High-Risk Series: Substantial Efforts Needed to Achieve Greater Progress on High-Risk Areas

The federal government is one of the world's largest and most complex entities; about $4.1 trillion in outlays in fiscal year 2018 funded a broad array of programs and operations. GAO's high-risk program identifies government operations with vulnerabilities to fraud, waste, abuse, and mismanagement, or in need of transformation to address economy, efficiency, or effectiveness challenges.

This biennial update describes the status of high-risk areas, outlines actions that are still needed to assure further progress, and identifies two new high-risk areas needing attention by the executive branch and Congress. Solutions to high-risk problems save billions of dollars, improve service to the public, and would strengthen government performance and accountability.

GAO uses five criteria to assess progress in addressing high-risk areas: (1) leadership commitment, (2) agency capacity, (3) an action plan, (4) monitoring efforts, and (5) demonstrated progress.

The ratings for more than half of the 35 areas on the 2019 High-Risk List remain largely unchanged. Since GAO's last update in 2017, seven areas improved, three regressed, and two showed mixed progress by improving in some criteria but declining in others. Where there has been improvement in high-risk areas, congressional actions have been critical in spurring progress in addition to actions by executive agencies.

GAO is removing two of the seven areas with improved ratings from the High-Risk List because they met all of GAO's five criteria for removal. The first area, Department of Defense (DOD) Supply Chain Management, made progress on seven actions and outcomes related to monitoring and demonstrated progress that GAO recommended for improving supply chain management. For example, DOD improved the visibility of physical inventories, receipt processing, cargo tracking, and unit moves. Improvements in asset visibility have saved millions of dollars and allow DOD to better meet mission needs by providing assets where and when needed.

The second area, Mitigating Gaps in Weather Satellite Data, made significant progress in establishing and implementing plans to mitigate potential gaps. For example, the National Oceanic and Atmospheric Administration successfully launched a satellite, now called NOAA-20, in November 2017. NOAA-20 is operational and provides advanced weather data and forecasts. DOD developed plans and has taken actions to address gaps in weather data through its plans to launch the Weather System Follow-on–Microwave satellite in 2022.

There are two new areas on the High-Risk List since 2017. Added in 2018 outside of GAO's biennial high-risk update cycle, the Government-Wide Personnel Security Clearance Process faces significant challenges related to processing clearances in a timely fashion, measuring investigation quality, and ensuring information technology security. The second area, added in 2019, is Department of Veterans Affairs (VA) Acquisition Management. VA has one of the most significant acquisition functions in the federal government, both in obligations and number of contract actions. GAO identified seven contracting challenges for VA, such as outdated acquisition regulations and policies, lack of an effective medical supplies procurement strategy, and inadequate acquisition training.

Overall, 24 high-risk areas have either met or partially met all five criteria for removal from the list; 20 of these areas fully met at least one criterion. Ten high-risk areas have neither met nor partially met one or more criteria.

While progress is needed across all high-risk areas, GAO has identified nine that need especially focused executive and congressional attention, including Ensuring the Cybersecurity of the Nation, Resolving the Federal Role in Housing Finance, addressing Pension Benefit Guaranty Corporation Insurance Programs, Managing Risks and Improving VA Health Care, and ensuring an effective 2020 Decennial Census. Beyond these specific areas, focused attention is needed to address mission-critical skills gaps in 16 high-risk areas, confront three high-risk areas concerning health care and tax law enforcement that include billions of dollars in improper payments each year, and focus on a yawning tax gap.

This statement describes GAO's views on progress made and what remains to be done to bring about lasting solutions for each high-risk area. Substantial efforts are needed by the executive branch to achieve progress on high-risk areas. Addressing GAO's hundreds of open recommendations across the high-risk areas and continued congressional oversight and action are essential to achieving greater progress.

Since the early 1990s, our high-risk program has focused attention on  government operations with greater vulnerabilities to fraud, waste, abuse,  and mismanagement, or that are in need of transformation to address  economy, efficiency, or effectiveness challenges. This effort, supported  by this committee and the Senate Committee on Homeland Security and  Governmental Affairs, has brought much needed attention to problems  impeding effective government and costing billions of dollars each year.

We have made hundreds of recommendations to reduce the  government’s high-risk challenges. Executive agencies either have  addressed or are addressing many of them and, as a result, progress is  being made in a number of areas. Congress also continues to take  important actions. For example, Congress has enacted a number of laws  since our last report in February 2017 that are helping to make progress  on high-risk issues. Financial benefits to the federal government due to  progress in addressing high-risk areas over the past 13 years (fiscal year  2006 through fiscal year 2018) totaled nearly $350 billion or an average of  about $27 billion per year. In fiscal year 2018, financial benefits were the  highest we ever reported at nearly $47 billion.

Our 2019 High-Risk Report, which is being released today, describes (1)  progress made addressing high-risk areas and the reasons for that  progress, and (2) actions that are still needed. It also identifies two new  high-risk areas—Government-wide Personnel Security Clearance  Process and Department of Veterans Affairs (VA) Acquisition  Management, and two high-risk areas we removed from the list because  they demonstrated sufficient progress in managing risk—Department of  Defense (DOD) Supply Chain Management and Mitigating Gaps in  Weather Satellite Data.

Substantial efforts are needed on the remaining high-risk areas to  achieve greater progress and to address regress in some areas since the  last high-risk update in 2017. Continued congressional attention and  executive branch leadership attention remain key to success.

Our experience has shown that the key elements needed to make  progress in high-risk areas are top-level attention by the administration  and agency leaders grounded in the five criteria for removal from the  High-Risk List, as well as any needed congressional action. The five  criteria for removal that we issued in November 2000 are as follows:

Leadership commitment. Demonstrated strong commitment and top leadership support.

Capacity. Agency has the capacity (i.e., people and resources) to resolve the risk(s).

Action plan. A corrective action plan exists that defines the root cause, solutions, and provides for substantially completing corrective measures, including steps necessary to implement solutions we recommended.

Monitoring. A program has been instituted to monitor and independently validate the effectiveness and sustainability of corrective measures.

Demonstrated progress. Ability to demonstrate progress in implementing corrective measures and in resolving the high-risk area.

Starting in our 2015 update, we added clarity and specificity to our  assessments by rating each high-risk area’s progress on the five criteria  and used the following definitions:

Met. Actions have been taken that meet the criterion. There are no significant actions that need to be taken to further address this criterion.

Partially met. Some, but not all, actions necessary to meet the criterion have been taken.

Not met. Few, if any, actions towards meeting the criterion have been taken.

We are removing two areas—DOD Supply Chain Management and  Mitigating Gaps in Weather Satellite Data—from the list due to the  progress that was made in addressing the high-risk issues. As we have  with areas previously removed from the High-Risk List, we will continue to  monitor these areas to ensure that the improvements we have noted are  sustained. If significant problems again arise, we will consider reapplying  the high-risk designation. We added two areas to the High-Risk List since  our 2017 update—Government-Wide Personnel Security Clearance  Process and VA Acquisition Management.

DOD Supply Chain Management Remo ved From the High-Risk List

We are removing the area of DOD Supply Chain Management from the  High-Risk List because, since 2017, DOD has addressed the remaining  two criteria (monitoring and demonstrated progress) for the asset visibility  and materiel distribution segments. Congressional attention, DOD  leadership commitment, and our collaboration contributed to the  successful outcome for this high-risk area, which had been on GAO’s  High-Risk List since 1990.

DOD’s actions for the asset visibility segment of this high-risk area  included (1) providing guidance for the military components to consider  key attributes of successful performance measures during metric  development for their improvement initiatives; (2) incorporating into after- action reports, information relating to performance measures; and (3)  demonstrating sustained progress by, for example, increasing its visibility  of assets through radio-frequency identification (RFID), an automated  data-capture technology that can be used to electronically identify, track,  and store information contained on a tag. According to DOD, the use of  RFID tags to provide visibility of sustainment cargo at the tactical leg (i.e.,  the last segment of the distribution system) resulted in $1.4 million annual  cost savings.

DOD’s actions for the materiel distribution segment of this high-risk area  included (1) making progress in developing its suite of distribution  performance metrics; (2) incorporating distribution metrics, as  appropriate, on the performance of all legs of the distribution system,  including the tactical leg; (3) making progress in refining its Materiel  Distribution Improvement Plan and incorporating additional actions based  on interim progress and results; and (4) improving its capability to  comprehensively measure distribution performance, identifying  distribution problems and root cause, and implementing solutions.

According to DOD, initiatives focused on distribution process and  operational improvements have resulted in at least $1.56 billion in  distribution cost avoidances to date.

As we have with areas previously removed from the High-Risk List, we  will continue to monitor this area to ensure that the improvements we  have noted are sustained. Appendix I provides additional information on  this high-risk area.

Mitigating Gaps in Weather Satellite Data Removed From the High- Risk List

We are removing the area of Mitigating Gaps in Weather Satellite Data  from the High-Risk List because—with strong congressional support and  oversight—the National Oceanic and Atmospheric Administration (NOAA)  and DOD have made significant progress since 2017 in establishing and  implementing plans to mitigate potential gaps in weather satellite data.

The United States relies on polar-orbiting satellites to provide a global  perspective on weather every morning and afternoon. NOAA is  responsible for the polar satellite program that crosses the equator in the  afternoon while DOD is responsible for the polar satellite program that  crosses the equator in the early morning orbit. NOAA’s actions for polar- orbiting weather satellites that addressed the remaining criteria of action  plan and demonstrated progress included (1) issuing three updates to its  gap mitigation plan between January 2016 and February 2017 to address  shortfalls we had identified previously; and (2) successfully launching the  NOAA-20 satellite in November 2017, which is currently operational and  is being used to provide advanced weather data and forecasts. Moreover,  NOAA is also working to build and launch the next satellites in the polar  satellite program.

DOD’s actions for polar-orbiting weather satellites, pursuant to statutes  and accompanying congressional direction, included DOD leadership (1)  developing and implementing plans to acquire satellites as part of a family  of systems to replace its aging legacy weather satellites, including  awarding a contract for its Weather System Follow-on–Microwave  program, planned for launch in 2022; (2) establishing plans to meet its  highest-priority weather monitoring data collection needs that will not be  covered by the Weather System Follow-on–Microwave program, including  by acquiring and launching the Electro-Optical/Infrared Weather Systems  satellite in 2024; and (3) monitoring the Weather System Follow-on- Microwave satellite program’s progress toward addressing critical needs  and assessing its operations and sustainment costs.

Government-wide Personnel Security Clearance Process Added to the High-Risk List

Executive branch agencies are not meeting investigation timeliness  objectives, and these processing delays have contributed to a significant  backlog that the National Background Investigations Bureau (NBIB)—the  agency responsible for personnel security clearance investigations— reported to be approximately 565,000 investigations as of February 2019.  In addition, the executive branch has not finalized performance measures  to ensure the quality of background investigations and some long- standing key reform initiatives remain incomplete. Further, information  technology (IT) security concerns may delay planned milestones for the  development of a new background investigation IT system.

We included the DOD program on our High-Risk List in 2005 and  removed it in 2011 because of improvements in the timeliness of  investigations and adjudications, and steps toward measuring the quality  of the process. We put the government-wide personnel security clearance  process on our High-Risk List in January 2018 because of significant  challenges related to the timely processing of security clearances and  completing the development of quality measures. In addition, the  government’s effort to reform the personnel security clearance process,  starting with the enactment of the Intelligence Reform and Terrorism  Prevention Act of 2004, has had mixed progress, and key reform efforts  have not been implemented government-wide. Since adding this area to  the High-Risk List, the Security Clearance, Suitability, and Credentialing  Performance Accountability Council (PAC), including its four principal  members—the Deputy Director for Management of the Office of  Management and Budget (OMB), the Director of National Intelligence  (DNI); the Under Secretary of Defense for Intelligence; and the Director of  the Office of Personnel Management (OPM)—have not fully met the five  criteria for high-risk removal.

Several issues contribute to the risks facing the government-wide  personnel security clearance process:

Clearance processing delays. Executive branch agencies are not meeting most investigation timeliness objectives. The percentage of executive branch agencies meeting established timeliness objectives for initial secret clearances, initial top secret clearances, and periodic reinvestigations decreased each year from fiscal years 2012 through 2018. For example, 97 percent of the executive branch agencies we reviewed did not meet the timeliness objectives for initial secret  clearance investigations in fiscal year 2018.

Lack of quality measures. While the executive branch has taken steps to establish government-wide performance measures for the quality of background investigations—including establishing quality assessment standards and a quality assessment reporting tool—it is unclear when this effort will be completed.

Security clearance reform delays. The executive branch has reformed many parts of the personnel security clearance process— such as updating adjudicative guidelines to establish common adjudicative criteria for security clearances; however, some long- standing key initiatives remain incomplete—such as completing plans to fully implement and monitor continuous evaluation.

IT security. DOD is responsible for developing a new system to support background investigation processes, and DOD officials expressed concerns about the security of connecting to OPM’s legacy systems since a 2015 data breach compromised OPM’s background investigation systems and files for 21.5 million individuals. As of December 2018, OPM has not fully taken action on our priority recommendations to update its security plans, evaluate its security control assessments, and implement additional training opportunities.

However, since we added this area to our High-Risk List, the PAC has  demonstrated progress in some areas. For example, NBIB reported that  the backlog of background investigations decreased from almost 715,000  cases in January 2018 to approximately 565,000 cases in February 2019.  NBIB officials credit an Executive Memorandum—issued jointly in June  2018 by the DNI and the Director of OPM and containing measures to  reduce the investigation backlog—as a driver in backlog reduction.

Further, in response to a requirement in the Securely Expediting  Clearances Through Reporting Transparency (SECRET) Act of 2018, in  September 2018, NBIB reported to Congress, for each clearance level,  (1) the size of the investigation backlog, (2) the average length of time to conduct an initial investigation and a periodic reinvestigation, and (3) a discussion of the factors contributing to investigation timeliness. The PAC is also reporting publicly on the progress of key reforms through www.performance.gov, and for fiscal year 2018, the website contains quarterly action plans and progress updates, which present figures on the average timeliness of initial investigations and periodic reinvestigations  for the executive branch as a whole, investigation workload and backlog,  and investigator headcounts.

We have made numerous recommendations to PAC members to address  risks associated with the personnel security clearance process between  2011—when we removed DOD’s personnel security clearance program  from the High-Risk List, and 2018—when we placed the government-wide  personnel security clearance process on the High-Risk List. We consider  27 of these recommendations key to addressing the high-risk designation.  Eight recommendations key to the high-risk designation have been  implemented, including three since January 2018.

Nineteen of these key recommendations remain open—including  recommendations that the principal members of the PAC (1) conduct an  evidence-based review of investigation and adjudication timeliness  objectives, (2) develop and report to Congress on investigation quality  measures, (3) prioritize the timely completion of efforts to modernize and  secure IT systems that affect clearance holders government-wide, and (4)  develop and implement a comprehensive workforce plan that identifies  the workforce needed to meet current and future demand for background  investigations services and to reduce the investigations backlog.

See page 170 of the report for additional detail on this high-risk area,  including more details on actions that need to be taken.

VA Acquisition Management Added to the High-Risk List

VA spends tens of billions of dollars to procure a wide range of goods and  services—including medical supplies, IT, and construction of hospitals,  clinics, and other facilities—to meet its mission of providing health care  and other benefits to millions of veterans. VA has one of the most  significant acquisition functions in the federal government, both in  obligations and number of contract actions. The Veterans Health  Administration (VHA) provides medical care to veterans and is by far the  largest administration in the VA. Since we began focusing on VA’s  acquisition management activities in 2015, we have reported numerous  challenges in this area. Since 2015, we have made 31 recommendations,  21 of which remain open, that cover a range of areas to address  challenges in VA’s acquisition management.

In fiscal year 2019, VA received the largest discretionary budget in its  history—$86.5 billion, about $20 billion higher than in 2015. About a third  of VA’s discretionary budget in fiscal year 2017, or $26 billion, has been  used to contract for goods and services. VA’s acquisition management  continues to face challenges including (1) outdated acquisition regulations  and policies; (2) lack of an effective medical supplies procurement  strategy; (3) inadequate acquisition training; (4) contracting officer  workload challenges; (5) lack of reliable data systems; (6) limited contract  oversight and incomplete contract file documentation; and (7) leadership  instability.

In light of these challenges and given the significant taxpayer investment,  it is imperative that VA show sustained leadership commitment to take  steps to improve the performance of its procurement function so that it  can use its funding in the most efficient manner possible to meet the  needs of those who served our country.

This area has been added to the High-Risk List for the following reasons  in particular:

Outdated acquisition regulations and policies. VA’s procurement policies have historically been outdated, disjointed, and difficult for contracting officers to use. In September 2016, we reported that the acquisition regulations contracting officers currently follow have not been fully updated since 2008 and that VA had been working on completing a comprehensive revision of its acquisition regulations since 2011. VA’s delay in updating this fundamental source of policy has impeded the ability of contracting officers to effectively carry out their duties. We recommended in September 2016 that VA identify measures to expedite the revision of its acquisition regulations and  clarify what policies are currently in effect. VA concurred with this  recommendation but has not yet fully implemented it.

Lack of an effective medical supplies procurement strategy. VA’s Medical Surgical Prime Vendor-Next Generation (MSPV-NG) program for purchasing medical supplies to meet the needs of about 9 million veterans at 172 medical centers has not been effectively executed, nor is it in line with practices at leading hospitals that have launched similar programs. We reported in November 2017 that VA’s approach to developing its catalog of supplies was rushed and lacked key stakeholder involvement and buy-in. As a result, VA was not able to accomplish some of the key efficiencies the program was intended to achieve, such as streamlining the purchase of medical supplies and saving money. We recommended in November 2017 that VA develop, document, and communicate to stakeholders an overarching strategy for the program. VA concurred with this recommendation and reported that it would develop a new strategy by March 2019.

Contracting officer workload challenges. The majority of our reviews since 2015 have highlighted workload as a contributing factor to the challenges that contracting officers face. Most recently, in September 2018, we reported that about 54 percent of surveyed VA contracting officers said their workload was not reasonable. In addition, in September 2016, we reported that VHA contracting officers processed a large number of emergency procurements of routine medical supplies, which accounted for approximately 20 percent of VHA’s overall contract actions in fiscal year 2016, with obligations totaling about $1.9 billion.

Contracting officers told us that these frequent and urgent small-dollar  transactions reduce contracting officers’ efficiency and ability to take a  strategic view of procurement needs. We recommended in November  2017 that VHA network contracting offices work with medical centers to  identify opportunities to more strategically purchase goods and services  frequently purchased on an emergency basis. VA concurred with this  recommendation and reported in December 2018 that it is utilizing a  supply chain dashboard to track items purchased on an emergency basis  and determine which of those items to include on the catalog. VA noted  that it added 13,300 items to the catalog from June 2018 to December  2018, including items often purchased on an emergency basis. We  requested documentation showing which items added to the catalog were  previously purchased on an emergency basis, but as of January 2019, VA  had not yet provided it.

Among other things, VA should implement our 21 open recommendations  and specifically needs to take the following steps to demonstrate greater  leadership commitment and strategic planning to ensure efficient use of  its acquisition funding and staffing resources:

Prioritize completing the revision of its acquisition regulations, which has been in process since 2011.

Develop, document, and communicate to stakeholders a strategy for the Medical Surgical Prime Vendor program to achieve overall program goals.

Identify opportunities to strategically purchase goods and services that are frequently purchased on an emergency basis.

See page 210 of the report for additional detail on this high-risk area,  including more details on actions that need to be taken.

Emerging Issue Requiring Close Attention: Federal Efforts to Prevent Drug Misuse

In addition to specific areas that we have designated as high risk, other  important challenges facing our nation merit continuing close attention.  One of these is the use of illicit drugs and the misuse of prescription  drugs and the ways they affect individuals, their families, and the  communities in which they live. Over 70,000 people died from drug  overdoses in 2017—about 191 people every day—according to the  Centers for Disease Control and Prevention, with the largest portion of  these deaths attributed to opioids. Further, drug overdoses are the  leading cause of death due to injuries in the United States. They are  currently at their highest ever recorded level and, since 2011, have  outnumbered deaths by firearms, motor vehicle crashes, suicide, and  homicide, according to the Drug Enforcement Administration. The Council  of Economic Advisors estimates that in 2015, the economic cost of the  opioid crisis alone was more than $500 billion when considering the value  of lives lost due to opioid-related overdose.

Federal drug control efforts spanning prevention, treatment, interdiction,  international operations, and law enforcement represent a considerable  federal investment. According to the President’s fiscal year 2019 budget,  federal drug control funding for fiscal year 2017 was $28.8 billion. Multiple  federal agencies have ongoing efforts to respond to this crisis, including  efforts to reduce the supply and demand for illicit drugs, to prevent  misuse of prescription drugs, and to treat substance use disorders.

However, we previously found that many efforts lacked measures to  gauge the success of the federal response. Further, we have long  advocated an approach to decision-making based on risk management.  Such an approach would (1) link agencies’ plans and budgets to  achieving their strategic goals, (2) assess values and risks of various  courses of actions to help set priorities and allocate resources, and (3)  provide for the use of performance measures to assess progress.

The Office of National Drug Control Policy (ONDCP) is responsible for  overseeing and coordinating the implementation of U.S. drug policy,  including developing the National Drug Control Strategy (Strategy).  ONDCP released the 2019 Strategy on January 31, 2019. The Strategy  focuses on approaches related to prevention, treatment and recovery,  and steps to reduce the availability of illicit drugs in the United States. We  will continue to monitor the extent to which ONDCP and other federal  agencies are employing a risk management and coordinated approach to  their efforts to limit drug misuse.

In particular, we have ongoing and planned work to assess ONDCP’s  operations, including its (1) leadership and coordination of efforts across  the federal government; (2) the effects of the drug crisis on labor force  participation and productivity and on people with disabilities and other  vulnerable populations; (3) key federal efforts to reduce the availability of  illicit drugs; and (4) agency efforts around drug education and prevention.  We will determine whether this issue should be added to the High-Risk  List once we have completed this ongoing and planned work.

Agencies can show progress by addressing our five criteria for removal  from the list: leadership commitment, capacity, action plan, monitoring,  and demonstrated progress. As shown in table 1, 24 high-risk areas, or  about two-thirds of all the areas, have met or partially met all five criteria  for removal from our High-Risk List; 20 of these areas fully met at least  one criterion. Compared with our last assessment, 7 high-risk areas  showed progress in one or more of the five criteria without regressing in  any of the criteria. Ten high-risk areas have neither met nor partially met  one or more criteria. Two areas showed mixed progress by increasing in  at least one criterion and also declining in at least one criterion. Three  areas declined since 2017. These changes are indicated by the up and  down arrows in table 1.

Figure 1 shows that since our 2017 update, the most progress was made  on the action plan criterion—four high-risk areas received higher ratings.  We rated two areas lower on leadership commitment and two areas lower  on monitoring.

Leadership Attention Needed to Meet High-Risk Criteria

Table 2 shows that 17 of the 34 high-risk areas we rated have met the  leadership commitment criterion while two high-risk area ratings  regressed on leadership commitment from met to partially met since our  last report.

Leadership commitment is the critical element for initiating and sustaining  progress, and leaders provide needed support and accountability for  managing risks. Leadership commitment is needed to make progress on  the other four high-risk criteria. Table 2 shows that only three high-risk  areas met the criterion for capacity, six met the criterion for action plan,  and two met the criterion for demonstrated progress. One high-risk  area—U.S. Government’s Environmental Liability—has partially met only  one criterion since we added the area to our list in 2017 and the rest are  not met.

As noted, seven areas showed improvement in one or more criterion  without regressing in any criteria. Two areas showed sufficient progress  to be removed from the High-Risk List. The other five high-risk areas  remaining on the 2019 list demonstrated improvement and are described  below. Three of these five improving high-risk areas are the responsibility  of the Department of Defense (DOD)—DOD Support Infrastructure  Management, DOD Financial Management, and DOD Business Systems  Modernization. The two other improving areas are Department of  Energy’s (DOE's) Contract Management for the National Nuclear Security  Administration and Office of Environmental Management, and Medicare  Program & Improper Payments.

DOD Support Infrastructure Management: DOD manages a portfolio of  real property assets that, as of fiscal year 2017, reportedly included about  586,000 facilities—including barracks, maintenance depots,  commissaries, and office buildings. The combined replacement value of  this portfolio is almost $1.2 trillion and includes about 27 million acres of  land at nearly 4,800 sites worldwide. This infrastructure is critical to  maintaining military readiness, and the cost to build and maintain it  represents a significant financial commitment. Since our 2017 High-Risk  Report, DOD’s rating for two criteria—leadership commitment and action  plan—improved from partially met to met.

DOD has demonstrated leadership commitment by stating its commitment  to addressing key recommendations we have made by, for example, (1)  better forecasting the initial Base Realignment and Closure (BRAC) costs  for military construction, IT, and relocating military personnel and  equipment; (2) better aligning infrastructure to DOD force structure needs  by, for example, improving the accuracy and sufficiency of its excess  capacity estimates; and (3) pursuing an effort to consolidate and  standardize leases, which includes analyzing whether it is feasible to  relocate functions from commercial leased space to existing space on an  installation, thereby reducing leases and better utilizing excess space.

DOD has developed action plans to better identify excess infrastructure  and thus be positioned to dispose of it. For example, in the 2017 High- Risk Report, we stated that DOD’s Real Property Efficiency Plan includes  DOD’s goals for reducing the footprint of its real property inventory and  metrics to gauge progress, to be implemented by the end of 2020. We  also found in 2018 that DOD was achieving cost savings and cost  avoidances as it had begun using intergovernmental support agreements  between military installations and local governments to obtain installation  services, such as waste removal, grounds maintenance, and stray animal  control. As a result of these and other actions, DOD now meets the action  plan criterion for this high-risk area.

As of December 2018, 23 recommendations related to this high-risk area  remain open. DOD continues to partially meet the criteria for capacity,  monitoring, and demonstrated progress.

See page 158 of the report for additional detail on this high-risk area,  including more details on actions that need to be taken.

DOD Financial Management: Since our 2017 High-Risk Report, ratings  for the DOD Financial Management high-risk area improved for the  criteria of leadership commitment and monitoring. For the leadership  commitment criterion, the high-risk area rating improved from partially met  to met in 2019 due to several DOD leadership actions. For example, in  2018, DOD leadership met the goal of undergoing an agency-wide  financial statement audit and established a process to remediate any  audit findings—ultimately to improve the quality of financial information  that is most valuable in managing the department’s day-to-day  operations. In addition, according to a DOD official, audit remediation  efforts have produced benefits in certain inventory processes that have  led to operational improvements.

DOD leadership demonstrated its commitment to making needed  improvements by developing a database that tracks hundreds of findings  and recommendations that came out of the audits. In addition, senior  leadership has been meeting bimonthly with military services’ leadership  for updates on the status of corrective action plans to address audit  findings and recommendations, and the Under Secretary of Defense  (Comptroller) has been meeting frequently with the Secretary of Defense  to review the plans.

These same DOD actions also led to the high-risk area’s rating for the  criterion of monitoring to improve from not met to partially met. For  example, the database mentioned above is intended to capture, prioritize,  and assign responsibility for auditor findings and related corrective action  plans, which are meant to be used to measure progress towards  achieving a clean audit opinion.

Further, DOD leadership has held frequent meetings to discuss the status  of corrective action plans. In addition, DOD also established councils in  certain areas (e.g., financial reporting) to review the status of audit  remediation activities and challenges. All of these actions demonstrate an  improvement in DOD’s monitoring activities for its financial management  function.

However, DOD’s efforts to improve its financial management continue to  be impaired by long-standing issues—including its decentralized  environment; cultural resistance to change; lack of skilled financial  management staff; ineffective processes, systems, and controls;  incomplete corrective action plans; and the need for more effective  monitoring and reporting. DOD remains one of the few federal entities  that cannot accurately account for and report on its spending or assets.  As of December 2018, 53 recommendations for this high-risk area are  open. The DOD Financial Management high-risk area continues to  partially meet the capacity and action plan criteria and not meet the  demonstrated progress criterion.

See page 147 of the report for additional detail on this high-risk area,  including more details on actions that need to be taken.

DOD Business Systems Modernization: DOD spends billions of dollars  each year to acquire modernized systems, including systems that  address key areas such as personnel, financial management, health care,  and logistics. This high-risk area includes three critical challenges facing  DOD: (1) improving business system acquisition management, (2)  improving business system investment management, and (3) leveraging  DOD’s federated business enterprise architecture.

DOD’s capacity for modernizing its business systems has improved over  time and, since our 2017 High-Risk Report, DOD’s overall rating for the  criterion of action plan improved from not met to partially met in 2019.  DOD established a plan for improving its federated business enterprise  architecture (i.e., description of DOD’s current and future business  environment and a plan for transitioning to the future environment).  Specifically, the rating improved for DOD’s federated business enterprise  architecture segment of the high-risk area because DOD’s assistant  deputy chief management officer approved a business architecture  improvement plan in January 2017.

Since 2017, we have made 10 recommendations related to this high-risk  issue. As of December 2018, 27 recommendations are open. The  leadership, capacity, monitoring, and demonstrated progress criteria  remain partially met as in 2017.

See page 152 of the report for additional detail on this high-risk area,  including more details on actions that need to be taken.

DOE's Contract Management for the National Nuclear Security  Administration and Office of Environmental Management: DOE  oversees a broad range of programs related to nuclear security, science,  energy, and waste cleanup, among other areas. As the largest civilian  contracting agency in the federal government, DOE relies primarily on  contractors to carry out its programs. For instance, DOE spends about 90  percent of its annual budget on contracts and acquiring capital assets. In  fiscal year 2018, DOE’s budget was $34.5 billion.

The high-risk area focuses on contracts, as well as major projects—those  with an estimated cost of $750 million or greater—managed by DOE’s  National Nuclear Security Administration (NNSA) and Office of  Environmental Management (EM).

Since our 2017 High-Risk Report, DOE has made progress by improving  from a not met to a partially met rating for the demonstrated progress  criterion. Specifically, through its Office of Cost Estimating and Program  Evaluation, NNSA has enhanced its capability to estimate costs and  schedules, and to assess alternatives for programs and projects, among  other things. NNSA also made progress by adopting best practices in  several areas, such as those for estimating costs and schedules in  nuclear weapons refurbishment activities and capital asset acquisitions.  For example, we determined that DOE’s revised cost estimate of $17.2  billion to construct a Mixed Oxide Fuel Fabrication Facility to dispose of  surplus, weapons-grade plutonium substantially met best practices— providing assurance that the estimated costs could be considered  reliable. This finding contributed to DOE’s reevaluation of the project and  ultimate termination, in October 2018, in favor of a potentially less costly  disposal approach.

Fifty-one of our recommendations were open as of December 2018; 15  recommendations were made since the last high-risk update in February  2017. DOE continues to meet the criterion of leadership commitment,  partially meet the criteria for action plan and monitoring, and not meet the  criterion for capacity.

See page 217 of the report for additional detail on this high-risk area,  including more details on actions that need to be taken.

Medicare Program & Improper Payments: In calendar year 2017,  Medicare, which is overseen by the Centers for Medicare & Medicaid  Services (CMS), financed $702 billion worth of health services for  approximately 58 million elderly and disabled beneficiaries. Medicare  faces a significant risk with improper payments—payments that either  were made in an incorrect amount or should not have been made at all— which reached an estimated $48 billion in fiscal year 2018.

Since our 2017 High-Risk Report, estimated improper payment rates  declined more than one percent across the Medicare program. In  addition, CMS’ rating for the capacity criterion of the improper payments  segment improved from partially met to met in 2019 due to several  actions. First, the Center for Program Integrity’s (CPI) budget and  resources have increased over time and the agency has established work  groups and interagency collaborations to extend its capacity. For  example, CMS allocated more staff to CPI after Congress provided  additional funding. CPI’s full-time equivalent positions increased from 177  in 2011 to 419 in 2017.

Additionally, in August 2017, we reported that CMS’s Fraud Prevention  System, which analyzes claims to identify health care providers with  suspect billing patterns, helped speed up certain fraud investigation  processes. Further, the Healthcare Fraud Prevention Partnership helped  improve information sharing among payers inside and outside of the  government.

Since 1990, when we added Medicare to our High-Risk List, we have  made many recommendations related to the Medicare program, 28 of  which were made since the last high-risk update in February 2017. As of  December 2018, more than 80 recommendations remain open. CMS  continues to meet the criterion of leadership commitment and to partially  meet the remaining three criteria of action plan, monitoring, and  demonstrated progress.

See page 241 of the report for additional detail on this high-risk area,  including more details on actions that need to be taken.

Congressional Action Aided Progress on High- Risk Issues

Congress enacted several laws since our last report in February 2017 to  help make progress on high-risk issues. Table 3 lists selected examples  of congressional actions taken on high-risk areas.

Congressional oversight also plays a vital role in addressing high-risk  issues. For example, at a May 2018 hearing, we testified that the Census  Bureau’s (Bureau) cost estimate was not reliable, and that the actual cost  could be higher than planned. Further, the Secretary of Commerce  created a dedicated team to provide oversight and guidance to the  Bureau on cost estimation.

In addition to its instrumental role in supporting progress in individual  high-risk areas, Congress also enacted the following statutes that, if  implemented effectively, will help foster progress on high-risk issues  government-wide:

Fraud Reduction and Data Analytics Act of 2015 (FRDAA):FRDAA is intended to strengthen federal antifraud controls. OMFRDAA requires OMB to use our Fraud Risk Framework to create guidelines for federal agencies to identify and assess fraud risks, and then design and implement control activities to prevent, detect, and respond to fraud. Agencies, as part of their annual financial reports beginning in fiscal year 2017, are further required to report on their fraud risks and their implementation of fraud reduction strategies, which should help Congress monitor agencies’ progress in addressing and reducing fraud risks.

To aid federal agencies in better analyzing fraud risks, FRDAA requires OMB to establish a working group tasked with developing a plan for creating an interagency library of data analytics and data sets to facilitate the detection of fraud and the recovery of improper payments. This working group and the library should help agencies coordinate their fraud detection efforts and improve their ability to use data analytics to monitor databases for potential improper payments. The billions of dollars in improper payments, some of which may be a result of fraud, are a central part of the  Medicare Program, Medicaid Program, and Enforcement of Tax  Laws (Earned Income Tax Credit) high-risk areas.

We reported in 2018 that, among other things, OMB did not  involve all agencies subject to the act as required by FRDAA or  hold the required minimum number of working-group meetings in  2017. As shown in figure 2, a majority of the 72 agencies  surveyed indicated a lack of involvement with and information  from the working group as challenges in implementing FRDAA.  We made three recommendations, including that OMB ensure the  working group meets FRDAA’s requirements to involve all  agencies that are subject to the act and ensure that mechanisms  to share controls, best practices, and data-analytics techniques  are in place. OMB did not concur with our recommendations. We  continue to believe the recommendations are valid, as discussed  in the 2018 report.

IT Acquisition Reform, statutory provisions known as the Federal Information Technology Acquisition Reform Act (FITARA): FITARA, enacted in December 2014, was intended to improve how agencies acquire IT and better enable Congress to monitor agencies’ progress in reducing duplication and achieving cost savings. Since the enactment of these provisions, OMB and federal agencies have paid greater attention to IT acquisition and operation, resulting in improvements to the government-wide management of this significant annual investment. These efforts have been motivated in part by sustained congressional support for improving implementation of this law, as highlighted in agencies’ FITARA implementation scores issued biannually by the House Committee on Oversight and Reform.

This continuing oversight has produced positive results. For example, in the committee’s December 2018 FITARA implementation scorecard, 18 of the 24 major federal agencies received the highest possible rating for their efforts to improve the management of software licenses, of which we have found there are thousands annually across the government. Seven months earlier, in the prior scorecard, only eight agencies had achieved this rating. Moreover, federal agencies have taken actions to address 106 of the 136 related recommendations that we have made in this area since 2014.

FITARA includes specific requirements related to seven areas: the federal data center consolidation initiative, enhanced transparency and improved risk management, agency Chief Information Officer authority enhancements, portfolio review, expansion of training and use of IT acquisition cadres, government-wide software purchasing, and maximizing the benefit of the federal strategic sourcing initiative.

In November 2017, Congress extended or removed the sunset dates of several of these statutory requirements that were originally to end in 2018 and 2019. While all of the 24 federal agencies covered by this law have developed FITARA implementation plans, the agencies need to effectively execute these plans. Successfully addressing FITARA requirements is central to making progress in Improving the Management of IT Acquisitions and Operations, which has been on our High-Risk  List since 2015.

Program Management Improvement Accountability Act (PMIAA): Enacted in December 2016, the act is intended to improve program and project management in certain larger federal agencies. Among other things, the act requires the Deputy Director for Management of OMB to adopt and oversee implementation of government-wide standards, policies, and guidelines for program and project management in executive agencies. The act also requires the Deputy Director to conduct portfolio reviews to address programs we identify as high-risk. It further creates a Program Management Policy Council to act as the principal interagency forum for improving practices related to program and project management. The council is to review programs identified as high-risk and make recommendations to the Deputy Director or designee.

OMB has produced a general strategy for implementing the law through 2022 and met some initial milestones required by PMIAA. For example, in June 2018, OMB issued OMB Memorandum M- 18-19, which includes: (1) agency guidance for implementing PMIAA, (2) a five-year strategic outline for improving program and project management, and (3) initial program management standards and principles. Further, agencies have designated Program Management Improvement Officers to guide their implementation of PMIAA.

According to OMB, it began implementing PMIAA’s requirement to  conduct portfolio reviews on high-risk areas by requiring relevant  agencies to provide several items for discussion during the 2018  Strategic Review meetings. These annual meetings are to consist  primarily of a discussion of agency progress towards each of the  strategic objectives outlined in their strategic plans, but also cover  other management topics such as enterprise risk management  and high-risk area progress. According to OMB documents, in  advance of these meetings, OMB required agencies to provide a  high-level summary of (1) any disagreements with our  recommendations, (2) progress barriers, and (3) actions needed  by OMB, other agencies, or Congress to help the agency achieve  progress towards removal from our High-Risk List.

OMB officials told us their 2018 Strategic Review meetings did not  address each high-risk area but did address government-wide  high-risk areas, such as cybersecurity, information technology,  and strategic human capital as they related to the President’s  Management Agenda.

In the past, senior management officials from OMB, applicable  agencies, and our agency have met to address areas where  additional management attention could be beneficial to high-risk  issues. These trilateral meetings, beginning in 2007 and pre- dating PMIAA’s 2016 enactment, have continued across  administrations.

However, OMB has organized only one of these high-risk  meetings since the last high-risk update in 2017, on the  Government-wide Personnel Security Clearance Process. In  November 2018, OMB told us of plans to hold additional meetings  on priority high-risk areas, including the 2020 Decennial Census,  Strategic Human Capital Management, Ensuring the  Cybersecurity of the Nation, National Aeronautics and Space  Administration (NASA) Acquisition Management, and Managing  Federal Real Property.

Effective implementation of PMIAA provides an important  opportunity to enhance progress on high-risk areas by focusing  leadership attention through the portfolio reviews and trilateral  meetings. Further, a number of high-risk areas have longstanding  or significant program and project management concerns,  including the acquisition-related high-risk areas for DOD, DOE,  NASA, and VA. These and other programs can benefit from  improving program and project management. In December 2019,  we will report on OMB’s progress in implementing PMIAA,  including what further steps it has taken to use the portfolio review  process required in PMIAA to address issues on our High-Risk  List.

Executive Branch Action on Our Recommendations Aided Progress on High- Risk Issues

Agency leaders took actions to implement our recommendations. These  resulted in numerous improvements to programs and operation and  improved service. Further, these actions to implement our  recommendations resulted in significant financial benefits. Table 4 shows  some examples of the financial benefits achieved since our last High-Risk  Report.

High-Risk Areas Needing Significant Attention

In the 2 years since our last High-Risk Report, three areas—NASA  Acquisition Management, Transforming EPA's Process for Assessing and  Controlling Toxic Chemicals, and Limiting the Federal Government's  Fiscal Exposure By Better Managing Climate Change Risks—have  regressed in their ratings against our criteria for removal from the High- Risk List. In addition, while progress is needed across all high-risk areas,  we have identified nine additional areas that require significant attention  to address imminent, longstanding, or particularly broad issues affecting  the nation.

NASA plans to invest billions of dollars in the coming years to explore  space, improve its understanding of the Earth’s environment, and conduct  aeronautics research, among other things. We designated NASA’s  acquisition management as high risk in 1990 in view of NASA’s history of  persistent cost growth and schedule delays in the majority of its major  projects.

Following several years of continuing a generally positive trend of limiting  cost growth and schedule delays for its portfolio of major projects, we  found that NASA’s average launch delay increased from 7 to 12 months  between May 2017 and May 2018. Further, the overall development cost  growth increased from 15.6 percent to at least 18.8 percent over the  same time period. NASA’s largest science project, the James Webb  Space Telescope, has experienced schedule delays of 81 months and  cost growth of 95 percent since the project’s cost and schedule baseline  was first established in 2009.

NASA is at risk for continued cost growth and schedule delays in its  portfolio of major projects. Since our 2017 high-risk update, we have  lowered NASA acquisition management from meeting the rating to  partially meeting the rating in two criteria—leadership commitment and  monitoring. The other three criteria ratings remained the same as in 2017.  Ratings for capacity and demonstrated progress remain partially met and  the rating for action plan remains met.

Over the next several years, NASA plans to add new, large, and complex  projects to the portfolio, including a lunar Gateway—currently being  discussed as a platform in a lunar orbit to mature deep space exploration  capabilities. In addition, many of NASA’s current major projects, including  some of the most expensive ones, are in the phase of their life cycles  when cost growth and schedule delays are most likely.

NASA acquisition management requires significant attention for the  following reasons:

NASA leadership has approved risky programmatic decisions for complex major projects, which compounded technical challenges. For example, leadership has approved some programs to proceed (1) with low cost and schedule reserves, (2) with overly aggressive schedules, and (3) without following best practices for establishing reliable cost and schedule baselines.

NASA leadership has also not been transparent about cost and schedule estimates for some of its most expensive projects. Without transparency into these estimates, both NASA and Congress have limited data to inform decision making.

NASA has not yet instituted a program for monitoring and independently validating the effectiveness and sustainability of the corrective action measures in its new action plan, which NASA finalized in December 2018.

In addition, while NASA has taken some steps to build capacity to help  reduce acquisition risk, including updating tools aimed at improving cost  and schedule estimates, other areas still require attention. For example,  we reported in May 2018 that several major NASA projects experienced  workforce challenges, including not having enough staff or staff with the  right skills. NASA has also identified capability gaps in areas such as  scheduling, earned value management, and cost estimating, and has  efforts underway to try to improve capacity in these areas.

Since 2017, we have made 9 recommendations on this high-risk area,  and as of December 2018, 15 recommendations remain open. These  recommendations include that NASA needs to improve transparency of  major project cost and schedule estimates, especially for its human  spaceflight programs, as well as continue to build capacity to reduce  acquisition risk. NASA will also need to implement its new action plan and  track progress against it. See page 222 of the report for additional detail  on this high-risk area, including more details on actions that need to be  taken.

Transforming EPA's Process for Assessing and Controlling Toxic Chemicals

The Environmental Protection Agency’s (EPA’s) ability to effectively  implement its mission of protecting public health and the environment is  dependent on it assessing the risks posed by chemicals in a credible and  timely manner. Such assessments are the cornerstone of scientifically  sound environmental decisions, policies, and regulations under a variety  of statutes.

Based on our work since our 2017 High-Risk Report, the overall rating for  leadership commitment decreased from met to partially met due to limited  information for completing chemical assessments and proposed budget  cuts in the Integrated Risk Information System (IRIS) Program. The  ratings for the remaining four criteria remain unchanged and are partially  met.

The EPA Acting Administrator indicated his commitment to fulfill the  agency’s obligations under the Toxic Substances Control Act (TSCA) as  amended by the 2016 Frank R. Lautenberg Chemical Safety for the 21  Century Act (Lautenberg Act) and ensure chemicals in the marketplace  are safe for human health and the environment. Nonetheless, EPA needs  to give more attention to several areas to fully realize the benefits of the  new law, and to demonstrate additional progress in the IRIS Program,  such as:

While EPA released a document in late December 2018 called the IRIS Program Outlook, the Outlook fails to list the projected date for most of the assessments and includes no information regarding assessment prioritization—including how these assessments will meet program and regional office needs.

The Lautenberg Act increases both EPA’s responsibility for regulating chemicals and its workload. EPA recently issued a rule under the act to collect fees from certain companies to defray a portion of the implementation costs, but it is unclear whether the fees collected will be sufficient to support relevant parts of the program.

EPA issued a First Year Implementation Plan in June 2016 noting that this document is intended to be a roadmap of major activities EPA will focus on during the initial year of implementation. As of mid-February 2019 the plan has not been updated, according to publically available information, although EPA had indicated that it is a living document that will be further developed over time.

EPA needs to ensure that the people and resources dedicated to the  IRIS Program and TSCA implementation are sufficient. Our March 2019  report on chemical assessments provides information on what remains to  be done to address challenges in the IRIS program and implement the  Lautenberg Act.

Since we added this area to our High-Risk List in 2009, we have made 12  recommendations to EPA related to IRIS and TSCA. As of February  2019, seven recommendations remain open. See page 204 of the report  for additional detail on this high-risk area, including more details on  actions that need to be taken.

Limiting the Federal Government's Fiscal Exposure by Better Managing Climate Change Risks

Numerous studies have concluded that climate change poses risks to  many environmental and economic systems and creates a significant  fiscal risk to the federal government. The rising number of natural  disasters and increasing reliance on the federal government for  assistance is a key source of federal fiscal exposure. As of December  2018, total federal funding for disaster assistance since 2005 is  approaching half a trillion dollars (about $430 billion), most recently for  catastrophic hurricanes, flooding, wildfires, and other losses in 2017 and  2018. The costliness of disasters is projected to increase as extreme  weather events become more frequent and intense due to climate  change. There are five areas where government-wide action is needed to  reduce federal fiscal exposure, including, but not limited to, the federal  government’s role as (1) the insurer of property and crops; (2) the  provider of disaster aid; (3) the owner or operator of infrastructure; (4) the  leader of a strategic plan that coordinates federal efforts and informs  state, local, and private-sector action; and (5) the provider of data and  technical assistance to decision makers.

Neither global efforts to mitigate climate change causes nor regional  adaptation efforts currently approach the scales needed to avoid  substantial damages to the U.S. economy, environment, and human  health over the coming decades, according to the November 2018 Fourth  National Climate Assessment. Government-wide action is needed to  improve the nation’s resilience to natural hazards and reduce federal  fiscal exposure to climate change impacts.

Congress continues to show its commitment to progress on this high-risk  issue by enacting legislation. For example, in October 2018, the Disaster  Recovery Reform Act was enacted, which, among other things, allows the  President to set aside, with respect to each major disaster, a percentage  of certain grants to use for pre-disaster hazard mitigation. In addition, the  National Defense Authorization Act of 2018, required, among other  things, DOD to report on climate impacts to its installations. However, the  federal government has not made measurable progress since 2017 to  reduce its fiscal exposure to climate change, and in some cases, has  revoked prior policies designed to do so. Specifically, since 2017, the  ratings for four criteria remain unchanged—three at partially met and one  at not met. The rating for one criterion—monitoring—regressed to not  met.

Limiting the federal government’s fiscal exposure to climate change  requires significant attention because the federal government has  revoked prior policies that had partially addressed this high-risk area and  has not implemented several of our recommendations that could help  reduce federal fiscal exposure. For example, since our 2017 high-risk  update, the federal government:  revoked Executive Order 13690, which had established a government-wide federal flood risk management standard to improve the resilience of communities and federal assets against the impacts of flooding. This action could increase federal fiscal exposure, as taxpayer-funded projects may not last as long as intended because they are not required to account for future changes in climate-related risk. rescinded its guidance directing agencies to consider climate change in their National Environmental Policy Act of 1969 reviews for certain types of federal projects. has not implemented our July 2015 recommendation to establish a comprehensive investment strategy identifying, prioritizing, and implementing federal disaster resilience investments that could reduce federal fiscal exposure to climate change. has not implemented our November 2015 recommendations to create a national climate information system providing authoritative, accessible information useful for state, local, and private-sector decision making.

We have made 62 recommendations related to this high-risk area, 12 of  which were made since our February 2017 high-risk update. As of  December 2018, 25 remain open. The federal government needs a  cohesive strategic approach with strong leadership and the authority to  manage climate change risks across the entire range of federal activities.

See page 110 of the report for additional detail on this high-risk area,  including more details on actions that need to be taken.

Additional High-Risk Areas That Need Significant Attention

Ensuring the Cybersecurity of the Nation

Federal agencies and the nation’s critical infrastructures—such as  energy, transportation systems, communications, and financial services— are dependent on information technology systems to carry out operations.  The security of these systems and the data they use is vital to public  confidence and national security, prosperity, and well-being. The risks to  systems underpinning the nation’s critical infrastructure are increasing as  security threats evolve and become more sophisticated.

We first designated information security as a government-wide high-risk  area in 1997. This was expanded to include protecting cyber critical  infrastructure in 2003 and protecting the privacy of personally identifiable  information in 2015. In 2018, we updated this high-risk area to reflect the  lack of a comprehensive cybersecurity strategy for the federal  government.

Since 2010, we have made over 3,000 recommendations to agencies  aimed at addressing cybersecurity shortcomings, including protecting  cyber critical infrastructure, managing the cybersecurity workforce, and  responding to cybersecurity incidents. Of those 3,000 recommendations,  448 were made since our last high-risk update in February 2017.  Although many recommendations have been addressed, about 700 have  not yet been implemented.

Despite the number of unimplemented recommendations, since our 2017  High-Risk Report, the administration has made progress in this high-risk  area as it continues to meet the leadership commitment criterion through  various actions. These include the President issuing (1) an executive  order in May 2017 requiring federal agencies to take a variety of actions,  including better managing their cybersecurity risks and coordinating to  meet reporting requirements related to cybersecurity of federal networks  and critical infrastructure and (2) a National Security Strategy in  December 2017 citing cybersecurity as a national priority and identifying  needed actions. Further, the administration issued a government-wide  reform plan and reorganization recommendations in June 2018 with,  among other things, proposals for solving the federal cybersecurity  workforce shortage. Additionally, the administration released a National  Cyber Strategy in September 2018 outlining activities such as securing  critical infrastructure, federal networks, and associated information.

However, additional actions are needed. We have identified four major  cybersecurity challenges facing the nation: (1) establishing a  comprehensive cybersecurity strategy and performing effective oversight,  (2) securing federal systems and information, (3) protecting cyber critical infrastructure, and (4) protecting privacy and sensitive data. To address the four major cybersecurity challenges, we identified 10 critical actions the federal government and other entities need to take. These critical actions include, for example, developing and executing a more comprehensive federal strategy for national cybersecurity and global cyberspace; addressing cybersecurity workforce management challenges; and strengthening the federal role in protecting the cybersecurity of critical infrastructure (see figure 3).

Until these shortcomings are addressed, federal agencies’ information  and systems will be increasingly susceptible to the multitude of cyber- related threats that exist. See page 178 of the report for additional detail  on this high-risk area, including more details on actions that need to be  taken.

Resolving the Federal Role in Housing Finance

The expanded federal role in housing finance that began during the  2007–2009 financial crisis has substantially increased the government’s  exposure to potential mortgage losses. Federally supported mortgages  include those backed by the Federal National Mortgage Association  (Fannie Mae) and the Federal Home Loan Mortgage Corporation (Freddie  Mac)—collectively, the enterprises—which the Federal Housing Finance  Agency (FHFA) placed into government conservatorships in 2008.  Federal support also occurs through Federal Housing Administration  (FHA) mortgage insurance and Government National Mortgage  Association (Ginnie Mae) guarantees on mortgage-backed securities. The  substantial financial assistance the enterprises required during and after  the crisis, coupled with the large fiscal exposure they and other federal  mortgage entities represent today, underscore the need to reform the  federal role in housing finance.

Delay in resolving the federal role in housing finance poses considerable  risks. Through the enterprises, FHA, and Ginnie Mae, the federal  government is exposed to potential losses on several trillion dollars in  mortgage debt. A severe economic downturn could trigger significant  taxpayer assistance to one or more of these entities.

Congress and federal agencies have taken some steps to facilitate the  transition to a revised federal role, such as holding hearings, introducing  legislation, issuing regulations, and developing market monitoring tools.  For example, in 2013 and 2014, housing and regulatory agencies  finalized rules designed to prevent a recurrence of risky practices in  originating and securing mortgages that contributed to the financial crisis.  Additionally, FHFA and the Consumer Financial Protection Bureau have  developed a representative database of mortgage information that could  be useful for examining the effect of mortgage market reforms. However,  overall progress on resolving the federal role will be difficult to achieve  until Congress provides further direction by enacting changes to the  housing finance system.

Several issues contribute to the risks facing federal housing finance,  including the following:

More than 10 years after entering federal conservatorships, the enterprises’ futures remain uncertain and billions of taxpayer dollars remain at risk. Under agreements with the Department of the Treasury (Treasury), the enterprises have received $191.4 billion in capital support as of the end of fiscal year 2018 and have paid dividends to the department exceeding that amount. If they were to incur major additional losses, they would draw required amounts from their remaining $254.1 billion in Treasury commitments. In addition, prolonged conservatorships could hinder development of the broader mortgage securities market by creating uncertainty and crowding out private investment.

Nonbanks (lenders and loan servicers that are not depository institutions) have played an increasingly large role in the mortgage market in recent years. While nonbanks have helped provide access to mortgage credit, they also may pose additional risks, in part because they are not federally regulated for safety and soundness. However, FHFA lacks statutory authority to examine nonbank mortgage servicers and other third parties who do business with and pose potential risks to the enterprises.

The statutory 2 percent capital requirement for FHA’s $1.26 trillion mortgage insurance fund is not based on a specified risk threshold, such as the economic conditions the fund would be expected to withstand. As a result, it may not provide an adequate financial cushion under scenarios in which Congress may anticipate the fund would be self-sufficient. During the last housing downturn, the fund’s capital ratio fell below the required level and remained there for 6 consecutive years. At the end of fiscal year 2013, the fund required supplemental funds—about $1.7 billion—for the first time in its history.

Six of our federal housing recommendations remain open, including those  we made in June 2015 on assessing the effects of mortgage reforms  already in place.

Further, as we previously recommended in November 2016 and January  2019, Congress should consider housing finance reform legislation that:  establishes objectives for the future federal role in housing finance, including the role and structure of the enterprises within the housing finance system; provides a transition plan to a reformed system that enables the enterprises to exit federal conservatorship; and addresses all relevant federal entities, including FHA and Ginnie Mae.

As we recommended in March 2016 and November 2017, respectively,  Congress also should consider granting FHFA explicit authority to  examine nonbank servicers and other third parties that do business with  the enterprises, and specifying the economic conditions FHA’s insurance  fund would be expected to withstand without a substantial risk of requiring  supplemental funds. See page 95 of the report for additional detail on this  high-risk area, including more details on actions that need to be taken.

Due to the significance and risk associated with Resolving the Federal  Role in Housing Finance, we are separating it from the high-risk area of  Modernizing the U.S. Financial Regulatory System. These areas were  combined in our 2017 High-Risk report. See page 95 of the report for  additional detail on this high-risk area, including more details on actions  that need to be taken.

Pension Benefit Guaranty Corporation Insurance Programs

The Pension Benefit Guaranty Corporation (PBGC) is responsible for  insuring the defined benefit pension plans for nearly 37 million American  workers and retirees, who participate in about 24,800 private sector  plans. PBGC faces an uncertain financial future due, in part, to a long- term decline in the number of traditional defined benefit plans and the  collective financial risk of the many underfunded pension plans that  PBGC insures.

PBGC’s financial portfolio is one of the largest of all federal government  corporations. While PBGC’s single employer program had a net surplus  of about $2.4 billion at the end of fiscal year 2018, its multiemployer  program had a net deficit of about $54 billion—or a combined net  accumulated financial deficit of over $51 billion. Its deficit has increased  by nearly 45 percent since fiscal year 2013. PBGC has estimated that,  without additional funding, its multiemployer insurance program will likely  be exhausted by 2025 as a result of current and projected pension plan  insolvencies. The agency’s single-employer insurance program is also at  risk due to the continuing decline of traditional defined benefit pension  plans, as well as premiums that are not well aligned to the financial risk  presented by the plans it insures.

While Congress and PBGC have taken significant and positive steps to  strengthen the agency in the past 5 years, challenges related to PBGC’s  funding and governance structure remain. Congress established a  temporary Joint Select Committee on multiemployer pension plans in  2018—with the goal of improving the solvency of the multiemployer  program. However, the committee did not release draft legislation.  Addressing the significant financial risk and governance challenges that  PBGC faces will require additional congressional action.

Over the years since we added PBGC to the High-Risk List, we have  suggested a number of matters for congressional consideration,  including: (1) authorizing a redesign of PBGC’s single employer program  premium structure to better align premium rates with sponsor risk; (2)  adopting additional changes to PBGC’s governance structure—in  particular, expanding the composition of its board of directors; (3)  strengthening funding requirements for plan sponsors as appropriate  given national economic conditions; (4) working with PBGC to develop a  strategy for funding PBGC claims over the long term as the defined  benefit pension system continues to decline; and (5) enacting additional  structural reforms to reinforce and stabilize the multiemployer system,  and balance the needs and potential sacrifices of contributing employers,  participants, and the federal government.

Absent additional steps to improve PBGC’s finances, the long-term  financial stability of the agency remains uncertain, and the retirement  benefits of millions of American workers and retirees could be at risk of  dramatic reductions. See page 267 of the report for additional detail on  this high-risk area, including more details on actions that need to be  taken.

Managing Risks and Improving VA Health Care

VA operates one of the largest health care delivery systems in the nation  through its Veterans Health Administration (VHA), with 172 medical  centers and more than 1,000 outpatient facilities organized into regional  networks. VA has faced a growing demand by veterans for its health care  services—due, in part, to the needs of an aging veteran population—and  that trend is expected to continue. The total number of veterans enrolled  in VA’s health care system rose from 7.9 million to more than 9 million  from fiscal year 2006 through fiscal year 2017. Over that same period,  VHA’s total budgetary resources have more than doubled, from $37.8  billion in fiscal year 2006 to $92.3 billion in fiscal year 2017.

Given the importance of VHA’s mission, coupled with its lack of progress  in addressing its high-risk designation, we continue to be concerned  about VHA’s ability to ensure its resources are being used effectively and  efficiently to improve veterans’ timely access to safe and high-quality  health care. We have identified five areas of concern: (1) ambiguous  policies and inconsistent processes; (2) inadequate oversight and  accountability; (3) IT challenges; (4) inadequate training for VA staff; and  (5) unclear resource needs and allocation priorities. VHA has begun to address each of these areas but, prior to Secretary Robert Wilkie’s July 2018 confirmation, its efforts were impeded by leadership instability. Since taking office, Secretary Wilkie has demonstrated his commitment to addressing the department’s high-risk designation by, among other things, creating an office to direct an integrated, focused high-risk approach and communicating to VA leaders the importance of addressing our recommendations.

While VHA completed root cause analyses for each area of concern and  developed an action plan in response, the plan lacks milestones and  metrics needed to effectively monitor its implementation and demonstrate  progress made in addressing the high-risk designation. Additionally, many  of VHA’s capacity-building initiatives are either in the initial stages of  development or are lacking necessary funding and resources. As such,  VHA has not made sufficient progress since our 2017 update to improve  its overall ratings, as two high-risk criteria remain partially met and three  criteria remain unmet.

We remain concerned about VHA’s ability to oversee its programs, hold  its workforce accountable, and avoid ambiguous policies and inconsistent  processes that jeopardize its ability to provide safe, high-quality care to  veterans:   In November 2017, we reported that, due in part to misinterpretation or lack of awareness of VHA policy, VA medical center officials did not always document or conduct timely required reviews of providers when allegations were made against them. As a result, we concluded that VA medical center officials may have lacked necessary information to reasonably ensure that their providers were competent to provide safe, high-quality care to veterans and to grant approvals about these providers’ privileges to perform specific clinical services at VA medical centers. We made four recommendations related to this and other findings, all of which remain open.

In June 2018, we reported that VHA could not systematically monitor the timeliness of veterans’ access to Veterans Choice Program (VCP) care because it lacked complete, reliable data to do so. We also found that veterans, who were referred to the VCP for routine care because health care services were not available in a timely manner, could potentially wait for care up to 70 calendar days if the maximum amount of time allowed by VA processes is used. This wait time exceeds the statutory requirement that veterans receive VCP care within 30 days of the dates their VA health care providers indicated  they should receive appointments, or if no such date existed, within  30 days of the veteran’s preferred date. We made 10  recommendations related to this and other findings, all of which  remain open.

Similarly, in July 2018, we reported that VA collected data related to employee misconduct and disciplinary actions, but data fragmentation and reliability issues impeded department-wide analysis of those data. Additionally, we found that VA did not consistently ensure that allegations of misconduct involving senior officials were reviewed according to its investigative standards or ensure these officials were held accountable. We made 16 recommendations related to this and other findings, all of which remain open.

In November 2018, we reported that VHA’s suicide prevention media outreach activities declined in recent years due to leadership turnover and reorganization. Additionally, we found that VHA did not assign key leadership responsibilities or establish clear lines of reporting for its suicide prevention media outreach campaign, which hindered its ability to oversee the campaign. Consequently, we concluded that VHA may not be maximizing its reach with suicide prevention media content to veterans, especially those who are at-risk. This is inconsistent with VHA’s efforts to reduce veteran suicides, which is VA’s highest clinical priority. We made two recommendations related to this and other findings, both of which remain open.

VA needs to further develop its capacity-building initiatives and establish  metrics to monitor and measure its progress addressing the high-risk  areas of concern. It is also important that our recommendations continue  to be implemented. The department has implemented 209 of the 353  recommendations related to VA health care that we made from January  1, 2010 through December 2018, but more than 125 recommendations  remain open as of December 2018. This includes 17 that are older than 3  years. In addition to addressing our recommendations, VA needs to make  systemic change to department management and oversight in order to  fully address the high-risk issues and improve the health care provided to  our nation’s veterans.

See page 275 of the report for additional detail on this high-risk area,  including more details on actions that need to be taken.

Mission-critical skills gaps both within federal agencies and across the  federal workforce impede the government from cost-effectively serving  the public and achieving results. For example, the difficulties in recruiting  and retaining skilled health care providers and human resource staff at  VHA’s medical centers make it difficult to meet the health care needs of  more than 9 million veterans. As a result, VHA’s 168 medical centers  have large staffing shortages, including physicians, registered nurses,  physician assistants, psychologists, physical therapists, as well as human  resource specialists and assistants.

OPM continues to demonstrate top leadership commitment through its  numerous efforts to assist agencies’ in addressing mission-critical skills  gaps within their workforces. This includes providing guidance, training  and on-going support for agencies on the use of comprehensive data  analytic methods for identifying skills gaps and the development of  strategies to address these gaps. However, since we first added strategic  human capital management to our High-Risk List in 2001, we have  reported on the need for agencies to address their workforce skills gaps.

As of December 2018, OPM had not fully implemented 29 of our  recommendations made since 2012 relating to this high-risk area. Staffing  shortages and the lack of skills among current staff not only affect  individual agencies but also cut across the entire federal workforce in  areas such as cybersecurity and acquisition management. Skills gaps  caused by insufficient number of staff, inadequate workforce planning,  and a lack of training in critical skills are contributing to our designating  other areas as high-risk.

As table 5 shows, of the 34 other high-risk areas covered in this report,  skills gaps played a significant role in 16 of the areas.

Over the years since we added this area to our High-Risk List, in addition  to recommendations to address critical skills gaps in individual high-risk  areas, we have made numerous recommendations to OPM related to this  high-risk issue, 29 of which remain open. Agencies also need to take  action to address mission-critical skills gaps within their own workforces –  a root cause of many high-risk areas. See page 75 of the report for  additional detail on this high-risk area, including more details on actions  that need to be taken.

The 2010 Census was the costliest in history at about $12.3 billion; as of  October 2017, the 2020 Census is projected to cost about $15.6 billion, a  27 percent increase. For the 2020 Census, the U.S. Census Bureau  (Bureau) plans to implement several innovations, including new IT  systems. Implementing these innovations, along with other challenges,  puts the Bureau’s ability to conduct a cost-effective census at risk.

The decennial census is mandated by the U.S. Constitution and provides  vital data for the nation. Census data are used, among other purposes, to  apportion seats in the Congress and allocate billions of dollars in federal  assistance to state and local governments. To ensure its success, this  complicated and costly undertaking requires careful planning, risk  management, and oversight. Census activities, some of which are new for  the 2020 cycle, must be carried out on schedule to deliver the state  apportionment counts to the President by December 31, 2020.

The Bureau and the Department of Commerce (Commerce) have  strengthened leadership commitment with executive-level oversight of the  2020 Census by holding regular meetings on the status of IT systems and  other risk areas. In addition, in 2017 Commerce designated a team to  assist senior Bureau management with cost estimation challenges. These  examples demonstrate both the Bureau’s and Commerce’s strong  leadership commitment to implementing the 2020 Census.

One of the Bureau’s major challenges is to control any further cost growth  and develop cost estimates that are reliable and reflect best practices for  the 2020 Census. According to the Bureau, the total cost of the 2020  Census is now estimated to be approximately $15.6 billion, more than $3  billion higher than previously estimated by the Bureau. The higher  estimated life-cycle cost is due, in part, to the Bureau’s failure to  previously include all cost associated with the decennial census.

The Bureau’s schedule for developing IT systems has experienced delays  that have compressed the time available for system testing, integration  testing, and security assessments. These schedule delays have  contributed to systems experiencing problems after deployment, as well  as cybersecurity challenges. For example, as of December 2018, the  Bureau had identified nearly 1,100 system security weaknesses that  needed to be addressed. Continued schedule management challenges  may compress the time available for the remaining system testing and  security assessments, and increase the risk that deployed systems will  either not function as intended, have security vulnerabilities, or both.

As of January 2019, 30 of our recommendations related to this high-risk  area had not been implemented. To make continued progress, the  Bureau needs to ensure that its approach to strategic planning, IT  management, cybersecurity, human capital management, internal  collaboration, knowledge sharing, as well as risk and change  management are all aligned toward delivering more cost-effective  outcomes. Among other things, the Bureau needs to ensure cost growth  is controlled and that the development and testing of key systems is  completed and fully integrated with all census operations before the 2020  Census. In addition, the Bureau needs to address cybersecurity  weaknesses in a timely manner and ensure that security risks are at an  acceptable level before systems are deployed. See page 134 of the  report for additional detail on this high-risk area, including more details on  actions that need to be taken.

Medicare, Medicaid, and Earned Income Tax Credit Improper Payments

An improper payment is any payment that should not have been made or  that was made in an incorrect amount (including overpayments and  underpayments) under statutory, contractual, administrative, or other  legally applicable requirements. Reducing improper payments—such as  payments to ineligible recipients or duplicate payments—is critical to  safeguarding federal funds. However, the federal government has  consistently been unable to determine the full extent of improper  payments and reasonably assure that appropriate actions are taken to  reduce them.

Since 2003—when certain agencies were required by statute to begin  reporting improper payments—cumulative improper payment estimates  have totaled about $1.5 trillion. As shown in figure 4, for fiscal year 2018,  federal entities estimated about $151 billion in improper payments.  Medicare and Medicaid improper payments and the Earned Income Tax  Credit (EITC) improper payments—a part of the Enforcement of Tax Laws  high-risk area—accounted for about 68.5 percent of this total.

Federal spending for Medicare programs and Medicaid is expected to  significantly increase in the coming years, so it is especially critical to take  appropriate measures to reduce improper payments in these programs.  Internal Revenue Service estimates also show that the EITC has  consistently had a high improper payment rate. OMB has designated  Medicare programs, Medicaid, and EITC as high-priority programs for  improper payments, indicating they are amongst the highest-risk  programs where the government can achieve the greatest return on  investment for the taxpayer by ensuring that improper payments are  eliminated.

Our work has identified a number of strategic and specific actions  agencies can take to reduce improper payments, which could yield  significant savings, and help ensure that taxpayer funds are adequately  safeguarded. Continued agency attention is needed to (1) identify  susceptible programs, (2) develop reliable methodologies for estimating  improper payments, (3) report as required by statute, and (4) implement  effective corrective actions based on root cause analysis. Absent such  continued efforts, the federal government cannot be assured that  taxpayer funds are adequately safeguarded.

See pages 241, 250, and 235 of the report (respectively) for additional  detail on the Medicare Program & Improper Payments, Strengthening  Medicaid Program Integrity, and Enforcement of Tax Laws high-risk  areas, including more details on actions that need to be taken.

The Internal Revenue Service (IRS) continues to face two pressing  challenges in enforcing tax laws: addressing the tax gap—amounting to  hundreds of billions of dollars each year when some taxpayers fail to pay  the taxes that they owe—and combatting identity theft (IDT) refund fraud.  Enforcement of Tax Laws has been on GAO’s high risk list since 1990.

IRS enforcement of tax laws helps fund the U.S. government by collecting  revenue from noncompliant taxpayers and, perhaps more importantly,  promoting voluntary compliance by giving taxpayers confidence that  others are paying their fair share. In 2016, IRS estimated that the average  annual net tax gap, the difference between taxes owed and taxes paid on  time, was $406 billion, on average, for tax years 2008-2010.

While IRS continues to demonstrate top leadership support to address  the tax gap, IRS’s capacity to implement new initiatives and improve  ongoing enforcement and taxpayer service programs remains a  challenge. For example, IRS’s strategic plan includes a goal to facilitate  voluntary compliance and deter noncompliance that could address the tax  gap. However, IRS could do more to identify specific efforts for improving  compliance in its strategic plan, measure the effects of compliance  programs—such as those used for large partnerships—and develop  specific quantitative goals to reduce the tax gap. Such efforts would help  IRS make more effective use of its resources and gauge the success of  its strategies.

The second challenge facing IRS is IDT refund fraud, which occurs when  an identity thief files a fraudulent tax return using a legitimate taxpayer’s  identifying information and claims a refund. IRS estimates that at least  $12.2 billion in individual IDT tax refund fraud was attempted in 2016, of  which it prevented at least $10.5 billion (86 percent). Of the amount  attempted, IRS estimated that at least $1.6 billion (14 percent) was paid.

IRS’s ability to combat IDT fraud continues to be challenged as more  personally identifiable information has become readily available as a  result of large-scale cyberattacks on various entities. This makes it more  difficult for IRS to distinguish between fraudsters and legitimate  taxpayers.

While IRS has demonstrated some progress by developing tools and  programs to further detect and prevent IDT refund fraud, it has not  completed updating its authentication procedures to be in compliance  with new government standards. As a result, IRS may be missing an  opportunity to implement the most secure, robust technologies to protect  taxpayers.

As of December 2018, 189 GAO recommendations related to this high- risk area had not been implemented. To make continued progress on  closing the tax gap, IRS needs to re-establish goals for improving  voluntary compliance and develop and document a strategy that outlines  how it will use its data to help address this issue. Reducing the tax gap  will also require targeted legislative actions, including additional third- party information reporting, enhanced electronic filing, expanded math  error authority (also referred to as correctible error authority), and paid  preparer regulation. To help stay on top of IDT refund fraud, IRS should  develop a comprehensive process to evaluate alternative options for  improving taxpayer authentication. Given that IDT refund fraud continues  to be a challenge, targeted legislative action, such as requiring a  scannable code on returns prepared electronically but filed on paper  could help IRS address such fraud.

See page 235 of the report for additional detail on this high-risk area,  including more details on actions that need to be taken.

Improving the Management of IT Acquisitions and Operations

The federal government currently invests more than $90 billion annually  in IT, and OMB has implemented several key initiatives intended to help  better manage this investment. Additionally, enactment of FITARA, in  conjunction with greater attention paid to the acquisition and operation of  IT, has helped further improve the government-wide management of this  significant annual investment. OMB’s current level of top leadership  support and commitment to ensure that agencies successfully execute its  guidance on implementing FITARA and related IT initiatives has helped  this high-risk area meet the leadership commitment high-risk criteria.

Additional positive government-wide actions have enabled this high-risk  area to partially meet the four remaining high-risk criteria. For example,  OMB has established an IT Dashboard—a public website that provides  detailed information on major IT investments at 26 federal agencies—and  agencies’ data center consolidation efforts have resulted in a total savings  of slightly more than 80 percent of the agencies’ planned $5.7 billion in  savings since 2011. However, major federal agencies have yet to fully  address the requirements of FITARA and realize billions of dollars in  planned or possible savings and improved government performance  through more efficient budgeting and management of IT.

As government-wide spending on IT increases every year, the need for  appropriate stewardship of that investment increases as well. However,  OMB and federal agencies have not made significant progress since  2017 in taking the steps needed to improve how these financial resources  are budgeted and utilized. While OMB has continued to demonstrate its  leadership commitment through guidance and sponsorship of key  initiatives, agencies still have not fully implemented all requirements of  FITARA, such as putting into place authorities the law requires for chief  information officers (CIO). Additionally, while the President’s Management  Agenda has a goal to improve IT spending transparency, agencies are  underreporting IT contract obligations by billions of dollars. OMB and the  agencies also have not yet implemented hundreds of our  recommendations on improving shortcomings in IT acquisitions and  operations.

In an August 2018 review of the 24 federal agencies covered by FITARA,  none had IT management policies that fully addressed the role of their  CIOs consistent with federal laws and guidance. Specifically, the majority  of the agencies only minimally addressed, or did not address, their CIO’s  role in assessing agency IT workforce needs and developing strategies  and plans for meeting those needs. Correspondingly, the majority of the  24 CIOs acknowledged that they were not fully effective at implementing  IT management responsibilities, such as IT strategic planning and  investment management.

Further, in January 2018, we reported that the majority of 22 agencies did  not identify all of their IT acquisition contracts, totaling about $4.5 billion in  IT-related contract obligations beyond those reported by agencies. In  addition, in November 2018 we reported that four selected agencies  lacked quality assurance processes for ensuring that billions of dollars  requested in their IT budgets were informed by reliable cost information.  Until agencies properly identify IT contracts and establish processes for  ensuring the quality of cost data used to inform their budgets, agency  CIOs are at risk of not having appropriate oversight of IT acquisitions and  may lack adequate transparency into IT spending to make informed  budget decisions.

As of December 2018, OMB and federal agencies had fully implemented  only 59 percent of the recommendations we have made since fiscal year  2010 to address shortcomings in IT acquisitions and operations. OMB  and agencies should work toward implementing our remaining 456 open  recommendations related to this high-risk area. These remaining  recommendations include 12 priority recommendations to agencies to,  among other things, report all data center consolidation cost savings to  OMB, plan to modernize or replace obsolete systems as needed, and  improve their implementation of PortfolioStat—an initiative that is to  consolidate and eliminate duplicative systems.

OMB and agencies need to take additional actions to (1) implement at  least 80 percent of our open recommendations related to the  management of IT acquisitions and operations, (2) ensure that a  minimum of 80 percent of the government’s major IT acquisitions deliver  functionality every 12 months, and (3) achieve at least 80 percent of the  over $6 billion in planned PortfolioStat savings.

See page 123 of the report for additional detail on this high-risk area,  including more details on actions that need to be taken.

Our high-risk program continues to be a top priority at GAO and we will  maintain our emphasis on identifying high-risk issues across government  and on providing recommendations and sustained attention to help  address them, by working collaboratively with Congress, agency leaders,  and OMB. As part of this effort, we hope to continue to participate in  regular meetings with the OMB Deputy Director for Management and with  top agency leaders to discuss progress in addressing high-risk areas.  Such efforts have been critical for the progress that has been made.

This high-risk update is intended to help inform the oversight agenda for  the 116th Congress and to guide efforts of the administration and  agencies to improve government performance and reduce waste and  risks.

Thank you, Chairman Cummings, Ranking Member Jordan, and  Members of the Committee. This concludes my testimony. I would be  pleased to answer any questions.

For further information on this testimony, please contact J. Christopher  Mihm at (202) 512-6806 or MihmJ@gao.gov. Contact points for the  individual high-risk areas are listed in the report and on our high-risk  website. Contact points for our Offices of Congressional Relations and  Public Affairs may be found on the last page of this statement.

Appendix I: Areas Removed From the High- Risk List

The following pages provide overviews of the two areas removed from the  High-Risk List. Each overview discusses (1) why the area was high risk,  and (2) why the area is being removed from the list. Each of these high- risk areas is also described on our High-Risk List website,  http://www.gao.gov/highrisk/overview.

Since our 2017 High-Risk Report, DOD has  continued to meet the criteria of leadership  commitment, capacity, and action plan for  asset visibility. Further, DOD has fully  addressed the three remaining actions and  outcomes we outlined in 2017 in order to  mitigate or resolve long-standing  weaknesses in asset visibility.  Consequently, DOD has met the monitoring  and demonstrated progress criteria for  asset visibility to remove this area from our  High-Risk List.

Leadership commitment: met. Senior leaders have continued to  demonstrate commitment through their involvement in groups such as the  Supply Chain Executive Steering Committee—senior-level officials  responsible for overseeing asset visibility improvement efforts—and  through the Asset Visibility Working Group, which identifies opportunities  for improvement and monitors the implementation of initiatives by issuing  its Strategy for Improving DOD Asset Visibility (Strategy) in 2014, 2015,  and 2017.

Capacity: met. DOD continues to demonstrate that it has the capacity— personnel and resources—to improve asset visibility. For example, DOD’s  2015 and 2017 Strategies advise the components to consider items such  as staffing, materiel, and sustainment costs when documenting cost  estimates for the initiatives in the Strategy, as we recommended in  January 2015.

Action plan: met. A provision in the National Defense Authorization Act  for Fiscal Year 2014 required DOD to submit to Congress a  comprehensive strategy and implementation plans for improving asset  tracking and in-transit visibility. In January 2014, DOD issued the Strategy  and accompanying implementation plans, which outlined initiatives  intended to improve asset visibility. DOD updated its 2014 Strategy in  October 2015 and in August 2017.

Importantly, since 2017 DOD addressed the three remaining actions and  outcomes related to the monitoring and demonstrated progress criteria  through updates to and implementation of the Strategies (see table 6).

Monitoring: met. DOD provided guidance in its 2017 update to the  Strategy for the military components to consider key attributes of  successful performance measures during metric development for their  improvement initiatives. As appropriate, the military components have  followed the guidance and provided high-level summary metrics updates  to the Asset Visibility Working Group. In addition, DOD has taken steps to  monitor asset visibility by incorporating into after-action reports, as  appropriate, information relating to performance measures. These after- action reports serve as closure documents and permanent records of  each initiative’s accomplishments.

Demonstrated progress: met. DOD has demonstrated sustained  progress by completing 34 of the 39 initiatives to improve asset visibility  and continues to monitor the remaining 5 initiatives. These initiatives have  supported DOD’s goals and objectives, which include: (1) improving  visibility efficiencies of physical inventories, receipt processing, cargo  tracking, and unit moves; (2) ensuring asset visibility data are  discoverable, accessible, and understandable to support informed  decision-making across the enterprise; and (3) increasing efficiencies for  delivery accuracy and cycle times. Also, the Asset Visibility Working  Group meets regularly to identify opportunities to further improve asset  visibility within DOD.

DOD has taken the following actions to demonstrate sustained progress:  (1) created an integrated single portal system providing 7,500 users  access to near-real-time, in-transit visibility of eight million lines of items  of supply and transportation data; and (2) increased its visibility of assets  through radio-frequency identification (RFID), an automated data-capture  technology that can be used to electronically identify, track, and store  information contained on a tag. There are two main types of RFID tags,  passive and active, which show whether assets are in-storage, in-transit,  in-process, or in-use. Passive tags, such as mass transit passes, do not  contain their own power source and cannot initiate communication with a  reader; while active tags, such as an “E-Z pass,” contain a power source  and a transmitter, and send a continuous signal over longer distances.

DOD closed nine initiatives from its Strategies by implementing RFID  technology. For example, the Marine Corps implemented long-range  passive RFID for visibility and accountability of items, resulting in  improvements that include an increased range for “reading” an item— from 30 feet to 240 feet—and reduced inventory cycle times from 12 days  to 10 hours. Also, the Navy reported that the use of passive RFID  technology to support the overhaul of its nuclear-powered attack  submarines enabled the Navy to better track parts, resulting in 98 percent  fewer missing components and an average cost avoidance of $1.3 million  per boat.

Additionally, according to DOD, the use of RFID tags to provide visibility  of sustainment cargo at the tactical leg resulted in $1.4 million annual cost  savings. Further, DOD reported that the migration of the active RFID  enterprise from a proprietary communication standard to a competitive  multivendor environment reduced the cost of active RFID tags by half,  resulting in an estimated $5.7 million annual reduction in costs.

Since our 2017 High-Risk Report, DOD has  continued to meet the criteria of leadership  commitment, capacity, and action plan for  materiel distribution. Further, DOD has fully  addressed the four remaining actions and  outcomes we outlined in 2017 in order to  mitigate or resolve long-standing  weaknesses in materiel distribution.  Consequently, DOD has met the monitoring  and demonstrated progress criteria for  materiel distribution to remove this area  from our High-Risk List.

Leadership commitment: met. Senior leaders continue to demonstrate  commitment through their involvement in groups such as the Supply  Chain Executive Steering Committee—senior-level officials responsible  for overseeing materiel distribution corrective actions—and through the  Distribution Working Group, which helped develop the Materiel  Distribution Improvement Plan (Improvement Plan) in 2016.

Capacity: met. DOD has continued to demonstrate that it has the  personnel and resources, such as key organizations and the associated  governance structure, to improve materiel distribution. The Improvement  Plan recognizes that additional resources will be required to accomplish  its corrective actions and close any identified performance gaps within the  time frame specified.

Action plan: met. In 2016, DOD developed its corrective action plan to  address the department’s materiel distribution challenges. The  Improvement Plan details specific goals and actions to better measure  the end-to-end distribution process, ensure the accuracy of underlying  data, and strengthen and integrate distribution policies and the  governance structure.

Importantly, since 2017, DOD has fully addressed the four remaining  actions and outcomes related to monitoring and demonstrated progress  to mitigate or resolve long-standing weaknesses in materiel distribution  (see table 7).

Monitoring: met. DOD has monitored materiel distribution by making  progress in developing its suite of distribution performance metrics,  improving the quality of their underlying data, and sharing metrics  information with stakeholders. For example, in January 2017, DOD  developed a suite of performance metrics that provides a comprehensive  picture of the distribution process, including whether supplies are  delivered on time and at sufficient quantity and quality. Also, DOD  implemented checklists to assess the quality of data underlying each  performance metric based on relevance, accuracy, comparability, and  interpretability.

The checklists and their standards assist in identifying root causes and  addressing areas where performance data quality may be lacking. DOD  has also incorporated internal control requirements in its supply chain  management guidance to increase confidence in the performance data.  Additionally, DOD has revised its policy documents to require  stakeholders to routinely capture and share distribution performance  metrics, including cost data, and the department maintains websites to  provide current performance information to distribution stakeholders.

DOD has also incorporated distribution metrics, as appropriate, on the  performance of all legs of the distribution system, including the tactical leg  (i.e., the last segment of the distribution system). We previously reported  on DOD’s deficiencies to accurately assess its distribution performance at  the tactical leg, such as missing delivery dates for shipments in  Afghanistan. Since that time, the geographic combatant commands have  been tracking metrics at the tactical leg, including required delivery dates,  to determine the movement and causes of delays for shipments, and  have been sharing distribution performance information with the U.S.  Transportation Command (TRANSCOM) through their deployment and  distribution operations centers. DOD is implementing a cost framework to  incorporate transportation costs for all legs of the distribution system,  which will provide an additional metric for distribution stakeholders to  assess the efficiency of the system. The first phase of the cost framework  began operating in August 2018 and is expected to be fully implemented  in 2019.

DOD is making progress in refining its Improvement Plan and is  incorporating additional actions based on interim progress and results.  Since DOD issued the Improvement Plan in September 2016, the agency  has (1) documented the results and monitored the status of each  corrective action, (2) revised completion dates as needed, and (3)  periodically provided decision makers with summary action charts, plans,  and milestones. DOD is also updating its instruction on management and  oversight of the distribution enterprise to clarify the roles and  responsibilities of all distribution stakeholders. DOD officials have not  determined a date for when this instruction will be issued.

Demonstrated progress: met. DOD has demonstrated sustained  progress in improving its capability to comprehensively measure  distribution performance, identify distribution problems and root causes,  and implement solutions. DOD has implemented 10 of 18 corrective  actions in its Improvement Plan and is on track to implement the  remaining 8 by September 2019. Because of this progress, DOD’s  monthly shipment reports have assessed performance against enhanced  metrics across the distribution system. For example, in December 2017,  TRANSCOM investigated performance standards for truck deliveries from  its Defense Logistics Agency warehouses in Bahrain to customers in  Kuwait due to frequent delays in shipments. TRANSCOM determined that  inadequate time for clearing customs in Kuwait resulted in an unrealistic  delivery standard.

TRANSCOM, in coordination with distribution stakeholders, adjusted the  delivery standard to adequately account for the in-theater customs  process. In addition, TRANSCOM, in partnership with the Defense  Logistics Agency and the General Services Administration, developed  and implemented initiatives focused on distribution process and  operational improvements to reduce costs and improve distribution  services to the warfighter. According to DOD, these efforts have resulted  in at least $1.56 billion in distribution cost avoidances to date.

DOD has demonstrated commendable, sustained progress improving its  supply chain management. This does not mean DOD has addressed all  risk within this area. It remains imperative that senior leaders continue  their efforts to implement initiatives and corrective actions to maintain  visibility of supplies, track cargo movements, meet delivery standards,  and maintain delivery data for shipments. Continued oversight and  attention are also warranted given the recent reorganization of the Office  of the Under Secretary of Defense for Acquisition and Sustainment and  the resulting change in the oversight structure of Supply Chain  Management. We will therefore continue to conduct oversight of supply  chain management at DOD.

Defense Logistics: Improved Performance Measures and Information  Needed for Assessing Asset Visibility Initiatives. GAO-17-183.  Washington, D.C.: Mar. 16, 2017.

Defense Logistics: DOD Has Addressed Most Reporting Requirements  and Continues to Refine its Asset Visibility Strategy. GAO-16-88.  Washington, D.C.: Dec. 22, 2015.

Defense Logistics: Improvements Needed to Accurately Assess the  Performance of DOD’s Materiel Distribution Pipeline. GAO-15-226.  Washington, D.C.: Feb. 26, 2015.

Mitigating Gaps in Weather Satellite Data

NOAA’s Polar- Orbiting Weather Satellites

Since our last high-risk update in 2017,  NOAA continues to meet the criteria of  leadership commitment, capacity, and  monitoring and now also meets the criteria  of action plan and demonstrated progress.

Leadership commitment: met. NOAA  program officials met the leadership  commitment criteria in 2015 and have  continued to sustain their strong leadership  commitment to mitigating potential satellite  data gaps since that time. For example,  NOAA issued and frequently updated its polar satellite gap mitigation  plan, which identifies the specific technical, programmatic, and  management steps the agency is taking to ensure that satellite mitigation  options are viable. In addition, NOAA executives continue to oversee the  acquisition of polar-orbiting satellites through monthly briefings on the  cost, schedule, and risks affecting the satellites’ development.

Capacity: met. NOAA continues to meet the criterion of improving its  capacity to address the risk of a satellite data gap. In December 2014, we  recommended that NOAA investigate ways to prioritize the gap mitigation  projects with the greatest potential benefit to weather forecasting, such as  by improving its high-performance computing capacity. NOAA agreed  with this recommendation and implemented it. For example, NOAA  upgraded its high-performance computers, which allowed the agency to  move forward on multiple other mitigation activities, including  experimenting with other data sources and assimilating these data into its  weather models.

Action plan: met. NOAA now meets the criterion for having a plan to  address the risk of a polar satellite data gap, which is an increase over its  rating in 2017. In June 2012, we reported that, while NOAA officials  communicated publicly and often about the risk of a polar satellite data  gap, the agency had not established plans to mitigate the gap. We  recommended that NOAA establish a gap mitigation plan, and the agency  did so in February 2014. However, in December 2014, we recommended  that NOAA revise its plan to address shortfalls, including (1) adding  recovery time objectives for key products, (2) identifying opportunities for  accelerating the calibration and validation of satellite data products, (3)  providing an assessment of available alternatives based on their costs  and impacts, and (4) establishing a schedule with meaningful timelines  and linkages among mitigation activities. mitigation plan between January 2016 and February 2017. With the last  of the updates, the agency addressed the shortfalls we had identified.

Monitoring: met. NOAA met this criterion in 2017, and continues to meet  it now, by implementing our recommendations to more consistently and  comprehensively monitor its progress on gap mitigation activities. For  example, all three NOAA organizations responsible for gap mitigation  projects regularly brief senior management on their progress.

Demonstrated progress: met. NOAA now meets the criterion for  demonstrated progress, which is an increase over its prior rating. In our  2017 High-Risk Report, we noted that NOAA had identified 35 different  gap mitigation projects and was making progress in implementing them.  These projects fell into three general categories: (1) understanding the  likelihood and impact of a gap, (2) reducing the likelihood of a gap, and  (3) reducing the impact of a gap. Nevertheless, one of the most important  steps in reducing the likelihood of a gap—keeping the launch of the next  polar satellite on schedule—had encountered problems. Specifically,  agency officials decided to delay the launch due to challenges in  developing the ground system and a critical instrument on the spacecraft.  This delay exacerbated the probability of a satellite data gap.

More recently, however, NOAA was able to demonstrate progress by  successfully launching the satellite in November 2017. That satellite, now  called NOAA-20, is currently operational and is being used to provide  advanced weather data and forecasts. Moreover, the agency is also  working to build and launch the next satellites in the polar satellite  program.

Since our last high-risk update in 2017,  DOD now meets all five high-risk criteria.

Leadership commitment: met. With  strong congressional oversight, DOD now  meets this criterion. Pursuant to enactment  of the Carl Levin and Howard P. ’Buck’  McKeon National Defense Authorization Act  for Fiscal Year 2015 (NDAA for FY 2015),  the National Defense Authorization Act for  Fiscal Year 2016 (NDAA for FY 2016), and  the Consolidated Appropriations Act, 2016,  DOD leadership committed to developing and implementing plans to  address its weather satellite requirements. For example, in late 2017, the  department awarded a contract for its Weather System Follow-on— Microwave satellite to fulfill core weather requirements.

Capacity: met. With strong congressional oversight, DOD now meets the  capacity criterion. Specifically, the NDAA for FY 2015 restricted the  availability of 50 percent of the FY 2015 funds authorized for the Weather  Satellite Follow-on System (now called the Weather System Follow-on— Microwave satellite program) until DOD submitted to the congressional  defense committees a plan to meet weather monitoring data collection  requirements. In addition, the explanatory statement that accompanied  the Consolidated Appropriations Act, 2016, recommended that the Air  Force focus on ensuring that the next generation of weather satellites  meet the full spectrum of requirements and work with civil stakeholders to  leverage appropriate civil or international weather assets.

As called for in the law and the explanatory statement, DOD established  plans to meet weather monitoring data collection needs, including by  acquiring satellites as part of a family of systems to replace its aging  legacy weather satellites. Additionally, DOD formally coordinated with  NOAA on weather monitoring data collection efforts. In January 2017, the  Air Force and NOAA signed a memorandum of agreement, and in  November 2017, signed an annex to that agreement, to allow for the  exchange of information and collaboration on a plan for collecting weather  monitoring data. The Air Force and NOAA are now developing plans to  relocate a residual NOAA satellite over the Indian Ocean, an area of  concern for cloud characterization and area-specific weather imagery  coverage.

Action plan: met. In our 2017 High-Risk Report, we reported that DOD  was slow to establish plans for its Weather System Follow-on–Microwave  program and had made little progress in determining how it would meet  weather satellite requirements for cloud characterization and area-specific  weather imagery. Pursuant to the NDAA for FY 2015, the NDAA for FY  2016, and the explanatory statement that accompanied the Consolidated  Appropriations Act, 2016, the department developed and began  implementing plans to address its weather satellite requirements. As  mentioned above, in late 2017, the department awarded a contract for its  Weather System Follow-on–Microwave satellite to fulfill core weather  requirements. Under this program, the department may launch a  demonstration satellite in 2021 and plans to launch an operational  satellite in 2022. capabilities. DOD plans to launch Operationally Responsive Space-8 as  early as 2022.

Monitoring: met. DOD now meets the monitoring criterion as evidenced  by its actions to initiate a major acquisition program, the Weather System  Follow-on–Microwave, and award a contract for the first satellite. In  addition, program officials stated that they plan to monitor the program’s  progress toward addressing critical needs and assess its operations and  sustainment costs.

Demonstrated progress: met. DOD now meets the demonstrated  progress criterion because it has developed plans and taken actions to  address gaps in weather data through its plans to launch the Weather  System Follow-on–Microwave satellite in 2022. The department also  plans to launch the Electro-Optical/Infrared Weather Systems satellite in  2024 and provide interim capabilities beginning as early as 2022. By  developing these plans, DOD has reduced the risk of a gap in weather  satellite data and addressed the concerns about a lack of planning that  we identified in our 2017 High-Risk Report. DOD’s effective  implementation of its plans will be key to further reducing the risks of gaps  in weather satellite data in the future.

Moving forward, we will continue to monitor both NOAA and DOD efforts  to develop and launch the next satellites in their respective weather  satellite programs. NOAA plans to launch its next geostationary weather  satellite in 2021 and to launch its next polar weather satellite in 2022.   DOD plans satellite launches in 2021 (potentially), 2022, and 2024. In  addition, we will continue to monitor DOD’s efforts to develop long-term  plans to meet its weather satellite requirements.

Weapon Systems Annual Assessment: Knowledge Gaps Pose Risks to  Sustaining Recent Positive Trends. GAO-18-360SP. Washington, D.C.:  Apr. 25, 2018.

Satellite Acquisitions: Agencies May Recover a Limited Portion of  Contract Value When Satellites Fail. GAO-17-490. Washington, D.C.:  June 9, 2017.

Defense Acquisitions: Assessments of Selected Weapon Programs.  GAO-17-333SP. Washington, D.C.: Mar. 30, 2017.

Defense Weather Satellites: DOD Faces Acquisition Challenges for  Addressing Capability Needs. GAO-16-769T. Washington, D.C.: July 7,  2016.

Polar Satellites: NOAA Faces Challenges and Uncertainties that Could  Affect the Availability of Critical Weather Data. GAO-16-773T.  Washington, D.C.: July 7, 2016.

Polar Weather Satellites: NOAA Is Working to Ensure Continuity but  Needs to Quickly Address Information Security Weaknesses and Future  Program Uncertainties. GAO-16-359. Washington, D.C.:  May 17, 2016.

Defense Weather Satellites: Analysis of Alternatives Is Useful for Certain  Capabilities, but Ineffective Coordination Limited Assessment of Two  Capabilities. GAO-16-252R. Washington, D.C.: Mar. 10, 2016.

This  is  a  work  of  the  U.S.  government  and  is  not  subject  to  copyright  protection  in  the  United  States.  The  published  product  may  be  reproduced  and  distributed  in  its  entirety  without  further  permission  from  GAO.  However,  because  this  work  may  contain  copyrighted  images  or  other  material,  permission  from  the  copyright  holder  may  be  necessary if you wish to reproduce this material separately.

Every 2 years, we report on federal programs/operations that are vulnerable to waste, fraud, abuse, and mismanagement, or that need broad reform—our High Risk List. Our 2019 report reviews the status of areas on the list and outlines steps to lasting solutions.

We testified in front of the House that the ratings for over half the 35 areas on our list remain unchanged. Since our last update, 7 areas improved and 3 regressed. We added 2 areas (government-wide personnel security clearance process and VA acquisition management) and removed 2 areas due to their progress (mitigating gaps in weather satellite data and DOD supply chain management).