Background TSA’s Secure Flight Program TSA began implementing its Secure Flight program in 2009 to identify passengers who may pose security risks before boarding an aircraft. The program requires U.S. and foreign commercial aircraft operators traveling to, from, within or overflying the United States, as well as U.S. commercial aircraft operators with international point-to-point flights, to collect information from passengers and transmit it electronically to TSA. This information includes personally identifiable information, such as full name, gender, date of birth, passport information (if available), and certain non-personally identifiable information, such as itinerary information and the unique number associated with a travel record (record number locator). The Secure Flight program matches the passenger-provided personally identifiable information against federal government watchlists and other information to determine if passengers may pose a security risk and to assign them a risk category. Since January 2009, Secure Flight has matched passengers to two subsets of the Terrorist Screening Database—the No Fly List, composed of individuals who should be precluded from boarding an aircraft or entering the sterile area of a U.S. airport, and the Selectee List, composed of individuals who should receive enhanced screening prior to boarding an aircraft or entering an airport sterile area. The risk categories are not specifically communicated to the air carriers, but for each passenger Secure Flight provides responses to air carriers commensurate with the risk levels identified (e.g., an air carrier will receive a response of “inhibited” if the passenger was identified as being in the highest-risk category, or the boarding pass printed for a high-risk passenger will identify that passenger as a selectee for enhanced screening at the security checkpoint). In April 2011, in response to the December 25, 2009 attempted attack, TSA also began matching passengers to a third subset of the Terrorist Screening Database—the Expanded Selectee List—to designate known or suspected terrorists not otherwise included on the No Fly or Selectee Lists as selectees for enhanced screening. The Expanded Selectee List, in general, includes all records in the Terrorist Screening Database with a full name (first name and surname) and full date of birth not otherwise included on the No Fly or Selectee Lists. The Secure Flight system, which also screens passengers against the Silent Partner and Quiet Skies Lists, among others, results in passengers receiving one of four prescreening outcomes: Low risk (expedited screening). Passengers who are eligible for expedited screening, such as those with TSA Pre®, Unknown Risk (standard screening). Passengers who warrant standard screening, High Risk (enhanced screening). Passengers who receive enhanced screening such as a pat down and explosives trace detection, because they have been identified as matches to government watchlists, including the Selectee, Expanded Selectee, Silent Partner and Quiet Skies Lists, or Highest Risk (denied boarding). Passengers who are not permitted to board a commercial aircraft, such as passengers who are on the No Fly List or the Centers for Disease Control and Prevention Do Not Board List (see fig. 1). Secure Flight also randomly identifies passengers for enhanced screening. Although subject to the same screening measures as high risk passengers, they have not been determined to be high risk. Similarly, individuals included on the Silent Partner and Quiet Skies Lists have not been determined to be of high risk, but rather have been identified using rules based on current intelligence and other factors that may indicate an elevated risk. The Silent Partner List TSA leverages CBP information and targeting capabilities to create the Silent Partner List. Specifically, TSA leverages (1) data CBP collects regarding passengers traveling internationally (such as citizenship, passport country of issuance, and address information), and (2) CBP’s Automated Targeting System. CBP uses the Automated Targeting System to identify potentially high risk passengers arriving or departing the United States by comparing passenger information with law enforcement, intelligence, and other enforcement data using risk-based targeting scenarios and assessments. Analysts within TSA I&A’s Threat Analysis Division review intelligence to identify factors that may indicate elevated passenger risk. TSA works with CBP to create Silent Partner and Quiet Skies rules in the Automated Targeting System based on these factors. The system returns information on passengers who match with the rules and are scheduled to fly on U.S.- bound flights. TSA then omits any individuals on the Silent Partner cleared list (i.e. travelers exempted from further enhanced screening based on a specific rule) before placing the remaining passengers on the Silent Partner List. The Secure Flight program designates passengers who are on the Silent Partner List as selectees for enhanced screening for a particular international flight. The Quiet Skies List In April 2012, TSA’s Quiet Skies List became fully operational. The Quiet Skies List is a subset of passengers on the Silent Partner List. Specifically, TSA identifies certain Silent Partner rules that warrant continued enhanced screening for passengers’ subsequent domestic or outbound travel after arriving in the United States. Passengers identified via these rules—the Quiet Skies rules—comprise the Quiet Skies List. Passengers matched to the Quiet Skies List are designated as selectees and receive enhanced screening on any subsequent domestic flights for a designated period of time, or for a designated number of flights, whichever comes first. After the designated time period has elapsed (or number of flights is flown), passengers’ names and identifying information are moved to a cleared list. TSA Modernization Act Requirements Pursuant to the TSA Modernization Act, TSA I&A is to identify and review its Silent Partner and Quiet Skies screening rules, in coordination with DHS and TSA stakeholders, every 120 days and provide notification to these stakeholders no later than two days after making a change to a rule. Table 1 lists the DHS and TSA stakeholders TSA I&A must coordinate with under the Act. TSA Coordinates with Stakeholders as Required, but TSA Guidance Is Not Clear About Criteria for Review of Rule Changes TSA I&A Coordinates Quarterly Rule Reviews and Notifies Oversight Offices of Rule Changes According to DHS and TSA officials, TSA has coordinated quarterly rule review meetings with DHS and TSA stakeholders since the inception of the Silent Partner and Quiet Skies programs. We reviewed documentation of the reviews that occurred from December 2018 through March 2019. The quarterly review meetings are called for in DHS’s Automated Rule Review SOP and its Quiet Skies Implementation Plan. Pursuant to the TSA Modernization Act, TSA I&A is to identify and review its screening rules in coordination with DHS and TSA stakeholders every 120 days—or at least three times a year. TSA I&A officials stated that they plan to continue convening four times a year because, given the difficulty of scheduling these large meetings, it will help them ensure they meet the 120 day requirement. Since October 2018, TSA I&A has also included representatives of DHS’s Traveler Redress Inquiry Program and the Federal Air Marshal Service in these quarterly review meetings, as required by the Act. Officials from these offices told us in August 2019 that they are still determining their role in the rule review process, but expect the coordination to be beneficial. DHS and TSA SOPs set forth the process for the quarterly review meetings. TSA I&A and stakeholder officials stated that the process generally happens as described in the SOP. Two weeks prior to the meeting, TSA I&A sends out materials including a list of new rules, rule changes, archived (discontinued) rules, and the rationale and links to the underlying intelligence supporting each rule change. According to TSA officials, TSA and DHS stakeholders review the rules from their particular areas of expertise. For example, TSA Chief Counsel officials reported that they review rules and the supporting intelligence to ensure that the rules meet legal sufficiency standards. A TSA Privacy official stated that they review rules and the supporting intelligence to ensure rules do not violate passengers’ rights. All stakeholders review the rules to ensure they are based on current intelligence that identify specific threats. If a stakeholder finds that there is insufficient current intelligence to support the rule, TSA I&A officials stated that they would modify it to ensure it is tailored to current intelligence or archive a rule when the intelligence- based threat is no longer relevant. For example, during the March 2019 quarterly review meeting TSA I&A officials discussed archiving a Silent Partner rule due to insufficient current intelligence to support it. According to TSA I&A officials, the rule was archived in April 2019. TSA I&A officials and stakeholders generally agreed that the quarterly reviews provide a good mechanism for oversight of both programs. Stakeholders told us these meetings provide a forum to discuss the scope of the rules and whether or not they were supported by current intelligence or if they are sufficiently specific. For example, a TSA stakeholder questioned the basis for a rule that identified a particular travel pattern as a high risk factor. As a result, TSA I&A officials reviewed the intelligence and revised the rule. TSA I&A officials stated that since enactment of the TSA Modernization Act in October 2018, they have also notified DHS and TSA stakeholders within two days of making changes to a rule. We reviewed the eight notifications that TSA I&A sent to stakeholders regarding rule changes during the period from October 2018 through May 2019. These notifications detailed changes to rules, new rules, and rules that were archived. DHS and TSA stakeholders we spoke with said that the two day notifications are helpful in keeping them informed in between quarterly meetings. In addition, stakeholders said it allowed them to proactively reach out to TSA I&A to ask questions and share more timely feedback about rule changes. TSA I&A has implemented the two day notifications and other steps required in the TSA Modernization Act, but TSA I&A’s Standard Operating Procedures have not yet been updated to reflect these changes. TSA I&A officials stated that they have plans to do so in fall 2019. TSA Has a Standard and Expedited Rule Review Process, but TSA Guidance Is Unclear about Criteria for Each Process TSA I&A’s standard operating procedures establish two situation- dependent processes for reviewing and approving rule changes, as shown in figure 2. First, under standard circumstances, TSA I&A’s standard operating procedures detail a four-part vetting process by which TSA I&A drafts support for the rule change and it is subsequently approved by TSA Chief Counsel, the TSA I&A Assistant Administrator, and ultimately TSA senior leadership. TSA procedures specify that in standard circumstances, all rule changes are to be supported and approved in writing prior to implementation. Specifically, TSA I&A is to draft a memo with the nature of the threat and how all components of the rule address the concerns from intelligence reporting. The memo, along with all pertinent intelligence sources, is then required to be routed through TSA Chief Counsel and TSA leadership for intelligence, legal, and policy review. TSA’s April 2012 Quiet Skies Implementation Plan specified that the Chief Counsel’s review is to ensure that the proposed rule targets the threat presented in the assessment, the assessment properly documents the reasons for the recommendation, and the recommendation is in compliance with relevant legal authorities, regulations, and DHS policies. Upon approval, the memo is referred to TSA senior leadership—the TSA Administrator or TSA Deputy Administrator—for final written approval. Following this, the rule change can be implemented. A second process, called exigent, is also briefly described in the SOPs. In exigent circumstances—circumstances requiring immediate action—the TSA I&A Assistant Administrator or his or her designee may direct that the rule be implemented immediately without a signed decision memo. The signed memo is still required, but can be drafted, reviewed, and approved after the change is implemented. TSA I&A officials stated that the exigent process entails verbal direction to implement a rule. It is unclear if TSA I&A has followed the exigent rule review process in standard circumstances because the SOP is unclear on the criteria for each process. TSA’s SOP states that the exigent review process may be used “if TSA determines that exigent circumstances require immediate implementation of a Silent Partner rule.” However, the SOP does not clarify who or which office within TSA makes this determination or what types of circumstances would be appropriately characterized as exigent. TSA I&A officials told us that exigent circumstances were very rare. They estimated that in the last 3 years exigent circumstances had occurred once. Yet, the same officials also estimated that they implemented approximately 90 percent of the rule changes following verbal approval from either TSA or I&A leadership and drafted the required memos after the fact. This indicates that TSA I&A officials have not followed the standard review process when implementing rule changes in circumstances they regard as standard, and the process followed appears to be closer to what would occur in exigent circumstances. These TSA I&A officials explained that drafting and processing the approval memo after they implement a rule change allows them to more quickly respond to changing intelligence. TSA’s SOP provides flexibility for this in exigent circumstances. However, given the absence of clarity in the SOP about when the exigent process is to be used and who is to make that decision, it is unclear whether or not TSA I&A used the exigent review process—a process which is not, initially, contingent upon TSA’s legal review or I&A’s written support—in circumstances that DHS and TSA leadership who oversee the program would regard as standard. According to Standards for Internal Control in the Federal Government, management should implement control activities through policies by, for example, documenting responsibilities in policies and periodically reviewing policies and procedures for continued relevance and effectiveness. As TSA I&A updates its Silent Partner and Quiet Skies SOPs in fall 2019, clarifying the criteria for standard and exigent rule review procedures would provide greater assurance that screening rule changes are reviewed as intended. TSA I&A officials further told us that they do not document or otherwise have a way of determining what proportion of rule changes have been reviewed in accordance with the standard process versus the exigent process because they had not identified a need to do so. According to the 2012 TSA memo establishing Quiet Skies as a permanent program, at the program’s outset a working group of DHS and TSA stakeholders identified the need for transparency as the first of seven key areas of consensus. Further, DHS’s Integrated Risk Management Framework establishes transparency and documentation as important characteristics of homeland security risk management. Documenting which review process TSA I&A uses for each rule change could improve transparency. TSA Tracks Some Data on Rule Implementation, but Has Not Comprehensively Assessed Effectiveness TSA Has Monitored List Size and Number of Rule Matches, but Has Not Identified a Means to Comprehensively Measure Rule Effectiveness TSA I&A monitors some operational data on its passenger screening rules. For example, TSA I&A officials track the number of individuals on the Silent Partner and Quiet Skies Lists, and the number of Silent Partner and Quiet Skies rules triggered by the passengers’ travel. TSA I&A officials stated that rule matches and list size are helpful for oversight purposes because they allow TSA I&A to monitor for Secure Flight system errors. Officials identified one example in which a Secure Flight software update created a system error that prevented 808 passengers from being moved to the Quiet Skies cleared list after a designated number of flights. According to the officials, monitoring list size and the number of rules triggered by passengers’ travel allowed them to identify and correct this error within 10 days of identifying the system error. TSA I&A has not identified a means to comprehensively measure rule effectiveness. TSA I&A officials explained that they would find it helpful to demonstrate the effectiveness of the program, but had not yet done so because it was difficult to measure. TSA I&A officials reported that the approach they have used was to count the number of Quiet Skies passengers who were later identified as a known or suspected terrorist and added to the Terrorist Screening Database. TSA I&A officials reported that in January 2019 they reviewed all Quiet Skies passengers from January 2014 through July 2018 to determine how many were subsequently added to the Terrorist Screening Database. However, because it included Quiet Skies only, this analysis excluded about 93 percent of the rules. TSA officials reported that it is not feasible to do a similar analysis for Silent Partner rules because of the higher numbers of rules and matches and the difficulty matching Silent Partner rules to data in the Terrorist Screening Database. Further, TSA officials noted that without comparable information on the rate that non-Quiet Skies passengers were added to the Terrorist Screening Database during that time period, it is difficult to interpret what the results indicate about rule effectiveness. TSA’s April 2012 Quiet Skies Implementation Plan established that TSA would continually evaluate the performance of the rules in the Silent Partner and Quiet Skies programs. Further, GAO and the Office of Management and Budget have previously identified useful practices to enhance performance management and measurement processes. GAO has previously reported that measuring performance allows organizations to track the progress they are making toward their goals and gives managers critical information on which to base decisions for improving their progress. Office of Management and Budget guidance has also focused specifically on common challenges associated with measuring effectiveness, including data availability and identifying measurable outcomes for a program. This guidance suggests using a variety of approaches such as outlining short-term milestones, identifying target outcomes, and using proxy measures to assess these programs. Assessing the effectiveness of Silent Partner and Quiet Skies rules may be difficult, but I&A could explore using other data sources to assess program effectiveness in addition to further developing their consideration of Terrorist Screening Database additions. For example, TSA I&A could consider analyzing TSA data on the outcomes of the enhanced screening of Silent Partner and Quiet Skies passengers at passenger security checkpoints. CBP officials said that they review secondary inspection results to help them assess CBP’s rules-based program. TSA I&A officials noted that they were considering this measure and would need to determine what comparison group would make sense, and if they want to focus on specific screening outcomes versus all outcomes. TSA I&A could also consider using the results of air marshals’ monitoring of Quiet Skies passengers. According to senior Federal Air Marshal Service officials, the service—with a budget of approximately $780 million for fiscal year 2019—began deploying air marshals on as many flights as possible with Quiet Skies passengers in March 2018. According to TSA’s Privacy Impact Assessment for Silent Partner and Quiet Skies and a Federal Air Marshal Service official, after air marshals complete a flight with a Quiet Skies List match, they file a report saying either “nothing to report” or, if they observe that the individual was involved in a security incident or suspicious activity, they will describe this in an after-action report. TSA I&A officials told us that while they have seen individual after-action reports, they do not review them regularly. These after-action reports are another source of information TSA I&A could consider using to gauge program effectiveness. Given the TSA resources being devoted to the enhanced screening and in-flight monitoring of many passengers matching the Silent Partner and Quiet Skies Lists, and the burden on the traveling public, it is important that TSA understand the value of its screening rules programs. Exploring additional data sources—such as checkpoint screening results and Federal Air Marshal Service after-action reports—could help TSA refine and supplement their existing efforts to measure program effectiveness. Conclusions The attempted attack of December 25, 2009, highlighted the unknown threats to U.S. civil aviation. TSA has created the Silent Partner and Quiet Skies Lists to help address these unknown threats by ensuring that certain potentially higher risk passengers receive enhanced screening when traveling to, from, or within the United States. TSA created an oversight process that was further bolstered by the TSA Modernization Act, and DHS and TSA officials we met with generally regard the process as effective. However, TSA SOPs are not clear about when it is appropriate for TSA to use an expedited review process and they do not document which review process they used. The lack of clear SOPs inhibits program oversight. By establishing clear criteria for and documentation of each review process, TSA could increase transparency and ensure rule changes are reviewed as intended. Moreover, TSA has not identified a means to comprehensively measure the effectiveness of its Silent Partner and Quiet Skies rules. Exploring additional data sources—such as checkpoint screening results and Federal Air Marshal Service after-action reports—could help TSA refine and supplement their existing efforts to measure program effectiveness. Recommendations for Executive Action We are making the following three recommendations to TSA: The Administrator of TSA should clarify the criteria for exigent circumstances and standard rule review procedures; (Recommendation 1) The Administrator of TSA should document which rule review process TSA I&A uses (exigent or standard) for each new rule or rule change; (Recommendation 2) The Administrator of TSA should explore additional data sources measuring the effectiveness of Silent Partner and Quiet Skies rules. (Recommendation 3) Agency Comments We provided a draft of our report to DHS for comment. In written comments, which are included in appendix I, DHS concurred with our three recommendations and described steps they plan to take to address them. DHS also provided technical comments, which we have incorporated, as appropriate. We are sending copies of this report to the appropriate congressional committees and to the Acting Secretary of Homeland Security. In addition, this report is available at no charge on the GAO website at http://gao.gov. If you or your staff have any questions concerning this report, please contact me at (202) 512-8777 or russellw@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made significant contributions to this report are listed in Appendix II. Appendix I: Comments from the Department of Homeland Security Appendix II: GAO Contacts and Staff Acknowledgments Appendix II: GAO Contacts and Staff Acknowledgments Error! No text of specified style in document. GAO Contact William Russell, (202) 512-8777 or russellw@gao.gov. Staff Acknowledgments In addition to the contact named above Claudia Becker, Assistant Director; Imoni Hampton, Analyst-in-Charge; Melissa Greenaway, John De Ferrari, Michele Fejfar, Eric Hauswirth, Tom Lombardi, and Kevin Reeves made key contributions to this work.


Background TSOs and Agency Roles for Their Training TSA is the primary federal agency responsible for implementing and overseeing the security of the nation’s civil aviation system and, in general, is responsible for ensuring that all passengers and belongings transported by passenger aircraft to, from, within, or overflying the United States are adequately screened. Over 43,000 TSOs stationed across the nation’s approximately 440 commercial airports are responsible for inspecting individuals and belongings to deter and prevent passengers from bringing prohibited items on board an aircraft or into the airport sterile area. Within TSA, two offices—T&D and Security Operations—are to work together to manage TSOs and ensure their training is current and relevant. T&D is responsible for developing initial and ongoing training curricula for TSOs based in part on TSA’s standard operating procedures that govern how TSOs screen passengers and baggage. Security Operations is responsible for allocating TSO staff to airports, and scheduling TSO work hours and training availability. Within Security Operations, FSDs are responsible for overseeing security operations at the nation’s commercial airports, many overseeing multiple airports within a specific geographic area. FSDs report to one of three executive directors, who in turn are responsible for annually assessing FSD performance, including oversight of TSO training. TSO Training Requirements TSA’s screener training is comprised of a compendium of courses that includes basic training for initial hires, recurrent training, remedial training, and return-to-duty training. The National Training Plan specifies annual training requirements and contains the core curriculum for TSOs, including the classes and hours required for TSOs to complete. In accordance with the Aviation and Transportation Security Act, screeners must complete a minimum of 40 hours of classroom instruction and 60 hours of on-the-job training, and must successfully complete an on-the- job training examination. Until 2016, new TSOs completed these training requirements at or near their home airports through the New Hire Training Program. In January 2016, TSA centralized this training under the TSO Basic Training Program at the TSA Academy in Glynco, Georgia. Further, in August 2018, TSA launched the first phases of TSO Career Progression, in which new hire screeners receive local training and gain experience in a limited number of screening functions before advancing to the next stage of training at the TSA Academy, roughly around the four-month mark. In 2015, in response to the DHS Office of Inspector General covert test findings that highlighted areas of concern in the passenger screening process, TSA implemented a TSO re-training effort, beginning with a nationwide training called “Mission Essentials—Threat Mitigation.” According to TSA, this training provided the opportunity for the TSO workforce to become familiar with the threat information that underlies TSA’s use of checkpoint technologies and operational procedures to mitigate risks. Federal Training Evaluation Requirements and Training Evaluation Models In 2009, OPM developed and published regulations that require agencies to evaluate training programs annually. According to the regulations, these training evaluations are to help agencies determine how well such plans and programs contribute to mission accomplishment and meet organizational performance goals. One commonly accepted training evaluation model, endorsed by OPM and commonly used in the federal government to evaluate training, is known as the Kirkpatrick model. The Kirkpatrick model consists of a four-level approach for soliciting feedback from training course participants and evaluating the impact the training had on individual development, among other things. The following describes what each level within the Kirkpatrick model is to accomplish: Level 1: The first level measures the training participants’ reaction to, and satisfaction with, the training program. A level 1 evaluation could take the form of a course survey that a participant fills out immediately after completing the training. Level 2: The second level measures the extent to which learning has occurred because of the training effort. A level 2 evaluation could take the form of a written exam that a participant takes during the course. Level 3: The third level measures how training affects changes in behavior on the job. Such an evaluation could take the form of a survey sent to participants several months after they have completed the training to follow up on the impact of the training on the job. Level 4: The fourth level measures the impact of the training program on the agency’s mission or organizational results. Such an evaluation could take the form of comparing operational data before, and after, a training modification. TSA Revised Screener Training to Address Risks Identified through Covert Tests and Emerging Threats Since 2015, TSA’s T&D has developed and updated TSO training programs in response to findings from covert tests and reporting on emerging threats that identified risks to aviation security. T&D uses an online database to track results from covert tests and reporting on emerging threats, and any changes to training that T&D makes as a result. According to T&D data from May 2015 through June 2019, T&D officials reviewed 62 risks that warranted a review for a potential change to training, and 56 of the risks led officials to make training changes across its TSO curriculum. Overall, T&D made changes affecting 40 different training courses. Based on our review of TSO training curriculum from May 2015 through June 2019, we found that changes T&D made to its TSO training took many forms. In some cases, T&D changed training to place additional emphasis on a certain aspect of a current standard operating procedure or provide context on the importance of following it. For example, in 2019, T&D updated its instructor-led course—”Mission Essentials: Resolution Tools and Procedures”—to address covert tests where TSOs failed to detect simulated explosive devices hidden in bags or concealed on individuals at checkpoints. The training included a review of methods terrorists may use to plan and carry out attacks in order to emphasize the importance of following the standard operating procedure. The updated training also included leading practices for searching belongings and a discussion of issues that may affect a TSO’s ability to detect threat items hidden in belongings or on individuals. In fiscal year 2019, T&D also updated instructor-led courses on its explosives detection system for checked baggage to respond to covert test findings that TSOs failed to detect certain simulated explosive devices. The updated training included images of simulated explosives hidden in checked bags that replicated scenarios similar to the failed covert tests. In other cases, T&D developed TSO training in response to new or updated standard operating procedures for using technologies. T&D officials said that for this type of TSO training, they wait until TSA’s Requirements, Capabilities, and Analysis office updates or establishes new standard operating procedures for using new technologies and then develops training based on the revisions. For example, T&D developed TSO training to cover the differences between a prior and updated version of the standard operating procedure for screening passengers and belongings at security checkpoints. T&D included curriculum to cover the major changes in the standard operating procedure and incorporated additional training to address a covert test in which TSOs failed to detect a simulated explosive device at a screening checkpoint. T&D also developed training for TSOs who check passenger IDs and travel documents. The training focused on updates to the standard operating procedure and included procedures specific to the 2005 REAL ID Act, which TSA will fully implement in 2020. Additionally, T&D incorporated this new training to address covert tests that had found issues with identifying false or fraudulent travel documents. In addition to updating or developing new training involving instructor-led courses, TSA responded to identified risks by developing or updating job aids or briefings for TSOs. For example, TSA developed the “It’s Not the Container” briefing in 2017 to address risks highlighted by an attempted attack in Australia and included tactics used to conceal explosives in benign items. The briefing provided best practices for using screening technologies to identify concealed explosives, which aligns with current standard operating procedures. T&D also developed the “Electronics vs. Electrical Devices Job Aid”—covering how TSOs should handle the devices at checkpoints—which instructors circulated during classroom training and provided to TSOs at the screening checkpoints. TSA Uses Established Models for Updating and Evaluating TSO Training and Has Followed Leading Practices TSA uses established models and processes for updating and evaluating TSO training, and these processes follow leading practices for training and evaluation development. TSA updates its trainings using a training development process that can be segmented into five broad, interrelated elements, and is typically referred to as the ADDIE model. The elements include (1) analysis, (2) design, (3) development, (4) implementation, and (5) evaluation. In our prior work, we have found that these five elements of the ADDIE model help to produce a strategic approach to federal agencies’ training and development efforts. See figure 1 for how T&D aligns its training development process with the ADDIE model. T&D’s guidance and our prior work on federal agency training development identify various leading practice attributes for developing training. Such attributes include that the training development process: (1) is formal and based on industry recognized standards; (2) provides the ability to update training based on changing conditions and, if necessary, quickly; (3) includes mechanisms to ensure programs provide training that addresses identified needs; (4) ensures measures of effectiveness are included in training program; (5) prevents duplication of effort and allows for consistent message; (6) allows for stakeholder feedback; (7) provides for continuous evaluation of effort; and (8) includes mechanisms to ensure training programs are evaluated. We found that T&D’s training development process incorporates all of the identified leading practice attributes, as shown in table 1. Two examples of TSA’s implementation of selected leading practice attributes are that T&D (1) has methods for updating training quickly, if needed, and (2) has mechanisms to ensure TSO training is evaluated. Specifically: Methods to quickly update training. In alignment with the leading practice that agencies should have a process to enable quick updates to training to respond to changing conditions, T&D has alternative processes to develop and deliver training to TSOs faster than the approximately 6 months its standard process takes to develop or revise training. For example, in 2018, T&D formalized a set of alternative processes to rapidly develop and deliver training to TSOs. One such alternative is for T&D to use its Rapid Response process, which allows for a response time to the field of 72 hours. Additional options include the Rapid Update/Revision or Rapid Development (Priority Training) processes to allow for a new training to be issued in approximately 30 days. T&D officials said that the rapid development processes are used when an issue, such as an emerging threat, requires a response in days or weeks. T&D’s guidance outlines situations when these processes are appropriate for use and provides checklists to help T&D personnel follow key steps. Mechanisms to help ensure evaluations of training effectiveness. T&D has mechanisms for ensuring it evaluates the effectiveness of its TSO training programs. In particular, T&D uses the Kirkpatrick model to evaluate its training and, according to its policy, all of its courses are to be evaluated at Level 1 of the model, which measures training participants’ reaction to, and satisfaction with, the training. T&D is also to plan course evaluations for each training during the curriculum development process, determine the formal review cycle, and include it in the curriculum development paperwork. According to its policy, T&D must complete a curriculum review at least once every 5 years, but may do so at shorter intervals. During the curriculum review, T&D examines the training to confirm the content is valid with respect to the applicable listing of tasks and competencies, current law, policy, procedures, and equipment. As a part of this process, T&D assesses participant evaluations to determine whether changes to TSO training are needed. As of October 2019, T&D’s efforts to evaluate new or updated TSO training made from May 2015 through June 2019 are in line with its policy. For example, T&D officials said they updated participant evaluations for TSO training they changed during this time period to address risks identified by covert testing and reports on emerging threats. These officials told us that they had not yet formally analyzed the results of the evaluations. This progress is in line with T&D policy, which requires a review of each training every 5 years. We verified this by obtaining evaluations T&D collected for the six selected sample courses we reviewed. T&D provided us level 1 survey responses it had collected that measure training participants’ reaction to, and satisfaction with, the training programs for four of the courses. T&D implemented the four courses from calendar years 2015 to 2019. Based on those dates and T&D policy, T&D should complete curriculum reviews for the courses between 2020 and 2024. TSA Monitors Training Compliance, but Its Process Does Not Look for Trends across Fiscal Years and Is Not Fully Documented TSA relies on a database that both field and headquarters staff use to monitor TSO training compliance. According to TSA policy, TSA documents and maintains the training status of all TSOs across approximately 440 commercial airports through its Online Learning Center database. Within the database, TSA records training completion in three ways: 1. TSOs self-certify they completed the training activity, such as reading 2. A training staff member at a commercial airport will record training completion on behalf of a TSO for instructor-led courses and on-the- job training; 3. The database automatically records completion for training actions, such as online training. After recording training completion, the database calculates the percentage of TSOs at a given airport who are on pace for completing their required annual training. According to TSA guidance, the agency has set its annual TSO target compliance rate at 90 percent per commercial airport. While TSA has guidance outlining roles and responsibilities for training oversight at a high level, TSA headquarters and field officials told us their processes for monitoring training compliance—including analyzing training compliance data, reporting their results, and taking action to address the results—were not documented. Below are descriptions of these roles and responsibilities at the field and headquarters levels, based on what officials from each level told us. TSA personnel in the field have various responsibilities for overseeing training compliance: FSDs. FSDs, who oversee operations at one or more airports, have the primary responsibility for ensuring that TSOs within the airports they oversee have fulfilled their training requirements. FSDs are assessed on training compliance among TSOs at their respective airports during their annual performance reviews. All seven FSDs we interviewed said they use the Online Learning Center database to verify that TSOs are on track for meeting their training requirements. Further, these FSDs said they meet regularly with their on-site training staff to discuss how training is going and whether TSOs are at risk of not meeting their training requirements. Executive Directors. Executive Directors oversee the FSDs who work within their respective portfolios and discuss training compliance with the FSDs during their annual performance review. To monitor FSDs’ efforts, Executive Directors also review data from TSA’s Online Learning Center database on TSO training compliance for airports within their area of responsibility. According to an Executive Director we spoke with, if an Executive Director notices that TSO training compliance rates for an airport whose FSD they oversee are lower than the 90 percent compliance target, he or she may reach out to the FSD to obtain information on the causes and discuss an action plan to improve training compliance. TSA personnel at headquarters also have various responsibilities for overseeing training compliance: T&D. T&D officials said that on a monthly basis they analyze TSO training compliance data from TSA’s Online Learning Center database to identify how TSOs nationwide are meeting requirements and whether there may be trends that indicate a need for changes to training during the fiscal year. For example, officials told us that in fiscal year 2019 they noticed that airports were generally behind in meeting annual training requirements and determined this was due to the effects of the federal government shutdown. In response, they stated they adjusted the duration of some training courses to shorten the amount of time it would take TSOs to complete the training within the remainder of the fiscal year. Security Operations. Security Operations tracks individual airport progress toward meeting TSA’s annual 90 percent compliance target. Security Operations officials said they receive and review monthly training compliance reports from T&D. They are responsible for analyzing the data to monitor whether airports are on pace toward meeting the annual TSO training compliance target. For example, TSA has set the required training completion pace goal at 8.3 percent per month for each commercial airport—-so that by maintaining the pace, by the end of the fiscal year, TSOs at each airport will have completed their required annual training. Officials told us that if they identify instances where an airport’s overall TSO training compliance rate for a given month is below this goal during the course of a fiscal year, they will reach out to the FSD responsible. They will provide the FSD a point of contact at a comparable airport with higher compliance rates to share best practices for addressing the issue. While TSA headquarters officials from Security Operations and T&D are responsible for analyzing and addressing TSO training compliance, they focus on monthly airport progress toward the 90 percent TSO training target, rather than annual changes in compliance rates. In particular, they do not look back at prior year airport compliance data to assess whether airports did not meet the compliance target across fiscal years, and whether they require corrective action at the headquarters level. However, we reviewed annual TSO training compliance data across fiscal years for each of the 435 commercial airports that reported data from fiscal years 2016 through 2018. We found that while all airports met TSA’s 90 percent training compliance target in fiscal years 2016 and 2017, the compliance rates for five airports dropped well below 90 percent in 2018. These five airports’ TSO compliance rates dropped 15 to 26 percentage points from their reported compliance rate in 2017. T&D and Security Operations headquarters officials said they were not aware that five airports had not met TSA’s TSO training compliance target in fiscal year 2018, nor the causes for it. Headquarters officials said that they did not identify this development because their focus is on monthly nationwide trends, rather than instances of noncompliance at individual airports across fiscal years, which field officials would be responsible for addressing. However, unlike headquarters officials, field officials do not have the visibility to identify if or when such noncompliance may be occurring across other commercial airports; and whether it may indicate a broader issue. For example, the five airports whose TSO compliance rates dropped significantly between fiscal years 2017 and 2018 varied by size and location. As a result, FSDs and Executive Directors would generally not have been aware that other airports experienced noncompliance or been in a position to determine whether the noncompliance was due to related reasons. Based on TSA’s process, TSA headquarters officials from T&D and Security Operations are best positioned to identify training compliance trends and their causes when they occur, as they have visibility into training compliance data across the agency in a way that field officials do not. Headquarters officials from T&D and Security Operations told us the field- level processes for overseeing training compliance are not documented because TSA has intentionally given field officials the flexibility to manage TSO workload and training to meet the individual needs of their airports. They said they did not document their processes at the headquarters level because they already understood what to do and were not required to document the analysis results. However, the headquarters officials said there may be a benefit to documenting the headquarters process to ensure consistency in how they carry out the process in the event of attrition. Standards for Internal Control in the Federal Government calls for agencies to develop and maintain documentation of their internal control system. This documentation allows management to retain organizational knowledge and communicate that knowledge to external parties. This documentation of controls is also evidence that controls are identified, can be communicated to those responsible for their performance, and can be monitored and evaluated by the entity. Moreover, internal control standards state that internal control monitoring should generally be designed to ensure that ongoing monitoring occurs in the course of normal operations to ensure that known weaknesses are resolved. By documenting its headquarters process for monitoring TSO training compliance—including its process for analyzing monthly training compliance data, the results of its analyses, and actions taken in response—TSA could better ensure its headquarters staff are aware of their responsibilities for overseeing TSO training compliance and consistently carry these responsibilities out as staff change over time. Additionally, by monitoring for instances of TSO noncompliance at individual airports across fiscal years in its analysis of training compliance data, TSA headquarters would be better positioned to determine whether they constitute a trend warranting corrective action at the headquarters level. Conclusions TSOs’ ability to perform their duties effectively in screening passengers and their belongings is crucial to the security of the nation’s aviation system. While TSA has made updates to its TSO training programs to address risks identified in covert testing, additional actions could improve its processes for monitoring TSO training compliance so that the agency can identify and address any potential training issues. In particular, by documenting its process for monitoring TSO training compliance— including those for analyzing monthly training compliance data, reporting the results of its monitoring efforts, and taking action to address potential issues—TSA could help ensure that all of the various officials responsible for monitoring training compliance, including new staff over time, understand the process and can consistently implement it. Further, by monitoring for instances of airport TSO non-compliance across fiscal years in its analysis of training compliance data, TSA would be better positioned to ensure that it is aware of potential trends so it may determine whether corrective action at the headquarters level is warranted. Recommendations for Executive Action We are making the following two recommendations to TSA: The TSA Administrator should direct T&D and Security Operations to document their processes for monitoring TSO training compliance— including those for analyzing training compliance data, reporting the results from their analysis, and actions taken to address the results. (Recommendation 1) The TSA Administrator should direct T&D and Security Operations to monitor for instances of TSO non-compliance by individual commercial airports across fiscal years that could potentially warrant corrective action at the headquarters level. (Recommendation 2) Agency Comments We provided a draft of our report to DHS for review and comment. In its comments, reproduced in appendix I, DHS concurred with both of our recommendations. DHS also provided technical comments, which we incorporated as appropriate. With respect to our first recommendation that TSA document its process for monitoring TSO training compliance, DHS stated that, among other things, Security Operations will collaborate with T&D to develop and maintain an internal control mechanism that will document responsibilities at the field and headquarters level for monitoring TSO training completion compliance, and actions taken to address the results. With respect to our second recommendation that TSA monitor for instances of TSO noncompliance by individual commercial airports across fiscal years, DHS stated that T&D and Security Operations will begin monitoring trends in non-compliance at individual airports and for specific courses. Further, T&D has developed an internal website to share its findings with Security Operations through monthly compliance reports. We are sending this report to the appropriate congressional committees and to the acting Secretary of Homeland Security. In addition, this report is available at no charge on the GAO website at http://gao.gov. If you or your staff members have any questions about this report, please contact me at (202) 512-8777 or russellw@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix II. Appendix I: Comments from the Department of Homeland Security Appendix II: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Jason Berman (Assistant Director), Julia Vieweg (Analyst-in-Charge), Benjamin Crossley, Elizabeth Dretsch, Michael Dworman, Eric Hauswirth, Susan Hsu, Tom Lombardi, and Heidi Nielson made key contributions to this report.


Background Table 1 describes the activities that USDA’s mission areas and major staff offices perform as part of five types of administrative services that USDA business centers are to provide under the Secretary of Agriculture’s November 2017 memorandum. At USDA, eight mission areas and three of the 13 major department-level staff offices, including five sub-offices, are responsible for delivering or overseeing these five types of administrative services (see fig. 1). USDA’s eight mission areas carry out the department’s program responsibilities through 18 agencies. Five mission areas consist of multiple agencies, while three consist of a single agency, as shown below. In general, USDA’s eight mission areas deliver the administrative services, and the staff offices develop regulations, guidance, and policies describing how mission areas should deliver those services and oversee the mission areas’ performance. In addition, the staff offices deliver some administrative services on a department-wide or shared-services basis. According to USDA officials, the mission areas are to follow the regulations, guidance, and policies developed by the staff offices but are allowed considerable discretion in how they deliver administrative services based on their missions and program needs. According to USDA officials and documentation, service delivery is typically handled by a mission area’s field offices at the regional, state, or local level; however, with the establishment of the business centers, more service is being delivered at the mission area’s headquarters level. USDA Has Established Business Centers in All of Its Eight Mission Areas, and the Business Centers Vary in Establishment Date, Structure, and Services USDA has consolidated administrative services and established business centers in all of its eight mission areas in accordance with the Secretary’s November 2017 memorandum. The eight existing business centers vary in when they were established. As shown in figure 2, three mission areas had business centers before the Secretary’s memorandum. However, even the mission areas that had business centers before the Secretary’s November 2017 memorandum subsequently changed the way they provide administrative services, specifically with regard to information technology services. Two mission areas—Marketing and Regulatory Programs and Research, Education, and Economics—added information technology to their business centers during fiscal year 2019. In 2019, the Natural Resources and Environment mission area, which already included information technology in its business center, changed the position descriptions of certain employees to more accurately reflect that their major duties are considered to be information technology work. Of the five new business centers established since the Secretary’s memorandum, establishment of the FPAC Business Center entailed the most significant transformation. Typically, each business center is located within one of the mission area’s component agencies and the center’s leader reports directly to that agency’s leadership (see table 2). The FPAC Business Center is the only business center established as a separate agency within a mission area. Changes that occurred at other mission areas in transitioning to new business centers included modifying reporting structures for services that had already been consolidated. For example, according to Rural Development officials, the mission area had a business services entity prior to the Secretary’s memorandum. To establish a business center as envisioned by the Secretary’s memorandum, the mission area changed the reporting structure for administrative operations in the field. Previously, field employees associated with an administrative service reported directly to leadership in Rural Development’s state offices. These employees now report directly to headquarters leadership specific to their administrative service. However, according to Rural Development officials, no employees were physically moved. As of November 2019, most of the business centers were providing all five of the main administrative services that the Secretary’s November 2017 memorandum envisioned—specifically, financial management, human resources, information technology, procurement, and property management. Two business centers have chosen to provide financial management services differently from the other administrative services. Specifically: Food Safety. According to officials in the Food Safety mission area, as part of its reorganization, that mission area grouped all of the administrative services except financial management under the Chief Operating Officer. However, it grouped the budget office, which performs financial management services, under the agency’s Chief Financial Officer because it preferred to keep this office with mission- related program offices, which report directly to the Deputy Administrator. Natural Resources and Environment. Officials in the Natural Resources and Environment mission area said that unlike other administrative services, which are grouped under the business center, financial management responsibilities are divided between the business center’s Office of Strategic Planning, Budget, and Accountability and the Forest Service’s Office of the Chief Financial Officer. According to these officials, this arrangement strengthens internal controls by separating responsibility for allocating and spending financial resources from responsibility for accounting for how the resources are spent. One business center—in the Trade and Foreign Agricultural Affairs mission area—provides information technology and financial management services for Foreign Agricultural Service employees and has agreements in place with other USDA components to provide human resources, procurement, and property management services for the mission area. According to the Deputy Assistant Secretary for Administration, USDA accepted these mission areas’ decisions about financial management because they ensured accountability of field-level staff to the administrative service’s headquarters leadership. USDA Has Developed Metrics for Managing Administrative Services but Has Not Assessed the Effectiveness and Impact of Its Business Centers According to USDA’s Deputy Assistant Secretary for Administration, the department regularly reviews data on administrative services, including services provided by the business centers. However, the department does not use these or other data to assess the effectiveness and impact of its business centers and as of November 2019 did not plan to do so. Beginning in 2018, USDA created an online monitoring system to compile data from mission areas on the status of their administrative services. The system has “dashboards” displaying data specific to financial management, human resources, information technology, procurement, and property management, among other things. Each of the dashboards presents metrics gathered from various databases across mission areas. For example, the dashboards for human resources include the number of employees by organization, along with their geographic location, retirement eligibility, occupation, and any skills gaps. According to USDA officials, the dashboards allow department-level review of a large number of metrics on a range of administrative activities performed by the business centers—data that previously were available only to each mission area. USDA’s Deputy Secretary discusses performance on various dashboards with mission area and staff office leadership at quarterly review meetings. However, the department has not used dashboards or associated metrics to assess the effectiveness and impact of the business centers. Specifically, the department has not assessed the impact that the business centers have had on USDA’s customer service; human resources, including hiring; and overall functionality. According to the Deputy Assistant Secretary for Administration, creating new business centers and changing existing ones has contributed to positive results, such as savings from reducing the size of USDA’s vehicle fleet, but USDA’s Departmental Administration has not systematically compared USDA’s ability to deliver its administrative services before and after these reforms. For example, the department has not examined whether the reforms have enabled mission areas to reduce costs, reduce processing times, or identify previously unknown issues that need to be addressed. According to USDA officials, these business center reforms broadly addressed the first policy goal in USDA’s May 2018 strategic plan for fiscal years 2018 through 2022—namely that USDA programs be delivered efficiently, effectively, and with integrity and a focus on customer service. However, USDA officials told us that they have not yet attempted to measure how the business center reforms have met the three overarching policy goals identified in the Secretary of Agriculture’s November 2017 memorandum, which called for the business center reforms to (1) improve customer engagement, (2) maximize efficiency, and (3) improve agency collaboration. In addition, some stakeholders we interviewed expressed concern about progress toward these goals as USDA works to implement the business center reforms. For example: Staffing vacancies. Some stakeholders raised concerns about the impact of vacancy rates at business centers on customer engagement. The two largest business centers created since November 2017—in FPAC and Rural Development—had position vacancy rates above 27 percent as of September 30, 2019. Officials with one group representing farmers who are customers of the FPAC and Rural Development mission areas told us they were concerned that (1) vacancies in the business center may be leading to vacancies among program staff in the field, (2) complaints related to staffing have increased over the past few years, and (3) staffing vacancies in the field are negatively affecting customer service. An official from another group representing farmers told us that the group is hearing from its members that there have been a lot of changes within USDA lately and field offices seem to be understaffed and overwhelmed even after the creation of the business centers, which could be negatively affecting the quality of customer service. Vacancies at the FPAC and Rural Development business centers, particularly among staff responsible for hiring USDA program staff in the field, could therefore affect both access to and the quality of technical assistance. Employee concerns. In the FPAC Business Center, officials from one union representing employees told us that confusion among employees about their roles and responsibilities could affect both internal employee satisfaction and the overall ability of the business center to serve the FPAC mission and its customers. Specifically, these union officials noted employees’ confusion about how to reconcile differences among the work procedures that each of the three FPAC agencies used before the reorganization. Officials from this and one other union also stated that employees have reported that business center leadership has not taken action to address such employee concerns. As a result, according to officials from both unions, FPAC business center employees are experiencing low morale, confusion, frustration, and anxiety about the changes, affecting their ability to deliver services. In response, FPAC officials told us in November 2019 that the FPAC Business Center is working on empowering employees, hiring, establishing a culture of accountability, building trust and engagement, and addressing other issues that have arisen in the business center’s first year of operation. For example, these officials said they were reviewing the business center’s organizational structure to determine whether there is a need for adjustments to further streamline operations and improve service. USDA officials cited several reasons the department has not assessed the effect of the business center reform effort undertaken in response to the Secretary’s November 2017 memorandum. According to the Deputy Assistant Secretary for Administration, the absence of evaluation is partly attributable to the department’s strategy of delegating responsibility to the mission areas to implement business centers; this strategy aims to give the mission area leadership ownership of the reform effort and help ensure their buy-in. The Deputy Assistant Secretary for Administration also said that the department has focused on implementing the reforms called for in the memorandum rather than on evaluating the results. USDA officials also pointed out that the reform effort is relatively recent, with five of the business centers having been created since June 2018. However, the Deputy Assistant Secretary for Administration acknowledged the importance of evaluating and communicating any benefits derived from the business center reform effort as it moves forward. Our prior work has shown that a key practice to consider during agency reform efforts is the establishment of clear outcome-oriented goals and performance measures to assess the reform’s effectiveness and impact. As we have previously reported, a performance goal is a target level of performance expressed as a measurable objective; a performance measure includes an assessment of results compared with intended purpose that can be expressed quantitatively or in another way that indicates a level or degree of performance. Monitoring performance against goals allows agencies to assess progress and address problems as necessary. While USDA has not developed goals and measures to assess the effectiveness and impact of the business center reforms, the department has set goals for a limited number of administrative services, including hiring, the number of fleet vehicles, and travel and conference spending. In addition, parts of the department have developed goals and measures for the administrative services their business centers provide. For example, officials in the Research, Education, and Economics mission area reported nine key performance indicators for their administrative services, such as specific goals and measures for the timeliness of posting job opportunity announcements. Developing appropriate performance goals and measures and systematically assessing the effectiveness and impact of the business center reforms could help the department determine whether the reforms are meeting the Secretary’s overarching policy goals and improving the delivery of administrative services to support the department’s mission and program goals. Conclusions USDA has established business centers in all of its eight mission areas, and, according to USDA’s Deputy Assistant Secretary for Administration, the department regularly reviews data on administrative services, including services provided by the business centers. However, the department has not systematically assessed whether USDA’s ability to deliver its administrative services has improved since the establishment of its business center reforms or whether the reforms are meeting the policy goals that the Secretary intended them to achieve. Importantly, the department has not assessed the impact that the business centers have had on USDA’s customer service; human resources, including hiring; and overall functionality. Our prior work has shown that a key practice to consider during agency reform efforts is the establishment of clear outcome-oriented goals and performance measures to assess the reform’s effectiveness and impact. The department has set goals for a limited number of administrative services, including hiring, the number of fleet vehicles, and travel and conference spending, but it has not developed goals and measures to more broadly assess the effectiveness and impact of the business center reforms. Developing such goals and measures and using them to assess the effectiveness and impact of the business center reforms could help the department (1) determine whether the reforms are meeting the Secretary’s overarching policy goals and (2) identify whether the reforms have enabled mission areas to improve the delivery of their administrative services by, for example, reducing costs, reducing processing times, or identifying previously unknown issues that need to be addressed. Recommendation for Executive Action The Secretary of Agriculture should direct Departmental Administration to work with the mission areas to develop department-level outcome- oriented performance goals and related measures for the business centers, and use them to assess the effectiveness and impact of the business center reforms. (Recommendation 1) Agency Comments We provided a draft of this report to USDA for comment. In an email, a Senior Advisor in USDA’s Office of Operations stated that USDA agreed with our recommendation about assessing the effectiveness and impact of the business centers. In addition, in comments, reproduced in appendix II, USDA generally agreed with the findings in our draft report. USDA stated that to address our recommendation, the department is evaluating options for the development of performance metrics and inclusion of these metrics and related information as part of the regular and recurring reviews by the department’s Deputy Secretary who is identified as the Chief Operating Officer. We are sending copies of this report to the appropriate congressional committees, the Secretary of Agriculture, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions regarding this report, please contact me at (202) 512-3841 or morriss@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. Appendix I: Fu nding for the F and Conservation Business Center, Including Information Technology Modernization Since the U.S. Department of Agriculture (USDA) established the Farm Production and Conservation (FPAC) Business Center in October 2018, Congress has appropriated a total of about $294 million to USDA for necessary expenses of the FPAC Business Center. USDA has also approved $1.1 million for efforts to modernize information technology at the center through fiscal year 2020. USDA Has Funded the FPAC Business Center with Discretionary and Mandatory Appropriations USDA has supported the FPAC Business Center with discretionary and mandatory appropriations. USDA budget documents and congressional report language indicate that these appropriations have been accompanied by corresponding reductions in funding to the other three agencies within the FPAC mission area—the Farm Services Agency (FSA), Natural Resources Conservation Service (NRCS), and Risk Management Agency (RMA). For fiscal year 2018, the Consolidated Appropriations Act, 2018, provided discretionary appropriations of about $1.0 million to the FPAC Business Center and further provided for the transfer into the FPAC Business Center account of another $145,000 in mandatory appropriations. Subsequent USDA budget justification documents state that the $145,000 included funds directed towards three NRCS programs—the Environmental Quality Incentives Program (EQIP), Conservation Stewardship Program (CSP), and Agricultural Conservation Easement Program (ACEP). As shown in table 3, for fiscal year 2019, the Consolidated Appropriations Act, 2019, provided for the FPAC Business Center to receive discretionary appropriations of about $216.4 million, an amount that an accompanying conference report states was offset by reductions to the appropriations for administrative functions in FSA, NRCS, and RMA; a transfer of about $16.1 million in discretionary appropriations from FSA’s Agricultural Credit Insurance Fund Program Account; and a transfer of about $60.2 million in mandatory appropriations that, according to USDA officials, came from the same three NRCS programs as in 2018 (EQIP, CSP, and ACEP). According to USDA officials, prior to the establishment of the FPAC Business Center, these funds were used to support the salaries of FSA, NRCS, and RMA personnel performing functions and tasks similar to those provided by the business center and for general operating costs such as rents, information technology, travel, and training expenses. The FPAC Business Center plans its spending and tracks its obligations using standard categories, including personnel compensation, benefits, travel, transportation, postage, contracts, supplies, and equipment. As shown in table 4, the FPAC Business Center planned to spend funds only for personnel compensation and benefits in fiscal year 2018. According to data provided by USDA, the business center obligated about $995,000 of the nearly $1.2 million in available funds, and those obligations were entirely for personnel compensation and benefits. In fiscal year 2019, the business center planned to obligate nearly 74 percent of the $292.7 million in available funds on personnel compensation and benefits, about 18 percent on contracts, about 8 percent on travel, and the rest on other activities. According to USDA officials, through the end of the fiscal year, the business center had obligated approximately $272 million, or about 93 percent, of its available funds. USDA Has Approved $1.1 Million in FPAC Business Center Information Technology Modernization Efforts through Fiscal Year 2020 For fiscal years 2018 through 2020, USDA approved an investment of $10 million for information technology modernization across all FPAC agencies, including the following two efforts to modernize information technology in the FPAC Business Center at an estimated cost of $1.1 million: The Modernized Directives System, approved at a cost of $600,000. According to USDA officials, the FPAC Business Center is funding this project from its salaries and expenses budget. According to USDA documents, the business center’s Management Services Division wants to provide all FPAC employees an online tool to create, authorize, disseminate, and manage all of the agency’s policy directives in an FPAC Consolidated Directives Repository while minimizing the costs of operations. According to the agency, the tool would streamline the tasks performed by the division’s administrative staff. FPAC plans to gauge the success of the effort by measuring adoption of the new tool by employees, stakeholders, and the public. The National Office Information System, approved at a cost of $500,000. According to USDA officials, $41,000 of that amount is from the FPAC Business Center’s budget for salaries and expenses, while the remaining $459,000 is funded by the other three FPAC agencies. According to USDA documents, this operations support system would improve the agency’s ability to respond in a timely manner to congressional and departmental inquiries and meet reporting requirements from the Office of Management and Budget and other oversight organizations. According to FPAC Business Center officials, the business center obligated $600,000 and $41,000, respectively, toward these two projects in fiscal year 2019. Appendix III: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Nico Sloss (Assistant Director), Stephen Cleary (Analyst in Charge), Ross Campbell, Caitlin Dardenne, Juan Garay, Scott Heacock, Serena Lo, Cynthia Norris, Lauren Ostrander, and Sara Sullivan made key contributions to this report.