Search

The Office of Personnel Management (OPM) manages the systems that process retirement benefits for most federal civilian employees. In fiscal year 2003, over 198,000 claims were processed and over $50 billion in benefits was paid through OPM's retirement systems. OPM is trying to modernize these systems through a program called Retirement Systems Modernization (RSM). The conference report accompanying the fiscal year 2004 OPM appropriations act directed us to review the management of and challenges facing RSM. Specifically, our objectives were to determine (1) the current status of and plans for OPM's RSM program and (2) the challenges OPM faces in successfully managing the program. The Office of Personnel Management (OPM) is in the midst of an effort known as Retirement Systems Modernization (RSM). OPM's goals, through this program, are to improve customer service, reduce calculation errors, and reduce the amount of paper-based and manual processing. OPM expects RSM's total cost to be about $294 million from fiscal year 1997 to fiscal year 2008, when the agency expects to have most of RSM implemented and integrated. As currently envisioned, RSM comprises four major components: licensed technology for pension benefits administration, data conversion of paper files and development of electronic processes for capture and storage of data, coverage determination and other applications, and foundation and infrastructure elements. GAO's experience with major systems acquisitions such as RSM has shown that having sound systems acquisition, change management, and investment management processes in place increases the likelihood of the acquisitions meeting cost and schedule estimates as well as performance requirements. However, GAO found that many of the processes in these areas for RSM are not sufficiently developed, are still under development, or are planned for future development. For example, OPM lacks needed processes for developing and managing requirements, planning and managing project activities, managing risks, and providing sound information to investment decision makers. Without these processes in place, RSM is at increased risk of not being developed and delivered on time and within budget and falling short of promised capabilities. [ABSTRACT FROM AUTHOR]

This testimony outlines (1) the impact of the recent increased operational tempo on the process used to reimburse Army Guard soldiers for travel expenses and the effect that travel reimbursement problems have had on soldiers and their families; (2) the adequacy of the overall design of controls over the processes, human capital, and automated systems relied on for Army Guard travel reimbursements; (3) whether the Department of Defense's (DOD) current efforts to automate its travel reimbursement process will resolve the problems identified; and (4) other DOD actions to improve the accuracy and timeliness of Army Guard travel reimbursements. Mobilized Army Guard soldiers have experienced significant problems getting accurate, timely, and consistent reimbursements for out-of-pocket travel expenses. These weaknesses were more glaring in light of the sustained increase in mobilized Guard soldiers following the terrorist attacks of September 11, 2001. To its credit, the Defense Finance and Accounting Service (DFAS) hired over 200 new personnel to address travel voucher processing backlogs and recently upgraded their training. However, Guard soldiers in our case study units reported a number of problems they and their families endured due to delayed or unpaid travel reimbursements, including debts on their personal credit cards, trouble paying their monthly bills, and inability to make child support payments. The soldier bears primary responsibility for travel voucher preparation, including obtaining paper copies of various types of authorizations. DFAS data indicate that it rejected and asked soldiers to resubmit about 18 percent of vouchers during fiscal year 2004--a churning process that added to delays and frustration. Also, existing guidance did not clearly address the sometimes complex travel situations of mobilized Army Guard soldiers, who were often housed off-post due to overcrowding on military installations. Further, DOD continued to be noncompliant with a law that requires payment of late payment interest and fees when soldiers' travel reimbursements are not timely. With respect to human capital, GAO found a lack of oversight and accountability and inadequate training. Automated systems problems, such as nonintegration of key systems involved in authorizing and paying travel expenses and failure to automate key processes, also contributed to the inefficient, error-prone process. DOD has been developing and implementing the Defense Travel System (DTS) to resolve travel-related deficiencies. However, DTS will not address some of the key systems flaws. For example, DTS is currently not able to process mobilized soldier travel authorizations and vouchers and identify and calculate late payment interest and fees. [ABSTRACT FROM AUTHOR]

The National Transportation Safety Board (NTSB) plays a vital role in advancing transportation safety by investigating accidents, determining their causes, issuing safety recommendations, and conducting safety studies. To support its mission, NTSB's training center provides training to NTSB investigators and others. It is important that NTSB use its resources efficiently to carry out its mission. In 2006, GAO made recommendations to NTSB in most of these areas. In 2007, an independent auditor made information security recommendations. This testimony addresses NTSB's progress in following leading practices in selected management areas, increasing the efficiency of aspects of investigating accidents and conducting safety studies, increasing the utilization of its training center, and improving information security. This testimony is based on GAO's assessment of agency plans and procedures developed to address these recommendations. NTSB has made progress in following leading management practices in the eight areas in which GAO made prior recommendations. For example, the agency has improved communication from staff to management by conducting periodic employee surveys, which should help build more constructive relationships within NTSB. Similarly, the agency has made significant progress in improving strategic planning, human capital management, and IT management. It has issued new strategic plans in each area. Although the plans still leave room for improvement, they establish a solid foundation for NTSB to move forward. However, until the agency has developed a full cost accounting system and a strategic training plan, it will miss other opportunities to strengthen the management of the agency. NTSB has improved the efficiency of activities related to investigating accidents and tracking the status of recommendations. For example, it has developed transparent, risk-based criteria for selecting which rail, pipeline, hazardous materials, and aviation accidents to investigate at the scene. The completion of similar criteria for marine accidents will help provide assurance that NTSB is managing its resources in a manner to ensure a maximum safety benefit. Also, it is in the process of automating its lengthy, paper-based process for closing-out recommendations. Although NTSB has increased the utilization of its training center--from 10 percent in fiscal year 2006 to a projected 24 percent fiscal year 2008--the classroom space remains significantly underutilized. The increased utilization has helped increase revenues and reduce the center's overall deficit, which declined from about $3.9 million in fiscal year 2005 to about $2.3 million in fiscal year 2007. For fiscal year 2008, NTSB expects the deficit to decline further to about $1.2 million due, in part, to increased revenues from subleasing some classrooms starting July 2008. However the agency's business plan for the training center lacks specific strategies to achieve further... [ABSTRACT FROM AUTHOR]

The U.S. Dept. of Agriculture's (USDA) Risk Management Agency (RMA) administers the federal crop insurance program in partnership with private insurers. In 2006, the program cost $3.5 billion, including millions in losses from fraud, waste, and abuse, according to USDA. The Agricultural Risk Protection Act of 2000 granted RMA authority to renegotiate the terms of RMA's standard reinsurance agreement with companies once over 5 years. This testimony is based on GAO's 2005 report, Crop Insurance: Actions Needed to Reduce Program's Vulnerability to Fraud, Waste, and Abuse, and May 2007 testimony, Crop Insurance: Continuing Efforts Are Needed to Improve Program Integrity and Ensure Program Costs Are Reasonable. GAO discusses (1) USDA's processes to address fraud, waste, and abuse; (2) extent the program's design makes it vulnerable to abuse; and (3) reasonableness of underwriting gains and other expenses. USDA agreed with most of GAO's 2005 recommendations to improve program integrity. GAO reported that RMA did not use all available tools to reduce the crop insurance program's vulnerability to fraud, waste, and abuse. RMA has since taken some steps to improve its procedures. In particular: (1) USDA's Farm Service Agency (FSA) inspections during the growing season were not being used to maximum effect. Between 2001 and 2004, FSA conducted only 64 percent of the inspections RMA requested. Without inspections, farmers may falsely claim crop losses. However, FSA said it could not conduct all requested inspections, as GAO recommended, because of insufficient resources. RMA now provides information more frequently so FSA can conduct timelier inspections. (2) RMA's data analysis of the largest farming operations was incomplete. In 2003, about 21,000 of the largest farming operations did not report all of the individuals or entities with an ownership interest in these operations, as required. Therefore, RMA was unaware of ownership interests that could help it prevent potential program abuse. FSA and RMA started sharing information to identify such individuals or entities, but have stopped temporarily to resolve producer privacy issues. USDA should recover up to $74 million in improper payments made during 2003. (3) RMA was not effectively overseeing insurance companies' efforts to control program abuse. According to GAO's review of 120 cases, companies did not complete all the required quality assurance reviews of claims, and those that were conducted were largely paper exercises. RMA agreed to improve oversight of their reviews, but GAO has not followed up to examine its implementation. RMA's regulations to implement the crop insurance program, as well as some statutory requirements, create design problems that hinder its efforts to reduce abuse. For example, the regulations allow farmers to insure fields individually rather than together. As such, farmers can "switch" reporting of yield among fields to make false claims or build up a... [ABSTRACT FROM AUTHOR]

The U.S. Dept. of Agriculture's (USDA) Risk Management Agency (RMA) administers the federal crop insurance program in partnership with private insurers. In 2006, the program cost $3.5 billion, including millions in losses from fraud, waste, and abuse, according to USDA. The Agricultural Risk Protection Act of 2000 granted RMA authority to renegotiate the terms of RMA's standard reinsurance agreement with companies once over 5 years. This testimony is based on GAO's 2005 report, Crop Insurance: Actions Needed to Reduce Program's Vulnerability to Fraud, Waste, and Abuse, as well as new analyses this Committee requested on underwriting gains and administrative and operating expenses USDA paid companies. GAO discusses (1) USDA's processes to address fraud, waste, and abuse; (2) extent the program's design makes it vulnerable to abuse; and (3) reasonableness of underwriting gains and other expenses. USDA agreed with most of GAO's 2005 recommendations to improve program integrity. RMA agreed that GAO's new analyses were technically accurate. GAO reported that RMA did not use all available tools to reduce the crop insurance program's vulnerability to fraud, waste, and abuse. RMA has since taken some steps to improve its procedures. In particular, USDA's Farm Service Agency (FSA) inspections during the growing season were not being used to maximum effect. Between 2001 and 2004, FSA conducted only 64 percent of the inspections RMA requested. Without inspections, farmers may falsely claim crop losses. However, FSA said it could not conduct all requested inspections, as GAO recommended, because of insufficient resources. RMA now provides information more frequently so FSA can conduct timelier inspections. RMA's data analysis of the largest farming operations was incomplete. In 2003, about 21,000 of the largest farming operations did not report all of the individuals or entities with an ownership interest in these operations, as required. Therefore, RMA was unaware of ownership interests that could help it prevent potential program abuse. FSA and RMA now share information to identify such individuals or entities. USDA should be able to recover up to $74 million in improper payments made during 2003. RMA was not effectively overseeing insurance companies' efforts to control program abuse. According to GAO's review of 120 cases, companies did not complete all the required quality assurance reviews of claims, and those that were conducted were largely paper exercises. RMA agreed to improve oversight of their reviews, but GAO has not followed up to examine its implementation. RMA's regulations to implement the crop insurance program, as well as some statutory requirements, create design problems that hinder its efforts to reduce abuse. For example, the regulations allow farmers to insure fields individually rather than together. As such, farmers can "switch" reporting of yield among fields to make false claims or build up a higher yield history... [ABSTRACT FROM AUTHOR]

The U.S. Dept. of Agriculture's (USDA) Risk Management Agency (RMA) administers the federal crop insurance program in partnership with private insurers. In 2005, the program cost $2.7 billion, including an estimated $117 million in losses from fraud, waste, and abuse. The Agricultural Risk Protection Act of 2000 (ARPA) provided new tools to monitor and control abuses, such as providing RMA sanction authority to address program abuse and having USDA's Farm Service Agency (FSA) inspect farmers' fields. This testimony is based on GAO's September 30, 2005, report, Crop Insurance: Actions Needed to Reduce Program's Vulnerability to Fraud, Waste, and Abuse (GAO-05-528). GAO assessed (1) USDA's processes to address fraud, waste, and abuse, and (2) the extent to which the program's design makes it vulnerable to abuse. RMA has taken a number of steps to improve its procedures and processes to address fraud, waste and abuse in selling and servicing crop insurance policies and has reported more than $300 million in savings from 2001 to 2004. However, RMA is not effectively using all of its tools. GAO identified weaknesses in four key areas. First, FSA inspections during the growing season are not being used to maximum effect. Between 2001 and 2004, FSA conducted only 64 percent of the inspections RMA had requested. Without inspections, farmers may falsely claim crop losses. Second, RMA's data analysis of the largest farming operations is incomplete. According to GAO's analysis, in 2003 about 21,000 of the largest farming operations in the program did not report individuals or entities with an ownership interest in these operations as required. Without this information RMA was unaware of ownership interests that could help it prevent potential program abuse. FSA did not give RMA access to the data needed to identify such individuals or entities. USDA should be able to recover up to $74 million in improper claims payments. Third, RMA is not effectively overseeing insurance companies' efforts to control program abuse. GAO's review of 120 cases showed that companies did not complete all of the required quality assurance reviews of claims and those that were conducted were largely paper exercises. Fourth, RMA has infrequently used its new sanction authority to address program abuse. RMA has not issued regulations to implement its new sanction authority under ARPA and imposed only 114 sanctions from 2001 through 2004, although it annually identifies about 3,000 questionable claims, not all of which are necessarily sanctionable. RMA's regulations to implement the crop insurance program, as well as some statutory requirements, create program design problems that hinder RMA's efforts to reduce program abuse. For example, RMA's regulations allow farmers to insure fields individually rather than all fields combined. This option enables farmers to "switch" reporting of yield among fields to either make false claims or build up a higher yield history on... [ABSTRACT FROM AUTHOR]

Federal crop insurance protects producers against losses from natural disasters. In 2004, the crop insurance program provided $47 billion in coverage, at a cost of $3.6 billion, including an estimated $160 million in losses from fraud and abuse. The U.S. Department of Agriculture's (USDA) Risk Management Agency (RMA) administers this program with private insurers. The Agricultural Risk Protection Act of 2000 (ARPA) provided new tools to monitor and control abuses, such as having USDA's Farm Service Agency (FSA) conduct field inspections. GAO assessed, among other things, the (1) effectiveness of USDA's processes to address program fraud and abuse and (2) extent to which the program's design makes it vulnerable to abuse. While RMA employs a range of processes to help prevent and detect fraud, waste, and abuse and has reported more than $300 million in savings over the past 4 years in the crop insurance program, GAO found that RMA does not effectively use all the tools it has available. Inspections during the growing season are not being used to maximum effect. Between 2001 and 2004, FSA conducted only 64 percent of the inspections RMA had requested. Without inspections, producers may falsely claim crop losses. RMA's data analysis of the largest farming operations is incomplete. According to GAO's analysis, in 2003, about 21,000 of the largest farming operations in the program did not report individuals or entities with an ownership interest in these operations. As a result, USDA should be able to recover up to $74 million in claims payments. FSA did not give RMA access to the data needed to identify such individuals or entities. RMA is not effectively overseeing insurance companies' quality assurance programs. GAO's review of 120 cases showed that companies completed only 75 percent of the required reviews and those that were conducted were largely paper exercises. RMA has infrequently used its new sanction authority to address program abuses. RMA has not issued regulations to implement its new sanction authority under ARPA. RMA imposed only 114 sanctions from 2001 through 2004. Annually, RMA identifies about 3,000 questionable claims, not all of which are necessarily sanctionable. Eight recent crop insurance fraud cases, investigated by USDA's Office of Inspector General and resulting in criminal prosecutions between June 2003 and April 2005, reflect these issues. Totaling $3 million in insurance claims, these cases show how producers, sometimes in collusion with insurance agents and others, falsely claim prevented planting, weather damage, and low production. In some cases, producers hid or moved production from one field to another. Several of these cases also demonstrate the importance of having FSA and RMA work together to identify and share information on questionable farming practices/activities. RMA's regulations, as well as statutory requirements, create program design problems that hinder RMA officials' efforts to reduce program abuse. For example, RMA's regulations allow producers to insure fields individually rather than all fields combined. This option enables producers to "switch" reporting of yield among fields to either make false claims or build up a higher yield history on a field to increase its eligibility for higher insurance guarantees. High premium subsidies, established by statute, may also limit RMA's ability to control program abuse because the subsidies shield producers from the full effect of paying higher premiums associated with frequent or larger claims. [ABSTRACT FROM AUTHOR]

The Internal Revenue Service (IRS) has been shifting its priorities from taxpayer service to enforcement and its management of Business Systems Modernization (BSM) from contractors to IRS staff. Although there are sound reasons for these adjustments, they also involve risks. With respect to the fiscal year 2006 budget request, GAO assessed (1) how IRS proposes to balance its resources between taxpayer service and enforcement programs and the potential impact on taxpayers, (2) the status of IRS's efforts to develop and implement the BSM program, and (3) the progress IRS has made in implementing best practices in developing its Information Technology (IT) operations and maintenance budget. For the 2005 filing season, GAO assessed IRS's performance in processing returns and providing taxpayer service. IRS's fiscal year 2006 budget request of $10.9 billion proposes increased funding for enforcement, but reduced funding for taxpayer service and BSM. However, the potential impact of these changes on taxpayers in either the short- or long-term is unclear, because IRS has not provided details of proposed taxpayer service reductions, and although it is developing longterm goals, they are not yet finalized. Because of the proposed reductions and new and improved taxpayer services in recent years, this is an opportune time to examine the menu of services IRS provides. It may be possible to maintain the overall level of service to taxpayers by offsetting reductions in some areas with new and improved service in other areas. Taxpayers and IRS are seeing some payoff from the BSM program, with the deployment of initial phases of several modernized systems in 2004. Nevertheless, the BSM program continues to be high-risk, in part, because projects have incurred significant cost increases and schedule delays and the program faces major challenges in areas such as human capital and requirements management. As a result of budget reductions and other factors, IRS has made major adjustments. It is too early to tell what effect these adjustments will have on the program, but they are not without risk and could potentially impact future budgets. Further, the BSM program is based on strategies developed years ago, which, coupled with the delays and changes brought on by budget reductions, indicates that it is time for IRS to revisit its long-term goals, strategy, and plans for BSM. Because of these challenges, IRS is redefining and refocusing the BSM program. IRS has generally maintained or improved its filing season performance in 2005. Processing is more efficient, the accuracy of answers provided by telephone assistors is improved, and telephone access is relatively comparable to last year. This is particularly noteworthy, because IRS received less funding for taxpayer service in 2005 than it spent in 2004. Because the filing season is not over, the full impact on taxpayers and IRS operations is not yet known. However, there are indications of slippage in telephone access such as more abandoned calls and longer wait times. [ABSTRACT FROM AUTHOR]

Securing the control systems that regulate the nation's critical infrastructures is vital to ensuring our economic security and public health and safety. The Tennessee Valley Authority (TVA), a federal corporation and the nation's largest public power company, generates and distributes power in an area of about 80,000 square miles in the southeastern United States. GAO was asked to determine whether TVA has implemented appropriate information security practices to protect its control systems. To do this, GAO examined the security practices in place at several TVA facilities; analyzed the agency's information security policies, plans, and procedures against federal law and guidance; and interviewed agency officials who are responsible for overseeing TVA's control systems and their security. TVA has not fully implemented appropriate security practices to secure the control systems and networks used to operate its critical infrastructures. Both its corporate network infrastructure and control systems networks and devices were vulnerable to disruption. The corporate network was interconnected with control systems networks GAO reviewed, thereby increasing the risk that security weaknesses on the corporate network could affect those control systems networks. On TVA's corporate network, certain individual workstations lacked key software patches and had inadequate security settings, and numerous network infrastructure protocols and devices had limited or ineffective security configurations. In addition, the intrusion detection system had significant limitations. On control systems networks, firewalls reviewed were either inadequately configured or had been bypassed, passwords were not effectively implemented, logging of certain activity was limited, configuration management policies for control systems software were inconsistently implemented, and servers and workstations lacked key patches and effective virus protection. In addition, physical security at multiple locations did not sufficiently protect critical control systems. As a result, systems that operate TVA's critical infrastructures are at increased risk of unauthorized modification or disruption by both internal and external threats. An underlying reason for these weaknesses is that TVA had not consistently implemented significant elements of its information security program. Although TVA had developed and implemented program activities related to contingency planning and incident response, it had not consistently implemented key activities related to developing an inventory of systems, assessing risk, developing policies and procedures, developing security plans, testing and monitoring the effectiveness of controls, completing appropriate training, and identifying and tracking remedial actions. For example, the agency lacked a complete inventory of its control systems and had not categorized all of its control systems according to risk, thereby limiting assurance that these... [ABSTRACT FROM AUTHOR]

The control systems that regulate the nation's critical infrastructures face risks of cyber threats, system vulnerabilities, and potential attacks. Securing these systems is therefore vital to ensuring national security, economic well-being, and public health and safety. While most critical infrastructures are privately owned, the Tennessee Valley Authority (TVA), a federal corporation and the nation's largest public power company, provides power and other services to a large swath of the American Southeast. GAO was asked to testify on its public report being released today on the security controls in place over TVA's critical infrastructure control systems. In doing this work, GAO examined the security practices in place at TVA facilities; analyzed the agency's information security policies, plans, and procedures in light of federal law and guidance; and interviewed agency officials responsible for overseeing TVA's control systems and their security. TVA had not fully implemented appropriate security practices to secure the control systems used to operate its critical infrastructures at facilities GAO reviewed. Multiple weaknesses within the TVA corporate network left it vulnerable to potential compromise of the confidentiality, integrity, and availability of network devices and the information transmitted by the network. For example, almost all of the workstations and servers that GAO examined on the corporate network lacked key security patches or had inadequate security settings. Furthermore, TVA did not adequately secure its control system networks and devices on these networks, leaving the control systems vulnerable to disruption by unauthorized individuals. Network interconnections provided opportunities for weaknesses on one network to potentially affect systems on other networks. For example, weaknesses in the separation of network segments could allow an individual who gained access to a computing device connected to a less secure portion of the network to compromise systems in a more secure portion of the network, such as the control systems. In addition, physical security at multiple locations that GAO reviewed did not sufficiently protect the control systems. For example, live network jacks connected to TVA's internal network at certain facilities GAO reviewed had not been adequately secured from unauthorized access. As a result, TVA's control systems were at increased risk of unauthorized modification or disruption by both internal and external threats. An underlying reason for these weaknesses was that TVA had not consistently implemented significant elements of its information security program. For example, the agency lacked a complete and accurate inventory of its control systems and had not categorized all of its control systems according to risk, limiting assurance that these systems are adequately protected. In addition, TVA's patch management process lacked a mechanism to effectively prioritize... [ABSTRACT FROM AUTHOR]

In 1995, GAO first designated the Department of Defense's (DOD) business systems modernization program as "high risk," and GAO continues to do so today. To assist in addressing this high-risk area, the Ronald W. Reagan National Defense Authorization Act for Fiscal Year 2005 contains provisions that are consistent with prior GAO investment management and enterprise architecture-related recommendations, and requires the department to submit annual reports to its congressional committees on its compliance with these provisions. The act also directs GAO to review each annual report. In response, GAO assessed the actions taken by DOD to comply with requirements of the act. To do so, GAO leveraged its recent reports on various aspects of the department's modernization management controls, and it reviewed, for example, the latest version of its business enterprise architecture and the associated transition plan and architecture federation strategy. GAO also interviewed key officials. As part of DOD's continuing efforts to strengthen management of its business systems modernization program, it has taken steps over the last year to build on past efforts and further comply with the National Defense Authorization Act's requirements and related federal guidance. Notwithstanding this progress, aspects of these requirements and relevant guidance have yet to be fully satisfied. In particular, the military departments, under DOD's "federated" and "tiered" approach to establishing institutional modernization management controls, have lagged well behind DOD's corporate efforts, and the corporate efforts are still not yet where they need to be. For example, the latest version of DOD's corporate business enterprise architecture continues to add content needed to improve its completeness, consistency, understandability, and usability. Moreover, its latest architecture federation strategy is more detailed and explicit than the prior version. However, the corporate architecture is still missing important content, such as business rules for, and information flows among, certain business activities. Moreover, the architecture has yet to be federated. Specifically, the military departments, which are the largest members of the federation, do not yet have mature enterprise architecture programs, and the federation strategy aimed at accomplishing this is still evolving. GAO has existing recommendations to address these and other architecture issues. The updated enterprise transition plan, which provides a temporal investment roadmap for transitioning from the current architectural environment to the target environment, continues to identify systems and initiatives that are to fill business capability gaps and address the DOD-wide and component business priorities that are contained in the business enterprise architecture. However, the plan still does not include investments for all components and does not reflect key factors associated with properly... [ABSTRACT FROM AUTHOR]

Congress mandated that the United States Trade Representative (USTR) annually assess China's trade compliance and report its findings to Congress. In addition, USTR conducted an interagency "top-to-bottom review" of U.S. trade policies toward China. USTR's resulting February 2006 report outlined U.S objectives and action items. GAO was asked to (1) evaluate USTR's annual China trade compliance reports to Congress and the degree to which they present information necessary to fully understand China's compliance situation and (2) examine the status of the plans presented in USTR's February 2006 top-to-bottom report. GAO systematically analyzed the contents of USTR's compliance reports from 2002 to 2007 and reviewed information on the status of agencies' monitoring and enforcement activities. USTR's annual reports to Congress, which detail U.S. industry concerns with China's compliance and progress on resolving such concerns, are very consistent in format and language. However, they lack any summary analysis about the number, scope, and disposition of reported issues that would facilitate understanding of developments in China's trade compliance and better tracking of the effectiveness of U.S. monitoring and enforcement efforts with China. For example, USTR's narrative reports make it difficult to understand the relative level of progress China made in each trade area in a given year. USTR reported issues that spanned nine trade areas and ranged from very specific issues to broader concerns; however, USTR's narrative reports make it difficult to ascertain specific changes or trends. GAO's systematic content analysis quantified the number, type, and disposition of trade issues and identified 180 individual compliance issues from 2002 to 2007. GAO analysis showed that China resolved a quarter of these issues, but made no progress on one-third of them. Also, GAO's analysis revealed that China's progress in resolving compliance issues varied by trade area and has been slowing over time, especially since 2004, when most progress was made. GAO could only partially determine the status of U.S. agencies' implementation of USTR's 2006 top-to-bottom report, which outlines broad objectives and priority goals for U.S.-China trade relations as well as specific action items. GAO found that key trade agencies made considerable progress implementing planned action items. They increased bilateral engagement with the Chinese and monitoring and enforcement capacity by increasing staffing levels and training opportunities, but staffing gaps and limited Chinese language capacity are challenges at some agencies. However, GAO could not determine agencies' progress toward achieving some U.S. objectives and goals identified in the report. USTR does not formally assess its progress or measure program results. The lack of linkages between U.S. objectives and planned action items and undefined terms make it difficult to assess whether the steps agencies... [ABSTRACT FROM AUTHOR]

Since its inception, the Transportation Security Administration (TSA) has focused much of its efforts on aviation security, and has developed and implemented a variety of programs and procedures to secure commercial aviation. More recently, TSA has taken actions to secure the nation's surface transportation modes. TSA funding for aviation security has totaled about $26 billion since fiscal year 2004, and for surface transportation security activities, about $175 million since fiscal year 2005. This testimony focuses on TSA's efforts to secure the commercial aviation system-- through passenger screening, air cargo, and watch-list matching programs--and the nation's surface transportation modes. It also addresses challenges remaining in these areas. GAO's comments are based on GAO products issued from February 2004 through April 2008 including selected updates obtained in February through April 2008. DHS and TSA have undertaken numerous initiatives to strengthen the security of the nation's transportation system, including actions to address many recommendations made by GAO. With respect to aviation security, TSA has focused its efforts on, among other things, more efficiently allocating, deploying, and managing the Transportation Security Officer (TSO) workforce--formerly known as screeners; strengthening screening procedures; developing and deploying more effective and efficient screening technologies; strengthening domestic air cargo security; and developing a government operated watch-list matching program, known as Secure Flight. For example, in response to GAO's recommendation, TSA developed a plan to periodically review assumptions in its Staffing Allocation Model, and took steps to strengthen its evaluation of proposed procedural changes. TSA has also explored new passenger checkpoint screening technologies to better detect explosives and other threats, and has taken steps to strengthen air cargo security, including conducting compliance inspections of air carriers. Finally, TSA has instilled more discipline and rigor into Secure Flight's systems development, including preparing key documentation and strengthening privacy protections. With regard to surface transportation security, TSA has, among other things, taken steps to develop a strategic approach for securing mass transit, passenger and freight rail, commercial vehicles, and highways; established security standards for certain transportation modes; and conducted threat, criticality, and vulnerability assessments of surface transportation assets, particularly related to passenger and freight rail. While these efforts should be commended, GAO has identified several areas that should be addressed to further strengthen transportation security. For example, TSA has made limited progress in developing and deploying checkpoint technologies due to planning and management challenges. In addition, TSA has not revised screening exemptions for air cargo transported into the... [ABSTRACT FROM AUTHOR]

In 1995, GAO designated Department of Defense (DOD) business systems modernization as a high-risk program, and the program remains on the high-risk list today. A key to successful systems modernization is having and using an enterprise architecture as an authoritative frame of reference, or blueprint, for system investment decisions. To assist DOD in modernizing its business systems, Congress passed legislation consistent with prior GAO recommendations for DOD to develop and implement a business enterprise architecture (BEA). In response, DOD developed a corporate BEA that it intends to federate, or extend, to the military departments and defense agencies. To support GAO's legislative mandate to review DOD's BEA, GAO evaluated the status of the Air Force, Navy, and Army architecture programs. To accomplish this, GAO used its Enterprise Architecture Management Maturity Framework and associated evaluation method. The enterprise architecture programs within the Departments of the Air Force, Navy, and Army have yet to advance to a level that can be considered fully mature. Specifically, all three departments are at the initial stage of GAO's architecture maturity framework. This means that they have not fully satisfied all the core elements associated with the framework's second stage (establishing the management foundation for developing, maintaining, and using the architecture) or any of the framework's higher stages: Stage 3 (developing the architecture), Stage 4 (completing the architecture), and Stage 5 (leveraging the architecture for organizational change). An organization generally needs to have achieved the fifth stage in the framework for it to have an effective architecture program because, at this stage, the management controls and structures are in place for using an approved architecture to guide and constrain system investments in a way that produces institutional results. Although each department is at Stage 1, the status of the programs vary considerably. Specifically, the Air Force far exceeds both the Navy and the Army, while the Navy generally exceeds the Army, in terms of the total percentage of core elements that are fully satisfied. Moreover, of the core elements that have not been fully satisfied by at least one of the three departments, most relate to architecture content, use, and measurement. Even though none of the departments have fully satisfied sufficient core elements to advance beyond Stage 1, the Air Force has at least partially satisfied all the core elements associated with Stages 2 and 3, as well as all but three core elements across all stages, and the Navy has at least partially satisfied all the core elements for Stage 2. In addition, the Air Force has made important progress in the last 2 years in maturing its architecture program, while the Navy's progress has been mixed, and the Army has not made any progress. Collectively, this means that DOD, as a whole, is not as well positioned as it... [ABSTRACT FROM AUTHOR]

Since 2001, Labor has spent nearly $900 million on three workforce employment and training grant initiatives: High Growth Job Training Initiative (High Growth), Community-Based Job Training Initiative (Community Based), and the Workforce Innovation in Regional Economic Development (WIRED). GAO was asked to examine (1) the intent of the grant initiatives and the extent to which Labor will be able to assess their effects, (2) the extent to which the process used competition, was adequately documented, and included key players, and (3) what Labor is doing to monitor individual grantee compliance with grant requirements. To answer these questions, GAO obtained from Labor a list of grants for fiscal years 2001 through 2007, and reviewed relevant laws and Labor's internal grant award procedures. GAO interviewed grantees, and state and local workforce officials in seven states where grantees were located, Labor officials, and subject matter experts. According to Labor officials, the grant initiatives were designed to shift the focus of the public workforce system toward the training and employment needs of high-growth, in-demand industries, but Labor will be challenged to assess their impact. Under the initiatives, Labor awarded 349 grants totaling almost $900 million to foster this change. However, the grant initiatives were not fully integrated into Labor's strategic plan or overall research agenda; therefore, it is unclear what criteria Labor will use to evaluate their effectiveness. Labor lacks data that will allow it to compare outcomes for grant-funded services to those of other federally funded employment and training services. While grants under all three initiatives are now awarded competitively, the initial noncompetitive process for High Growth grants was not adequately documented and did not include key players. Community Based and WIRED grants have always been awarded competitively, but more than 80 percent of High Growth grants were awarded without competition. Labor began awarding some High Growth grants competitively in 2005 and Congress required Labor to award certain grants competitively in fiscal years 2007 and 2008. This requirement applies only to those years. Labor could not document criteria used to select the noncompetitive High Growth grants or whether these grants met internal or statutory requirements. Labor has taken steps to strengthen the noncompetitive process, but these procedures do not explicitly require documentation of compliance with statutory program requirements. Labor's process for identifying solutions for industry workforce challenges did not include the vast majority of local workforce investment boards, which oversee local employment and training services. Labor provides some monitoring for grantees under all three initiatives and uses a risk-based monitoring approach for the High Growth and Community Based grants, but not for WIRED. Labor has a process to address findings from single audit... [ABSTRACT FROM AUTHOR]

The United States Capitol Police (USCP) is responsible for securing the 276-acre Capitol Complex, including protecting Members of Congress, visitors, and congressional facilities. In response to heightened security concerns, various requests, and legislative mandates over the years, GAO has reported on management control problems in five key areas: (1) establishing an accountability framework for monitoring recommendations, (2) establishing a risk management framework, (3) ensuring financial management, (4) ensuring strategic and human capital planning, and (5) managing information technology (IT). From January 2004 through March 2007, GAO made 46 recommendations aimed at improving USCP administrative and management operations and achieving strategic goals. This testimony reports on the status of USCP's efforts to address GAO's recommendations. To conduct its work, GAO analyzed USCP documentation, such as risk matrices, budget documents, and strategic plans. GAO also conducted interviews with USCP officials and contractors on their efforts related to its recommendations. GAO performed this work from October 2007 through April 2008. USCP generally agreed with GAO's 46 prior recommendations and GAO's assessment of the status of USCP's efforts to implement those recommendations. Along these lines, USCP needs to complete those actions in progress and address those where there has been no progress. USCP has made significant progress in addressing the 46 recommendations GAO made since 2004. USCP has completed actions on 15 recommendations, is making progress toward addressing 28 recommendations, and has not made progress on 3 recommendations. With respect to the five areas, the status of USCP's efforts to address GAO's recommendations is as follows: (1) Accountability Framework for Monitoring Recommendations--USCP has completed actions on creating a framework to monitor progress on addressing GAO's recommendations and on reporting this progress to appropriate congressional committees and the USCP Police Board. (2) Linking Resources to Risks, Threats, and Vulnerabilities--USCP has taken steps to complete risk assessments for 18 of the 19 congressional facilities. However, additional actions will be required to adequately test and review its overall risk management approach. (3) Financial Management--USCP has completed actions on 8 GAO recommendations, including preparing its first full set of financial statements. USCP is making progress in addressing another 13 recommendations related to training, policies, procedures, and internal controls, but did not make progress toward addressing ongoing staff shortages and work imbalances. (4) Human Capital Management--USCP has implemented one recommendation by adopting a hiring policy and is making progress on seven other recommendations related to workforce planning and training. USCP has not yet addressed a ninth recommendation to monitor and evaluate the results of its strategic workforce... [ABSTRACT FROM AUTHOR]

According to the Centers for Disease Control and Prevention (CDC), health-care-associated infections (HAI) are estimated to be 1 of the top 10 causes of death in the United States. HAIs are infections that patients acquire while receiving treatment for other conditions. GAO was asked to examine (1) CDC's guidelines for hospitals to reduce or prevent HAIs and what the Department of Health and Human Services (HHS) does to promote their implementation, (2) Centers for Medicare & Medicaid Services' (CMS) and hospital accrediting organizations' required standards for hospitals to reduce or prevent HAIs and how compliance is assessed, and (3) HHS programs that collect data related to HAIs and integration of the data across HHS. GAO reviewed documents and interviewed officials from CDC, CMS, the Agency for Healthcare Research and Quality (AHRQ), and accrediting organizations. CDC has 13 guidelines for hospitals on infection control and prevention, which cover a variety of topics, and in these guidelines CDC recommends almost 1,200 practices for implementation to prevent HAIs and related adverse events. Most of the practices are sorted into five categories--from strongly recommended for implementation to not recommended--primarily on the basis of the strength of the scientific evidence for each practice. Over 500 practices are strongly recommended. CDC and AHRQ have conducted some activities to promote implementation of recommended practices, but these activities are not based on a clear prioritization of the practices. Prioritization may consider not only the strength of the evidence, but also other factors that can affect implementation, such as cost and organizational obstacles. In addition to CDC, AHRQ has reviewed scientific evidence for certain HAI-related practices, but the efforts of the two agencies have not been coordinated. The infection control standards required by CMS and hospital-accrediting organizations--the Joint Commission and the Healthcare Facilities Accreditation Program of the American Osteopathic Association (AOA)--describe the fundamental components of a hospital's infection control program. These components include the active prevention, control, and investigation of infections. The standards are far fewer in number than the recommended practices in CDC's guidelines and generally do not require that hospitals implement all recommended practices in CDC's infection control and prevention guidelines. CMS, the Joint Commission, and AOA assess compliance with their infection control standards through direct observation of hospital activities and review hospital policy documents during on-site surveys. Multiple HHS programs collect data on HAIs, but limitations in the scope of information they collect and a lack of integration across the databases maintained by these separate programs constrain the utility of the data. Three agencies within HHS currently collect HAI-related data for a variety of purposes in databases... [ABSTRACT FROM AUTHOR]

According to the Centers for Disease Control and Prevention (CDC), health-care-associated infections (HAI)--infections that patients acquire while receiving treatment for other conditions--are estimated to be 1 of the top 10 causes of death in the nation. This statement summarizes a report issued in March and released today, Health-Care-Associated Infections in Hospitals: Leadership Needed from HHS to Prioritize Prevention Practices and Improve Data on These Infections (GAO-08-283). In this report, GAO examined (1) CDC's guidelines for hospitals to reduce or prevent HAIs and what HHS does to promote their implementation, (2) Centers for Medicare & Medicaid Services' (CMS) and hospital accrediting organizations' required standards for hospitals to reduce or prevent HAIs, and (3) HHS programs that collect data related to HAIs and integration of the data across HHS. To conduct the work, GAO reviewed documents and interviewed HHS agency and accrediting organization officials. In its March report, which is summarized in this statement, GAO found CDC has 13 guidelines for hospitals on infection control and prevention, which contain almost 1,200 recommended practices, but activities across HHS to promote implementation of these practices are not guided by a prioritization of the practices. Although most of the practices have been sorted into categories primarily on the basis of the strength of the scientific evidence for the practice, other factors to consider in prioritizing, such as costs or organizational obstacles, have not been taken into account. While CDC's guidelines describe specific clinical practices recommended to reduce HAIs, the infection control standards that CMS and the accrediting organizations require of hospitals describe the fundamental components of a hospital's infection control program. The standards are far fewer in number than CDC's recommended practices and generally do not require that hospitals implement all recommended practices in CDC's guidelines. Multiple HHS programs have databases that collect data on HAIs, but limitations in the scope of information collected and a lack of integration across the databases constrain the utility of the data. GAO concluded that the lack of department-level prioritization of CDC's large number of recommended practices has hindered efforts to promote their implementation. GAO noted that a few of CDC's strongly recommended practices were required by CMS or the accrediting organizations but that it was not reasonable to expect CMS or the accrediting organizations to require additional practices without prioritization. GAO also concluded that HHS has not effectively used the HAI-related data it has collected through multiple databases across the department to provide a complete picture of the extent of the problem. [ABSTRACT FROM AUTHOR]

Under the Freedom of Information Act (FOIA), federal agencies must generally provide access to their information, enabling the public to learn about government operations and decisions. To help ensure proper implementation, the act requires that agencies report annually to the Attorney General on their processing of FOIA requests. For fiscal year 2006, agencies were also to report on their progress in implementing plans to improve FOIA operations, as directed by a December 2005 Executive Order. A major goal of the order was reducing backlogs of overdue FOIA requests (the statute requires an agency to respond to requests within 20 or, in some cases, 30 working days with a determination on whether it will provide records). For this study, GAO was asked, among other things, to determine trends in FOIA processing and agencies' progress in addressing backlogs of overdue FOIA requests since implementing their improvement plans. To do so, GAO analyzed 21 agencies' annual reports and additional statistics. Based on data reported by major agencies in annual FOIA reports from fiscal years 2002 to 2006, the numbers of FOIA requests received and processed continue to rise, but the rate of increase has flattened in recent years. The number of pending requests carried over from year to year has also increased, although the rate of increase has declined. The increase in pending requests is primarily due to increases in requests directed to the Department of Homeland Security (DHS). In particular, increases have occurred at DHS's Citizenship and Immigration Services, which accounted for about 89 percent of DHS's total pending requests. However, the rate of increase is slightly less than it was in fiscal year 2005. Following the emphasis on backlog reduction in Executive Order 13392 and agency improvement plans, many agencies have shown progress in decreasing their backlogs of overdue requests as of September 2007. In response to GAO's request, 16 agencies provided information on their recent progress in addressing backlogs; results showed that 9 achieved decreases, 5 experienced increases, and 2 had no material change. Notably, according to this information, DHS was able to decrease its backlog of overdue requests by 29,972, or about 29 percent. However, the statistics provided by the 16 agencies varied widely, representing both overdue cases and all pending cases, as well as varying time frames. Further, 3 of 21 agencies reviewed were unable to provide statistics supporting their backlog reduction efforts, and 1 provided statistics by component, which could not be aggregated to provide an agencywide result. (The remaining agency reported no backlog before or after implementing its plan.) Tracking and reporting numbers of overdue cases is not a requirement of the annual FOIA reports or of the Executive Order. Although both the Executive Order and Justice's implementing guidance put a major emphasis on backlog reduction, agencies were given... [ABSTRACT FROM AUTHOR]

The Millennium Challenge Corporation (MCC), now in its fourth year of operations, provides aid to developing countries that have demonstrated a commitment to ruling justly, encouraging economic freedom, and investing in people. MCC provides monetary assistance to eligible countries through multiyear compact agreements to fund specific programs targeted at reducing poverty and stimulating economic growth. MCC has received appropriations for fiscal years 2004 to 2008 totaling more than $7.5 billion, and has set aside about $6.4 billion of this amount for compact assistance. The President has requested an additional $2.225 billion for MCC for 2009, of which MCC plans to use $1.88 billion for compact assistance with countries currently eligible for compacts. MCC compact development is a four-phase process: (1) an eligible country submits a compact proposal; (2) MCC conducts a due diligence review of the proposed projects; (3) MCC and the country negotiate and sign the compact; (4) MCC and the country complete preparations, including developing disbursement plans, for the compact to enter into force. After the compact enters into force, compact implementation begins, and funds are obligated and disbursed. As of March 2008, MCC had selected 28 countries as eligible for compact assistance and had signed compacts with 16 of these countries. Eleven of these compacts have entered into force. Ten countries have not signed compacts and remain in the compact development process. We conducted this performance audit on the initiative of the Comptroller General. This report assesses (1) the current status and pace of compact development; (2) projected time frames for the commitment and obligation of MCC's existing (2004 to 2008) and requested (2009) appropriations; and (3) MCC's progress in disbursing compact assistance. The 10 countries without signed compacts are in the first or second phase of compact development. Since MCC made its first eligibility selections, the length of time required for compact development has increased substantially. For example, the first 11 countries to sign compacts completed compact development an average of 25 months after being selected as eligible. Assuming the next 5 signed compacts enter into force as MCC projects, the average length of compact development for all 16 countries with signed compacts will increase to 32 months. MCC attributed the slowing pace of compact development to several factors, such as the increased size of more recent compacts, and estimates that future compact development will take an average of 36 months. Assuming that MCC signs two additional compacts for $858 million by the end of 2008, as planned, and that compact development continues at the pace observed to date (32 months), we project that MCC could obligate the balance of its existing (2004 to 2008) appropriations by the end of 2009. Similarly, at the observed pace of compact development, and assuming MCC funds four compacts... [ABSTRACT FROM AUTHOR]

In an effort to increase the quality and security of federal identification (ID) practices, the President issued Homeland Security Presidential Directive 12 (HSPD-12) in August 2004. This directive requires the establishment of a governmentwide standard for secure and reliable forms of ID. GAO was asked to testify on its report, being released today, assessing the progress selected agencies have made in implementing HSPD-12. For this report, GAO selected eight agencies with a range of experience in implementing ID systems and analyzed actions these agencies had taken. GAO was also asked to summarize challenges in the DOD personnel security clearance process. This overview is based on past work including reviews of clearance-related documents. Military servicemembers, federal workers, and industry personnel must obtain security clearances to gain access to classified information. Long-standing delays in processing applications for these clearances led GAO to designate the Department of Defense's (DOD) program as a high-risk area in 2005. In its report on HSPD-12, GAO made recommendations to the Office of Management and Budget (OMB), to, among other things, set realistic milestones for implementing the electronic authentication capabilities. GAO has also made recommendations to OMB and DOD to improve the security clearance process. Much work had been accomplished to lay the foundations for implementation of HSPD-12--a major governmentwide undertaking. However, none of the eight agencies GAO reviewed--the Departments of Agriculture, Commerce, Homeland Security, Housing and Urban Development, the Interior, and Labor; the Nuclear Regulatory Commission; and the National Aeronautics and Space Administration--met OMB's goal of issuing ID cards by October 27, 2007, to all employees and contractor personnel who had been with the agency for 15 years or less. In addition, for the limited number of cards that had been issued, most agencies had not been using the electronic authentication capabilities on the cards and had not developed implementation plans for those capabilities. A key contributing factor for this limited progress is that OMB had emphasized issuance of the cards, rather than full use of the cards' capabilities. Furthermore, agencies anticipated having to make substantial financial investments to implement HSPD-12, since ID cards are considerably more expensive than traditional ID cards. However, OMB had not considered HSPD-12 implementation to be a major new investment and thus had not required agencies to prepare detailed plans regarding how, when, and the extent to which they would implement the electronic authentication mechanisms available through the cards. Until OMB revises its approach to focus on the full use of the capabilities of the new ID cards, HSPD-12's objectives of increasing the quality and security of ID and credentialing practices across the federal government may not be fully achieved. Regarding personnel... [ABSTRACT FROM AUTHOR]

The United Nations (UN) headquarters in New York City neither conforms to current building codes nor meets UN technology or security requirements. As the UN's host country and largest contributor, the United States has a substantial interest in the success of the Capital Master Plan (CMP), a project to renovate the complex. In this update, GAO reviewed the following key areas: renovation approach, schedule, cost, funding, risk management, project progress, procurement, and oversight. To perform this work, GAO reviewed UN documents and met with officials from the CMP office and other UN departments. To assess oversight and monitoring, GAO reviewed UN documents and oversight reports and interviewed UN officials from the Office of Internal Oversight Services (OIOS) and officials from the U.S. Department of State (State). The UN accelerated the CMP schedule by changing the renovation approach, which it reported would make up for past delays, reduce costs, and mitigate key risks. It will now renovate buildings in single phases, rather than in multiple phases as previously planned. Under the accelerated approach, the UN plans to begin construction of the temporary building in 2008 and start renovations in early 2009. Barring delays, the UN now intends to complete the project by mid-2013. Under the previous approach, the completion date had slipped to mid-2015. Delays in relocating UN staff could extend the schedule, creating additional costs. UN officials told us the CMP's Executive Director would make relocation decisions in spring 2008, with most moves following in early 2009. The CMP office currently estimates the total cost is $2.07 billion--$190 million over the $1.88 billion budget. The CMP office is looking for cost savings, but this effort may not be sufficient to bring estimated costs back to budget without potentially impacting the buildings' functionality. According to CMP officials, projected payments from member states will be enough to cover expenditures under the accelerated schedule. As of December 31, 2007, member states had paid $380.9 million, and $127.5 million in payments were late, including $64.2 million from the United States. The CMP office identified risks to the schedule and cost and developed strategies to mitigate them. For example, cost increases resulting from decision-making delays are a major risk the CMP office intends to mitigate by having the CMP Executive Director communicate proactively with key UN stakeholders. To mitigate weaknesses in UN procurement, the UN is piloting a streamlined process for approving CMP contract amendments in an effort to balance timely decision making with adherence to the procurement manual. The Procurement Division obtained authority to approve amendments up to $2.5 million--increased from $200,000--which can expedite the approval of such amendments by about 5 weeks, according to officials. While a subcontracting process has been developed, it does not include a... [ABSTRACT FROM AUTHOR]

Over the past several years, GAO has issued numerous reports and testimonies on internal control breakdowns in certain individual agencies' purchase card programs. In light of these findings, GAO was asked to analyze purchase card transactions governmentwide to (1) determine whether internal control weaknesses existed in the government purchase card program and (2) if so, identify examples of fraudulent, improper, and abusive activity. GAO used statistical sampling to systematically test internal controls and data mining procedures to identify fraudulent, improper, and abusive activity. GAO's work was not designed to determine the overall extent of fraudulent, improper, or abusive transactions. Internal control weaknesses in agency purchase card programs exposed the federal government to fraud, waste, abuse, and loss of assets. When testing internal controls, GAO asked agencies to provide documentation on selected transactions to prove that the purchase of goods or services had been properly authorized and that when the good or service was delivered, an individual other than the cardholder received and signed for it. Using a statistical sample of purchase card transactions from July 1, 2005, through June 30, 2006, GAO estimated that nearly 41 percent of the transactions failed to meet either of these basic internal control standards. Using a second sample of transactions over $2,500, GAO found a similar failure rate--agencies could not demonstrate that 48 percent of these large purchases met the standard of proper authorization, independent receipt and acceptance, or both. Breakdowns in internal controls, including authorization and independent receipt and acceptance, resulted in numerous examples of fraudulent, improper, and abusive purchase card use. These examples included instances where cardholders used purchase cards to subscribe to Internet dating services, buy video iPods for personal use, and pay for lavish dinners that included top-shelf liquor. GAO identified some of the case studies, including one case where a cardholder used the purchase card program to embezzle over $642,000 over a period of 6 years from the Department of Agriculture's Forest Service firefighting fund. This cardholder was sentenced to 21 months in prison and ordered to pay full restitution. In addition, agencies were unable to locate 458 items of 1,058 total accountable and pilferable items totaling over $2.7 million that GAO selected for testing. These missing items, which GAO considered to be lost or stolen, totaled over $1.8 million and included computer servers, laptop computers, iPods, and digital cameras. For example, the Department of the Army could not adequately account for 256 items making up 16 server configurations, each of which cost nearly $100,000. [ABSTRACT FROM AUTHOR]

The Department of Homeland Security (DHS) began operations in March 2003 with missions that include preventing terrorist attacks from occurring within the United States, reducing U.S. vulnerability to terrorism, minimizing damages from attacks that occur, and helping the nation recover from any attacks. GAO has reported that the implementation and transformation of DHS is an enormous management challenge. GAO's prior work on mergers and acquisitions found that successful transformations of large organizations, even those faced with less strenuous reorganizations than DHS, can take at least 5 to 7 years to achieve. This testimony addresses (1) the progress made by DHS in implementing its management functions; and (2) key issues that have affected the department's implementation efforts. This testimony is based on GAO's August 2007 report evaluating DHS's progress between March 2003 and July 2007; selected reports issued since July 2007; and GAO's institutional knowledge of homeland security and management issues. Within each of its management areas--acquisition, financial, human capital, information technology, and real property management--DHS has made some progress, but has also faced challenges. DHS has recognized the need to improve acquisition outcomes and taken some positive steps to organize and assess the acquisition function, but continues to lack clear accountability for the outcomes of acquisition dollars spent. The department also has not fully ensured proper oversight of its contractors providing services closely supporting inherently government functions. DHS has designated a Chief Financial Officer and taken actions to prepare corrective action plans for its internal control weaknesses. However, DHS has been unable to obtain an unqualified audit opinion of its financial statements, and for fiscal year 2007 the independent auditor identified significant deficiencies in DHS's internal control over financial reporting. DHS has taken actions to implement its human capital system by, for example, issuing a departmental training plan and human capital operational plan. Among other things, DHS still needs to implement a human capital system linked to its strategic plan, establish a market-based and more performance-oriented pay system, and seek more routine feedback from employees. DHS has taken actions to develop information technology management controls, such as developing an information technology human capital plan and developing policies to ensure the protection of sensitive information. However, DHS has not yet fully implemented a comprehensive information security program or a process to effectively manage information technology investments. DHS has developed an Asset Management Plan and established performance measures consistent with Federal Real Property standards. However, DHS has yet to demonstrate full implementation of its Asset Management Plan or full use of asset management inventory information. Various... [ABSTRACT FROM AUTHOR]

The Department of Defense (DOD) is simultaneously implementing a number of force realignments that contribute to personnel growth at military installations throughout the United States. DOD plans to execute over 800 actions from the 2005 Base Realignment and Closure (BRAC) round, which entail relocating over 123,000 personnel. Concurrent with its BRAC 2005 actions, DOD is also implementing or planning to implement other extensive worldwide transformation initiatives, which include relocating about 50,000 soldiers primarily from Europe and Korea to the United States; transforming the Army's force structure from an organization based on divisions to more rapidly deployable, brigade-based units (known as Army modularity); and increasing its active duty end strength by 92,000, all of which will affect DOD's facilities infrastructure. These force realignments will result in dramatic growth at some DOD installations across the United States. Based on data provided by the services, the DOD Office of Economic Adjustment (OEA) had identified, as of January 2008, 20 locations where expected growth as a result of force realignments in fiscal years 2006 through 2012 will adversely affect surrounding communities. The National Defense Authorization Act for Fiscal Year 2008 mandated that we assess the impact on military installations caused by an increase in assigned forces or civilian personnel as a result of the 2005 BRAC or other force realignments. Our specific objectives were to (1) determine whether military facility requirements (including quality-of-life projects) will be met before the arrival of assigned forces and (2) determine whether DOD has programmed sufficient funding to mitigate community traffic congestion in accordance with the Defense Access Roads (DAR) program. While DOD has made progress in initiating construction of military facilities to accommodate growth, it is too early to determine whether all required facilities will be constructed prior to arrival of assigned forces because contracts must still be let, the progress of construction may affect timelines for the arrival of forces, and the services are still requesting or expecting to request $6.4 billion in funding. At the 11 installations we reviewed, representing over 85 percent of expected population growth, the Army, Navy, and Marine Corps have received about $7.3 billion for fiscal years 2006 through 2008 for growth-related construction projects, which is approximately 54 percent of the total estimated funding requirement for growth related construction at those installations through 2011. As of March 2008, at the 11 installations we reviewed contracts have been awarded for approximately $4.1billion--about 56 percent of the available funds--and base officials plan to award contracts for most of the remaining funds in fiscal year 2008. The services have requested or plan to request just under $6.4 billion in funding to implement remaining growth: the services have... [ABSTRACT FROM AUTHOR]

On November 16, 2007, we issued our report on the U.S. Securities and Exchange Commission's (SEC) fiscal years 2007 and 2006 financial statements and on SEC's internal control as of September 30, 2007. We also reported on the results of our tests of SEC's compliance with selected provisions of laws and regulations during fiscal year 2007. The purpose of this report is to present areas of SEC's internal controls identified during our fiscal year 2007 audit that could be improved. This report contains 14 recommendations to SEC to improve these internal controls and procedures. These recommendations are in addition to those we already provided to SEC as a result of our prior audits of SEC's financial statements. Our November 16, 2007, report concluded that SEC had a material weakness in internal control over its financial reporting process, and therefore did not maintain effective internal control over financial reporting as of September 30, 2007. This weakness is comprised of four significant deficiencies, which taken collectively result in more than a remote likelihood that a material misstatement of the financial statements will not be prevented or detected. These significant deficiencies concern (1) the period-end financial reporting process, (2) disgorgements and penalties accounts receivable, (3) accounting for transaction fee revenue, and (4) preparing financial statement disclosures. In addition to the material weakness discussed above, we identified three significant deficiencies in internal control, which although not material weaknesses, represent significant deficiencies in the design or operation of internal control. These significant deficiencies concern (1) information security controls, (2) property and equipment, and (3) accounting for budgetary resources. As of January 2008, SEC had taken actions to fully address 3 of the 23 recommendations that remained open as of January 2007 from our audits of the agency's 2004, 2005, and 2006 financial statements. We also identified one other internal control weakness that although not considered to be a material weakness or significant deficiency, we believe warrants SEC management's consideration as to whether additional actions are warranted. This issue concerns certification of employees' time cards, documentation of monitoring of time card certification, and approval of personnel actions. In providing written comments on a draft of this report, the SEC Chairman expressed his commitment to remediate the control deficiencies this fiscal year and summarized SEC's corrective action plans to address GAO's recommendations. [ABSTRACT FROM AUTHOR]

The Department of Veterans Affairs (VA) and the Department of Defense (DOD) have a long history of partnering to achieve more cost-effective use of health care resources. Their partnerships have evolved to include joint ventures--joint efforts to construct or share medical facilities. VA has maintained eight joint ventures with DOD across the country. VA has also developed partnerships, or affiliations, with university medical schools to obtain health care services for veterans and provide training to medical residents. VA has not entered into a joint venture with an academic affiliate to date. However, several proposals for such joint ventures have surfaced in the last decade. This congressionally requested report discusses the (1) potential benefits and concerns associated with joint ventures and the extent to which they are documented and measured, (2) lessons learned from existing and proposed VA joint ventures, and (3) steps VA has taken to evaluate proposed joint ventures. To address these issues, GAO conducted site visits to and interviews with officials from all existing and proposed joint venture sites. VA and DOD officials identified a number of potential benefits and concerns associated with joint ventures, but they have not routinely or comprehensively documented and measured them. Among the potential benefits, VA and DOD officials and academic affiliate representatives cited improved access to care, lower or avoided costs, and improved training opportunities. While the identified benefits are many, these officials and representatives also cited a number of concerns associated with joint ventures, such as potential conflicts of missions and cultures, a loss of organizational identity and control, staffing uncertainties, and financial risks. Although able to provide anecdotal information of the benefits and concerns associated with joint ventures, officials at the joint ventures do not use performance measures to routinely or comprehensively document and assess the outcomes of the joint ventures. Without such efforts, it is difficult to know to what extent these benefits and concerns have materialized. VA also does not use performance measures at the department level to determine what is being achieved through the joint ventures--thereby making it difficult to determine the overall outcomes of the joint ventures and to hold joint venture partners accountable for results. Officials from VA and DOD and representatives from academic affiliates identified several lessons they have learned from their experiences with the existing and proposed joint ventures. These lessons include the importance of establishing joint committees to work through issues, communicating frequently with their partners, securing leadership buy-in and support at all levels, developing contingency plans, allowing adequate time to implement change, and establishing clear roles and responsibilities. For example, at most VA-DOD joint venture sites,... [ABSTRACT FROM AUTHOR]

The nation's long-term fiscal imbalances will likely make DOD's $1.6 trillion planned investment in new weapon systems unsustainable. Thus, it is critical that DOD retains the flexibility to end programs and contracts when necessary and appropriate. Although the federal government generally has the legal right to terminate contracts for convenience, defense stakeholders have sometimes expressed concerns that it will cost more to terminate a contract than to complete it. To address this perception, GAO examined (1) how expected contract termination costs and other factors affect DOD decisions on whether to end programs and contracts; (2) the circumstances under which it would cost more to terminate a contract for convenience than to complete it; and (3) the options DOD has for retaining value or reducing costs, when DOD ends programs or contracts. To do this, GAO examined DOD data on terminated contracts over $100 million; reviewed laws, regulations, and guidance; and met with key DOD officials. Contract termination costs were generally not a major factor in Department of Defense (DOD) decisions to end programs or contracts for the weapon systems GAO reviewed. GAO found that these program cancellations were driven by factors such as changes in warfighter need and budgetary constraints. In the contract termination decisions GAO reviewed, DOD considered termination costs, but they were generally not as significant as other factors, such as contract cost growth. For the contracts reviewed, GAO found that it did not cost more to terminate than to complete them. When the government terminates a contract for convenience, it must compensate the contractor for the incurred costs on the completed work, a fee or profit on that work, and the termination costs. Federal regulations place various limits on this compensation for both cost-reimbursement and fixed-price contracts. GAO found eight fully terminated contracts of weapon systems that were over $100 million in value, terminated after 1995, and for which data were available. Of these, none cost more to terminate than to complete. When a program or contract ends, DOD can retain some value from the work completed. For example, DOD can end the work immediately and transfer materials or technology to other efforts. Alternatively, DOD can modify the scope of a contract and complete a limited portion of the original work. GAO's review of DOD's past experience with terminations highlights important lessons for DOD in making decisions to cancel individual programs as well as in managing its broader investment portfolio. For example, when considering cancellation of individual programs, contract termination costs are generally not a compelling reason to continue programs or contracts that otherwise warrant ending. Moreover, while incurred or "sunk" costs in programs being considered for termination may be substantial, they must be paid regardless of whether or not a contract is terminated.... [ABSTRACT FROM AUTHOR]

Information security is especially important for federal agencies, where the public's trust is essential and poor information security can have devastating consequences. Since 1997, GAO has identified information security as a governmentwide high-risk issue in each of our biennial reports to Congress. Concerned by reports of significant weaknesses in federal computer systems, Congress passed the Federal Information Security Management Act (FISMA) of 2002, which permanently authorized and strengthened information security program, evaluation, and annual reporting requirements for federal agencies. GAO was asked to testify on the current state of federal information security and compliance with FISMA. This testimony summarizes (1) the status of agency performance of information security control activities as reported by major agencies and their inspectors general (IG), (2) the effectiveness of information security at federal agencies, and (3) opportunities to improve federal information security. In preparing for this testimony, GAO analyzed agency, IG, Office of Management and Budget (OMB), and GAO reports on information security and reviewed OMB FISMA reporting instructions, information technology security guidance, and information on reported security incidents. Over the past several years, 24 major federal agencies have consistently reported progress in performing information security control activities in their annual FISMA reports. For fiscal year 2007, the federal government continued to report improved information security performance relative to key performance metrics established by OMB. For example, an increasing percentage of systems governmentwide had been tested and evaluated, had tested contingency plans, and had been certified and accredited. However, IGs at several agencies sometimes disagreed with the agency reported information and identified weaknesses in the processes used to implement these and other security program activities. Despite agency reported progress, major federal agencies continue to experience significant information security control deficiencies that limit the effectiveness of their efforts to protect the confidentiality, integrity, and availability of their information and information systems. Most agencies did not implement controls to sufficiently prevent, limit, or detect access to computer networks, systems, or information. In addition, agencies did not always effectively manage the configuration of network devices to prevent unauthorized access and ensure system integrity, patch key servers and workstations in a timely manner, assign duties to different individuals or groups so that one individual did not control all aspects of a process or transaction, and maintain complete continuity of operations plans for key information systems. An underlying cause for these weaknesses is that agencies have not fully or effectively implemented agencywide information security programs. As a result,... [ABSTRACT FROM AUTHOR]

To help secure the nation's ports against a terrorist attack, federal regulations have required cargo and other maritime facilities to have security plans in place since July 2004. U.S Coast Guard (USCG) guidance calls for an annual inspection to ensure that plans are being followed. Federal law enacted in October 2006 required such facilities to be inspected two times a year--one of which is to be conducted unannounced. The USCG plans to conduct one announced inspection and the other as a less comprehensive unannounced "spot check." GAO examined the extent to which the USCG (1) has met inspection requirements and found facilities to be complying with their plans, (2) has determined the availability of trained personnel to meet current and future facility inspection requirements, and (3) has assessed the effectiveness of its facility inspection program and ensured that program compliance data collected and reported are reliable. GAO analyzed USCG compliance data, interviewed inspectors and other stakeholders in 7 of 35 USCG sectors of varying size, geographic location, and type of waterway. We could not determine the extent to which the USCG has met inspection requirements because its compliance database does not identify all regulated facilities to establish how many should have been inspected. While the USCG estimates there are about 3,200 facilities requiring inspection, their records indicate 2,126 annual inspections were conducted in 2006. Headquarters officials said field units reported that all required facility inspections were conducted. However, officials also said some inspections may not have been recorded, or were delayed by staff being diverted for natural disasters. The USCG identified deficiencies in about one-third of inspections, mainly for problems with access controls or missing documentation. Over 80 percent of deficiencies identified by the USCG were resolved by facility operators without the USCG applying formal enforcement actions. Although USCG officials believe they have enough trained inspectors to conduct current and future inspections, two additional factors could affect the USCG's estimates of the number of inspectors needed. First, facility inspectors balance security inspections with other competing duties, such as safety or pollution checks, and giving priority to security inspections could affect these other duties, inspectors said. Second, new guidance for spot checks calls for these checks to be more detailed--and perhaps more time-consuming--than some USCG units conducted in the past. For example, the guidance now requires an on-site visit, whereas some units had allowed the check to be a drive-by observation. The effect of the new guidance on resource requirements in these units is unknown. The USCG has not assessed the effectiveness of its facility inspection program. Headquarters guidance gives considerable discretion to local USCG units in deciding how to conduct facility inspections--for... [ABSTRACT FROM AUTHOR]

Improvised explosive devices (IED) have been and continue to be a significant threat to U.S. forces. The Department of Defense (DOD) expanded efforts to defeat IEDs with the establishment of the Joint Improvised Explosive Device Defeat Organization (JIEDDO) in January 2006. GAO was asked to review JIEDDO's management and operations. For this second report in its series, GAO determined (1) the extent to which JIEDDO's management processes provide adequate assurances that its financial information is accurate and provides transparency over its operations and (2) the extent to which JIEDDO identifies, records, tracks, and reports numbers of all personnel, including contractors. GAO analyzed data for the first half of fiscal year 2007, which included 47 funding transactions totaling $1.34 billion for 24 initiatives to address these objectives. JIEDDO's financial management processes do not provide adequate assurances that its financial information is accurate, and as a result, JIEDDO is unable to provide full transparency over the cost of its operations. While JIEDDO has improved its financial management processes, it has not yet reached a point where those processes contain an effective system of internal control. According to federal standards, internal control comprises the plans, methods, and procedures used to meet missions, goals, and objectives of an organization and help it to achieve desired results through effective stewardship of its resources. GAO identified four internal control weaknesses that affect JIEDDO's financial management processes. First, JIEDDO has not comprehensively documented its administrative policies and operating manuals, which affects the consistency of how its financial management personnel perform their duties. Second, JIEDDO does not have adequate funds authorization controls to ensure that transactions are properly authorized before funds are committed. In reviewing funding transactions totaling $795 million, 18 of 24 initiatives were not properly authorized in accordance with internal control standards. As a result, funds may be used without proper scrutiny and without a mechanism to detect, correct, or address this control failure. Third, JIEDDO does not have controls to ensure that transactions are properly categorized. For example, of the $1.34 billion in fiscal year 2007 commitments reviewed, JIEDDO inaccurately categorized at least 83 percent of these dollars under one category that should have been applied to others. This could distort information used in assessing trends and prioritizing funds. Fourth, JIEDDO does not have an adequate internal process to monitor and review the efficacy of its internal controls. In the absence of an adequate system of internal control, the agency may not achieve all of its objectives and its use of resources may not be consistent with DOD priorities. Furthermore, decision makers may be basing their decisions on inaccurate financial data and reports. At the... [ABSTRACT FROM AUTHOR]

The 2005 Base Closure and Realignment Commission estimated that two supply-related recommendations now being implemented by the Defense Logistics Agency (DLA) would save the Department of Defense (DOD) about $4.8 billion over 20 years--about 13 percent of the 2005 base realignment and closure (BRAC) round's estimated long-term savings. These recommendations focus on business process reengineering by reconfiguring DLA's wholesale supply, storage, and distribution network and transferring procurement responsibility for depot-level reparables from the military services to DLA. This report is one in a series of reports on BRAC conducted under the Comptroller General's authority. It examines (1) the extent to which DLA's cost and savings estimates to implement these recommendations differ from those of the BRAC Commission and (2) DLA's progress and challenges in implementing the recommendations. GAO analyzed estimated cost and savings data and visited several of the military services' depots in its review. Since the BRAC Commission issued its cost and savings estimates in 2005, DOD will spend more, save less, and take longer than expected to recoup up-front costs to implement two recommendations intended to improve DOD's logistics systems. Over the 2006-2011 BRAC time frame to implement these recommendations, GAO's analysis of DLA's data indicates that estimated net savings will be reduced by more than $1.8 billion compared to the BRAC Commission's estimate, with a net cost of about $222 million to DOD, because of increased estimated costs, decreased savings, and DLA's inclusion in the business plans of almost $243 million in expected savings that GAO believes should not be counted as BRAC savings. The $243 million in savings were to be achieved from inventory reduction initiatives that were not directly the result of BRAC actions and would have occurred regardless of BRAC. GAO's analysis further shows that the projected net annual recurring savings after 2011 have been reduced from nearly $360 million to almost $167 million, and that the savings over 20 years are expected to be $1.4 billion rather than $4.8 billion as estimated by the Commission. While some variances are to be expected, the magnitude of these variances is large and resulted from several factors, such as the use of inaccurate or outdated data, misinterpretation of terms, and changes in operational requirements that occurred during the decision-making process for formulating the recommendations. Because expected savings for the longer term are still large but subject to considerable variability, until net savings are tracked over time, decision makers will lack complete information to assess the financial performance of these recommendations. Although DLA has partially completed methodologies to accomplish this, they have yet to be implemented. While DLA has focused primarily on planning to date, it has identified several challenges as implementation proceeds that, if... [ABSTRACT FROM AUTHOR]

In December 2006, Congress passed the first comprehensive postal reform legislation in over 30 years. The Postal Accountability and Enhancement Act (the act) provided opportunities to address many of the financial, operational, and human capital challenges facing the Postal Service (the Service), which contributed to GAO's decision to remove the Service's transformation efforts from its High-Risk List last year. Specifically, the act provides tools and mechanisms that can be used to establish an efficient, flexible, fair, transparent, and financially sound Postal Service--one that can more effectively operate in an increasingly competitive environment not anticipated under the Postal Reorganization Act of 1970. This testimony focuses on (1) the actions to date resulting from implementing the act and how it affected the Service's 2007 financial condition, (2) the implementation challenges and areas for continued oversight, and (3) how information required under the law can contribute to future postal reform decisions. The testimony is based on GAO's past work; a review of the implementation of the postal reform law, including actions already taken; and updated information on the Service's financial and operational condition. The Postal Service had no comments on this testimony. Over the last 14 months, key actions have been taken to implement the act. For example, a new rate-setting system and regulatory agency were established, the Service began prefunding its retiree health benefit obligations, service standards were updated, and key reports were issued. These actions have required the collective efforts of many postal stakeholders including the Service and the Postal Regulatory Commission. The Service reported a $5.1 billion net loss for fiscal year 2007. Some of the actions taken to implement the act, such as funding changes to its retiree health benefit obligations and pension requirements, directly impacted these results, as did other events such as the January 2006 and May 2007 rate increases. The uncertain economic environment serves to exacerbate the challenges facing the Service and contributed to lower than expected mail volumes and revenues in the first quarter of fiscal year 2008. The Service projects a $600 million net loss for 2008 as it faces challenges such as generating volumes as rates increase again in May; managing its costs and improving operational efficiencies through accelerated cost reduction strategies; maintaining, measuring, and reporting service; and managing its workforce. Some key areas for continued oversight include changes to mail volumes and revenues, efforts to control costs by optimizing the Service's infrastructure and workforce, transition to new automation and technology to enhance mail sorting and tracking, transparency in measuring and reporting delivery performance, and implementation of the new rate-setting regulations. Information required under the act can be used to facilitate... [ABSTRACT FROM AUTHOR]

In fiscal year 2006, the Federal Employees' Compensation Act (FECA) program paid over $1.8 billion in wage loss compensation to federal employees who were unable to work after being injured on the job. Under the Comptroller General's authority to conduct evaluations on his own initiative, GAO examined (1) how effectively the Department of Labor's (Labor) Office of Workers' Compensation Programs (OWCP) manages the risk of improper FECA compensation payments; (2) what vulnerabilities to improper payments, if any, exist in OWCP's procedures for making FECA wage loss payments; and (3) how well OWCP ensures the recovery of identified FECA overpayments. To address these issues, GAO reviewed OWCP documents, analyzed data obtained from OWCP, reviewed a random and projectable sample of FECA claims files, visited five OWCP district offices, and interviewed OWCP headquarters and district officials. OWCP has not established an effective strategy for managing improper payments in the FECA program. The agency does not sufficiently emphasize preventing, detecting, and recovering improper payments. None of the performance goals for the program addresses improper payments. Further, OWCP does not collect the information it needs to accurately assess the FECA program's risk of improper payments, such as information on their magnitude and causes. Without such data, it cannot focus on the most vulnerable areas. The FECA program is vulnerable to improper payments for several reasons. First, OWCP relies on unverified, self-reported information from claimants that is not always timely or correct. From a review of a sample of claims files for overpayments identified by OWCP in 2006, GAO found that many occurred because claimants did not inform OWCP in a timely manner when they returned to work. Further, because OWCP generally does not require claimants' self-reported earnings to be verified and does not systemically match its data on FECA claimants with earnings data from other federal agencies, it may fail to identify cases of unreported earnings. An obstacle to conducting such matches, however, is that OWCP does not have the legal authority to access the database maintained by another federal agency with the most current earnings data. In addition, from GAO's file reviews, GAO found that both overpayments and underpayments were caused by OWCP errors and that many overpayments occurred when OWCP's payment-processing deadlines prevented payments from being quickly canceled when claimants returned to work or died. Finally, OWCP does not ensure that overpayments are collected in a timely manner and misses some opportunities for recovering overpayments, such as deducting them from claimants' subsequent FECA payments. [ABSTRACT FROM AUTHOR]

Since the 1998 near collapse of Long-Term Capital Management (LTCM), a large hedge fund--a pooled investment vehicle that is privately managed and often engages in active trading of various types of securities and commodity futures and options--the number of hedge funds has grown, and they have attracted investments from institutional investors such as pension plans. Hedge funds generally are recognized as important sources of liquidity and as holders and managers of risks in the capital markets. Although the market impacts of recent hedge fund near collapses were less severe than that of LTCM, they recalled concerns about risks associated with hedge funds and they highlighted the continuing relevance of questions raised over LTCM. This report (1) describes how federal financial regulators oversee hedge fund-related activities under their existing authorities; (2) examines what measures investors, creditors, and counterparties have taken to impose market discipline on hedge funds; and (3) explores the potential for systemic risk from hedge fund-related activities and describes actions regulators have taken to address this risk. In conducting this study, GAO reviewed regulators' policy documents and examinations and industry reports and interviewed regulatory and industry officials, and academics. Regulators only provided technical comments on a draft of this report, which GAO has incorporated into the report as appropriate. Under the existing regulatory structure, the Securities and Exchange Commission and Commodity Futures Trading Commission can provide direct oversight of registered hedge fund advisers, and along with federal bank regulators, they monitor hedge fund-related activities conducted at their regulated entities. Since LTCM's near collapse, regulators generally have increased reviews--by such means as targeted examinations--of systems and policies of their regulated entities to mitigate counterparty credit risks, including those involving hedge funds. Although some examinations found that banks generally have strengthened practices for managing risk exposures to hedge funds, regulators recommended that they enhance firmwide risk management systems and practices, including expanded stress testing. Regulated entities have the responsibility to practice prudent risk management standards, but prudent standards do not guarantee prudent practices. As such, it will be important for regulators to show continued vigilance in overseeing hedge fund-related activities. According to market participants, hedge fund advisers have improved disclosures and transparency about their operations since LTCM as a result of industry guidance issued and pressure from investors and creditors and counterparties (such as prime brokers). But market participants also suggested that not all investors have the capacity to analyze the information they receive from hedge funds. Regulators and market participants said that creditors and counterparties... [ABSTRACT FROM AUTHOR]

This is the second of two reports on the leveraging of federal funds in housing and community and economic development programs. Leveraging involves using a source of funds to attract other funds or combining multiple sources of funds. This report examines (1) the leverage measures and the transparency of the data and methods used to calculate them, and (2) the relevance of such measures in assessing performance that the Department of Housing and Urban Development (HUD) and the Department of the Treasury (Treasury) reported for six selected programs. To complete this work, GAO reviewed agency policies and reports, interviewed officials, and analyzed agency data. The leverage measures (such as ratios) HUD and Treasury reported for the selected programs in performance, budget, and other documents lacked transparency because the agencies generally did not disclose the limitations of the data or the methods used to calculate them. Based on its review of available leveraging data and interviews with HUD and Treasury officials, GAO found that the leverage measures the agencies reported for the selected programs were based on incomplete data and thus did not capture the actual extent of leveraging in the programs. GAO also found that while the agencies generally reported measures that described the ratio of all other funds (federal, state, local, and private funds) to program funds, alternative measures that described the total federal investment or total private investment in a program provided considerably different results--also potentially of value to decision makers--about the extent of leveraging in a program. GAO regularly has reported that clearly communicating data limitations and their potential impact may foster appropriate use of data; however, no agency-specific or governmentwide guidance directs what agencies should disclose about the leverage measures they report for the selected programs. Consequently, absent specific information on how these measures were calculated and their limitations, decision makers would not have sufficient information to understand their meaning and determine how they could and should be used in performance assessment, budgeting, and other contexts. Leverage measures can provide basic information about the programs GAO reviewed; however, their relevance in assessing the performance of these programs varies considerably. For all of the programs GAO reviewed, leverage measures can describe inputs, or the resources used to support program activities, and may be useful for conveying basic financial information. To the extent that leveraging is a goal or expected activity of a program (as in the three Treasury programs), leverage measures generally can describe program outputs, or the products or services delivered (such as total leveraged funds), and may be used along with other performance indicators to assess the efficiency and effectiveness of a program in meeting its goals. In cases where... [ABSTRACT FROM AUTHOR]

Information security is especially important for federal agencies, where the public's trust is essential and poor information security can have devastating consequences. Since 1997, GAO has identified information security as a governmentwide high-risk issue in each of its biennial reports to the Congress. Concerned by reports of significant weaknesses in federal computer systems, Congress passed the Federal Information Security Management Act (FISMA) of 2002, which permanently authorized and strengthened information security program, evaluation, and annual reporting requirements for federal agencies. GAO was asked to testify on the current state of federal information security and compliance with FISMA. This testimony summarizes (1) agency progress in performing key control activities, (2) the effectiveness of information security at federal agencies, and (3) opportunities to strengthen security. In preparing for this testimony, GAO reviewed prior audit reports; examined federal policies, guidance, and budgetary documentation; and analyzed agency and inspector general (IG) reports on information security. Over the past several years, federal agencies consistently reported progress in performing certain information security control activities. According to the President's proposed fiscal year 2009 budget for information technology, the federal government continued to improve information security performance in fiscal year 2007 relative to key performance metrics established by the Office of Management and Budget (OMB). The percentage of certified and accredited systems governmentwide reportedly increased from 88 percent to 92 percent. Gains were also reported in testing of security controls - from 88 percent of systems to 95 percent of systems - and for contingency plan testing - from 77 percent to 86 percent. These gains continue a historical trend that GAO reported on last year. Despite reported progress, major federal agencies continue to experience significant information security control deficiencies. Most agencies did not implement controls to sufficiently prevent, limit, or detect access to computer networks, systems, or information. In addition, agencies did not always manage the configuration of network devices to prevent unauthorized access and ensure system integrity, patch key servers and workstations in a timely manner, assign duties to different individuals or groups so that one individual did not control all aspects of a process or transaction, and maintain complete continuity of operations plans for key information systems. An underlying cause for these weaknesses is that agencies have not fully or effectively implemented agencywide information security programs. As a result, federal systems and information are at increased risk of unauthorized access to and disclosure, modification, or destruction of sensitive information, as well as inadvertent or deliberate disruption of system operations and services. Such... [ABSTRACT FROM AUTHOR]

On June 28, 2007, GAO testified before the Senate Subcommittee on Federal Financial Management, Government Information, Federal Services, and International Security, Committee on Homeland Security and Governmental Affairs, at a hearing entitled, "Financial Management Systems Modernization at the Department of Homeland Security: Are Missed Opportunities Costing Us Money?" At the hearing, we discussed the Department of Homeland Security's (DHS) failed efforts to implement the Electronically Managing Enterprise Resources for Government Effectiveness and Efficiency (eMerge2) program that was expected to integrate financial management systems across the entire department. Our testimony and related report focused on (1) DHS's financial management systems modernization efforts, (2) key financial management system transformation challenges, and (3) the four building blocks that form the foundation for successful financial management system implementation efforts. This letter responds to Congress's July 10, 2007, request for responses to follow-up questions relating to our June 28, 2007, testimony. The responses are based on work associated with previously issued GAO products. The consolidation of an entity as large and diverse as DHS poses significant management challenges, including integrating a myriad of redundant financial management systems and addressing existing and newly identified weaknesses in the inherited components. We have identified four key concepts that will be critical to DHS's ability to successfully complete the implementation of an integrated financial management system. The four concepts are (1) developing a concept of operations document, (2) defining standard business practices, (3) developing an implementation or migration strategy, and (4) defining and effectively implementing disciplined processes necessary to properly manage the specific projects. Expenditure plan reviews have proven to be an effective method of providing accountability for projects. While expenditure plans can provide valuable and useful information, additional types of information are needed to fully assess the effectiveness of the processes being used to manage a project. Further, given the importance of IT to DHS's mission performance and outcomes, it is vital for the department to adopt and employ an effective institutional approach to IT investment management. Regardless of the strategy DHS takes, sustained leadership will be key to a successful migration strategy for moving DHS toward a consolidated financial management system. Although DHS officials told us that they expect the requirements developed for eMerge2 to be salvageable and provide a foundation for its future efforts, our review found that key requirements developed for eMerge2 did not have attributes associated with good requirements developed using best practices. The attributes of good requirements include being correct, unambiguous, complete, consistent, ranked for order... [ABSTRACT FROM AUTHOR]

The Sentinel program is intended to replace and expand on the Federal Bureau of Investigation's (FBI) failed Virtual Case File (VCF) project and thereby meet the bureau's pressing need for a modern, automated capability to support its field agents and intelligence analysts' investigative case management and information sharing requirements. Because of the FBI's experience with VCF and the importance of Sentinel to the bureau's mission operations, GAO was asked to conduct a series of reviews on the FBI's management of Sentinel. This review focuses on the FBI's (1) use of effective practices for acquiring Sentinel and (2) basis for reliably estimating Sentinel's schedule and costs. To address its objectives, GAO researched relevant best practices, reviewed FBI policies and procedures, program plans and other program documents, and interviewed appropriate program officials. The FBI is managing its Sentinel program according to a number of key systems acquisition best practices. For example, the FBI has followed best practices when soliciting offers from contractors to lead the development of Sentinel; it has also followed the practices in evaluating the offers and making a contract award decision. In addition, it has established and is following effective processes to proactively identify and mitigate program risks before they have a chance to become actual cost, schedule, or performance problems. Further, it has taken a range of steps to effectively define expectations for its prime contractor and to measure performance against these expectations and related incentives and hold the contractor accountable for results. However, the bureau has not done the same for one key aspect of tracking and overseeing its program management support contractors. In particular, it has not established performance and product quality standards for these support contractors. According to FBI officials, such standards are not necessary because they monitor their support contractors on a daily basis, including the review and approval of all work products. By not implementing this practice, GAO believes that the FBI's monitoring does not adequately ensure that Sentinel support contractors are performing important program management functions effectively and efficiently. The FBI's policies, procedures, and supporting tools that form the basis for Sentinel's schedule and cost estimates do not adequately reflect key best practices. While the FBI has issued an information technology (IT) program management handbook, related guidance, and tools that define how IT program schedules and costs are to be estimated, this handbook and related material do not, for example, address such key practices as having a historical database of program schedule and cost estimates to inform future estimates. As a result, the reliability of Sentinel's schedule and cost estimates is questionable. GAO's analyses of the Sentinel cost estimates and program officials' statements... [ABSTRACT FROM AUTHOR]

Travel documents are often used fraudulently in attempts to enter the United States. The integrity of U.S. passports and visas depends on the combination of well-designed security features and solid issuance and inspection processes. GAO was asked to examine (1) the features of U.S. passports and visas and how information on the features is shared; (2) the integrity of the issuance process for these documents; and (3) how these documents are inspected at U.S. ports of entry. We reviewed documents such as studies, alerts, and training materials. We met with officials from the Departments of State, Homeland Security, and Commerce's National Institute of Standards and Technology, and U.S. Government Printing Office, and with officials at seven passport offices, nine U.S. ports of entry, two U.S. consulates in Mexico, and two Border Crossing Card production facilities. The Department of State (State) has developed passports and visas, including border crossing cards (BCC), that are more secure than older versions of these documents; however, older versions have been fraudulently used and remain more vulnerable to fraud during their lifespan. For example, earlier versions valid until 2011, of which there are more than 20 million in circulation, remain vulnerable to fraudulent alteration by such means as photo substitution. Although State has updated or changed the security features of its travel documents, State does not have a structured process to periodically reassess the effectiveness of the security features in its documents against evolving threats and to actively plan for new generations. State has taken a number of measures to ensure the security and quality of passports and visas, including establishing internal control standards and quality assurance measures, training of acceptance agents, and initiating new visa policies and procedures. However, additional measures are needed in the passport issuance process to minimize the risk of fraud. State lacks a program for oversight of the thousands of passport acceptance facilities that serve an important function in verifying the identity of millions of passport applicants each year. Officers in primary inspection--the first and most critical opportunity to identify fraudulent travel documents at U.S. ports of entry--are unable to take full advantage of the security features in passports and visas. These officers rely on both their observations of travelers and visual and manual examination of documents to detect fraudulent documents. However, the Department of Homeland Security (DHS) has not yet provided most ports of entry with the technology tools to read the new electronic passports and does not have a process in place for primary inspectors to utilize fingerprints collected for visas, including BCCs, at all land ports of entry. Moreover, DHS has provided little regular training to update its officers on the security features and fraud trends in passports and visas. [ABSTRACT FROM AUTHOR]

The Department of Defense (DOD) established a goal to achieve total asset visibility (TAV) over 30 years ago, but to date it has been unsuccessful. GAO was requested to (1) determine whether the Army has a systems strategy for achieving TAV, (2) determine if the Army's business system investment governance structure is consistent with DOD guidance, and (3) evaluate the Army's effort to correct previously reported problems with the Logistics Modernization Program (LMP). GAO obtained an understanding of the Army's efforts to achieve TAV, oversee and manage its business system investments, and address previously reported LMP problems. Supply chain management has been on GAO's high-risk list since 1990. One area that has contributed to this long-standing problem has been DOD's inability to maintain control and accountability over hundreds of billions of dollars of assets. DOD plans to improve its asset management through its business system modernization. In this regard, GFEBS, the Global Combat Support System-Army (GCSS-Army), and LMP are aimed at achieving TAV within the Army. The Army estimates that it will invest approximately $5 billion to develop and implement these systems. However, this investment is being made without a clear integrated strategy. GFEBS, GCSS-Army, and LMP are not being developed in the context of a well-defined Army-wide enterprise architecture. As a result, the Army does not have an informed basis for determining if these systems will fit within the context of future Army business operations and will efficiently and effectively address the Army's long-standing weaknesses associated with the lack of asset visibility. The Army lacks a concept of operations that would describe, at a high level, (1) how the three business systems relate to each other in achieving the Army's TAV goal, and (2) how information flows from and through these systems. Moreover, GAO found that the Army's lack of a concept of operations has contributed to its failure to take full advantage of business process reengineering opportunities that are available when using an enterprise resource planning solution. Without these key foundational elements, the Army is at risk of investing about $5 billion in business systems and still not achieving DOD's and the Army's goal of TAV. Furthermore, while the Army has established a governance structure that is consistent with DOD guidance, its processes are still maturing. The Army's governance structure is designed to certify and review individual business systems rather than to evaluate these investments from a portfolio perspective. Such a perspective permits investments to be viewed in a comprehensive manner to help ensure that the organization's missions and objectives are achieved. GAO also found that the Army did not have reliable processes and analyses, such as an independent validation and verification function or economic analyses, to support its oversight of individual business systems.... [ABSTRACT FROM AUTHOR]

Farmers receive about $20 billion annually in federal farm program payments, which go to individuals and "entities," including corporations, partnerships, and estates. Under certain conditions, estates may receive payments for the first 2 years after an individual's death. For later years, the U.S. Department of Agriculture (USDA) must determine that the estate is not being kept open primarily to receive farm program payments. This testimony is based on GAO's report, Federal Farm Programs: USDA Needs to Strengthen Controls to Prevent Improper Payments to Estates and Deceased Individuals (GAO-07-818, July 9, 2007). GAO discusses the extent to which USDA (1) follows its regulations that are intended to provide reasonable assurance that farm program payments go only to eligible estates and (2) makes improper payments to deceased individuals. USDA has made farm program payments to estates more than 2 years after recipients died, without determining, as its regulations require, whether the estates were kept open to receive these payments. As a result, USDA cannot be assured that farm payments are not going to estates kept open primarily to obtain these payments. From 1999 through 2005, USDA did not conduct any of the required eligibility determinations for 73, or 40 percent, of the 181 estates GAO reviewed. Sixteen of these 73 estates had each received more than $200,000 in farm payments, and 4 had each received more than $500,000. Only 39 of the 181 estates received all annual determinations as required. Even when FSA conducted determinations, we found shortcomings. For example, some USDA field offices approved groups of estates for payments without reviewing each estate individually or without a documented explanation for keeping the estate open. USDA also cannot be assured that it is not making improper payments to deceased individuals. For 1999 through 2005, USDA paid $1.1 billion in farm payments in the names of 172,801 deceased individuals (either as an individual recipient or as a member of an entity). Of this total, 40 percent went to those who had been dead for 3 or more years, and 19 percent to those dead for 7 or more years. Most of these payments were made to deceased individuals indirectly (i.e., as members of farming entities). For example, over one-half of the $1.1 billion in payments went through entities from 1999 through 2005. In one case, USDA paid a member of an entity--deceased since 1995--over $400,000 in payments for 1999 through 2005. USDA relies on a farming operation's self-certification that the information it provides USDA is accurate; operations are also required to notify USDA of any changes, such as the death of a member. Such notification would provide USDA with current information to determine the eligibility of the operation to receive payments. The complex nature of some farming operations--such as entities embedded within other entities--can make it difficult for USDA to avoid making payments to... [ABSTRACT FROM AUTHOR]

In December 2000, the Department of Energy (DOE) awarded Bechtel National, Inc. (Bechtel) a contract to design and construct the Waste Treatment Plant (WTP), one of the largest nuclear waste cleanup projects in the nation. Originally expected to cost $4.3 billion and be completed in 2011, DOE now estimates that WTP will cost over $12.2 billion and be completed in late 2019. Weaknesses in DOE's management and oversight of contractors led GAO to designate DOE contract management as a high-risk area since 1990. GAO was asked to determine whether (1) DOE's internal controls are designed to provide reasonable assurance against improper WTP payments and (2) DOE's controls reasonably ensure proper accountability for WTP assets. GAO reviewed fiscal year 2005 and 2006 internal controls by analyzing data and documents, interviewing DOE and contractor staff, and physically observing property items. DOE's internal controls over payments to contractors on its WTP project did not provide reasonable assurance against the risk of improper contractor payments, particularly given the project's substantial inherent risks. Several factors combined to pose a risk of improper payments on this project, including the size and complexity of this one-of-a-kind nuclear construction project, escalating cost and schedule estimates, and the thousands of charges Bechtel billed to DOE on each invoice. Despite the risks, in fiscal years 2005 and 2006 DOE performed little or no review of contractor invoices or supporting documents for the $40 million to $60 million in charges that Bechtel billed to DOE each month to help ensure the validity of these charges. Instead, DOE officials relied primarily on the Defense Contract Audit Agency's reviews of Bechtel's corporate-wide financial systems and on Bechtel's reviews of subcontractor charges for assurance that the charges were proper. DOE's heavy reliance on others, with little oversight of its own, exposed the hundreds of millions of dollars it spent annually on the project to an unnecessarily high risk of improper payments. DOE also did not adequately oversee the contractor to ensure accountability for assets purchased with WTP contract funds, relying primarily on the contractor to manage such government property without ensuring the adequacy of the contractor's controls. We found numerous internal control weaknesses with Bechtel's property management program, including poor segregation of duties, property system errors, and inadequate property procedures. For example, Bechtel did not timely prepare and submit required reports of lost or damaged property, taking up to 2 years in some instances to report missing assets, such as computers, to DOE. Bechtel also did not always review subcontractors' property management policies and procedures as required or follow up on subcontractor weaknesses it identified to help ensure that its subcontractors adequately managed and safeguarded WTP property in their possession.... [ABSTRACT FROM AUTHOR]

Farmers receive about $20 billion annually in federal farm program payments, which go to individuals and "entities," including corporations, partnerships, and estates. Under certain conditions, estates may receive payments for the first 2 years after an individual's death. For later years, the U.S. Department of Agriculture (USDA) must determine that the estate is not being kept open for payments. As requested, GAO evaluated the extent to which USDA (1) follows its regulations that are intended to provide reasonable assurance that farm program payments go only to eligible estates and (2) makes improper payments to deceased individuals. GAO reviewed a nonrandom sample of estates based, in part, on the amount of payments an estate received and compared USDA's databases that identify payment recipients with individuals the Social Security Administration listed as deceased. USDA has made farm payments to estates more than 2 years after recipients died, without determining, as its regulations require, whether the estates were kept open to receive these payments. As a result, USDA cannot be assured that farm payments are not going to estates kept open primarily to obtain these payments. From 1999 through 2005, USDA did not conduct any eligibility determinations for 73, or 40 percent, of the 181 estates GAO reviewed. Sixteen of these 73 estates had each received more than $200,000 in farm payments, and 4 had each received more than $500,000. Also, for the 108 reviews USDA did conduct, GAO identified shortcomings. For example, from 1999 through 2005, 69 of the 108 estates did not receive annual reviews for every year of payments received, and some USDA field offices approved groups of estates for payments without reviewing each estate. Furthermore, 20 estates that USDA approved for payment eligibility had no documented explanation for keeping the estate open. USDA cannot be assured that millions of dollars in farm payments are proper. It does not have management controls to verify that it is not making payments to deceased individuals. For 1999 through 2005, USDA paid $1.1 billion in farm payments in the names of 172,801 deceased individuals (either as an individual recipient or as a member of an entity). Of this total, 40 percent went to those who had been dead for 3 or more years, and 19 percent to those dead for 7 or more years. Most of these payments were made to deceased individuals indirectly (i.e., as members of farming entities). For example, over one-half of the $1.1 billion payments went through entities from 1999 through 2005. In one case, USDA paid a member of an entity--deceased since 1995--over $400,000 in payments for 1999 through 2005. USDA relies on the farming operation's self-certification that the information provided is accurate and that the operation will inform USDA of any changes, such as the death of a member. Such notification would provide USDA with current information to determine the eligibility of the entity... [ABSTRACT FROM AUTHOR]

Overseas deployments expose servicemembers to a number of potential risks to their health and well-being. However, since the mid-1990s, GAO has highlighted shortcomings with respect to the Department of Defense's (DOD) ability to assess the medical condition of servicemembers both before and after their deployments. Following GAO's May 1997 report, Congress enacted legislation (10 U.S.C. 1074f) that required the Secretary of Defense to establish a medical tracking system for assessing the medical condition of servicemembers before and after deployments. GAO was asked to determine (1) whether DOD has established a medical tracking system to comply with requirements of 10 U.S.C. 1074f pertaining to pre- and postdeployment medical examinations, and (2) the extent to which DOD has effectively implemented a deployment health quality assurance program as part of its medical tracking system. In conducting this review, GAO analyzed pertinent documents and interviewed DOD officials. DOD has established a system to comply with the requirements of 10 U.S.C. 1074f to perform predeployment and postdeployment medical examinations through a variety of deployment health activities. For example, DOD's system includes the use of pre- and postdeployment health assessment questionnaires along with reviews of servicemembers' medical records. The pre- and postdeployment health assessment questionnaires ask servicemembers to respond to a series of questions about their current medical and mental health conditions and any medical concerns they might have. Prior to deploying, the predeployment questionnaire and servicemembers' medical records are to be reviewed by a health care provider to confirm whether servicemembers have met applicable deployment health requirements. Also, prior to or after redeploying, the postdeployment questionnaires are to be reviewed by a health care provider, along with servicemembers' medical records, to determine whether additional clinical evaluation or treatment is needed. DOD has established a deployment health quality assurance program as part of its medical tracking system, but does not have a comprehensive oversight framework to help ensure effective implementation of the program. Thus, DOD does not have the information it needs to evaluate the effectiveness and efficiency of its deployment health quality assurance program. DOD policy specifies four elements of the program: (1) monthly reports on active and reserve component servicemembers' deployment health data from the Army Medical Surveillance Activity (AMSA), (2) quarterly reports on service-specific quality assurance programs, (3) DOD site visits to military installations, and (4) an annual report on the program. DOD guidance requires each of the services to create their own quality assurance programs based on these elements. However, GAO found weaknesses in each of these elements. For example, DOD's policy does not contain specific reporting requirements or... [ABSTRACT FROM AUTHOR]

Given a large-scale organizational change initiative, such as the Department of Defense's (DOD) National Security Personnel System (NSPS), is a substantial commitment that will take years to complete, it is important that DOD and Congress be kept informed of the full cost of implementing NSPS. Under the Comptroller General's authority to conduct evaluations on his own initiative, GAO analyzed the extent to which DOD has (1) fully estimated total costs associated with the implementation of NSPS and (2) expended or obligated funds to design and implement NSPS through fiscal year 2006. GAO interviewed department officials and analyzed the NSPS Program Executive Office's (PEO), and the military services' and the Washington Headquarters Services' (hereafter referred to as the components) cost estimates and reports of expended and obligated funds. DOD's November 2005 estimate that it will cost $158 million to implement NSPS does not include the full cost that the department expects to incur as a result of implementing the new system. Federal financial accounting standards state that reliable information on the costs of federal programs and activities is crucial for effective management of government operations and recommend that full costs of programs and their outputs be provided to assist Congress and executives in making informed decisions on program resources and to ensure that programs get expected and efficient results. The full cost includes both those costs specifically identifiable to carry out the program, or direct costs, and those costs that are common to multiple programs but cannot be specifically identified with any particular program, or indirect costs. While the standards emphasize that full cost information is essential for managing federal programs, their activities, and outputs, the standards also provide that items may be omitted from cost information if that omission would not change or influence the judgment of a reasonable person relying on the cost information. Based on GAO's review of documentation provided by DOD and discussions with department officials, GAO found that DOD's estimate includes some direct costs, such as the start-up and operation of the NSPS PEO and the development and delivery of new NSPS training courses, but it does not include other direct costs such as the full salary costs of all civilian and military personnel who directly support NSPS activities departmentwide. Before developing its estimate, DOD had not fully defined all the direct and indirect costs needed to manage the program. Without a better estimate, decision makers--within DOD and Congress--will not have complete information about whether adequate resources are being provided for implementing NSPS. The total amount of funds DOD has expended or obligated to design and implement NSPS during fiscal years 2005 through 2006 cannot be determined because DOD has not established an oversight mechanism to ensure that these costs are... [ABSTRACT FROM AUTHOR]

The Federal Motor Carrier Safety Administration (FMCSA) has the primary federal responsibility for reducing crashes involving large trucks and buses. FMCSA uses its "SafeStat" tool to select carriers for reviews for compliance with its safety regulations based on the carriers' crash rates and prior safety violations. FMCSA then conducts these compliance reviews and can place carriers out of service if they are found to be operating unsafely. This statement is based on a recent report (GAO-07-585) and other nearly completed work. GAO assessed (1) the extent to which FMCSA identifies carriers that subsequently have high crash rates, (2) how FMCSA ensures that its compliance reviews are conducted thoroughly and consistently, and (3) the extent to which FMCSA follows up with carriers with serious safety violations. GAO's work was based on a review of laws, program guidance, and analyses of data from 2004 through early 2006. FMCSA generally does a good job in identifying carriers that pose high crash risks for subsequent compliance reviews, ensuring the thoroughness and consistency of those reviews, and following up with high-risk carriers. SafeStat is nearly twice as effective (83 percent) as random selection in identifying carriers that pose high crash risks. However, its effectiveness could be improved by using a statistical approach (negative binomial regression), which provides for a systematic assessment to apply weights to the four SafeStat safety evaluation areas (accidents and driver, vehicle, and safety management violations) rather than FMCSA's approach, which relies on expert judgment. The regression approach identified carriers that had twice as many crashes in the subsequent 18 months as did the carriers identified by the current SafeStat approach. FMCSA is concerned that adopting this approach would result in it placing more emphasis on crashes and less emphasis on compliance with its safety management, vehicle, and driver regulations. GAO believes that because (1) the ultimate purpose of compliance reviews is to reduce the number and severity of truck and bus crashes and (2) GAO's and others' research has shown that crash rates are stronger predictors of future crashes than is poor compliance with FMCSA's safety regulations, the regression approach would improve safety. GAO's preliminary assessment is that FMCSA promotes thoroughness and consistency in its compliance reviews through its management processes, which meet GAO's standards for internal controls. For example, FMCSA uses an electronic manual to record and communicate its compliance review policies and procedures and teaches proper compliance review procedures through both classroom and on-the-job training. Furthermore, investigators use an information system to document their compliance reviews, and managers review these data, helping to ensure thoroughness and consistency between investigators. For the most part, FMCSA and state investigators cover the nine... [ABSTRACT FROM AUTHOR]

According to the Air Force, the Kaiserslautern Military Community Center (KMCC), an over 800,000 square-foot facility, is currently the Department of Defense's largest single-facility project under construction. It is intended to provide lodging, dining, shopping, and entertainment for thousands of U.S. military and civilian personnel and their families in the Kaiserslautern, Germany, area. Initial costs for the KMCC were estimated at about $150 million, with funding coming from a variety of appropriated and nonappropriated fund sources. The construction for the project, which began in late 2003, was originally scheduled to be completed in early 2006. This testimony discusses GAO findings to date related to the KMCC. The testimony describes (1) current problems facing the KMCC, (2) causes for identified problems, and (3) the effect of problems identified and their implications for future projects in Germany. To address our objectives, we interviewed officials from the U.S. Air Force, Army and Air Force Exchange Service, U.S. Army Corps of Engineers, and German government. We also conducted a site visit and reviewed relevant KMCC documents. We plan to continue our work and make recommendations to the Air Force as appropriate. The KMCC project has encountered cost, schedule, and performance problems. Currently neither Landesbetrieb Liegenschafts- und baubetreuung's office in Kaiserslautern (LBB-Kaiserslautern), the German government construction agency in charge of the project, nor the Air Force have a reliable estimated completion date or final cost for the project. Problems facing KMCC include construction flaws, vandalism of property, repeated work stoppages and slowdowns by contractors, and ongoing criminal investigations. Because of financial problems facing the project, the number of workers on-site has dwindled from several hundred to less than 50, which will likely further delay completion of the project. In addition, the KMCC's multimillion dollar "green" roof is experiencing water leaks, and will likely require the Air Force to spend millions of dollars for its replacement. The KMCC faced a high level of risk from its inception, which was not effectively mitigated by the Air Force. Increased risks included an overseas project controlled by LBB-Kaiserslautern with financial risks borne by the Air Force and its funding partners. Unfortunately, LBB-Kaiserslautern did not effectively manage the design and construction of the project. Rather than increase controls to mitigate project risks, the Air Force provided minimal oversight and in some cases circumvented controls to expedite the invoice payment process in an attempt to complete the project. Because this project is funded primarily with nonappropriated funds, the likely substantial cost increases in the project will be borne by military servicemembers, civilians and their families. Further, absent better Air Force controls, future projects may experience the same types... [ABSTRACT FROM AUTHOR]

In recent years GAO and others have reported on problems in the financial management environment at the Department of Homeland Security's (DHS) Science and Technology Directorate (S&T). S&T was established by the Homeland Security Act of 2002 to, among other things, coordinate the federal government's civilian efforts to identify and develop countermeasures to emerging terrorist threats to our nation. As DHS's primary research and development arm, the directorate is tasked with providing federal, state, local, and tribal officials with state-of-the-art technology and other resources, such as protocols and training procedures for use in responding to, and recovery from, chemical, biological, radiological, nuclear, and explosive attacks. S&T is led by an Under Secretary and has a Chief Financial Officer (CFO) who is responsible for all budgeting and accounting for financial resources. S&T receives funds for research, development, acquisition, and operations. It also receives funds for management and administration that support the operations of the directorate in both headquarters and the field, such as the expenditures for personnel compensation and benefits, travel, and rent. The Department of Homeland Security Appropriations Act, 2007 (Appropriations Act) provided about $973 million for S&T, of which about $838 million (about 86 percent) was for research, development, acquisition, and operations, and $135 million (about 14 percent) was for salaries and expenses of the Office of the Under Secretary and for management and administration of programs and activities. The Appropriations Act restricted S&T from obligating $60 million (about 44 percent) of the $135 million until the Secretary of Homeland Security prepared a fiscal year 2007 expenditure plan that was to be received and approved by the Committees on Appropriations of the Senate and House of Representatives that (1) was broken down by program, project, and activity (PPA), (2) contained a detailed breakdown and justification of the management and administrative costs for each PPA, and (3) described the method utilized to develop the budget for administration costs in the budget requests for fiscal years 2006 and 2007. The Appropriations Act also required GAO to review the plan. In responding to this mandate, we assessed whether S&T's fiscal year 2007 expenditure plan satisfied the above conditions of the Appropriations Act. In April 2007, we briefed Congress on the preliminary results of our work. On May 9, 2007, Congress released the $60 million management and administration funding that had been restricted by the act. The S&T fiscal year 2007 expenditure plan, including related documentation and other information provided by S&T program officials, did not fully satisfy the conditions set forth in the Appropriations Act. Prior to the obligation of the $60 million, the Appropriations Act required S&T to provide an expenditure plan by PPA, as well as a detailed breakdown and... [ABSTRACT FROM AUTHOR]

The Department of Homeland Security (DHS), the third largest department in federal procurement spending in fiscal year 2006, has faced ongoing cost, schedule, and performance problems with major acquisitions and procurement of services. In December 2005, DHS established an acquisition oversight program to provide insight into and improve components' acquisition programs. In 2006, GAO reported that DHS faced challenges in implementing its program. Congress mandated that DHS develop an oversight plan and tasked GAO with analyzing the plan. GAO (1) evaluated actions DHS and its components have taken to implement the acquisition oversight plan and (2) identified implementation challenges. GAO also identified opportunities for strengthening oversight conducted through the plan. GAO reviewed relevant DHS documents and GAO and DHS Inspector General reports and interviewed officials in the office of the Chief Procurement Officer (CPO) and nine DHS components. The CPO has taken several actions to implement DHS's acquisition oversight plan--which generally incorporates basic principles of an effective and accountable acquisition function. The plan monitors acquisition performance through four recurring reviews: self-assessment, operational status, on-site, and acquisition planning. Each component has completed the first self-assessment, which has helped components identify and prioritize acquisition weaknesses. In addition, each component has submitted an initial operational status report to the CPO and on-site reviews are being conducted. Despite this progress, the acquisition planning reviews are not sufficient to determine if components adequately plan their acquisitions--in part because a required review has not been implemented and the CPO lacks visibility into components' planning activities. DHS faces two key challenges in implementing its acquisition oversight plan. First, the CPO has had limited oversight resources to implement plan reviews. However, recent increases in staff have begun to address this challenge. Second, the CPO lacks sufficient authority to ensure components comply with the plan--despite being held accountable for departmentwide management and oversight of the acquisition function. GAO has previously recommended that DHS provide the CPO with sufficient enforcement authority to enable effective acquisition oversight. In addition to these challenges, GAO identified two opportunities to strengthen internal controls for overseeing the plan's implementation and for increasing knowledge sharing. Specifically, independent evaluations of DHS's oversight program could help ensure that the plan maintains its effectiveness over time. Sharing knowledge and lessons learned could provide DHS's acquisition workforce with the information needed to improve their acquisition processes and better achieve DHS's mission. [ABSTRACT FROM AUTHOR]