Background NMB’s Organization and Mission NMB is headed by a three-member board, with each member appointed by the President and confirmed by the Senate for a term of 3 years. The board members provide overall leadership and strategic direction for NMB, and retain responsibility for key functions such as releasing parties from the mediation of major disputes if no agreement can be reached. In May 2018, NMB reorganized various agency components to improve its management and oversight of agency operations. This resulted in the creation of three mission areas and three mission support areas. The Offices of Fiscal Services and Information Services were newly created as a result of the delegation order (see fig. 1). In June 2019, NMB hired a Chief Financial Officer (CFO), who serves as the Director of the Office of Fiscal Services. The CFO has authority over NMB’s budget, accounting, and financial auditing functions. In January 2019, NMB hired a Chief Information Officer (CIO), who serves as the Director of the Office of Information Services. The CIO has authority over NMB’s information technology and related systems, including its electronic record keeping functions. All offices, along with NMB’s Designated Agency Ethics Official, report directly to the Board. Previously, the Offices of Administration, Mediation, and Arbitration reported to a Chief of Staff, a position that was eliminated in 2018. NMB’s overall mission is to provide for the independence of air and rail carriers and employees in matters of self-organization, help prevent interruption to commerce conducted through the operation of those carriers, administer adjustment boards, as well as develop complementary strategies to resolve disputes. NMB has three program areas to fulfill its mission: Representation. Rail or air carrier employees select unions for the purposes of collective bargaining through secret-ballot elections conducted by NMB. NMB is charged with resolving any questions concerning representation of a specific craft or class through the agency’s Office of Legal Affairs, and has sole jurisdiction to decide these disputes. Mediation and Alternative Dispute Resolution. The RLA provides for mediation to help resolve disputes between management and labor during collective bargaining negotiations. When rail or air carriers and unions cannot reach agreement on the terms of a new or revised collective bargaining agreement – such as working conditions or rates of pay – either party can apply for NMB’s mediation services to resolve their differences. Additionally, NMB may impose mediation if it finds that resolving the dispute is in the public’s interest. NMB also offers grievance mediation to parties as an alternative way to resolve disputes filed for grievance arbitration. Although mediation is voluntary, it is a less expensive approach to resolving grievances, using NMB’s existing mediation staff rather than outsourcing—and paying—external arbitrators. Arbitration. The RLA also offers grievance arbitration to help resolve disagreements between carriers and unions over how to interpret and apply provisions of existing collective bargaining agreements. NMB does not directly provide arbitration services, but rather maintains a list of registered arbitrators from which the parties can select someone to review and decide their case. In the airline industry, the parties pay the costs of arbitration. In the railroad industry, however, consistent with the requirements of the RLA, NMB pays the fee and travel expenses of the arbitrator. Executive Branch Oversight of the NMB The Office of Management and Budget (OMB) and the Office of Personnel Management (OPM) have key oversight responsibilities for all federal agencies, including NMB. OMB is responsible for the oversight of NMB’s management and information technology. OPM is the central personnel management agency of the federal government charged with administering and enforcing civil service laws, regulations, and rules. OPM annually administers surveys to federal employees across the government, including NMB, to solicit their views on their agencies including agency leadership, collaboration, and other issues. OPM also offers various services to agencies to evaluate organizational climate. Federal law does not establish an Inspector General (IG) for NMB. However, the agency signed a Memorandum of Understanding (MOU) in 2018 with the National Labor Relations Board’s (NLRB) Office of Inspector General to provide independent audit and investigative oversight. In the MOU, the NLRB IG agreed to (1) operate a hotline for employees to anonymously submit information—via email or telephone messages—regarding fraud, waste, and abuse involving the NMB’s programs and operations, and (2) take action to address complaints, such as inform the appropriate law enforcement agency or the NMB Chairman or Board Members, as appropriate. Federal Risk and Authorization Management Program (FedRAMP) Requirements FedRAMP is a government-wide program that provides authorizations for use of cloud services. As an executive agency that uses a cloud service approved through FedRAMP, NMB is subject to related requirements. Through a December 2011 memorandum, OMB established requirements for executive agencies to use FedRAMP when conducting security authorizations for agency use of cloud services. In addition, the FedRAMP Program Management Office issued guidance in 2017 that specifies authorization requirements, including that an agency should document the authorization of the agency system supported by a cloud service approved through FedRAMP and the related cloud service used by the agency. Prior GAO Work GAO has issued three prior reports on NMB and collectively had 13 recommendations. NMB had previously implemented six of those recommendations, and seven remained in our current review. We issued our first report in December 2013 with seven recommendations in key management areas, including strategic planning, performance measurement, and workforce planning. We also suggested that Congress consider authorizing an IG at an appropriate federal agency to provide independent audit and investigative oversight at NMB. We issued a second report in February 2016, which found that NMB needed to take additional actions to implement the seven recommendations from our December 2013 report. We also made one additional recommendation related to procurement. We issued our third report in March 2018, which found that NMB had taken action to implement four of the recommendations from our December 2013 report and the recommendation from our February 2016 report. However, additional actions were needed to close the remaining three recommendations. We also made five additional recommendations related to the backlog of arbitration cases, outside employment, organizational climate, and NMB’s travel and telework policies. Since 2018, NMB Has Fully Implemented One Open GAO Recommendation, but Additional Actions Are Needed to Fully Address Others and Meet New Information Security Requirements NMB Has Fully Implemented One of GAO’s Seven Open Recommendations, but Shortcomings Persist in Other Areas NMB implemented a recommendation from GAO’s 2018 report to create and monitor requests for outside employment, but has not taken action to fully implement the remaining six recommendations from GAO’s past reviews (see table 1). By not fully implementing these recommendations, NMB remains at risk in several areas key to its mission, including information privacy and security and organizational climate, among others. Ethical Standards for Outside Employment and Activities GAO 2018 Recommendation: Develop and implement policies for approval and monitoring of employee requests for outside employment and other outside activities to prevent violations of ethics rules, consistent with Office of Government Ethics standards of conduct and federal internal control standards. Since our 2018 review, we found that NMB has developed and implemented policies for approving employee requests for outside employment and the agency monitors these requests. We reported in 2018 that NMB did not have a policy for approving and monitoring employee requests for outside employment consistent with the Office of Government Ethics (OGE) standards of conduct and federal internal controls. NMB also did not systematically track or monitor when managers or board members approved such activities for an employee. We recommended that establishing an outside employment policy and a system to monitor activities would help to prevent violations of ethics rules. In our current review, we found that NMB has implemented our recommendation. NMB worked with OGE to develop a policy on outside employment that details how employees should submit outside employment requests, consistent with OGE standards. NMB has incorporated the policy into annual and new employee ethics training. Once NMB approves an outside employment request, the agency monitors outside employment through employees’ annual financial disclosure forms. Rail Arbitration Case Backlog GAO 2018 Recommendation: Develop and execute a plan to address the rail arbitration case backlog. Since our 2018 review, we found that NMB has used several strategies to reduce its backlog by 57 percent; however, without a plan establishing specific goals and timeframes, it is difficult to track the agency’s progress against specific measures of success. We reported in 2018 that NMB’s rail grievance arbitration case backlog had more than tripled since 2011, and that NMB did not have a specific plan and related processes to address it. However, identifying and assessing the risks associated with the backlog and developing a plan to effectively manage it are key to implementing effective risk management. In our current review, we found that NMB has implemented several initiatives to reduce the rail grievance arbitration case backlog, including removing older cases, using lead cases—cases that have the same parties and similar fact patterns, allowing a decision from one case to settle others—and promoting an “Ambassador Program” to move cases from grievance arbitration to grievance mediation. NMB officials credit these strategies with reducing the backlog from a height of 8,550 cases at the end of fiscal year 2017 by 4,852 cases—about 57 percent—to 3,698 cases as of the end of fiscal year 2019 (see table 2). 1. Removing older cases. NMB officials said that NMB has removed older arbitration cases that were filed, but had not yet been moved forward to arbitration. Specifically, officials explained that, in late summer 2018, NMB removed 400 cases from the backlog that were 3 years or older. NMB officials said that the agency subsequently removed 1,025 cases that were 2 years or older. NMB officials told us that parties may choose to re-file a removed case. NMB has not received objections from unions and carriers regarding the removal of older cases. 2. Using lead cases: For lead cases, NMB and the parties agree that the decision for one case will be used to settle other cases with similar fact patterns. For example, officials said that a similar fact pattern would be cases that had the same union and carrier and dealt with the same underlying issue. In fiscal year 2017, NMB used the decisions for nine lead cases to settle 4,240 additional claims. In fiscal year 2018, NMB used the decisions for four lead cases to settle 600 additional claims. 3. Promoting the Ambassador Program. NMB’s Ambassador Program involves NMB reaching out to parties to encourage them to voluntarily move cases from arbitration to grievance mediation. NMB has assigned experienced mediators to carriers and unions as “ambassadors.” Unions that have disputes with a carrier can raise the issue through the ambassador in hopes of avoiding the formal arbitration process; in that way, the Ambassador Program may proactively decrease the number of arbitration cases filed. NMB is interested in using the Ambassador Program to resolve multiple claims regarding the same issue, policy, or employment action. NMB officials said in fiscal year 2018, NMB had seven cases in the Ambassador Program and closed six cases. NMB officials said in fiscal year 2019, NMB had four cases in the Ambassador Program; none are closed to date. NMB officials said that the Ambassador Program and the lead case program are related, in that many of the cases moved through the Ambassador Program are lead cases. For example, NMB reported that in fiscal year 2018, one grievance mediation case was used to settle 300 claims. In fiscal year 2017, NMB heard five cases in the Ambassador Program, and the decisions on these cases were applied to 1,951 remaining claims to resolve them. In addition, NMB officials told us a small number of railway carriers and unions file the largest percentage of the grievance arbitration cases (see fig. 2). In fiscal year 2019, four railway carriers represented 72 percent of the backlog, and four railway unions represented 87 percent of the backlog. The Office of Arbitration seeks to coordinate with the organizations with the most arbitration cases to help them move toward mediation or other techniques to decrease the arbitration backlog. Another method NMB reported using to reduce the backlog is to direct otherwise unobligated funding at the end of the fiscal year to fund arbitration cases, in addition to the amount of funds it had initially budgeted for arbitration. Specifically, NMB officials said that the agency allocated at least $1 million in additional funds in fiscal years 2017, 2018, and 2019 for arbitration cases at the end of each fiscal year, which allowed NMB to fund arbitration for approximately 4,200 more cases overall, closing nearly all of those cases. Officials said that these additional funds came from unfilled full-time equivalent staff position salaries and contracts that NMB did not award. Officials said they do not anticipate having similar amounts of funding available for arbitration in the future, once NMB hires staff and awards the contracts. While NMB has implemented various strategies to reduce the rail arbitration case backlog, it has not developed a plan to link the strategies to specific goals or timeframes. GAO’s Standards for Internal Control in the Federal Government state that management should define objectives in specific and measurable terms. Further, federal agencies are required to develop annual performance plans that measure performance to reinforce the connection between long-term strategic goals and day-to- day activities of its managers and staff. NMB’s 2018 Annual Performance and Accountability Report does not link NMB’s efforts to reduce the backlog to specific and measurable objectives to assess their effectiveness. By developing specific and measurable objectives to reduce the overall backlog or any component thereof, NMB and Congress would be able to more adequately assess NMB’s progress in reducing the backlog relative to its goals. Organizational Climate Assessment GAO 2018 Recommendation: Complete and take actions on the organizational climate assessment and survey results as a means to address employee concerns. Since our 2018 review, we found NMB has completed an organizational climate assessment but has not taken actions to address the results of that assessment. We reported in 2018 that surveyed NMB employees expressed concerns about the organizational climate at NMB. In addition, NMB’s strategic plan called for an organizational climate assessment to be conducted by the end of calendar year 2015 and every 3 years thereafter. However, at the time of our 2018 report, NMB had not conducted such an assessment. In addition, NMB officials said that they did not take action in response to survey results, which had a 59 percent response rate, because they believed the negative responses were attributable to a few employees. GAO recommended that NMB conduct an organizational climate assessment and develop actions to address the results of that assessment. In our current review, we found that NMB conducted an organizational climate assessment and has taken some actions to address the elements identified in the assessment, but must take additional actions to address employee concerns. NMB worked with OPM to conduct an organizational climate assessment in April 2019. The assessment had a response rate of 95 percent. Several NMB officials said the agency achieved a higher response rate than prior surveys because the Board held an all staff meeting to emphasize the importance of taking the assessment. In May 2019, NMB received the results of the organizational climate assessment from OPM. NMB identified a lack of communication across departmental staff as an issue. To address this, NMB directed regular interdepartmental updates, where each quarter a department is given an opportunity to present the activities within that department. NMB officials said that NMB held its first interdepartmental update in October 2019, with the Office of Legal Affairs presenting. The next interdepartmental update is scheduled for February 2020. NMB has identified some additional potential actions to address issues raised by the organizational climate assessment, including directing NMB’s CFO to rewrite the travel policy and to work with OPM to identify recommended training for supervisors, among others. However, these potential actions are not finalized and are generally unlinked to timeframes for implementation. By not taking these actions, NMB employees may be less engaged, which may lead to absenteeism or turnover. Travel Policy GAO 2018 Recommendation: Revise NMB’s Travel Policy and develop appropriate internal controls to ensure compliance with federal regulations. Since our 2018 review, we found that NMB has not revised its travel policy to be consistent with the Federal Travel Regulation (FTR) issued by the General Services Administration. We reported in 2018 that NMB’s travel policy was, in some respects, not consistent with the FTR. NMB management had also granted NMB staff exceptions to the agency travel policy that were not consistent with the FTR. For example, the FTR requires employees to rent the least expensive car available, but a former NMB management official approved the use of a luxury rental car in some cases. Our 2018 report found that without greater oversight of employee travel expenses, NMB may be incurring unnecessary additional expenses for employee travel. In our current review, we found that NMB has not revised its travel policy to be consistent with the FTR. However, NMB’s Office of Fiscal Services plans to rewrite portions of the travel policy, including clarifying roles and responsibilities of NMB employees and adding a Frequently Asked Questions portion to the policy. NMB officials said the revised policy is expected to be completed in 2020, and will be reviewed by the CFO in consultation with the Office of Legal Affairs prior to its publication. It is unclear the extent to which these changes will make NMB’s travel policy consistent with the FTR. In addition, NMB has taken steps to strengthen its internal controls related to travel, including: 1. Replacing the Chief of Staff role in travel policy. In August 2018, NMB replaced references to the eliminated Chief of Staff position in its travel policy to make the Board the decision making body for travel- related issues. This clarification strengthened internal controls because no one individual is singularly responsible for approval. 2. Updating NMB’s travel charge card program. In 2019, NMB transitioned to a new travel charge card program run by the General Services Administration. Both NMB and the Department of Treasury’s Bureau of Fiscal Services, which provides accounting services to NMB, routinely monitor the program, including monitoring each employee’s use of the travel card to ensure only appropriate official government-related expenses are being charged to the card. The CFO receives reports from this new program. 3. Issuing an interim procedure. Separately, NMB has established an interim procedure for disputed claims that sets timeframes for when vouchers must be approved to avoid delays in returning vouchers to travelers. The interim procedure requires travelers to cite the specific regulatory authority to support their disputed claim. The NMB Board is determining whether this procedure should be established officially in the travel policy. While NMB has made these initial efforts to strengthen internal controls related to travel, such as increasing oversight from the Board, NMB has not revised its travel policy to be consistent with the FTR. For example, NMB has not updated its policy to clarify the use of personal credit cards as discussed in our 2018 review. Without an updated policy consistent with the FTR, NMB may be incurring needless additional expenses for employee travel. Telework Policy Since our 2018 review, we found that NMB has not yet revised its telework policy, but the agency has collected telework agreements and provided training for teleworking employees. We reported in 2018 that NMB’s telework policy is not consistent with the requirements of the Telework Enhancement Act of 2010, which requires employees to take telework training and have signed telework agreements prior to beginning telework, and NMB did not consistently enforce its policy. NMB’s telework policy, effective October 2015, did not mention employee telework training nor did management require employees to complete training before entering into a telework agreement, as required by federal law. In addition, management allowed employees to telework without a written telework agreement, even though this requirement is specified in NMB’s telework policy. NMB agreed to review its policy and make any revisions determined to be necessary. In our current review, we found that NMB now tracks telework training and agreements to ensure that teleworking employees have telework agreements and completed telework training prior to engaging in telework. However, NMB has not updated its telework policy to be consistent with the requirements of the Telework Enhancement Act of 2010, instead determining after reviewing its policy that a revision was unnecessary. Despite this determination, the telework policy, last updated in October 2015, does not reflect the current structure of NMB: for example, it includes responsibilities for the Chief of Staff, a position that no longer exists. Further, the policy does not mention employee telework training. Until NMB updates its policy, it will continue to be outdated regarding official responsibilities and inconsistent with relevant law. NMB Has Not Fully Implemented Key Information Privacy and Security Practices, or Met Recent Information Security Requirements Information Privacy GAO 2013 Recommendation: Establish a privacy program that includes conducting privacy impact assessments and issuing system of record notices for systems that contain personally identifiable information. Since our 2018 review, we found that NMB has not always followed key information privacy practices to protect personal information federal agencies collect. In our 2018 review, we found that NMB did not establish a privacy program that included practices such as conducting privacy impact assessments and issuing system of records notices for systems that contain personally identifiable information. For example, in our 2018 review, we found that while NMB designated a privacy officer, the agency did not conduct privacy impact assessments for its systems and those of third-party providers containing the agency’s personally identifiable information. In our current review, we found that, of the four key information privacy practices described in our 2013 report, NMB is still following one, partially following two, and minimally following one practice. For example, NMB documented a privacy impact assessment dated July 2018. However, the assessment did not specify whether a system of records notice would be developed as required by OMB. For additional details on the extent to which NMB is following key information privacy practices, see appendix II. Information Security GAO 2013 Recommendation: Develop and fully implement key components of an information security program in accordance with the Federal Information Security Management Act of 2002. Since our 2018 review, we found that NMB continues to only partially follow the eight key information security practices in accordance with the Federal Information Security Management Act (FISMA). These practices include developing and implementing risk-based policies and procedures to ensure compliance with applicable standards and guidance, including system configuration requirements. For example, in our 2018 review, we found that, while NMB had its information security policy documented in its April 2016 Information Program Plan, which included risk assessment requirements, NMB had not developed agency- wide policies and procedures on the oversight of its third-party providers that support the operations and assets of the agency, as required by FISMA. In our current review, we found that, while NMB has created a policy to conduct periodic risk assessments of cyber threats and vulnerabilities, the agency did not provide risk assessment documentation of its enterprise network for fiscal year 2019. NMB officials said that the agency had not fully addressed information security practices due to a lack of resources. NMB officials stated the agency plans to address several of these practices with the targeted completion expected in fiscal year 2020. As a step to further focus on information technology challenges, NMB established the Office of Information Services and, as noted earlier, hired a CIO. While hiring a CIO does not directly address the practices described above, NMB officials said that these actions, along with hiring more staff and making key acquisitions through contracts, will enable NMB to fully follow the practices in the future. For additional details on the extent to which NMB is following key information security practices, including NMB’s recent engagement of contractors, see appendix II. In addition to the gaps in key information security practices discussed above, we found in our current review that NMB has not fully implemented federal requirements related to authorizing the cloud service approved through FedRAMP that the agency uses. OMB defines an authorization to operate as an official management decision where a federal official or officials authorize the operation of information system(s) and accept the risk to agency operations and assets, individuals, and other organizations based on the implementation of security and privacy controls. OMB requires agencies to use FedRAMP processes when granting authorizations to operate for their use of cloud services. The FedRAMP Program Management Office published guidance in 2017 to describe the process by which agencies can reuse existing authorizations. According to the FedRAMP guidance, agencies should document the authorization of 1) the agency system supported by the cloud service; and 2) the cloud service used by the agency. Additionally, the agency should provide a copy of its authorization letter for the cloud service to the FedRAMP Program Management Office so that the office can verify the agency’s use of the service and keep agencies informed of any changes to a provider’s authorization status. These steps ensure that federal agencies have made a determination of whether the cloud service provider’s risk posture is acceptable for use at that agency. According to NMB, the agency is using a cloud service that was approved through FedRAMP to support the agency’s enterprise network. NMB had documented the authorization of its enterprise network, but NMB had not documented its authorization of the cloud service to demonstrate that it had accepted the risk of using the service. In addition, NMB had not provided the authorization letter for the cloud service to the FedRAMP Program Management Office. NMB officials stated that the agency’s internal information security guidance did not include procedures to address FedRAMP requirements because the officials were unaware of those requirements. Without taking these steps, the FedRAMP Program Management Office may not be able to inform NMB, in a timely manner, if its cloud service provider has experienced a security incident. NMB Lacks Effective Internal Controls to Manage and Oversee Its Annual Appropriation and Audit Policy NMB has taken steps to improve its agency management and oversight, such as reorganizing some agency mission areas and filling key staff positions; however, it lacks effective internal controls to manage and oversee its annual appropriation and ensure that its audit policy is consistently followed. As a result, the agency did not use funding the Board said is needed to accomplish NMB goals. NMB had about $4 million in unobligated appropriations in expired accounts in the U.S. Treasury and unavailable to NMB for new obligations from fiscal years 2016 through 2019. In addition, NMB has not taken corrective actions to address management deficiencies identified during audits. NMB Lacks Effective Internal Controls to Manage and Oversee Its Annual Appropriations NMB has not established effective internal controls to assist the agency in managing and overseeing its annual appropriations. NMB has had significant unobligated balances remaining for the last 4 fiscal years, even though officials said they could not accomplish some of the agency’s goals – such as hiring staff and information technology initiatives – due to a lack of financial resources (see table 3). For example, from fiscal years 2016 through 2019, NMB had unobligated balances ranging between approximately $600,000 to over $2 million. These are the remaining funds from its appropriations received each year from fiscal year 2016 through 2019. In total, over 8 percent of NMB’s appropriations for the last 4 fiscal years went unobligated. NMB officials noted that hiring challenges and uncertainty regarding the agency’s final appropriation as a result of continuing resolutions— legislation that continues to fund federal agencies until final agency appropriations for a fiscal year are made—kept the agency from obligating funds during those fiscal years to achieve its goals. For example, NMB officials said that the Board did not pursue certain planned hiring, as well as other contract actions and travel, because of uncertainty about the amount of final appropriations that would be available. GAO has reported that continuing resolutions present challenges for federal agencies, and that agencies may not have enough time to spend funding on high-priority needs such as hiring. However, given the frequency of continuing resolutions, it is even more important for NMB to develop an effective plan to use its appropriations to accomplish agency goals. During our review, we found that NMB struggled to plan effectively for contingencies such as funding under continuing resolutions, although NMB’s budget request and appropriations were generally consistent for several years. Additionally, NMB officials told us they lacked an effective process to reliably forecast the amount of funding the agency would have remaining at the end of a fiscal year, and we found NMB did not plan effectively to allow the agency to obligate its fiscal year appropriations. NMB officials said the agency waited until the end of the third quarter to assign unobligated funds to other priorities in order to allow for the option of retaining temporary services during periods of high demand. Although NMB was able to reassign at least $1 million to arbitration work in each of the fourth quarters in 2017, 2018, and 2019, there was insufficient time to use other available funding in additional areas of need. The Board has taken steps to improve its budget execution process. In particular, the Board has implemented new bi-weekly budget reviews with the CFO meant to help NMB better forecast the agency’s available funds, including more reliably predicting the amount of unobligated funds and how to use those funds to meet agency goals. However, these changes have not been incorporated into a formal, written process to help NMB manage its appropriations more effectively to achieve agency goals. One goal under NMB’s Strategic Plan is to provide timely, efficient, and responsible stewardship of agency fiscal resources. Federal internal control standards state that internal controls comprise the plans used to fulfill the goals of the agency, and we have reported that maintaining written policies and procedures can help ensure that adequate internal controls are in place. Further, those standards state that management should obtain reliable financial data on a timely basis to enable effective monitoring. Until NMB establishes and documents an effective plan to manage its appropriations, as well as timely, reliable financial data, it may miss opportunities to achieve its objectives as efficiently and effectively as possible. NMB Lacks Effective Internal Controls to Ensure that It Consistently Follows Its Audit Policy to Identify and Address Audit Deficiencies NMB lacks effective internal controls to ensure that it consistently addresses deficiencies identified from financial and other audits. For example, NMB did not follow its own requirements to create corrective action plans to address findings of financial audits or GAO recommendations. Under agency policy, those corrective action plans should detail major steps for NMB to take, estimated completion dates, and other related information. Although NMB provided its financial auditors and GAO with general plans to address findings and recommendations, those plans have not always included major steps or estimated completion dates, and NMB has not always followed through with the steps it agreed to take. For instance, NMB’s financial auditor noted a deficiency in NMB’s internal controls related to financial reporting in 2017, and noted a similar deficiency in 2018 because NMB still had not addressed the problem sufficiently. Effective remediation of internal control deficiencies, like those found by GAO and other audits, is essential to achieving the objectives of the Federal Managers’ Financial Integrity Act, as amended (FMFIA). Unless NMB follows its own policy and federal guidance on corrective action plans, it may not do what is needed to address the risks associated with any deficiency. Likewise, NMB did not follow its policy to circulate draft financial audit findings and provide a draft response to the Board. When NMB received notice of a 2018 draft management letter from its independent financial auditors, the letter was not circulated for over 5 months nor was the Board provided with any draft response to the findings. Moreover, although NMB’s Board was notified of the letter’s existence in November 2018, the Board did not ask for the letter prior to May 2019, and said instead that they relied on the official in charge of the audit to follow procedure. Federal internal control standards state that management should obtain relevant data, including compliance data, in a timely manner so that they can be used for monitoring, but NMB officials and the Board did not obtain such information, putting the agency at risk for missed opportunities to identify and address audit deficiencies. Additionally, NMB has not effectively monitored the sufficiency of its internal controls as required under FMFIA. NMB has also not conducted its planned fiscal year 2017 internal controls review of its Office of Mediation or its fiscal year 2018 internal controls review of its Office of Legal Affairs in order to complete its annual review and report under FMFIA. Monitoring the effectiveness of internal controls provides the basis for an agency’s annual assessment and report of internal control, as required by FMFIA. NMB officials said the agency had not completed those reviews in a timely manner due to the timing of multiple audits occurring at NMB. NMB recently scheduled those reviews for 2020. Without monitoring its internal controls, NMB may not identify and be able to address significant management problems that can impede the agency’s ability to achieve its goals. Although NMB has identified and taken steps to address some of these audit and internal control deficiencies, it has not established an effective process to consistently monitor adherence to its audit policy and federal standards, evaluate the results, and remediate any deficiencies. For example, NMB has revised its audit policy to assign responsibility for audits and related follow-up to the CFO, who is tasked with helping NMB develop appropriate corrective action plans. Additionally, the Board said it addressed the issue of not circulating the audit management letter with the responsible official and changed the protocols for circulating letters for audit findings to include the Board in addition to the CFO. However, these actions, by themselves, do not establish the monitoring activities required by NMB’s audit policy and federal internal control standards. Under NMB’s new audit policy, the Board has responsibility to provide top-level oversight of NMB’s management activities related to audit coordination and follow-up; federal internal control standards require management to establish and operate monitoring activities to monitor the internal control system, evaluate the results, and remediate identified deficiencies on a timely basis. Further, FMFIA requires regular evaluation of the sufficiency of an agency’s internal controls. The failure of NMB to conduct the necessary reviews to support its annual assertion under FMFIA hampers the agency’s ability to identify risks in its internal controls and to correct any associated material weaknesses, as well as deprives Congress of information necessary to oversee the agency. Further, by not following its own policies and federal internal control standards, NMB may miss opportunities to improve its ability to achieve objectives, address audit deficiencies, and improve management oversight. Conclusions NMB has fully implemented one of the seven recommendations still open from prior GAO reports: creating standards on outside employment, which will help prevent employee violations of ethics rules. However, while making varying degrees of progress on the others, NMB still has more work to implement all six remaining recommendations. NMB has decreased its backlog of rail arbitration cases, but it has no specific goals against which to measure its progress toward reducing the backlog and ensuring NMB and Congress can adequately assess NMB’s resolution of disputes. Likewise, while the Board’s implementation of the climate assessment illustrated that it recognizes the need to understand employee concerns regarding communication across teams, agency travel, and training for management, among other things, it has not fully executed plans to address those concerns in order to benefit from that assessment. Finally, while NMB has improved certain aspects of how it implements its travel and telework policies, it has not sufficiently changed the policies themselves to ensure that NMB policies are consistent with the Federal Travel Regulation and the Telework Enhancement Act of 2010, respectively. Moreover, NMB established the Office of Information Services and hired a new CIO to assist NMB in addressing information security and privacy recommendations, but NMB still must change its underlying information policies and procedures, including updating its information privacy policy to reflect the current structure of NMB and perform a review of its system security plans. Additionally, until NMB complies with the recent FedRAMP requirements, its data may be at greater risk in the event of a security incident. Without fully implementing the remaining six recommendations and addressing the recent FedRAMP requirements, NMB is missing opportunities to mitigate information security risks and improve its own management and performance. Moreover, NMB faces challenges in managing and overseeing its annual appropriation and audit policy as a result of ineffective internal controls. Specifically, as a result of ineffective internal controls for managing and overseeing its annual appropriation, NMB has forgone several million dollars in funding that could have been used to accomplish agency goals. While continuing resolutions can make it difficult for agencies to achieve hiring and other goals, until NMB develops a written plan to document NMB’s process for reviewing and monitoring the agency’s annual appropriation to effectively manage its budgetary resources and spending, NMB will likely continue to miss opportunities to accomplish its goals. Similarly, until NMB establishes a specific process for the Board to monitor and evaluate NMB’s adherence to audit protocols, NMB will not be well positioned to address audit recommendations from its financial auditors and GAO, hindering efforts to improve its operations. While NMB officials have told us that they did not have the resources for certain changes that we recommended, such as information security and privacy improvements, they had more resources than they actually used, as evidenced by unused appropriations. Given the range of management issues that have remained unaddressed over the past 6 years, NMB should ensure their available resources are used effectively. Recommendations for Executive Action We are making the following four recommendations to the National Mediation Board (NMB): 1. The Chairman of the NMB should document NMB’s authorizations for its use of cloud services approved through FedRAMP and submit the authorizations to the FedRAMP Program Management Office. (Recommendation 1) 2. The Chairman of the NMB should update NMB’s security policies and procedures to include FedRAMP’s authorization requirements. (Recommendation 2) 3. The Chairman of the NMB should develop a written plan to document NMB’s process for reviewing and monitoring the agency’s annual appropriation to ensure that funds are used effectively. (Recommendation 3) 4. The Chairman of the NMB should establish a process for the Board to effectively monitor and evaluate NMB’s adherence to audit protocols and implementation of actions to address audit recommendations. (Recommendation 4) Agency Comments and Our Evaluation We provided a draft of this report to the National Mediation Board (NMB) for review and comment. The agency provided written comments, which are reproduced in their entirety in appendix III. NMB also provided technical comments, which we incorporated as appropriate. NMB agreed with our four recommendations, and stated that it would take actions to address them. With regard to our first two recommendations concerning the Federal Risk and Authorization Management Program authorizations, NMB stated that it plans to complete the required actions by the end of fiscal year 2020. While NMB stated that it would take actions to address our third and fourth recommendations, concerning improvements to better monitor its annual appropriations and adhere to audit protocols to implement audit recommendations, respectively, NMB did not provide a timeframe for when these actions would be completed. NMB also said that it is taking actions to fully implement the remaining recommendations from our prior reports concerning its rail arbitration case backlog, organizational climate assessment, travel and telework policies, and information privacy and security. We are sending copies of this report to the appropriate congressional committees, NMB, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7215 or nguyentt@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. Appendix I: National Mediation Board Documents Compared with Statutory and Policy Requirements Outside Employment Appendix II: Status of National Mediation Board Practices in Information Privacy and Security NMB appointed a senior agency official for privacy in April 2019 and documented the assignment through a memorandum. Partially following NMB established a privacy policy dated October 2017 that includes procedures for protecting sensitive information, including personally identifiable information. However, the policy reflects outdated roles and responsibilities. For example, the policy reflects the role of chief of staff that no longer exists in the agency. An NMB official stated the agency engaged a technical writer (contractor) to update the policy by the end of fiscal year 2020. Partially following The NMB documented a privacy impact assessment dated July 2018. assessments for systems containing personally identifiable information 4. However, the assessment did not specify whether a system of records notice would be developed as required by the Office of Management and Budget (OMB). An NMB official stated the agency engaged an information system security officer (contractor) to address this practice by the end of fiscal year 2020. NMB did not issue a system of records notice for its enterprise network and did not provide any documentation that this notice was not required in the agency’s privacy impact assessment. An NMB official stated the agency engaged an information system security officer (contractor) to address this practice by the end of fiscal year 2020. Partially following NMB developed an Information Program Plan dated April 2016 that states the agency annually conduct a risk analysis. NMB had assessments of its enterprise network conducted on May 2016 and November 2017. NMB also completed an information system risk assessment dated October 2017 that identifies and describes threats. However, NMB did not provide any assessment documentation for its network in fiscal year 2019. An NMB official stated the agency engaged a security assessor (contractor) to address this practice by the end of fiscal year 2020. Partially following NMB has developed an information security policy by documenting its based policies and procedures to ensure compliance with applicable standards and guidance including system configuration requirements existing April 2016 Information Program Plan. While the policy includes risk assessment requirements, it does not reflect oversight of NMB third- party providers. An NMB official stated that the agency engaged a technical writer (contractor) to address this practice by the end of fiscal year 2020. Partially following NMB’s current system security plan for its enterprise network has been in that cover networks, facilities, and systems or groups of systems, as appropriate place since March 2016. However, the plan does not include full implementation details on operational controls or a rationale on why controls are not applicable as recommended in National Institute of Standards and Technology guidance. An NMB official stated that the agency engaged an information system security officer (contractor) to address this practice by the end of fiscal year 2020. Extent NMB is following Partially following NMB has security awareness training guidelines signed April 2016 that specify agency employees and contractors will receive annual security awareness training. An NMB official stated that security awareness training is to be conducted each fiscal year. However, an NMB official stated the agency did not provide security awareness training in fiscal year 2018. NMB provided that training in fiscal year 2019, and an NMB official said the agency engaged an information system security officer (contractor) to address this practice by the end of fiscal year 2020. In May 2016, the NMB’s enterprise network was independently tested by the Department of the Treasury’s Bureau of Fiscal Service Division of Security Services. In addition, an NMB official documented a security assessment for the network signed November 2017. However, NMB did not provide us with any additional documentation to show the enterprise network was assessed in fiscal year 2019. According to an NMB official, the agency engaged a security assessor (contractor) to address this practice by the end of fiscal year 2020. Program Plan dated April 2016. In addition, the agency documented a plan of actions for its enterprise network dated January 2018. However, the plan of actions did not fully meet OMB requirements such as planned completion dates and changes to milestones, among other things. An NMB official stated that the agency engaged an information system security officer (contractor) to address this practice by the end of fiscal year 2020. Partially following NMB’s security-incident procedures dated June 2016 include information procedures for detecting, reporting, and responding to incidents on handling cyber incidents. However, the procedure did not include required actions specified by the Federal Information Security Modernization Act of 2014, such as notifying the federal information security incident center, law enforcement agencies, and relevant offices of inspector general and general counsel. An NMB official stated the agency engaged a technical writer (contractor) to address this practice by the end of fiscal year 2020. Partially following NMB documented a continuity of operations plan policy dated March 2016. However, the agency has not documented a contingency plan for its enterprise network. An NMB official stated the agency engaged an information system security officer (contractor) to address this practice by the end of fiscal year 2020. covered by information in a system of records, the category of records that are maintained about the individuals, and how the information is shared and routinely used by the agency. Appendix III: Comments from the National Mediation Board Appendix IV: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Mary Crenshaw (Assistant Director), Andrew Nelson (Analyst-In-Charge), Cindy Brown Barnes, Larry Crosland, Mikey Erb, Chelsa Gurkin, John Lack, and Dana Pon made significant contributions to this report. Also contributing to this report were Shirley Abel, Amy Anderson, Bill Anderson, J. Howard Arp, Gary Bianchi, Rachael Chamberlin, Vijay D’Souza, Robert Graves, Carol Henn, Janice Latimer, Barbara Lewis, Benjamin Licht, Jessica Orr, Monica Perez- Nelson, James Rebbe, Constance Satchell, Monica Savoy, Almeta Spencer, Sabrina Streagle, Barbara Steel, Amy Sweet, Curtia Taylor, Candice Wright, and Paul Wright.