Background IAEA’s Structure IAEA’s policy-making bodies include the Board of Governors, which consists of 35 member states, including the United States as a de-facto permanent member; and the General Conference, which consists of all 171 member states of IAEA. The agency’s staff, led by the Director General, is referred to as the Secretariat and is organized into six departments that implement programs approved by the Board of Governors and the General Conference. The Division of Nuclear Security, within the Department of Nuclear Safety and Security, implements the nuclear security program. Figure 1 shows the position of DNS within the agency. The agency’s other departments include the Department of Safeguards, which carries out technical measures and activities by which IAEA seeks to verify that nuclear material subject to safeguards is not diverted to nuclear weapons or other proscribed purposes; and the Department of Technical Cooperation, which provides nuclear technologies and expertise to member states. In addition to the departments, the agency has offices that report to the Director General, such as the Office of Legal Affairs. The Nuclear Security Legal Framework and IAEA’s Nuclear Security Role IAEA’s statute is the foundation of the agency’s dual mission of promoting the peaceful uses of nuclear energy and verifying through safeguards that nuclear technologies and materials are used for peaceful purposes and not diverted to nuclear weapons. Nuclear security is not an explicit part of this broader mission, but the agency has identified several of its statutory authorities as underpinning its nuclear security role. For example, the statute authorizes the agency to exchange scientific and technical information on peaceful uses of atomic energy, which IAEA does under its nuclear security program. In addition, a number of international treaties establish a nuclear security role for the agency, including: The Convention on the Physical Protection of Nuclear Material (CPPNM) and its 2005 amendment. This convention originally addressed the security of nuclear materials in international transport. A 2005 amendment, which entered into force in 2016, requires parties to establish, implement, and maintain a physical protection regime for nuclear materials and facilities in domestic use, storage, and transport. The amendment encourages states to consult with IAEA to obtain guidance on the design, maintenance, and improvement of their national systems of physical protection of nuclear material. International Convention for the Suppression of Acts of Nuclear Terrorism. This convention refers to IAEA as a source of guidance to States parties on measures for security of nuclear materials and charges IAEA with transmitting information to States parties, following an offense under the convention, on the disposition or retention of radioactive material, devices, or facilities taken control of during the response. In addition, United Nations Security Council Resolution 1540 calls upon states to refrain from supporting by any means non-state actors that attempt to, among other activities, acquire, use, or transfer nuclear, chemical, or biological weapons and their delivery systems. The resolution also calls upon states to engage in activities similar to those described in IAEA’s Nuclear Security Plan. For example, the resolution calls on states to take and enforce effective measures to establish domestic controls to prevent the proliferation of nuclear weapons, including physical protection measures; IAEA provides guidance and other support for applying such measures to civilian nuclear materials. The resolution also calls for measures to prevent illicit trafficking, to establish effective export controls, and to renew and fulfill commitments to multilateral cooperation in particular within the framework of the IAEA. IAEA Funding IAEA funds its programs primarily through (1) its regular budget, for which all member countries are assessed an annual contribution, and (2) extra-budgetary cash contributions, which are voluntary. In addition, IAEA has a Technical Cooperation Fund—generally supported through voluntary annual contributions of member states—to be used for technical cooperation projects. The State Department coordinates the United States’ policy with and financial contributions to IAEA and is the lead U.S. agency for interacting with IAEA. In 2018, IAEA’s total regular budget was $437.9 million, and approximately $103.5 million was unfunded (to be funded through extra- budgetary contributions). In 2018, the Division of Nuclear Security’s regular budget was approximately $6.9 million, and $25.2 million was unfunded (to be funded through extra-budgetary contributions). The Nuclear Security Fund, established after the September 2001 terrorist attacks, holds the extra-budgetary funding for most of IAEA’s nuclear security activities. Figure 2 shows the levels of regular and extra- budgetary funding for DNS over the last three biennial budget cycles, from 2014 to 2019. According to IAEA officials, the agency operates under substantial budget constraints as a number of member states advocate for zero-nominal- growth budgets. This has generally caused IAEA’s programs to operate under minimal growth in their regular budgets from year to year and to seek efficiencies on an ongoing basis. Extra-budgetary contributions are not subject to these constraints. Nuclear Security Summits As part of an initiative to secure all vulnerable nuclear material around the world, the United States hosted 47 world leaders in Washington, D.C., for a Nuclear Security Summit in 2010. The summit organizers invited a range of participants, taking into account the scale of their nuclear energy programs and countries’ access to weapons-usable materials. Additional summits were held in Seoul, South Korea, in 2012; the Hague, the Netherlands, in 2014; and again in Washington, D.C. in 2016. The Nuclear Security Summits brought heads of state together to discuss and bring high-level international attention to nuclear security issues. These summits led to, among other things, the removal or elimination of nuclear material from civilian facilities across the globe, ratification and implementation of treaties, conversion of reactors to operate on low- enriched uranium, and the strengthening of regulations. Summit participants issued an Action Plan in Support of the IAEA during the final summit in 2016 to document their commitments to IAEA’s nuclear security mission. Commitments in the Action Plan in Support of the IAEA included recognizing the leading role of the agency for coordinating multilateral nuclear security activities as well as committing high-level support for the IAEA’s nuclear security activities and advocacy for IAEA’s coordination role and provision of guidance. IAEA Structures Its Nuclear Security Work into Four Subprograms That Encompass Activities Ranging from Developing Guidance to Coordinating International Efforts IAEA’s nuclear security activities are conducted primarily under its nuclear security program, which consists of four subprograms. Under these subprograms, IAEA carries out a wide range of nuclear security activities, including developing and promoting the use of nuclear security guidance documents, providing assistance to member states, and developing training programs. IAEA also coordinates international nuclear security efforts. IAEA’s Nuclear Security Program Consists of Four Subprograms IAEA’s nuclear security activities are conducted primarily under the agency’s nuclear security program, which consists of four subprograms: Nuclear Security of Materials and Facilities. This subprogram covers the security of nuclear and other radioactive material and associated facilities and activities including transport. Nuclear Security of Materials Outside of Regulatory Control. This subprogram covers detection of criminal or intentional unauthorized acts involving nuclear or radioactive material and responding to nuclear events. Information Management. This subprogram is responsible for establishing and maintaining systems to collect and analyze nuclear security information. Program Development and International Cooperation. This subprogram covers international nuclear security coordination and provides education and training programs. It also manages donor relations and the Nuclear Security Fund. The Nuclear Security Program is implemented by IAEA’s Division of Nuclear Security (DNS), which is structured into four sections that correspond to the four subprograms. Figure 3 shows the projects carried out by each section. Other IAEA offices coordinate with DNS to carry out the agency’s nuclear security activities. For example, IAEA’s Department of Nuclear Energy collaborates with DNS to convert reactors to run on low-enriched uranium, return nuclear materials resulting from the conversion to the country of origin, and assist with the disposition of disused radioactive sources. The agency’s Office of Legal Affairs supports DNS by promoting universal adoption of the Convention on the Physical Protection of Nuclear Material and its 2005 amendment and helping member states with legal and regulatory understanding of the convention and drafting review. IAEA Develops Guidance, Provides Assistance and Training to Member States, and Coordinates International Nuclear Security Efforts, Among Other Things Under the four subprograms, IAEA conducts a broad range of nuclear security activities including (1) developing nuclear security guidance; (2) providing assistance to member states in areas such as establishing legal, regulatory, and technical nuclear security infrastructure, and converting reactors to operate on non-weapons usable materials; (3) providing training and education; and (4) coordinating international nuclear security efforts. Developing Guidance IAEA develops nuclear security guidance documents and encourages member states to adopt and implement the guidance to improve their nuclear security regimes. IAEA’s Nuclear Security Guidance Committee, established by the Director General in 2012, makes recommendations to IAEA on what nuclear security guidance to develop and approves guidance publications. The Nuclear Security Guidance Committee is open to all member states. DNS’s four sections contribute to the development of guidance. For example, the Information Management section develops guidance relating to computer security at nuclear facilities, and the Nuclear Security of Materials and Associated Facilities section develops guidance in the area of physical protection of nuclear materials and facilities. DNS develops two main sets of guidance documents: the Nuclear Security Series and Codes of Conduct. The Nuclear Security Series, launched in 2006, is continuously updated by IAEA in cooperation with experts from member states. The series comprises four broad categories of publications: Nuclear Security Fundamentals, which establish the fundamental objectives and essential elements of states’ national nuclear security regimes. Recommendations, which set out measures that states should take to achieve and maintain effective regimes. Implementing Guides, which provide guidance on implementing security measures. Technical Guidance, which provides detailed guidance on specific methodologies and techniques for implementing security measures. Within each category, there are specific guidance documents, such as “Establishing the Nuclear Security Infrastructure for a Nuclear Power Programme” and “Nuclear Security Systems and Measures for Major Public Events.” The publications’ principal users are regulatory bodies for nuclear and radiation security and other relevant member-state authorities, such as those involved in law enforcement and forensics, border control and customs, and intelligence gathering. Other users include international organizations with responsibilities relevant to nuclear security; organizations that design, manufacture, and operate nuclear facilities; and organizations involved in the use of radiation related technologies. Another set of publications, the Codes of Conduct, are meant to serve as guidance to states for the development and harmonization of policies, laws and regulations. They include a Code of Conduct on the Safety and Security of Radioactive Sources. Providing Assistance to Member States IAEA provides a variety of nuclear security assistance, which member states may request through the Integrated Nuclear Security Support Plan (INSSP) process, in which DNS works with member states to jointly conduct a comprehensive and systematic review of their nuclear security regimes and identify potential areas for improvement. DNS works with member states that request an INSSP to develop implementation strategies, based on the nuclear security needs identified, for IAEA or potential donors to provide assistance to the state. The INSSPs serve as input for the work plans of each DNS section. Member states may also request ad hoc assistance outside this process. IAEA’s nuclear security assistance includes helping member states establish legal, regulatory, and technical infrastructure to secure nuclear materials and facilities, and helping states detect and respond to “materials out of regulatory control”—material present in sufficient quantity that it should be under regulatory control but is not. IAEA may help to identify the need for assistance through advisory missions and peer reviews, such as International Physical Protection Advisory Service missions. These missions assist countries in strengthening their national civilian nuclear security regimes by providing (1) guidance on the protection of nuclear material and facilities, as well as of sealed radioactive sources and other radioactive material; (2) best practices in nuclear security; and (3) peer advice on implementing international agreements related to physical protection of nuclear material and facilities. Since 1996, IAEA has conducted 84 International Physical Protection Advisory Service missions in 50 countries. In addition, IAEA conducts International Nuclear Security Advisory Service missions to help member states establish effective nuclear security regimes that address nuclear and other radioactive “material out of regulatory control.” According to IAEA officials, in 2016 the agency suspended International Nuclear Security Advisory Service missions while DNS updated the supporting guidance, but it intends to restart such missions in 2019. IAEA also assists member states hosting major public events in strengthening nuclear security measures before and during the events. Assistance provided for major public events includes coordination meetings, workshops, and training on the use of detection equipment. The agency reported that, from July 2017 through June 2018, it assisted states with preparing for at least seven major public events, such as the 29th Southeast Asian Games in Malaysia in August 2017 and the G20 Buenos Aires Summit in Argentina in November 2018. In addition, IAEA assists with converting reactors to operate on low- enriched uranium rather than highly enriched uranium and contributes to the design of reactor cores that operate on low-enriched uranium. IAEA also assists with the repatriation of fissile and radioactive material from countries that no longer require or cannot adequately secure those materials to more secure storage in other countries. As previously noted, IAEA’s Department of Nuclear Energy assists DNS with converting reactors to run on low-enriched uranium. The Department of Nuclear Energy also works with DNS on management strategies for disused radioactive sources. With regard to radioactive material, IAEA reported that, from July 2017 through June 2018, it helped repatriate three highly radioactive materials from Lebanon to Canada and 27 such materials from South America to Germany and the United States. Providing Training and Education IAEA conducts several types of nuclear security training and education activities to support member state capacity building, including workshops and exercises. The agency reported that, from July 2017 through June 2018, it provided in-person training for more than 2,400 participants from 149 member states on subjects including physical protection of nuclear material and computer security. IAEA has also developed e-learning courses to make training more accessible. In addition, IAEA supports member states in developing Nuclear Security Support Centers. The purpose of these centers is to effectively develop nuclear security knowledge and associated technical skills in states to promote the long term sustainability and effectiveness of nuclear security in those states. The agency also supports the International Nuclear Security Education Network, a partnership through which IAEA, educational and research institutions, and other stakeholders cooperate to promote nuclear security education. This network connects 170 institutions from 62 member states to assist them in establishing and enhancing nuclear security education. Network members collaborate in areas such as the development of peer- reviewed textbooks, instructional material, computer-based teaching tools, and exercises and materials for laboratory work; faculty development in different areas of nuclear security; joint research and development activities to share scientific knowledge and infrastructure; and quality assurance. Coordinating International Nuclear Security Efforts IAEA coordinates international nuclear security efforts through activities such as hosting information exchange meetings, organizing events and conferences, and promoting universal adoption of international legal instruments. Twice a year, IAEA hosts information exchange meetings to coordinate nuclear security activities with other organizations, such as the Global Initiative to Combat Nuclear Terrorism. IAEA reported hosting information exchange meetings in November 2017 and April 2018. The agency organizes a range of events and conferences, including the International Conference on Nuclear Security, which brings together ministerial-level representation to discuss important issues related to nuclear security. IAEA’s activities to promote the universal adoption of international agreements relevant to nuclear security—such as the Convention on the Physical Protection of Nuclear Material and its 2005 amendment—include working with states directly, speaking at conferences, and offering model legislation for states to follow. In addition, IAEA manages the Incident and Trafficking Database, which catalogues reports by participating states about details of thefts, losses, and other unauthorized activities and events involving nuclear and other radioactive material out of regulatory control. The details of such incidents are accessible to participating states, with limited information accessible to other UN-affiliated organizations. IAEA Plans Its Nuclear Security Work through a Range of Documents but Does Not Prioritize Activities or Fully Measure or Report on Program Performance IAEA Plans Its Nuclear Security Activities through a Range of Documents but Does Not Prioritize Those Activities IAEA plans its nuclear security work through a range of documents, including a biennial Programme and Budget (P&B). However, IAEA does not prioritize its nuclear security activities. In addition, IAEA’s performance measures have limitations, and agency reports on nuclear security do not consistently include performance information. IAEA has two primary planning documents for nuclear security: Nuclear Security Plan. This 4-year planning document describes the nuclear security program’s tasks and outputs by project. The Nuclear Security Plan, which is approved by the Board of Governors, identifies broad priority areas, such as physical protection and nuclear security detection architecture and response. Programme and Budget (P&B). This biennial document, which is approved by the General Conference, identifies current IAEA program funding levels and future funding needs. The P&B also lays out objectives and associated outcomes and performance measures for the entire agency, including the nuclear security program and its subprograms. Figure 4 shows the objectives for the nuclear security program. In addition, the P&B identifies planned outputs for each project under the nuclear security subprograms. However, these documents contain only broad statements on prioritizing activities, providing limited guidance to DNS. Specifically, the Nuclear Security Plan calls for the agency to carry out its nuclear security activities in a prioritized manner with available resources, without further guidance about how to prioritize activities. Similarly, the P&B establishes two broad criteria for prioritization: 1) completion and maintenance of the universally applicable Nuclear Security Series recommendations and guidance, and provision of assessment and evaluation services at the request of member states, and; 2) the provision, upon request, of assistance based on an analysis of needs, including those identified through INSSPs. These criteria for prioritization are broad, effectively including almost all of the DNS’s activities. When we compared these criteria to DNS’s projects described in the 2018-2019 P&B, 12 of 13 projects aligned with at least one criterion. For example, one project under the Information Management section is to develop and implement INSSPs and a voluntary self-assessment tool for member states to use. This project aligns with the second criterion—the provision of assistance, including assistance identified through the INSSPs—because developing INSSPs helps the agency provide assistance to member states. DNS officials said that they use the criteria in the P&B as broad expectations set by member states for the nuclear security program, noting that they do not prioritize among activities because member states do not agree on priorities. Instead of actively prioritizing activities, DNS officials said they respond to requests from member states as those requests come in and to the extent that resources are available, taking into account conditions on funding. According to leading practices identified in the Project Management Institute’s The Standard for Program Management, organizations’ resource management plans should describe the guidelines for making decisions about priorities for using program resources and resolving resource conflicts. However, DNS does not have guidelines for prioritizing activities; there is no guidance in the Nuclear Security Plan, and the criteria for prioritization in the P&B are too broad for division officials to distinguish among competing needs. Such detailed guidelines would help DNS ensure it is appropriately targeting its limited program resources. IAEA’s Performance Measures Have Limitations, and Agency Reports on Nuclear Security Do Not Consistently Include Performance Information IAEA has established several performance measures for its nuclear security program and subprograms, but these measures do not fully align with leading practices. IAEA issues several reports on the results of the nuclear security program, but these reports contain only some of the agency’s performance measures. DNS Has Developed Performance Measures, but They Have Limitations IAEA has established four high-level performance measures in the P&B that it uses to determine progress toward the nuclear security program’s goals: (1) the number of member states requesting and receiving assistance through INSSPs, (2) the number of member states establishing or improving nuclear security measures based on advice from the agency, (3) the number of activities duplicated by other initiatives, and (4) the number of activities carried out in conjunction with the agency. In addition, the P&B identifies from four to six performance measures for each nuclear security subprogram. For example, the number of states requesting assistance or participating in IAEA activities to improve computer and information security capabilities is a performance measure for the Information Management subprogram. According to IAEA’s P&B, the agency follows a “results-based management” approach, which is driven by articulating desired results and measuring actual performance against those results. The P&B states that key elements of this approach include establishing program baselines and targets and measuring actual performance against these baselines and targets to determine whether the program is achieving its planned outcomes. We reviewed IAEA’s nuclear security program performance measures against four leading practices for performance management we have previously reported on: (1) linking performance measures to the offices responsible for implementing the programs, (2) limiting measures to the vital few, (3) determining whether performance measures for the defined objectives are appropriate for evaluating the agency’s performance in achieving those objectives, meaning that measures and processes for measuring performance align with the objective, and (4) measuring performance against baselines. The practice of measuring performance against baselines is also consistent with IAEA’s results-based management approach. Table 1 shows the extent to which DNS’s performance measures meet leading practices. We found that DNS’s performance measures fully met two of the four leading practices. First, IAEA’s nuclear security program performance measures linked to the offices responsible for implementing them, as DNS’s four sections are responsible for implementing the four subprograms of the corresponding name. For instance, a performance measure linked to the Information Management subprogram within DNS is the number of states requesting assistance or participating in IAEA activities to improve computer and information security capabilities, and the Information Management section implements the associated subprogram, whose projects include information and computer security. Second, IAEA’s nuclear security program performance measures are limited to the vital few; as discussed above, there are four high-level measures for the program and between four and six measures for each subprogram. We found that IAEA’s performance measures partially met the third of the four leading practices. Specifically, they were generally appropriate for evaluating their corresponding outcomes and objectives. The program objective of playing a central role and enhancing international cooperation in nuclear security fully aligned with its associated outcome of improved global coordination and cooperation in supporting national efforts to improve nuclear security. Also, the associated measures by which IAEA assesses progress toward this outcome—the number of activities duplicated by others and the number of activities carried out in conjunction with IAEA—fully aligned with the outcome and objective. However, for the other two program objectives, outcomes and measures partially aligned with the objectives. For example, one of the nuclear security program’s objectives is contributing to global nuclear security efforts by establishing guidance and providing for its use through advisory services and capacity building; there is a performance measure related to advisory services, but no measure related to guidance. We found that IAEA’s nuclear security program performance measures did not meet the fourth leading practice, in that they did not include baselines or targets. For example, the performance measure regarding the number of states that have established or improved national nuclear security measures and systems on the basis of advice from the agency does not include a baseline of the number of states that already have established effective nuclear security measures. The measure also does not include a target for the number of states that should establish or improve nuclear security measures. Without established baselines or targets for each performance measure, IAEA’s ability to demonstrate results for its nuclear security program is limited. DNS officials acknowledged that the performance measures for the nuclear security program and subprograms do not have targets or baselines. They said that this is deliberate, based on nuclear security being a national responsibility and the limitations of IAEA’s nuclear security mandate. However, many of the performance measures for the nuclear security program and subprograms are focused on activities the agency carries out, for which DNS can develop targets and baselines; they are not focused on activities of member states. DNS officials also said that the division struggles to develop measures because the nuclear security environment—for example, threats to computer security—is continually evolving. However, many of these measures—such as adherence to the Convention on the Physical Protection of Nuclear Material—are independent of the security environment, and uncertainty should not prevent programs from developing measures to track their performance. By developing baselines and measurable targets to demonstrate results, DNS can more effectively monitor and assess the performance of its Nuclear Security Program. IAEA Issues Several Reports That Provide Information on its Nuclear Security Program, but They Do Not Consistently Include Performance Measures IAEA issues four sets of reports that provide information on its nuclear security program to member states, key stakeholders, and the public, including: Nuclear Security Report. This annual report, developed by DNS, describes the nuclear security program’s major achievements and expenditures of the prior year, as well as goals for the following year. Program Performance Report. This internal, agency-wide report describes progress in implementing all of the agency’s programs and identifies the resources used for each program in a given year. IAEA Annual Report. This report provides a high-level overview of the agency’s accomplishments and includes a section on the nuclear security program. Individual reports for each donor. These reports detail how DNS uses extra-budgetary contributions from each donor country (or government agency) in a given year; these reports are not shared with other countries or agencies. We have previously reported that program managers should communicate necessary quality information so that both internal and external parties can help the program achieve its objectives. Communicating necessary quality information through reporting is consistent with IAEA’s results-based management approach, according to which results-based reports help the organization, stakeholders, and funders to better understand the impact of a given program or project. We have also found that completeness is an element of quality reporting; completeness entails reporting on every performance goal and measure. In May 2013, we recommended that State work with IAEA and its member states to systematically report on the results of the agency’s performance measures. IAEA has subsequently taken steps to improve reporting, such as aligning the Nuclear Security Report with the P&B. In 2018, DNS restructured the format of the Nuclear Security Report so that each section of the report more clearly aligns with the nuclear security program and its subprograms. According to IAEA officials, DNS devotes substantial resources—including two full-time staff—to meeting all of its reporting requirements. Our analysis of three IAEA reports for 2016—the Nuclear Security Report, the Annual Report, and the Program Performance Report—found that DNS reports on some performance measures for its nuclear security program, but not all. Specifically, in the Nuclear Security Report, DNS reports on one measure fully and one partially and does not report on two measures. Specifically, DNS reports fully on the number of activities carried out in conjunction IAEA reports partially on the number of states that request and receive assistance, as identified in INSSPs. The agency reports on the number of states that completed INSSPs and provides examples of assistance but does not report whether that assistance was requested through INSSPs. For example, in the 2016 Nuclear Security Report, IAEA reported that five member states formally approved INSSPs. The agency also reported several examples of assistance to member states, such as training workshops on radiological crime scene management for Colombia in February 2015, Lithuania in February 2015, and the Philippines in June 2015. However, the report did not specify whether the need for that assistance was identified through INSSPs. IAEA does not report on the number of member states that have established or improved national nuclear security measures based on advice from IAEA or the number of activities duplicated by other initiatives. None of the three IAEA reports we reviewed consistently includes performance measures for the nuclear security subprograms. Table 2 shows the extent to which at least one of the three 2016 reports we reviewed includes measures for program and subprogram performance. Member states have expressed concerns with the effectiveness of IAEA’s reporting on the nuclear security program. In 2018, IAEA member states included language in the Nuclear Security Resolution to encourage the agency to improve communication with the public and member states about its nuclear security activities and their global impact. U.S. officials we interviewed said that they are dissatisfied with the reports, including with the quality of information on nuclear security activities, and would like to see, among other things, better reporting on how those activities support the agency’s mission, rather than reports that merely describe activities completed. IAEA officials provided two reasons why IAEA is limited in communicating more comprehensive information on nuclear security program performance in its reports. First, IAEA officials said that there are sensitivities around the data IAEA collects about member states, and member states are hesitant to share information on their security weaknesses. However, IAEA can report on its program performance without reporting sensitive information about individual states. Many of its measures pertain to numbers of states, and in cases where there are sensitivities, IAEA could aggregate data to a regional level to conceal state-specific information. Second, IAEA officials said that member states may not consistently make available to the agency the information it would need to measure the impact of its work. For example, to measure the number of states that established or improved national nuclear security measures based on advice from the agency, IAEA would need to know whether states implemented the agency’s recommendations. However, as previously mentioned, most of IAEA’s performance measures are focused on activities the agency carries out and not activities of member states. For example, one of the nuclear security subprogram’s measures is the number of states that participate in the Nuclear Security Guidance Committee. IAEA should have the data it requires to report on measures focused on activities carried out or facilitated by the agency. The lack of completeness in DNS’s reporting limits the effectiveness of the agency’s communication on the nuclear security program’s performance. By consistently including the results of its performance measures in at least one of its reports, IAEA could better communicate internally and with external stakeholders on the nuclear security program’s performance. Member-State Disagreements over IAEA’s Nuclear Security Role Pose Challenges to DNS’s Resources and Coordinating Efforts IAEA member states disagree over the agency’s role in nuclear security. These disagreements have frequently contributed to DNS’s challenges over resources and the agency’s central coordinating role in nuclear security. IAEA Member States Disagree over the Agency’s Nuclear Security Role According to U.S. and member-state officials and experts, IAEA member states disagree over the agency’s role in nuclear security. According to U.S. officials, member states supportive of the agency’s nuclear security role—such as the United States—see nuclear security as an issue with trans-border implications and believe the agency is well suited to supporting and facilitating cooperation on international, regional, and national nuclear security efforts. U.S. officials said that some member states do not see nuclear security as an international responsibility, but rather only as a national one, and disagree with IAEA’s nuclear security role to various extents. The disagreements over the agency’s role are rooted in a number of issues: Questions regarding the statutory basis for IAEA’s nuclear security work. Some U.S. officials and experts told us that some member states question IAEA’s nuclear security work because it is not established in the agency’s statute. IAEA officials told us that disputes over the statutory basis for IAEA’s nuclear security work are no longer an issue, and officials representing member states that had raised questions about the statutory basis for the work conceded that the matter was settled. However, these member-state officials said they felt strongly that because of the weak statutory basis, IAEA’s nuclear security work should be limited to core areas such as physical protection of nuclear facilities, rather than emerging areas such as cybersecurity. According to U.S. officials, other member states acknowledge the limited statutory basis for IAEA’s nuclear security work but still recognize the IAEA’s nuclear security role, which includes cybersecurity and newer areas of work. Perception of nuclear security as a barrier to or competition with IAEA support of civilian nuclear programs. According to IAEA, U.S. and several member-state officials, some states are concerned that IAEA’s nuclear security work could create barriers to their civilian nuclear programs—for example, by requiring recipients of IAEA technical cooperation to adhere to nuclear security guidance. In addition, according to U.S. and some member-state officials, some member states view IAEA’s nuclear security work as competing for resources with the agency’s other programs, such as the Technical Cooperation program, which assists member states with developing civilian nuclear programs. U.S. officials said that the Group of 77 generally advocates for more of the agency’s funds to be allocated to such programs. Resistance to nuclear security as a proxy for disagreement on other issues. U.S. officials, many mission officials, and many experts said that political disagreements among member states on unrelated or tangentially related international nuclear issues undermine IAEA’s nuclear security work. For example, U.S. officials and many member- state officials and experts told us that disagreement between nuclear weapons states and nonnuclear weapons states about nuclear disarmament manifests itself as political resistance in various IAEA forums to the agency’s nuclear security activities. Resistance to the Nuclear Security Summits. Some U.S. and member-state officials and experts said that some IAEA member states resented the perceived exclusive nature of the Nuclear Security Summits. As previously mentioned, the final summit in 2016 resulted in an Action Plan in Support of the IAEA in which signatories made commitments to support IAEA’s nuclear security mission. According to several mission officials and experts we interviewed, some excluded member states do not believe that the agency should carry forward the summits’ work, which in their view represents the priorities of the approximately 50 summit participants rather than all 171 IAEA member states. One expert said that within IAEA, there is resistance to anything associated with the summits among the member states that did not participate and that those states do not want IAEA involved in regulating or implementing anything resulting from the summits. Disagreements over the Agency’s Role Create Challenges by Reinforcing DNS’s Reliance on Extra- budgetary Contributions IAEA officials and others we interviewed said that the disagreements over the agency’s nuclear security role create tangible challenges for the agency concerning funding, as member states that do not support the agency’s nuclear security role resist efforts to substantially raise DNS’s regular budget. As a result, according to IAEA, U.S., and several member-state officials, DNS continues to rely heavily on extra-budgetary contributions and has a smaller proportion of regular budget funding than other IAEA divisions, including other parts of the Department of Nuclear Safety and Security. DNS’s regular budget funding represents less than a quarter of total nuclear security program funding, with 78 percent of the funding coming from extra-budgetary contributions (see fig. 5). As we have previously reported, the extra-budgetary contributions on which DNS relies are voluntary, unpredictable from year to year, and inflexible, as they are often directed to specific purposes and often carry additional conditions. As a consequence, the nuclear security program’s large reliance on extra-budgetary support affects program management and human resources in ways that may undermine effective management of the program. IAEA officials identified several ways in which the nuclear security program’s heavy reliance on extra-budgetary funding affects program management. Planning and prioritization. According to IAEA officials, because extra-budgetary contributions are predominantly directed to specific purposes and can only be used for direct assistance to states, rather than support costs, they may not align with DNS’s most critical needs. IAEA officials also said that reliance on extra-budgetary contributions leads DNS to plan its activities around conditions stipulated for the contributions rather than planning around overall program needs. Donor states may also use the contributions to create cost-free expert positions for their own personnel that may not meet DNS needs. U.S. officials said, however, that even within the constraints of extra- budgetary contributions, DNS could take steps to work with donors to conduct work on a broader range of projects and initiatives, such as providing donors with plans to address longer-term, strategic needs. Program sustainability. IAEA officials, several member-state officials, and some experts we interviewed raised concerns about the effect of extra-budgetary contributions on the sustainability of IAEA’s nuclear security efforts. For example, several experts suggested that the DNS’s planning of work around individually-funded projects means that IAEA’s focus tends to be on short-term activities rather than long- term sustainability, including through follow-up on prior work. IAEA officials did not agree with the concern about follow-up work, but did acknowledge that long-term reliance on extra-budgetary contributions was unsustainable. Human resource management. IAEA officials also identified ways in which the reliance on extra-budgetary funding affects DNS’s human resource management. First, extra-budgetary funding generally supports positions that are initially designed to last for only 2 or 3 years, leading to few long-term positions in the division and making it difficult to sustain continuity of knowledge and experience over time. Second, staff hired for positions supported by extra-budgetary funding tend to look for regular-budget-funded positions elsewhere in the agency, which hurts recruitment as well as retention within DNS. Furthermore, the division must dedicate several staff to reporting on the use of extra-budgetary funding provided by each donor. U.S. officials acknowledged the detrimental impact of DNS’s high reliance on extra-budgetary contributions on staffing, but said that they are open to working with DNS to mitigate this impact. Member states have emphasized through the 2017 and 2018 Nuclear Security Resolutions, which are approved by the General Conference, the need to continue providing appropriate resources for the agency to implement its nuclear security activities. Furthermore, signatories of the Action Plan in Support of the IAEA, including the United States, committed to “contribute effectively to the implementation of the IAEA Nuclear Security Plan, including through reliable and sufficient resources.” The United States and other member states supportive of IAEA’s nuclear security role have advocated for increasing the agency’s regular budget for nuclear security. IAEA officials stated that, because of the politics around the agency’s nuclear security work, as well as the zero-growth policy, it is unlikely that the regular budget for nuclear security will increase substantially in the short term. As a result, IAEA officials have undertaken short-term solutions to minimize the impact of its reliance on extra-budgetary funding, such as reaching out to major donors and cultivating new sources of funding. However, such new sources of voluntary funding also would not be guaranteed or predictable and therefore would not improve the stability of the division’s funding stream. According to IAEA officials, the agency has not identified options to stabilize DNS’s budget within the existing constraints. IAEA officials and experts suggested other options for making the nuclear security budget more stable and flexible. One option could involve making structural changes to the Nuclear Security Fund, such as assessing a percentage of each extra-budgetary contribution and allocating those assessed funds for general expenditures without conditions. This could give the program more flexibility in using the funds and to support longer- term needs or projects. Another option could involve shifting funding within the Department of Nuclear Safety and Security to balance the proportion of regular and extra-budgetary funding between the Nuclear Safety and Nuclear Security divisions. U.S. and IAEA officials identified drawbacks to some of these options but IAEA has not comprehensively identified and analyzed options to stabilize DNS’s budget within the existing constraints. By working with the United States and other member states to analyze options to stabilize funding for the agency’s nuclear security program, IAEA could ensure that it has sufficient, reliable resources to implement the Nuclear Security Plan. Member-State Disagreements and IAEA’s Not Following Key Practices for Collaboration Create Challenges for the Agency’s Central Coordinating Role in Nuclear Security The member-state disagreements discussed above—together with IAEA’s not following key practices for collaboration—limit IAEA’s ability to fulfill its central coordinating role in nuclear security. As noted in the Nuclear Security Plan, an objective of IAEA’s nuclear security program is “to play the central role and enhance international cooperation in nuclear security.” Numerous U.S., IAEA, and member-state officials and experts we interviewed said that there is a need for coordination of international nuclear security efforts and that IAEA is the appropriate entity to take on that role. These officials and experts cited IAEA’s perceived international legitimacy, technical expertise, and broad range of nuclear security efforts as key attributes that would allow the agency to play that coordinating role. DNS officials told us that they fulfill the agency’s central coordinating role in nuclear security in two key ways: (1) by providing nuclear security guidance that establishes the terms of reference for any nation working to improve its nuclear security and that is used by all member states and (2) by hosting and participating in key meetings. They said they further fulfill the role by using the agency’s international legitimacy and neutrality to work with countries that may be wary of international assistance from western countries. In addition, according to the agency’s Nuclear Security Plan, managing international nuclear security education through the Nuclear Security Support Centre and International Nuclear Security Education Networks is part of the central coordinating role. However, we found that IAEA is not fully implementing its central coordinating role in nuclear security, based on feedback from member states and experts and our evaluation of the extent to which IAEA has followed key practices that can sustain effective collaboration. Some experts told us that IAEA’s limited approach to its central coordinating role is a response to the resistance among some member states to the agency’s nuclear security role. According to many officials and experts we interviewed, IAEA’s approach to its central coordinating role is limited: Minimal outreach to key nuclear security stakeholders. Many experts expressed concern about the level of coordination with nongovernmental organizations and industry and said that IAEA would benefit from conducting more outreach to key nuclear stakeholders, including states. According to one expert, although IAEA may only conduct nuclear security activities at member-state request, IAEA could conduct more outreach to states about the assistance the agency could provide. Furthermore, some member- state officials and experts said the staff the agency sends to nuclear security meetings are not of the appropriate level of seniority. One expert said that IAEA does not engage actively with the Nuclear Security Contact Group, which, as previously mentioned, was established at the last Nuclear Security Summit to continue the work of the summit process after it ended. Specifically, according to this expert, the agency downgraded the level of representation it sent to Nuclear Security Contact Group proceedings to an official unauthorized to speak for DNS. However, U.S. officials said that senior DNS officials represented IAEA in more recent NSCG meetings. Logistical rather than substantive management of events. Several member-state officials and experts told us that IAEA limits its role at the events it organizes to logistical coordination rather than substantive management. According to one expert, to coordinate some of its support centers, IAEA convenes periodic meetings where participants share what they are doing, but it does not actively manage the support centers to reduce duplication. Some experts told us that multiple support centers in the same region teach the same content to the same students, raising concerns about duplicative activities. Another expert said that IAEA could more actively manage the support centers by starting discussions about best practices and, for example, the value of certification. To further examine IAEA’s fulfillment of its central coordinating role, we reviewed certain key practices that we have previously found can enhance and sustain collaborative efforts, such as: defining and articulating a common outcome, establishing joint strategies and compatible policies and procedures to operate across boundaries, identifying and addressing needs by leveraging resources, and agreeing on roles and responsibilities. IAEA’s planning documents—the Nuclear Security Plan and the P&B— define and articulate a common outcome. However, DNS has not established joint strategies or compatible policies and procedures with other nuclear security stakeholders, identified and addressed needs by leveraging resources, or agreed on roles and responsibilities. DNS officials said that they discuss these issues—such as resources and roles—at information exchange meetings with other organizations with a role in international security and said that these meetings have not resulted in agreed-upon or documented roles and responsibilities. In addition, the meetings have not resulted in the documentation of needs or resources, joint strategies, or compatible policies or procedures. As a result of IAEA’s approach to its central coordinating role in nuclear security, the agency may be missing opportunities to fully leverage its international legitimacy, technical expertise, and broad range of nuclear security efforts. By following key practices for collaboration, DNS could more formally define IAEA’s central coordinating role in nuclear security and strengthen the role even within the context of member-state disagreements. Conclusions IAEA’s DNS plays a crucial role in preventing dangerous releases of radiation by assisting nations in securing their nuclear materials and protecting their nuclear facilities against sabotage. IAEA plans its nuclear security activities through a range of documents, but does not prioritize those activities. The agency’s P&B contains criteria for prioritization, but the criteria are too broad to help DNS make resource decisions. Guidelines for prioritizing activities would help DNS ensure that it is applying its resources toward the areas of greatest program needs. In addition, IAEA’s performance measures do not have baselines and targets. By developing baselines and targets to demonstrate results, DNS can more effectively monitor progress toward achieving the program’s objectives. Furthermore, none of the three IAEA reports on the nuclear security program fully addresses performance measure results. Improved reporting could help IAEA more effectively communicate internally and with external stakeholders on program performance. The nuclear security program relies heavily on extra-budgetary contributions, which adversely affects program management. Options exist to address this issue but IAEA has not analyzed these options. IAEA and its member states acknowledge the agency’s central coordinating role in nuclear security, but the agency has not followed key practices for collaboration. This has left IAEA’s approach to the central coordinating role vulnerable to member-state disagreements, and IAEA’s implementation of the role has not met the expectations of various member states. Recommendations for Executive Action We are making the following five recommendations to the Department of State: The Secretary of State should work with IAEA and its member states through the Board of Governors to develop detailed guidelines for prioritizing nuclear security activities. (Recommendation 1) The Secretary of State should work with IAEA and its member states through the Board of Governors to improve the nuclear security program’s performance measures by developing baselines and measurable targets. (Recommendation 2) The Secretary of State should work with IAEA and its member states through the Board of Governors to improve how DNS reports to member states by consistently including the results of performance measures in at least one of the reports. (Recommendation 3) The Secretary of State should work with IAEA and its member states through the Board of Governors to analyze options to stabilize DNS’s funding within current fiscal and political constraints to enhance the sustainability of IAEA’s nuclear security program. (Recommendation 4) The Secretary of State should work with IAEA and its member states through the Board of Governors to strengthen the agency’s central coordinating role by following key practices for collaboration. (Recommendation 5) Agency Comments and Our Evaluation We provided a draft of this report to the Departments of State and Energy and to the International Atomic Energy Agency for review and comment. In its written comments, reproduced in appendix III, State concurred with all five of our recommendations. We are sending copies of this report to the appropriate congressional committees, the Secretary of State, the Secretary of Energy, and other interested parties. In addition, this report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (202) 512-3841 or trimbled@gao,gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. Appendix I: Objectives, Scope, and Methodology This report examines (1) the structure and range of nuclear security work that the International Atomic Energy Agency (IAEA) conducts; (2) ) how IAEA plans and prioritizes its nuclear security work, and how it measures and reports on its performance; and (3) the challenges that IAEA’s nuclear security program faces. We focused our review on IAEA’s nuclear security program, specifically on activities carried out by the Division of Nuclear Security (DNS), within the Department of Nuclear Safety and Security. To address all three objectives, we interviewed U.S. officials, IAEA officials, officials representing IAEA member states, and other nuclear security experts. We selected the U.S. agencies most involved in nuclear security policy, including interacting with IAEA. The Department of State is the lead agency for interacting with IAEA and has represented the United States in the Nuclear Security Contact Group (NSCG) since September 2018; the Department of Energy’s National Nuclear Security Administration provides technical expertise and loans staff to IAEA; Nuclear Regulatory Commission, as the regulator for the U.S. civilian nuclear industry, provides perspectives on how IAEA’s guidance may impact states’ regulations, among other things; the Department of Defense collaborates with IAEA to develop IAEA training (for example, for border monitoring); and the National Security Council leads interagency coordination to develop U.S. priorities for nuclear security and initially represented the United States in the NSCG through August 2018. To gain the perspectives of IAEA member states, we selected member states based on their involvement in IAEA’s nuclear security work and suggestions from State and nuclear security experts; the selected member states represent a range of informed opinions, but cannot be generalized to the universe of IAEA member states. While we reached out to various member states, we predominantly received responses from member states who have voiced support regarding IAEA’s nuclear security work. Our statements about member states we spoke to should be interpreted with the understanding that few member states that have voiced opposition to IAEAs nuclear security work responded to our requests. Throughout this report, we use the phrase “member states we spoke to” or “member states who responded” to refer to all those who provided us information. In light of political sensitivities surrounding IAEA’s nuclear security work, we agreed not to identify the member states whose officials we interviewed. We selected nuclear security experts based on a literature search and a snowball sampling technique. Specifically, from our initial literature search, we selected seven authors who had published at least two articles since 2010 that were relevant to our review. However, two authors declined or did not respond to our interview request. During our interviews with the authors identified in the literature search, as well as with U.S. government officials, we asked for suggestions of individuals who were knowledgeable on IAEA’s nuclear security work or nuclear security more broadly. We added to our sample individuals named at least twice by other interviewees. Not all experts in the sample were available to participate in interviews. We summarized the information gathered from experts and other interviewees in the report by using “some” to refer to three members of a group, “several” to refer to four or five members of a group, and “many” to refer to more than five members of a group. We interviewed officials representing 12 member states, and 20 experts. To determine the structure and range of IAEA’s nuclear security work, we reviewed pertinent legal instruments, such as the Statute of the IAEA, the Convention on the Physical Protection of Nuclear Material and its 2005 amendment, and the International Convention for the Suppression of Acts of Nuclear Terrorism. We also reviewed IAEA’s planning documents, including the 2018-2019 Programme & Budget (P&B); 2017 and 2018 Nuclear Security Resolutions; and the 2018-2021 Nuclear Security Plan. To review how IAEA plans and prioritizes its nuclear security work, we reviewed these planning documents against the Project Management Institute’s The Standard for Program Management and interviewed IAEA officials responsible for planning and prioritizing the agency’s nuclear security work. To examine how IAEA measures and reports on performance, we reviewed the previously mentioned IAEA documents, as well as IAEA’s Nuclear Security Reports from 2016-2018. We also reviewed the 2015-2016 P&B, the 2016 Nuclear Security Report, 2018 Annual Report, and the 2016 mid-term program performance report to understand IAEA’s use of objectives, outcomes, and performance indicators. We chose the 2016 reports because at the time of our review, the 2016 program performance report was the most recent completed. We compared the agency’s planning documents and reports with leading practices for performance management and reporting, including leading practices derived from our prior work, and IAEA’s results-based management approach. We derived some of these leading practices from standards and practices developed for federal agencies, such as those established in Standards for Internal Control in the Federal Government. Although federal standards are not required to be used by international organizations such as IAEA, the leading practices based on these standards can be instructive for assessing IAEA performance measurement and reporting practices. To examine the challenges the agency’s nuclear security role faces, we reviewed the IAEA documents listed above as well as proceedings from meetings and conferences and budgetary contributions data from the United States and other member states. We analyzed statements from IAEA, U.S., and member-state officials and from experts about IAEA’s nuclear security challenges. We also assessed actions IAEA and member states have taken to potentially mitigate challenges by comparing those actions with written commitments made in support of the agency’s nuclear security work. We also reviewed IAEA’s central coordinating role in nuclear security against certain key practices that we have previously found to enhance and sustain collaborative efforts. We selected five practices as relevant to our analysis, and combined two practices—those on establishing joint strategies and establishing compatible policies and procedures. In our analysis we considered IAEA’s role as a coequal entity among many rather than one that has authority over other entities. We conducted this performance audit from March 2018 to July 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix II: The Nuclear Security Contact Group The Nuclear Security Contact Group (NSCG) was established at the 2016 Nuclear Security Summit to continue the work of the summit process, including maintaining high-level political attention and momentum on nuclear security, assessing and following up on commitments made at the summits, and developing and maintaining connections to nongovernmental experts and the nuclear industry. NSCG has 48 members as of March 2019, and its membership is open to all International Atomic Energy Agency (IAEA) member states. According to State officials, the group actively focuses on recruiting new members. NSCG advertises itself through IAEA Board of Governors statements and has issued joint statements to encourage other member states to join. Canada was the first country to chair NSCG, followed by Jordan and Hungary, which is the current chair. NSCG formally meets on the margins of the IAEA General Conference. According to U.S. officials, NSCG has convened two to three times per year since its inception after the 2016 summit. IAEA is an observer, and an IAEA representative may comment on how NSCG proposals would impact IAEA. Representatives to the NSCG are government agencies. The National Security Council was the lead agency to represent the United States in the NSCG through August 2018, and State has been the lead agency since September 2018. According to officials and experts we interviewed, NSCG serves as a forum for proposing and developing ideas rather than as a formal decision-making body. Member states described the benefits NSCG has provided. For example, some member-state officials said NSCG helps maintain contact among summit participants and between nuclear security officials in their respective capitals—where nuclear security policy would be implemented—and those at IAEA. In addition, a member-state official said that the group is a very important instrument for developing key messages as part of a communication strategy. As a result of this strategy, some ideas developed in NSCG have been introduced into IAEA proceedings by NSCG member states, or into national policymaking discussions. NSCG has also prepared unofficial position papers. Furthermore, according to a member-state official we interviewed, NSCG has discussed or developed internal papers on a number of topics related to IAEA, including: ways to improve IAEA’s coordinating role in nuclear security whether more regulation is needed in nuclear security IAEA’s role in dealing with emerging nuclear security challenges promoting a more resource stable and empowered Division of Nuclear communication and outreach within IAEA the agency’s networks of nuclear security training centers. According to State officials, U.S. priorities for NSCG include ensuring that it is productive and action-oriented, with representatives ready to share views, brainstorm on ways forward, and lead change both at home and internationally. State is also focused on preparing the NSCG’s input for its representatives to significant conferences, such as IAEA’s ministerial- level and technical conferences and the 2021 Review Conference on the Amendment to the Convention on the Physical Protection of Nuclear Material. According to a member-state official, the NSCG has discussed how to engage in preparation for the review conference, the framework of the review, what to ask of member states, and whether to revise the Convention. According to U.S. officials and some member-state officials, NSCG has also promoted implementation of summit commitments, in which individual members are responsible for tracking and following up on commitments made by countries in certain areas. For example, the United States is the lead for following up on commitments related to insider–threat mitigation, and the Department of Energy led a meeting in Belgium in February 2019 on that topic. State officials said that NSCG also follows up on commitments made during the 2016 International Conference on Nuclear Security. Many experts we interviewed said that the NSCG process lacks transparency. Specifically, it does not publish its proceedings, which these experts said made it difficult to discern its accomplishments. U.S. and several member-state officials and experts said that a quiet approach was necessary to protect the group from IAEA member-state politics. Several representatives said that NSCG is mindful of the political sensitivities around its association with the Nuclear Security Summits, and is committed to supporting IAEA’s nuclear security role without becoming a distraction. In addition, one expert said that more openness would weaken the group as a discussion forum. For example, publishing proceedings would require getting consensus among members, which would shift the focus of the group from discussion to decision-making. U.S. officials said that NSCG planned to revamp and update its website, and to use it to highlight nuclear security successes and events, such as nuclear security support for major public events or regional training events, but did not plan to promote its own work. Appendix III: Comments from the Department of State Appendix IV: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, the following staff members made key contributions to this report: William Hoehn (Assistant Director); Alisa Beyninson; Antoinette Capaccio; R. Scott Fletcher; Ellen Fried; Drew Lindsey; Steven Putansu; Liz Spurgeon; and Sara Sullivan.