Background The Defense Personal Property Program DOD currently relies on more than 900 commercial industry transportation service providers (TSPs) to move and store servicemembers’ and their families’ household goods. About 40 percent of DOD’s annual household goods moves occur during the 14-week annual peak moving season, which runs from May 15 through August 31. As figure 1 shows, servicemember survey satisfaction scores declined in 2018 during the peak moving season. According to TRANSCOM officials, this decline in satisfaction scores during the peak moving season has persisted for years. Under the current DP3, the military services own, operate, and staff most of the infrastructure involved in managing and overseeing the movement and storage-in-transit of DOD’s household goods, including the personal property processing offices and personal property shipping offices. The military services’ processing offices, among other things, ensure that the servicemembers’ reassignment orders and paperwork authorizing a move are in order, and that their application is accurate and complete. The processing offices also provide counseling, including advising servicemembers on the DP3 process, entitlements, and restrictions so they can make informed decisions about their moves. The military services’ shipping offices work with TSPs to schedule moves, monitor TSP performance, and take or recommend punitive action against poor performing TSPs. Recent DOD Efforts to Address Long-Standing DP3 Performance Issues DOD has conducted and sponsored several studies to help address persistent DP3 performance issues, including those related to servicemember satisfaction and challenges with meeting capacity demands during the peak summer months. For example, LMI and the Institute for Defense Analyses (IDA) produced reports on behalf of DOD in 2012 and 2018, respectively, to analyze DP3 performance issues and make recommendations to improve DP3. In its report, LMI outlined the impact of a range of options for contracting out some or all of the management of DOD’s household goods movement and storage activities. IDA recommended that DOD create consistent performance metrics, unify its DP3 operating structure, and improve servicemember support. Concurrent with pursuing its Global Household Goods Contract, TRANSCOM has several ongoing initiatives intended to improve servicemember satisfaction in general, and household goods loss and damage specifically. According to survey data, loss of and damage to household goods is the number one reason servicemembers cite for dissatisfaction. Ongoing TRANSCOM initiatives to improve servicemembers’ moving experiences that are independent of the Global Household Goods Contract include the following: Increasing the use of shipping containers in domestic household goods moves to reduce the number of servicemember loss and damage claims. According to TRANSCOM officials, in the past TRANSCOM has primarily used shipping containers only for international moves. Replacing the internet-based system used to manage DOD household goods moves, the Defense Personal Property System, with a new, mobile-friendly information technology operating system platform called MILMOVE. MILMOVE is intended to provide servicemembers and their families with more reliable information about their planned and ongoing household goods moves through access to all phases of the move process via their personal smartphones or tablets. Tracking whether quality inspections occur in person or via telephone, and requiring that at least 50 percent of all shipments have an in- person quality inspection. Increasing the liability limits for damaged or lost household goods shipments to $6 per pound and the total loss cap to $75,000 per shipment, when claims are filed within a specified time. TRANSCOM Efforts to Develop the Global Household Goods Contract In November 2018, TRANSCOM, in coordination with OSD and the military services, began planning and developing requirements for the Global Household Goods Contract. According to TRANSCOM officials, the goal was to have the contract in place in time for the 2021 peak moving season. TRANSCOM announced that in April 2020 it would award a Global Household Goods Contract to a single commercial move manager to oversee DP3 activities that relate to the movement and storage-in-transit of household goods. The proposed contract includes an initial 9-month transition period that will commence in May 2020, a 3-year base period, three 1-year option periods, two 1-year award terms, and an option to extend the contract 6 months. Including all option periods and award terms, the contract is expected to be completed at the end of January 2029 or, if the option to extend services is exercised, by the end of July 2029. The 9-month transition period is intended to give the Global Household Goods contractor sufficient time to, among other things, integrate its information technology systems with existing DOD information technology systems. During the initial years of the contract, the contractor’s volume of workload will incrementally increase, including the volume of household goods moves that it will handle. The Global Household Goods Contract is not intended to replace DP3 in its entirety. Activities that are planned to be a part of the contract include the movement and storage-in-transit of household goods, direct procurement method shipments, and some level of servicemember counseling. DP3 activities that are not to be a part of the Global Household Goods Contract include the long-term storage of household goods (referred to as non-temporary storage) and the movement and storage of servicemembers’ privately owned vehicles. Additionally, while the contract is expected to include counseling to servicemembers, the military services will also perform some counseling. According to TRANSCOM and military service officials, they are working to determine the amount of counseling that will be retained by the military services. Key Differences in How Household Goods Are Moved and Stored in DP3 Currently and under the Planned Global Household Goods Contract The movement and storage-in-transit of household goods in the current DP3 differs in key ways from the approach under the planned Global Household Goods Contract, as shown in table 1. TRANSCOM Has Taken Steps to Determine the Cost Implications Associated with Moving to a DP3 That Incorporates the Global Household Goods Contract, but Plans Not to Determine Some Cost Estimates for Years TRANSCOM has developed preliminary and refined cost estimates for determining the cost implications associated with moving to a DP3 that incorporates the Global Household Goods Contract. According to TRANSCOM officials, they began developing preliminary cost estimates in December 2018 in order to (1) create a baseline cost estimate for the movement and storage of household goods under the current DP3, (2) create a cost estimate for those DP3 activities that will be a part of the Global Household Goods Contract, and (3) serve as a point of comparison between the two estimates to determine the cost implications of moving to the Global Household Goods Contract. TRANSCOM’s preliminary cost estimates for the current DP3 and for the activities that will be a part of the Global Household Goods Contract included costs associated with the movement and storage of household goods and government personnel costs associated with the military services’ personal property processing and shipping offices. TRANSCOM developed these preliminary cost estimates in part by requesting and collecting information from the military services about their current costs under DP3. Some DP3 costs were not included in the preliminary cost estimates, such as infrastructure and vehicle costs because these assets are used to support multiple programs and could not be easily isolated. However, our assessment of the preliminary DP3 cost estimates associated with moving to the Global Household Goods Contract found that TRANSCOM may not have accurately calculated some costs because of unanswered questions about how certain activities will be performed. TRANSCOM’s cost estimates associated with the number of government personnel that (1) will counsel servicemembers and (2) oversee contractor performance under the contract had weaknesses. Specifically, these estimates relied on assumptions that may have resulted in over- or underestimating some costs. First, TRANSCOM’s preliminary DP3 cost estimates associated with moving to the Global Household Goods Contract assume that DOD’s costs related to government personnel will be equivalent to those under the current DP3. However, TRANSCOM officials acknowledge that this assumption is based on discussions with military service officials that occurred before the Global Household Goods Contract draft request for proposals was issued in April 2019. Furthermore, military service officials told us they have not decided how much of the counseling function their service has provided will be moved to the planned contract, and the services’ approaches will likely differ. TRANSCOM officials pointed out that while the Global Household Goods contractor will perform some level of servicemember counseling, the contract will allow the individual military services to decide how much of the counseling responsibility to retain. Second, TRANSCOM’s cost estimates do not account for the number of DOD contracting officer’s representatives and quality assurance evaluators required to oversee contractor performance under the contract. According to TRANSCOM officials, the command’s preliminary cost estimates assume that government personnel who have been relieved of servicemember counseling responsibility will perform contract oversight and quality assurance responsibilities under the planned contract. For example, TRANSCOM officials told us that quality assurance inspectors under the current DP3 will transition to serve as quality assurance evaluators once the contract is in place. However, TRANSCOM officials acknowledge that it is possible that workload (and personnel costs) for the military services under the current DP3 will change under the planned contract. Moreover, if government personnel do switch roles and responsibilities, TRANSCOM did not take into account the cost to transition and train personnel to execute their contracting officer’s representative and quality assurance evaluator responsibilities under the contract. TRANSCOM officials told us that they were unable to determine with any precision the number and associated costs of government personnel required to counsel servicemembers and oversee the contract because of the fractured nature of the current DP3. Nonetheless, in September 2019, TRANSCOM tasked LMI with developing a BCA with refined cost estimates. LMI finalized the BCA and we received it on January 17, 2020. When we assessed the BCA, we found that like us LMI determined that it did not have complete information to fully calculate the cost of a DP3 that incorporates the Global Household Goods contract. Specifically, LMI acknowledged some of the same limitations in its cost estimates that we identified in TRANSCOM’s preliminary cost estimates, such as uncertainty about the number of government personnel required to oversee the Global Household Goods Contract. For example, LMI states in its BCA that the Global Household Goods Contract may reduce DOD staffing requirements for functions such as counseling; however, roles such as quality assurance evaluators and contracting officer’s representatives to oversee contractor performance may increase DOD staffing requirements. When we raised concerns about these unanswered questions and their potential cost implications with TRANSCOM officials, they told us that the move to the Global Household Goods Contract is less about saving money than it is about representing the best value to DOD when both cost and program performance are considered. They also told us they have developed a plan of action for the phase-in of the Global Household Goods Contract, and that plan includes conducting a manpower study during the third year of the contract. As described earlier in this report, the initial 3 years of the contract involve a gradual phase-in of household goods move volume for the contractor, and in the third year the contractor will be responsible for all of DOD’s household goods move volume. According to these officials, by waiting until year 3 of the contract to conduct a manpower study, DOD will have data to more precisely determine the number (and cost) of government personnel required to counsel servicemembers and oversee the contract, such as contracting officer’s representatives and quality assurance evaluators. However, we have determined that TRANSCOM does not have a process in place to track data that would inform its manpower study in year 3, such as how many personnel within each military service are needed to perform contract oversight duties and the costs associated with these personnel. We have reported that organizations should determine their personnel requirements as part of a systematic requirements- determination process that includes (1) identifying an organization’s mission, functions, and tasks and (2) determining the minimum number and type of personnel—military, civilian, and contractor—needed to fulfill those missions, functions, and tasks by conducting a workforce analysis. Without a way to track key data, DOD risks conducting a manpower study that does not allow it to fully understand the personnel and cost implications of its move to a DP3 that incorporates a Global Household Goods Contract. Notably, in its BCA LMI recommended that DOD reexamine the BCA when additional relevant information becomes available, such as when DOD completes its manpower study. TRANSCOM officials told us they are in agreement with this recommendation. However, if TRANSCOM does not have a process in place to collect key pieces of data during the first 3 years of the contract, a reexamination of the BCA will be less fruitful than it otherwise might be. TRANSCOM Has Developed Performance Metrics to Assess Some but Not All DP3 Activities, and Not All of TRANSCOM’s Overarching Program Goals Have Clearly Associated Performance Metrics First, TRANSCOM has developed performance metrics—referred to as performance indicators—for its Global Household Goods Contract, and has developed performance metrics for some, but not all, activities that fall outside of the contract. TRANSCOM’s draft quality assurance surveillance plan for the Global Household Goods Contract, which was developed in coordination with the military services, outlines how the contractor’s performance will be assessed against performance indicators. These performance indicators set measurable standards for, among other things, information technology systems’ availability, claims settlement timeliness for lost and damaged goods, and the timeliness of household goods pick-up and deliveries. Examples of performance indicators include: settling 90 percent of all loss and damage claims valued at less than $1,000 within 30 days and settling 95 percent of all claims, regardless of value, within 60 days; delivery of household goods on the scheduled date 95 percent of the time per month; and overall customer satisfaction rating of satisfactory at least 95 percent per month. Based on a DP3 briefing TRANSCOM provided us, the command has also developed metrics for assessing other contracted DP3 activities, such as the transport of privately owned vehicles and non-temporary storage, which TRANSCOM captures under contracts separate from the Global Household Goods Contract. For example, TRANSCOM tracks the number and cost of non-temporary storage lots maintained annually to support its storage requirements. However, TRANSCOM officials acknowledge that the command has not developed metrics for other activities that government personnel will continue to perform in DP3, once a Global Household Goods Contract is in place, such as servicemember counseling and claims resolution. Although TRANSCOM’s draft quality assurance surveillance plan includes a performance indicator to assess the contractor’s performance with respect to servicemember counseling, TRANSCOM officials told us the command has not developed commensurate metrics to assess the military services’ performance in providing servicemember counseling. TRANSCOM officials also noted that while the military services’ claims offices will be responsible for handling unresolved loss and damage claims between the servicemember and the contractor, the command has not developed metrics associated with this DP3 activity. Second, we found that, while TRANSCOM has articulated overarching DP3 goals, it has not clearly articulated how its performance metrics align with each of these goals. According to TRANSCOM officials, they decided to move certain DP3 activities to the Global Household Goods Contract because doing so could positively impact the program’s five goals regarding cost, quality, capacity, accountability, and responsibility, terms described in LMI’s BCA as shown below: Cost considers the potential financial impact, including either opportunities or risks to the future-state costs and any savings the program is likely to achieve. Quality encompasses the value of a move, typically measured by customer (i.e., servicemember) satisfaction. Quality may improve with on-time performance and minimized loss or damage. Capacity is the availability of industry providers to meet the program’s demands at a given time. This can be during peak or non-peak season. Accountability refers to the government’s ability to affix responsibility to the contractor and their supplier network for performance. Responsibility encompasses the authority of the government and how each government stakeholder will be held responsible for accomplishing their assigned tasks. Planned contract performance indicators and metrics are intended to assess contractor performance, but they may also provide information that TRANSCOM could use to more broadly assess the extent to which DP3 is meeting its overarching program goals. However, TRANSCOM has not clearly articulated which of the performance metrics it has established under the Global Household Goods contract align with which program goals. For example, one performance indicator for the Global Household Goods Contract is for contractor delivery of household goods to be on-time at least 95 percent of the time. While it appears that this performance indicator could relate to the quality and capacity goals, TRANSCOM has not established linkage between this performance indicator and either of these goals. Determining how it will assess improved capacity is particularly important. When we spoke with them about the move to the Global Household Goods contract, some military service officials, representatives of the moving and storage industry, and members of TRANSCOM’s Personal Property Relocation Advisory Panel told us that they doubt whether the Global Household Goods Contract will, indeed, improve capacity. Moreover, none of the existing performance indicators appear to relate to TRANSCOM’s responsibility goal. It is not surprising that the Global Household Goods Contract does not include performance indicators on how government stakeholders are to be held responsible for various program activities, because indicators under the contract are intended to evaluate contractor performance. However, we would expect to see performance metrics outside of the contract to measure government stakeholders’ performance. When we spoke with TRANSCOM officials about the gaps we identified in their performance assessment approach, they agreed that clarifying the linkage between performance metrics and the overarching program goals and ensuring there are performance metrics for assessing each of the goals would improve the command’s ability to assess overall program performance. While the performance indicators and metrics related to the various contracts, including the Global Household Goods Contract, are intended to assess contractor performance, they could also provide information that TRANSCOM could use to more broadly assess the extent to which DP3 is meeting its overarching program goals. DOD Instruction 4500.57, Transportation and Traffic Management, calls for TRANSCOM, in coordination with DOD components, to conduct annual program reviews to ensure the overall effectiveness of the DP3. The instruction calls for these reviews to include a metrics-based evaluation of the program, and assessments of TSP and service-provider cost and performance, information technology systems and contracts that support DP3, and external factors that impact the program such as industry capability and changes to servicemember shipping entitlements. Moreover, the Standards for Internal Control in the Federal Government call for management to define objectives (or metrics) in terms of what is to be achieved, who is to achieve it, how it will be achieved, and the time frames for achievement so that performance toward achieving those objectives (or metrics) can be assessed. We have also previously reported on the importance of linking lower-order performance metrics and higher-order strategic goals to achieve desired outcomes. Without performance metrics that account for those DP3 activities that fall outside of the Global Household Goods Contract and other DP3 contracts and without clearly articulating the linkage between performance metrics and program goals, TRANSCOM’s ability to assess progress toward, and take actions to help achieve, its overarching program goals will be hindered. The need to take these steps is particularly important, given some of the skepticism that TRANSCOM faces with its move to a DP3 that incorporates the Global Household Goods Contract. Further, because TRANSCOM officials have determined that the move to the Global Household Goods contract is about delivering better value, rather than just saving money, it is imperative that they have a robust performance assessment approach in place. Conclusions DOD has experienced long-standing quality issues moving and storing the household goods of servicemembers and their families, despite numerous reform efforts. To address persistent quality-of-service issues, such as late pick-up and deliveries and high claims costs for lost and damaged goods, TRANSCOM intends to award a multi-year Global Household Goods Contract, under which a single commercial move manager would oversee the movement and storage of household goods shipments. DOD has been working to award its Global Household Goods Contract in time to meet the fiscal year 2021 peak season demand, and will award the contract without precise information on the number and cost of government personnel required to counsel servicemembers and oversee the contract. Given this determination, it is particularly important that DOD put in place a process to track key data during the first 3 years of the contract to inform its planned manpower study, so that it can fully determine the cost implications of this shift in DP3. Moreover, because DOD has stated that the purpose of the move to the Global Household Goods contract is to provide better value for the customers, DOD should ensure that it has in place performance metrics to assess all DP3 activities, including those that fall outside of the Global Household Goods contract, and clearly articulate the linkage between performance metrics and overarching program goals. Without doing so, TRANSCOM will be hindered in its ability to assess whether a DP3 that incorporates the Global Household Goods Contract is an improved program, particularly as it relates to the moving experiences of servicemembers and their families. Recommendations for Executive Action We are making the following three recommendations to the Secretary of Defense: The Secretary of Defense, in coordination with the Chairman of the Joint Chiefs of Staff, should ensure that the TRANSCOM Commander, in coordination with the military services and the Coast Guard, develop a process for tracking data during the first 3 years of the Global Household Goods Contract to inform its planned manpower study during the third year of the contract to more precisely determine DP3 manpower needs and associated costs. (Recommendation 1) The Secretary of Defense, in coordination with the Chairman of the Joint Chiefs of Staff, should ensure that the TRANSCOM Commander develop performance metrics for those DP3 activities that will not be a part of the Global Household Goods Contract, such as servicemember counseling and claims resolution that will, at least in part, continue to be performed by the military services. (Recommendation 2) The Secretary of Defense, in coordination with the Chairman of the Joint Chiefs of Staff, should ensure that the TRANSCOM Commander articulate the linkage, where appropriate, between DP3 performance metrics, including Global Household Goods Contract performance indicators, and overarching program goals. (Recommendation 3) Agency Comments and Our Evaluation We provided a draft of this report to DOD for comment. In its comments, which are reproduced in Appendix III, DOD concurred with all of our recommendations and described ongoing and planned actions to address them. We are sending copies of this report to the appropriate congressional committees; the Secretary of Defense, the Chairman of the Joint Chiefs of Staff, and the Secretaries of the Army, the Navy, and the Air Force; and the Commandant of the Marine Corps. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-2775 or fielde1@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. Appendix I: Scope and Methodology Our review focused on household goods movement and storage-in-transit for servicemembers in the Army, the Navy, the Air Force, the Marine Corps, and the Coast Guard. We did not evaluate Department of Defense (DOD) Defense Personal Property Program (DP3) activities that will not be a part of the Global Household Goods Contract, which include the long-term storage of household goods and the movement and storage of servicemembers’ privately owned vehicles. We did, however review metrics being tracked for these activities to determine the U.S. Transportation Command’s (TRANSCOM) ability to assess performance for the broader DP3. During our review, we coordinated with officials from the DOD Office of the Inspector General to gain an appreciation for the objectives, scope, and methodology of their ongoing audit on the timeliness of household goods deliveries and claims resolution under the current DP3. The resulting audit report contained several recommendations, including that TRANSCOM issue warnings or letters of suspension to transportation service providers (TSPs) within 14 days of missing the agreed-upon delivery date from storage, and that TRANSCOM help servicemembers and their families file inconvenience claims with TSPs within 14 days of a missed delivery date. To inform both of our objectives, we met with officials from the Office of the Secretary of Defense (OSD), TRANSCOM, the military services, the Coast Guard, and the DOD Office of the Inspector General. We also met with external stakeholders, including associations representing the moving and storage industry, the Small Business Administration, the American Federation of Government Employees, and members of TRANSCOM’s Personal Property Relocation Advisory Panel. For objective one, we assessed preliminary cost estimates TRANSCOM developed in connection with the move to a DP3 approach that incorporates the planned Global Household Goods Contract against best practices in the GAO Cost Estimating and Assessment Guide. The guide states that valid and useful historical data are important in developing sound cost estimates, and that risk and uncertainty and sensitivity analyses should be performed to mitigate the effects of changing assumptions. We analyzed TRANSCOM’s preliminary cost estimates, and discussed with TRANSCOM officials assumptions that were used to develop the estimates and techniques that were applied to account for variability in the assumptions. Given that TRANSCOM’s cost estimates were preliminary and likely to change based on the Logistics Management Institute’s (LMI) ongoing business case analysis (BCA), we did not conduct a reliability assessment of TRANSCOM’s cost estimates. We instead focused on TRANSCOM’s treatment of evolving assumptions in its preliminary cost estimates. We met with representatives from LMI to discuss their process for updating TRANSCOM’s preliminary cost estimates as part of a BCA that it was preparing for the command. We evaluated these cost estimates, including the cost estimates in the BCA that was issued in January 2020, using criteria from GAO’s Assessment Methodology for Economic Analysis that outlines five key elements for an economic analysis. Our assessment of LMI’s BCA is included in appendix II. For objective two, we reviewed relevant DOD guidance, including DOD Instruction 4500.57, Transportation and Traffic Management. The instruction requires TRANSCOM, in coordination with the DOD components, to annually evaluate the effectiveness of the DP3. We also reviewed the Global Household Goods request for proposals and TRANSCOM’s draft quality assurance surveillance plan. The draft quality assurance surveillance plan outlines how DOD will oversee the move manager’s performance under the Global Household Goods Contract and describes the performance indicators that will be used to assess contractor performance. Using the Standards for Internal Control in the Federal Government, which calls for management to define objectives (or metrics) in terms of what is to be achieved, who is to achieve it, how it will be achieved, and the time frames for achievement so that performance toward achieving those objectives can be assessed, we also assessed DOD’s DP3 performance metrics. Additionally, we discussed with TRANSCOM officials their approach for overseeing the Global Household Goods Contract, including the linkage between performance measures for those DP3 activities that will and will not be a part of the contract and DP3’s overarching goals. We conducted this performance audit from May 2019 to April 2020 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix II: GAO’s Assessment of the Logistics Management Institute’s (LMI) Business Case Analysis (BCA) Appendix II: GAO’s Assessment of the Logistics Management Institute’s (LMI) Business Case Analysis (BCA) We assessed the cost and benefit information in LMI’s BCA against our Assessment Methodology for Economic Analysis. Our assessment methodology identifies the following five key components of an economic analysis: We found that the BCA informs decision-makers and stakeholders, with caveats, about the economic effects of the proposed Global Household Goods Contract. Further, we found that the BCA fully met four and partially met one of the five key components of an economic analysis. A summary of our rationale for these assessments is outlined in table 2. Appendix III: Comments from the Department of Defense Appendix IV: GAO Contact and Staff Acknowledgments GAO Contact: Elizabeth A. Field, (202) 512-2775 or fielde1@gao.gov. Staff Acknowledgments: In addition to the contact named above, GAO staff who made key contributions to this report include Marc Schwartz, Assistant Director; Pedro Almoguera, John Bumgarner, William Cordrey (retired), Tim DiNapoli, Jennifer Echard, Christopher Gezon, Mae Jones, Jason Lee, Ned Malone, Tara Porter, Oliver Richard, Mike Shaughnessy, Susan Tindall, Nate Tranquilli, John Van Schaik, and Mary Weiland.


Background The Department of Defense (DOD) operates a Military Health System (MHS) that delivers certain health entitlements under Chapter 55 of Title 10, U.S. Code. The Defense Health Agency (DHA)âa component of the MHSâadministers the TRICARE program, which offers health care services to approximately 9.5 million beneficiaries, composed of military personnel, retirees, and their families. Beneficiaries may receive health care services in DOD-operated hospitals and clinicsâknown as military treatment facilities (MTFs)âor through participating civilian health care providers. DOD operates 723 MTFs in the United States and in overseas locations. Each MTF provides a range of clinical services depending on its size, mission, and level of capabilities. Only active duty servicemembers are entitled to care in any MTF. Dependents and retirees may receive care on a space-available basis that takes into account patient capacity, beneficiary category (e.g., servicemember, family member, retiree), and enrollment status. When care is not available at an MTF, beneficiaries may receive care from a civilian health care provider who participates in TRICARE. The three main health plan options offered to eligible beneficiaries include TRICARE Prime, TRICARE Select, and TRICARE for Life. TRICARE also offers premium-based health plan options for certain beneficiaries, such as qualified members of the Selected Reserve, retired reservists, young adults, and transitioning servicemembers. Other TRICARE benefits include a pharmacy program, optional dental plans, and a vision plan for certain beneficiaries. This report answers frequently asked questions about TRICARE health plan options tailored for certain reservists, retired reservists, and their families (i.e., TRICARE Reserve Select and TRICARE Retired Reserve) and certain statutory prohibitions that limit their participation in the plans. Questions and Answers 1. What is TRICARE Reserve Select and TRICARE Retired Reserve? TRICARE Reserve Select (TRS) is a premium-based health plan available worldwide for some members of the Selected Reserve and their families. TRS was established by Section 701 of the Ronald W. Reagan National Defense Authorization Act (NDAA) of Fiscal Year 2005 ( P.L. 108-375 ). TRICARE Retired Reserve (TRR) is a premium-based health plan available worldwide for qualified retired members of the reserve components. TRR was established by Section 705 of the NDAA for FY2010 ( P.L. 111-84 ) as a TRICARE coverage option for so-called gray area reservists, defined as those who have retired but are too young to draw retired pay. The plans are similar to TRICARE Select (i.e., preferred provider option), which feature monthly premiums, annual deductibles, and fixed co-pays when receiving care from a network provider or paying a percentage of the allowable charge when receiving care from a TRICARE-authorized, nonnetwork provider. Eligible beneficiaries residing outside of the United States are also eligible for TRS and TRR; however, the availability of network providers may be limited based on geographic location. By law, the Department of Defense (DOD) is required to subsidize the cost of TRS. Servicemembers pay 28% of the cost of the program in the form of premiums. For TRR, enrollees pay the full cost of the calculated premium as determined by the Secretary of Defense. DOD does not subsidize the program costs for TRR. DOD annually updates the premiums for each program on an "appropriate actuarial basis." Monthly TRS and TRR premiums for calendar years 2019 and 2020 are listed in Table 1 . DOD reports that at the end of FY2018, 383,683 beneficiaries were covered by TRS and 9,019 beneficiaries were covered by TRR. 2. Who qualifies for TRS, and what are the statutory prohibitions on TRICARE Reserve Select eligibility for certain members of the reserve components? Members of the Selected Reserve (i.e., drilling reservists) and their families qualify for TRS if the following criteria are met: the reservist is not on active duty orders; the reservist or their family members are not covered under the Transitional Assistance Management Program; and the reservist or their family members are not eligible for the Federal Employee Health Benefits (FEHB) program. Prior to 2006, TRS availability was limited to members of the Selected Reserve (including family members) after serving on continuous active duty in support of a contingency operation for 90 or more days and signing an agreement to continue serving in the Selected Reserve for one or more years. TRS coverage was also limited to the lesser of: one year (in cases where an activated reservist does not continuously serve on active duty for at least 90 days due to an "injury, illness, or disease incurred or aggravated while deployed"); one year for each consecutive period of 90 days of continuous active duty service; or the number of years agreed upon in the military service obligation agreement. Section 706 of the John Warner NDAA for FY2007 ( P.L. 109-364 ) amended 10 U.S.C. Â§1076d to expand TRS eligibility, including removal of the military service obligation agreement, active duty service length, and period of coverage requirements. In revising TRS, the law also added a prohibition on members of the Selected Reserve and their family members from being eligible for TRS if they are also eligible for, or enrolled in, "a health benefits plan under Chapter 89 of Title 5," U.S. Code. This health benefit plan is known as the FEHB program. 3. Who is eligible for TRR, and what are the statutory prohibitions on TRICARE Retired Reserve eligibility for qualified retired reservists? Retired members of the reserve components and their family members qualify for TRR if the following criteria are met: the retiree is qualified for non-regular retirement under chapter 1223 of Title 10, U.S. Code; the retiree is under age 60; and the retiree or their family members are not eligible for the FEHB program. P.L. 111-84 , which established TRR, incorporated a similar prohibition on qualified retired members of the reserve components and their family members from being eligible for TRR if they are eligible for the FEHB program. For example, a reservist or qualified retired reservist who is also a civil service or U.S. Postal Service (USPS) employee, annuitant, or family member that is eligible for the FEHB program is barred from enrolling in TRS or TRR. This restriction does not apply to other TRICARE programs for which reservists or retired reservists may also be eligible under other criteria (e.g., TRICARE Prime, TRICARE Select, TRICARE for Life, TRICARE Dental Program, or the Transition Assistance Management Program). 4. How many beneficiaries do the TRS eligibility restrictions affect? In 2019, the Congressional Budget Office (CBO) estimated approximately 110,000 members of the Selected Reserve are prohibited from enrolling in TRS because they are eligible for FEHB. This represents approximately 13.7% of the total Selected Reserve force. CBO also estimated that about "one third would enroll in TRS if given the opportunity." Neither DOD nor CBO has published any similar estimates for TRR. 5. Why did Congress enact these statutory prohibitions? The congressional record, the committee and conference reports accompanying the enacting and amending legislation for TRS and TRR, do not articulate why the prohibitions are in place. Nevertheless, observers have speculated that the prohibition may be related to potential increases in mandatory or discretionary costs associated with certain risk-pool adjustments to FEHB and expansion of the TRICARE program. As the House of Representatives considered the FY2007 NDAA, as reported by the House Armed Services Committee, the Office of Management and Budget issued a Statement of Administration Policy (SAP) that expressed cost concerns with the proposal to expand to TRS. The SAP noted: â¦ the Administration strongly opposes Section 709, which expands TRICARE eligibility to all Selected Reserve members and their families and dramatically worsens the fiscal situation by increasing the government subsidy for non-mobilized reservists and their families at an estimated cost of $400 million in FY 2007 and $3.6 billion from FY 2007 through FY 2011. By FY 2011, it is estimated that the annual cost for this expanded benefit will reach $1.2 billion. It is critical for Congress to eliminate these unfunded expansions and work with the Administration to place the system on a sound fiscal foundation. 6. What health insurance options are available to those prohibited from enrolling in TRS or TRR? Reservists, qualified retired reservists, or their family members subject to the statutory prohibitions may obtain health insurance coverage, if eligible, through any of the following health insurance options: FEHB; Medicaid; private individual health insurance; or employer-sponsored insurance (e.g., personally or as offered through a spouse's employer). Reservists serving in a federal active duty status for greater than 30 days are eligible to participate in TRICARE programs for active duty servicemembers, including TRICARE Prime. 7. What are the premium rates for the FEHB program? The FEHB program establishes several premium rates based on geographic location, coverage option, and federal employee category. The monthly average premium rates (non-USPS employee and annuitant) for calendar year 2019 are listed in Table 2 . 8. What are the potential implications of extending TRS or TRR eligibility to all members of the Selected Reserve and qualified retired reservists? Parity in TRS or TRR Eligibility for Reservists Reservists who are eligible for FEHB, for any reason, are disqualified from participation in TRS or TRR. Reservists not employed by the federal government (and not eligible for FEHB) may participate in TRS or TRR. Certain military service organizations (MSOs) perceive and advocate that the removal of the statutory prohibition for TRS or TRR would create equality among all members of the Selected Reserves or qualified retired reservists. These advocacy groups also note that in doing so, all members of the Selected Reserves would be able to access TRS as a "more affordable option" than FEHB, which has higher premiums and cost shares. In a 2018 report to Congress on reserve component health care, DOD states that reservists have "expressed strong feelings of discontent with the law that disqualifies Selected Reserve members from purchasing TRICARE Reserve Select (TRS) for themselves or for family members if they are eligible for, or enrolled in, the FEHB program." DOD also noted in its report that reservists "would like Congress to repeal the FEHB exclusion and DOD fully supports its repeal;" however, DOD made no recommendation concerning this issue at the time it produced the report nor has it any time since. Cost Implications While expanding TRS or TRR eligibility would have certain cost implications for DOD, there are also cost considerations for other federal agencies that fund FEHB benefits for their respective federal employees. In June 2019, CBO published a cost estimate of a proposal to remove the TRS prohibition starting in 2030âSection 703 of the FY2020 NDAA ( H.R. 2500 ; as reported by the House Armed Services Committee). Overall, there would be an estimated savings to the federal government. However, given certain statutory or House pay-as-you-go (PAYGO) rules, increases in mandatory spending must be offset by "direct spending cuts, revenue increases, or a combination of the two," rather than by savings in discretionary spending. CBO estimates that expanding TRS eligibility would produce an increase in mandatory costs, noting that: Because members of the Selected Reserve are younger and healthier than the average federal employee, reservists and their family members who discontinue FEHB coverage would cause an increase in premiums for all remaining FEHB beneficiaries, including federal retirees and active postal employees, whose premiums are paid from mandatory accounts. When implemented, CBO estimates this section would increase direct spending by about $40 million each year beginning in 2030. Concurrently, CBO also estimates there would also be savings in discretionary spending, greater than the increase in mandatory costs: On net, CBO estimates section 703 would eventually reduce discretionary costs to the government by about $250 million per year beginning in 2030 because the cost of TRS is less than the government's share of the premium for FEHB. Section 703 would also affect spending for other FEHB beneficiaries. Beneficiary Satisfaction DOD asserts that reservists and their spouses "show satisfaction with the TRICARE program in general, and TRS in particular." Beneficiaries enrolled in TRS are reportedly satisfied with their TRICARE plan and the quality of health care provided. For example, DOD observed in the 2014 Survey of Reserve Component Spouse s that 48% found "no difference" between TRS and civilian health insurance plans. DOD also observed that 32% of survey participants believed that TRS provides "better" or "much better" health care than civilian health plans. Similar results can be found in certain MSO-conducted surveys of beneficiaries. While many TRS enrollees express a general satisfaction with their TRICARE plan, some beneficiaries have described certain challenges, such as: difficulty in finding health care providers and facilities that accept TRICARE; maintaining continuity of care for a family member when a reservist is activated and ordered to active duty; and having to reenroll in TRS after a reservist transitions from active duty to the Selected Reserve. 9. Has Congress previously considered extending TRS or TRR eligibility? Since the creation of TRS and TRR, Congress has considered a number of proposals to eliminate the statutory prohibitions described above (see Table 3 ). To date, none of the proposals have been enacted.


Background The Dodd-Frank Act was enacted to promote the financial stability of the United States by improving accountability and transparency in the financial system and protecting consumers from abusive financial services practices, among other purposes. To help detect and prevent securities misconduct, section 961 of the Dodd-Frank Act promotes complete and consistent performance of SEC staff examinations, investigations and reviews, and appropriate supervision of these activities through internal supervisory controls. SEC has submitted eight annual reports to Congress under section 961, all of which stated that both its internal supervisory controls and its staff procedures were effective for the period under review. In addition, all such reports stated that no significant deficiencies in internal supervisory controls were identified. Section 961 does not define “internal supervisory control.” SEC has defined internal supervisory controls as the processes established by management to monitor that the procedures applicable to staff (that is, established day-to-day procedures to be followed by the employees within the applicable programs) are consistently being performed according to policy and procedures, and also remain reasonable, adequate, and current. SEC is the primary regulator of the U.S. securities markets and is responsible for protecting investors, maintaining fair, orderly, and efficient markets, and facilitating capital formation. To fulfill this mission, SEC requires public companies to disclose meaningful financial and other information to the public, examines firms it regulates, and investigates potential violations of the federal securities laws. SEC is organized into five divisions and 24 offices. SEC’s approximately 4,400 staff are located in Washington, D.C., and in 11 regional offices. As discussed previously, four divisions and offices are subject to section 961 of the Dodd-Frank Act (see table 1). SEC formalized its Section 961 Working Group in 2017. The primary purposes of the Working Group are to enhance the efficiency and effectiveness of SEC’s processes related to section 961 compliance and to enhance coordination and information sharing among the divisions and offices. The Working Group is a staff-level group comprising one or more representatives from each of the four divisions and offices subject to section 961 as well as the Office of the Chief Operating Officer. These staff are responsible for carrying out the Working Group’s responsibilities, which include establishing a common understanding and consistent approach to compliance; creating a means to share information and ideas to improve the efficiency and effectiveness of section 961 compliance activities; discussing best practices to streamline procedures and documentation of internal control testing and reporting; and developing and updating guidance related to implementing section 961. Federal Internal Control Standards Standards for Internal Control in the Federal Government provides the overall framework for establishing and maintaining internal control in federal agencies. Agency management is responsible for adapting the framework for an agency. Furthermore, an agency may use the framework to organize its development and implementation of internal controls and implement its standards throughout the agency or at an office level. Five interrelated components and associated principles establish requirements for developing and maintaining an effective internal control system: Control environment: The control environment is the foundation for an internal control system. It provides discipline and structure, which affect the overall quality of internal control. It influences how objectives are defined and control activities are structured. The oversight body and management establish and maintain an environment throughout the entity that sets a positive attitude toward internal control. Risk assessment: Management assesses the risks facing the entity as it seeks to achieve its objectives. This assessment provides the basis for developing appropriate risk responses. Management assesses risks the entity faces from external and internal sources. Control activities: Control activities are the actions management establishes through policies and procedures to achieve objectives and respond to risks in the internal control system, which includes the entity’s information system. Information and communication: Management uses quality information to support the internal control system. Effective information and communication are vital for an entity to achieve its objectives. Entity management needs access to relevant and reliable communication related to internal and external events. Monitoring: Internal controls are dynamic and have to be adapted continually to risks and changes an entity faces. Monitoring the internal control system is essential in helping internal control remain aligned with changing objectives, environment, laws, resources, and risks. Internal control monitoring assesses the quality of performance over time and promptly resolves the findings of audits and other reviews. Corrective actions are a necessary complement to control activities to achieve objectives. To be effective, an agency’s internal control system must incorporate the five components of internal control in an integrated manner throughout its operations and on an ongoing basis. Once in place, internal control provides reasonable, not absolute, assurance of meeting agency objectives. When evaluating the design of internal control, management determines if controls individually and in combination are capable of achieving an objective and addressing related risks. To the extent a control does not fully achieve an objective or address related risks, it is deficient, and such deficiencies may be associated with a control’s design or operation. A deficiency in design exists when a control necessary to meet a control objective is missing, or an existing control is not properly designed so that even if the control operated as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Federal Managers’ Financial Integrity Act and SEC Assurance Statement In addition to the requirements under section 961 of the Dodd-Frank Act, SEC must establish and maintain effective internal control and financial management systems that meet the objectives of the Federal Managers’ Financial Integrity Act of 1982 (FMFIA). FMFIA requires agencies to annually assess and report on the internal controls that protect the integrity of their programs and whether financial management systems conform to related requirements. In addition, FMFIA requires agencies to provide an assurance statement regarding the effectiveness of the agency’s internal controls. SEC’s internal controls for financial management systems are not included in this report because they are reported in our annual financial audit of SEC. In addition, all of SEC’s internal controls—including those which constitute internal supervisory controls—are in scope for FMFIA. SEC’s Framework for Assessing the Effectiveness of Internal Supervisory Controls Reflected Internal Control Standards In response to section 961 of the Dodd-Frank Act, the Working Group put in place a framework that provides guidance for division and office staff responsible for assessing the effectiveness of internal supervisory controls (control framework). The control framework draws on external sources such as federal internal control standards as well as internal documents such as SEC’s Reference Guide for Compliance with Section 961 of the Dodd-Frank Act, the Risk Management and Internal Control Review Reference Guide from the Office of the Chief Operating Officer, and the charter for the Working Group. These internal documents include definitions, criteria, and other guidance and together compose SEC’s control framework. For example, the control framework includes time frames for when divisions and offices should assess their internal supervisory controls and report findings to Congress (see fig. 1). SEC’s control framework consists of three phases—risk assessment, internal supervisory control testing, and communication of results—during which division and office staff conduct activities to systematically assess and report on the effectiveness of their internal supervisory controls (see fig. 2 for examples). Changes to SEC’s Control Framework Included Refining Guidance and Classification of Internal Supervisory Controls Changes to SEC’s control framework since our last review (which focused on fiscal years 2013–2015) include revisions to key guidance documentation and reclassification of some controls (as nonsupervisory controls). The Working Group revised elements of its control framework documentation since our last review. First, the Working Group streamlined the Reference Guide for Compliance with Section 961 by removing direct guidance—for example, steps staff should take to assess the design and operation of internal supervisory controls—and replaced it with references to the Risk Management and Internal Control Review Reference Guide. Second, the Working Group also updated other information such as the agency’s definition for internal supervisory control. Third, some divisions and offices changed which controls they considered to be internal supervisory controls subject to section 961 assessments. As stated previously, SEC defines internal supervisory controls as the processes established by management to monitor that procedures applicable to staff (the established day-to-day procedures to be followed by the employees within the applicable program) are consistently being performed according to policy and procedures, and also remain reasonable, adequate, and current. Division and Office officials elaborated further, stating they only consider controls that are supervisory in nature and directly related to the consistent and complete execution of examinations of registered entities, enforcement investigation, or reviews of corporate financial securities filings to be internal supervisory controls relevant to section 961. More specifically, OCIE reduced the number of controls it classified as internal supervisory controls from 40 in fiscal year 2015 to 14 in fiscal year 2018 by reclassifying some controls as nonsupervisory controls and by consolidating others (see table 2). For example, OCIE no longer classifies examination program strategy and selection controls (such as development and dissemination of examination program goals) as internal supervisory controls. Therefore, the controls are no longer assessed under section 961. OCIE officials explained that the strategy and selection of controls are performed by management and related to the selection of registrants for examinations, and not to staff conducting examinations consistently with professional competence and integrity. Similarly, the number of internal supervisory controls Corporation Finance maintained decreased from 25 in fiscal year 2015 to eight in fiscal year 2018. Corporation Finance officials told us that they determined that certain controls previously considered relevant to section 961 did not represent processes that fall within the core function of reviewing corporate financial securities filings and thus should not be considered internal supervisory controls under section 961. Enforcement maintained 25 internal supervisory controls from fiscal year 2015 to fiscal year 2018, while OCR had 13–14 internal supervisory controls during the same period. SEC’s Control Framework Reflected Internal Control Standards As of the end of fiscal year 2018, SEC’s control framework continued to reflect key components of internal control. We compared the framework against federal internal control standards. Specifically, we assessed whether the control framework reflected the five components of internal control—control environment, risk assessment, control activities, information and communication, and monitoring. We determined that SEC’s control framework included attributes covering each of the components. For example, the framework included oversight structures to monitor the design and operation of division and office internal supervisory controls, assigned responsibilities to division and office staff, incorporated steps for staff to follow to assess risks and test internal supervisory controls, and included mechanisms to correct deficiencies and report findings to internal and external stakeholders (such as Congress). See table 3 for additional examples that illustrate how the control framework reflected relevant standards. SEC Lacks Policies and Procedures to Systematically Assess the Effectiveness of Staff Procedures Divisions and offices have not developed written policies and procedures to ensure that they systematically assess the effectiveness of procedures applicable to staff who perform examinations of registered entities, enforcement investigations, and reviews of corporate financial securities filings. As mentioned previously, the report required under section 961 of the Dodd-Frank Act must include an assessment of the effectiveness of both internal supervisory controls and staff procedures. Division and office officials told us that they used findings and conclusions from their internal supervisory control assessments to support their conclusions that staff procedures were effective. As discussed earlier, SEC defines internal supervisory controls to include two types of processes used by managers: (1) those used to monitor whether staff follow existing procedures and (2) those used to monitor whether the procedures remain reasonable, adequate, and current. We found that SEC’s assessments of internal supervisory controls did not directly assess the effectiveness of staff procedures for three primary reasons. First, the controls included in SEC’s assessment generally consist of processes that monitor whether staff follow existing procedures, not processes that monitor whether the procedures remain reasonable, adequate, and current. Second, SEC’s assessments of internal supervisory control focus on evaluating the extent to which managers executed the controls for which they are responsible. Although the controls monitor whether staff follow underlying procedures, the control assessments do not directly address whether those underlying staff procedures are designed to effectively achieve their stated objectives (for example, identifying and mitigating securities misconduct by securities market participants). Lastly, documentation of division and office internal supervisory control assessments did not speak to how division and office staff reached conclusions that procedures applicable to staff were effective. In addition to findings from internal supervisory control assessments, SEC officials also told us about policies and procedures, compliance testing, and other activities that provide information regarding the effectiveness of staff procedures. Corporation Finance officials further elaborated by stating that there is no single or discrete assessment to test the effectiveness of staff procedures. Rather, the officials explained that the division relies on activities performed throughout the year that contribute to the evaluation of the effectiveness of staff procedures. Examples of activities all or some divisions and offices referenced included the following: Enforcement, Corporation Finance, OCIE, and OCR officials told us that senior management from each division or office monitor the effectiveness of their programs throughout the year to help assess the effectiveness of staff procedures. Examples of monitoring activities include discussions with staff and subject-matter experts who perform examinations of registered entities, enforcement investigations, and reviews of corporate financial securities filings. OCR and Corporation Finance provided examples of documentation for these activities. Enforcement, Corporation Finance, OCIE, and OCR provided documentation that showed they developed review teams, task forces, projects, or initiatives that review specific policies or risks, which can result in updates to procedures. Corporation Finance, OCIE, and OCR officials told us that they have implemented reviews and redesigns of their policies and procedures through periodic reviews of their respective program manuals. See table 4 below for additional examples of activities that divisions and offices referenced as assessments of the effectiveness of staff procedures. The activities mentioned above could provide valuable information for staff who perform examinations of registered entities, enforcement investigations, and reviews of corporate financial securities filings, but they do not represent systematic assessments for the purposes of section 961. In particular, these activities varied between divisions and offices, mostly were implemented on an irregular basis, and were not established through written policies or procedures. In addition, none of the divisions and offices provided documentation linking the results of these, or any other, activities to the conclusions in SEC’s annual reports to Congress under section 961, each of which have stated that SEC’s staff procedures were effective for the period under review. Furthermore, only Corporation Finance officials told us that they discuss the effectiveness of staff procedures with their Director when they present their annual internal supervisory control assessment findings. As stated previously, the control framework includes an oversight structure, timelines, evaluation criteria, and documentation requirements, and SEC considers its control assessments under the framework to represent assessments of the effectiveness of staff procedures. However, SEC has not developed detailed policies, procedures, or guidance for assessing the effectiveness of staff procedures for the purposes of section 961. For example, the activities that divisions and offices referenced as assessing the effectiveness of staff procedures were not established through written policies for section 961-reporting purposes. And, existing guidance documents such as the Reference Guide for Compliance with Section 961 do not include steps or documentation requirements for assessing staff procedures. Federal internal control standards state the importance for agency management to establish policies and procedures to achieve objectives. Because divisions and offices lack written policies and procedures for assessing the effectiveness of staff procedures, each uses informal methods and varied processes instead of a systematic approach that document how each division and office reached its conclusions (that staff procedures were effective) in SEC’s annual section 961 report to Congress. Establishing written policies and procedures for systematically assessing the effectiveness of staff procedures would provide SEC with greater assurance that the procedures were effective in the context of section 961 and would help divisions and offices meet objectives. Selected Controls Were Designed Consistent with Standards, but Some Lacked Directions for Implementing Control Activities To evaluate the extent to which SEC’s internal supervisory controls met federal internal control standards and SEC guidance, we evaluated a non-generalizable sample of internal supervisory controls. We assessed whether (1) controls were designed to address objectives and respond to risks and (2) control activities were implemented through policies. We discuss below our findings related to the 39 internal supervisory controls that SEC identified as related to section 961. See appendix II for an example of the template we used to evaluate the controls. All of the Selected Controls Addressed Identified Objectives and Risks All 39 internal supervisory controls that we evaluated incorporated design elements to achieve SEC’s control objectives and respond to risks that SEC identified. We assessed the overall design of selected internal supervisory controls against four design elements identified in federal internal control standards: Control activities should respond to identified objectives and risks, Appropriate types of control activities should be used, Control activities should be designed at the appropriate levels of the organization (Director, Assistant Director, Branch Chief, etc.), and Control activity duties should be segregated where practical. We found that, for the selected controls, each division and office designed control activities to respond to identified objectives and risks by identifying the risks addressed by each control and the control objective (how a control will address the associated risk) in their risk and control matrixes. In their risk and control matrixes, the divisions and offices also have established characteristics identified by relevant standards as important for designing appropriate controls, including the control frequency, control owner, and whether a control is automated or manual, preventive or detective, and key or secondary. To ensure that control activities are designed at the appropriate levels, each division and office identified control owners in their risk and control matrixes and in the control descriptions they identified the job title of staff responsible for executing the controls. Finally, the divisions and offices segregated control duties in cases in which the need for such segregation was apparent. For example, a second review by a higher-level official was included in some controls that required approval decisions. For the results of our control design assessments, see appendix III. Some Control Activity Descriptions Lacked Sufficient Information for Implementation and Monitoring Ten of the 39 controls we evaluated lacked key information needed to help ensure execution of the control activities (see table 5). Federal internal control standards state that documentation is required for the effective design, implementation, and operating effectiveness of an entity’s internal control system, including documentation of internal control responsibilities through policies. We assessed SEC’s documented control activities against three key attributes identified in federal internal control standards: Establishment of procedures to support control execution, Assignment of responsibility for control execution, and Establishment of time frames for control execution. Two or three of the selected controls from each division and office did not incorporate key execution attributes, as seen in table 5. For the results of our control design assessments, see appendix III. Descriptions for many control activities did not specify procedures to be performed or, in some cases include time frames, but all controls we assessed assigned responsibility for control execution (see table 6). More specifically, 10 of the 39 controls had no requirement to document execution of the control activities. For example, one Enforcement control and two Corporation Finance controls intended to monitor compliance with timeliness metrics did not include a requirement to document whether the control activities had been executed—that managers completed the review of the timeliness reports, noted if any cases were nearing the time frame threshold, or took appropriate actions in response. In addition, three of the 39 controls we reviewed did not include the control activity attribute of follow-up actions to be taken. For example, the Corporation Finance timeliness controls discussed above also did not establish follow-up actions for cases in which a team or individual neared the timeliness threshold. Follow-up actions could include emailing or calling relevant staff when a timeliness threshold was within a certain number of days of being breached. The divisions and offices did not establish operational procedures for how the control activities would be performed in three of the 39 controls we reviewed. For example, an OCIE control intended to track enrollment and completion of new examiner training lacked underlying procedures for identifying or tracking training progress of new employees. The divisions and offices did not establish time frames for executing control activities in three of the 39 controls we reviewed. For example, while the Corporation Finance timeliness controls discussed above identified the reports to be reviewed, one of the two controls did not specify when the reports should be reviewed. By not incorporating key control attributes into their control activities, SEC may not have reasonable assurance that internal supervisory controls are effectively implemented. Some of the controls with weaknesses in one or more of the control attributes lacked documentation of the controls’ execution, which hindered our ability to test whether the controls operated as intended, as discussed in the next section. For example, two of the timeliness controls for Corporation Finance, described above, did not include a documentation requirement, and no documentation of control execution was created. In lieu of reviewing documentation of control execution, for SEC’s assessment of the effectiveness of its internal supervisory controls, the divisions and offices asked supervisors twice a year (by email) whether they had executed this control weekly over the course of the year. Staff from some divisions and offices said the reason that control activity attributes were not included in some of the controls was because policies and procedures had been long established and orally communicated, but not written into the control activities. Based on Standards for Internal Control in the Federal Government, SEC developed a reference guide to provide guidance for identifying, documenting, and monitoring controls. The reference guide states that internal control activities should be written to describe the actual activities performed to meet the control objective, and at a minimum, identify control procedures and how they are to be executed, establish a documentation requirement for control execution, and assign responsibility and establish time frames for control execution. Following SEC guidance for developing control activities could help divisions and offices ensure evidence exists of control execution and better enable control monitoring by SEC, and oversight by external parties, such as GAO and the SEC Inspector General. In turn, better control monitoring would help ensure that SEC’s internal supervisory controls are effectively implemented and that procedures necessary to achieve organizational objectives are followed. Furthermore, enhancing control activity descriptions would provide SEC greater assurance that staff have the information necessary to effectively implement the controls. Assessed Controls Operated or Partially Operated as Intended, but Some Controls Could Not Be Assessed Because of Documentation Weaknesses We selected 18 of 39 internal supervisory controls across the four divisions and offices to assess whether they operated as intended in fiscal year 2018. (See figure 3 for an overview of how we determined they operated as intended, partially operated as intended, or did not operate as intended.) As an example of how we conducted these assessments, we reviewed one OCIE control that called for manager approval at three points of an examination and additional assistant director approval to close the examination, as described in OCIE’s control documentation. To assess whether this control operated as intended, we selected and reviewed a random, generalizable sample of examinations in OCIE’s internal system to determine whether all of the control’s activities—in this case, management approvals—had been executed. We could not assess some of the controls we selected because SEC did not provide sufficient documentation to allow us to determine whether the control operated as intended. For example, two of four Corporation Finance controls did not include a documentation requirement for weekly monitoring of staff compliance with internal policy. As a result, documentation did not exist for us to assess whether supervisors executed these control activities throughout the year. For more information on how we determined whether controls were operating as intended, see appendix I. All of the Controls That Could Be Assessed Operated or Partially Operated as Intended Of the 15 controls we could assess, 13 operated as intended and two partially operated as intended (see table 7). We could not assess three controls because sufficient documentation was not provided. More specifically, a control documentation requirement was not established for the three controls—as identified through our assessment of the control’s design, described earlier. We determined that two OCIE controls partially operated as intended. For example, while we found that 20 percent of sampled OCIE examinations were not approved within the designated deadline, all examinations were closed and included all required elements (see table 8). Some Selected Controls Could Not Be Assessed Because Documentation of Control Execution Did Not Exist We were unable to assess three of 18 selected controls because the divisions and offices did not provide sufficient documentation on the execution of control activities (see table 9). We found these controls lacked a documentation requirement for control execution in their control activity descriptions and did not produce sufficient documentation, which prevented us from determining whether these controls operated as intended. For example, two of four Corporation Finance controls did not include a requirement to document execution of the control activity— weekly monitoring of staff compliance with internal policy. Because these controls did not produce documentation of weekly monitoring throughout the year as prescribed in the control activity frequency, we did not receive documentation to allow us to assess whether supervisors executed these control activities on a weekly basis or, in some cases, at all. Additionally, we could not assess one selected OCIE control involving tracking of new employee training. Conclusions To help detect and prevent securities misconduct, section 961 of the Dodd-Frank Act requires SEC to assess the effectiveness of both its internal supervisory controls and the procedures applicable to staff who perform examinations of registered entities, enforcement investigations, and reviews of corporate financial securities filings. While SEC has established a framework for systematically assessing the effectiveness of its internal supervisory controls, it has not established a framework for systematically assessing the effectiveness of staff procedures or documenting how SEC reached related conclusions about the procedures in its annual reports to Congress under section 961. Creating written policies and procedures to systematically assess the effectiveness of staff procedures and documenting the results of such assessments would provide SEC with greater assurance that the staff procedures are effective, a key objective of section 961. Every control we reviewed incorporated design elements to achieve SEC’s control objectives and respond to risks that it identified. However, nine of the 39 controls did not incorporate one or more key attributes that would help ensure execution of the control, including documentation requirements, detailed procedures, identification of follow-up actions, assignment of responsibility for control execution, and time frames for control execution. Following SEC guidance for developing detailed control activities could help divisions and offices ensure evidence of control execution and better enable control monitoring by SEC and external parties, such as GAO and the SEC Inspector General. In turn, better control monitoring would help ensure that SEC’s internal supervisory controls are effective and that procedures necessary to achieve organizational objectives are followed. Furthermore, enhancing control activity descriptions would provide SEC greater assurance that staff have the information necessary to effectively implement the controls. Recommendations for Executive Action We are making the following five recommendations to SEC. The SEC Chair should direct the Directors of the Division of Corporation Finance, Division of Enforcement, Office of Compliance Inspections and Examinations, and Office of Credit Ratings to develop written policies and processes to systematically assess the effectiveness of staff procedures (procedures applicable to staff who perform examinations of registered entities, enforcement investigations, and reviews of corporate financial securities filings). Examples of elements SEC could include in the policies and processes are the steps necessary to conduct such assessments, including time frames in which the assessments should be performed and reviewed; assignment of responsibilities related to the assessments; requirements for documenting assessments; and steps for staff to take to mitigate and report deficiencies identified as a result of the assessments. (Recommendation 1) The Director of the Division of Corporation Finance should ensure that all internal supervisory controls include documentation requirements, detailed procedures, identified follow-up actions, implementation time frames, and assignment of control execution responsibility, in accordance with SEC guidance and federal internal control standards for implementing control activities through documented policies. (Recommendation 2) The Director of the Division of Enforcement should ensure that all internal supervisory controls include documentation requirements, detailed procedures, identified follow-up actions, implementation time frames, and assignment of control execution responsibility, in accordance with SEC guidance and federal internal control standards for implementing control activities through documented policies. (Recommendation 3) The Director of the Office of Compliance Inspections and Examinations should ensure that all internal supervisory controls include documentation requirements, detailed procedures, identified follow-up actions, implementation time frames, and assignment of control execution responsibility, in accordance with SEC guidance and federal internal control standards for implementing control activities through documented policies. (Recommendation 4) The Director of the Office of Credit Ratings should ensure that all internal supervisory controls include documentation requirements, detailed procedures, identified follow-up actions, implementation time frames, and assignment of control execution responsibility, in accordance with SEC guidance and federal internal control standards for implementing control activities through documented policies. (Recommendation 5) Agency Comments We provided a draft of this report to SEC for review and comment. In written comments (reproduced in appendix VI), SEC agreed with our findings and concurred with our recommendations. In addition, SEC provided technical comments, which we incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees, the Chair of SEC, and other interested parties. In addition, this report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (202) 512-8678 or clementsm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix VII. Appendix I: Objectives, Scope, and Methodology This report focuses on activities that fall within the purview of the Division of Corporation Finance (Corporation Finance), Division of Enforcement (Enforcement), Office of Compliance Inspections and Examinations (OCIE), and Office of Credit Ratings (OCR) at the Securities and Exchange Commission (SEC)—to which we refer collectively as the divisions and offices. We examined (1) the extent to which SEC’s internal supervisory control framework during fiscal years 2016–2018 reflected federal internal control standards; (2) how SEC evaluated the effectiveness of staff procedures in fiscal year 2018; (3) the extent to which selected controls in fiscal year 2018 were designed consistent with relevant standards; and (4) the extent to which selected controls operated as intended in fiscal year 2018. For our first objective, we obtained and reviewed relevant documentation on SEC’s internal supervisory control framework for fiscal years 2016– 2018 and interviewed division and office staff responsible for developing and updating the framework. We then assessed this framework against Standards for Internal Control in the Federal Government and determined the extent to which the framework reflected these standards. Specifically, we assessed the framework against the five components of internal control—control environment, risk assessment, control activities, information and communication, and monitoring—and the 17 principles associated with these components. We compared information on changes SEC made to its internal supervisory control framework with information from our previous review and federal internal control standards to determine the extent to which the framework continued to reflect internal control standards. For our second objective, we reviewed policies, procedures, and guidance documents (for fiscal year 2018) relating to SEC assessments of the effectiveness of procedures applicable to staff who perform examinations of registered entities, enforcement investigations, and reviews of corporate financial securities filings. We also interviewed SEC staff to obtain an understanding of the steps and activities that divisions and offices take to assess the effectiveness of staff procedures. We intended to assess how SEC assessed staff procedures to determine the extent to which SEC’s assessments reflected federal internal control standards. However, as discussed in the report, we found SEC did not have a framework for assessing the effectiveness of staff procedures. We therefore examined policies, procedures, and guidance, but did not assess them against the components and principles associated with the federal standards for internal control. For our third objective, we used the policies, procedures, and control objectives to determine if the design of selected division and office internal supervisory controls in place during fiscal year 2018 was consistent with federal internal control standards and SEC guidance for designing internal controls. We developed an evaluation template and used it to assess selected controls from each division and office by having multiple analysts conduct independent reviews and then reached a final consensus by conducting a joint review with the same analysts. We used Standards for Internal Control in the Federal Government and The Committee of Sponsoring Organizations of the Treadway Commission’s Internal Control – Integrated Framework to develop our template. We also reviewed documents and interviewed staff to obtain a thorough understanding of the internal supervisory controls used to oversee the processes for conducting examinations of registered entities, enforcement investigations, and reviews of corporate financial securities filings. We selected for our review a non-generalizable sample of 53 controls in place during fiscal year 2018—13 controls in Corporation Finance, 15 controls in Enforcement, 11 in OCIE, and 14 in OCR. We grouped these controls into sets because some underlying staff processes had multiple associated controls. In cases in which we selected a control that was part of a set, we would review every control in the associated set. We selected controls and control sets that SEC designated as being associated with processes that have the highest risk or potential impact on achieving stated objectives until we reached our target of 10–15 controls per division or office. Some control sets also contained controls that were not related to section 961. Therefore, to fully assess complete control sets associated with underlying processes, our selection contained some controls that were not related to section 961. However, in this report we only discuss and include analysis for those controls that SEC identified as related to section 961, which comprises 39 controls—eight in Corporation Finance, 10 in Enforcement, eight in OCIE, and 13 in OCR. For our fourth objective, we developed an evaluation template for each control and conducted independent primary and secondary reviews to reach a final consensus on the operation of each control. The template was created using SEC’s control activities and related policy and procedural documents we received as part of our design assessment. We used the template to determine the extent to which the execution of controls met the design criteria. Depending on the extent to which they met criteria established from control design documents, the selected controls were grouped under one of the following categories: (1) operated as intended, (2) partially operated as intended, (3) did not operate as intended, and (4) could not be assessed because control documentation did not exist due to design weaknesses, was not received, or was not relevant. Because the nature of controls varied, we evaluated controls by applying the factors below in conjunction with professional judgment. We focused on whether deficiencies would affect the implementation and operation of controls. For controls that operated as intended, we determined that the divisions and offices provided documentation demonstrating that all control activities were executed for the instances of control implementation we reviewed. We considered controls to have partially operated as intended if the documentation provided supported that only some control activities were executed or if at least one control activity did not operate as intended, but the overall control was executed for most instances. We did not identify any controls that did not operate as intended. This determination would have applied to controls for which we received sufficient documentation to assess the control’s operation and for which the divisions and offices did not execute all control activities in most instances. For controls that we could not assess, we did not receive sufficient documentation that would enable us to make a determination of whether the control was executed or operated as intended. For these controls, we also used the results of our design assessments to determine whether the controls included a documentation requirement that would enable us to assess whether they operated as intended. We judgmentally selected a non-generalizable sample of 18 controls across all four divisions and offices from the population of 39 internal supervisory controls we reviewed in the third objective. We selected these controls based on factors such as whether they were classified as key to achieving objectives, high-risk, or having high potential impact on achieving stated objectives or likelihood of failure. We then created a generalizable, random sample of cases to review for eight controls, and we reviewed all instances for the remaining controls because they occurred annually or had few instances. In some cases, we conducted on-site testing in which we assessed samples of cases for controls by demonstrations of the divisions and offices’ internal systems. We conducted this performance audit from October 2018 to December 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix II: Template for GAO’s Assessment of the Internal Supervisory Control Design of the Securities and Exchange Commission This appendix illustrates the template we used to assess the design of selected controls from each division and office that we reviewed at the Securities and Exchange Commission (SEC). For each control, we reviewed policies, procedures, and control objectives to determine if the design of the selected internal supervisory controls was consistent with federal internal control standards and SEC guidance for designing internal controls. Appendix III: GAO Testing Results for the Design of Selected Securities and Exchange Commission Controls, Fiscal Year 2018 To assess the extent to which design of the Securities and Exchange Commission’s (SEC) internal supervisory controls was consistent with federal internal control standards and SEC guidance for designing internal controls, we reviewed 39 internal supervisory controls across the four divisions and offices in place during fiscal year 2018. We used the policies, procedures, and control objectives to determine if the controls’ designs were consistent with the standards and guidance. Appendix IV: Template for GAO’s Assessment of the Operation of Internal Supervisory Controls by the Securities and Exchange Commission This appendix illustrates the template we used to assess the operation of selected Securities and Exchange Commission internal supervisory controls. For each control, we compared control activity descriptions, including policy and procedure documents to determine whether selected controls operated as intended. Appendix V: GAO Testing Results for Selected Securities and Exchange Commission Controls, Fiscal Year 2018 As part of our review, we tested 18 internal supervisory controls across four divisions and offices at the Securities and Exchange Commission (SEC) to determine whether they operated as intended. Controls were assessed using SEC’s control activity descriptions, including related policy and procedure documents. For controls that operated as intended, SEC provided documentation demonstrating that all control activities were executed. We considered controls to have partially operated as intended if the documentation supported that only some control activities were executed or if at least one control activity did not operate as intended, but the overall control was executed. We did not identify any controls that did not operate as intended, but this would have applied to controls for which we received sufficient documentation and the divisions and offices did not execute all control activities. Controls that we could not assess lacked sufficient documentation that would have enabled us to determine whether they operated as intended. Appendix VI: Comments from the Securities and Exchange Commission Appendix VII: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Kevin Averyt (Assistant Director), Christopher Ross (Analyst in Charge), Aaron A. Colsher, Justin Fisher, Efrain Magallan, Marc Molino, Kirsten Noethen, Barbara Roesmann, and Farrah Stone made key contributions to this report.