FEMA uses the National Preparedness System to help assess the nation's emergency management capabilities in preparing for disasters and, in part, to help prioritize federal preparedness grants it provides to state and local jurisdictions. Since 2002, FEMA has provided over $52 billion in such grants intended to enhance preparedness capabilities. GAO was asked to examine national preparedness. This report examines the extent to which: (1) FEMA's National Preparedness System and associated preparedness grants have assisted jurisdictions in preparing for disasters; (2) FEMA has strengthened the National Preparedness System and what steps remain; and (3) FEMA is using after-action reports to identify lessons learned and strengthen future preparedness. GAO evaluated agency guidance, analyzed 2013 to 2017 capability data—the most current available; conducted site visits to five states; and interviewed FEMA, state, and local emergency management officials. The Federal Emergency Management Agency's (FEMA) National Preparedness System and associated grants have helped build some emergency management capabilities, but gaps remain. Capabilities fall in five mission areas: (1) prevention—preventing imminent acts of terrorism, (2) protection—protecting citizens and assets, (3) mitigation—mitigating the loss of life and property, (4) response—responding quickly to save lives, and (5) recovery—timely restoration of infrastructure and housing, among other things. From fiscal years 2013 through 2018, jurisdictions directed almost 90 percent of FEMA preparedness grants ($7.3 of $8.3 billion) to capabilities in the crosscutting (i.e., benefit all five mission areas), response, and prevention areas (figure below). Jurisdictions reported a higher level of preparedness in these areas compared to capabilities in the other mission areas—recovery, mitigation, and protection. Jurisdictions have consistently rated select capabilities in these three mission areas—such as disaster housing and cybersecurity—in the lowest category since 2013. FEMA does not limit jurisdictions' use of preparedness grants for select capabilities, but it has encouraged jurisdictions to address the known gaps. FEMA is taking steps to strengthen the national preparedness system, but has yet to determine what steps are needed to address the nation's capability gaps across all levels of government. Specifically, FEMA is implementing a new methodology to collect more quantitative data on capabilities at the state, territory, and local levels—as GAO recommended in 2011—and also plans to begin assessing the federal government's capabilities. Including the federal government in such an assessment would enable FEMA and jurisdictions to assess national preparedness capabilities collectively. While these are positive steps that could meet the intent of the 2011 recommendation, FEMA has yet to determine what steps are needed to address the capability gaps once they are identified, including jurisdictions' capability gaps that have been known since 2012. By determining these steps and informing key stakeholders, such as Congress, about what resources will be needed across all levels of government, FEMA will be better positioned to address the nation's capability gaps. FEMA after-action reports have identified areas for improvement and lessons learned following disasters, but has completed after-action reviews for only 29 percent of disasters from 2017 through 2019. FEMA lacks a formal mechanism to track corrective actions and does not have guidance on sharing after-action reports with key external stakeholders, as appropriate.


FFRDCs provide federal agencies with research and development functions, technical systems engineering capabilities, and policy development and decision-making studies, among other services. The Federal Acquisition Regulation states that FFRDCs have a special relationship with DOD, which can give FFRDCs access to sensitive data beyond what would commonly be shared with contractors. The National Defense Authorization Act for Fiscal Year 2017 directed DOD to establish a 3-year pilot program that allows FFRDCs streamlined access to sensitive data maintained by DOD. It also included a provision for GAO to report on the pilot program within 2 years of implementation. This report addresses the extent to which (1) FFRDCs are using the pilot program, (2) DOD put procedures in place to protect data accessed, and (3) DOD is evaluating the pilot program. GAO reviewed DOD guidance and FFRDC processes, pilot reports for January 2018 through September 2019, and DOD's plans and efforts for evaluating the pilot program. GAO also selected a nongeneralizable sample of six projects—at least one from each FFRDC with an enrolled project as of December 2018—for further review. In addition, GAO assessed the pilot program against leading practices for pilot design. The Department of Defense (DOD) launched a 3-year pilot program in December 2017 to enable a streamlined process to share certain sensitive data, such as data collected from its contractors, with its Federally Funded Research and Development Centers (FFRDC). At times, FFRDCs need to access such data to support DOD. The pilot was intended to reduce the burden on FFRDCs to seek permission from hundreds of contractors to access information needed for their research. Six of DOD's 10 FFRDCs have taken part in the pilot, enrolling a combined total of 33 projects, as shown in the table. DOD officials and FFRDC representatives reported that the streamlined process made the use of sensitive data feasible. As a result, FFRDCs with completed projects in GAO's sample indicated they were able to provide more robust analyses or insights to DOD. DOD guidance for the pilot program established procedures to protect sensitive data. But GAO found that DOD did not incorporate all of the details of the required protections into its agreements with FFRDCs. Further, GAO found that not all FFRDCs were performing annual certification of financial disclosure forms, as required by its agreements with DOD. DOD does not have a process to ensure that all the protections pertaining to FFRDCs' streamlined access to sensitive data are being followed. Without a process that defines roles and responsibilities, DOD cannot ensure that FFRDCs adhere to the protections. DOD developed goals for the pilot program and outlined what information was to be obtained for each participating project, actions that are consistent with GAO's leading practices for pilot design. However, DOD has not developed a plan for evaluating the program nor has it consistently collected information on about a third of the pilot projects. Leading practices for pilot design call for an evaluation plan, which should include an assessment methodology and identify responsibilities as to how the evaluation will be conducted. Without an evaluation plan and a mechanism to collect information on pilot projects, DOD will not be positioned to identify the effectiveness of the pilot program and benefit from lessons learned. Such information will be useful as Congress considers the path forward after the pilot ends in December 2020.


FHA insures hundreds of thousands of single-family home mortgages annually. When an FHA borrower defaults, the mortgage servicer in many cases forecloses, obtains title to the property, and conveys ownership to FHA. FHA inspects the property, acquires it if it complies with condition standards and title requirements, and lists the property for sale. FHA may reconvey noncompliant properties to servicers. During conveyance, homes may sit vacant for months and can deteriorate, contributing to neighborhood blight. Senate Report 114-243 included a provision for GAO to review FHA's effectiveness and efficiency in reaching determinations of conveyable condition. This report discusses (1) timelines for FHA property conveyances in 2010–2017 and whether servicers and FHA met time requirements, and (2) changes FHA has made to the conveyance process in recent years and any ongoing process challenges. GAO analyzed FHA data on properties conveyed in 2010–2017, reviewed FHA's policies and procedures, and interviewed 20 randomly selected mortgage servicers accounting for more than one-third of active FHA mortgages. From July 2010 through December 2017, the process for conveying foreclosed properties to the Federal Housing Administration (FHA) took a median of 70 days. The conveyance process—which GAO measured from a mortgage servicer's obtaining title to and possession of the property to FHA's marketing of the property—involves servicers making repairs, transferring ownership, and filing a mortgage insurance claim, and FHA inspecting the property. FHA attributes the length of time to complete the process partly to foreclosure processing delays that left properties vulnerable to damage and vandalism, which can increase the time servicers need to bring properties into conveyance condition. Property damage also may increase the likelihood that FHA will reconvey a property (transfer it to the servicer) for not complying with condition standards, further extending the conveyance process. For about 55 percent of properties conveyed in July 2010–December 2017, servicers exceeded the required time to obtain title and possession of a foreclosed property and convey it to FHA. For 2017 alone, the corresponding figure was 72 percent. As a result, servicers were not eligible to be reimbursed for all repairs and interest expenses for those properties when filing insurance claims with FHA. In recent years, FHA changed aspects of its conveyance process to help address some of the execution challenges the agency and servicers have faced. For example, in 2016, FHA enhanced its data system for conveyed properties to reduce manual administrative processing. FHA also began a pilot program in 2017 to decrease the number of properties FHA reconveys by inspecting properties before conveyance. However, GAO found shortcomings in FHA policies, procedures, and assessment efforts that are inconsistent with federal evaluation criteria and internal control standards, as follows: FHA's policies and procedures lack detail that could help servicers and contractors determine if a property is in compliance, and the agency has not examined alternative methods of communicating this information. Fifteen of the 20 servicers GAO interviewed said existing policies, procedures, and communications often were not clear or specific enough to address property conditions or repair decisions they encountered. FHA also relies on brief written policies to explain standards and makes limited or no use of other methods, such as photographs or industry-wide calls. FHA has not provided written direction on when to use alternatives to reconveyance—such as agreements under which servicers make repairs or repay FHA for any repair costs after conveyance—for properties not meeting condition standards. In the absence of such direction, FHA may not be addressing these properties in the most consistent or effective manner. FHA has not developed a plan to assess the outcome of its inspection pilot. Without rigorous assessment, FHA risks making decisions about the future of the pilot based on inaccurate or incomplete information. Addressing these shortcomings could help improve the efficiency and effectiveness of FHA's property conveyance process.


According to DOD, from fiscal years 2014 through 2019, it used ACSAs to provide billions of dollars of logistic support, supplies, and services to more than 100 partner countries. For example, this support included fuel and ammunition to assist international exercises and coalition operations, among other efforts. Senate Report 115-262 included a provision for GAO to review ACSA management. This report examines the extent to which (1) agencies have provided information to Congress about ACSAs, and (2) DOD has tracked and received reimbursement for ACSA orders. GAO conducted content analysis of DOD and State ACSA documents, and analyzed a generalizable sample of ACSA orders authorized from October 2013 through March 2018 and recorded in DOD's system of record for ACSA orders. An ACSA order, also referred to as a transaction, documents an exchange of support between the United States and a foreign partner. In addition, GAO interviewed agency officials and conducted fieldwork at Shaw Air Force Base in Sumter, South Carolina. While generally providing required information to Congress, poor recordkeeping by the Department of Defense (DOD) and late notifications by the Department of State (State) have limited the accuracy and timeliness of information provided to Congress on acquisition and cross-servicing agreements (ACSA). DOD and State have Congressional notification requirements pertaining to ACSAs—agreements through which DOD exchanges logistic support, supplies, and services with foreign partners in return for cash or in-kind reimbursement. Documents indicate that DOD provided notice to Congress before designating 78 of 104 countries eligible for an ACSA. However, DOD did not have records for the remaining 26, in part because it lacks documented recordkeeping procedures. While State generally notified Congress about ACSAs' entry into force, it transmitted 41 percent of them after the statutory deadline, largely because DOD did not provide required information to State. These gaps and issues have reduced the accuracy and timeliness of information provided to Congress about ACSAs. DOD has not maintained quality data to track ACSA orders and has not received reimbursement for thousands of orders. First, DOD does not have complete and accurate ACSA data. For example, for an estimated 12 percent of ACSA orders authorized from October 2013 through March 2018 in DOD's system of record, DOD could not determine whether it had received reimbursement for support provided to partners. According to DOD officials, such inaccuracies occur in part because DOD does not have a process to validate data in its system. Second, GAO estimates that DOD received full reimbursement for 64 percent of ACSA orders authorized from October 2013 through March 2018 (about 6,000 orders), but did not receive full reimbursement for 24 percent. Orders remain unpaid in part because DOD has not requested timely repayment or monitored reimbursement. These management weaknesses limit DOD's ability to obtain reimbursement for overdue ACSA orders, which, according to DOD, were valued at more than $1 billion as of November 2019. Note: These estimates are based on a generalizable sample of orders in which the United States provided support to foreign partners; have a margin of error of up to plus or minus 5.1 percentage points at the 95-percent confidence level; and represent the percentage of the number of orders, not the dollar value of orders.


FOIA requires federal agencies to provide the public with access to government records and information based on the principles of openness and accountability in government. Each year, individuals and entities file hundreds of thousands of FOIA requests. DHS continues to receive and process the largest number of FOIA requests of any federal department or agency. For fiscal year 2018, over 40 percent of federal FOIA requests (about 396,000) belonged to DHS. GAO was asked to summarize its November 2014 and June 2018 reports which addressed, among other things, (1) DHS's methods to reduce backlogged FOIA requests and (2) duplication in DHS's processing of FOIA requests. In conducting this prior work, GAO evaluated the department's and components' FOIA policies, procedures, reports, and other documentation; and interviewed agency officials. GAO also followed up on its recommendations to determine their implementation status. The Department of Homeland Security's (DHS) responsibilities for processing Freedom of Information Act (FOIA) requests are split between the department's Privacy Office, which acts as its central FOIA office, and FOIA offices in the department's component agencies, such as U.S. Citizenship and Immigration Services and Immigration and Customs Enforcement. In 2018, GAO reported that DHS had implemented several methods to reduce backlogged FOIA requests, including sending monthly emails to its components on backlog statistics and conducting oversight. In addition, several DHS components, implemented actions to reduce their backlogs. Due to efforts by the department, the backlog dropped 66 percent in fiscal year 2015, decreasing to 35,374 requests. Although there was initial progress by the end of fiscal year 2015, the number of backlogged requests increased in fiscal years 2016 and 2018 (see figure). One reason DHS was struggling to consistently reduce its backlogs is that it lacked documented, comprehensive plans that would provide a more reliable, sustainable approach to addressing backlogs and describe how it will implement best practices for reducing backlogs over time. DHS attributed the increase in its FOIA backlogs to several factors, including the increased numbers and complexity of requests received and the volume of responsive records for those requests. Until it develops a plan to implement best practices to reduce its backlogs, DHS will likely continue to struggle to reduce the backlogs to a manageable level. In addition, in 2014 GAO reported that certain immigration-related requests were processed twice by two different DHS components. The duplicate processing of such requests by the two components contributed to an increase in the time needed to respond to the requests. GAO continued to report this issue in its 2019 annual product on opportunities to reduce fragmentation, overlap, and duplication.


FPS conducts physical security and law enforcement activities for about 9,000 federal facilities and the millions of employees or visitors who work in or visit these facilities. Legislation enacted in November 2018 required DHS to determine the appropriate placement for FPS. The legislation also gave the Secretary of DHS authority to move FPS within DHS. In May 2019, DHS announced its decision to place FPS within the DHS Management Directorate as a direct report to the Under Secretary for Management. GAO has reported that FPS faces persistent challenges in meeting its mission to protect facilities, and, as of 2019, physical security continues to be part of GAO's federal real property management high-risk area. For example, FPS has not yet fully implemented its guard management system. Thus, FPS is unable to obtain information to assess its guards' capability to address physical security risks across its portfolio. This statement describes considerations for FPS's placement in DHS's Management Directorate based upon five key organizational placement criteria GAO identified, as well as steps to transition FPS based upon GAO's prior work on organizational change. This testimony is based on reports GAO issued from 2002 through 2019, particularly, GAO's January 2019 report on FPS's organizational placement. Detailed information on the scope and methodology for this work can be found in these published products, cited throughout this testimony. In its January 2019 report, GAO identified five key criteria relevant for evaluating placement options for the Federal Protective Service (FPS) within the Department of Homeland Security's (DHS) or other federal agencies. (See table.) Placing FPS, in the DHS Management Directorate was not an option GAO assessed in its January 2019 report. However, GAO did assess the option of making FPS a “standalone” entity reporting directly to the Deputy Secretary of DHS. GAO found that this placement met the first criteria ( mission, goals, and objectives ) and the third criteria ( organizational culture ) but did not completely meet the other criteria. For example, FPS had joint responsibility for coordinating facility protection with other federal agencies. DHS did not have joint responsibility for coordinating facility protection with FPS. GAO recommended DHS fully evaluate placement options for FPS. DHS concurred, and officials stated they conducted an assessment. GAO has not yet received DHS's assessment of placement options. GAO's prior work on implementing an organizational change provides valuable insights for making any transition regarding FPS. These insights include key questions to consider such as: “What are the goals of the consolidation?” “How have stakeholders been involved in the decision-making?” In addition, GAO has identified key practices for organizational transformation, practices that include ensuring that top leadership drives the transformation and establishing a communication strategy to create shared expectations, among others. These questions and practices could provide insights to DHS and FPS as they implement FPS's new placement.


FTA provides more than $12 billion annually to support and expand transit services. The operation of transit systems depends on a skilled, qualified workforce, but impending transit worker retirements and advances in transit technology may create challenges for the transit workforce such as finding eligible applicants for transit jobs and obtaining the technology expertise needed. GAO was asked to review various issues related to the sufficiency of the transit workforce. This report discusses the extent to which: (1) information exists about future transit workforce needs and (2) FTA assists with addressing current and future transit workforce needs, among other things. GAO reviewed DOT and FTA documents, including strategic and performance plans, and interviewed DOT and FTA officials and other transit stakeholders, including representatives of transit agencies, research organizations, and unions. Stakeholders were selected based on recommendations from other transit stakeholders and for geographic diversity, among other factors. The nation's transit infrastructure requires a trained workforce, consisting of a variety of occupations (see figure), to operate, maintain, and oversee it. Information on future transit workforce needs is limited in part by the absence of transit-specific workforce projections. According to Federal Transit Administration (FTA) officials, the best information available is an August 2015 report developed by the Department of Transportation (DOT) and other federal stakeholders to produce transportation job projections. However, the report's transit data are combined with ground passenger transportation data (e.g., school buses, taxis), and many of these services are specifically excluded from the statutory definition of transit. Transit-specific data were not available and would be costly to obtain, according to the researchers who wrote the report. Thus, the report does not exclusively reflect the transit workforce. The views of stakeholders GAO interviewed varied regarding whether additional workforce data were needed. Working with stakeholders to understand what, if any, additional information is needed could enable FTA to weigh the complete costs and benefits of developing future transit workforce data. This approach could also enable FTA to make informed decisions on allocating the appropriate resources toward transit workforce efforts. While FTA assists transit stakeholders with addressing workforce needs—for example, providing about $29 million in workforce development assistance in fiscal year 2017—it lacks key strategic planning practices that could ensure its efforts are effective. FTA first reported to Congress in 2016 that it planned to develop a transit workforce strategic plan; however, no clear action has been taken to develop one so far. Further, FTA does not have clearly defined performance goals and measures—as outlined in the Government Performance and Results Act of 1993 (GPRA) and the GPRA Modernization Act of 2010—for FTA's transit workforce development efforts. Without these key strategic planning practices, FTA is limited in its ability to make informed decisions about effectively leveraging its resources to address future transit workforce needs and in measuring the effectiveness of its efforts.


Federal advisory committees provide advice to federal agencies on many topics. As of March 31, 2018, EPA managed 22 such committees. They advise the agency on such issues as developing regulations and managing research programs. Questions have been raised about EPA's process for appointing committee members after recent policy changes affecting who serves on the advisory committees. GAO was asked to review issues related to how EPA appoints advisory committee members. This report examines: (1) EPA's process for appointing advisory committee members, (2) the extent to which EPA followed its process for selecting members from October 2016 through March 2018, and (3) how, if at all, selected characteristics of EPA advisory committees changed after January 2017. GAO reviewed relevant federal laws, regulations, and guidance; reviewed documents from committees that appointed members over this period; analyzed information from the GSA's FACA database; and interviewed agency officials. Based on GAO's review of U.S. Environmental Protection Agency's (EPA) guidance, the agency's established process for appointing advisory committee members involves three main phases: soliciting nominations, evaluating candidates, and obtaining approvals. Each phase involves several steps. For example, a key step for evaluating candidates involves EPA staff's preparing documents that reflect staff recommendations on the best qualified and most appropriate candidates for achieving balanced committee membership, according to EPA guidance. EPA generally followed its established process for most of its 22 advisory committees; however, in fiscal year 2018, EPA did not follow a key step for appointing 20 committee members to two committees GAO reviewed: the EPA Science Advisory Board and Clean Air Scientific Advisory Committee, which advise the agency on environmental regulatory matters, among other things. The 2018 appointment packets for these two committees did not contain documents reflecting EPA staff rationales for proposed membership, as called for by EPA's established process. EPA developed guidance to implement the Federal Advisory Committee Act (FACA). By directing officials responsible for appointing committee members to follow a key step in its process to document staff rationales for proposed membership, the agency would have better assurance that it will (1) consistently meet FACA's purpose of encouraging uniform appointment procedures and (2) show how it made appointment decisions to achieve the best qualified and most appropriate candidates for balanced committee membership. EPA also did not consistently ensure that members appointed as special government employees (SGE)—who are expected to provide their best judgment free from conflicts of interest and are required by federal regulations to disclose their financial interests—met federal ethics requirements. For about 23 percent, or 17 of the 74 financial disclosure forms GAO reviewed, an ethics official had not signed and dated that the SGE filing the form was in compliance with federal ethics rules. EPA also did not periodically review its ethics program, as called for by federal regulations, such as through audits or spot-checks, to evaluate the quality of financial disclosure reviews for SGEs. Until EPA's Ethics Office evaluates the quality of financial disclosure reviews of SGEs as part of its periodic review of its ethics program, it will not have reasonable assurance that it will address noncompliance with federal ethics requirements and prevent conflicts of interest on its advisory committees. Based on GAO's review of the U.S. General Services Administration's (GSA) FACA database, there were notable changes to selected characteristics of EPA advisory committees (i.e. at least a 20 percentage point difference in the change to a characteristic after January 2017 compared to the period after January 2009). Of the four characteristics GAO reviewed—committee composition, regional affiliation, membership turnover, and number of meetings committees held—one or more of the first three changed notably for four of 18 EPA advisory committees after January 2017.


Federal agencies are required in certain circumstances to consult with tribes on infrastructure projects and other activities—such as permitting natural gas pipelines—that may affect tribal natural and cultural resources. According to the National Congress of American Indians, federal consultation with tribes can help to minimize potential negative impacts of federal activities on tribes' cultural resources. The Secretary of Homeland Security has waived federal cultural resource laws that generally require federal agencies to consult with federally recognized tribes to ensure expeditious construction of barriers along the southern U.S. border. This testimony discusses examples of (1) federal laws and regulations that apply to Native American cultural resources and (2) factors that impact the effectiveness of federal agencies' tribal consultation efforts. It is based on reports GAO issued from July 2018 through November 2019 related to federal laws that apply to Native American cultural resources, tribal consultation for infrastructure projects, and border security. It also includes additional information about the consultation requirements in these cultural resource laws and regulations. Examples of federal laws and regulations that apply to Native American cultural resources include: The Native American Graves Protection and Repatriation Act (NAGPRA). In August 2018, GAO reported that NAGPRA prohibits the intentional removal from, or excavation of, Native American cultural items from federal or tribal lands unless a permit has been issued and other requirements are met. NAGPRA and its implementing regulations contain provisions to address both the intentional excavation and removal of Native American cultural items as well as their inadvertent discovery on federal and tribal lands. Section 106 of the National Historic Preservation Act (NHPA). In March 2019, GAO reported that section 106 of the NHPA and its implementing regulations require federal agencies to consult with Indian tribes when agency “undertakings” may affect historic properties—including those to which tribes attach religious or cultural significance—prior to the approval of the expenditure of federal funds or issuance of any licenses. In March 2019, GAO reported that tribes and selected federal agencies identified a number of factors that impact the effectiveness of consultation on infrastructure projects, based on GAO's review of the comments on consultation submitted by 100 tribes to federal agencies in 2016 and GAO's interviews with officials from 57 tribes and 21 federal agencies. Examples of these factors include: Agency consideration of tribal input . Sixty-two percent of the 100 tribes that provided comments to federal agencies in 2016 identified concerns that agencies often do not adequately consider the tribal input they collect during consultation when making decisions about proposed infrastructure projects. Maintaining tribal contact information . Officials from 67 percent of the 21 federal agencies in GAO's review cited difficulties obtaining and maintaining accurate contact information for tribes, which is needed to notify tribes of consultation opportunities. GAO also found that the 21 agencies in GAO's review had taken some steps to facilitate tribal consultation. For example: Eighteen agencies had developed systems to help notify tribes of consultation opportunities, including contact information for tribal leaders or other tribal officials. Five agencies' tribal consultation policies specify that agencies are to communicate with tribes on how tribal input was considered.


Federal agencies are required to provide equal opportunity to qualified individuals with disabilities in all aspects of federal employment. GAO was asked to examine agencies' efforts to increase the employment of individuals with disabilities. Among other objectives, this report examines: (1) the extent to which agencies met the 2010 federal goal to hire an additional 100,000 individuals with disabilities by 2015, and the retention rates of those employees between 2011 and 2017; and (2) practices selected agencies used to increase hiring and retention of individuals with disabilities. GAO analyzed data and documents from OPM and interviewed agency officials. GAO interviewed officials from DOJ, SBA, and SSA about their efforts to enhance employment opportunities for disabled persons. GAO selected these three agencies because they represent a range of agency size and relatively high or low percentages of total employees with disabilities. Approximately 143,600 persons with disabilities were hired during 2011 through 2015—plus an additional 79,600 hires in 2016 and 2017—across the 24 Chief Financial Officers Act agencies, exceeding the stated goal of 100,000 by 2015. About 39 percent of individuals with disabilities hired during 2011 through 2017 stayed less than 1 year and approximately 60 percent stayed less than 2 years. Of the total individuals without disabilities hired during that same time period, approximately 43 percent stayed less than 1 year and approximately 60 percent stayed less than 2 years. Although targeted data tracking and analyses could help pinpoint root causes contributing to departure rates, the Office of Personnel Management (OPM) does not track or report retention data on disabled employees. Doing so, and making such data available to agencies would facilitate more comprehensive analyses of the retention of employees with disabilities and identify needed improvements. Officials at three agencies GAO examined—Department of Justice (DOJ), Small Business Administration (SBA), and Social Security Administration (SSA)—used various practices to increase hiring, such as training staff on Schedule A—a commonly used hiring authority to employ individuals with disabilities. However, the agencies neither assess the impact of training nor how it relates to contributing to performance goals of increasing the number of disabled hires. Agencies are expected to track performance related to providing reasonable accommodations. The selected agencies reported having processes in place for receiving reasonable accommodations requests, but only SSA has procedures for obtaining feedback from employees after an accommodation is provided. Without such feedback, DOJ and SBA are limited in their ability to assess the continued effectiveness of reasonable accommodations provided to employees.


Federal agencies conduct a variety of procurements that are reserved for small business participation through small business set-asides. These set-asides can be for small businesses in general, or they can be specific to small businesses that meet additional eligibility requirements in programs such as those for WOSB or HUBZone. SBA administers both the WOSB and HUBZone programs. SBA also produces an annual Small Business Procurement Scorecard to measure how much contracted spending federal agencies allocate to small businesses and whether the federal government is meeting its goals for awarding contracts to small businesses. GAO issued three reports between September 2018 and March 2019 on SBA contracting programs (see GAO-18-666 , GAO-18-672 , and GAO-19-168). This testimony is primarily based on these three reports and discusses prior GAO findings and SBA's progress on implementing GAO's recommendations on (1) the WOSB program, (2) the HUBZone program, and (3) SBA's procurement scorecard. To update the status of prior recommendations, GAO reviewed updates from SBA and interviewed officials. The Small Business Administration (SBA) has not fully implemented GAO's prior recommendations to address oversight deficiencies in the Women-Owned Small Business (WOSB) and Historically Underutilized Business Zone (HUBZone) programs and to improve evaluation of its procurement scorecard. GAO maintains that its recommendations should be addressed. Women-Owned Small Business Program. In its March 2019 report, GAO found that SBA had not addressed WOSB program oversight deficiencies identified in GAO's 2014 report (GAO-15-54). For example, GAO had found that SBA did not have procedures related to reviewing the performance of the four third-party certifers—private entities approved by SBA to certify the eligibility of WOSB firms—as well as information the certifiiers submitted to SBA. GAO recommended that SBA establish procedures to assess the performance of the certifiers and the information they submitted. While SBA conducted a compliance review of the certifiers in 2016, SBA said in June 2018 that it had no plans to conduct further compliance reviews until a final rule implementing a new certification process was completed. SBA officials said that they expected the rule to be implemented by June 2021. By waiting to improve its oversight of the WOSB program, SBA cannot provide reasonable assurance that certifiers are complying with program requirements and cannot improve its efforts to identify ineligible firms or potential fraud. HUBZone Program. In September 2018, GAO reported that it had reviewed case files for a nongeneralizable sample of 12 firms in Puerto Rico that received HUBZone certification between March 2017 and March 2018 and found that SBA did not consistently document or follow its policies and procedures for certification reviews. For example, SBA did not have complete documentation in nine of 12 cases and did not follow its policy to conduct three levels of review when determining whether to approve or deny a firm in four of 12 cases. As a result, SBA did not have reasonable assurance that firms meet HUBZone criteria. SBA said that it planned to implement GAO's recommendations that SBA (1) update internal policy manuals for certification and recertification and (2) conduct and document reviews of staff compliance with relevant procedures. However, as of May 2019, SBA had not provided documentation showing that it had completed these planned actions. Small Business Procurement Scorecard. For fiscal year 2017, SBA revised the methodology for its Small Business Procurement Scorecard, which assesses the efforts of federal agencies to support contracting with small businesses. For example, one revision reduced the share of the total scorecard grade devoted to prime contracting achievement (the dollar amount of contracts awarded directly to small businesses). GAO recommended in September 2018 that SBA design and implement a comprehensive evaluation to assess the scorecard revisions. Since that report was issued, SBA has proposed but not yet implemented a two-phase evaluation of the scorecard to include an evaluation of the scorecard's effect on federal agencies achieving small business contracting goals. SBA said that it expects to complete phase one by September 2019 and has not provided a time frame for phase two.


Federal agencies face a growing number of cyber threats to their systems and data. To protect against these threats, federal law and policies emphasize that agencies take a risk-based approach to cybersecurity by effectively identifying, prioritizing, and managing their cyber risks. In addition, OMB and DHS play important roles in overseeing and supporting agencies' cybersecurity risk management efforts. GAO was asked to review federal agencies' cybersecurity risk management programs. GAO examined (1) the extent to which agencies established key elements of a cybersecurity risk management program; (2) what challenges, if any, agencies identified in developing and implementing cybersecurity risk management programs; and (3) steps OMB and DHS have taken to meet their risk management responsibilities and address any challenges agencies face. To do this, GAO reviewed policies and procedures from 23 civilian Chief Financial Officers Act of 1990 agencies and compared them to key federal cybersecurity risk management practices, obtained agencies' views on challenges they faced, identified and analyzed actions taken by OMB and DHS to determine whether they address agency challenges, and interviewed responsible agency officials. Key practices for establishing an agency-wide cybersecurity risk management program include designating a cybersecurity risk executive, developing a risk management strategy and policies to facilitate risk-based decisions, assessing cyber risks to the agency, and establishing coordination with the agency's enterprise risk management (ERM) program. Although the 23 agencies GAO reviewed almost always designated a risk executive, they often did not fully incorporate other key practices in their programs: Twenty-two agencies established the role of cybersecurity risk executive, to provide agency-wide management and oversight of risk management. Sixteen agencies have not fully established a cybersecurity risk management strategy to delineate the boundaries for risk-based decisions. Seventeen agencies have not fully established agency- and system-level policies for assessing, responding to, and monitoring risk. Eleven agencies have not fully established a process for assessing agency-wide cybersecurity risks based on an aggregation of system-level risks. Thirteen agencies have not fully established a process for coordinating between their cybersecurity and ERM programs for managing all major risks. Until they address these practices, agencies will face an increased risk of cyber-based incidents that threaten national security and personal privacy. Agencies identified multiple challenges in establishing and implementing cybersecurity risk management programs (see table).


Federal agencies publish on average 3,700 proposed rules yearly and are generally required to provide interested persons (commenters) an opportunity to comment on these rules. In recent years, some high-profile rulemakings have received extremely large numbers of comments, raising questions about how agencies manage the identity information associated with comments. While the APA does not require the disclosure of identifying information from a commenter, agencies may choose to collect this information. This report examines (1) the identity information collected by Regulations.gov and agency-specific comment websites; (2) the guidance agencies have related to the identity of commenters; (3) how selected agencies treat identity information; and (4) the extent to which selected agencies clearly communicate their practices associated with identity information. GAO selected a nongeneralizable sample of 10 federal agencies on the basis of large comment volume. GAO surveyed 52 program offices within these agencies about their comment process; and reviewed comment websites, agency guidance, and posted comment data. GAO also interviewed relevant agency officials. The Administrative Procedure Act (APA) governs the process by which many federal agencies develop and issue regulations, which includes the public comment process (see figure below). Regulations.gov and agency-specific comment websites collect some identity information—such as name, email, or address—from commenters who choose to provide it during the public comment process. The APA does not require commenters to disclose identity information when submitting comments. In addition, agencies have no obligation under the APA to verify the identity of such parties during the rulemaking process. GAO found that seven of 10 selected agencies have some internal guidance associated with the identity of commenters, but the substance varies, reflecting the differences among the agencies. The guidance most frequently relates to the comment intake or response to comment phases of the public comment process. With the discretion afforded by the APA, selected agencies' treatment of commenters' identity information varies, particularly when posting duplicate comments (identical or near-identical comment text but varied identity information). Generally, officials told GAO that their agencies (1) post all comments within the comment system; or (2) maintain some comments outside of the system, such as in email file archives. For instance, one agency posts a single example of duplicate comments and indicates the total number of comments received. However, within these broad categories, posting practices vary considerably—even within the same agency—and identity information is inconsistently presented on public websites. Selected agencies do not clearly communicate their practices for how comments and identity information are posted. GAO's key practices for transparently reporting government data state that federal government websites should disclose data sources and limitations to help public users make informed decisions about how to use the data. As a result, public users of the comment websites could reach inaccurate conclusions about who submitted a particular comment, or how many individuals commented on an issue.


Federal agencies publish on average 3,700 proposed rules yearly and are generally required to provide interested persons (commenters) an opportunity to comment on these rules. In recent years, some high-profile rulemakings have received extremely large numbers of comments, raising questions about how agencies manage the identity information associated with comments. While the APA does not require the disclosure of identifying information from a commenter, agencies may choose to collect this information. This testimony summarizes GAO's June 2019 report on public comment posting practices (GAO-19-483). In that report, GAO examined (1) the identity information collected by comment websites; (2) the guidance agencies have related to the identity of commenters; (3) how 10 selected agencies treat identity information; and (4) the extent to which the selected agencies clearly communicate their practices associated with identity information. The 10 agencies were selected on the basis of the volume of public comments they received on rulemakings. For this testimony, GAO obtained updates on the status of recommendations made to the selected agencies. The Administrative Procedure Act (APA) governs the process by which many federal agencies develop and issue regulations, which includes the public comment process (see figure below). In June 2019, GAO found that Regulations.gov and agency-specific comment websites collect some identity information—such as name, email, or address—from commenters who choose to provide it during the public comment process. The APA does not require commenters to disclose identity information when submitting comments. In addition, agencies have no obligation under the APA to verify the identity of such parties during the rulemaking process, and all selected agencies accept anonymous comments in practice. GAO found in the June 2019 report that seven of 10 selected agencies have some internal guidance associated with the identity of commenters, but the substance of this guidance varies. This reflects the differences in the way that the selected agencies handle commenter identity information internally. GAO also found that the selected agencies' practices for posting public comments to comment websites vary considerably, particularly for duplicate comments (identical or near-identical comment text but varied identity information). For example, one agency posts a single example of duplicate comments and indicates the total number of comments received, but only the example is available to public users of Regulations.gov. In contrast, other agencies post all comments individually. As a result, identity information submitted with comments is inconsistently presented on public websites. The APA allows agencies discretion in how they post comments, but GAO found that some of the selected agencies do not clearly communicate their practices for how comments and identity information are posted. GAO's key practices for transparently reporting government data state that federal government websites should disclose data sources and limitations to help public users make informed decisions about how to use the data. If not, public users of the comment websites could reach inaccurate conclusions about who submitted a particular comment, or how many individuals commented on an issue.


According to FEMA—a component within DHS—the 2017 disasters affected 47 million people, or about 15 percent of the nation's population. Federal contracts have played a key role in responding to these disasters and in long-term community recovery. So far, FEMA has obligated billions of dollars on these contracts. This testimony is based primarily on GAO's recent reports on disaster contracting—specifically advance contracting and post-disaster contracts related to the 2017 disasters—which detail much of FEMA's disaster contracting activities. It addresses key challenges FEMA faced contracting for goods and services in response to these disasters. To conduct this work, GAO analyzed data from the Federal Procurement Data System-Next Generation through June 30, 2018, the latest and most complete data available for the 2017 disasters. GAO also analyzed FEMA guidance and documentation and interviewed FEMA officials to discuss the use of contracts to respond to the 2017 disasters. Following Hurricanes Harvey, Irma, and Maria, and the 2017 California wildfires, federal agencies entered into disaster-related contracts worth about $9.5 billion, according to data as of June 30, 2018—the latest and most complete data at the time of GAO's review (see figure). The Federal Emergency Management Agency (FEMA) obligated about $2.9 billion of this total through advance contracts, which it establishes prior to a disaster to rapidly mobilize resources. FEMA obligated an additional $1.6 billion through post-disaster contracts, which are established after disasters hit. In its December 2018 and April 2019 reports, GAO made 10 recommendations to strengthen FEMA's ability to address challenges GAO identified in how FEMA plans, coordinates, and tracks its contracts: Planning: FEMA has an outdated strategy and unclear guidance on how contracting officers should use advance contracts and has not fully assessed its contracting workforce needs. Effectively planning its contract use is critical to FEMA quickly providing critical goods and services. Coordination: FEMA did not fully coordinate with states and localities on certain contracts and encountered communication and coordination challenges with other federal agencies. Effective coordination helps FEMA ensure stakeholders have the tools needed to facilitate their disaster response efforts. Tracking: The full extent of 2017 disaster contracting activities, for FEMA and other agencies, is unknown. GAO found that codes used to track obligations for these disasters in a federal procurement data system were closed without full consideration of user needs or due to inconsistent implementation of criteria established by the Department of Homeland Security (DHS) and other agencies, limiting visibility over federal disaster contracts.


Federal agencies publish on average 3,700 proposed rules yearly and are generally required to provide interested persons (commenters) an opportunity to comment on these rules. In recent years, some high-profile rulemakings have received extremely large numbers of comments, raising questions about how agencies manage the identity information associated with comments. While the APA does not require the disclosure of identifying information from a commenter, agencies may choose to collect this information. This testimony summarizes GAO's June 2019 report on public comment posting practices (GAO-19-483). In that report, GAO examined (1) the identity information collected by comment websites; (2) the guidance agencies have related to the identity of commenters; (3) how selected agencies treat identity information; and (4) the extent to which selected agencies clearly communicate their practices associated with identity information. The agencies were selected on the basis of the volume of public comments they received on rulemakings. For this testimony, GAO obtained updates on the status of recommendations made to the selected agencies. The Administrative Procedure Act (APA) governs the process by which many federal agencies develop and issue regulations, which includes the public comment process (see figure). In June 2019, GAO found that Regulations.gov and agency-specific comment websites collect some identity information—such as name, email, or address—from commenters who choose to provide it during the public comment process. The APA does not require commenters to disclose identity information when submitting comments. In addition, agencies have no obligation under the APA to verify the identity of such parties during the rulemaking process. GAO found in the June 2019 report that seven of 10 selected agencies have some internal guidance associated with the identity of commenters, but the substance varies. This reflects the differences in the way that the selected agencies handle commenter identity information internally. GAO also found that the selected agencies' practices for posting public comments to comment websites vary considerably, particularly for duplicate comments (identical or near-identical comment text but varied identity information). For example, one agency posts a single example of duplicate comments and indicates the total number of comments received, but only the example is available to public users of Regulations.gov. In contrast, other agencies post all comments individually. As a result, identity information submitted with comments is inconsistently presented on public websites. The APA allows agencies discretion in how they post comments, but GAO found that selected agencies do not clearly communicate their practices for how comments and identity information are posted. GAO's key practices for transparently reporting government data state that federal government websites should disclose data sources and limitations to help public users make informed decisions about how to use the data. If not, public users of the comment websites could reach inaccurate conclusions about who submitted a particular comment, or how many individuals commented on an issue.


Federal agencies use internet-based (cloud) services to fulfill their missions. GSA manages FedRAMP, which provides a standardized approach to ensure that cloud services meet federal security requirements. OMB requires agencies to use FedRAMP to authorize the use of cloud services. GAO was asked to review FedRAMP. The objectives were to determine the extent to which 1) federal agencies used FedRAMP to authorize cloud services, 2) selected agencies addressed key elements of the program's authorization process, and 3) program participants identified FedRAMP benefits and challenges. GAO analyzed survey responses from 24 federal agencies and 47 cloud service providers. GAO also reviewed policies, plans, procedures, and authorization packages for cloud services at four selected federal agencies and interviewed officials from federal agencies, the FedRAMP program office, and OMB. The 24 federal agencies GAO surveyed reported using the Federal Risk and Authorization Management Program (FedRAMP) for authorizing cloud services. From June 2017 to July 2019, the number of authorizations granted through FedRAMP by the 24 agencies increased from 390 to 926, a 137 percent increase. However, 15 agencies reported that they did not always use the program for authorizing cloud services. For example, one agency reported that it used 90 cloud services that were not authorized through FedRAMP and the other 14 agencies reported using a total of 157 cloud services that were not authorized through the program. In addition, 31 of 47 cloud service providers reported that during fiscal year 2017, agencies used providers' cloud services that had not been authorized through FedRAMP. Although the Office of Management and Budget (OMB) required agencies to use the program, it did not effectively monitor agencies' compliance with this requirement. Consequently, OMB may have less assurance that cloud services used by agencies meet federal security requirements. Four selected agencies did not consistently address key elements of the FedRAMP authorization process (see table). Officials at the agencies attributed some of these shortcomings to a lack of clarity in the FedRAMP guidance. Program participants identified several benefits, but also noted challenges with implementing the FedRAMP. For example, almost half of the 24 agencies reported that the program had improved the security of their data. However, participants reported ongoing challenges with resources needed to comply with the program. GSA took steps to improve the program, but its FedRAMP guidance on requirements and responsibilities was not always clear and the program's process for monitoring the status of security controls over cloud services was limited. Until GSA addresses these challenges, agency implementation of the program's requirements will likely remain inconsistent.


Federal agencies' ethics programs seek to prevent conflicts of interest and safeguard the integrity of governmental decision-making. GAO was asked to review compliance with ethics requirements for political appointees in the executive branch. This report examines the extent to which (1) existing data identify political appointees serving in the executive branch, and (2) selected agencies use internal controls to reasonably ensure that their ethics programs are designed and implemented to meet statutory and regulatory requirements. GAO reviewed available data on political appointees. GAO also reviewed three case study agencies selected to provide a range in agency size and number of political appointees. GAO reviewed ethics documentation for a nongeneralizable sample of political appointees at the three agencies at any point between January 2017 and 2018 and interviewed officials from the agencies and two non-governmental organizations. There is no single source of data on political appointees serving in the executive branch that is publicly available, comprehensive, and timely. Political appointees make or advocate policy for a presidential administration or support those positions. The Office of Personnel Management (OPM) and two nongovernmental organizations collect, and in some cases, report data on political appointees, but the data are incomplete. For example, the data did not include information on political appointee positions within the Executive Office of the President. The White House Office of Presidential Personnel (PPO) maintains data but does not make them publicly available. The public has an interest in knowing the political appointees serving and this information would facilitate congressional oversight and hold leaders accountable. As of March 2019, no agency in the federal government is required to publicly report comprehensive and timely data on political appointees serving in the executive branch. OPM is positioned to maintain and make political appointee data publicly available on a timely basis but is limited in its ability to provide comprehensive data. PPO has more comprehensive data but may not be positioned to publish data on a recurring basis. Ultimately, it is a policy decision as to which agency is best positioned to report comprehensive and timely data on political appointees. All three agencies GAO reviewed generally used appropriate internal controls to ensure they met basic ethics program requirements, though two of the agencies could take actions to strengthen their ethics programs. The Departments of Health and Human Services (HHS), and the Interior (Interior), and the Small Business Administration (SBA) all have procedures for administering their financial disclosure systems. HHS and Interior had procedures for providing initial ethics training as required beginning in January 2017. Prior to February 2019 SBA did not have written procedures for initial ethics training and did not adequately document political appointees' training dates. SBA's written procedures now reflect the requirements of initial ethics training and SBA developed a tracking sheet to indicate appointees completed training. GAO will assess the implementation of the tracking sheet to confirm the process is sufficient for documenting appointees' completion of initial ethics training. Interior's ethics program has human capital and workforce continuity challenges. Interior reported that four out of 14 full-time positions were vacant. Interior officials attributed the vacancies to a recent transformation of the ethics program and prioritizing the staffing at individual bureaus such as the National Park Service. However, vacancies affected the ethics program's ability to properly document policies and procedures as well as file and review financial disclosure forms. According to Interior officials, steps are being taken to address vacancies and document policies and procedures. However, GAO found that a more strategic and documented approach would enable Interior to better manage human capital, fill key positions, and maintain institutional knowledge.


Federal civilian agencies hold and manage billions of dollars in property that is not considered to be real property, such as vehicles, furniture, computers, and scientific instruments. Some of these items are stored in nearly 18,000 warehouses covering more than 90-million square feet. Agencies are required by law to regularly identify and dispose of unneeded items. However, GAO reported in 2018 that agencies often did not do so. The Federal Personal Property Management Act of 2018 requires agencies to use GSA guidance to assess the utilization and ongoing need for property. GAO was asked to review property stored in warehouses. This report examines: (1) what is known about property in selected agencies' warehouses and how much agencies spend to store it, and (2) the extent to which selected agencies assess the ongoing need for property stored in warehouses. GAO reviewed federal statutes, regulations, and GSA's guidance; analyzed policies from three agencies—FAA, Office of Science, and BOP—which were selected based on total warehouse square footage, among other factors; conducted site visits to agencies' warehouses; and interviewed stakeholders such as agency officials and industry groups. GAO found that three selected agencies stored a wide variety of property in their warehouses. For example: Federal Aviation Administration (FAA) warehouses at four main sites contained items used to build and repair aviation support systems, such as wind shear alert systems. Other sites contained tools and equipment to maintain aviation support systems or housed the systems themselves. The Department of Energy's Office of Science warehouses, located primarily at national laboratories, contained items, such as large magnets, for use in scientific experiments. Bureau of Prisons (BOP) warehouses, located mainly at federal correctional institutions, contained items, such as food, uniforms, and soap, for inmates. The above agencies reported spending approximately $50.1 million in fiscal year 2018 on warehouse rent, operations, and maintenance costs. The three selected agencies generally did not systematically assess the ongoing need for property in their warehouses and had limited guidance for doing so. For example, although two of the agencies had policies about when such an assessment should occur, none of the agencies specified how it should occur for most types of property. Instead, agencies primarily relied on agency officials' professional judgment to assess ongoing need. GAO identified instances where agencies retained unneeded property absent relevant guidance. For example, one agency site had stored obsolete computers dating back to the 1990s. While the General Services Administration (GSA) drafted guidance in response to recent legislation, this guidance does not describe approaches or practices stakeholders identified as potentially useful for assessing ongoing need for property, such as periodic retention justifications, use of data analytics, and utilization reviews. Further, while GSA officials intend to put the final guidance on GSA's website and provide it to agencies that participate in a GSA-chaired committee on property management by December 2019, GSA has not provided a documented plan or a timeline for broader dissemination. Guidance that incorporates such approaches could help agencies avoid retaining property that is no longer needed and, as a result, allow them to better manage their property and use of their warehouse space.


Federal contracts play a key role in timely response and recovery efforts following disasters. While federal agencies, such as FEMA and USACE, may have advance contracts in place for obtaining goods and services following disasters, agencies may also award post-disaster contracts. GAO was asked to review the federal government's response to three major hurricanes in 2017, as well as the 2017 California wildfires. This report addresses, among other objectives, the extent to which (1) federal agencies obligated funds on post-disaster contracts in response to the these events, and (2) selected agencies experienced challenges in the planning of selected contracts. GAO analyzed data from the Federal Procurement Data System-Next Generation; selected a non-generalizable sample of 23 post-disaster contracts based on factors such as if the contract was set aside for award to a local contractor; reviewed federal regulations and agency guidance; and interviewed agency officials. Following hurricanes Harvey, Irma, and Maria and the 2017 California wildfires, federal agencies obligated at least $5 billion in post-disaster contracts—which are awarded after disasters hit— to support disaster response and recovery efforts. The U.S. Army Corps of Engineers (USACE) and the Federal Emergency Management Agency (FEMA) comprised over three-quarters of reported post-disaster contract obligations as of June 30, 2018 (see figure). However, the full extent of post-disaster contracting related to the 2017 disasters is unknown due to the Department of Homeland Security's (DHS) inconsistent implementation of the criteria for closing a national interest action (NIA) code. This code allows agencies to track data on contract actions related to national emergencies, providing government-wide insight into response and recovery efforts. DHS closed the codes for Harvey and Irma on June 30, 2018, less than a year after those hurricanes hit. In contrast, the codes for prior hurricanes were open for at least five years, with Katrina remaining open for 13 years. Based on a review of 23 contract files from FEMA, USACE, the Defense Logistics Agency, and the Coast Guard, GAO identified challenges in the planning of selected contracts. For example, GAO found USACE officials were not consistently aware of the regulation that defines “local area.” GAO also found that contracting officers at FEMA, USACE, and the Coast Guard did not consistently write justifications for awards to non-local vendors outside the disaster area, as required. FEMA developed guidance to address this, but the Coast Guard and USACE have not issued guidance or tools to address this requirement. Without addressing planning challenges, agencies may miss opportunities to award contracts to local businesses in the disaster area to the extent feasible and practicable, which could help jump-start the local economy.


Federal employee whistleblowers—individuals who report allegations of wrongdoing—potentially help to safeguard the government from fraud, waste, and abuse. OSC was created to help protect whistleblowers. Probationary employees—generally those with less than 1 or 2 years of federal service—can be especially vulnerable to reprisal because they have fewer protections from adverse personnel actions, including termination. A 2017 law included a provision for GAO to examine retaliation against whistleblowers in their probationary period. This report examines (1) the extent to which probationary employees filed whistleblower disclosures or reprisal complaints, (2) termination rates of complainants, and (3) OSC procedures related to probationary employees. GAO used complaint data and workforce data to identify the probationary status of employees who filed claims with OSC from fiscal year 2014 to 2018 (the most recent full years of available data); estimated the number of instances where claimants were terminated; and reviewed OSC procedures. GAO found that existing data are not sufficient to determine if the rates of filing whistleblower disclosures, retaliation complaints, or both vary by probationary status. The average annual number of probationary and permanent federal employees from fiscal years 2014 to 2018 was approximately 1.9 million employees. Over this time frame, an average of approximately 2,800 employees—about 0.15 percent—filed complaints each year. Existing data were not sufficient to determine probationary status of employees for over 18 percent of each year's complaints. Therefore, it is not possible to determine whether probationary employees file at lower, comparable, or higher rates than their prevalence in the overall employee population. Specifically, probationary employees represented about 13.5 percent, on average, of the federal workforce, and GAO estimates that they filed from 6.6 percent to 18.2 percent of complaints. GAO estimates suggest that both permanent and probationary employees who filed complaints were consistently terminated at higher rates than federal employees government-wide. For example, in fiscal year 2018, the termination rate for probationary employees government-wide was 1.1 percent, while the lowest estimated rate of termination among probationary employees who filed a complaint was 10.1 percent. For permanent employees, the overall termination rate was 0.3 percent, while the lowest estimated rate for filers was 2.9 percent. GAO estimates also suggest that probationary employees who filed complaints were terminated at higher rates than permanent employees who did the same. For example, in fiscal year 2018: The lowest estimated termination rate for probationary employees who filed whistleblower disclosures (10.1 percent) exceeded the maximum estimated rate for permanent employees who did the same (5.2 percent). The lowest estimated termination rate for probationary employees who filed retaliation complaints (17.4 percent) exceeded the maximum estimated rate for permanent employees who did the same (9.9 percent). The lowest estimated termination rate for probationary employees who filed both types (14.1 percent) exceeded the maximum estimated rate for permanent employees who did the same (13.2 percent). The Office of Special Counsel's (OSC) complaint form allows but does not require complainants to identify whether they are probationary or permanent employees when filing a whistleblower disclosure or retaliation complaint. OSC officials said they try to limit mandatory data fields to the information that is necessary for processing a case, and that they have no plans to do any analysis of employees in their probationary period who file claims. However, the higher rates of termination GAO found for filers generally, and probationary employees specifically, suggests that there could be a risk of unequal treatment. Without first identifying probationary employees who file whistleblower claims, OSC would lack complete data should it decide at some point to analyze the effect of probationary status on filers. Collecting and maintaining such data on every claimant would provide OSC or other entities the ability to analyze termination rates or other issues related to a whistleblower's probationary status.


Federal employees perform critical functions across multiple mission areas, from those vital to the long-term well-being of the country to those directly charged with aspects of public safety. Major emergencies, such as the COVID-19 pandemic, can pose threats to employees' safety and conditions may ebb and flow over an extended period. During these situations, federal agencies have a responsibility to provide an environment for employees to perform their jobs safely and effectively. This statement provides (1) key considerations based on GAO's prior work for federal agencies as federal workers reenter the workplace; (2) an illustrative example of how the Census Bureau was forced to suspend major Decennial Census field operations and the process it used to resume operations; and (3) key practices for ensuring telework contributes to continuity of operations. This statement is based on a large body of GAO work on pandemic preparedness, reviews of the Decennial Census, and federal human capital management issued from July 2003 through June 2020. The rapidly escalating challenges from the Coronavirus Disease 2019 (COVID-19) global outbreak present critical workforce issues for federal agencies to assess and address. GAO's prior work on pandemics and human capital issues has shown that agencies should consider a range of factors to carry out their missions while protecting their workforce and the members of the public with whom they interact. Key considerations for federal workers' reentry to workplaces . As federal agencies manage operations during the COVID-19 pandemic and plan for their employees to safely return to workplaces, GAO's prior work has shown that it is important for agencies to identify mission essential functions that cannot be performed remotely when deciding who needs to return to the office. Agencies should also consider the exposure risk level and local conditions when deciding whether to reopen offices across the country. To protect employees as they reenter the workforce, it will be important for agencies to have appropriate protection measures in place. For example, agencies should consider how they can ensure adequate distribution of hygiene supplies. They should also consider changes to the work environment to reduce workplace hazards, and implement social distancing strategies. How the Census Bureau decided to resume Decennial Census operations. The U.S. Census Bureau offers an example of how an agency suspended and resumed operations under the current pandemic. In March 2020, the U.S. Census Bureau suspended field operations of the Decennial Census and took a phased approach to resuming operations at its area census offices. As of June 11, all area census offices had resumed operations. Key aspects of resuming operations at area census offices included: (1) taking a phased approach to restarting operations, such as resuming operations that required less physical interaction first; (2) making operational changes to minimize face-to-face interactions; (3) addressing worker safety concerns; and (4) communicating pandemic plans to ensure continued operations. Key practices for ensuring telework contributes to continuity of operations. Several key practices GAO previously identified are useful for agencies to help ensure telework contributes to continuity of operations during the current pandemic and in the future. Specifically, agencies should consider based on their current experiences whether: (1) their policies and guidance related to telework are sufficient to ensure that their workforces are telework ready and balances are struck between employees' personal circumstances and work responsibilities; (2) the extent to which their telework infrastructure, including technical support and security, is adequate to support increased telework; (3) procedures and standards are in place that ensure telework does not diminish organizational and employee performance; and (4) the processes, procedures, and tracking systems to collect data provide the information needed to evaluate the use of telework. These assessments will assist agencies in considering broader changes to their policies and procedures related to telework as employees are called back to their duty stations.


Federal funding for disaster assistance since 2005 has totaled at least $450 billion, including a 2019 supplemental appropriation of $19.1 billion for recent disasters. In 2018 alone, 14 separate billion-dollar weather and climate disaster events occurred across the United States, with total costs of at least $91 billion including the loss of public and private property, according to the National Oceanic and Atmospheric Administration. Disaster costs will likely increase as certain extreme weather events become more frequent and intense due to climate change, according to the U.S. Global Change Research Program, a global change research coordinating body that spans 13 federal agencies. In 2013, GAO included “Limiting the Federal Government's Fiscal Exposure by Better Managing Climate Change Risks” on its list of federal program areas at high risk of fraud, waste, abuse, mismanagement, or most in need of transformation. The cost of recent weather disasters has illustrated the need to plan for climate change risks and invest in climate resilience. Investing in climate resilience can reduce the need for far more costly steps in the decades to come. The Disaster Recovery Reform Act of 2018 provides one potential source of funding for climate resilience projects. In particular, it allows the President to set aside up to 6 percent of the estimated aggregate amount of grants from certain programs under a major disaster declaration to implement pre-disaster hazard mitigation activities. Officials estimate funds for the related program will average $300 million to $500 million annually. GAO was asked to review the federal approach to prioritizing and funding climate resilience projects that address the nation's most significant climate risks. This report examines (1) the extent to which the federal government has a strategic approach for investing in climate resilience projects; (2) key steps that provide an opportunity to strategically prioritize projects for investment; and (3) the strengths and limitations of options for focusing federal funding on these projects. GAO reviewed relevant reports and interviewed 35 stakeholders with relevant expertise, including federal officials, researchers, and consultants. In addition, during the course of this work, GAO identified domestic and international examples of governments that invest in climate resilience and related projects. GAO selected two of these examples for in-depth review and presentation in the report: the state of Louisiana's coastal master planning effort and Canada's Disaster Mitigation and Adaptation Fund. The federal government has invested in projects that may enhance climate resilience, but it does not have a strategic approach to guide its investments in high-priority climate resilience projects. Enhancing climate resilience means taking actions to reduce potential future losses by planning and preparing for potential climate hazards such as extreme rainfall, sea level rise, and drought. Some federal agencies have made efforts to manage climate change risk within existing programs and operations, and these efforts may convey climate resilience benefits. For example, the U.S. Army Corps of Engineers' civil works program constructs flood control projects, such as sea walls, that may enhance climate resilience. However, additional strategic federal investments may be needed to manage some of the nation's most significant climate risks because climate change cuts across agency missions and presents fiscal exposures larger than any one agency can manage. GAO's analysis shows the federal government does not strategically identify and prioritize projects to ensure they address the nation's most significant climate risks. Likewise, GAO's past work shows an absence of government-wide climate change strategic planning. As of August 2019, no action had been taken to implement 14 of GAO's 17 recommendations to improve federal strategic planning for climate resilience. GAO's enterprise risk management framework calls for reviewing risks and selecting the most appropriate strategy to manage them. However, no federal agency, interagency collaborative effort, or other organizational arrangement has been established to implement a strategic approach to climate resilience investment that includes periodically identifying and prioritizing projects. Such an approach could supplement individual agency climate resilience efforts and help target federal resources toward high-priority projects. Six key steps provide an opportunity for the federal government to strategically identify and prioritize climate resilience projects for investment, as GAO found based on its review of prior GAO work, relevant reports, and stakeholder interviews (see figure). GAO identified one domestic and one international example to illustrate these key steps: Louisiana's Coastal Protection and Restoration Authority (CPRA) coastal master planning effort and Canada's Disaster Mitigation and Adaptation Fund (DMAF). In the domestic example, in 2005 the Louisiana legislature consolidated coastal planning efforts previously carried out by multiple state entities into a single effort led by CPRA to address the lack of strategic coordination. CPRA periodically identifies high-priority coastal resilience projects designed to address two primary risks: flooding and coastal land loss. To identify potential projects, CPRA sought project proposals from citizens, nongovernmental organizations, and others. To prioritize projects, CPRA used quantitative modeling to estimate project outcomes under multiple future scenarios of varied climate and other conditions and coordinated with stakeholders to understand potential project impacts. In 2017, CPRA identified $50 billion in high-priority projects to be implemented as funds become available. In the international example, in 2018, the Canadian government launched the DMAF, a financial assistance program to provide US$1.5 billion over 10 years for large-scale, nationally significant projects to manage natural hazard risks, including those triggered by climate change. Infrastructure Canada, the entity responsible for administering the DMAF, seeks project ideas from provinces and territories, municipal and regional governments, indigenous groups, and others. These entities apply directly to Infrastructure Canada for funding. According to Canadian officials, two committees of experts—one composed of experts from other federal departments and the other composed of nonfederal experts (e.g., urban planners and individuals with regional expertise)—provide feedback on potential projects. These projects are prioritized based on multiple criteria such as the extent to which they reduce the impacts of natural disasters. On the basis of GAO's review of relevant reports and past GAO work, interviews with stakeholders, and illustrative examples, GAO identified two options—each with strengths and limitations—for focusing federal funding on high-priority climate resilience projects. The options are (1) coordinating funding provided through multiple existing programs with varied purposes and (2) creating a new federal funding source specifically for investment in climate resilience. A strength of coordinating funding from existing sources is access to multiple funding sources for a project. For example, one stakeholder GAO interviewed—whose community used federal funding to implement large-scale resilience projects—said that having multiple programs is advantageous because when funding from one program is not available—such as when the project does not match that program's purpose or when there are insufficient funds—funds could be sought from another program. A limitation of that option, according to CPRA officials, is that coordinating funding from multiple sources could be administratively challenging and could require dedicated staff to identify programs, assess whether projects meet program funding criteria, apply for funds, and ensure program requirements are met. Alternatively, one strength of a new federal funding source is that it could encourage cross-sector projects designed to achieve benefits in multiple sectors. For example, according to one stakeholder, such a funding source could allow experts from multiple sectors—such as infrastructure, housing, transportation, and health—to collaborate on projects, leading to more creative, comprehensive approaches to enhance community resilience. However, such a new funding source would have to be created, which would require Congressional authorization. In addition, GAO identified opportunities to increase the climate resilience impact of federal funding options. For example, a federal resilience investment effort presents an opportunity to encourage several types of complementary resilience activities by nonfederal actors such as states, localities, and private-sector partners. In this example, the federal government could require or provide incentives for communities to use and enforce climate-resilient building codes or limit development in high-risk areas through zoning regulations.


Federal health insurance requirements generally apply to health plans sold in the private health insurance market in the United States (i.e., individual coverage, small- and large-group coverage, and self-insured plans). However, not all private health coverage arrangements comply with these requirements. This includes exempted health coverage arrangements and noncompliant health coverage arrangements , as termed for purposes of this report. This report identifies and describes arrangements in these two categories. It is intended to help congressional policymakers better understand the scope of such arrangements available to individuals in the United States and to provide information about the limits of the application of federal health insurance requirements. The arrangements described in this report can be divided into two categories: Exempted Health Coverage Arrangements : Those that meet a federal definition of health insurance but are exempt from compliance with some or all applicable federal health insurance requirements. Such arrangements include the following: G roup health plans covering fewer than two current employees , including retiree-only plans , are exempt from all federal health insurance requirements. Health plans in their provision of excepted benefits (e.g., auto liability insurance, limited-scope dental and vision benefits, and specific disease coverage) are exempt from all federal health insurance requirements. S hort-term, limited-duration insurance (i.e., coverage generally sold in the individual market that must have a specified expiration date that is less than 12 months after the original effective date of the contract and that cannot be renewed or extended for longer than 36 months) is exempt from complying with all federal health insurance requirements. S tudent health insurance coverage (i.e., individual health insurance coverage that meets specified conditions and that may be provided only to students enrolled in an institution of higher education and their dependents) is exempt from complying with some federal health insurance requirements if such coverage is fully insured and is exempt from all federal health insurance requirements if the student health plan is self-insured. S elf-insured, nonfederal governmental plans (e.g., group health plans sponsored by states, counties, school districts, and municipalities) may elect to exempt the plan from some federal requirements. G randfathered plans (i.e., group health plans or health insurance coverage in which at least one individual was enrolled as of enactment of the Patient Protection and Affordable Care Act [ACA; P.L. 111-148 , as amended] and which have continued to meet specified conditions) are exempt from some federal requirements. T ransitional plans (i.e., individual and small-group market plans that meet certain requirements and are in states that have continuously opted to exempt them, per federal guidance) are exempt from some federal requirements. Noncompliant Health Coverage Arrangements : Those that the federal government has not explicitly exempted from compliance with federal health insurance requirements and that do not necessarily comply with those requirements. Such arrangements include the following: H ealth care sharing ministries (i.e., faith-based organizations that share resources for medical needs among their members) do not currently and have not historically complied with federal health insurance requirements. Certain types of f arm bureau coverage (i.e., health coverage offered by a farm bureau in the three states with a law that specifies that such coverage is not considered insurance and is not subject to the state's insurance laws) do not comply with federal health insurance requirements. The report includes a brief description of each arrangement, its status with respect to complying with federal health insurance requirements, and the history of its status. The report also includes information about whether and how the arrangements are subject to state regulatory authority. Where available, estimates of enrollment in an arrangement are provided.


Federal highway construction and safety programs are currently authorized through September 30, 2020, under the five-year Fixing America's Surface Transportation Act (FAST Act; P.L. 114-94 ). For the 1,027,849-mile system of federal-aid highways, the FAST Act provided an average of $45 billion annually. Although there are exceptions, federally funded projects are generally limited to this system that includes roughly 25% of all U.S. public road mileage. Of these funds, nearly 93% are distributed to the states via formula. The states have nearly complete control over the use of these funds, within the limits of federal planning, eligibility, and oversight rules. Money is not provided up front. A state is reimbursed after work is started, costs are incurred, and the state submits a voucher to the Federal Highway Administration (FHWA). The highway program focuses on highway construction and planning, and does not support operations or routine maintenance. The federal share of project costs is generally 80%, but 90% for Interstate System projects. Nearly all highway funding comes from the Highway Trust Fund (HTF). The excise taxes on gasoline and diesel, which are the main support of the HTF, are fixed in terms of cents per gallon (18.3 cents for gasoline and 24.3 cents for diesel), and do not adjust for inflation or change with fuel prices. The rates were last raised in 1993. These taxes no longer raise enough money to support the programs Congress has authorized. Congressional Budget Office (CBO) projections estimate that the HTF shortfall for a five-year reauthorization bill, FY2021-FY2025, will be $68.8 billion, of which the highway portion will be $46.5 billion. The funding shortfall is a major issue framing the reauthorization debate. The FAST Act transferred $70 billion in general Treasury funds to the HTF, $51.9 billion of which were for highways. Congress could deal with the shortfall that is projected to persist over the coming years in three ways: again transfer money from the Treasury general fund; cut spending by roughly 25%; and raise revenue dedicated to the HTF. Widely discussed revenue options include increasing the rates of existing gasoline, diesel, and truck taxes or imposing new charges such as a vehicle miles traveled (VMT) charge. Other issues likely to be considered by Congress include the following: Whether any additional federal spending for highways should be distributed by formula, giving the states greater control, or through discretionary programs that distribute funds based on Administration or congressional priorities. Whether to retain the current highway funding formula, which links states' annual apportionments to their funding shares in past years, or to introduce such formula factors as each state's lane miles, population growth, or VMT. Whether to create stand-alone programs to address issues such as bridge conditions or climate change mitigation and adaptation. Whether the stand-alone National Highway Freight Program, a formula program that has been highly popular with the states, should be funded at a higher level relative to the other formula programs. Whether the Emergency Relief program should be expanded to cover a wider range of resilience needs. Whether states should be permitted to place tolls on free Interstate Highway lanes, and whether to regulate the use of tolls. The Senate Environment and Public Works Committee (EPW) reported the America ' s Transportation Infrastructure Act of 2019 (ATIA; S. 2302 ) on August 1, 2019 . The bill includes the highway elements of surface transport ation reauthorization under EPW' s jurisdiction. It is the only active FAST Act reauthorization bill to date.


According to IRS, TCJA was the most sweeping tax law change in more than three decades, with 86 provisions that modified, added to, or repealed business and international taxes, such as the qualified business income deduction. IRS determined it would take significant effort to implement the law given the limited time-frame and magnitude of the provisions. GAO was asked to review IRS's implementation of TCJA business and international provisions. Among other reporting objectives, this report examines IRS's (1) progress implementing the provisions, (2) processes to provide guidance, and (3) challenges for effectively administering these provisions. To address these objectives, GAO analyzed IRS documentation on project management, compliance planning, and regulation development. Additionally, GAO interviewed IRS officials and tax practitioners. The Internal Revenue Service (IRS) has made considerable progress issuing guidance to taxpayers for Public Law 115-97—commonly known as the Tax Cuts and Jobs Act of 2017 (TCJA)—but has additional work remaining to issue all planned guidance, as shown in the figure. To improve efficiency of TCJA guidance development, IRS internally collaborated earlier and more frequently than during more routine tax law changes. IRS officials said the benefits of this enhanced collaboration included faster decision-making on time-sensitive guidance, including regulations. IRS officials agreed enhanced collaboration had value but as of December 2019 had not identified the parameters for when this collaborative approach would be warranted. IRS may face challenges ensuring compliance with certain TCJA provisions because third-party information reporting is not always available. GAO's past work has found that one of the important factors contributing to the tax gap is the extent to which information is reported to IRS by third parties. Without third-party reporting, IRS will have to rely on resource-intensive audits to enforce certain TCJA provisions, which could be challenging given recent trends of declining audit rates and enforcement staff. GAO has recommendations from March 2019 for IRS to take actions to mitigate hiring risks and reduce skill gaps. IRS was also unable to update all information technology systems prior to the start of the 2019 tax season due to the magnitude of TCJA changes. As a result, IRS was not able to capture certain tax return information in a format that can be easily analyzed to help with compliance planning activities. One IRS division took steps to convert certain tax return data to a more useable format, but efforts to identify other viable opportunities have not been taken. Without appropriate data for analyses, IRS could face challenges enforcing certain TCJA provisions.