Background Roles and Responsibilities CBP’s Office of Field Operations (OFO) is responsible for inspecting pedestrians, passengers, and cargo at 110 land POEs, which have a combined total of 173 crossings (see figure 1). OFO has 20 field offices nationwide that oversee the operations of all POEs within their designated areas of responsibility. Traveler and Cargo Entry Requirements Travelers seeking entry to the United States through a land POE are required to present valid travel documents. In response to a recommendation from the 9/11 Commission and the Intelligence Reform and Terrorism Prevention Act of 2004, DHS and the Department of State implemented the Western Hemisphere Travel Initiative, which requires all travelers to present documents that denote identity and citizenship, such as a passport, when entering the United States. Foreign nationals may have particular travel document requirements, such as a visa or other entry permit, which vary based on such factors as nationality and the purpose of travel. See table 1 for examples of the types of acceptable documents for travelers coming into the United States through land POEs. There are also documentary requirements for commercial vehicles with cargo seeking entry into the United States. The Trade Act of 2002, as amended, establishes requirements for commercial vehicles with cargo to electronically submit information to CBP at least 1 hour in advance of arrival at a land POE. The information required includes data on the vehicle (e.g., Vehicle Identification Number or license plate number), the shipper, the carrier, scheduled date and time of arrival, and the description and weight of the cargo, among other things. Commercial vehicles with cargo valued less than $2,500 are considered “informal entries” that are exempt from the advance cargo information reporting requirements. CBP Has Processes for Inspections at Land POEs, But Has Not Updated Related Policies Consistent with CBP Guidance CBP’s Inspection Processes Include Screening to Identify Higher-Risk Travelers, Vehicles and Cargo and Conducting Physical Inspections CBP inspects travelers and cargo seeking to enter the country through land POEs. These inspections involve a targeting process in which CBP uses law enforcement databases to identify and target higher-risk passengers, pedestrians, commercial vehicles, and cargo before arrival at a land POE. Targeting. CBP uses law enforcement, intelligence, and other enforcement data to identify higher-risk individuals, vehicles, or cargo for additional scrutiny upon their arrival at a land POE. Most cargo-carrying commercial vehicles must submit an electronic manifest (e-manifest) with information on the shipment to CBP at least 1 hour in advance of arrival at a land POE. CBP personnel at the POEs are to use the e-manifest and CBP’s Automated Targeting System to identify high-risk inbound cargo. The Automated Targeting System is a decision support tool that compares traveler, cargo, and conveyance information against law enforcement, intelligence, and other enforcement data using risk-based targeting scenarios and assessments. It draws on many law enforcement, intelligence, and other enforcement databases, including the Terrorist Screening Database, the Department of Justice’s National Crime Information Center, the Social Security Administration Death Master File, and the National Insurance Crime Bureau’s private database of stolen vehicles. CBP policy requires that high-risk cargo be targeted for additional research and analysis and generally will also require the high- risk cargo to undergo a secondary examination once it arrives at the POE. In addition, CBP personnel at the POEs or field offices may review seizure and arrest reports, and other law enforcement information to identify individuals or vehicles that have associations with known criminals and place a “lookout” on them in TECS, CBP’s system for processing travelers. TECS will flag travelers with lookouts for additional inspection if they arrive at the land POE. CBP personnel at the POEs or field offices may also use this information to develop products on recent trends that can help inform inspections. Once passengers, pedestrians, and commercial vehicles arrive at a land POE, CBP has various processes for inspecting them, including preprimary, primary, and secondary inspections, as explained below (see figure 2). Preprimary. In the preprimary area, both commercial vehicles and passenger vehicles will generally pass through radiation portal monitors that are designed to detect radiation and help prevent the smuggling of nuclear material into the United States (see figure 3). In the passenger vehicle environment, the preprimary area also contains license plate readers and Radio Frequency Identification (RFID) readers to capture information on vehicles and RFID-enabled travel documents. Examples of RFID-enabled travel documents include passport cards and border crossing cards. When a vehicle enters the preprimary inspection lane, a sensor grid determines that a vehicle has entered the lane. The sensors deploy a flash strobe that illuminates the area and license plate reader cameras take a picture of the front and rear of the vehicle. The information associated with the license plate number is run against law enforcement databases to alert the officer during the primary inspection if there is a potential issue with the vehicle or its occupants. Similarly, as a vehicle approaches the primary inspection area, travelers are directed to hold up their RFID travel documents to be read by RFID readers. Some land POEs may also have RFID readers for pedestrians. See figure 4 for examples of a license plate reader and RFID reader. The preprimary area is also used to direct travelers to different lanes according to the type of travel documents they have. For example, CBP may use signs to designate specific lanes for travelers with RFID or other machine readable documents (“Ready lanes”) or for trusted travelers (see figure 5). Primary inspection. During the primary inspection, CBP officers inspect travelers, vehicles, and cargo to determine compliance with U.S. law and admissibility to the United States. A CBP officer is to examine travel documents to ensure their validity and visually match the traveler to the photo identification to confirm the traveler’s identity. All travelers’ names and license plates generally are to be screened against law enforcement databases. As previously discussed, this screening process may begin in the preprimary area when license plate and RFID readers collect data on vehicles and travelers with RFID travel documents. CBP officers may also manually enter data on travelers and vehicles during the primary inspection. A CBP officer is to interview travelers to obtain a declaration of citizenship, the purpose of travel, and items acquired outside the United States. For commercial vehicles, the CBP officer may also review the manifest and the results of targeting, if any. All CBP officers conducting primary inspections are to wear personal radiation detectors— small devices designed to be worn on a belt—to help detect radiation and help ensure the safety of officers and the traveling public. If the inspection cannot be completed at the primary inspection location, a more thorough inspection is required and the travelers, vehicles, or cargo are to be referred for secondary inspection. Travelers, vehicles, or cargo can be directed to secondary inspection for a wide range of issues, including when: radiation is detected (either on the traveler or from his or her vehicle), the traveler does not have required travel documents, the officer has questions about the validity of travel documents, the traveler’s information matches information that may be of concern from law enforcement or intelligence data, or the officer suspects that the traveler is carrying contraband. Foreign visitors to the United States (with the exception of Canadian citizens and Mexican citizens using border crossing cards) may also be referred to secondary inspection to complete processing of their admission records, referred to as Form I-94s. Additionally, CBP selects passenger vehicles at random to be sent to a secondary inspection for a Compliance Examination (COMPEX). COMPEX is a program designed to help measure the effectiveness of CBP’s inspections and is discussed in more detail later in this report. Secondary inspection. A secondary inspection may include a CBP officer conducting further questioning of travelers or additional examination of the traveler, vehicle, or cargo. CBP may use canines, non- intrusive inspection (NII) X-ray, Gamma-ray, or radiation detection equipment, or physically examine the traveler, vehicle, or cargo. CBP may also examine a traveler’s electronic devices, such as computers, tablets, and mobile phones. To examine cargo, CBP may require the contents to be offloaded. When foreign visitors are referred to a secondary inspection to process Form I-94 admission records, CBP officers are to conduct interviews and additional database screening, including biometric checks of fingerprints. CBP policy calls for documentation, immigration, and other admissibility issues to be resolved before a traveler or vehicle is permitted to enter the country. Below, figure 6 shows a canine examination and figure 7 shows an example of NII equipment and scans of vehicles with indicators of contraband smuggling. CBP also has additional processes to enhance preprimary, primary, or secondary inspections at land POEs, including: Canines. CBP has canines that can detect concealed humans, narcotics, currency, firearms, and agriculture products. Depending on availability, land POEs may deploy officers with canines to walk among the vehicles in preprimary waiting to reach an inspection booth. Canines may also be used in the pedestrian and commercial vehicle environments. As previously mentioned, canines are also used for some secondary searches. Anti-Terrorism Contraband Enforcement Teams. These teams conduct special operations that focus on anti-terrorism and the interdiction of narcotics, alien smugglers, and fraudulent documents, among other contraband. For example, at one POE we visited, members of the Anti-Terrorism Contraband Enforcement Team told us they often walk among the passenger vehicles in the preprimary area to look for indicators of illicit activity. Tactical Terrorism Response Teams. These teams provide immediate counterterrorism response capabilities at some land POEs. Members of Tactical Terrorism Response Teams receive counterterrorism training and are responsible for interviewing known and suspected terrorists at ports of entry to help determine admissibility and collect intelligence. Blitzes and other local practices. CBP officers at land POEs may perform “blitzes”, in which inspections are enhanced for a period of time. For example, CBP officials told us that blitzes may include looking in all vehicle trunks during the primary inspection or sending additional vehicles for NII (X-ray) exams during a certain period of time. Officers at the POEs we visited also discussed other local initiatives to enhance inspections. For example, one POE we visited used NII to screen all commercial vehicles. Another POE we visited partnered with the local authority that manages an international bridge to deploy license plate readers for commercial vehicles before the vehicles enter the bridge into the United States. The bridge authority uses the license plate reading to check if the commercial vehicle has submitted the required e-manifest to CBP; only those commercial vehicles that have submitted the required e-manifests are allowed to cross. Officials from CBP told us that, in the future, CBP and the bridge authority plan to deploy additional technology in the preprimary area on the non-U.S. side of the border, including facial recognition and NII. In addition, CBP has plans to make future improvements to inspection processes. For example, CBP is conducting tests to use facial recognition technology as part of inspections at land POEs. According to CBP, facial recognition technology may enhance its ability to detect imposters by matching facial images of those arriving with images on file. CBP began a facial recognition test in the passenger vehicle environment at the Anzalduas, Texas land POE in August 2018 and expects the test to run for up to 1 year. In September 2018, CBP initiated a project at the Port of San Luis, Arizona to demonstrate the feasibility of acquiring photos of all arriving pedestrians and comparing those photos to photos on file. Subsequently, in October 2018, CBP officials stated they extended this demonstration project to the Port of Nogales, Arizona. According to CBP, these pedestrian demonstration projects built upon an earlier pilot project at the Port of Otay Mesa, California, which ran from February through May 2016. Testing this technology is one of CBP’s key efforts in developing the capability to fulfill DHS’ statutory responsibility to collect biometric information from arriving and departing aliens. Many of CBP’s Policies Related to Inspections at Land POEs Have Not Been Reviewed and Updated to Reflect Changes Consistent with CBP Guidance CBP has numerous directives, handbooks and other official instructions that specify policies and procedures for inspections at land POEs. However, many of these documents have not been reviewed and updated as required by OFO’s January 2016 OFO Policy Management Handbook. This guidance states that all of OFO’s policies must be reviewed and updated, as necessary at least once every 3 years to help ensure the timely provision of uniform and relevant policy. In some cases, the policy documents issued by OFO or its program offices have not been reviewed and updated for almost two decades. See table 2 below for a list of such policies we identified that have not been reviewed and updated to reflect changes in processes since their issuance consistent with OFO’s policy management requirements. As a result of policies not being reviewed and updated by OFO, these policies, as currently written, do not fully reflect changes in technology, operating conditions, or inspection processes. For example: The 2008 policy on processing travelers and vehicles at land POEs does not include information on the Consolidated Secondary Inspection System, the current system used to record secondary inspections. It also directs officers to follow guidance in the Inspector’s Field Manual, which has since been discontinued. The 1999 Compliance Measurement directive refers to procedures for a paper-based system, while the system is now electronic, according to officials. The 2004 Personal Search Handbook does not incorporate the 2015 National Standards on Transport, Escort, Detention, and Search policy that prohibited CBP officers from observing personal cavity searches conducted by medical personnel. The 1999 Narcotics Interdiction Handbook and the 2002 canine policies do not address fentanyl. Fentanyl is a synthetic opioid that requires special handling and has been a main contributor to the recent spike in overdose deaths in the United States, according to the Centers for Disease Control and Prevention. OFO’s Planning, Program, Analysis, and Evaluation (PPAE) Quality Assurance Enterprise Division (QAED) is responsible for monitoring that each program office review and update, as needed, the policies for its programs. QAED has an internal tracking system and sends out reminders to CBP program offices about policies that need to be reviewed, and updated, if necessary. QAED officials acknowledged that many policies need to be updated because some are almost 20 years old and many technological and other changes have occurred that may not be described in existing policies. CBP officials stated that they are in the process of updating some policies, including the 1999 Compliance Measurement directive, the 2002 Canine Enforcement Program Handbook, the 2004 Personal Search Handbook, and the 2008 Primary Processing of Travelers and Vehicles Seeking Entry to the United States at Land Ports of Entry directive. Officials attributed the lack of timely updating to several factors. OFO officials responsible for reviewing and updating policies said that the process can be time-consuming and difficult, as there may be many needed changes or may include conducting site visits to identify best practices and areas for improvement. In addition, QAED officials responsible for monitoring policy updates said QAED has 12 staff and is responsible for three OFO-wide mission areas in addition to policy management, as well as a number of other responsibilities within PPAE. Further, according to QAED officials, they do not have authority to require cognizant program offices to review and update their policies in line with the OFO Policy Management Handbook. QAED officials agreed that CBP and OFO could better ensure compliance with OFO’s policy updating requirements. OFO’s 2016 OFO Policy Management Handbook states that the timely provision of uniform and relevant policy facilitates informed decision- making at all levels of the organization and that an effective policy management program is critical to the success of any organization. By reviewing and updating as necessary all relevant policies related to land POE inspections consistent with OFO’s policy handbook, CBP could better ensure that officers have guidance needed to consistently and properly inspect vehicles and their passengers, pedestrians, and commercial vehicles. CBP Uses Various Mechanisms to Monitor Inspection Activities at Land POEs, But Does Not Fully Analyze the Results of Some National Monitoring Programs CBP Monitors Inspections at Land POEs Using Mechanisms Deployed at the Port, Field Office, and National Levels CBP uses various mechanisms at the port, field office, and national levels to monitor inspection activities at land POEs to help ensure that CBP officers are following policies and procedures. At the POE level, supervisors and port management monitor many of the inspection tasks in real-time by reviewing computer-based records and logs of inspections and observing inspections. CBP also provides tools to the ports to assist with supervisory monitoring efforts, such as Enforcement Link Mobile Operations Red Flag (ELMOrf)—a computer application that provides alerts to supervisors via mobile device when certain types of events occur during primary inspections that warrant supervisory oversight. Table 3 below provides key monitoring mechanisms CBP uses for its land POE inspections at the port level. At the field office level, field office staff may monitor land POE activities within their area of responsibility through periodic assessments of supervisor monitoring duties, such as inspection report reviews. In addition, all field offices have Integrity Officers tasked with identifying potential corruption and officer training issues at the ports. Table 4 below provides key monitoring mechanisms CBP uses for its land POE inspections at the field office level. CBP’s national level initiatives include its Self-Inspection Program (SIP) and the Operational Field Testing Division’s covert testing program. The Self-Inspection Program is an annual internal self-assessment of various CBP component offices and includes assessment of various inspection activities at POEs. Table 5 below provides key monitoring mechanisms CBP uses for its land POE inspections at the national level. CBP Conducts Analysis of the Results of National Level Monitoring Programs, But Opportunities Exist to Enhance Analyses CBP Analyzes Self-Inspection Program Results Each Year, But Does Not Analyze Results of Individual POEs to Identify Reoccurring Deficiencies CBP produces CBP-wide analyses of the SIP results it collects annually, but the analyses are not done in a manner—such as at the port level and over multiple years—that would allow CBP to identify potentially reoccurring deficiencies at individual POEs. The Management Inspections Division issues a report each year which provides comprehensive SIP results across CBP offices for that year and highlights compliance issues identified (referred to as the SIP Summary Analysis Report). Similarly, OFO issues an annual report which provides comprehensive results and highlights compliance issues identified across OFO’s programs for that year. See figure 8 for an overview of the SIP process. With regard to the 2018 SIP Summary Analysis Report, the Management Inspections Division reported that approximately 80 percent of all SIP worksheets, which document the results of the self-assessments, submitted across CBP in the 2018 cycle had no deficient conditions. The report also identified the six worksheets with the highest number of deficient conditions across OFO and the questions associated with the most corrective actions for those worksheets. For worksheets that the report did not highlight, additional summaries of the OFO data are provided, including the number of worksheets submitted and the number of worksheets reporting corrective actions. OFO’s SIP annual report also provides summaries of the SIP results, but with additional analysis specific to OFO. The 2018 OFO SIP annual report calculated an overall compliance rate of 92.4 percent across the 31,947 questions for worksheets completed by OFO that year. The report also provided summaries of data used to calculate compliance rates for each worksheet assigned to OFO and included trends in compliance rates for each over 3 years. Additionally, the report provided summaries of the data for each OFO field office that includes number of worksheets submitted, the number of deficient conditions in the given year, and the number of corrective actions for each POE under the field office. Beginning in 2017, the OFO report provided an analysis of any SIP worksheet question with a compliance rate below 90 percent in a given year and the actions planned or taken to increase future compliance. While these reports provide useful summary data of CBP’s monitoring of inspections activities and recommendations for increasing compliance for some programs and processes, our analysis of SIP results showed that opportunities exist for CBP to identify potential reoccurring deficiencies at individual land POEs over time. Specifically, our analysis of SIP results from 2013 through 2018 identified reoccurring instances of noncompliance at individual land POEs indicating the possibility that the corrective actions taken each year to address the deficiencies did not fully remediate them. We found that management at the land POEs with reoccurring instances of deficiencies took corrective actions each year to address the identified deficiencies, and in some instances, management proposed and implemented the same corrective action in multiple years to try to resolve the identified deficiency. While the Management Inspections Division and OFO reports provide some useful analysis to identify programs or specific activities across CBP to target for remediation each year, these reports have not positioned CBP to identify and more effectively address reoccurring deficiencies at individual POEs. Standards for Internal Control in the Federal Government provides that management should use quality information to achieve the entity’s objectives and management should process the obtained data into quality information that supports the internal control system. Furthermore, management should remediate identified internal control deficiencies on a timely basis and the audit resolution process is completed only after action has been taken that (1) corrects identified deficiencies, (2) produces improvements, or (3) demonstrates that the findings and recommendations do not warrant management action. Additionally, management, with oversight from the oversight body, is to monitor the status of remediation efforts so that they are completed on a timely basis. Management Inspections Division and OFO officials stated that their analyses are designed to identify systemic compliance issues across OFO. In addition, OFO officials stated that port management is responsible for addressing compliance issues of individual land POEs. However, without an analysis to identify reoccurring deficiencies at all individual land POEs, the Management Inspections Division and OFO are not well positioned to determine whether CBP may need to take additional or alternative actions to more effectively address the deficiencies at these ports. By enhancing analysis of the SIP data to include analysis at the port level over time, CBP could better identify potential reoccurring deficiencies with inspections at land POEs and could be better positioned to more fully remediate them and ensure compliance with inspection policies. CBP Has Produced Comprehensive Analyses of Some Covert Testing Results, But Does Not Have a Policy to Conduct These Analyses on a Periodic Basis CBP has produced comprehensive analyses of the results from some of its covert operational tests conducted at land POEs in fiscal years 2013, 2014 and 2018. These comprehensive assessments of aggregated covert test results provide analysis of trends, common vulnerabilities, and best practices used in inspections across land POEs; however, CBP has not developed comprehensive assessments for various other covert tests it conducted during this time frame. Of the 213 land POE tests conducted from fiscal years 2013 through 2018, 78 were included in comprehensive assessments. CBP’s Operational Field Testing Division (OFTD) is responsible for covertly assessing and evaluating the integrity of CBP’s personnel, technologies, and policies and procedures at land POEs. From fiscal years 2013 through 2018, OFTD conducted a variety of tests of inspections at land POEs including: fraudulent document and imposter tests, canine contraband detection tests, biological agent detection tests, NII equipment contraband detection tests, radiation detection capabilities tests, and assessments of Tactical Terrorism Response Teams. See figure 9 for an overview of the process for fraudulent document and imposter covert testing. For tests conducted from fiscal years 2013 to 2018, OFTD produced three comprehensive assessments related to tests it conducted at land POEs. One assessment compiled the results of 129 fraudulent document and imposter tests conducted at 10 land POEs and 14 airports in fiscal years 2012 and 2013. Another assessment covered 34 NII equipment tests conducted in fiscal years 2013 and 2014 at land POEs and seaports, of which nine of the tests were at land POEs. The third assessment, issued in 2018, covered 33 NII equipment tests conducted in fiscal year 2018 at six land POEs. While OFTD produced comprehensive assessments for these tests, OFTD did not comprehensively analyze the results of various other types of covert tests conducted from fiscal years 2013 through 2018. Such covert tests included 34 tests for canine detection of contraband, 11 for agricultural and biological agent detection, seven for radiation detection, and seven for Tactical Terrorism Response Team response. Additionally, OFTD conducted another 72 fraudulent document and imposter tests and six NII equipment tests over this time period that were not included in the comprehensive assessments described above. Overall, we found that 135 of 213 tests conducted from fiscal years 2013 through 2018 were not included in comprehensive assessments. For tests not included in comprehensive assessments, analysis of the test is limited to a test summary document that is produced following a test or group of tests conducted during a field visit to one location. The summaries identify officer actions during the test and record whether the test resulted in an interdiction of the test subject. Some of the summaries also include findings, identify leading practices, and provide recommendations to the POE where the test or tests were conducted to improve the inspections. While these summaries provide useful information, they encompass the results of tests at individual POEs and do not provide an evaluation of aggregated test results that could more broadly identify vulnerabilities, trends, and best practices across land POEs as provided in the comprehensive assessments. According to OFTD officials, they have drafted a policy and standard operating procedures that would address comprehensive analysis of covert testing results, but these have been in development for 3 years and have not been finalized. OFTD did not provide further details or documentation of the draft policy or procedures or a date for completion. Additionally, OFTD officials stated that in some cases they did not have a sufficient number of covert test results to conduct a comprehensive analysis. OFTD officials also stated that an additional comprehensive assessment of fraudulent document and imposter tests was not needed as OFTD completed this type of assessment in 2013 and no new findings were generated by subsequent tests. We recognize that the small number of certain tests limit OFTD’s ability to conduct comprehensive analyses. However, we found that from fiscal years 2013 through 2018 over half (135 of 213) of the tests conducted at land POEs were not included in a comprehensive assessment and a formalized policy could better position OFTD to be able to conduct these analyses moving forward. Further, our analysis of covert test interdiction rates suggests that additional periodic comprehensive analysis could help inform CBP management of vulnerabilities, systemic inspection deficiencies, leading practices observed, and ways to improve inspection processes. Moreover, the reasons for non-interdiction in the fraudulent document and imposter covert tests conducted since the last comprehensive assessment may be different due to changes in inspection technologies, training, personnel, or the threat environment. OFTD officials agreed and stated that another comprehensive assessment is being developed based on covert tests focused on facial recognition technologies. Standards for Internal Control in the Federal Government provides that management should implement control activities through policies, including documenting such policies. In addition, management should monitor the internal control system through ongoing monitoring and separate evaluations. These evaluations are to be used periodically and may provide feedback on the effectiveness of ongoing monitoring. Furthermore, management should evaluate and document issues identified through separate evaluations to identify internal control deficiencies and monitor changes in the internal control system. By implementing a policy for conducting periodic comprehensive analyses of its covert operational test results, CBP would be better positioned to understand the effectiveness of inspection policies, personnel, and technologies across land POEs over time. Furthermore, periodic analyses could help identify inspection vulnerabilities that may be occurring more broadly, trends in these vulnerabilities, and best practices in mitigating such vulnerabilities on a more consistent basis. CBP Has Performance Measures to Assess Its Land POE Inspections but Has Not Set a Target for One Measure That Drives Performance Improvements CBP uses various sets of performance measures including organizational performance measures, internal performance measures, program and port-specific measures, and measures required by the National Defense Authorization Act for Fiscal Year 2017 (NDAA). CBP reports organizational measures externally to inform program management while internal measures track additional areas of performance to inform OFO management. In addition, some CBP programs and ports track measures specific to their performance at land POEs. DHS also reports measures that cover CBP’s efforts to detect illegal activity at land POEs as required by the NDAA. These performance measures generally reflect attributes of effective measures, however, CBP has not set an ambitious target for one measure—the land border interception rate. CBP Uses Various Sets of Measures to Evaluate Its Efforts to Detect Illegal Activity at Land POEs Organizational Performance Measures CBP tracks and externally reports the results of performance measures annually in its Organizational Performance Measures Overview. The Overview states that it serves as a tool for leadership to manage programs using performance information and includes performance measure descriptions, targets, results, and trends over time. CBP developed and reports on two measures that cover the detection of illegal activity among inbound passenger vehicle and cargo traffic at land POEs: (1) the estimated percentage of land border privately-owned vehicles with passengers who are compliant with laws, rules, and regulations; and (2) the percentage of inbound cargo identified as high-risk that is assessed or scanned prior to departure or at arrival at a U.S. air, land, and sea POE. CBP also tracks, but does not report, data on the percentage of high-risk inbound cargo assessed or scanned prior to departure or upon arrival at U.S. land POEs, which in fiscal year 2018 was 97.7 percent. See figures 10 and 11 for CBP’s reported results for these measures by fiscal year. CBP measures the percentage of privately-owned vehicles with passengers who are compliant with all federal, state, and local laws and regulations through its COMPEX program. COMPEX is a statistical survey in which vehicles cleared for entry into the United States by CBP are randomly selected for a comprehensive audit through a computer- generated random sample. CBP is to conduct an audit of the selected vehicles by doing a secondary inspection using a standardized system of checks to identify any violations that were missed during the routine inspection. Violations found in the COMPEX audits represent violations missed by CBP and are used by CBP to estimate the total number of violations missed by CBP operations. According to officials, CBP uses these data— along with data on violations CBP officers identify during the normal inspection process—to calculate the overall estimated percentage of land border privately-owned vehicles with passengers compliant with laws, rules, and regulations. As shown in Figure 10, CBP has set a target rate of 99.5 percent compliance. From fiscal years 2015 through 2018, CBP reported estimated rates of over 99 percent compliance. While CBP nearly met its target across all of these years, CBP plans to work with field office management and review COMPEX secondary inspection findings to identify noncompliance trends and identify the underlying reasons for noncompliance. In addition, CBP plans to develop materials to educate travelers on relevant laws and requirements. As previously discussed, in the cargo environment, CBP identifies potentially high-risk cargo through the Automated Targeting System. CBP then tracks the percentage of such cargo assessed or scanned prior to arrival or at a land POE. As shown in Figure 11, CBP has set a target rate of identifying 100 percent of potentially high-risk cargo. For fiscal years 2014 through 2017, CBP reported rates of 99 percent or higher, and in 2018, the rate was 97.9 percent. According to CBP, it did not meet its target rate of 100 percent in fiscal year 2018 because of challenges related to changes in high-risk status that occur en route, data entry errors, and logistical or scheduling errors. OFO plans to address these challenges by working with internal stakeholders to resolve status- tracking problems and information-processing errors and by working with shippers and carriers to rectify logistical and scheduling issues. In addition to its externally-reported organizational performance measures, OFO tracks two performance measures internally that relate to efforts to detect illegal activity among inbound traffic at land POEs: the percentage of individuals screened against law enforcement databases for entry into the United States and the land border interception rate for passengers in privately-owned vehicles with major violations. See figure 12 for CBP’s performance by fiscal year. CBP uses COMPEX data to estimate the land border interception rate for privately-owned vehicles containing passengers with major violations (interception rate). This represents the number of major violations in privately-owned vehicles at the border that CBP intercepts divided by the estimated total number of major violations. CBP tracked the percentage of individuals screened against law enforcement databases for entry into the United States across fiscal years 2013 through 2018, but plans to discontinue use of this measure beginning in fiscal year 2019 according to CBP officials. CBP officials stated that this measure was originally created to track progress toward electronic screening of travel documents as part of the Western Hemisphere Travel Initiative. This measure tracks the percentage of travelers screened against law enforcement databases using electronically readable documents. According to CBP officials, there have been a variety of technology infrastructure upgrades and changes to vehicle processing software at land POEs that have reduced the relevance of this measure for land POE operations and CBP plans to discontinue its use as a result. Program and Port-Specific Measures Some CBP programs that operate as part of the inspection process track performance data on the results of their program activities. For example, CBP tracks results from the Canine Program. Canine handlers are to enter performance data into the Canine Tracking System locally at land POEs. They track data on the numbers of days canine officers worked, searches conducted, and fines and arrests that result from canine searches. In addition, some land POEs track performance data on local efforts to detect illegal activity. For example, officials at one POE we visited track data on the numbers and types of seizures, arrests, and immigration enforcement actions that occur at the port. Metrics Required by National Defense Authorization Act for Fiscal Year 2017 In 2018, DHS began reporting additional metrics to measure the effectiveness of border security at land POEs in response to the National Defense Authorization Act for Fiscal Year 2017 (NDAA). The NDAA requires DHS to produce an annual report for appropriate congressional committees, the Comptroller General, and certain other entities. This report is to include certain metrics to measure the effectiveness of border security between POEs, at POEs, in the maritime environment, and with respect to aviation assets and other air and marine operations in the land domain. DHS submitted the fiscal year 2017 Border Security Metrics Report in response to the NDAA requirement in May 2018. Nine of the metrics in DHS’s fiscal year 2017 report cover CBP’s efforts to detect illegal activity at land POEs, although many of these measures group land POE data with other types of ports. DHS reported data for 7 of these 9 metrics. In some instances, DHS reported that it did not have the specific data needed for a required metric and provided other available data instead. DHS reported data in response to the following required metrics related to land ports of entry in the fiscal year 2017 Border Security Metrics Report: total inadmissible travelers at ports of entry (DHS does not have a methodology to estimate total inadmissible travelers, and therefore presented data on known inadmissible travelers), refusal rate at ports of entry, illicit drugs seized at ports of entry, port of entry illicit drug seizure rate, major infractions at ports of entry (DHS does not have a methodology to estimate all major infractions, and therefore included data on known passenger infractions), cocaine seizures effectiveness rate at land ports of entry, and secondary examination rate. CBP did not leverage existing data from the COMPEX program to estimate all major infractions in the fiscal year 2017 Border Security Metrics Report, but began reporting these data in the fiscal year 2018 report. The NDAA requires DHS to report the number of infractions related to travelers and cargo committed by major violators who are interdicted by OFO at ports of entry and the estimated number of such infractions committed by major violators who are not so interdicted. In the fiscal year 2017 DHS Border Security Metrics Report, DHS reported the number of known major infractions at ports of entry. DHS also reported that they did not have a methodology to estimate the number of infractions among those who are not interdicted. However, CBP estimates the number of undetected major infractions through the COMPEX program. CBP officials stated there was likely a miscommunication within CBP that led to the DHS Office of Immigration Statistics—the DHS office that compiled the Border Security Metrics Report— not using COMPEX data to report the estimated number of major infractions in the 2017 Border Security Metrics Report. In addition, the DHS Office of Immigration Statistics was not aware that CBP’s COMPEX was applicable for purposes of reporting this metric. As a result of our review, DHS included an estimate of the number of major infractions not interdicted by CBP using data from the COMPEX program in the fiscal year 2018 Border Security Metrics Report. CBP Performance Measures Generally Reflect Key Attributes of Effective Measures but CBP Does Not Set an Ambitious Target for One Measure CBP organizational and internal performance measures for detecting illegal activity at land POEs generally reflect key attributes of effective performance measures that we previously identified. Based on our analysis of CBP’s organizational and internal performance measures, these measures generally reflect the key attributes listed in table 6. For example, CBP clearly defines its externally-reported organizational measures and presents baselines and trends in its Organizational Performance Measures Overview. In addition, CBP’s Organizational Performance Measures Overview provides linkage between its externally-reported organizational measures and DHS mission. CBP performance measures also have limited overlap with each other presenting new information beyond what other measures provide. Our analysis of CBP’s measures found that they focus on the commercial and passenger-owned vehicle environments and currently provide limited coverage of the pedestrian traveler environment. According to CBP officials, the agency is in the process of expanding the two COMPEX measures to include pedestrian travelers at land POEs, which would provide greater coverage of CBP’s core program activities for detecting illegal activity at land POEs. According to CBP officials, CBP began collecting COMPEX data for all pedestrian POEs in 2015. CBP officials stated they are in the process of reviewing the collected data and are working to refine the methodology and operational issues that may impact the reliability of the results. After CBP resolves these data issues, CBP will begin reporting the results of COMPEX audits in the pedestrian environment, according to CBP officials. Our analysis of CBP’s measures also found that CBP generally sets ambitious but realistic targets for its organizational and internal performance measures. However, CBP’s target for the land border interception rate is lower than the actual reported rate for fiscal years 2015 through 2018. We previously identified critical success factors for goal-setting and performance measurement efforts. Creating ambitious but realistic and measurable “stretch” goals based on current performance levels, among other things, supports the organization in achieving performance improvements. In addition, the Office of Management and Budget Circular A-11 states that agencies are expected to set ambitious goals to push them to achieve significant performance improvements beyond current levels. OFO officials stated they set the target for the land border interception rate following methodological changes OFO implemented in the COMPEX program in 2015. However since that time, OFO officials in the Strategic Transformation Office—the office that reviews and provides input into targets for CBP’s organizational performance measures—stated they have not reviewed this target because it is an internal measure and they do not review these as they would for the externally-reported organizational measures. Nevertheless, OFO officials stated they use this measure internally for performance management and to report results to OFO management. Because OFO sets a target for the interception rate and uses this measure internally, a more ambitious target for the measure would better encourage CBP to review its performance of inspection activities that impact the measure and challenge them to identify ways of improving performance. Conclusions Inspecting travelers and cargo seeking entry to the United States through land POEs is critical to preventing terrorists and other inadmissible persons, as well as nuclear materials, narcotics, and other contraband, from entering the country. OFO has implemented processes and deployed technology to screen and examine travelers and cargo at POEs; however, by reviewing and updating its inspection policies in accordance with its own established time frames, CBP could better ensure that officers have guidance needed to consistently and properly inspect passengers, pedestrians, and commercial vehicles. Further, while CBP has taken steps to monitor compliance with inspection policies through the SIP and covert operational tests, it could more fully analyze the results. By identifying and addressing reoccurring SIP deficiencies at individual land POEs and implementing a policy to conduct periodic comprehensive analyses of covert test findings, CBP could be better positioned to enhance inspections and address vulnerabilities. Lastly, CBP has established various measures to assess the effectiveness of its inspections; however, establishing an ambitious and realistic target for its major violations interception rate could encourage additional improvements in performance. Recommendations for Executive Action We are making the following four recommendations to CBP: The Commissioner of CBP should review and update policies related to land port of entry inspections in accordance with OFO guidance. (Recommendation 1) The Commissioner of CBP should analyze the results of the Self- Inspection Program over time and at a level necessary to identify and address potentially reoccurring inspection deficiencies at individual ports of entry. (Recommendation 2) The Commissioner of CBP should implement a policy to conduct periodic comprehensive analyses of covert test findings. (Recommendation 3) The Commissioner of CBP should develop a new target for the land border interception rate for passengers in privately-owned vehicles with major violations that sets an ambitious and realistic goal based on past performance. (Recommendation 4) Agency Comments and Our Evaluation We provided a draft of this report to DHS for its review and comment. DHS provided comments, which are reproduced in appendix I. In its comments, DHS concurred with the four recommendations. DHS also provided technical comments, which we incorporated as appropriate. With regard to the first recommendation that CBP update policies related to land POE inspections in accordance with OFO guidance, DHS stated that OFO has initiated a process to modernize handbooks, policy memoranda, and directives. With regard to the second recommendation that CBP analyze SIP results over time and at a level necessary to identify and address potentially reoccurring deficiencies at individual POEs, DHS stated that OFO plans to begin training on how to conduct this analysis so it may be conducted for 2021 SIP results. With regard to the third recommendation that CBP implement a policy to conduct periodic comprehensive analyses of covert test findings, DHS stated that CBP is in the process of writing a policy that will document procedures for comprehensive reporting, including periodic reviews of corrective actions taken to mitigate vulnerabilities. With regard to the fourth recommendation that CBP develop a new target for the land border interception rate, DHS stated that OFO will set a new target for fiscal year 2020 using data from the previous three fiscal years. If fully implemented, these actions will meet the intent of our recommendations. We are sending copies of this report to the appropriate congressional committees, the Secretary of the Department of Homeland Security, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-8777 or gamblerr@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix II. Appendix I: Comments from the Department of Homeland Security Appendix II: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Kirk Kiester (Assistant Director), Heather May (Analyst in Charge), Carl Barden, Michele Fejfar, Eric Hauswirth, Susan Hsu, Richard Hung, Jeff Love, Mara McMillen, Sasan J. “Jon” Najmi, and Jonathan Tumin made key contributions to this report.


Background Roles and Responsibilities Related to Collecting and Expending Transportation Funds State reviews and approves FMS purchases, while DOD is responsible for program implementation. DSCA administers the FMS program for DOD, including exercising financial management responsibilities for the FMS trust fund, and DFAS provides DSCA’s accounting services for FMS. Additionally, various other DOD components have responsibilities related to collecting and expending transportation funds, as shown in figure 1. Regulations and Guidance for the FMS Program Several DOD publications provide regulations and guidance for the FMS program, including: DOD Financial Management Regulation (FMR). Managed by the Under Secretary of Defense (Comptroller), the FMR defines financial management requirements for all DOD components, and states that DSCA administers the FMS program and is responsible for monitoring the use of the FMS trust fund. The FMR also states that DOD components should maintain documentation that constitutes a complete audit trail. Defense Transportation Regulation. Managed by the U.S. Transportation Command (TRANSCOM), the Defense Transportation Regulation defines requirements for the transportation of items within the Defense Transportation System, such as the use of unique identifiers for all shipments and how to use and pay commercial carriers, when applicable. Security Assistance Management Manual (SAMM). Managed by DSCA, SAMM provides guidance to the DOD components that manage or implement the FMS program. Life Cycle of FMS Purchases Foreign partners that purchase items and services through the FMS program may use their own funds or, if provided, U.S. funds, such as grants or loans provided through Foreign Military Financing. In addition, some FMS purchases are made using funds appropriated to DOD, State, or other U.S. government agencies for Building Partner Capacity (BPC) programs. These programs purchase items or services for foreign partners through FMS. The FMS process begins when an eligible entity requests information on defense articles or services for purchase. The responsible DOD component then prepares a Letter of Offer and Acceptance (LOA), which is the legal instrument used by the U.S. government to sell defense articles to a foreign country or international organization under authorities provided in the Arms Export Control Act. The LOA itemizes the defense articles or services offered and, when implemented, becomes an official tender by the U.S. government. Signed LOAs are referred to as “FMS cases,” and the individual items or services included for purchase in the FMS case are referred to as “case lines.” Once the LOA is signed, the DOD component responsible for the FMS case then manages the contracting or requisition of the equipment or services specified in the agreement, which are then delivered to the foreign partner. Foreign partners have different options available to them for transporting items they purchase through FMS. Other than when purchasing certain hazardous or sensitive items that must be transported via the Defense Transportation System, foreign partners have the option to arrange for their own transportation of FMS items they purchase—such as using a freight forwarder—for all or part of the transportation needed to reach the final destination. On the other hand, BPC programs use the Defense Transportation System to move all their FMS purchases. When all items have been delivered, all ordered services have been performed, and no new orders exist or are forthcoming, the DOD component responsible for managing the FMS case may mark it as closed. FMS Transportation and Fee Calculation DOD most commonly calculates the FMS transportation fee using a percentage rate applied to the price of the item. The percentage rate varies depending on the extent of the U.S. government’s responsibility for transporting the items purchased, as agreed to between DOD and the foreign partner in the LOA. DOD first determines the estimated transportation fees for shipping FMS purchases based on the terms agreed upon in the LOA. When an item is shipped, the transportation fee is collected from the FMS purchaser’s account into the FMS transportation accounts. Payment and Tracking of FMS Shipments Eight transportation accounts within the FMS trust fund are used to hold transportation fees collected from FMS purchasers’ accounts, and to pay FMS transportation bills. Seven separate accounts hold transportation funds for certain larger BPC programs. These seven BPC accounts allow BPC program transportation fee collections and expenditures to be tracked. In addition, one main account holds transportation funds for all foreign partner purchasers and smaller BPC programs. Individual shipments trigger collections into and expenditures from the FMS transportation accounts. As shown in figure 2, after DOD ships an item and DFAS is notified of that shipment—through a process known as delivery reporting—DFAS moves the amount of the related transportation fee from the FMS country or BPC program account into the main transportation account or corresponding BPC program transportation account and records the amount as a collection. DFAS receives monthly bills that include the costs for FMS transportation, which DFAS pays out of the main transportation account, recording the amount paid as an expenditure. Subsequently, DFAS reviews the transportation bills and associated expenditure transaction data to identify any expenditures associated with the seven BPC programs with dedicated transportation accounts. For any BPC transactions identified, DFAS reimburses the main transportation account for the cost of the expenditure by moving funds from the relevant BPC transportation account into the main transportation account through a process DOD refers to as realignment. DOD and DSCA Guidance Identifies Controls, but DSCA Lacks Routine Oversight Over DOD Components’ Activities DOD and DSCA Guidance Identifies Controls for Fees Collected into the FMS Transportation Accounts DOD and DSCA guidance to DOD components identifies controls over the information used to calculate the fees collected into the FMS transportation accounts. For example, DOD has various codes that identify the percentage rate used to calculate the transportation fee charged to FMS purchasers. DSCA provides guidance to components on how to use those codes, and components are responsible for managing the use of those codes. Both DSCA’s guidance and the FMR require that components maintain documentation, such as documentation of significant events related to delivery transactions and authorized exceptions to normal billing procedures. Additionally, both the FMR and DSCA’s guidance to components identifies that components are responsible for submitting delivery reporting within 30 days of completion, which triggers collection of the transportation fee. DSCA’s guidance to components requires components to perform various case reviews and reconciliations, including annual case reviews to verify the accuracy of information, such as the accuracy of the codes applied to case lines, as well as the timeliness of delivery reporting. DSCA Lacks Routine Oversight of DOD Components’ Annual Case Reviews DSCA’s guidance to DOD components requires components to review FMS cases at least annually to verify the accuracy of data—including the accuracy of the transportation fee collected and the timeliness of delivery reporting—but DSCA does not have a routine process to oversee those reviews. DSCA’s guidance to components also states that DSCA may request copies of components’ annual case reviews for oversight purposes, and DSCA officials told us that they request copies on an ad hoc basis. Although DSCA has oversight responsibility over collections into the FMS transportation accounts, DSCA officials said they do not have a standard process for selecting and examining components’ annual case reviews, and do not document their reviews. Federal internal control standards state that management should establish and implement activities to monitor internal control systems and evaluate results, and ensure that activities are performed routinely and consistently. Management may use ongoing monitoring, separate evaluations, or a combination of the two to obtain reasonable assurance of the operating effectiveness of the controls in place. Without routine oversight of components’ annual case reviews—which could include a process to select annual case reviews for examination, and guidance on how to perform and document examinations—DSCA increases the risk that components may not complete such reviews consistent with DSCA’s guidance, thereby increasing the likelihood that fees collected may be inaccurate. Additionally, according to DOD, the FMS program is intended to operate on a “no profit, no loss” basis, and inaccuracies in the collection of the FMS transportation fee could lead to over- or under- collecting fees from an FMS purchaser. DSCA officials told us that they have begun to work on an initiative to analyze a sample of annual case reviews on a routine basis. According to DSCA officials, the process will include reviewing and documenting cases based on certain events and is expected to be implemented in April 2020. The successful implementation of this initiative may help DSCA ensure that components’ annual case reviews comply with DSCA guidance. However, until DSCA fully implements this initiative, the risk remains that components may not complete annual case reviews consistent with DSCA’s guidance. DSCA Lacks Oversight of DOD Components’ Delivery Reporting DSCA does not have a process to monitor the timeliness of DOD components’ delivery reporting of shipments of items, which triggers collections into the FMS transportation accounts. According to DOD regulations, components are required to submit delivery reporting in their systems within 30 days of shipment. Although DSCA has financial responsibility over collections into the FMS transportation accounts, DSCA officials told us that they do not monitor components’ compliance with this regulation. Federal internal control standards state that management should design internal control activities to achieve control objectives and respond to risks, ensure the accurate and timely recording of transactions, and evaluate and document the results of ongoing monitoring activities. Further, the FMR incorporates the federal accounting standards into DOD accounting and financial reporting policy. The federal accounting standards state that revenue transactions—such as the FMS transportation fee—should be recorded when services are provided. DSCA officials told us that they rely on DFAS to monitor components’ delivery reporting. During the course of our review, DFAS officials told us that they began providing a report to DSCA and other components that detailed information on each components’ delivery reporting, which was based on a prior FMR requirement. Both DSCA and DFAS officials told us that they are working on an agreement that would formalize DFAS’s reporting, but have not finalized this agreement as of February 2020. However, DFAS officials told us that they have not followed up with components to verify the accuracy of the delivery reporting, and are not required to do so. While DSCA officials told us that DFAS’s reporting may help provide transparency, without a process to oversee that reporting, DSCA’s lack of monitoring of components’ delivery reporting raises the risk that such reporting may not be timely. As timeliness is an element of accuracy, untimely component delivery reporting may result in the inaccurate collection of related transportation fees into the FMS transportation accounts. A documented process to review reporting and monitor the timeliness of components’ delivery reporting—which could include DSCA’s review of DFAS’s reporting to identify and follow up on discrepancies—could help reduce the risk that transportation fees may not be collected into the FMS transportation accounts in a timely manner. Further, such oversight could assist components during other required reviews, such as annual case reviews. DSCA’s Financial Oversight of Expenditures Does Not Provide Reasonable Assurance That Expenditures Are Allowable and Paid from the Correct FMS Transportation Account DSCA has limited financial oversight of expenditures from the FMS transportation accounts. While DSCA established internal guidance related to monthly reviews of expenditures from the accounts, that guidance lacks procedures to review expenditures and is not fully documented. In addition, DSCA has not provided guidance to DFAS on preparing the reports DSCA uses for its monthly review. Also, DFAS’s internal guidance on reviewing and realigning expenditures is inconsistent and lacks key controls and details, such as procedures to provide reasonable assurance that all transportation expenditures are reviewed. As a result, DSCA’s financial oversight of the FMS transportation accounts is insufficient to provide reasonable assurance that expenditures paid from the FMS transportation accounts are allowable and paid from the correct account, which limits DSCA’s ability to help ensure that relevant BPC program expenditures are paid from the related BPC accounts. During the course of our audits of the FMS program, DSCA officials told us that they began developing new internal guidance to address financial oversight of expenditures from the FMS transportation accounts, and expect it to be implemented by May 2020. However, until DSCA finalizes and implements that guidance, the risk remains that DSCA may use the FMS transportation accounts to pay for unallowable costs, or pay transportation costs from the incorrect account. DSCA Established Some Guidance for the Monthly Review of FMS Transportation Expenditures In fiscal year 2016, DSCA established a Managers’ Internal Control Program to oversee the FMS transportation accounts, according to DSCA officials. This internal guidance identified the risk that DSCA may use the FMS transportation accounts to pay for unallowable costs—such as those not related to FMS transportation and that may be a result of misuse—or that DSCA may pay transportation costs from the incorrect account. To address these risks, the guidance identified procedures for DSCA to review expenditures. As shown in figure 3, the procedures state that DSCA will review expenditures from the FMS transportation accounts on a monthly basis to ensure costs are valid and applied to the proper account, and to identify and correct discrepancies. DSCA officials told us that to perform their monthly review they use reports provided by DFAS, and DFAS officials told us they provide those reports to DSCA on a monthly basis based on internal guidance. These reports include information on the FMS transportation account balances, and, in addition, DFAS provides supporting documentation that includes: copies of bills paid from the accounts and detailed analysis of individual transportation expenditures; an analysis of discrepancies DFAS identified for each transaction; and financial transactions DFAS performed to reimburse the main transportation account for specific BPC transportation expenditures, through a process DOD refers to as realignment. Both DSCA and DFAS officials said they use two pieces of information from the reports and analyses: The transportation account code, which identifies the DOD component responsible for a particular expenditure, and may provide information on the country or program associated with the transportation expenditure. The transportation control number, which is a unique 17-character code that is associated with a shipment and used throughout the Defense Transportation System for shipment tracking and payment processing. For FMS shipments, the transportation control number includes information that identifies the DOD component and foreign partner, and may be used to tie a particular transportation expenditure to an FMS case. The transportation account code and the transportation control number are entered by DOD components directly involved in ordering and processing shipments into their individual systems. Figure 4 provides additional details regarding the composition of the transportation control number. DSCA Lacks Sufficient Internal Guidance for the Monthly Review of FMS Transportation Expenditures DSCA’s Internal Guidance Lacks Procedures for Conducting the Monthly Review of Expenditures DSCA’s internal guidance does not contain procedures explaining how DSCA staff should review transportation expenditures. Federal internal control standards state that management should design control activities to respond to risks, implement activities that address those controls, and identify the information requirements needed to achieve objectives. DSCA’s monthly review of expenditures from the FMS transportation accounts is meant to provide financial oversight of the accounts, and DSCA’s internal guidance establishes that, as part of its monthly review, DSCA should review expenditures to ensure they are allowable and paid from the correct account, and follow up on any discrepancies. However, DSCA’s internal guidance does not explain how to review expenditures, and DSCA officials told us that they do not have internal guidance identifying the data needed to oversee expenditures or explaining how they should evaluate expenditure data, which could include steps such as identifying and correcting discrepancies including mismatched, missing, or incomplete entries. To assess transportation expenditure data reviewed by DFAS and DSCA, we analyzed a nongeneralizable sample of expenditure data for the FMS transportation accounts provided by DFAS for the period from May through July 2019. Over that 3-month period, DFAS reported about 6,200 transportation expenditures totaling approximately $21.6 million. Our review of those expenditures identified discrepancies or missing data such as transactions with: Mismatched DOD component codes. Approximately 19 percent of expenditures we examined—representing around $4 million—had transportation account codes and transportation control numbers identifying different DOD components. According to DFAS officials, if the transportation account code and transportation control number for an expenditure do not identify the same component, the mismatch may be a discrepancy. For example, a mismatch could indicate that staff at a component entered an incorrect transportation account code, or misapplied a transportation account code, which may result in the payment of a non-FMS expenditure from the FMS transportation account. Missing or misformatted control numbers. Approximately 3 percent of the number of expenditure transactions in our sample— representing around $40,000—either lacked transportation control numbers or included transportation control numbers that did not contain 17 digits. Without a valid transportation control number, DSCA may not be able to determine whether an expenditure is allowable or paid from the correct account. Because DSCA’s internal guidance lacks procedures—including those explaining what expenditure data is needed to perform oversight and how to evaluate that data for and address discrepancies—DSCA cannot provide reasonable assurance that it appropriately reviews expenditures from the FMS transportation accounts. Without guidance that addresses the risk that unallowable costs may be paid from the transportation account, DSCA raises the risk of misuse of funds of the FMS transportation accounts. Additionally, without guidance that identifies and addresses discrepancies—such as missing transportation control numbers—DSCA raises the risk that transportation expenditures may not be paid from the correct account. DSCA officials told us that they were developing new internal guidance and collaborating with DFAS on an initiative to follow up on discrepancies, and expect both to be implemented by May 2020. However, until DSCA finalizes and implements that guidance, the risk remains that DSCA may use the FMS transportation accounts to pay for unallowable costs, or pay transportation costs from the incorrect account. DSCA’s Internal Guidance Lacks Procedures for Documenting the Monthly Review of Expenditures DSCA’s internal guidance does not identify how DSCA officials should document their monthly review of expenditures. Additionally, DSCA officials confirmed that they do not document their monthly review of expenditures. DSCA officials told us that while DSCA staff conducted regular monthly reviews, DSCA has not issued specific internal guidance explaining how staff should conduct and document these reviews. Federal internal control standards state that management should develop documentation of its internal control system, document internal control activities such as by documenting that activities occurred, and ensure that activities are performed routinely and consistently. Without internal guidance that identifies how staff should perform and document monthly reviews as well as a process to ensure reviews are documented, DSCA cannot provide reasonable assurance that staff perform monthly reviews consistently. DSCA officials told us that their planned internal guidance should address how the monthly review process is conducted, and should be implemented by July 2020. However, until DSCA finalizes and implements that guidance, DSCA will not have guidance on documenting its monthly review of expenditures consistent with federal internal control standards. DSCA Lacks Written Guidance to DFAS on Preparing Monthly Reports DSCA officials have not provided written guidance to DFAS on preparing the reports and analyses DSCA uses for its monthly review, and, as a result, those reports and analyses may be inconsistent and incomplete. Federal internal control standards state that management should design control activities that respond to risks, document internal controls, communicate required information to external parties, and obtain relevant data from external sources based on information requirements. DFAS officials confirmed that they do not have written guidance from DSCA regarding how to generate the reports for DSCA, such as what analyses to perform on expenditure data. We found that DFAS’s analyses vary and lack key procedures. For example, our review of the expenditure data DSCA received from DFAS for May through July 2019 showed that DFAS performed certain analyses—such as verifying the validity of the transportation control number—on some transactions, but not on others. Additionally, DSCA did not provide DFAS with a complete list of transportation account codes to use to identify transactions for review. As a result, DSCA’s review of expenditures based on DFAS’s reports—both for allowability, as well as to ensure those transactions are paid from the correct account—excludes some transactions. Because DSCA has not provided written guidance to DFAS on how to generate the reports needed for its monthly review process—including what analysis to perform on expenditure data—or provided DFAS with the necessary transportation account codes, DSCA cannot provide reasonable assurance that all expenditures from the FMS transportation accounts are allowable and paid from the correct account. Additionally, the lack of consistent identification and review of all transactions by DSCA raises the risk of misuse of funds in the FMS transportation accounts. DSCA officials told us that they are developing guidance in coordination with DFAS, and that it should be implemented by July 2020. However, until DSCA finalizes that guidance to DFAS, DSCA may review inconsistent analyses and may not review all transportation expenditures, and the risk remains that DSCA may use the FMS transportation accounts to pay for unallowable costs, or pay transportation costs from the incorrect account. DFAS’s Internal Guidance on Reviewing Transportation Expenditures Lacks Key Steps DFAS established procedures to review FMS transportation expenditures and to realign BPC expenditures to the correct FMS transportation accounts in part based on direction from DSCA. However, these procedures lack key steps to ensure that DFAS reviews all expenditures and identifies discrepancies, as well as to address discrepancies that may limit DFAS’s ability to identify transactions for realignment. Federal internal control standards state that management should design control activities to respond to risks, implement activities that address those controls, and ensure that activities are performed consistently. DFAS maintains a separate set of procedures for each of the three transportation service providers that submit FMS transportation bills. The results of DFAS’s procedures—such as how transportation expenditures were realigned—are included as supporting documentation for the monthly reports provided to DSCA. Our review of DFAS’s realignment procedures determined that the procedures are inconsistent or missing key steps that could help address the risk that expenditures paid from the FMS transportation accounts may be unallowable or paid from the incorrect account. We found that DFAS’s procedures do not ensure that DFAS reviews all transactions, including those that may require realignment. For example, DFAS’s procedures for DOD’s commercial transportation payment system—known as Syncada—do not include a step for reconciling the amount of the payment to the service provider against a list of detailed expenditure transactions, which may provide assurance that the list of transactions is complete. Specifically, for Syncada, DFAS queries the provider’s system using only nine transportation account codes provided by DSCA, which do not include any account codes associated with Navy, and only some associated with Air Force. Conversely, the realignment procedures for the Air Mobility Command and the Surface Deployment and Distribution Command include a step for reconciling the amount of the payment to the service provider against a list of detailed expenditure transactions, which helps to provide assurance that the list of transactions being reviewed is complete. Table 1 shows the results of our review of DFAS’s realignment procedures and analysis. Because DFAS’s procedures do not include steps to identify all Navy and Air Force transportation account codes, DFAS does not have reasonable assurance that all expenditures are reviewed by DFAS for realignment and provided to DSCA with the monthly report, which DSCA subsequently uses to review the validity of expenditures. As a result, any of these transactions that should be paid from a BPC transportation account are instead paid from the main FMS transportation account. As shown in figure 5, our review of Syncada expenditure data for May through July 2019 found that the use of DFAS’s procedures resulted in approximately 15 percent of expenditures not being reviewed. Those transactions represent 11 percent of the dollar value of transportation expenditures for that period, or approximately $392,000. In addition, we found that DFAS’s procedures do not address how to correct or follow up on discrepancies. Specifically, all three sets of realignment procedures state that analyzing the list of detailed transactions may identify transactions with discrepancies in their data, but none of the procedures fully address the types of discrepancies or their implications, such as if the expenditure does not include a transportation control number. Rather, according to DFAS officials, if DFAS identifies such a discrepancy with a specific expenditure, that cost remains as an expenditure from the main transportation account. Because DFAS’s procedures do not include steps to reconcile the amount of payments to all service providers against a list of detailed cost transactions or to identify all transportation expenditure transactions, DFAS may not review all FMS transportation expenditures and may not pay all expenditures from the correct transportation account. Additionally, because the list of transportation account codes provided to DFAS does not include all FMS account codes, neither DFAS nor DSCA review all expenditures from the FMS transportation accounts, which raises the risk of unallowable or unapproved expenditures. As a result, DSCA’s ability to provide reasonable assurance that all transportation expenditures are allowable and paid from the correct account is limited. DSCA officials told us that they are developing guidance in coordination with DFAS to identify and follow up on discrepancies and clarify how DFAS is to perform its analysis, and that the guidance should be implemented by July 2020. However, until DSCA finalizes that guidance to DFAS, DSCA may review inconsistent analyses and may not review all transportation expenditures, and the risk remains that DSCA may use the FMS transportation accounts to pay for unallowable costs, or pay transportation costs from the incorrect account. Conclusions DSCA has developed financial oversight procedures for overseeing the billions of dollars that are collected into and expended from the FMS transportation accounts, but we found weaknesses in oversight of both collections and expenditures. Regarding collections, gaps in DSCA’s oversight of DOD components’ annual case reviews and delivery reporting increase the risk that transportation fees collected may be inaccurate. Similarly, regarding expenditures, we identified gaps in DSCA’s oversight. Specifically, DSCA has not established procedures for conducting monthly reviews of expenditures and correcting discrepancies, or defined the information it needs from DFAS. Further, DFAS’s procedures to review and realign costs between FMS transportation accounts—which are based on guidance from DSCA—do not ensure that all transactions are included. By improving financial oversight of the FMS transportation accounts, DSCA could better ensure the accuracy of fees collected and help provide reasonable assurance that expenditures are allowable and paid from the correct account. DSCA officials told us that they are developing guidance to address these issues, and plan to implement that guidance in 2020. However, until DSCA finalizes and implements that guidance, the risks remain that DSCA may collect inaccurate transportation fees, use the FMS transportation accounts to pay for unallowable costs, or pay transportation costs from the incorrect account. Recommendations for Executive Action We are making the following five recommendations to DOD: The Secretary of Defense should ensure that the Director of DSCA implements the planned initiative to routinely examine annual case reviews performed by DOD components to help ensure that fees collected into the FMS transportation accounts are accurate. (Recommendation 1) The Secretary of Defense should ensure that the Director of DSCA works with DFAS and DOD components to establish a written process to monitor the timeliness of components’ delivery reporting to help ensure that fees collected into the FMS transportation accounts are accurate. (Recommendation 2) The Secretary of Defense should ensure that the Director of DSCA finalizes and implements internal guidance on how to conduct and document DSCA’s monthly review of expenditures from the FMS transportation accounts, including what information should be reviewed and how to identify and follow up on discrepancies. (Recommendation 3) The Secretary of Defense should ensure that the Director of DSCA works with DFAS to finalize written guidance to DFAS on how to generate the reports needed for DSCA’s monthly review of expenditures from the FMS transportation accounts, including the type of analysis needed. (Recommendation 4) The Secretary of Defense should ensure that the Director of DSCA works with DFAS and other DOD components to finalize the planned guidance to DFAS for the review and realignment of expenditures from the FMS transportation accounts to ensure reviews are consistent and include all expenditures. (Recommendation 5) Agency Comments We provided a draft of this report to DOD and State for review and comment. DSCA provided written comments on behalf of DOD, which are reprinted in appendix II. DSCA concurred with all of our recommendations, and indicated that it had developed plans to address them and had begun implementing some of those plans. DOD noted that annual case reviews and delivery reporting are not directly related to financial transactions tied to the FMS transportation account. However, both annual case reviews and delivery reporting provide an opportunity for oversight that can help verify the accuracy of data, which affects the accuracy of transportation fees collected from FMS purchasers’ accounts into the FMS transportation accounts. We also received technical comments from DOD, which we incorporated in our report as appropriate. State did not provide any written or technical comments. We are sending copies of this report to the appropriate congressional committees, the Secretary of Defense, the Secretary of State, and other interested parties. In addition, this report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-6881 or BairJ@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. Appendix I: Objectives, Scope & Methodology This report examines (1) the Defense Security Cooperation Agency’s (DSCA) oversight of Department of Defense (DOD) components’ activities that affect fees collected into the Foreign Military Sales (FMS) transportation accounts, and (2) DSCA’s financial oversight of expenditures from the FMS transportation accounts. To obtain information on both of our objectives, we reviewed DSCA’s guidance related to the FMS program and FMS transportation, and analyzed fiscal years 2007 to 2018 summary collections and expenditures data for the FMS transportation accounts maintained by the Defense Finance and Accounting Service (DFAS) in the Defense Integrated Financial System. We chose to review data from these fiscal years based on data availability. Under a prior review of the management oversight of FMS transportation fees, we assessed the reliability of these data by reviewing for duplicate entries, gaps, and obvious errors, comparing the data to similar data obtained under prior reviews, and interviewing agency officials to clarify questions about how to interpret the data. On the basis of this assessment, we determined these data to be reliable for the purposes of summarizing the total collections into and expenditures from the FMS transportation accounts during fiscal years 2007 to 2018. To examine DSCA’s oversight of DOD components’ activities that affect fees collected into the FMS transportation accounts, we reviewed DOD’s current guidance related to the FMS transportation fee, as well as other documentation and internal guidance developed by DSCA. We interviewed DSCA and DFAS officials on their implementation of oversight procedures. To determine and assess the controls DSCA should be using to manage and oversee the account, we reviewed DOD’s Financial Management Regulation, DSCA’s Security Assistance Management Manual, other internal DSCA guidance, federal accounting standards, federal internal control standards, and our prior report on DSCA’s management oversight of the FMS transportation account balances. To examine DSCA’s financial oversight of expenditures from the FMS transportation accounts, we reviewed DOD’s current regulations related to financial oversight and transportation, including DOD Financial Management Regulation and DOD Defense Transportation Regulation. Additionally, we reviewed DSCA’s Managers’ Internal Control Program procedures for monthly FMS transportation account reviews, and we interviewed DSCA officials responsible for these reviews. We also reviewed DSCA’s Security Assistance Management Manual, which provides guidance to DOD components related to the FMS program, and DFAS’s internal guidance on reviewing and realigning expenditures from the FMS transportation account. We analyzed a nongeneralizable, 3-month sample of expenditure data for the FMS transportation accounts provided by DFAS for the period from May through July 2019, including transportation service provider bills and detailed transaction-level expenditures. These data included the transportation account codes and transportation control numbers that DSCA and DFAS use to verify that individual expenses are allowable, and to realign transportation expenditures to the correct FMS transportation account. We initially obtained 1 month of transportation expenditure data, but decided to expand our analysis to 3 months of data to account for any variability between months. Additionally, we chose to review data from this period because they were the most current at the time of our request, and therefore the data were compiled using DFAS’s current process. We determined this period to be sufficient for our analysis of the data, which DSCA and DFAS use to provide assurance that expenditures from the FMS transportation accounts are allowable and paid from the correct account. To assess the reliability of these data, we reviewed the data for internal consistency by reviewing for duplicate entries, gaps, and obvious errors; compared them to DOD regulations on transportation account code and transportation control number construction; and interviewed DSCA and DFAS officials about their data collection and verification procedures. We found the data to be sufficiently reliable for our purpose of presenting the total number and dollar amount of transportation expenditures reviewed by DSCA and DFAS for each month, and to identify the number and dollar amount associated with expenditure records where we identified discrepancies. We found instances of blank or incorrectly formatted transportation account codes and transportation control numbers, and instances where the first characters of the transportation account code and transportation control number did not match, which DFAS officials identified as possible discrepancies in the data. As we discuss in the report, these instances raise questions about the reliability of the data for financial oversight, since DSCA and DFAS use this information to ensure that expenditures are allowable and paid from the correct FMS transportation accounts. We did not conduct any independent testing of the data to determine whether the amounts reflected correct payments made toward accurate billings. To review DFAS’s internal guidance for reviewing and realigning expenditures from the FMS transportation account, we reviewed copies of the procedures provided by DFAS for each of the three transportation service providers. We identified major steps in the procedures related to reviewing expenditure data, as well as various internal controls related to analyzing data. We reviewed each of the procedures against one another to determine the extent to which they addressed the same elements, and we compared relevant procedures against standards for internal control related to obtaining, evaluating, and correcting data, to determine whether they were sufficient to provide financial oversight. Additionally, we interviewed DFAS officials responsible for these procedures. In order to determine whether DFAS’s procedures included all expenditures, we requested and obtained information from Army, Navy, and Air Force on the transportation account codes that each component used in fiscal year 2019, and compared them to the account codes provided to DFAS by DSCA and used to query the third-party transportation service provider system for relevant FMS transportation expenses. We identified a list of transportation account codes not queried as part of DFAS’s procedures, and we requested that DFAS query the third-party transportation service provider’s system for the period of May through July 2019 using that list. We requested data from this period to be consistent with the expenditure data DFAS initially provided us for the same period. We reviewed the resulting data and compared it to the previously-provided data in order to determine the relative size of each data set for this period. We did not independently test to determine whether the lists of transportation account codes provided to us were complete, and therefore the data reviewed may not include all relevant transportation expenditures. We conducted this performance audit from May 2019 to May 2020 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix II: Comments from the Department of Defense Appendix III: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments Jason Bair, (202) 512-6881 or BairJ@gao.gov In addition to the contact named above, Cheryl Goodman (Assistant Director), Benjamin L. Sponholtz (Analyst-in-Charge), Adam Peterson, and Heather Rasmussen made key contributions to this report. Martin de Alteriis, John Hussey, Christopher Keblitis, Heather Latta, and Grace Lui also contributed to this report.