators and others. It is important that NTSB use its resources efficiently to carry out its mission. In 2006, GAO made recommendations to NTSB in most of these areas. In 2007, an independent auditor made information security recommendations. This testimony addresses NTSB's progress in following leading practices in selected management areas, increasing the efficiency of aspects of investigating accidents and conducting safety studies, increasing the utilization of its training center, and improving information security. This testimony is based on GAO's assessment of agency plans and procedures developed to address these recommendations. NTSB has made progress in following leading management practices in the eight areas in which GAO made prior recommendations. For example, the agency has improved communication from staff to management by conducting periodic employee surveys, which should help build more constructive relationships within NTSB. Similarly, the agency has made significant progress in improving strategic planning, human capital management, and IT management. It has issued new strategic plans in each area. Although the plans still leave room for improvement, they establish a solid foundation for NTSB to move forward. However, until the agency has developed a full cost accounting system and a strategic training plan, it will miss other opportunities to strengthen the management of the agency. NTSB has improved the efficiency of activities related to investigating accidents and tracking the status of recommendations. For example, it has developed transparent, risk-based criteria for selecting which rail, pipeline, hazardous materials, and aviation accidents to investigate at the scene. The completion of similar criteria for marine accidents will help provide assurance that NTSB is managing its resources in a manner to ensure a maximum safety benefit. Also, it is in the process of automating its lengthy, paper-based process for closing-out recommendations. Although NTSB has increased the utilization of its training center--from 10 percent in fiscal year 2006 to a projected 24 percent fiscal year 2008--the classroom space remains significantly underutilized. The increased utilization has helped increase revenues and reduce the center's overall deficit, which declined from about $3.9 million in fiscal year 2005 to about $2.3 million in fiscal year 2007. For fiscal year 2008, NTSB expects the deficit to decline further to about $1.2 million due, in part, to increased revenues from subleasing some classrooms starting July 2008. However the agency's business plan for the training center lacks specific strategies to achieve further... [ABSTRACT FROM AUTHOR]

The U.S. Dept. of Agriculture's (USDA) Risk Management Agency (RMA) administers the federal crop insurance program in partnership with private insurers. In 2006, the program cost $3.5 billion, including millions in losses from fraud, waste, and abuse, according to USDA. The Agricultural Risk Protection Act of 2000 granted RMA authority to renegotiate the terms of RMA's standard reinsurance agreement with companies once over 5 years. This testimony is based on GAO's 2005 report, Crop Insurance: Actions Needed to Reduce Program's Vulnerability to Fraud, Waste, and Abuse, and May 2007 testimony, Crop Insurance: Continuing Efforts Are Needed to Improve Program Integrity and Ensure Program Costs Are Reasonable. GAO discusses (1) USDA's processes to address fraud, waste, and abuse; (2) extent the program's design makes it vulnerable to abuse; and (3) reasonableness of underwriting gains and other expenses. USDA agreed with most of GAO's 2005 recommendations to improve program integrity. GAO reported that RMA did not use all available tools to reduce the crop insurance program's vulnerability to fraud, waste, and abuse. RMA has since taken some steps to improve its procedures. In particular: (1) USDA's Farm Service Agency (FSA) inspections during the growing season were not being used to maximum effect. Between 2001 and 2004, FSA conducted only 64 percent of the inspections RMA requested. Without inspections, farmers may falsely claim crop losses. However, FSA said it could not conduct all requested inspections, as GAO recommended, because of insufficient resources. RMA now provides information more frequently so FSA can conduct timelier inspections. (2) RMA's data analysis of the largest farming operations was incomplete. In 2003, about 21,000 of the largest farming operations did not report all of the individuals or entities with an ownership interest in these operations, as required. Therefore, RMA was unaware of ownership interests that could help it prevent potential program abuse. FSA and RMA started sharing information to identify such individuals or entities, but have stopped temporarily to resolve producer privacy issues. USDA should recover up to $74 million in improper payments made during 2003. (3) RMA was not effectively overseeing insurance companies' efforts to control program abuse. According to GAO's review of 120 cases, companies did not complete all the required quality assurance reviews of claims, and those that were conducted were largely paper exercises. RMA agreed to improve oversight of their reviews, but GAO has not followed up to examine its implementation. RMA's regulations to implement the crop insurance program, as well as some statutory requirements, create design problems that hinder its efforts to reduce abuse. For example, the regulations allow farmers to insure fields individually rather than together. As such, farmers can "switch" reporting of yield among fields to make false claims or build up a... [ABSTRACT FROM AUTHOR]

The U.S. Dept. of Agriculture's (USDA) Risk Management Agency (RMA) administers the federal crop insurance program in partnership with private insurers. In 2006, the program cost $3.5 billion, including millions in losses from fraud, waste, and abuse, according to USDA. The Agricultural Risk Protection Act of 2000 granted RMA authority to renegotiate the terms of RMA's standard reinsurance agreement with companies once over 5 years. This testimony is based on GAO's 2005 report, Crop Insurance: Actions Needed to Reduce Program's Vulnerability to Fraud, Waste, and Abuse, as well as new analyses this Committee requested on underwriting gains and administrative and operating expenses USDA paid companies. GAO discusses (1) USDA's processes to address fraud, waste, and abuse; (2) extent the program's design makes it vulnerable to abuse; and (3) reasonableness of underwriting gains and other expenses. USDA agreed with most of GAO's 2005 recommendations to improve program integrity. RMA agreed that GAO's new analyses were technically accurate. GAO reported that RMA did not use all available tools to reduce the crop insurance program's vulnerability to fraud, waste, and abuse. RMA has since taken some steps to improve its procedures. In particular, USDA's Farm Service Agency (FSA) inspections during the growing season were not being used to maximum effect. Between 2001 and 2004, FSA conducted only 64 percent of the inspections RMA requested. Without inspections, farmers may falsely claim crop losses. However, FSA said it could not conduct all requested inspections, as GAO recommended, because of insufficient resources. RMA now provides information more frequently so FSA can conduct timelier inspections. RMA's data analysis of the largest farming operations was incomplete. In 2003, about 21,000 of the largest farming operations did not report all of the individuals or entities with an ownership interest in these operations, as required. Therefore, RMA was unaware of ownership interests that could help it prevent potential program abuse. FSA and RMA now share information to identify such individuals or entities. USDA should be able to recover up to $74 million in improper payments made during 2003. RMA was not effectively overseeing insurance companies' efforts to control program abuse. According to GAO's review of 120 cases, companies did not complete all the required quality assurance reviews of claims, and those that were conducted were largely paper exercises. RMA agreed to improve oversight of their reviews, but GAO has not followed up to examine its implementation. RMA's regulations to implement the crop insurance program, as well as some statutory requirements, create design problems that hinder its efforts to reduce abuse. For example, the regulations allow farmers to insure fields individually rather than together. As such, farmers can "switch" reporting of yield among fields to make false claims or build up a higher yield history... [ABSTRACT FROM AUTHOR]

The U.S. Dept. of Agriculture's (USDA) Risk Management Agency (RMA) administers the federal crop insurance program in partnership with private insurers. In 2005, the program cost $2.7 billion, including an estimated $117 million in losses from fraud, waste, and abuse. The Agricultural Risk Protection Act of 2000 (ARPA) provided new tools to monitor and control abuses, such as providing RMA sanction authority to address program abuse and having USDA's Farm Service Agency (FSA) inspect farmers' fields. This testimony is based on GAO's September 30, 2005, report, Crop Insurance: Actions Needed to Reduce Program's Vulnerability to Fraud, Waste, and Abuse (GAO-05-528). GAO assessed (1) USDA's processes to address fraud, waste, and abuse, and (2) the extent to which the program's design makes it vulnerable to abuse. RMA has taken a number of steps to improve its procedures and processes to address fraud, waste and abuse in selling and servicing crop insurance policies and has reported more than $300 million in savings from 2001 to 2004. However, RMA is not effectively using all of its tools. GAO identified weaknesses in four key areas. First, FSA inspections during the growing season are not being used to maximum effect. Between 2001 and 2004, FSA conducted only 64 percent of the inspections RMA had requested. Without inspections, farmers may falsely claim crop losses. Second, RMA's data analysis of the largest farming operations is incomplete. According to GAO's analysis, in 2003 about 21,000 of the largest farming operations in the program did not report individuals or entities with an ownership interest in these operations as required. Without this information RMA was unaware of ownership interests that could help it prevent potential program abuse. FSA did not give RMA access to the data needed to identify such individuals or entities. USDA should be able to recover up to $74 million in improper claims payments. Third, RMA is not effectively overseeing insurance companies' efforts to control program abuse. GAO's review of 120 cases showed that companies did not complete all of the required quality assurance reviews of claims and those that were conducted were largely paper exercises. Fourth, RMA has infrequently used its new sanction authority to address program abuse. RMA has not issued regulations to implement its new sanction authority under ARPA and imposed only 114 sanctions from 2001 through 2004, although it annually identifies about 3,000 questionable claims, not all of which are necessarily sanctionable. RMA's regulations to implement the crop insurance program, as well as some statutory requirements, create program design problems that hinder RMA's efforts to reduce program abuse. For example, RMA's regulations allow farmers to insure fields individually rather than all fields combined. This option enables farmers to "switch" reporting of yield among fields to either make false claims or build up a higher yield history on... [ABSTRACT FROM AUTHOR]

Over the past several years, we have reported on significant pay problems experienced by mobilized Army National Guard and Army Reserve (Army Guard and Reserve) soldiers in the wake of the September 11, 2001, terrorist attack. These reports included examples of hundreds of soldiers receiving inaccurate and untimely payroll payments due to a paper-intensive, error-prone pay process and the lack of integrated pay and personnel systems. In response to our reports, the Department of Defense (DOD) has taken some action to improve controls designed to pay Army Guard and Reserve soldiers accurately and on time, especially those who had become sick or injured in the line of duty. This report responds to a Congressional request that we investigate the allegation that 37 Army Guard and Reserve soldiers assigned to the Medical Retention Processing Unit (MRPU) at Fort Bragg, North Carolina, were overpaid for hostile fire and hardship duty pay while in an outpatient status. Our objectives were to determine (1) whether the allegations were true, and if so, whether the pay issues were more widespread at Fort Bragg and (2) the key causes of the overpayments and the resulting impact on soldiers and their families. Our investigation confirmed that 28 of the 37 Army Guard and Reserve soldiers assigned to the MRPU in an outpatient status at Fort Bragg with alleged pay problems were in fact overpaid for hostile fire and hardship duty pay. We also identified at least 204 additional cases of sick or injured soldiers assigned to the MRPU who were overpaid for the same entitlements. An estimated $218,000 in hostile fire and/or hardship duty overpayments were made to a total of about 232 Army Guard and Reserve soldiers in an outpatient status at Fort Bragg during the period April 2003 through June 2005. As we have previously reported, internal control weaknesses in Army processes, human capital, and the lack of integrated systems caused the overpayments of hostile fire and hardship duty pay. Our investigation disclosed that the Fort Bragg Finance Battalion and MRPU controls often failed to detect the overpayments in a timely manner. A Fort Bragg Finance official acknowledged that the Finance Battalion "dropped the ball" by failing to promptly detect and stop the overpayments to sick or injured Army Guard and Reserve soldiers upon their arrival to the Fort Bragg MRPU. Further, in October 2005, DFAS completed an annual performance inspection of the Fort Bragg Finance Battalion that confirmed our conclusion about the problems soldiers were having with hostile fire and hardship duty pay. Our case studies showed that as a result of these overpayments, some soldiers and their families had to expend significant time and effort dealing with pay and resulting debt problems while recovering from their injuries. Several soldiers experienced large, unexpected deductions--as much as $1,172 from a single paycheck--for repaying the debt resulting from the Army's failure... [ABSTRACT FROM AUTHOR]

The Telephone Consumer Protection Act of 1991 prohibited invasive telemarketing practices, including the faxing of unsolicited advertisements, known as "junk faxes," to individual consumers and businesses. Junk faxes create costs for consumers (paper and toner) and disrupt their fax operations. The Junk Fax Prevention Act of 2005 clarified an established business relationship exemption, specified opt-out procedures for consumers, and requires the Federal Communications Commission (FCC)--the federal agency responsible for junk fax enforcement0--to report annually to Congress on junk fax complaints and enforcement. The law also required GAO to report to Congress on FCC's enforcement of the junk fax laws. This report addresses (1) FCC's junk fax procedures and outcomes, (2) the strengths and weaknesses of FCC's procedures, and (3) FCC's junk fax management challenges. FCC has procedures for receiving and acknowledging the rapidly increasing number of junk fax complaints, but the numbers of investigations and enforcement actions have generally remained the same. In 2000, FCC recorded about 2,200 junk fax complaints; in 2005, it recorded over 46,000. Using its procedures to review the complaints, FCC's Enforcement Bureau (EB) issued 261 citations (i.e., warnings) from 2000 through 2005. EB has ordered six companies to pay forfeitures for continuing to violate the junk fax rules after receiving a citation. The six forfeitures totaled over $6.9 million, none of which has been collected by the Department of Justice for various reasons. EB officials cited competing demands, resource constraints, and the rising sophistication of junk faxers in hiding their identities as hindrances to enforcement. An emphasis on customer service, an effort to document consumers' complaints, and an attempt to target enforcement resources efficiently are the strengths of FCC's procedures; however, inefficient data management, resulting in time-consuming manual data entry, data errors, and--most important--the exclusion of the majority of complaints from decisions about investigations and enforcement, are weaknesses. FCC's guidance to consumers does not provide them with all of the information they need to support FCC's enforcement efforts. FCC faces management challenges in carrying out its junk fax responsibilities. The commission has no clearly articulated long-term or annual goals for junk fax monitoring and enforcement, and it is not analyzing the junk fax data. Without analysis, FCC cannot explore the need for, or implement, changes to its rules, procedures, or consumer guidance that might help deter junk fax violations or give consumers a better understanding of the junk fax rules. Most important, without performance goals and measures and without analysis of complaint and enforcement data, it is not possible to explore the effectiveness of current enforcement measures. [ABSTRACT FROM AUTHOR]

Rigorous planning is key to a successful census as it helps ensure greater effectiveness and efficiency. The U.S. Census Bureau (Bureau) estimates the 2010 Census will cost around $11.3 billion, which would make it the most expensive census in our country's history, even after adjusting for inflation. GAO was asked to testify on (1) the Bureau's progress in preparing for the 2010 Census, (2) the challenges that Hurricanes Katrina and Rita might pose for the Bureau's future activities, and, (3) more broadly, the importance of planning for a range of events that could severely disrupt the census. The Bureau's preparations for the 2010 Census are making progress along several fronts. Of particular note is (1) the re-engineered design of the census, which holds promise for controlling costs and maintaining accuracy; (2) the Bureau's early planning process which was more rigorous than for the 2000 Census; and (3) the Bureau's greater willingness to outsource key census-taking operations that would be difficult for it to carry out on its own. At the same time, it will be important for the Bureau to resolve issues that pose a risk to a successful census. For example, the Bureau plans to use hand-held mobile computing devices (MCD) to develop the census address list and collect data from millions of households that do not respond to the initial census questionnaire. The MCDs are an important step forward because they are designed to replace many of the paper questionnaires and maps that were used in past censuses, and are a key element of the Bureau's Field Data Collection Automation program. The Bureau has never before used the devices in a decennial. In tests held in 2004 and 2006 to date, census workers found the MCDs easy to use, but sometimes unreliable, which reduced efficiency. Some workers also deviated from prescribed procedures which points to the need for better training. The Bureau has taken steps to address these issues and future tests will help determine the effectiveness of the Bureau's actions. The Bureau also faces a possible brain drain, as 45 percent of its workforce will be eligible to retire by 2010. Although the Bureau has taken preventative measures, it could improve those efforts by, among other actions, strengthening the monitoring of its mission-critical workforce. Hurricanes Katrina and Rita highlight the importance of contingency planning and examining whether the Bureau's existing operations are adequate for capturing the demographic and physical changes that have occurred along the Gulf Coast. Overall, as the Bureau's preparations for 2010 continue, it will be important for Congress to monitor the Bureau's progress in (1) identifying and diagnosing problems, (2) devising solutions, and (3) integrating refinements in time to be evaluated during the Census Dress Rehearsal scheduled for 2008. [ABSTRACT FROM AUTHOR]

Federal crop insurance protects producers against losses from natural disasters. In 2004, the crop insurance program provided $47 billion in coverage, at a cost of $3.6 billion, including an estimated $160 million in losses from fraud and abuse. The U.S. Department of Agriculture's (USDA) Risk Management Agency (RMA) administers this program with private insurers. The Agricultural Risk Protection Act of 2000 (ARPA) provided new tools to monitor and control abuses, such as having USDA's Farm Service Agency (FSA) conduct field inspections. GAO assessed, among other things, the (1) effectiveness of USDA's processes to address program fraud and abuse and (2) extent to which the program's design makes it vulnerable to abuse. While RMA employs a range of processes to help prevent and detect fraud, waste, and abuse and has reported more than $300 million in savings over the past 4 years in the crop insurance program, GAO found that RMA does not effectively use all the tools it has available. Inspections during the growing season are not being used to maximum effect. Between 2001 and 2004, FSA conducted only 64 percent of the inspections RMA had requested. Without inspections, producers may falsely claim crop losses. RMA's data analysis of the largest farming operations is incomplete. According to GAO's analysis, in 2003, about 21,000 of the largest farming operations in the program did not report individuals or entities with an ownership interest in these operations. As a result, USDA should be able to recover up to $74 million in claims payments. FSA did not give RMA access to the data needed to identify such individuals or entities. RMA is not effectively overseeing insurance companies' quality assurance programs. GAO's review of 120 cases showed that companies completed only 75 percent of the required reviews and those that were conducted were largely paper exercises. RMA has infrequently used its new sanction authority to address program abuses. RMA has not issued regulations to implement its new sanction authority under ARPA. RMA imposed only 114 sanctions from 2001 through 2004. Annually, RMA identifies about 3,000 questionable claims, not all of which are necessarily sanctionable. Eight recent crop insurance fraud cases, investigated by USDA's Office of Inspector General and resulting in criminal prosecutions between June 2003 and April 2005, reflect these issues. Totaling $3 million in insurance claims, these cases show how producers, sometimes in collusion with insurance agents and others, falsely claim prevented planting, weather damage, and low production. In some cases, producers hid or moved production from one field to another. Several of these cases also demonstrate the importance of having FSA and RMA work together to identify and share information on questionable farming practices/activities. RMA's regulations, as well as statutory requirements, create program design problems that hinder RMA officials' efforts to reduce program abuse. For example, RMA's regulations allow producers to insure fields individually rather than all fields combined. This option enables producers to "switch" reporting of yield among fields to either make false claims or build up a higher yield history on a field to increase its eligibility for higher insurance guarantees. High premium subsidies, established by statute, may also limit RMA's ability to control program abuse because the subsidies shield producers from the full effect of paying higher premiums associated with frequent or larger claims. [ABSTRACT FROM AUTHOR]

In January 2004, Congress established the Millennium Challenge Corporation (MCC) to administer the Millennium Challenge Account. MCC's mission is to promote economic growth and reduce extreme poverty in developing countries. The act requires MCC to rely to the maximum extent possible on quantitative criteria in determining countries' eligibility for assistance. MCC will provide assistance primarily through compacts--agreements with country governments. MCC aims to be one of the top donors in countries with which it signs compacts. For fiscal years 2004 and 2005, Congress appropriated nearly $2.5 billion for the Millennium Challenge Corporation; for fiscal year 2006, the President is requesting $3 billion. GAO was asked to monitor MCC's (1) process for determining country eligibility, (2) progress in developing compacts, (3) coordination with key stakeholders, and (4) establishment of management structures and accountability mechanisms. For fiscal years 2004 and 2005, the MCC board used the quantitative criteria as well as judgment in determining 17 countries to be eligible for MCA compacts. Although MCC chose the indicators based in part on their public availability, our analysis showed that not all of the source data for the indicators were readily accessible. In addition, we found that reliance on the indicators carried certain inherent limitations, such as measurement uncertainty. Between August 2004 and March 2005, MCC received compact proposals, concept papers, or both, from 16 eligible countries. It signed a compact with Madagascar in April 2005 and is negotiating compacts with four countries. MCC's 4-year compact with Madagascar for $110 million would make it the country's fifth largest donor. MCC is continuing to refine its compact development process. In addition, MCC has identified elements of program implementation and fiscal accountability that can be adapted to eligible countries' compact objectives and institutional capacities. MCC is taking steps to coordinate with key stakeholders to use existing expertise and conduct outreach. The U.S. agencies on the MCC Board of Directors--USAID, the Departments of State and Treasury, and the Office of the U.S. Trade Representative--have provided resources and other assistance to MCC, and five U.S. agencies have agreed to provide technical assistance. Bilateral and multilateral donors are providing information and expertise. MCC is also consulting with nongovernmental organizations in the United States and abroad as part of its outreach activities. MCC has made progress in developing key administrative infrastructures that support its mission and operations. MCC has also made progress in establishing corporatewide structures for accountability, governance, internal control, and human capital management, including establishing an audit capability through its Inspector General, adopting bylaws, providing ethics training to employees, and expanding its permanent full-time staff. However, MCC has not yet completed comprehensive plans, strategies, and related time frames for establishing these essential management structures and accountability mechanisms on a corporatewide basis. [ABSTRACT FROM AUTHOR]

In January 2004, Congress established the Millennium Challenge Corporation (MCC) to administer the Millennium Challenge Account. MCC's mission is to promote economic growth and reduce extreme poverty in developing countries. The act requires MCC to rely to the maximum extent possible on quantitative criteria in determining countries' eligibility for assistance. MCC will provide assistance primarily through compacts--agreements with country governments. MCC aims to be one of the top donors in countries with which it signs compacts. For fiscal years 2004 and 2005, Congress appropriated nearly $2.5 billion for the Millennium Challenge Corporation; for fiscal year 2006, the President is requesting $3 billion. GAO was asked to monitor MCC's (1) process for determining country eligibility, (2) progress in developing compacts, (3) coordination with key stakeholders, and (4) establishment of management structures and accountability mechanisms. For fiscal years 2004 and 2005, the MCC board used the quantitative criteria as well as judgment in determining 17 countries to be eligible for MCA compacts. Although MCC chose the indicators based in part on their public availability, our analysis showed that not all of the source data for the indicators were readily accessible. In addition, we found that reliance on the indicators carried certain inherent limitations, such as measurement uncertainty. Between August 2004 and March 2005, MCC received compact proposals, concept papers, or both, from 16 eligible countries. It signed a compact with Madagascar in April 2005 and is negotiating compacts with four countries. MCC's 4-year compact with Madagascar for $110 million would make it the country's fifth largest donor. MCC is continuing to refine its compact development process. In addition, MCC has identified elements of program implementation and fiscal accountability that can be adapted to eligible countries' compact objectives and institutional capacities. MCC is taking steps to coordinate with key stakeholders to use existing expertise and conduct outreach. The U.S. agencies on the MCC Board of Directors--USAID, the Departments of State and Treasury, and the Office of the U.S. Trade Representative--have provided resources and other assistance to MCC, and five U.S. agencies have agreed to provide technical assistance. Bilateral and multilateral donors are providing information and expertise. MCC is also consulting with nongovernmental organizations in the United States and abroad as part of its outreach activities. MCC has made progress in developing key administrative infrastructures that support its mission and operations. MCC has also made progress in establishing corporatewide structures for accountability, governance, internal control, and human capital management, including establishing an audit capability through its Inspector General, adopting bylaws, providing ethics training to employees, and expanding its permanent full-time staff. However, MCC has not yet completed comprehensive plans, strategies, and related time frames for establishing these essential management structures and accountability mechanisms on a corporatewide basis. [ABSTRACT FROM AUTHOR]

GAO was asked to determine (1) the impact of the recent increased operational tempo on the process used to reimburse Army Guard soldiers for travel expenses and the effect that travel reimbursement problems have had on soldiers and their families; (2) the adequacy of the overall design of controls over the processes, human capital, and automated systems relied on for Army Guard travel reimbursements; and (3) whether the Department of Defense's (DOD) current efforts to automate its travel reimbursement process will resolve the problems identified. GAO selected and audited 10 case study units that were identified in a preliminary assessment as having a variety of travel reimbursement problems. Mobilized Army Guard soldiers have experienced significant problems getting accurate, timely, and consistent reimbursements for out-of-pocket travel expenses. These weaknesses were more glaring in light of the sustained increase in mobilized Guard soldiers following the terrorist attacks of September 11, 2001. To its credit, the Defense Finance and Accounting Service (DFAS) hired over 200 new personnel to address travel voucher processing backlogs and recently upgraded their training. However, Guard soldiers in our case study units reported a number of problems they and their families endured due to delayed or unpaid travel reimbursements, including debts on their personal credit cards, trouble paying their monthly bills, and inability to make child support payments. The soldier bears primary responsibility for travel voucher preparation, including obtaining paper copies of various types of authorizations. DFAS data indicate that it rejected and asked soldiers to resubmit about 18 percent of vouchers during fiscal year 2004--a churning process that added to delays and frustration. Also, existing guidance did not clearly address the sometimes complex travel situations of mobilized Army Guard soldiers, who were often housed off-post due to overcrowding on military installations. Further, DOD continued to be noncompliant with a law that requires payment of late payment interest and fees when soldiers' travel reimbursements are not timely. With respect to human capital, GAO found a lack of oversight and accountability and inadequate training. Automated systems problems, such as nonintegration of key systems involved in authorizing and paying travel expenses and failure to automate key processes, also contributed to the inefficient, error-prone process. DOD has been developing and implementing the Defense Travel System (DTS) to resolve travel-related deficiencies. However, DTS will not address some of the key systems flaws. For example, DTS is currently not able to process mobilized soldier travel authorizations and vouchers and identify and calculate late payment interest and fees. [ABSTRACT FROM AUTHOR]

In 2003, we added the federal government's disability programs to our high-risk list in part because of difficulties agencies faced in managing these programs and the expected growth in the rolls as baby boomers reach their disability-prone years. The Social Security Administration (SSA) manages the federal government's two largest disability programs, the Disability Insurance (DI) program and the Supplemental Security Income (SSI) program, which together paid out $91 billion in federal benefits to 11.4 million individuals with disabilities in 2003. To help address management difficulties and prepare for expected growth in the rolls, SSA must have reliable administrative data from its disability decision-making process to adequately understand the population it serves and the possible effect of proposed program changes on this population. However, in a prior study, we identified potential problems with the reliability of SSA's electronic administrative data. This report examines (1) the extent to which SSA collects useful and reliable electronic administrative data in order to effectively manage its DI and SSI programs and (2) whether ongoing and planned changes to SSA's computer systems and internal controls will address any weaknesses that we identified. While most types of information collected by SSA are useful for program management purposes, the agency lacks sufficient internal controls to ensure that these data are reliable. In its electronic records, SSA collects information related to the claimant, process, and decision--all of which are important for informing aspects of program management. However, SSA does not collect some information that would enhance program oversight. At the same time, SSA collects other information in its electronic disability record that the agency considers of limited value. Although the types of information SSA collects in its electronic records generally contribute to the management of the disability programs, the accuracy of the records is unknown. In addition, inadequate data entry controls have resulted in missing data for some information, such as the claimant's educational level, which is a critical factor in the disability decision and is therefore important in a study of the disability decision-making process. Most important, because SSA's policy does not require that the electronic record be verified against the information in the case file, the agency does not know the extent to which codes that appear valid reflect the claimant's actual information, such as the claimant's actual impairment or education level. While SSA's ongoing and planned changes to computer systems and internal controls may reduce the chance for some inaccuracies, SSA's plans do not provide adequate assurance of the accuracy of its electronic administrative data. SSA's ongoing transition from a paper-based disability system to an electronic one should reduce some of the inaccuracies we identified by limiting the amount of data re-entered at various levels in the process. However, SSA's planned changes will not address data entry problems found by GAO that could be prevented with additional data entry controls. SSA's current plans also do not include an internal control strategy for ensuring that electronic data match the information in the case file, nor do they provide for corrective action when inaccuracies are found. Finally, although SSA has proposed far-reaching changes to its disability decision-making process and is currently reassessing the processes for ensuring the quality of its disability decisions, the agency has not yet made any plans for evaluating the types of information it currently collects and whether other types of information would improve program management and oversight. [ABSTRACT FROM AUTHOR]

The transformation of the Government Printing Office (GPO) is under way. This report captures the results of our efforts over the past year to assess and help strengthen GPO's transformation and strategic planning efforts. It is the final part of GAO's response to both a mandate requiring GAO to examine the current state of printing and dissemination of public government information and a congressional request that we conduct a general management review of GPO focusing on that GPO's transformation and management. Federal government printing and dissemination are changing due to the underlying changes to the technological environment. The Public Printer and his leadership team understand the effects of this technological change on GPO and have begun an ambitious effort to transform GPO and reexamine its mission. Federal agencies are publishing more documents directly to the Web and are doing more of their printing and dissemination of information without using GPO services. At the same time, the public is obtaining government information from government Web sites such as GPO Access rather than purchasing paper copies. As a result, GPO has seen declines in its printing volumes, printing revenues, and document sales. To assist in the transformation process under way at GPO, GAO convened a panel of printing and information dissemination experts, who developed a series of options for GPO to consider in its strategic planning. The panel suggested that GPO (1) develop a business plan to focus its mission on information dissemination as its primary goal, rather than printing; (2) demonstrate to its customers the value it can provide; (3) improve and extend partnerships with agencies to help establish itself as an information disseminator; and (4) ensure that its internal operations are adequate for efficient and effective management of core business functions and for service to its customers. GPO can also use other key practices that GAO identified to help agencies successfully transform, such as involving employees to obtain their ideas and gain their ownership for the transformation. GPO fully applied one of these practices, related to ensuring that top management drives the transformation, and has partially implemented each of the remaining eight practices. To fully implement the remaining practices, GPO needs to take actions including establishing its mission and strategic goals and developing a documented plan for its transformation. GPO has taken some initial steps to adopt the best practices of other public and private sector organizations, most notably with respect to human capital management. GPO is actively implementing the recommendations GAO made in October 2003. For example, GPO reorganized the human capital office into customer-focused teams devoted to meeting the human capital needs of GPO's operating units. Continued leadership attention is needed to build on the initial progress made in information technology and financial management. For example, GPO should implement an information technology investment management process to help management choose, monitor, and evaluate projects, and GPO should train its line managers to effectively use financial data. [ABSTRACT FROM AUTHOR]

There is widespread agreement that the basic approach to federal pay is broken and that it needs to be more market- and performance-based. Doing so will be essential if the federal government is to maximize its performance and assure accountability for the benefit of the American people. While there will be debate and disagreement about the merits of individual reform proposals, all should be able to agree that a performance management system with adequate safeguards, including reasonable transparency and appropriate accountability mechanisms in place, must serve as the fundamental underpinning of any fair, effective, and appropriate pay reform. At the request of the Subcommittee on Civil Service and Agency Organization, House Committee on Government Reform, GAO discussed the key practices for effective performance management that federal agencies should consider as they develop and implement performance management systems as part of any pay reform. The need for results-oriented pay reform is one of the most pressing human capital issues facing the federal government today. To implement results-oriented pay reform, commonly referred to as "pay for performance," agencies must have modern, effective, credible, and validated performance management systems that are capable of supporting pay and other personnel decisions. Pay for performance works only with adequate safeguards, including reasonable transparency and appropriate accountability mechanisms in place, to ensure its fair, effective, and responsible implementation. Modern performance management systems are the centerpiece of those safeguards and accountability. Most federal agencies are a long way from meeting this test. All too often, agencies' performance management systems are based on episodic and paper intensive exercises that are not linked to the strategic plan of the organization and have only a modest impact on the pay, use, development, and promotion potential of federal workers. Leading organizations, on the other had, use their performance management systems to accelerate change, achieve desired organizational results, and facilitate two-way communication throughout the year so that discussions about individual and organizational performance are integrated and ongoing. Effective performance management systems are not merely used for once- or twice-yearly individual expectation setting and ratings processes, but are tools to help the organization manage on a day-to-day basis. GAO identified key practices leading public sector organizations both here in the United States and abroad have used in their performance management systems to link organizational goals to individual performance and create a "line of sight" between an individual's activities and organizational results. These practices can help agencies develop and implement performance management systems with the attributes necessary to effectively support pay for performance. [ABSTRACT FROM AUTHOR]

The Department of Health and Human Services (HHS) issued proposed regulations in November 1999 to help ensure the confidentiality of patient data, as required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA). GAO found that HHS' regulatory strategies appear to be consistent with HIPAA's goal of protecting the privacy of health information and are legally permissible. By requiring that entities directly regulated by the rule--health plans, health care providers, and health care clearinghouses--control the information practices of entities with which they do business, HHS has attempted to fill an otherwise significant gap in privacy protection. HHS has covered the "paper progeny" of electronically maintained or transmitted health information--the privacy protections extended to individuals by HIPAA would be easy to circumvent if protected health information in an electronic record lost its protection merely by being printed. HHS' decision to build flexibility into the proposed rule by allowing the implementation of the standards to vary on the basis of an organization's size is also within its authority. Comments from many of the entities that will have to implement the policies reflect two overriding themes. First is a widespread acknowledgment of the importance of protecting the privacy of medical records. Second is a fundamental difference in the groups' positions that reflects the conflicts that sometimes arise between privacy and competing goals. [ABSTRACT FROM AUTHOR]

To help ensure the integrity of Medicare, the Health Care Financing Administration (HCFA) and its contractors need to develop reliable and sophisticated approaches to identify potentially fraudulent billing practices. It is especially important that they be able to match up third-party billers with the providers they represent so contractors can identify potentially questionable billing patterns and subject these claims to more scrutiny. Although HCFA has various efforts under way to better identify providers' questionable claims and their associated third-party billers, there continue to be gaps in its safeguards. HCFA needs to complete its provider recertification program as soon as possible so that it will have comprehensive information on all Medicare providers and their billers. GAO is also concerned about inherent problems with data reliability. [ABSTRACT FROM AUTHOR]

GAO found serious and pervasive problems that essentially render the Environmental Protection Agency's (EPA) agencywide information security program ineffective. Current security program planning and management is largely a paper exercise that has done little to identify, evaluate, and mitigate risks to the agency's data and computer systems. Moreover, on the basis of its tests of computer-based controls, GAO concludes that the computer operating systems and the agencywide computer network that support most of EPA's mission-related and financial operations are riddled with security weaknesses. Of particular concern is that many of the most serious weaknesses GAO identified--those related to inadequate protection from intrusions via the Internet and poor security planning--had been reported to EPA management in 1997 by the agency's Inspector General. The repercussions of such weaknesses are illustrated by EPA's own records, which show several serious computer security incidents in the last two years that have damaged and disrupted agency operations. GAO has also identified shortcomings in EPA's incident detection and handling capabilities that call into questions the agency's ability to fully understand and assess the nature of or damage due to its computer security breaches. The result is that EPA's computer systems are highly vulnerable to tampering, disruption, and misuse, and EPA cannot guarantee the protection of sensitive business and financial data kept on its larger computer systems or supported by its agencywide network. [ABSTRACT FROM AUTHOR]

Travelers fly billions of miles each year, sometimes using tickets produced using stolen ticket stock--the paper upon which the ticket is printed. In testimony before Congress last year, the Airlines Reporting Corporation--the largest supplier of airline ticket stock worldwide--said that losses from stolen ticket stock are relatively minor, costing the airline industry only a few billion dollars annually. Travel agency representatives disagreed, testifying that the theft of airline ticket stock costs billions of dollars each year and forces travel agencies held liable for the losses to shut down. This report answers the following questions: What is the number and value of airline ticket stock stolen annually? What are the financial implications of the use of stolen ticket stock? What other issues are associated with the use of stolen ticket stock? What technologies and other initiatives are available to detect the use of stolen ticket stock? [ABSTRACT FROM AUTHOR]

The U.S. Customs Service fully recognizes the severity of its problems in managing import trade. Customs' existing import processes and supporting systems are simply not responsive to the business needs of either the agency or the trade community, which imports about $1 trillion in goods annually. These processes and systems are paper-intensive and error-prone and they are out of step with the just-in-time inventory practices used by the trade. In response, Customs has undertaken the Automated Commercial Environment (ACE), a 15-year project whose cost is estimated at upwards of $1.05 billion. Unfortunately, Customs has not used disciplined and rigorous management practices in developing ACE during the last five years. This testimony, which is based on a February 1999 report (GAO/AIMD-99-41), describes the following management and technical weaknesses plaguing ACE: (1) building ACE without a complete and enforced enterprise systems architecture, (2) investing in ACE without a firm basis for knowing that it is a cost-effective solution, and (3) building ACE without using engineering rigor and discipline. GAO makes several recommendations for addressing these problems. [ABSTRACT FROM AUTHOR]

A considerable amount of health research relies on personally identifiable information. Although some of this research is subject to review by institutional review boards -- either because it is federally supported or regulated research or because the organization voluntarily applies federal rules to all of its research -- some of the organizations conduct records-based research that is not reviewed by an institutional review board. In any case, the process of institutional review board review does not ensure the confidentiality of medical information used in research, primarily because the provisions of the Common Rule related to confidentiality are limited. Moreover, according to recent studies, the institutional review board system on the whole is strained. Nevertheless, although external review of their research is limited, most of the organizations in GAO's study indicated that they have security safeguards in place to limit internal and external access to paper and electronic databases, and many say that they have taken steps to ensure the anonymity of research and survey subjects. GAO summarized this report in testimony before Congress, Medical Records Privacy: Uses and Oversight of Patient Information in Research, by Bernice Steinhardt, Director of Health Services Quality and Public Health Issues, before the Senate Committee on Health, Education, Labor and Pensions. GAO/T-HEHS-99-70, Feb. 24 (10 pages). [ABSTRACT FROM AUTHOR]

A considerable amount of health research relies on personally identifiable information. Although some of this research is subject to review by institutional review boards -- either because it is federally supported or regulated research or because the organization voluntarily applies federal rules to all of its research -- some of the organizations conduct records-based research that is not reviewed by an institutional review board. In any case, the process of institutional review board review does not ensure the confidentiality of medical information used in research, primarily because the provisions of the Common Rule related to confidentiality are limited. Moreover, according to recent studies, the institutional review board system on the whole is strained. Nevertheless, although external review of their research is limited, most of the organizations in GAO's study indicated that they have security safeguards in place to limit internal and external access to paper and electronic databases, and many say that they have taken steps to ensure the anonymity of research and survey subjects. This testimony summarizes the February 1999 GAO report, GAO/HEHS-99-55. [ABSTRACT FROM AUTHOR]

Raul Salinas, brother of the former President of Mexico, was able to transfer as much as $100 million between 1992 and 1994 by using a private banking relationship with Citibank New York. The money was transferred through Mexico and New York to private banking investment accounts in London and Switzerland. Beginning in mid-1992, Citibank assisted Mr. Salinas with these transfers and effectively disguised the funds' source and destination, thus breaking the funds' paper trail. Citibank set up an offshore private investment company to hold Mr. Salinas' assets, waived bank references for Mr. Salinas and did not prepare a financial profile on him or request a waiver for the profile (as required by Citibank policy), facilitated Mrs. Salinas' use of another name to initiate fund transfers in Mexico, and wired funds from Citibank Mexico to a Citibank New York concentration account--a business account that commingles funds from various sources--before forwarding them to the offshore investment accounts. No U.S. documentation identified Mr. Salinas as the owner of the offshore private investment company or connected Mr. Salinas to the offshore private investment company funds transferred through Citibank Mexico and Citibank New York. Limited by an ongoing Justice Department investigation, GAO could not determine whether Citibank's actions violated any laws or regulations. Citibank's actions and testimony in a 1994 money laundering trial were inconsistent concerning due diligence and know-your-customer practices in private banking. For example, Citibank's testimony implied a stricter adherence to due diligence than actually occurred during the Salinas transactions. [ABSTRACT FROM AUTHOR]

The Social Security Administration (SSA) has issued more than 430 million Social Security numbers (SSN) and cards since the Social Security program began in 1935, of which an estimated 300 million belong to living number holders. SSNs have a key role in verifying individuals' authorization to work in the United States, but SSN cards are also vulnerable to theft and counterfeiting. The Intelligence Reform and Terrorism Prevention Act of 2004 requires that SSA consult with the Department of Homeland Security (DHS), form a task force, establish standards for safeguarding the SSN and card, and provide for implementation by June 2006. Concerns about unauthorized workers and the use of counterfeit documents led the Chairman of the House Judiciary Committee to ask that GAO (1) review SSA's progress to safeguard the SSN and enhance the card as required under the Intelligence Act, (2) identify key issues to be considered before enhancing the card, and (3) outline the range of options available to SSA for enhancing the card. [ABSTRACT FROM AUTHOR]

The Export-Import Bank (Ex-Im) provides loans, loan guarantees, and insurance to support U.S. exports. Its level of support for small business has been a long-standing issue of congressional interest. Most recently in 2002, Congress increased the proportion of financing Ex-Im must make available for small business to 20 percent. GAO examined legal and policy issues related to Ex-Im's small business financing. Specifically, GAO (1) analyzes Ex-Im's methodology for calculating its direct support of small business and the reliability of Ex-Im's data used in the methodology and (2) describes Ex-Im's legal interpretation of its obligations under the statutory 20 percent small business mandate. While Ex-Im generally classifies companies' small business status correctly, weaknesses in its data systems and data limit its ability to accurately determine its small business financing. Ex-Im uses a combination of direct counts and estimates to calculate its small business financing, based on the authorized value of individual transactions. For most transactions, Ex-Im can identify the exporter and thus bases its determination of the small business financing share on whether the exporter qualifies as a small business. For other transactions, Ex-Im cannot identify the exporter at the time it authorizes the transaction and estimates the small business share based on shipment patterns in an earlier period. GAO determined that Ex-Im generally classifies companies' small business status correctly. However, GAO identified weaknesses in Ex-Im's process for calculating its small business support. For transactions where Ex-Im can identify the exporter, GAO found internal control weaknesses such as Ex-Im's data systems containing conflicting records for the same company. For transactions where Ex-Im cannot identify the exporter when it authorizes the transaction, a weakness is not including a large value of shipments in its calculations. GAO also determined that Ex-Im's reporting on the number of transactions--as opposed to the value of transactions--that directly benefit small business includes transactions that do not benefit small business. Prior to the enactment of credit reform legislation, Ex-Im interpreted the mandate as requiring it to make available for financing small business exports an amount equal to 10 percent of the aggregate principal amount of loans, guarantees and insurance specified by Congress for that fiscal year. Given changes in law including federal credit reform and the removal of specific financing authority limits, Ex-Im currently interprets its statutory small business financing mandate as requiring it to attempt to ensure that 20 percent of the authorized value of its transactions during a year directly benefits small business. [ABSTRACT FROM AUTHOR]

The volume and complexity of patent applications to the U.S. Patent and Trademark Office (USPTO) have increased significantly in recent years, lengthening the time needed to process patents. Annual applications have grown from about 185,000 to over 350,000 in the last 10 years and are projected to exceed 450,000 by 2009. Coupled with this growth is a backlog of about 750,000 applications. USPTO has long recognized the need to automate its patent processing and, over the past two decades, has been engaged in various automation projects. Accordingly, GAO was asked to, among other things, assess progress to date and any problems facing USPTO as it develops the capability to efficiently handle patent information electronically. As part of its strategy to achieve a paperless, electronic patent process, USPTO had planned to deliver an operational patent system by October 2004. It has been able to deliver important capabilities, such as allowing patent applicants to electronically file and view the status of their patent applications and the public to search published patents. Nonetheless, after spending over $1 billion on its efforts from 1983 through 2004, the agency's existing automation has not provided the fully integrated, electronic patent process articulated in its automation plans, and when and how this process will be achieved is uncertain. Key systems that USPTO is relying on to help reach this goal--an electronic application filing system and a document imaging system--have not provided capabilities that are essential to operating in a fully electronic environment. Contributing to this situation is that the agency took an ad hoc approach to planning and managing its implementation of these systems, in which it lacked effective analysis of system requirements, alternatives, and costs; made acquisition decisions based on management judgment; and acquired software that did not meet its needs. USPTO's ineffective planning and management of its patent automation initiatives, in large measure, can be attributed to enterprise-level, systemic weaknesses in its information technology investment management processes. Although the agency had begun instituting essential investment management mechanisms, such as its enterprise architecture framework, it had not yet finalized its capital planning and investment control process nor established necessary linkages between the process and its architecture to guide the development and implementation of its information technology. The Under Secretary of Commerce for Intellectual Property and USPTO's chief information officer acknowledged the need for improvement, but specific plans for resolving problems have not yet been developed. [ABSTRACT FROM AUTHOR]

The Internal Revenue Service (IRS) has been shifting its priorities from taxpayer service to enforcement and its management of Business Systems Modernization (BSM) from contractors to IRS staff. Although there are sound reasons for these adjustments, they also involve risks. With respect to the fiscal year 2006 budget request, GAO assessed (1) how IRS proposes to balance its resources between taxpayer service and enforcement programs and the potential impact on taxpayers, (2) the status of IRS's efforts to develop and implement the BSM program, and (3) the progress IRS has made in implementing best practices in developing its Information Technology (IT) operations and maintenance budget. For the 2005 filing season, GAO assessed IRS's performance in processing returns and providing taxpayer service. IRS's fiscal year 2006 budget request of $10.9 billion proposes increased funding for enforcement, but reduced funding for taxpayer service and BSM. However, the potential impact of these changes on taxpayers in either the short- or long-term is unclear, because IRS has not provided details of proposed taxpayer service reductions, and although it is developing longterm goals, they are not yet finalized. Because of the proposed reductions and new and improved taxpayer services in recent years, this is an opportune time to examine the menu of services IRS provides. It may be possible to maintain the overall level of service to taxpayers by offsetting reductions in some areas with new and improved service in other areas. Taxpayers and IRS are seeing some payoff from the BSM program, with the deployment of initial phases of several modernized systems in 2004. Nevertheless, the BSM program continues to be high-risk, in part, because projects have incurred significant cost increases and schedule delays and the program faces major challenges in areas such as human capital and requirements management. As a result of budget reductions and other factors, IRS has made major adjustments. It is too early to tell what effect these adjustments will have on the program, but they are not without risk and could potentially impact future budgets. Further, the BSM program is based on strategies developed years ago, which, coupled with the delays and changes brought on by budget reductions, indicates that it is time for IRS to revisit its long-term goals, strategy, and plans for BSM. Because of these challenges, IRS is redefining and refocusing the BSM program. IRS has generally maintained or improved its filing season performance in 2005. Processing is more efficient, the accuracy of answers provided by telephone assistors is improved, and telephone access is relatively comparable to last year. This is particularly noteworthy, because IRS received less funding for taxpayer service in 2005 than it spent in 2004. Because the filing season is not over, the full impact on taxpayers and IRS operations is not yet known. However, there are indications of slippage in telephone access such as more abandoned calls and longer wait times. [ABSTRACT FROM AUTHOR]

The tax filing season is when millions of taxpayers file their returns and seek assistance by calling or visiting IRS's offices or Web site. Because of the large number of returns and critical nature of IRS's filing season activities, GAO was asked to assess IRS's 2002 filing season performance in processing tax returns and refunds and providing timely and accurate assistance to taxpayers. The Internal Revenue Service (IRS) processed returns and issued refunds smoothly and the quality of assistance provided to taxpayers improved in the 2002 filing season. In light of this, IRS should be commended for the various efforts it took to prepare for the 2002 filing season and improve performance. Still, opportunities exist for IRS to further improve aspects of its performance and some of its performance measures. In 2002, IRS's performance included issuing almost all refunds on time, providing more accurate telephone service than in 2001, and meeting many of its 2002 performance goals in all areas. IRS also began measuring the accuracy of assistance at its walk-in sites to obtain better performance data. In addition, IRS's redesigned Web site was easier to access and more user friendly. IRS's improved performance can be traced to its use of performance measures, which are part of its strategy to improve returns processing and taxpayer assistance as shown below. However, GAO identified opportunities for IRS to make further improvements. For example, IRS's suite of telephone measures lacks an indicator of how long callers wait to speak to an assistor--a key aspect of assistance that provides useful information for decision making by external stakeholders. Although not a primary focus of this report, GAO also found that IRS lacked comprehensive plans related to the extent and timing of anticipated workload and staffing changes at its walk-in sites. [ABSTRACT FROM AUTHOR]

This report discusses bank regulators' evaluation of electronic signature systems. Financial institutions use signature systems to verify or authenticate the identity of customers conducting financial and nonfinancial transactions over the Internet and other open electronic networks. Officials at the Office of the Comptroller of the Currency (OCC) and the Federal Reserve told GAO that they are developing an examination strategy for Identrus LLC, which is an entity that provides services to financial institutions to authenticate electronic signatures. OCCofficials have not determined what role they will play in assessing Identrus' operations, but they believe that financial institutions should take an active role in assessing the risks associated with electronic signatures. [ABSTRACT FROM AUTHOR]

This journal of the International Organization of Supreme Audit Institutions (INTOSAI) includes articles regarding: (1) the Food and Agriculture Organization's audit, management, and governance; (2) fighting corruption and fraud; (3) INTOSAI's conference on internal controls; (4) Romania's Court of Audit; (5) reports in print on auditing; and (6) activities inside INTOSAI. [ABSTRACT FROM AUTHOR]

This second amendment to the Government Auditing Standards adds a field work standard and amends a reporting standard for financial statement audits to improve auditor communication on the auditor's work on compliance laws and regulations and internal control over financial reporting. This new amendment requires specific communication with the auditee, the individuals contracting for or requesting the audit services, and the audit committee regarding the scope of compliance and internal control work to be done under Government Auditing Standards. The new amendment also requires the auditor to emphasize, in the auditor's report on the financial statement, the importance of the reports on compliance with laws and regulations and internal control over financial reporting when these reports are issued separately from the report on the financial statements. [ABSTRACT FROM AUTHOR]

Pursuant to a legislative requirement, GAO provided information on the Financial Management Service's (FMS) internal controls over federal disbursements. GAO noted that: (1) GAO previously reported on, and suggested improvements to, FMS' internal controls related to disbursement processing at FMS and its six Regional Financial Centers--Austin, Birmingham, Chicago, Kansas City, Philadelphia, and San Francisco; (2) FMS' corrective actions resolved GAO's concerns relating to the documentation and review of delegation and designation of agency certifying officers, physical controls over returned checks, and the posting of cancellation activities; (3) however, this year's suggested improvements include matters GAO reported on last year for which FMS' corrective actions were incomplete and new matters identified during this year's audit work; (4) specifically, GAO has reaffirmed its prior year suggestions for improvements to: (a) the approval, review, and documentation of disbursements; and (b) reconciliation of the returned check cancellations; (5) GAO has also suggested improvements to processing and documentation of the Automated Standard Application for Payments system enrollments and reconciliation of replacement benefit checks referred to as courtesy disbursements; and (6) although the internal control matters discussed in this letter are not material in relation to the federal government's fiscal year 1998 financial statements, they warrant attention. [ABSTRACT FROM AUTHOR]

Pursuant to a congressional request, GAO described how the Health Care Financing Administration (HCFA) and its contractors monitor third-party billing companies' involvement in the submission of claims to Medicare. GAO noted that: (1) providers are ultimately responsible for the claims that they submit or that are submitted on their behalf; (2) despite this, HCFA has an interest in tracking claims submitted by third-party billers as one way of targeting its program safeguard resources and determining the source of inappropriate or fraudulent claims; (3) GAO found that HCFA cannot identify when third-party billers were involved in the more than 700 million electronic claims in fiscal year 1998, because its systems identify only one of the many possible entities involved in preparing a claim; (4) further, paper claims--146 million in 1998--do not have any identifying information that would indicate whether third-party billers submitted them; (5) GAO also found weaknesses in HCFA's efforts to obtain information about third-party billers; (6) HCFA issued a new enrollment form for providers first enrolling in Medicare after May 1996; (7) this form obtains the identity of third-party billers that the enrolling providers use; (8) however, since 96 percent of Medicare's providers enrolled in Medicare before 1996, HCFA has no information on billing arrangements for most providers; (9) HCFA is proceeding with plans to develop a national system to capture this information on the enrollment form, even though the system would initially contain data for only a fraction of all Medicare providers; and (10) although HCFA's plans for implementing this system are not final, HCFA officials told GAO they plan to complete it after addressing computer systems work needed to prepare for year 2000. [ABSTRACT FROM AUTHOR]

This document describes proposed changes to Government Auditing Standards, commonly known as the "yellow book." These changes add a field work standard and amend a reporting standard for financial statement audits to improve auditor communication concerning the auditor's work on compliance with laws and regulations and internal controls over financial reporting with the auditee and users of the auditor's reports. GAO describes the process followed in revising the standards, discusses the proposed changes, outlines the format of this exposure draft, and requests comments from interested parties on these proposed revisions. [ABSTRACT FROM AUTHOR]

GAO reviewed the financial statement audit reports for the Daughters of the American Revolution for fiscal years 1999 and 1998. GAO found no reportable instances of noncompliance with the requirements of the law, and the audit report included the auditor's opinion that the financial statements of the corporation were presented fairly in accordance with generally accepted accounting principles. [ABSTRACT FROM AUTHOR]

GAO reviewed the financial statement audit reports for the National Ski Patrol System for fiscal years 1999 and 1998. GAO found no reportable instances of noncompliance with the requirements of the law, and the audit report included the auditor's opinion that the financial statements of the corporation were presented fairly in accordance with generally accepted accounting principles. [ABSTRACT FROM AUTHOR]

Securing the control systems that regulate the nation's critical infrastructures is vital to ensuring our economic security and public health and safety. The Tennessee Valley Authority (TVA), a federal corporation and the nation's largest public power company, generates and distributes power in an area of about 80,000 square miles in the southeastern United States. GAO was asked to determine whether TVA has implemented appropriate information security practices to protect its control systems. To do this, GAO examined the security practices in place at several TVA facilities; analyzed the agency's information security policies, plans, and procedures against federal law and guidance; and interviewed agency officials who are responsible for overseeing TVA's control systems and their security. TVA has not fully implemented appropriate security practices to secure the control systems and networks used to operate its critical infrastructures. Both its corporate network infrastructure and control systems networks and devices were vulnerable to disruption. The corporate network was interconnected with control systems networks GAO reviewed, thereby increasing the risk that security weaknesses on the corporate network could affect those control systems networks. On TVA's corporate network, certain individual workstations lacked key software patches and had inadequate security settings, and numerous network infrastructure protocols and devices had limited or ineffective security configurations. In addition, the intrusion detection system had significant limitations. On control systems networks, firewalls reviewed were either inadequately configured or had been bypassed, passwords were not effectively implemented, logging of certain activity was limited, configuration management policies for control systems software were inconsistently implemented, and servers and workstations lacked key patches and effective virus protection. In addition, physical security at multiple locations did not sufficiently protect critical control systems. As a result, systems that operate TVA's critical infrastructures are at increased risk of unauthorized modification or disruption by both internal and external threats. An underlying reason for these weaknesses is that TVA had not consistently implemented significant elements of its information security program. Although TVA had developed and implemented program activities related to contingency planning and incident response, it had not consistently implemented key activities related to developing an inventory of systems, assessing risk, developing policies and procedures, developing security plans, testing and monitoring the effectiveness of controls, completing appropriate training, and identifying and tracking remedial actions. For example, the agency lacked a complete inventory of its control systems and had not categorized all of its control systems according to risk, thereby limiting assurance that these... [ABSTRACT FROM AUTHOR]

The control systems that regulate the nation's critical infrastructures face risks of cyber threats, system vulnerabilities, and potential attacks. Securing these systems is therefore vital to ensuring national security, economic well-being, and public health and safety. While most critical infrastructures are privately owned, the Tennessee Valley Authority (TVA), a federal corporation and the nation's largest public power company, provides power and other services to a large swath of the American Southeast. GAO was asked to testify on its public report being released today on the security controls in place over TVA's critical infrastructure control systems. In doing this work, GAO examined the security practices in place at TVA facilities; analyzed the agency's information security policies, plans, and procedures in light of federal law and guidance; and interviewed agency officials responsible for overseeing TVA's control systems and their security. TVA had not fully implemented appropriate security practices to secure the control systems used to operate its critical infrastructures at facilities GAO reviewed. Multiple weaknesses within the TVA corporate network left it vulnerable to potential compromise of the confidentiality, integrity, and availability of network devices and the information transmitted by the network. For example, almost all of the workstations and servers that GAO examined on the corporate network lacked key security patches or had inadequate security settings. Furthermore, TVA did not adequately secure its control system networks and devices on these networks, leaving the control systems vulnerable to disruption by unauthorized individuals. Network interconnections provided opportunities for weaknesses on one network to potentially affect systems on other networks. For example, weaknesses in the separation of network segments could allow an individual who gained access to a computing device connected to a less secure portion of the network to compromise systems in a more secure portion of the network, such as the control systems. In addition, physical security at multiple locations that GAO reviewed did not sufficiently protect the control systems. For example, live network jacks connected to TVA's internal network at certain facilities GAO reviewed had not been adequately secured from unauthorized access. As a result, TVA's control systems were at increased risk of unauthorized modification or disruption by both internal and external threats. An underlying reason for these weaknesses was that TVA had not consistently implemented significant elements of its information security program. For example, the agency lacked a complete and accurate inventory of its control systems and had not categorized all of its control systems according to risk, limiting assurance that these systems are adequately protected. In addition, TVA's patch management process lacked a mechanism to effectively prioritize... [ABSTRACT FROM AUTHOR]

The Government Accountability Office (GAO) is required by the Government Management Reform Act of 1994 to audit the Consolidated Financial Statements of the U.S. Government (CFS). Certain material weaknesses in financial reporting and other limitations on the scope of our work have continued to result in conditions that have prevented us from expressing an opinion on the federal government's accrual basis consolidated financial statements. To assist us in planning future audits, when we anticipate being able to eventually issue an opinion on the accrual basis consolidated financial statements, we have performed and plan to continue performing selected procedures on certain line items and other areas of interest. The purpose of these procedures is to obtain an understanding of selected federal agencies' accounting and reporting and the audit work being performed in these areas. This letter relates to the fiscal year 2006 accounts payable (A/P) line item. The federal government reported about $58 billion of A/P as of September 30, 2006. Certain federal agencies' auditors reported internal control deficiencies related to A/P. These weaknesses contributed to the CFS material weakness for "Liabilities and Commitments and Contingencies" reported in our fiscal years 2007 and 2006 CFS audit reports. [ABSTRACT FROM AUTHOR]

In 1995, GAO first designated the Department of Defense's (DOD) business systems modernization program as "high risk," and GAO continues to do so today. To assist in addressing this high-risk area, the Ronald W. Reagan National Defense Authorization Act for Fiscal Year 2005 contains provisions that are consistent with prior GAO investment management and enterprise architecture-related recommendations, and requires the department to submit annual reports to its congressional committees on its compliance with these provisions. The act also directs GAO to review each annual report. In response, GAO assessed the actions taken by DOD to comply with requirements of the act. To do so, GAO leveraged its recent reports on various aspects of the department's modernization management controls, and it reviewed, for example, the latest version of its business enterprise architecture and the associated transition plan and architecture federation strategy. GAO also interviewed key officials. As part of DOD's continuing efforts to strengthen management of its business systems modernization program, it has taken steps over the last year to build on past efforts and further comply with the National Defense Authorization Act's requirements and related federal guidance. Notwithstanding this progress, aspects of these requirements and relevant guidance have yet to be fully satisfied. In particular, the military departments, under DOD's "federated" and "tiered" approach to establishing institutional modernization management controls, have lagged well behind DOD's corporate efforts, and the corporate efforts are still not yet where they need to be. For example, the latest version of DOD's corporate business enterprise architecture continues to add content needed to improve its completeness, consistency, understandability, and usability. Moreover, its latest architecture federation strategy is more detailed and explicit than the prior version. However, the corporate architecture is still missing important content, such as business rules for, and information flows among, certain business activities. Moreover, the architecture has yet to be federated. Specifically, the military departments, which are the largest members of the federation, do not yet have mature enterprise architecture programs, and the federation strategy aimed at accomplishing this is still evolving. GAO has existing recommendations to address these and other architecture issues. The updated enterprise transition plan, which provides a temporal investment roadmap for transitioning from the current architectural environment to the target environment, continues to identify systems and initiatives that are to fill business capability gaps and address the DOD-wide and component business priorities that are contained in the business enterprise architecture. However, the plan still does not include investments for all components and does not reflect key factors associated with properly... [ABSTRACT FROM AUTHOR]

The article focuses on the study conducted by the Government Accountability Office (GAO) on several governance reforms and accountability in operational matters in the Smithsonian Institution in Washington D.C. The study examine the effectiveness and usefulness of the proposed reform towards the improvement of the institution's operations. The governance reforms aimed three main areas such as executive compensation benefits, operational policies and Board's responsibilities and performance.