SBA Has Not Fully Addressed Deficiencies in Oversight and Implementation for the WOSB Program SBA has not fully addressed deficiencies we have previously identified for the WOSB program, and these deficiencies are affected by SBA’s ongoing implementation of changes to the program authorized by the National Defense Authorization Act of 2015 (2015 NDAA). As of early June 2019, SBA had implemented one of the three changes to the program authorized in the 2015 NDAA. Specifically, in September 2015 SBA published a final rule to implement sole-source authority (to award contracts without competition), effective October 2015. The two other changes—authorizing SBA to implement its own certification process for WOSBs and requiring SBA to eliminate the option for firms to self-certify that they are eligible for the WOSB program—had not been implemented. On May 14, 2019, SBA published in the Federal Register a proposed rule that eliminates the self-certification option and describes a potential certification process to be administered by SBA. SBA officials have stated that the agency will not eliminate self-certification until the new certification process for the WOSB program is in place, which they expect to implement by June 2021. In addition, SBA has not fully addressed WOSB program oversight deficiencies described in our March 2019 report and first identified in our 2014 report. We reported that SBA did not have formal policies for reviewing the performance of its four approved third-party certifiers (private entities approved by SBA to certify the eligibility of WOSB firms), including their compliance with their agreements with SBA. Further, we found that SBA had not developed formal policies and procedures for, among other things, reviewing the monthly reports that certifiers submit to SBA. We recommended that the Administrator of SBA establish comprehensive procedures to monitor and assess the performance of the third-party certifiers in accordance with their agreements with SBA and program regulations. While SBA has taken some steps to address our recommendation, including conducting a compliance review of the certifiers in 2016, SBA officials said in June 2018 that SBA had no plans to conduct further compliance reviews until the final rule implementing the new certification process was completed. By waiting to improve its oversight of the WOSB program, SBA cannot provide reasonable assurance that certifiers are complying with program requirements and cannot improve its efforts to identify ineligible firms or potential fraud. In addition, the implementation of sole-source authority in light of these continued oversight deficiencies can increase program risk. Consequently, we maintain that our recommendation should be addressed. SBA also has not fully addressed deficiencies related to eligibility examinations that we described in our March 2019 report and first identified in our October 2014 report. We found that SBA lacked formalized guidance for its eligibility examination processes and that the examinations identified high rates of potentially ineligible businesses. As a result, we recommended that SBA enhance its examination of businesses that register for the WOSB program to ensure that only eligible businesses obtain WOSB set-asides. Specifically, we suggested that SBA should take actions such as (1) completing the development of procedures to conduct annual eligibility examinations and implementing such procedures; (2) analyzing examination results and individual businesses found to be ineligible to better understand the cause of the high rate of ineligibility in annual reviews and determine what actions are needed to address the causes, and (3) implementing ongoing reviews of a sample of all businesses that have represented their eligibility to participate in the program. SBA has taken some steps to implement our recommendation, such as including written policies and procedures for WOSB program eligibility examinations in a standard operating procedure and a Desk Guide. However, SBA does not collect reliable information on the results of its annual eligibility examinations. In addition, SBA continues to have no mechanism to look across examinations for common eligibility issues to inform the WOSB program. As we noted in 2014, by not analyzing examination results broadly, the agency is missing opportunities to obtain meaningful insights into the program, such as the reasons many businesses are deemed ineligible. Further, SBA still conducts eligibility examinations only of firms that have already received a WOSB award. Restricting the samples in this way limits SBA’s ability to better understand the eligibility of businesses before they apply for and are awarded contracts, as well as its ability to detect and prevent potential fraud. We recognize that SBA has made some effort to address our recommendation by documenting procedures for conducting annual eligibility examinations of WOSB firms. However, without maintaining reliable information on the results of eligibility examinations, developing procedures for analyzing results, and expanding the sample of businesses to be examined to include those that did not receive contracts, SBA limits the value of its eligibility examinations and its ability to reduce ineligibility among businesses registered to participate in the WOSB program. Leading fraud risk management practices state that federal program managers should design control activities that focus on fraud prevention over detection and response, to the extent possible. The deficiencies in SBA’s oversight of the WOSB program limit SBA’s ability to identify potential fraud risks and develop any additional control activities needed to address these risks. As a result, the program may continue to be exposed to the risk of ineligible businesses receiving set- aside contracts. In addition, in light of these continued deficiencies, the implementation of sole-source authority without addressing the other changes made by the 2015 NDAA could increase program risk. For these reasons, we maintain that our previous recommendation that SBA enhance its WOSB eligibility examination procedures should be addressed. In addition, similar to previous findings from SBA’s Office of Inspector General, our March 2019 report found that about 3.5 percent of contracts using a WOSB set-aside were awarded for ineligible goods or services from April 2011 through June 2018. At that time, SBA was not reviewing contracting data that could identify this problem and inform SBA which agencies making awards may need targeted outreach or training. As a result, we found that SBA could not provide reasonable assurance that WOSB program requirements were being met and that the program was meeting its goals. We recommended that SBA develop a process for periodically reviewing the extent to which WOSB program set-asides are awarded for ineligible goods or services and use the results to address identified issues, such as through targeted outreach or training to agencies making awards under the ineligible codes. In early May 2019, SBA said that it had initiated such efforts. SBA Has Not Yet Implemented Recommendations to Improve the HUBZone Certification Process In September 2018, we found that although SBA had adopted criteria and guidance for a risk-based approach to certifying and recertifying firms for the HUBZone program in March 2017, the extent to which it conducted a risk assessment to inform its approach was unclear. In 2015, we found that SBA lacked key controls for its recertification process and recommended that SBA assess the process. In 2009, SBA increased documentation requirements for certification but not recertification (which determines continued program eligibility every 3 years). In March 2017, SBA changed its recertification criteria and guidance to require firms with $1 million or more in HUBZone contract awards to provide documentation to support continuing eligibility. During our work for the September 2018 report, SBA officials stated they had completed a risk assessment of the HUBZone recertification process, but did not provide us with documentation on when they performed the risk assessment, which risks were identified and considered, or what analysis established the $1 million threshold. As of May 2019, SBA had not provided documentation showing that it had performed the risk assessment, but we maintain that an assessment of the recertification process would help inform a risk- based approach to reviewing and verifying information from firms that appear to pose the most risk to the program. In addition, SBA had not provided documentation showing that a technology-based solution designed to address some of the ongoing challenges with the recertification process had been implemented. SBA officials had previously estimated this solution would be available first in spring 2017 and then by the end of calendar year 2017. We also found in our September 2018 report that, based on our review of case files for a nongeneralizable sample of 12 firms in Puerto Rico that received HUBZone certification between March 2017 and March 2018, SBA did not consistently document or follow its policies and procedures for certification reviews: SBA did not have complete documentation in nine of 12 cases. SBA officials described alternative procedures they used to determine firms’ eligibility, but SBA had not updated its internal policy manuals to reflect these procedures, and analysts did not document use of such procedures in the files we reviewed. As a result, SBA did not have reasonable assurance that firms met HUBZone criteria. In four of 12 cases, SBA did not follow its policy to conduct three levels of review (by an analyst, a senior analyst, and the program director or deputy) when determining whether to approve or deny a firm. It was unclear to what extent SBA reviewed staff compliance with certification and recertification review procedures. SBA provided an assurance letter stating that it evaluated the Office of HUBZone’s internal controls and concluded the controls were effective, but the letter did not specify what steps SBA took for the evaluation. We recommended that SBA (1) update its internal policy manuals for certification and recertification reviews to reflect existing policies and procedures not currently in written guidance and (2) conduct and document reviews of staff compliance with procedures associated with HUBZone certification and recertification. In response to our report, SBA said that it planned to update its internal policies on certification and recertification by issuing a procedural notice and to begin reviewing and documenting staff compliance with the updated procedures outlined in the notice. However, as of May 2019, SBA had not provided documentation showing that it had completed these planned actions. SBA Has Taken Some Steps to Address Recommendations about the Procurement Scorecard In September 2018, we found that for fiscal year 2017, SBA revised the methodology for its Small Business Procurement Scorecard, which is used to assess federal agencies’ progress toward small business procurement goals. SBA made revisions to address requirements specified in the National Defense Authorization Act for Fiscal Year 2016. SBA (1) reduced the share of the total scorecard grade devoted to prime contracting achievement, which is the dollar amount of contracts awarded directly to small businesses, and (2) added an element calculating changes in the number of small businesses receiving prime contracts. SBA made two additional revisions—with input from other agencies’ representatives—to increase the share of subcontracting achievement results and the share of the peer review of required activities designed to facilitate small business procurement. In July 2018, officials said they had begun developing a plan to evaluate the effects of the revised scorecard methodology but did not provide a draft plan. Conducting a well-designed and comprehensive evaluation could aid SBA in determining whether the scorecard is an effective tool for helping to achieve the agency’s strategic goals. In our September 2018 report, we also found that the published fiscal year 2017 scorecards originally contained errors, including an incorrect grade and numeric score for one agency, and SBA does not have a process to ensure that scorecard results are published accurately. Although SBA later corrected the errors, it did not initially document that scorecards had been changed, which is inconsistent with SBA’s policy on information quality. SBA officials said that errors occurred in the process of formatting scorecards for publication. Errors in the published scorecards—and the initial lack of disclosure about corrections—weaken data reliability and may undermine confidence in scorecard data. We recommended that SBA (1) design and implement a comprehensive evaluation to assess scorecard revisions and (2) institute a process for reviewing scorecards for accuracy prior to publication and a mechanism for disclosing corrected information. Since our report, SBA has proposed a two-phase program evaluation of the scorecard. SBA officials said that they plan for phase one to include a report to Congress on the impact of the small business procurement goal program for Chief Financial Officers Act agencies and to provide a recommendation on continuing, modifying, expanding, or terminating the scorecard program. SBA plans to provide the phase one report in September 2019. In phase two, SBA plans to conduct a program evaluation that investigates the effectiveness of the small business contracting scorecard on federal agency small business contracting goal achievement. SBA has not provided a time frame for phase two. With respect to the second recommendation, SBA officials said that SBA has developed a procedure that includes a prepublication review process for procurement scorecards. The officials said the procedure identifies responsibilities, provides for an independent peer review, and includes supervisory review. Officials said the procedure also includes measures for post-publication review and corrections. We will review supporting documentation for this new procedure to assess whether this recommendation can be closed as implemented. Chairman Rubio, Ranking Member Cardin, and Members of the Committee, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time. GAO Contact and Acknowledgments If you or your staff have any questions about this testimony, please contact William Shear, Director, Financial Markets and Community Investment at (202) 512-8678 or shearw@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. GAO staff who made key contributions to this testimony are Andrew Pauline (Assistant Director), Paige Smith (Assistant Director), Winnie Tsen (Assistant Director), and Jennifer Schwartz. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.


SBA’s STEP Grants Management Process Does Not Provide Reasonable Assurance of Compliance with Some Requirements of Applicable Law Our report found that SBA’s STEP grants management process does not provide reasonable assurance that STEP grant recipients meet two of the three TFTEA requirements we reviewed before the grant is closed out. TFTEA contains specific requirements for STEP, including: Proportional distribution requirement. SBA must distribute grant funds in a way that caps the amount of grant funds distributed to the 10 states with the largest numbers of eligible small businesses at 40 percent of the total amount awarded each year. This requirement ensures that states with fewer eligible small businesses receive funding, and is known as the “proportion of amounts” clause in the law. Total match requirement. States must provide either a 25 percent or 35 percent nonfederal total match to the federal grant amount. Cash match requirement. A state’s match cannot be less than 50 percent cash. SBA’s Process Provides Reasonable Assurance of Compliance with TFTEA’s Proportional Distribution Requirement First, we found that OIT has established a process for ensuring compliance with the TFTEA requirement outlined in the “proportion of amounts” clause of the statute. OIT officials told us they review data from the Department of Commerce’s Census Bureau that show the number of exporting small and medium-sized businesses in each state, and then use these data to determine the top 10 states. According to OIT officials, they use the most recent data available, with an approximately 2- to 3- year lag. OIT officials told us that they planned to use available 2016 Census data to determine the top 10 states for the fiscal year 2018 award cycle and then, after receiving applications, determine award amounts that would comply with this requirement. SBA’s Review Process Did Not Document that States Met TFTEA’s Total Match Requirement before Grant Closeout Second, we found SBA’s process did not document that states met TFTEA’s total match requirement before grant closeout. TFTEA requires that states provide matching funds, and the total match is typically 25 percent of the combined state-federal amount. At least half of the total match must be cash. Matching share requirements are often intended to ensure local financial participation, and may serve to hold down federal costs. If SBA determines that a state is not providing sufficient matching funds, it can withhold reimbursement for expenses incurred under the grant. Figure 1 illustrates the STEP funding proportions described above. In our report, we identified four instances where, according to OIT’s documentation, states reported insufficient total matches—one in fiscal year 2015 and three in fiscal year 2016. OIT’s documentation showed that these four states failed to meet the required total matching funds by about $76,000 combined over these 2 years of the program. SBA told us they nevertheless had closed these grants. OIT officials provided several explanations for their actions. First, OIT officials told us that of these four states, two submitted additional information after the grant had closed, indicating that the states had met the matching requirement. OIT officials stated that they did not verify the accuracy of the total match information before grant closure because of OIT staff error. With respect to the other two states, OIT initially stated that it was working with OGM to verify that the total match requirement had not been met, and how best to recover the funds. Subsequently, OIT reported OGM’s determination that one state had in fact met the match requirement, but that the other had not. In the case of the state that did not meet the requirement, OGM determined that SBA had overpaid federal funds to that state by about $19,600. However, after contacting the state and looking into the matter further, OGM conducted a review of quarterly reporting documentation for this state, and determined that the state had in fact exceeded its required match by about $3,800. Though all four of the states initially identified were eventually determined to have met the total match requirement, SBA did not have an adequate process in place to ensure documentation of a full match before grant closeout. Federal internal control standards state that management should design control activities. By designing and executing appropriate control activities, management helps fulfill its responsibilities and address identified risks in the internal control system. Without a process for effectively documenting that the total match requirement has been met and reviewing this documentation before grant closeout, SBA does not have reasonable assurance that states have complied with TFTEA’s total match requirement, and risks overpayment of federal funds. SBA Does Not Monitor States’ Compliance with TFTEA’s Cash Match Requirement Third, we found that OIT’s process does not provide reasonable assurance that states have complied with the TFTEA cash match requirement. As previously noted, TFTEA requires that states provide at least half of their total match in the form of cash. TFTEA allows for the remaining half to be any mixture of cash, in-kind contributions, and indirect costs. OIT collects information about the types of expended matching funds, including the proportion provided in cash; however, OIT does not have a process in place to use this information to monitor states’ compliance with this requirement. OIT documents show that while proposed cash match amounts are recorded, OIT does not track or analyze states’ expended cash matching funds during or at the close of the grant cycle. OIT officials told us that this information is included in the states’ quarterly detailed expenditure worksheets, and therefore can be reviewed for compliance on a case-by- case basis. However, OIT program officials told us that they do not regularly analyze this information to determine what proportion of the total match the cash portion constitutes. The program’s authorizing legislation does not define “cash,” and neither does the Uniform Guidance. OIT considers the salaries of state trade office staff who work on administering the grant to be a form of cash and, according to OIT officials, most states use state staff salaries as their total match, including the required cash portion. In addition, we found that OIT does not have a process for ensuring that states reporting staff salaries as their required cash match are not also using grant funds from STEP to pay for portions of these same salaries. As such, SBA cannot consistently determine whether states are meeting the TFTEA cash match requirement, and risks closing out grants for which states have not met the cash match requirement. Using part of the grant to cover the cost of the state’s matching requirement in this way could have the effect of reducing the match below the thresholds mandated by TFTEA. In our discussions with officials from 12 low-use states that received STEP grants in fiscal year 2015, 2 states reported using the grant to offset state staff salaries. When we asked OIT officials what process they had in place to determine whether states were using staff salaries paid for with STEP funds as part of their match amount, OIT officials told us that they were not aware that STEP grantees had engaged in this practice, and therefore did not monitor for it. SBA’s grants management standard operating procedure states that the agency should monitor grantees for compliance with the terms and conditions of the awards, which includes compliance with applicable federal law. Further, according to federal standards for internal control, management should design and execute control activities, and use quality information to achieve the entity’s objectives. Management should process reliable data into quality information to make informed decisions and evaluate the entity’s performance in achieving key objectives and addressing risks. Without processes to review whether states are meeting the cash match requirement, OIT is not implementing its responsibilities under SBA’s standard operating procedure because it cannot consistently determine whether states are meeting this requirement. Without making such a determination, SBA does not have reasonable assurance that states are contributing to the program as required by STEP’s authorizing statute. In our report, we recommended that the SBA Administrator should establish a process that ensures documentation of states’ compliance with the total match requirement before grant closeout, and develop a process to determine states’ compliance with the cash match requirement. SBA agreed with these recommendations. Some States Report Challenges to Using Grant Funds and SBA Has Not Adequately Assessed Risk to Program from Low Grant Use Next, we looked at STEP’s grant use rate. In our report, we found that nearly 20 percent of grant funds go unused each year, despite OIT officials stating that they seek 100 percent use of grant funds. Specifically: 2015. Across all 40 recipient states, combined grant use was 81 percent, leaving 19 percent, or nearly $3.4 million, unused. This included one state that left 77 percent, or over $432,000, of its funds unused that year. 2016. Across 41 of the 43 recipient states, combined grant use was 82 percent, leaving 18 percent, or nearly $3.2 million, unused. This included one state that left nearly 95 percent, or nearly $184,000, of its funds unused that year. We found that OIT made some changes to the program that could improve states’ ability to use all their grant funds. Changes included: (1) Extending funds usage period to 2 years. This change allows an additional 4 quarters to conduct program activities, which, in turn, may help enable states to use the full amount of their grant funding and achieve performance targets. (2) Eliminating travel preauthorization requirement. This change may reduce the administrative burden on state trade office staff and allow greater flexibility to use grant funds when opportunities that require travel arise with limited notice. (3) Reducing the length of the technical proposal. This change may help to streamline the program’s application paperwork. Some States Cited Challenges with the Program We interviewed officials from low-use states to identify the continuing challenges they faced. We grouped the most commonly reported challenges into the following categories: (1) Timing of the application and award processes. State officials discussed the variable and short application timeframes, and said that the award announcement happening close to the start of the grant period can make it difficult to use funds during the 1st quarter of the period. (2) Administrative burden. State officials described challenges due to inflexible application requirements, a difficult process for repurposing funds, and burdensome and changing reporting requirements. (3) Communication. State officials told us this was a challenge because of delays and inconsistent communication of requirements from OIT. SBA Has Not Adequately Assessed Risk to Achieving Program Goals or Effectively Shared Best Practices In our report, we found that OIT had not assessed and fully addressed the risk posed by some states’ low use of funds. OIT officials told us that while they informally collect feedback from states, there is no systematic process to collect states’ perspectives on challenges with the program, including obstacles to their ability to use funds. Officials said that they seek 100 percent use for each state that receives an award, as well as for the program as a whole. Federal internal control standards specify that agency leadership should define program objectives clearly to enable the identification of risks and define risk tolerances in order to meet the goals of the program’s authorizing legislation. In addition, OIT has no systematic process to share best practices with sufficient detail that states struggling to use their STEP funds might apply those practices to improve their own programs. TFTEA requires SBA to publish an annual report regarding STEP, including the best practices of those states that achieve the highest returns on investment and significant progress in helping eligible small businesses. While 12 states used 75 percent or less of their grant funds in the fiscal year 2015 cycle, 19 states used all or almost all of their funds. SBA publishes high-level information on what it deems to be notable state activities in its annual report to Congress. OIT officials told us that, when possible, they share best practices with states that may have difficulty accessing external markets. However, OIT officials told us that they do not formally facilitate the sharing of best practices among the states, saying that best practices for promoting exports in one state might not be transferable to another state because each state is unique. According to the Uniform Guidance, grant recipients’ performance should be measured in a way that helps the federal awarding agency and other nonfederal entities improve program outcomes, share lessons learned, and spread the adoption of promising practices. We have also previously reported on the importance of collecting and sharing best practices, as well as the processes for doing so. By sharing detailed information with all participating states about the approaches that some grant recipients are using to successfully achieve STEP’s goals, SBA could encourage all grant recipients to improve the effectiveness of their state STEP programs, including increasing fund use rates in pursuit of OIT’s stated aim of 100 percent grant fund use. In our report, we recommended that the SBA Administrator assess the risk to achieving program goals posed by some states’ low grant fund use rates, and that assessing this risk could include examining the challenges that states reported related to the program’s application and award processes, administrative burden, and communication. We also recommended that SBA enhance collection and sharing of best practices among states that receive STEP grant funds. SBA agreed with these recommendations. Chairwoman Finkenauer, Ranking Member Joyce, and Members of the Subcommittee, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time. GAO Contact and Staff Acknowledgments If you or your staff have any questions about this statement, please contact me at (202) 512-8612 or gianopoulosk@gao.gov. Contacts for our Offices of Congressional Relations and Public Affairs are on the last page of this testimony. GAO staff who made key contributions to this statement are Adam Cowles (Assistant Director), Cristina Ruggiero (Analyst in Charge), Martin de Alteriis, Mark Dowling, Jesse Elrod, John Hussey, and Christopher Keblitis. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.


Scope and Methodology As part of our audit of the fiscal years 2018 and 2017 CFS, we considered the federal government’s financial reporting procedures and related internal control. Also, we determined the status of corrective actions Treasury and OMB have taken to address open recommendations relating to their processes to prepare the CFS, detailed in our previous reports that remained open as of the completion of our fiscal year 2017 audit. A full discussion of our scope and methodology is included in our March 2019 report on our audit of the fiscal years 2018 and 2017 CFS. We have communicated each of the control deficiencies discussed in this report to your staff. We performed our audit in accordance with U.S. generally accepted government auditing standards. We believe that our audit provides a reasonable basis for our findings and recommendations in this report. Control Deficiencies Identified during Our Fiscal Year 2018 Audit During our audit of the fiscal year 2018 CFS, we identified three new internal control deficiencies in Treasury’s processes used to prepare the CFS. Specifically, we found that (1) Treasury did not have sufficient procedures to analyze and determine whether appropriate disclosures related to new federal accounting standards were included in the draft fiscal year 2018 Financial Report; (2) Treasury did not have sufficient procedures to properly support and consistently report restatements, reclassifications, and adjustments to beginning net position reported in the draft fiscal year 2018 Financial Report; and (3) Treasury and OMB did not have adequate processes and procedures for reporting appropriate information regarding legal contingency losses in the fiscal year 2018 CFS. New Federal Accounting Standards During our fiscal year 2018 CFS audit, we found that Treasury did not have sufficient procedures to analyze and determine whether appropriate disclosures related to new federal accounting standards were included in the draft fiscal year 2018 Financial Report. Treasury uses working groups, disclosure checklists, and other tools to assist in determining appropriate reporting in accordance with new standards. Treasury’s procedures include working with federal entities during the fiscal year to determine the reporting required based on new standards. Treasury presents the new standards for discussion at monthly Central Reporting Team meetings that include financial reporting representatives from federal entities. Treasury also establishes working groups for certain new standards, such as the working group established for the Federal Accounting Standards Advisory Board’s (FASAB) Statement of Federal Financial Accounting Standards (SFFAS) 47, Reporting Entity, to work with federal entities on their implementation. Treasury also utilizes a financial reporting disclosure checklist to help determine that all disclosures required by FASAB standards are included in the CFS. Treasury updates this disclosure checklist throughout the fiscal year and completes the checklist as a key focus of the CFS compilation process. Although Treasury has processes in place for the implementation of new standards, certain disclosures required by new standards were not included in the draft fiscal year 2018 Financial Report. For example, the draft fiscal year 2018 Financial Report did not include disclosures related to federal government land assets, such as the number of acres held at the end of each reporting period, explanations of federal entities’ election to include or exclude land and land rights from their opening balances, and a reference to the component reporting entity’s financial report, as required by SFFAS 50, Establishing Opening Balances for General Property, Plant, and Equipment. In addition, the draft fiscal year 2018 Financial Report did not include disclosures related to significant component entity amounts included in certain CFS line items that were determined in accordance with Financial Accounting Standards Board (FASB) standards rather than FASAB standards, in accordance with SFFAS 47. SFFAS 34, The Hierarchy of Generally Accepted Accounting Principles, Including the Application of Standards Issued by the Financial Accounting Standards Board, provides that general purpose federal financial reports prepared in conformity with accounting standards issued by FASB also may be regarded as in conformity with U.S. generally accepted auditing principles (U.S. GAAP). SFFAS 47 permits the consolidation of amounts determined in accordance with FASAB and FASB standards into a single line item without conversion for differences in accounting policies and also provides application guidance that emphasizes the need for disclosures of the different accounting policies and the related amounts to aid financial statement users’ understanding of the information provided. Treasury’s disclosure checklist was not updated in sufficient detail for Treasury accountants to identify appropriate disclosures for inclusion in the draft fiscal year 2018 Financial Report in accordance with these new federal accounting standards. The updated disclosure checklist used for fiscal year 2018 did not include (1) specific details about disclosures required by SFFAS 50 for land assets, such as the number of acres added or disposed of during the reporting period, and (2) questions to help determine the need for disclosures to communicate the effect on certain CFS line items that include material amounts determined using accounting policies in accordance with FASB standards rather than FASAB standards, as SFFAS 47 allows. Also, Treasury did not calculate in aggregate the amounts that are reported in the CFS on a FASB basis by line item in order to determine line items where the disclosures were needed. We communicated these matters to Treasury officials, who conducted a comprehensive analysis and included disclosures in the final fiscal year 2018 Financial Report, as appropriate. In addition, although Treasury established a working group to help implement SFFAS 47, Treasury’s procedures did not provide for sufficient consultation with technical experts in interpreting new standards and updating the disclosure checklist to reasonably assure that all requirements related to the new standard were incorporated during implementation. Actively consulting with technical experts, such as members of FASAB, the body designated as the source of U.S. GAAP for federal reporting entities, would help minimize the risk of misinterpreting the standards or presenting and disclosing information in the Financial Report that is incorrect, inconsistent, or incomplete. Standards for Internal Control in the Federal Government states that one of the key objectives of an organization’s internal control over financial reporting is to provide reasonable assurance as to the reliability of its financial reporting, including its financial statements and note disclosures. Accompanying notes are an integral part of financial statements and provide additional disclosures that are necessary to make the financial statements more informative. Without sufficient procedures for analyzing and determining the appropriate reporting of disclosures required by new federal accounting standards, Treasury cannot reasonably assure that disclosures included in the Financial Report are reliable and complete. Recommendation for Executive Action We recommend that the Secretary of the Treasury should ensure that the Fiscal Assistant Secretary develops and implements procedures to enhance Treasury’s processes for reasonably assuring that the Financial Report includes disclosures required by new federal accounting standards, such as conducting an appropriate level of analysis to determine whether disclosures are needed, consulting with technical experts, and including additional details on these requirements in its financial reporting disclosure checklists. (Recommendation 1) Restatements, Reclassifications, and Adjustments to Beginning Net Position During our fiscal year 2018 CFS audit, we found that Treasury did not have sufficient procedures to properly support and consistently report restatements, reclassifications, and adjustments to beginning net position in the draft fiscal year 2018 Financial Report. Treasury identifies changes to prior year amounts (either restatements or reclassifications) and adjustments to current year beginning net position based on its review of information that significant component entities submit to Treasury and applicable FASAB standards. Treasury also performs procedures to determine the consistency of such reporting with significant component entities’ audited financial statements. Treasury’s Subject Matter Analysis standard operating procedure includes steps for Treasury’s staff to obtain financial information from significant component entities and to prepare the draft Financial Report. According to these procedures, Treasury’s staff uses third quarter financial data that significant component entities report and other information to obtain a preliminary understanding of potential changes to prior year amounts and adjustments to beginning net position. Treasury’s staff compares these preliminary results to the entities’ year-end information and compares beginning net position amounts reported for the current year to ending net position amounts reported the prior year to identify changes to prior year amounts. The staff then prepares a table categorizing such changes as restatements, reclassifications, or adjustments to beginning net position. This table includes a separate line for each of the significant component entities but does not include separate lines for each line item or note disclosure affected. Treasury uses this table to prepare a summary analysis of its conclusions for reporting restatements, reclassifications, and adjustments to beginning net position and related note disclosures presented in the draft Financial Report. The subject area manager reviews the results of the procedures that Treasury’s staff performed and documented. Although Treasury’s staff followed these procedures for fiscal year 2018, we found that Treasury did not always maintain sufficient support for restatements, reclassifications, and adjustments to beginning net position included in the draft fiscal year 2018 Financial Report. For example, Treasury reported an adjustment to beginning net position but did not identify errors made in prior years to support such an adjustment. Treasury also reported that restatements affected the Statement of Changes in Cash Balance from Budget and Other Activities, but supporting documentation provided by Treasury for the draft fiscal year 2018 Financial Report did not clearly indicate how this statement was affected by restatements. Treasury included a summary of significant accounting policies in Note 1 to the CFS as required by U.S. GAAP, which contained information about restatements, reclassifications, and adjustments to beginning net position. However, Treasury did not disclose consistent information in related line item notes, such as those for loans receivable and loan guarantee liabilities, federal employee and veteran benefits payable, and funds from dedicated collections in the draft fiscal year 2018 Financial Report. Treasury included information in its summary analysis and supporting documentation that was not consistent with information that significant component entities reported. Although Treasury’s processes did not identify these inconsistencies, Treasury corrected them in response to our questions. We found that Treasury did not identify these inconsistencies, in part, because its subject matter review procedures did not include steps for coordinating with Treasury managers of other subject matter areas to reasonably assure consistency and appropriate support for conclusions. Also, although Treasury’s process involved preparing a summary of analyses performed, Treasury’s process did not include steps or other tools to reasonably assure that consistent information was communicated in all financial statement line items and note disclosures affected by restatements, reclassifications, and adjustments to net position. SFFAS 21, Reporting of Corrections of Errors and Changes in Accounting Principles, requires that reporting entities restate prior period financial statements for material errors discovered in the current period, if such statements are provided for comparative purposes and if the effect of an error would be material to the financial statements in either period. If not material, corrections should be made to the beginning balance of cumulative results of operations in the statement of changes in net position. A reclassification is the movement of a prior year amount in comparative financial statements in order to conform to the current year presentation. Standards for Internal Control in the Federal Government states that management should (1) design control activities to achieve objectives and respond to risks, such as procedures to help reasonably assure that financial information is completely and accurately reported, and (2) implement control activities, such as documenting responsibilities through policies and procedures. Management should periodically review policies, procedures, and related control activities for continued relevance and effectiveness in achieving objectives. Without sufficient procedures for reporting restatements, reclassifications, and adjustments to beginning net position, there is an increased risk of presenting information that is inaccurate or incomplete in the Financial Report. Recommendations for Executive Action We are making the following two recommendations to Treasury: The Secretary of the Treasury should ensure that the Fiscal Assistant Secretary enhances existing procedures for Treasury management to perform additional reviews for restatements, reclassifications, and adjustments to beginning net position to reasonably assure that they are properly supported and accurately reported. (Recommendation 2) The Secretary of the Treasury should ensure that the Fiscal Assistant Secretary develops and implements steps to reasonably assure that restatements, reclassifications, and adjustments to beginning net position are consistently reported in the Financial Report, such as developing a tool that identifies all affected financial statement line items and note disclosures. (Recommendation 3) Contingencies for Legal Representation Letters During our fiscal year 2018 CFS audit, we found that Treasury and OMB did not have adequate processes and procedures for reporting appropriate information regarding legal contingency losses in the fiscal year 2018 CFS. Significant component entities are responsible for properly accounting for and reporting legal contingency losses in their entity-level financial statements and submitting this information to Treasury for inclusion in the CFS. For each entity-level financial statement audit, U.S. generally accepted government auditing standards require that component entity auditors obtain written legal representations as part of the audit. The significant component entities provide interim and final legal representation letters, along with management schedules, to Treasury, the Department of Justice (DOJ), and GAO. According to DOJ’s established process, its legal counsel reviews individual cases included in these legal representation letters for which the potential loss exceeds $500 million individually or in the aggregate for similar cases. DOJ is responsible for preparing and submitting an interim and final government-wide legal representation letter to Treasury and GAO, containing its assessment of the potential litigation losses, including whether there are litigation, claims, or assessments that were not addressed in the significant component entities’ legal representation letters that DOJ believes should have been reported or which DOJ believes should have been reported differently. Treasury’s procedures call for it to determine whether the financial statement information that the significant component entities submitted and Treasury used to compile the fiscal year 2018 CFS is consistent with the significant component entities’ management schedules, legal representation letters, and the government-wide legal representation letter. For fiscal year 2018, Treasury identified various inconsistencies among the significant component entities’ financial statement information, management schedules, and legal representation letters as well as inconsistencies between the government-wide legal representation letter and the significant component entities’ management schedules and legal representation letters. There may be appropriate reasons for these differences. For example, although management often relies on advice of legal counsel on the likelihood of loss and estimate of the amount or range of potential loss, as reflected in the legal representation letter, management is ultimately responsible for determining whether the loss should be recognized as a liability or disclosed in the notes to the financial statements. As such, management may make a different determination as to the likelihood of loss or estimated loss amounts than those in the legal counsel’s assessment. Also, differences between the government-wide legal representation letter and the significant component entities’ legal representation letters can occur in situations in which DOJ has more current information on the likelihood of loss and estimated loss amounts. However, Treasury was not always able to timely determine whether there were appropriate reasons for the differences it identified or whether adjustments were needed to the legal contingency loss information reported in the fiscal year 2018 CFS. Based on our work, we found that certain of these differences required correction in the fiscal year 2018 CFS. For example, Treasury noted that one significant component entity included estimated loss amounts for reasonably possible cases in its management schedule and that such amounts were not reported in the financial information provided to Treasury for consolidation. Because Treasury was unable to timely resolve the issue, the fiscal year 2018 CFS was not appropriately adjusted to include these amounts. Further, DOJ did not provide us the final government-wide legal representation letter as of our audit completion date. Although Treasury has procedures for reviewing and analyzing the significant component entities’ legal contingency loss information and the government-wide legal representation letter, we found that Treasury lacked effective processes and procedures to reasonably assure that appropriate information regarding legal contingency losses was reported in the fiscal year 2018 CFS. Specifically, Treasury did not have sufficient processes and procedures to obtain the needed information in a manner that would facilitate the timely compilation of the legal contingency loss information for inclusion in the fiscal year 2018 CFS or for timely resolving issues identified during its review. For example, as part of Treasury’s procedures, it compares the estimated loss amounts for reasonably possible and probable cases included in the significant component entities’ management schedules with the financial statement information that the significant component entities report for inclusion in the fiscal year 2018 CFS. If discrepancies are greater than 10 percent, Treasury’s procedures call for significant component entities to provide an explanation. However, because of the extensive amount of time needed to perform this analysis, Treasury was not always able to timely follow up and resolve the differences with the significant component entities. SFFAS 5, Accounting for Liabilities of The Federal Government, as amended by SFFAS 12, Recognition of Contingent Liabilities Arising from Litigation, contains accounting and reporting standards for loss contingencies, including those arising from litigation, claims, and assessments. An entity should recognize a liability and a related charge to expense for an estimated loss from a loss contingency only when (1) a past event or exchange transaction has occurred, (2) a future outflow or other sacrifice of resources is probable, and (3) the future outflow or sacrifice of resources is measurable. A contingent liability should be disclosed if any of the conditions for liability recognition are not met and there is at least a reasonable possibility that a loss or an additional loss may have been incurred. Disclosure should include the nature of the contingency and an estimate of the possible liability, an estimate of the range of possible liability, or a statement that such an estimate cannot be made. OMB Bulletin 19-01 provides guidance to federal agencies on the preparation of legal letters and management schedules, and the Treasury Financial Manual provides federal agencies the legal letter reporting requirements. Also, Standards for Internal Control in the Federal Government provides that management should design control activities to achieve objectives and respond to risks. For example, management should design control activities so that financial information is completely and accurately reported. Until the federal government implements effective processes and procedures to obtain and assess information regarding legal contingency losses, the reliability of amounts and disclosures associated with legal loss contingencies reported in the CFS and the ability to assess their potential effect on the financial condition of the federal government will be limited. Recommendation for Executive Action We recommend that the Secretary of the Treasury should ensure that the Fiscal Assistant Secretary, working in coordination with the Controller of OMB, establishes effective processes and procedures to reasonably assure that appropriate information regarding legal contingency losses is reported in the CFS. (Recommendation 4) Status of Recommendations from Prior Reports At the completion of our fiscal year 2017 audit, 14 recommendations were open from our prior reports regarding control deficiencies in the processes used to prepare the CFS. During our fiscal year 2018 CFS audit, we found that Treasury, in coordination with OMB, implemented corrective actions that resulted in significant progress in resolving certain of the control deficiencies addressed by our prior recommendations. For two recommendations, the corrective actions resolved the related control deficiencies, and we closed the recommendations. While progress was made, 12 recommendations from our prior reports remained open as of March 20, 2019, the date of our report on the audit of the fiscal year 2018 CFS. These continuing control deficiencies contributed to the three material weaknesses that relate to the federal government’s processes used to prepare the CFS. Consequently, a total of 16 recommendations need to be addressed—12 remaining from prior reports and the four new recommendations we are making in this report. Appendix I summarizes the status as of March 20, 2019, of the 14 open recommendations from our prior years’ reports according to Treasury and OMB, as well as our own assessment and additional comments, where appropriate. Various efforts are under way to address these recommendations. As part of our fiscal year 2019 CFS audit, we will continue to monitor Treasury’s and OMB’s progress in addressing our recommendations. Agency Comments and Our Evaluation Treasury Comments We provided a draft of this report to Treasury for comment. In its written comments, reproduced in appendix II, Treasury concurred with our four new recommendations. Treasury agreed that new processes and procedures would enhance its internal controls over the processes used to prepare the CFS. It also described actions it will take, and has taken, to address these recommendations as well as certain open recommendations from our prior reports that are summarized in appendix I of this report. Treasury also provided technical comments, which we incorporated as appropriate. Treasury stated that it implemented process improvements that addressed three of the new recommendations, which resulted from our review of the draft fiscal year 2018 Financial Report, prior to the publication of the final report. These three recommendations are aimed at enhancing Treasury’s processes related to (1) including appropriate disclosures required by new federal accounting standards in the Financial Report and (2) supporting and consistently reporting restatements, reclassifications, and adjustments to beginning net position. In our report, we acknowledged that Treasury addressed the need for certain additional disclosures related to new federal accounting standards and inconsistencies related to restatements, reclassifications, and adjustments to beginning net position in the final fiscal year 2018 Financial Report. However, addressing the specific issues we identified in the draft fiscal year 2018 Financial Report does not fully address our recommendations and Treasury did not provide sufficient documentation supporting its efforts to develop and implement or enhance procedures or other steps to reasonably assure that the Financial Report is complete and accurate related to these areas. Treasury also stated that it will work on addressing the remaining recommendation. Regarding five open recommendations from our prior year reports related to treaties and other international agreements, Treasury stated that its existing controls provide reasonable assurance that there are no material misstatements in the Financial Report and that it worked with federal entities in fiscal year 2018 to obtain reasonable assurance that proper amounts and disclosures are reported as commitments and contingencies. As noted in appendix I, Treasury established three broad categories to help agencies in classifying treaties and other international agreements with respect to their potential financial implications. The establishment of three standard categories provides some guidance for identifying and reporting treaties and other international agreements; however, as stated in appendix I, we continue to believe further guidance is needed to determine whether additional disclosure in the CFS is required by U.S. GAAP. The guidance should be consistent with FASAB standards and provide procedures for identifying and assessing all treaties and other international agreements for potential contingencies. Treasury also stated that its efforts to validate the material completeness of budgetary information included in the Financial Report and verify the consistency of such information with federal entity reports are sufficient to address the two open recommendations from our prior year reports related to the Reconciliations of Net Operating Cost and Budget Deficit and the Statements of Changes in Cash Balance from Budget and Other Activities (Reconciliation Statements). As noted in appendix I, Treasury has improved its process by documenting its detailed analyses related to the accrual-based and cash-based effects of federal entities’ transactions included in net operating cost and the budget deficit and by continuing to identify items needed to prepare the Reconciliation Statements. However, as noted in appendix I, we continue to believe additional work is needed to (1) reconcile line items to audited federal entity financial statements and (2) determine the appropriate presentation for the reconciling items, which could affect the line items included. Treasury stated that it appreciates our perspective and will continue to focus its efforts on cost-beneficial solutions to resolve the material conditions that preclude having an opinion rendered on the CFS. Treasury also indicated that it plans to work with GAO as it fulfills its commitment to improving federal financial reporting. As part of our fiscal year 2019 CFS audit, we will determine the status of corrective actions to address the four new recommendations made in this report and the 12 remaining open recommendations from our prior year reports. OMB Comments We provided a draft of this report to OMB for comment. In oral comments, OMB staff in the Office of Federal Financial Management stated that OMB generally agreed with the draft report and Treasury’s written response. OMB noted that the current administration is committed to continuing to work with Treasury and federal agencies to achieve sound financial management across the federal government. This report contains three recommendations to the Secretary of the Treasury and one recommendation to the Secretary of the Treasury, working in coordination with the Controller of OMB. The head of a federal entity is required by 31 U.S.C. § 720, to submit a written statement on actions taken or planned on our recommendations to the Senate Committee on Homeland Security and Governmental Affairs and to the House Committee on Oversight and Reform, the congressional committees with jurisdiction over the programs and activities that are the subject of our recommendations, and GAO not later than 180 days after the date of this report. A written statement must also be sent to the Senate and House Committees on Appropriations with the entity’s first request for appropriations made more than 180 days after the date of this report. Please send your statement of actions to me at simpsondb@gao.gov. We are sending copies of this report to appropriate congressional committees, the Fiscal Assistant Secretary of the Treasury, the Controller of the Office of Management and Budget’s Office of Federal Financial Management, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov/. We acknowledge and appreciate the cooperation and assistance that Treasury and OMB staff members provided during our audit. If you or your staffs have any questions or wish to discuss this report, please contact me at (202) 512-3406 or simpsondb@gao.gov. Contacts points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff members who made major contributions to this report are listed in appendix III. Appendix I: Status of GAO’s Prior Recommendations Related to the Processes Used to Prepare the CFS Table 1 shows the status of GAO’s prior year recommendations related to the processes used to prepare the consolidated financial statements of the U.S. government. The abbreviations used are defined in the legend at the end of the table. Appendix II: Comments from the Department of the Treasury Appendix III: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, the following individuals made major contributions to this report: Carolyn M. Voltz and Paul F. Foderaro (Assistant Directors), LaTasha L. Freeman (Auditor-in-Charge), Youssef R. Amrani, Maria Hasan, W. Stephen Lowrey, Fabian J. Mendive, Maria M. Morton, and Kristine A. Papa.


Secret Service has Processes to Vet Individuals Based on Their Expected Proximity to the President The Secret Service has processes to vet individuals differently depending on the person’s expected proximity to the President, using a combination of physical screening and background checks, as illustrated in figure 1. According to Secret Service officials, physical screening includes the use of equipment such as wands and magnetometers to secure the property. Background checks assess in part whether an individual has a history of criminal activity. In some cases, enhanced background checks identify other types of threats. The Secret Service develops and executes a security plan to ensure that the outer, middle, and inner layers at the travel location are secure. Officials from the Secret Service confirmed that agency policies aim to provide comprehensive planning guidance for their agents’ activities but are not meant to be all inclusive. Outer Layer: The Secret Service uses physical screening measures to establish a layer of security around the Mar-a-Lago property. According to Secret Service officials, state and local law enforcement and the U.S. Coast Guard may monitor entry onto the property or perform visual checks of individuals entering the property and surrounding waterways. Depending on where the President is, guests may be required to pass through a physical security checkpoint that employs magnetometers, wands, and visual checks to assess physical threats. Middle Layer: Officials from the Secret Service said that they use physical screening measures for individuals and any rooms that the President may access during his visit. Officials told us that if they are notified of the President’s planned arrival to a specific room, they will secure that room. Inner Layer: In advance of the President’s arrival, the Secret Service has a process requiring vetting of individuals who are expected to be within close proximity to the President for a planned purpose or in certain secure areas. According to Secret Service officials, individuals who need access to secure areas but who are not expected to interact directly with the President, such as wait staff and other workers, are to undergo a background check in addition to physical screening. Individuals who are expected to meet the President are to undergo a background check and an enhanced background check. Officials from the Secret Service said that they are responsible for collecting the findings from these checks and making recommendations to the Executive Office of the President on whether individuals with derogatory findings should be allowed to access a space. According to officials from the Secret Service, staff at Mar-a-Lago routinely undergo background checks. In order to conduct the background check, the Secret Service is to use personally identifiable information for each individual, and those Individuals’ names may be checked against indexes maintained by the Secret Service and other federal, state, and local law enforcement organizations. The Secret Service’s guidance notes that submission of the requested information to run a background check is based on individuals voluntarily providing the needed information. In order to conduct an enhanced background check, the Secret Service collaborates with the Federal Bureau of Investigation and other federal agency partners. According to officials from the Secret Service, the Executive Office of the President is responsible for identifying individuals who are expected to meet with the President and providing the Secret Service with the names and the personally identifiable information needed to complete these checks. According to Secret Service guidance, White House staff is expected to submit all names to the Secret Service at least 72 hours in advance of the President’s arrival. Advance agents are also responsible for setting deadlines for completing background checks. Officials from the Secret Service said that, based on the information received from these checks, the Secret Service will make a recommendation to the Executive Office of the President on whether an individual should be granted access to the President. According to these officials, the Executive Office of the President ultimately determines whether or not an individual will have access. However, the Secret Service is responsible for ensuring that the area is safe and that the individual is physically screened. DOD and the Secret Service Provide Secure Areas for the Handling of Classified Information When the President Travels to Mar-a-Lago DOD’s White House Communications Agency and the Secret Service each have specific responsibilities for establishing secure communications and secure areas for handling classified information when the President travels to domestic locations, such as Mar-a-Lago. DOD’s White House Communications Agency: This organization is an information technology unit within DOD that supports the President and his staff during presidential trips. This organization’s mission is to provide information services to the President, Vice President, National Security Staff, Secret Service, and others when directed. According to agency guidance and officials, the White House Communications Agency is responsible for installing secure communications equipment that enables the exchange of classified information in areas that may be used by these entities. Secret Service: According to officials from the Secret Service, they send an advance team that coordinates with the White House Communications Agency to set up a conference center for the President where classified information may be exchanged, among other things. These officials stated that they provide security at the entrance of this conference center and perform security sweeps to ensure that it is safe and secure. DOD and the Secret Service coordinate to establish and secure several areas that are available for handling classified information when the President travels to locations such as Mar-a-Lago, as shown in figure 2. These areas include a conference center, spaces used by staff of the National Security Council and Executive Office of the President, and presidential transportation vehicles. Details associated with these areas and facilities are sensitive and have been omitted from this report. Regulations and Processes Governing Secret Service and DOD Expenditures on Employee Per Diem Expenses for Travel and Operational Space in Support of the President The Secret Service and DOD are subject to regulations governing reimbursements to employees for official travel. Processes exist to review these travel-related expenses when personnel from these agencies travel. These processes are the same when personnel accompany the President to Mar-a-Lago. Federal Regulations Govern Agencies’ Policies for Paying Or Reimbursing Employees’ Official Duty Travel Expenses Two regulations implement statutory requirements and executive branch policies for travel, allowing agencies to pay for or reimburse their employees’ per diem expenses (lodging, meals and incidental expenses) and other travel-related expenses: The Federal Travel Regulation (FTR), issued by the General Services Administration applies to the Secret Service’s personnel. The Joint Travel Regulations (JTR), issued by the Department of Defense apply to DOD personnel. Both regulations allow agencies to pay for employees’ daily expenses when they are traveling within the continental United States, based on allowances set by the General Services Administration for the applicable location and date (per diem rates) or the actual expense of travel. Under the Federal Travel Regulation, the maximum amount that a civilian employee may be reimbursed is 300 percent of the applicable per diem rate. The Joint Travel Regulations allow uniformed service members to be reimbursed up to 300 percent of the per diem rate when they are traveling in the continental United States, but they can be reimbursed more than 300 percent of the per diem rate for lodging when traveling outside the continental United States. The Secret Service Has a Standard Process for Overseeing Costs for Lodging, Meals and Incidental Expenses, and Operational Space during Presidential Travel Officials from the Secret Service stated that they apply the same cost oversight processes for all presidential travel. Expenses for lodging and operational space are centrally billed to the agency, and employee meals and incidental expenses are reimbursed to the traveler. In accordance with policy, the Secret Service tries to acquire lodging at the General Services Administration’s per diem lodging rate and must submit a waiver request for any room that exceeds this designated rate by any amount. The Secret Service field office closest to the travel destination is responsible for arranging for these spaces, negotiating rates, and if necessary submitting a waiver request to officials in the Secret Service’s Logistics Resource Center. The Logistics Resource Center is to review the waiver request, determine whether a more cost effective method exists to meet the need, and approve or reject the request. In some cases, the Secret Service may not be able to acquire rooms at the per diem lodging rate, or agents may need rooms for operational purposes that exceed 300 percent of the per diem rate, which is more than is allowed for lodging under the Federal Travel Regulation. For example, the Secret Service may use a room for operational purposes or reserve rooms adjacent to the President to better protect him. In addition, to meet operational demands, the Secret Service may require a certain number of agents to stay at the hotel in which the President is staying, so that they are within a certain proximity of the President at all times. Furthermore, officials from the Secret Service said that members of the Secret Service canine teams must stay at hotels that allow animals, and rooms at these hotels may exceed the General Services Administration lodging rate. The authorities the Secret Service has relied on to pay for hotel rooms needed to meet its operational requirements do not limit how much the agency can pay. Further, Congress passed a law in May of 2017 excepting the Secret Service from regulatory caps on room rentals, regardless of room purpose. Nevertheless, consistent with the Secret Service waiver process, personnel are still required to submit waiver requests for operational spaces to justify the need to book rooms during the President’s trips to Mar-a-Lago at prices higher than the General Service Administration lodging rates. We confirmed that a blanket waiver request was submitted and approved for all rooms at Mar-a-Lago that exceeded the General Services Administration per diem lodging rate during the President’s trips to Mar-a-Lago that are covered by this review. Additionally, we reviewed Secret Service documentation and confirmed that Secret Service personnel did not exceed the 300 percent threshold for lodging. For meals and incidental expenses, the Secret Service’s employees who are on official duty are to submit a claim for reimbursement electronically or by paper and receipts, as applicable, at the conclusion of the trip. Approving officials are to approve (or deny) expenses, and the Secret Service’s Financial Management Division authorizes reimbursement for approved travel. DOD Has a Standard Process to Oversee Costs for Lodging, Meals and Incidental Expenses, and Operational Space during Presidential Travel To Mar- A-Lago DOD personnel use the same processes for travel to Mar-a-Lago as they do for other Presidential trips to oversee costs for lodging, meals, and incidental expenses. According to officials from DOD’s Defense Travel Management Office, their office establishes travel policy that applies to the four organizations that travel in support of the President’s trips. DOD personnel use the Defense Travel System to submit travel documents, including vouchers and receipts, as applicable. According to officials, lodging may be booked and reimbursed on an individual basis or centrally billed if a block of rooms is needed over the same period. Meals and incidental expenses are reimbursed to the traveler. Like Secret Service’s personnel, DOD personnel must obtain approval from an authorizing official prior to the trip to exceed the General Services Administration per diem lodging rate, consistent with the Federal Travel Regulation and Joint Travel Regulations. According to officials from the Defense Travel Management Office, DOD typically would not reimburse expenses above the approved lodging rate if lodging at the approved rate was available within the region. However, officials from the Defense Finance and Accounting Service indicated that presidential trips may require such a deviation. These approvals are to be tracked in the Defense Travel System. The White House Military Office, which includes the White House Communications Agency, also sends personnel with the President when he travels. White House Communications Agency officials told us that its lodging and operational space for these personnel are typically coordinated by the White House Travel Office and that DOD personnel pay for the associated costs and seek reimbursement from DOD after the trip is complete. According to officials from the White House Communications Agency, some personnel are required to remain at, or near, the Mar-a-Lago property. If they are not required to stay at or near the property, they will try to obtain lodging at hotels in the area at the General Services Administration’s per diem rate for lodging. DOD officials told us that according to the Joint Travel Regulations, DOD is not authorized to pay or reimburse daily expenses above the 300 percent ceiling. In connection with the President’s travel to Mar-a-Lago between February 3, 2017 and March 5, 2017, DOD personnel exceeded the General Services Administration per diem rate but did not exceed the 300 percent threshold. According to officials from the Defense Travel Management Office, operational space used for official business is governed by the Federal Acquisition Regulation. White House Communications Agency officials told us that they have generally used space near the Mar-a-Lago property but leased property, effective September 2017, near Mar-a-Lago to reduce the cost of supporting the President’s trips to the property. Payments Received by the U.S. Treasury Department from The Trump Organization through Treasury’s Donation Processes Treasury has regular processes for receiving payments designated as gifts to the United States and gifts to reduce the public debt. Treasury officials stated that any payments received from The Trump Organization or the President that are designated as gifts would be handled using these processes. Under federal law, Treasury may receive general gifts to the U.S. Government and may also receive gifts to reduce the public debt. Treasury has developed processes to accept these types of payments, as shown in figure 3. Treasury officials said there are three accounts available to receive payments as gifts—a general gift account, a general fund receipts account, and an account for gifts to reduce the public debt. Any of these accounts could receive payments designated as gifts by the President or The Trump Organization. Treasury officials told us they would deposit such payments into the account for gifts to the U.S. Government unless the payment source specified that the funds should be used to reduce the public debt. Treasury received one payment from The Trump Organization, for $151,470 that was submitted through Treasury’s processes on February 22, 2018. In May 2017, The Trump Organization issued a policy addressing profits generated from foreign government patronage at its businesses. The Trump Organization’s policy states that it will make a single lump-sum payment annually after the end of its fiscal year, which ends on December 31st. We did not identify any other payments that Treasury received from The Trump Organization or the President between January 21, 2017, and August 1, 2018. In September 2018, an attorney for The Trump Organization confirmed that the organization had not made any payments since February 22, 2018. Agency Comments and Our Evaluation We provided copies of this draft report to DOD, DHS, the Department of Justice, the General Services Administration, the Department of Treasury, and the Executive Office of the President for comment. We also provided a section to the Trump Organization for comment. DHS provided written comments, which are reprinted in their entirety in appendix I. DHS, DOD, the Department of Treasury and the Department of Justice also provided technical comments, which we incorporated into this report as appropriate. The Executive Office of the President and the Trump Organization provided no comments. As agreed with your offices, unless you publicly release this report earlier, we will not issue the report until 30 days from the report date. At that time, we will also provide copies to the Secretary of Defense, the Director of the Secret Service, the Secretary of Homeland Security, the Attorney General, the Director of the Federal Bureau of Investigation, the Administrator of the General Services Administration, and the Secretary of the Treasury. In addition, this report will be available at no charge on the GAO website at www.gao.gov. If you or your staff have any questions about this report, please contact Joseph (Joe) Kirschbaum at (202) 512-9971 or at KirschbaumJ@gao.gov or Diana Maurer at (202) 512-9627 or at MaurerD@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in Appendix II. Appendix I: Comments from the Department of Homeland Security Appendix II: GAO Contacts and Staff Acknowledgments Staff Acknowledgments: In addition to the contacts named above, Gina R. Hoffman, Assistant Director; Joseph P. Cruz, Assistant Director; Tracy Barnes, Nicholas Benne, Jennifer Kamara, Joanne Landesman, Amie Lesser, Thomas Lombardi, Carol Petersen, Michael Silver, Janet Temko-Blinder, Christopher Turner, Kayli Westling, and Alex Winograd made key contributions to this report.


Selected Agencies Collect Some Information from Commenters and Accept Anonymous Comments through Regulations.gov and Agency-Specific Websites Consistent with the discretion afforded by the APA, Regulations.gov and agency-specific comment websites use required and optional fields on comment forms to collect some identity information from commenters. In addition to the text of the comment, agencies may choose to collect identity information by requiring commenters to fill in other fields, such as name, address, and email address before they are able to submit a comment. Regardless of the fields required by the comment form, the selected agencies all accept anonymous comments in practice. Further, because the APA does not require agencies to authenticate submitted identity information, neither Regulations.gov nor the agency-specific comment websites contain mechanisms to check the validity of identity information that commenters submit through comment forms. Regulations.gov and agency-specific comment websites also collect some information about public users’ interaction with their websites through application event logs and proxy server logs, though the APA does not require agencies to collect or verify it as part of the rulemaking process. This information, which can include a public user’s Internet Protocol (IP) address, browser type and operating system, and the time and date of webpage visits, is collected separately from the comment submission process as part of routine information technology management of system security and performance, and cannot be reliably connected to specific comments. Most Selected Agencies Have Some Internal Guidance Related to Commenter Identity Seven of 10 selected agencies have documented some internal guidance associated with the identity of commenters during the three phases of the public comment process: intake, analysis, and response to comments. However, the focus and substance of this guidance varies by agency and phase of the comment process. As shown in table 1, for selected agencies that have guidance associated with the identity of commenters, the guidance most frequently relates to the comment intake or response to comment phases of the public comment process. The guidance for these phases addresses activities such as managing duplicate comments (those with identical or near-identical comment text but varied identity information) or referring to commenters in a final rule. Agencies are not required by the APA to develop internal guidance associated with the public comment process generally, or identity information specifically. Selected Agencies’ Treatment of Identity Information Collected during the Public Comment Process Varies Within the discretion afforded by the APA, the 10 selected agencies’ treatment of identity information during the comment intake, comment analysis, and response to comments phases of the public comment process varies. Selected agencies differ in how they treat identity information during the comment intake phase, particularly in terms of how they post duplicate comments, which can lead to identity information being inconsistently presented to public users of comment systems. With regard to the comment intake phase in particular, the variation in how agencies identify duplicate comments and post comments results in identity information being inconsistently presented on Regulations.gov or the agency-specific websites. Generally, officials told us that their agencies either (1) maintain all comments within the comment system or (2) maintain some duplicate comment records outside of the comment system, for instance, in email file archives. For example, according to officials of one participating agency—the Wage and Hour Division (WHD)—all duplicate comments are stored in Regulations.gov. Our analysis of WHD comments did not suggest that any comments were missing from Regulations.gov. However, in one example, almost 18,000 duplicate comments were included in attachments under one individual’s name in the comment title. While all of the comments are included within 10 separate attachments, none of the identity information included with these comments can be easily found without manually opening and searching all 10 attachments, most of which contain approximately 2,000 individual comments. Selected agencies’ treatment of identity information during the comment analysis phase also varies. Specifically, program offices with the responsibility for analyzing comments place varied importance on identity information during the analysis phase. Finally, all agencies draft a response to comments with their final rule, but the extent to which the agencies identify commenters or commenter types in their response also varies across the selected agencies. Selected Agencies’ Practices Associated with Posting Identity Information Are Not Clearly Communicated to Public Users of Comment Websites Our analysis of Regulations.gov and agency-specific comment websites shows that the varied comment posting practices of the 10 selected agencies are not always documented or clearly communicated to public users of the websites. In part to facilitate effective public participation in the rulemaking process, the E-Government Act of 2002 requires that all public comments and other materials associated with a given rulemaking should be made “publicly available online to the extent practicable.” Additionally, key practices for transparently reporting open government data state that federal government websites—like those used to facilitate the public comment process—should fully describe the data that are made available to the public, including by disclosing data sources and limitations. We found that the selected agencies we reviewed do not effectively communicate the limitations and inconsistencies in how they post identity information associated with public comments. As a result, public users of the comment websites lack information related to data availability and limitations that could affect their ability to use and make informed decisions about the comment data and effectively participate in the rulemaking process themselves. Regulations.gov and Participating Agency Websites Public users of Regulations.gov seeking to submit a comment are provided with a blanket disclosure statement related to how their identity information may be disclosed, and are generally directed to individual agency websites for additional detail about submitting comments. While additional information is provided in the Privacy Notice, User Notice, and Privacy Impact Assessment for Regulations.gov, public users are not provided any further detail on Regulations.gov regarding what information, including identity information, they should expect to find in the comment data. Additionally, there is not enough information to help public users determine whether all of the individual comments and associated identity information are posted. Available resources on Regulations.gov direct public users to participating agencies’ websites for additional information about agency-specific review and posting policies. Seven of the eight participating agencies’ websites direct public users back to Regulations.gov and the Federal Register, either on webpages that are about the public comment process in general, or on pages containing information about specific NPRMs. Three of these participating agencies—the Environmental Protection Agency (EPA), Fish and Wildlife Service (FWS), and Food and Drug Administration (FDA)—do provide public users with information beyond directing them back to Regulations.gov or the Federal Register, but only FDA provides users with details about posting practices that are not also made available on Regulations.gov. The eighth participating agency—the Employee Benefits Security Administration (EBSA)—does not direct public users back to Regulations.gov, and instead re-creates all rulemaking materials for each NPRM on its own website, including individual links to each submitted comment. However, these links go directly to comment files, and do not link to Regulations.gov. While EBSA follows departmental guidance associated with posting duplicate comments, which allows some discretion in posting practices, the agency does not have a policy for how comments are posted to Regulations.gov or its own website. Further, in the examples we reviewed, the content of the NPRM-specific pages on EBSA’s website does not always match what is posted to Regulations.gov. Because participating agencies are not required to adhere to standardized posting practices, Regulations.gov directs public users to participating agency websites for additional information about posting practices and potential data limitations. However, these websites do not describe the limitations associated with the identity information contained in publicly posted comments. As allowed for under the APA, all of the participating agencies in our review vary in the way in which they post identity information associated with comments—particularly duplicate comments. However, the lack of accompanying disclosures may potentially lead users to assume, for example, that only one entity has weighed in on an issue when, actually, that comment represents 500 comments. Without better information about the posting process, the inconsistency in the way in which duplicate comments are presented to public users of Regulations.gov limits public users’ ability to explore and use the data and could lead users to draw inaccurate conclusions about the public comments that were submitted and how agencies considered them during the rulemaking process. Agency-Specific Comment Sites Both nonparticipating agencies use comment systems other than Regulations.gov and follow standardized posting processes associated with public comments submitted to their respective comment systems, but the Securities and Exchange Commission (SEC) has not clearly communicated these practices to the public. Although it appears to users of the SEC website that the agency follows a consistent process for posting duplicate comments, at the time of our June 2019 report, this practice had not been documented or communicated to public users of its website. In contrast, FCC identifies its policies for posting comments and their associated identity information in a number of places on the FCC.gov website, and on its Electronic Comment Filing System (ECFS) web page within the general website. Regarding comments submitted to rulemaking proceedings through ECFS, public users are informed that all information submitted with comments, including identity information, will be made public. Our review of ECFS comment data did not identify discrepancies with this practice. Although the public comment process allows interested parties to state their views about prospective rules, the lack of communication with the public about the way in which agencies treat identity information during the posting process, particularly for duplicate comments, may inhibit users’ meaningful participation in the rulemaking process. While the APA does not include requirements for commenters to provide identity information, or for agency officials to include commenters’ identity as part of their consideration of comments, key practices for transparently reporting open government data state that federal government websites— like those used to facilitate the public comment process—should fully describe the data that are made available to the public, including by disclosing data sources and limitations. In our June 2019 report, we made eight recommendations. Specifically, we recommended that five of the selected agencies establish a policy for posting comments, and that those five agencies plus three others take action to more clearly communicate their policies for posting comments, particularly with regard to identity information and duplicate comments. The eight agencies generally agreed with our recommendations and identified actions they planned to take in response, such as developing policies for posting duplicate comments and communicating those in various ways to public users. Since issuing our June 2019 report, SEC has taken action that is responsive to the recommendation we made to it. Specifically, in September 2019, SEC issued a memorandum that reflects SEC’s internal policies for posting duplicate comments and associated identity information. In addition, SEC has communicated these policies to public users on the SEC.gov website by adding a disclaimer on the main comment posting page that describes how the agency posts comments. Chairmen Portman and Lankford, Ranking Members Carper and Sinema, and Members of the Subcommittees, this concludes my prepared remarks. I would be happy to answer any questions you may have at this time. GAO Contact and Staff Acknowledgments For further information regarding this testimony, please contact Seto J. Bagdoyan, (202) 512-6722 or bagdoyans@gao.gov. In addition, contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals who made key contributions to this testimony are David Bruno (Assistant Director), Elizabeth Kowalewski (Analyst in Charge), and Dahlia Darwiche. Other individuals who also contributed to the report on which this testimony is based include Enyinnaya David Aja, Gretel Clarke, Lauren Kirkpatrick, James Murphy, Alexandria Palmer, Carl Ramirez, Shana Wallace, and April Yeaney. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.