Federal Trust Funds and Other Dedicated Funds: Fiscal Sustainability Is a Growing Concern for Some Key Funds

Some of the largest federal programs, including Medicare, Social Security, and postal services, are funded through trust funds and other dedicated funds, which link collections that have been dedicated to a specific purpose with the expenditures of those collections. While these funds have the ability to retain accumulated balances, these collections do not necessarily fund the full current or future cost of the government's commitments to the designated beneficiaries.

GAO was asked to review issues related to federal trust funds and other dedicated funds. This report examines (1) how the size and scope of federal trust funds and other dedicated funds in the federal budget have changed over time, (2) the extent to which these funds are supported by their dedicated collections, and (3) the extent to which these funds support mandatory programs, including major entitlement programs.

GAO analyzed OMB data on trust funds and other dedicated funds for fiscal year 2014 through 2018 and the Department of the Treasury's (Treasury) Fiscal Year 2018 Combined Statement of Receipts, Outlays, and Balances . GAO also examined 13 case study accounts in nine agencies, selected to include the largest of each type of these funds and a variety of program designs. GAO reviewed agency reports, CBO trust fund estimates for 2018 and projections for 2019 to 2029, and prior GAO reports, and interviewed OMB staff and officials from Treasury and each of the case study agencies. GAO also is providing an online dataset of these funds at https://www.gao.gov/products/GAO-20-156 .

Every major federal department has at least two trust funds or other dedicated funds. According to GAO analysis of Office of Management and Budget (OMB) data, balances in these funds, which can be used to support covered programs, grew 13 percent in nominal terms from fiscal year 2014 through 2018. Fund balances are affected by complex interactions of factors, but the total increase was driven largely by military and civilian retirement fund balances. The Congressional Budget Office (CBO) projects the total balance to start declining in fiscal year 2022 as decreases in Medicare and Social Security will exceed increases in military and civilian retirement balances. To offset the overall decrease, the federal government is projected to borrow more from the public.

GAO found that 11 of 13 case studies recently received general revenue—collections that are not dedicated by law for a specific purpose. For example, medical insurance premiums for Medicare Part B are set to cover 25 percent of expected costs; the remaining 75 percent are covered by general revenues. Even funds that rely primarily on their dedicated collections may not be fiscally sustainable. For example, the Social Security Old-Age and Survivors Insurance Trust Fund only uses dedicated collections for benefit payments, but its balances are projected to be depleted by 2034.

Nearly 98 percent of outlays and transfers from trust funds and other dedicated funds was through mandatory authority, which allows agencies to make payments without further congressional action. Most of the 23 largest funds also have entitlement authority, which generally requires payments to eligible parties based on legal requirements. Status as a trust fund, mandatory program, or entitlement does not prevent Congress and the President from changing related laws to alter future collections or payments.

Some of the largest federal programs, including Medicare, Social  Security, and postal services, are funded through trust funds and other  dedicated funds, which link collections that have been dedicated to a  specific purpose with the expenditures of those collections. For example,  collections from federal fuel taxes are credited to the Highway Trust Fund  and used to build and maintain the nation’s highways and bridges. Trust  funds and other dedicated funds may receive income from general  revenues—collections that are not dedicated by law for a specific  purpose—in addition to their dedicated collections.

We previously reported that, in fiscal year 1999, trust fund collections  represented nearly half of all federal budget collections and that most  trust funds and other dedicated funds had mandatory budget authority,  which, in general provides authority to spend collections without further  appropriation. Mandatory spending is a large and growing part of the  federal budget. We recently reported that between fiscal years 2007 and  2017, mandatory spending grew from 53 percent to 63 percent of all  federal spending.

Although trust funds and other dedicated funds have their own dedicated  collections and the ability to retain accumulated balances, these  collections do not necessarily fund the full current or future cost of the  government’s commitments to the designated beneficiaries. Trends and  projections in the inflows, outflows, and balances of these funds can  provide signals about the financial health of individual funds and the  impact of these funds as a group on the overall federal fiscal condition.

You asked us to review issues related to federal trust funds and other  dedicated funds. This report examines (1) how the size and scope of  federal trust funds and other dedicated funds in the federal budget have  changed over time, (2) the extent to which federal trust funds and other dedicated funds are supported by their dedicated collections, and (3) the  extent to which federal trust funds and other dedicated funds support  mandatory programs, including major entitlement programs. In addition to  this report, we are providing an online dataset of accounts that are  classified as trust and other dedicated funds by the Office of Management  and Budget (OMB), which can be accessed on our public website at  https://www.gao.gov/products/GAO-20-156.

To examine trends in the size and scope of federal trust funds and other  dedicated funds, we used OMB budget data to identify the income, outgo  (i.e., outlays and transfers to another government account), and balances  for all trust funds and other dedicated funds reported in OMB’s budget  database for fiscal years 2014 to 2018 in nominal terms. To provide a  complete count of these funds, including accounts with small balances  that fall below OMB’s $1 million reporting threshold, we used data from  the Department of the Treasury (Treasury) Fiscal Year 2018 Combined  Statement of Receipts, Outlays, and Balances of the United States  Government (Combined Statement). To assess the reliability of these  data for our purposes, we reviewed relevant documentation and  interviewed OMB staff and Treasury officials. We found the data to be  reliable for our purposes.

To examine the extent to which federal trust funds and other dedicated  funds are supported by their dedicated collections, we also examined 13  case study accounts in nine agencies selected to include the largest  funds and a variety of program designs (see table 1). We reviewed  agency reports, including agency performance, financial, and budget  reports, Congressional Budget Office (CBO) trust fund projections, the  2019 Annual Report of the Board of Trustees of the Federal Old-Age and  Survivors Insurance and Federal Disability Insurance Trust Funds (Social  Security Trustees), the 2019 Annual Report of the Board of Trustees of  the Federal Hospital Insurance and Federal Supplementary Medical  Insurance Trust Funds (Medicare Trustees), and our prior reports and  interviewed officials from each of the case study agencies.

To examine the extent to which federal trust funds and other dedicated  funds support mandatory programs, including major entitlement  programs, we used OMB budget data to calculate the prevalence of  discretionary budget authority, which refers to budget authority provided  in and controlled through appropriations acts, and mandatory budget  authority, which generally refers to budget authority provided through  laws other than appropriations acts, in federal trust funds and other  dedicated funds. OMB budget data does not systematically identify  entitlement authority. Entitlement authority is a provision of law that  requires payments to any person or unit of government that meets the  eligibility criteria established by law (see textbox). To determine which of  the largest trust funds and other dedicated funds have entitlement  authority, we analyzed the authorizing statutes for our case study  accounts and ten additional large accounts. We also reviewed budget  enforcement mechanisms, such as sequestration, that apply to these  types of budget authority through review of relevant laws, our prior work,  and OMB documents. See appendix I for additional details about our  scope and methodology.

We conducted this performance audit from October 2018 to January 2020  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Federal trust funds are an accounting mechanism used to link dedicated  collections with their expenditure for a specific purpose or program (see  textbox).

Earmarked or Dedicated Collections  Our budget glossary (GAO-05-734SP)  includes two definitions of earmarking:  1.  Dedicating collections by law for a specific  amount for particular purposes by means  of legislative language.

Our 2001 report on trust funds  (GAO-01-199SP) used the term “earmarked  receipts” in accordance with the first definition.  We use the term “dedicated collections”  instead to avoid confusion between the two  definitions.

One of the earliest trust funds established was the Civil Service  Retirement and Disability Fund, set up in 1920. In the federal budget, the  meaning of the term “trust fund” differs significantly from its private sector  usage. In the case of federal trust funds, the federal government owns  the assets of federal trust funds, does not have a fiduciary responsibility  to trust beneficiaries, and can raise or lower future trust fund collections  and payments or change the purposes for which the collections are used  by changing existing laws. Designation as a trust fund does not in and of  itself impose a greater commitment on the government to carry out  program activities than it has to carry out other government activities. It  can, however, indicate the government’s intent to restrict the use of those  funds to the specified purpose and—especially for a program funded in  whole or in part by its beneficiaries—may influence debates about  program changes.

OMB and Treasury determine budgetary designation as a trust fund when  a law both dedicates collections to a program and identifies the account  as a “trust fund.” Trust funds, however, are not the only way dedicated  collections are accounted for in the federal budget. Special funds and  public enterprise funds also link dedicated collections with their  expenditure for a specific purpose or program and are analogous to non- revolving and revolving trust funds, respectively (see figure 1). For the  purpose of this report, we examine budget accounts designated as “trust  funds” by OMB and Treasury and those that link dedicated collections  with their expenditure. There are two other fund types in the federal  budget that we did not include: general fund accounts, which hold all  federal money not allocated by law to any other fund account, and  intragovernmental fund accounts, which facilitate financing transactions  primarily within and between federal agencies.

The four fund types included in our definition of trust funds and other  dedicated funds are:

Non-revolving Trust Fund. An account designated as a “trust fund”  by law that is credited with dedicated collections, which can often, but  not always, be used without further appropriation action. For example,  the Federal Hospital Insurance (HI) Trust Fund, also known as Part A  of Medicare, is financed primarily through payroll taxes levied on  workers and their employers and finances health care services related  to stays in hospitals, skilled nursing facilities, and hospices for eligible  beneficiaries.

Special Fund. Analogous to a non-revolving trust fund but not  classified as a trust fund in name. For example, the Universal Service  Fund subsidizes telecommunication carriers that provide  telecommunications services to all consumers, including low-income  consumers, schools and libraries, and those who live in rural or high- cost areas.

Revolving Trust Fund. An account designated as a “trust fund” by  law that is credited with collections that are generally available for  obligation without further appropriation action to carry out a cycle of  businesslike operations in accordance with statute. For example, the  Employees Health Benefits Fund collects health insurance premiums  from federal employees, annuitants, and their employing agencies  and disburses payments to private insurers who participate in the  Federal Employees Health Benefits program.

Public Enterprise Fund. Analogous to a revolving trust fund but not  classified as a trust fund in name. A public enterprise fund is a type of  revolving fund that carries out a cycle of businesslike operations,  mainly with the public, in which it charges for the sale of products or  services and uses the proceeds to finance its spending, usually  without requirement for annual appropriations. The Postal Service  Fund of the United States Postal Service is an example of this type of  fund.

Trust funds and dedicated funds have their own dedicated collections and  the ability to retain accumulated balances. From the perspective of the  trust fund or other dedicated fund, the accumulated balances represent  the value of past taxes, fees, and the other income received by the fund  in excess of past spending by the fund. The accumulated balances are not cash. Most money collected and disbursed by the federal government  is held in the General Fund of the U.S. Government (General Fund). The  dedicated taxes and fees collected from the public are deposited in the  General Fund and the General Fund disburses the fund’s benefit and  other payments to the public. When the General Fund receives the cash,  the trust fund or other dedicated fund records an asset for these  collections and the General Fund records a liability to the fund, which  essentially means the trust fund has “lent” money to the General Fund. As  cash is disbursed, these asset and liability accounts are reduced. From  the government-wide perspective, the trust fund or dedicated fund asset  and General Fund liability accounts eliminate with each other in  consolidation.

Some trust funds and other dedicated funds have the legal authority to  invest their balances, most of which are held in U.S. Treasury securities.  The value of the securities held is recorded as “debt held by government  accounts” and represents debt owed by one part of the government to  another (i.e., intragovernmental debt). In many ways, the special U.S.  Treasury securities held by government accounts are indistinguishable  from the marketable government debt sold to the public. A maturity date  is set, interest is accrued at established market rates, and the securities  count as part of the total federal debt. Generally, these securities are  not traded in the financial markets and are able to be redeemed on  demand by the government account. The interest they earn is credited to  the fund accounts in the form of additional Treasury securities or is used  to pay current expenses or benefits. Interest earned by government  accounts on their Treasury securities is an internal transaction, made  between two accounts within the federal government, and constitutes an  expense for Treasury. Treasury must pay back the debt held by  government accounts when these accounts need to redeem their  securities to be able to make their expenditures. When this happens,  Treasury must obtain cash to finance the government’s spending either  through increasing taxes, cutting spending, or increasing borrowing from  the public.

Entitlement authority is another way to classify budget authority, but  OMB’s budget data do not include that classification. Discretionary  spending refers to budget authority that is provided in and controlled by  appropriations acts. Mandatory spending, also known as direct spending,  refers to budget authority provided in laws other than appropriations acts  and the outlays that result from such budget authority. Entitlement  authority is the authority to make payments to any person or government  if, under the provisions of the law, the U.S. government is legally required  to make the payments to persons or governments that meet the  requirements. Generally, entitlement authority is a type of mandatory  spending.

Applicability of Budget Control Mechanisms

The classification of the budget authority within a trust fund or other  dedicated fund as mandatory or discretionary determines how budget  control mechanisms apply. By itself, designation as a trust fund does not  determine whether spending is controlled through the annual  appropriations process or what limitations apply. Trust funds and  dedicated funds are subject to various enforcement mechanisms intended  to control revenues, spending, and deficits.

The Balanced Budget and Emergency Deficit Control Act of 1985  (BBEDCA) first established sequestration, which is the cancellation of  budgetary resources under a presidential order. The act set deficit  reduction targets for the federal government and established  sequestration procedures to enforce those targets. The Budget Control  Act of 2011 amended BBEDCA and revived this budgetary enforcement  mechanism by reinstating budget limits (also known as “caps”) to  encourage agreement on deficit reduction legislation or, in the event that  such agreement was not reached, to automatically reduce spending so  that an equivalent budgetary goal would be achieved. Appropriations from  trust funds and other dedicated funds designated as discretionary count  toward these limits.

The Statutory Pay-As-You-Go Act of 2010 (PAYGO) specifies a second  type of sequestration triggered under certain conditions. The act establishes a permanent budget enforcement mechanism intended to  prevent enactment of mandatory spending and revenue legislation that  would increase the federal deficit. The act requires OMB to track costs  and savings associated with enacted legislation and to determine at the  end of each congressional session if net total costs exceed net total  savings. If the costs exceed the savings, a separate sequestration will be  triggered. Consequently, the same mandatory accounts that are subject  to sequestration under BBEDCA could incur further reductions if a  secondary PAYGO sequestration is triggered. PAYGO does not control  the growth in spending that results from previously enacted laws, nor  does it control discretionary spending.

Federal Trust Funds and Other Dedicated Funds Were a Large and Growing Part of the Budget from Fiscal Year 2014 to 2018

Every Major Department Has At Least Two Trust Funds or Other Dedicated Funds

Hundreds of programs across the federal government are supported in  whole or in part by a trust fund or other dedicated fund. Our analysis of  OMB’s budget data shows 398 active federal trust funds and other  dedicated funds in fiscal year 2018. Non-revolving trust funds and special  funds make up the greatest number of these types of accounts and also  hold the greatest total balances. See table 2.

Our analysis of another government-wide source, Treasury’s Combined  Statement, records 647 trust and other dedicated fund accounts in fiscal  year 2018. This count is higher because Treasury includes accounts with  smaller balances and does not combine groups of related accounts. Of  the accounts in Treasury’s Combined Statement, 150 have balances that  are below $500,000 and would fall below OMB’s rounding threshold of $1  million. The trust funds and other dedicated funds in Treasury’s  Combined Statement are spread across all 29 major departments that are  reported separately in the statement (see figure 2). Each department has  at least two such accounts.

The distribution of the number of trust fund or other dedicated fund  accounts across federal agencies does not correspond with the balances  held by these accounts. For example, the Social Security Administration  has only four such accounts, but those four funds together held $2.9  trillion—more than double the balances of any other agency at the end of  fiscal year 2018 (see figure 3). In contrast, the Department of the Interior  had the greatest number of trust funds and other dedicated funds, but  these 118 funds together held $14.9 billion, which is less than 1 percent  of the total balances held in these types of accounts at the end of fiscal  year 2018.

Total Trust Fund and Other Dedicated Fund Balances Grew 13 Percent from Fiscal Year 2014 to Fiscal Year 2018

The total balance in federal trust funds and other dedicated funds grew  about 13 percent in nominal terms from fiscal year 2014 to fiscal year  2018. The five accounts that contributed the most to this overall growth  are listed in table 3.

Fund balances are affected by complex interactions of various economic,  demographic, and programmatic factors, but these changes are reflective  of some overarching trends. For example, the balances of civilian and  military pension and benefit programs increased, in part reflecting agency  and employee contributions to fund the ongoing accrual of benefits by  civilian and military personnel. Treasury has also contributed to these  accounts to help fund some of the benefits accrued in the past. Some of  the other increases were a result of economic changes experienced  during this time period such as declines in the unemployment rate, among  other things. For example, both Social Security’s Federal Old-Age and  Survivors Insurance Trust Fund (OASI) and the Unemployment Trust  Fund are funded primarily by payroll taxes, which tend to gather more  revenue during periods when employment goes up and wage growth  increases.

While the net change in total trust fund and other dedicated fund balances  was positive from fiscal year 2014 to 2018, not all trust fund and other  dedicated fund balances grew over the time period. The five accounts  that experienced the largest balance decreases are listed in table 4.

From fiscal year 2014 to 2018, the average trust fund and other dedicated  fund balance decrease was less than the average balance increase, and  a greater number of accounts increased than decreased over the period.  About 28 percent of the 398 accounts in our scope had individual  balances that changed less than $5 million over the time period (see table  5).

The higher total balance in trust funds and other dedicated funds  indicates an overall surplus—income exceeding outgo—from fiscal year  2014 to 2018, which could suggest that the federal government intends to  dedicate more resources to these specified purposes. Neither the  increased total balance nor an individual fund’s balance increase is a  signal that any individual fund is on sound financial footing. Similarly, a  decreasing balance does not necessarily signal that any individual fund is  not on sound financial footing. Assessing the future outlook for some of  these funds and programs requires actuarial or other projections and can  be subject to various degrees of inherent uncertainty.

Not All Federal Trust Funds and Other Dedicated Funds Are Fully Supported by Dedicated Collections

Dedicated Collections Are Not the Sole Source of Income for Trust Funds and Dedicated Funds

Of our 13 case study accounts, 11 received income from general  revenues in addition to their dedicated collections, either through a  permanent appropriation or in an annual appropriation. The form, size,  and purpose of income from general revenues that our case study  accounts received varied greatly based on the design of the program.  These accounts fall in to three basic types: those that received regular  income from general revenues as a part of their program design, those  that received intermittent general revenue income, and those that  received income solely from their own dedicated collections. See  appendix II for more detailed information about the income, outgo,  investments, and current issues for each of these accounts.

Regular Income from General Revenues as a Part of Program Design

Eight of the case study accounts we examined regularly receive income  from general revenues in addition to their dedicated collections. These  general revenues are often for specific purposes that have been deemed  public goods and are provided annually as a part of the program’s design.

The Medicare Supplementary Medical Insurance trust fund sets  medical insurance premium rates for Medicare Part B to cover 25  percent of expected costs for the year. The roughly 75 percent  remaining expected program cost is funded through general revenue.

The Medicare HI Trust Fund also regularly receives general revenues  to reimburse the fund for the cost for certain uninsured beneficiaries,  program management activities, and other miscellaneous activities. In  fiscal year 2018, $1.6 billion in general revenue was transferred into  the trust fund.

Both the Civil Service Retirement and Disability Fund (CSRDF)  program and the Federal Employees Health Benefits Fund receive  contributions from both current employees and their employing  agencies as their primary sources of income, but these accounts also  receive some general revenue in addition to these dedicated  collections.

Treasury is required by law to transfer an amount annually to the  CSRDF from the General Fund to subsidize in part the under- funding of the Civil Service Retirement System. The Civil Service  Retirement System is closed to new participants but covers most  federal employees who first entered a covered position prior to  1984.

According to OPM officials, the Federal Employees Health  Benefits program is funded about 30 percent by contributions from  participants and about 70 percent by contributions from their  employing agencies. OPM contributes the employer share of the  premiums for most annuitants via an appropriation from general  revenues.

The U.S. Postal Service (USPS) receives annual appropriations from  general revenues to fund mail for the blind and overseas absentee  voting. These appropriations account for less than 0.1 percent of the  total cash outlays of the Postal Service Fund. USPS received $58  million in appropriations for these activities in fiscal year 2018, when  total outlays were $69 billion.

The Social Security Trust Funds, both OASI and DI, receive  reimbursements from general revenue for several distinct purposes,  such as employee union expenses and the payroll tax holiday, among  other things. The total appropriations for these two activities were  about $23 million in fiscal year 2018.

While the Airport and Airway Trust Fund primarily receives dedicated  collections, it has received some appropriations from general revenue  in recent years, and some of the programs it funds also receive  regular appropriations from general revenue. The most prominent  example is the operations and management account within the  Federal Aviation Administration. While this account is funded mostly  by transfers from the Airport and Airway Trust Fund, it also typically  receives an annual appropriation from general revenues. In fiscal year  2018, the appropriation to the operations account was $1.36 billion,  which was about 13 percent of the total budget authority in the  account.

Three of the case study accounts we examined were supported in part by  general revenue income on an intermittent basis in recent years. These  general revenues helped temporarily restore solvency to programs that  were not designed to be fiscally sustainable.

The Highway Trust Fund has received appropriations from general  revenues as a part of its reauthorization process in recent years. The  most recent reauthorization, provided $70 billion in general revenue to  the Highway Trust Fund from fiscal year 2016 through fiscal year  2020. The appropriations have allowed outlays to exceed dedicated  collections in most years without exhausting assets in the fund.

The National Flood Insurance Fund had $16 billion of its debt  canceled by the Additional Supplemental Appropriations for Disaster  Relief Requirements Act, 2017. This cancellation converted a $16  billion liability of the fund to a cost borne by general revenues.  However, the National Flood Insurance Program (NFIP) still owes  $20.5 billion to Treasury. As we recently reported, NFIP likely will not  generate sufficient revenues to cover its expenses and repay its  outstanding debt because its premium rates do not reflect the full risk  of loss. The Flood Insurance Reserve Fund did not directly benefit  from the debt cancellation, but it did receive an indirect benefit since it  was established as a reserve fund to help meet expected future  obligations and repay debt.

Income Solely from Dedicated Collections

Two of our case study accounts did not receive income from general  revenue in recent years. For both of these accounts, the agencies have  some authority to adjust their dedicated collections to cover their  projected costs. The flexibility to adjust income levels based on  projections can help contribute to the sustainability of the funds.

Although the Tennessee Valley Authority (TVA) was originally funded  primarily by appropriations from Congress when it was established in  1933, TVA fulfilled its requirement to repay this investment in 2014  and currently collects enough revenue to cover its operating  expenses. The TVA Board has the authority to determine rates for its  electric power and the Tennessee Valley Authority Act of 1933  mandates that TVA keep rates as low as feasible while still collecting  sufficient revenue.

The Universal Service Fund (USF) does not receive income from  general revenue. The Federal Communications Commission (FCC)  has some flexibility to set the contribution factor, which determines the  payments telecommunications carriers are required to make into the  fund. FCC officials told us that they must set the rates at levels so that  they collect enough in dedicated collections to cover the projected  demand for the programs they have adopted. FCC sets the  contribution factor quarterly to cover the projected cost of the USF  programs for the upcoming quarter, up to the authorized level of  spending for each program.

Even funds that rely primarily on their dedicated collections may not be  fiscally sustainable. For example, the Social Security OASI and DI, and  Medicare HI trust funds do not receive income from general revenues to  support benefit payments. However, projections show that their dedicated  collections are expected to be insufficient to fully cover scheduled outlays  in the next 7 to 33 years. Conversely, some accounts supported by the  Airport and Airway Trust Fund received appropriations from general  revenue in recent years. However, the Airport and Airway Trust Fund has  received more in dedicated collections than are made available to outlay  through appropriations. As such, the fund carries a balance that is  unavailable without further appropriations action. At the end of fiscal year  2018, the total cash balance in the Airport and Airway Trust Fund was  about $17 billion. CBO projects this balance to grow more than threefold  over the next 10 years.

Total Trust Fund and Special Fund Balances Are Projected to Start Decreasing in Fiscal Year 2022

Although overall federal trust and other dedicated fund balances grew  over the past 5 fiscal years, this trend is not projected to continue. In  CBO’s most recent trust fund projections, overall federal trust fund and  special fund balances are projected to start declining in fiscal year 2022.  CBO does not estimate projected balances for public enterprise funds. As  shown in figure 4, the projected decline is largely explained by declines in  the Social Security and Medicare fund balances.

We have previously reported that demographic factors, such as an aging  population and slower labor force growth, are contributing to a gap  between Social Security program costs and revenues. According to the  most recent Social Security Trustees Report, Social Security’s costs, on a  combined OASI and DI basis, have exceeded its non-interest income  since 2010 and are projected to exceed total income, including interest,  starting in 2020. The Medicare and Social Security Trustees and CBO  projections show that several major trust funds will deplete their assets in  the next 3 to 33 years (see figure 5). If no action is taken, these trust  funds are projected to be unable to fully support paying their projected  obligations.

Projected trust fund balances can provide a vital signaling function for  policymakers about underlying fiscal imbalances in covered programs.  However, program sustainability is ultimately determined by whether the  government as a whole has the economic capacity to finance the claims  on the trust funds at the cost of other competing priorities. The economic  flexibility of the federal government may be limited as debt held by the  public grows as a percentage of gross domestic product (GDP). Debt held  by the public was $15.8 trillion—or 78 percent of GDP—at the end of  fiscal year 2018. It is projected to surpass its historical high of 106  percent of GDP within 13 to 20 years, and climb to between about 250 to  500 percent by 2092.

Further, neither the long-term projections of federal debt nor CBO’s trust  fund balance projections include certain fiscal risks that could affect the  federal government’s financial condition in the future. Fiscal risks, or fiscal  exposures, are responsibilities, programs, and activities that may legally  commit or create expectations for future federal spending. Many of the  largest trust funds and other dedicated funds face fiscal risks that are  highlighted in our High-Risk List due to the financial uncertainty they  face. For example,

USPS—USPS financial viability continues to be high-risk because  USPS cannot fund its current level of services and financial  obligations from its revenues.

Pension Benefit Guaranty Corporation (PBGC)—PBGC’s liabilities  exceeded its assets by about $51 billion as of the end of fiscal year  2018. PBGC’s financial future remains uncertain, due in part to a long- term decline in the number of traditional defined benefit plans and the  collective financial risk of the many underfunded pension plans PBGC  insures.

NFIP—Emphasizing affordability has led to premium rates that in  many cases do not reflect the full risk of loss and produce insufficient  premiums to pay for claims.

Highway Trust Fund (HTF)—The nation’s surface transportation  system is under growing strain and the cost to repair and upgrade the  system to meet current and future demand is estimated in the  hundreds of billions of dollars. A sustainable solution would balance  revenues to and spending from the HTF. Ultimately, major changes in  transportation spending or in revenues, or in both, will be needed to  bring the two into balance.

The Medicare Program—Medicare continues to challenge the federal  government because of its outsized impact on the federal budget and  the health care sector as a whole, the large number of beneficiaries it  serves, and the complexity of its administration. Federal spending for  Medicare programs is expected to significantly increase in the coming  years.

As overall trust and special fund balances are projected to decrease, our  projections and those from the Fiscal Year 2018 Financial Report of the  United States Government, and CBO show that the federal government  will have to borrow more from the public to offset the decrease in  intragovernmental debt. We have reported that existing federal debt  held by the public is already large by historical norms, and CBO has  noted that large and growing amounts of federal debt held by the public  would have negative long-term consequences for the economy and  constrain future budget policy. To change the long-term fiscal path,  policymakers will likely need to consider policy changes to the entire  range of federal activities, both revenue and spending.

Most Large Trust Funds and Other Dedicated Funds Have Mandatory Budget Authority and Support Entitlement Programs

Nearly All Outgo from Trust Funds and Other Dedicated Funds Was Mandatory, Thus Available to Be Spent without Further Appropriation

During fiscal year 2018, almost 98 percent of outgo (i.e., outlays and  transfers to another government account) from trust funds and other  dedicated funds was mandatory budget authority. This is greater than the  proportion of total federal spending that is mandatory. According to OMB,  during fiscal year 2018, mandatory spending made up 69.3 percent of all  federal outlays while discretionary spending accounted for the remaining  30.7 percent. Seventy-six percent of trust funds and other dedicated  funds had some mandatory budget authority (see table 6). Some funds  have a mix of mandatory and discretionary budget authority.

In general, the collections and balances of accounts with mandatory  spending authority are available for obligation. Mandatory authority  provides some flexibility for agencies because they do not have to await  congressional action to incur obligations and make payments. For  example, the Social Security Trust Funds have mandatory budget  authority, which authorizes the program to continue to make payments to  beneficiaries during lapses in appropriations. Although programs with  mandatory authority need not go through the annual appropriations  process, they are still subject to congressional oversight. In some cases  Congress has set obligation limits in annual appropriations acts. For  example, although the Crime Victims Fund has mandatory budget  authority to obligate funds from its available balances, limits in annual  appropriations acts have often capped the amount that may be obligated  in each fiscal year. As a result, annual income has exceeded outgo and  the balance of the fund had grown to $16.6 billion at the end of fiscal year  2018.

Designation as mandatory or discretionary budget authority determines  how budget control mechanisms are applied to the funds. Sequestration  applies annually to mandatory spending, but certain budget authority is  exempt or subject to special rules. Of the 13 case studies we reviewed,  nine are exempt from cancellation under budget enforcement  sequestration procedures and four—Medicare Supplementary Medical  Insurance, Medicare Hospital Insurance, the HTF, and the Airport and  Airway Trust Fund—are partially sequestrable (i.e., certain budgetary  resources specified by law within the accounts are not subject to  cancellation under budget enforcement sequestration procedures). For  example, Social Security, Medicaid, and veterans’ compensation are  completely exempt, and Medicare reductions are limited to 2 percent.  Exemptions and special rules lead sequestration to affect some areas of  the federal government more than others. For example, programs without  exempt status, such as the Commodity Credit Corporation Fund, bear a  greater reduction than they would if cuts were applied evenly to all  programs.

Outgo from those trust funds and other dedicated funds that do not have  mandatory budget authority are controlled in the annual appropriations  process and count toward the annual discretionary spending limits laid  out in the Budget Control Act of 2011 (BCA). For example, outlays from  the Airport and Airway Trust Fund are discretionary. This means that the  outlays for capital improvements and operations of the nation’s airport  and airway system, except for airport grants, count toward government- wide discretionary spending limits.

Some trust funds and other dedicated funds have a combination of  budget authorities, which can affect balances. For example, the Harbor  Maintenance Trust Fund (HMTF), which is supported through collections  of the harbor maintenance fee, has mandatory income and discretionary  outlays. Historically, HMTF income has exceeded outgo and by the end of  fiscal year 2018, the balance in the fund had grown to $9.3 billion. Any  proposed legislation to lower the fee revenues would require an offset so  as not to increase the deficit. Conversely, since the spending is subject to  the discretionary caps, any increase in spending to align with program  revenues would count toward the discretionary spending limits.

Most spending from trust funds and other dedicated funds is mandatory  and not controlled by the annual appropriations process. We have  previously reported that the increase in mandatory spending has long- term implications for the nation’s fiscal outlook overall, including the  growing federal debt. The federal government has previously enacted  fiscal rules in the form of laws that constrain fiscal policy decisions,  including BCA and PAYGO. These fiscal rules apply the same way  regardless of status as a trust fund or other dedicated fund. However, in  practice, fiscal rules that apply to mandatory budget authority are more  relevant to these types of accounts, because mandatory budget authority  is more concentrated in trust funds and other dedicated funds than it is in  the federal budget as a whole.

The Majority of the Largest Trust Funds and Other Dedicated Funds Are Entitlements—Legal Commitments

Of the 23 largest trust funds and other dedicated funds we reviewed, 13  have entitlement authority, which legally requires payments to individuals  or governments that meet the requirements of the programs (see table 7).  For example, OASI beneficiaries are legally entitled to benefits based on  a formula that takes into account the time they spent working and their  earnings, among other factors.

Some trust funds have mandatory budget authority, but not entitlement  authority. For example, the USF, the National Flood Insurance Reserve  Fund, and the Tennessee Valley Authority Fund all have mandatory  budget authority, but have no entitlement authority. These programs have  the most flexibility because their income is available without further  appropriations action and their outgo is not driven by legal requirements  to individuals or governments. For example, Federal Communication  Commission officials told us that they manage the size of each program  funded by the USF, to stay within an approved budget.

Although entitlements represent a current legal commitment and trust  funds and other dedicated funds demonstrate the government’s intent to  restrict the use of those funds to a specific purpose, the government can  change the terms of entitlement programs, including those financed  through trust funds or other dedicated funds, by changing the substantive  law. Congress and the President can raise or lower future trust fund  collections or payments or change the purposes for which the collections  can be used. For example, in 1983 a number of changes were made to  the Social Security program, including an increase in the full retirement  age and a new tax on a portion of Social Security benefits, which  increased collections and lowered future outgo.

We provided a draft of this report and the online dataset to the Director of  OMB and the Secretary of the Treasury for review and comment. We also  provided a draft of this report and the online dataset to our case study  agencies: the Centers for Medicare & Medicaid Services, the Federal  Communications Commission, the Federal Emergency Management  Agency, the Department of Transportation (for the Federal Aviation  Administration and the Federal Highway Administration), the Office of  Personnel Management, the Social Security Administration, the  Tennessee Valley Authority, and the U.S. Postal Service for review and  comment.

The Social Security Administration and the U.S. Postal Service provided  written responses thanking us for providing the opportunity to review the  report, which are published in appendixes III and IV. The Centers for  Medicare & Medicaid Services, the Federal Communications  Commission, the Department of Transportation, the Office of Personnel  Management, the Tennessee Valley Authority, and the U.S. Postal  Service provided technical comments, which we incorporated as  appropriate. OMB, Treasury, and the Federal Emergency Management  Agency reviewed our draft report and had no comments.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 7 days from the  report date. At that time, we will send copies to interested congressional  committees, the Director of the Office of Management and Budget, the  secretaries and agency heads of the departments and agencies in our  review, and other interested parties. In addition, the report is available at  no charge on GAO’s website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  Tranchau (Kris) T. Nguyen at (202) 512-6806 or nguyentt@gao.gov.  Contact points for our Offices of Congressional Relations and Public  Affairs may be found on the last page of this report. GAO staff who made  key contributions to this report are listed in appendix V.

This report examines: (1) how the size and scope of federal trust funds  and other dedicated funds in the federal budget have changed over time,  (2) the extent to which federal trust funds and other dedicated funds are  supported by their dedicated collections, and (3) the extent to which  federal trust funds and other dedicated funds support mandatory  programs, including major entitlement programs.

To examine trends in the size and scope of federal trust funds and other  dedicated funds, we used Office of Management and Budget (OMB)  budget data to identify the income, outgo (i.e., outlays and transfers to  another government account), and end of year balances for all revolving  trust funds, special funds, non-revolving trust funds, and public enterprise  funds reported in OMB’s budget database, OMB MAX, for fiscal years  2014 to 2018 in nominal terms. We excluded financing and credit  accounts because they are non-budgetary. For the majority of these data  we used the amounts reported in OMB MAX schedule J, which is used to  produce the Status of Funds tables in the President’s Budget Appendix.  While the list of accounts that report Status of Funds tables publicly in the  budget is limited to 21 accounts, a schedule J is created in OMB MAX for  all non-revolving trust funds and special funds and, for the years in our  review, for all revolving trust funds. Schedule J data are not available for  public enterprise funds, so we used guidance from OMB Circular No. A- 11 to approximate similar income, outgo, and balance data using data  fields that are reported in the Program and Financing table. The public  enterprise fund data are slightly different than the other fund types  because borrowing authority as it is reported in OMB MAX only includes  information on repayable advances and excludes information on  outstanding debt and borrowing. We asked OMB staff to review our  methodology to calculate these numbers and they agreed our approach  was methodologically sound. To assess the reliability of OMB MAX data  related to the income, outgo, and balances of trust fund and other  dedicated fund accounts, we reviewed related documentation,  interviewed knowledgeable OMB staff, and conducted electronic data  testing. We found these data reliable for our purposes.

OMB budget data are rounded to the nearest million and do not show  funds with amounts less than $500,000. Accordingly, OMB instructs  agencies to consolidate small trust fund accounts with larger general fund  accounts so the total government-wide amounts will be complete. In  addition, OMB sometimes reports trust fund groups under a single  account rather than each individual trust fund account. Groups may  include two or more trust funds with similar purposes. The Department of  the Treasury (Treasury), on the other hand, tracks monies for each  discrete account to the penny in order to fulfill its government wide  accounting and cash management responsibilities. As such, we used  data from the Treasury Fiscal Year 2018 Combined Statement of  Receipts, Outlays, and Balances of the United States Government to  provide a complete count of these funds, including accounts with small  balances and accounts that are a part of groups. We interviewed  Treasury officials, reviewed relevant documentation, and conducted  electronic and manual testing to ensure the data were reliable for our  purposes and concluded that they were.

To examine the extent to which federal trust funds and other dedicated  funds are supported by their dedicated collections, in addition to the data  described above, we examined thirteen case study accounts in nine  agencies. We selected a set of accounts to include the largest of each of  the four types of trust funds and other dedicated funds and a variety of  program designs (see table 8).

We used gross outlays from fiscal year 2017 to identify the largest  accounts, since that was the most recently available data at the time of  the account selection. Overall, our selected accounts covered 88 percent  of the total gross outlays among these types of accounts in fiscal year  2017. We also ensured that our set of case study accounts included: at  least one account from each of the four fund types in our scope, a range  of programs from different goals (e.g., infrastructure, insurance, federal  employee benefits), and budget authority with different characteristics.  The budget authority included in our case study selection represented  examples of both mandatory and discretionary budget authority. We also  ensured that budget authority from appropriations, borrowing authority,  contract authority, and offsetting collections were represented in at least  one case study. While the case studies were selected to capture the  largest funds and a diversity of programs and funding characteristics,  findings from the case studies cannot be generalized to all trust funds and  other dedicated funds.

We also reviewed agency financial, budget, and performance reports,  Congressional Budget Office trust fund projections, the 2019 Annual  Report of the Board of Trustees of the Federal Old-Age and Survivors  Insurance and Federal Disability Insurance Trust Funds (Social Security  Trustees), the 2019 Annual Report of the Board of Trustees of the  Federal Hospital Insurance and Federal Supplementary Medical  Insurance Trust Funds (Medicare Trustees), and our prior reports, and  interviewed officials from each of the case study agencies.

To examine the extent to which federal trust funds and other dedicated  funds support mandatory programs, including major entitlement  programs, we used OMB budget data to calculate the prevalence of  discretionary budget authority, which is controlled through appropriations  acts, and mandatory budget authority, which generally refers to budget  authority provided through laws other than appropriations acts, in federal  trust funds and other dedicated funds. OMB budget data do not  systematically identify entitlement authority. To determine which of the  largest trust funds and other dedicated funds have entitlement authority,  we analyzed the authorizing statutes for our case study accounts and 10  additional accounts with the next largest gross outlays. While the  entitlement analysis was designed to cover nearly all of the total outlays  from these types of accounts, the findings from this analysis are not  representative of all trust funds and other dedicated funds and cannot be  generalized to the other 375 accounts in our scope. We also reviewed  budget enforcement mechanisms, such as sequestration, that apply to  these types of budget authority through review of relevant laws, our prior  work, and OMB documents.

Appendix II: Selected Case Study Profiles

To illustrate the variety of federal trust funds and other dedicated funds,  and examine the extent to which they are supported by their dedicated  collections, we examined 13 case study accounts in nine agencies. We  selected accounts listed in table 9 to include the largest of each of the  four types of trust funds and other dedicated funds and a variety of  program designs.

Each case study profile in this appendix includes income, outgo,  investments, and current issues related to the account, as well as the  following account information:  Fund types. OMB and Treasury designate budget accounts as “trust  funds” and other fund types that link dedicated collections with their  expenditure based on legislation. The fund types in this appendix include:  Non-revolving trust fund. An account designated as a “trust fund” by law  that is credited with dedicated collections, which can often, but not  always, be used without further appropriation action.

Special fund. Analogous to a non-revolving trust fund but not classified as  a trust fund in name.

Revolving trust fund. An account designated as a “trust fund” by law that  is credited with collections that are generally available for obligation  without further appropriation action, to carry out a cycle of businesslike  operations in accordance with statute.

Public enterprise fund. Analogous to a revolving trust fund but not  classified as a trust fund in name. A public enterprise fund is a type of  revolving fund that carries out a cycle of businesslike operations, mainly  with the public, in which it charges for the sale of products or services and  uses the proceeds to finance its spending, usually without requirement for  annual appropriations.

Entitlement authority. Whether or not outgo from the fund is controlled  by an entitlement authority, which is the authority to make payments to  any person or government if the U.S. government is legally required to  make the payments to persons or governments that meet the  requirements established by law.

The Budget Enforcement Act category. OMB’s designation as to  whether the funds in the account are classified as discretionary or  mandatory depending on the nature of the substantive legislation creating  the fund.

Discretionary. Budget authority provided in and controlled through  appropriations acts.

Mandatory. Budget authority provided through laws other than  appropriations acts, and the outlays that result from such budget  authority.

Sequestration status. OMB’s designation of the authority for purposes of  sequestration, which is the cancellation of budgetary resources under a  presidential order. We defined the status categories as follows:   Exempt. Accounts for which budgetary resources are exempt from  cancellation under budget enforcement sequestration procedures.

Sequestrable. Accounts for which budgetary resources are subject to  cancellation under budget enforcement sequestration procedures.

Partially Sequestrable. Accounts for which certain budgetary resources  specified by law within the account are not subject to cancellation under  budget enforcement sequestration procedures.

In addition to the contact named above, Susan E. Murphy (Assistant  Director), Katherine D. Morris (Analyst in Charge), Alicia Cackley, Janice  Ceperich, Jacqueline Chapin, Steven Cohen, Michael Collins, James  Cosgrove, Robert Dacey, Karin Fangman, Paul Foderaro, Carol Henn,  James A. Howard, Susan J. Irving, Charles Jeszeck, Kenneth John,  Heather Krause, Natalie Logan, Scott McNulty, John Mingus, Sally Moino,  Tracie Sanchez, Lori Rectanus, Frank Rusco, Dawn Simpson, Frank  Todisco, Peter Verchinski, and Alicia White made key contributions to this  report.

Every major federal department has at least 2 trust funds or dedicated funds that pay for key programs. The money comes from related taxes, fees, and premiums—e.g., U.S. postage stamp revenue goes to the Postal Service Fund.

The overall federal trust fund balance is expected to start declining in 2022 as balances in the Medicare and Social Security trust funds drop. The government is projected to borrow the difference—which isn’t sustainable.

Of our 13 case study funds, 11 received general revenue in addition to dedicated revenue. For example, the 2015 Highway Trust Fund reauthorization provided $70 billion in general revenue to the fund.


Critical Infrastructure Protection: Actions Needed to Address Weaknesses in TSA's Pipeline Security Program Management

More than 2.7 million miles of pipeline transport and distribute natural gas, oil, and other hazardous products throughout the United States. Interstate pipelines run through remote areas and highly populated urban areas, and are vulnerable to accidents, operating errors, and malicious physical and cyber-based attack or intrusion. Pipeline system disruptions could result in commodity price increases or widespread energy shortages. Several federal and private entities have roles in pipeline security. TSA is primarily responsible for the federal oversight of pipeline physical security and cybersecurity.

This statement summarizes previous GAO findings related to TSA's management of its pipeline security program. It is based on a prior GAO product issued in December 2018, along with updates as of April 2019 on actions TSA has taken to address GAO's recommendations from the report. To conduct the prior work, GAO analyzed TSA documents, such as its Pipeline Security Guidelines ; evaluated TSA pipeline risk assessment efforts; and interviewed TSA officials, 10 U.S. pipeline operators—a non-generalizable sample selected based on volume, geography, and material transported—and representatives from five pipeline industry associations. GAO also reviewed information on TSA's actions to implement its prior recommendations.

The Department of Homeland Security's (DHS) Transportation Security Administration (TSA) has developed and provided pipeline operators with voluntary security guidelines, and also evaluates the vulnerability of pipeline systems through security assessments. However, GAO's prior work, reported in December 2018, identified some weaknesses and made recommendations to strengthen TSA's management of key aspects of its pipeline security program.

Pipeline security guidelines . GAO reported that TSA revised its voluntary pipeline security guidelines in March 2018 to reflect changes in the threat environment and incorporate most of the principles and practices from the National Institute of Standards and Technology's (NIST) Framework for Improving Critical Infrastructure Cybersecurity. However, TSA's revisions do not include all elements of the current NIST framework and TSA does not have a documented process for reviewing and revising its guidelines on a regular basis. GAO recommended that TSA implement a documented process for reviewing and revising TSA's Pipeline Security Guidelines at defined intervals. TSA has since outlined procedures for reviewing its guidelines, which GAO is reviewing to determine if they sufficiently address the recommendation.

Workforce planning . GAO reported that the number of TSA security reviews of pipeline systems has varied considerably over time. TSA officials stated that staffing limitations within its Pipeline Security Branch have prevented TSA from conducting more reviews. Staffing levels for the branch have varied significantly, ranging from 1 full-time equivalent in 2014 to 6 from fiscal years 2015 through 2018. Further, TSA does not have a strategic workforce plan to help ensure it identifies the skills and competencies—such as the required level of cybersecurity expertise—necessary to carry out its pipeline security responsibilities. GAO recommended that TSA develop a strategic workforce plan, which TSA plans to complete by July 2019.

Pipeline risk assessments . GAO identified factors that likely limit the usefulness of TSA's risk assessment methodology for prioritizing pipeline security reviews. For example, TSA has not updated its risk assessment methodology since 2014 to reflect current threats to the pipeline industry. Further, its sources of data and underlying assumptions and judgments regarding certain threat and vulnerability inputs are not fully documented. GAO recommended that TSA update its risk ranking tool to include up-to-date data to ensure it reflects industry conditions and fully document the data sources, assumptions and judgments that form the basis of the tool. As of April 2019, TSA reported taking steps to address these recommendations. GAO is reviewing documentation of these steps to determine if they sufficiently address the recommendations.

Monitoring performance . GAO reported that conducting security reviews was the primary means for TSA to assess the effectiveness of its efforts to reduce pipeline security risks. However, TSA has not tracked the status of key security review recommendations for the past 5 years. GAO recommended that TSA take steps to update information on security review recommendations and monitor and record their status, which TSA plans to address by November 2019

GAO made 10 recommendations in its December 2018 report to strengthen TSA's management of its pipeline security program. DHS agreed and has described planned actions or timeframes for addressing these recommendations.

Thank you for the opportunity to discuss our work on the Transportation  Security Administration’s (TSA) efforts to manage its pipeline security  program. The security of the nation’s pipeline systems is vital to public  confidence and the nation’s safety, prosperity, and well-being. More than  2.7 million miles of pipelines transport and distribute the natural gas, oil,  and other hazardous liquids that U.S. citizens and businesses depend on  to operate vehicles and machinery, heat homes, generate electricity, and  manufacture products. A minor pipeline system disruption could result in  commodity price increases, while prolonged pipeline disruptions could  lead to widespread energy shortages. A disruption of any magnitude  may affect other domestic critical infrastructure and industries that are  dependent on pipeline system commodities.

The interstate pipeline system runs through both remote and highly  populated urban areas, and it is vulnerable to accidents, operating errors,  and malicious attacks. In addition, pipelines increasingly rely on  sophisticated networked computerized systems and electronic data,  which are vulnerable to cyber-attack or intrusion. Given that many  pipelines transport volatile, flammable, or toxic oil and liquids, and given  the potential consequences of a successful physical or cyber-attack,  pipeline systems are attractive targets for terrorists, hackers, foreign  nations, criminal groups, and others with malicious intent.

New threats to the nation’s pipeline systems have evolved to include  sabotage by environmental activists and cyber-attack or intrusion by  nations. For example, in October 2016 environmental activists forced the  shutdown of five crude oil pipelines in four states. In March 2018, the  Federal Bureau of Investigation and the National Cybersecurity and  Communications Integration Center (NCCIC) reported that a nation-state  had targeted organizations within multiple U.S. critical infrastructure  sectors, including the energy sector, and collected information pertaining  to Industrial Control Systems.

TSA, within the Department of Homeland Security (DHS), has primary  oversight responsibility for the physical security and cybersecurity of  transmission and distribution pipeline systems. TSA’s Security Policy  and Industry Engagement’s Pipeline Security Branch is charged with  managing its pipeline security program. The Pipeline Security Branch first  issued its voluntary Pipeline Security Guidelines in 2011 and released  revised guidelines in March 2018. The Pipeline Security Branch is  responsible for conducting voluntary security reviews—Corporate  Security Reviews (CSR) and Critical Facility Security Reviews (CFSR)— which assess the extent to which the 100 most critical pipeline systems  are following the intent of TSA’s Pipeline Security Guidelines. CSRs are  voluntary on-site reviews of a pipeline owner’s corporate policies and  procedures. CFSRs are voluntary on-site inspections of critical pipeline  facilities, as well as other select pipeline facilities, throughout the nation.

My testimony today summarizes findings from our December 2018 report  examining TSA’s management of its pipeline security program. In  addition, this statement contains updates from TSA as of April 2019 about  actions it has taken to address the recommendations made in our  December 2018 report. For this report, we reviewed and analyzed  relevant documents from TSA and other federal entities, evaluated TSA  pipeline risk assessment efforts, and interviewed TSA officials, including  officials within TSA’s Pipeline Security Branch. We also interviewed  representatives from five major industry associations and security  personnel from 10 pipeline operators to collect a range of perspectives on  topics relevant to pipeline security. While the information gathered during  the operator interviews cannot be generalized to all pipeline operators, it  provides a range of perspectives on a variety of topics relevant to pipeline  security. Additional details on the scope and methodology are available in  our published report.

The work upon which this statement is based was conducted in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Actions Needed to Address Weaknesses in TSA’s Pipeline Security Program Management

In our December 2018 report, we found that TSA provides pipeline  operators with voluntary security guidelines that operators can implement  to enhance the security of their pipeline facilities. TSA also evaluates the  vulnerability of pipeline systems through security assessments. Pipeline  operators and industry association representatives who we interviewed  also reported exchanging risk-related security information and  coordinating with federal and nonfederal entities, including TSA.  However, we also identified weaknesses in several areas of TSA’s  pipeline security program management, including: (1) updating and  clarifying pipeline security guidelines; (2) planning for workforce needs;  (3) assessing pipeline risks; and (4) monitoring program performance.

Exchanging Security Information and Coordinating with Federal and Nonfederal Entities

We found in our December 2018 report that all of the pipeline operators  and industry association representatives that we interviewed reported  receiving security information from federal and nonfederal entities. For  example, DHS components including TSA’s Intelligence and Analysis and  NCCIC share security-related information on physical and cyber threats  and incidents. Nonfederal entities included Information Sharing and  Analysis Centers, fusion centers, industry associations, and subsector  coordinating councils.

Pipeline operators also reported that they share security-related  information with TSA and the NCCIC. For example, TSA’s Pipeline  Security Guidelines requests that pipeline operators report physical  security incidents to the Transportation Security Operations Center  (TSOC) and any actual or suspected cyberattacks to the NCCIC.  According to TSA officials, TSOC staff analyzes incident information for  national trends and common threats, and then shares their observations  with pipeline operators during monthly and quarterly conference calls.

In our December 2018 report, we found that the pipeline operators we  interviewed reported using a range of guidelines and standards to  address their physical and cybersecurity risks. For example, all 10 of the  pipeline operators we interviewed stated they had implemented the  voluntary 2011 TSA Pipeline Security Guidelines that the operators  determined to be applicable to their operations. Five of the 10 pipeline  operators characterized the guidelines as generally or somewhat effective  in helping to secure their operations, 1 was neutral on their effectiveness,  and 4 did not provide an assessment of the guidelines’ effectiveness.  Pipeline operators and industry association representatives reported that  their members also use the Interstate Natural Gas Association of  America’s Control Systems Cyber Security Guidelines for the Natural Gas  Pipeline Industry, the American Petroleum Institute’s Pipeline SCADA  Security standard, and the National Institute of Standards and  Technology’s (NIST) Cybersecurity Framework as sources of  cybersecurity standards, guidelines, and practices that may be scaled  and applied to address a pipeline operator’s cybersecurity risks.

We found that TSA’s Pipeline Security Branch had issued revised  Pipeline Security Guidelines in March 2018, but TSA had not established  a documented process to ensure that revisions occur and fully capture  updates to supporting standards and guidance. The guidelines were  revised to, among other things, reflect the dynamic threat environment  and to incorporate cybersecurity principles and practices from the NIST  Cybersecurity Framework, which was initially issued in February 2014.  However, because NIST released version 1.1 of the Cybersecurity  Framework in April 2018, the guidelines that TSA released in March 2018  did not incorporate cybersecurity elements that NIST added to the latest  Cybersecurity Framework, such as the Supply Chain Risk Management  category. Without a documented process defining how frequently TSA is  to review and, if deemed necessary, revise its guidelines, TSA cannot  ensure that the guidelines reflect the latest known standards and best  practices of physical security and cybersecurity.

We recommended that TSA implement a documented process for  reviewing, and if deemed necessary, revising TSA’s Pipeline Security  Guidelines at regular defined intervals. DHS agreed and estimated that  this effort would be completed by April 30, 2019. In April 2019, TSA  provided us with documentation outlining procedures for reviewing these  guidelines. We are currently assessing this information to determine if it  sufficiently addresses this recommendation.

We also found that TSA’s Pipeline Security Guidelines lacked clarity in  the definition of key terms used to determine critical facilities. TSA initially  identifies the 100 highest risk pipeline systems based on the amount of  material transported through the system. Subsequently, pipeline  operators are to use criteria in the Guidelines to self-identify the critical  facilities within those higher risk systems and report them to TSA. TSA’s  Pipeline Security Branch then conducts CFSRs at the critical facilities  identified by pipeline operators. However, our analysis of TSA’s data  found that at least 34 of the top 100 critical pipeline systems TSA deemed  highest risk indicated that they had no critical facilities. Three of the 10  operators we interviewed stated that some companies that reported to  TSA that they had no critical facilities may possibly be taking advantage  of the guidelines’ lack of clarity. For example, one of TSA’s criteria for  determining pipeline facility criticality states that if a facility or combination  of facilities were damaged or destroyed, it would have the potential to  “cause mass casualties or significant health effects.” Two operators told  us that individual operators may interpret TSA’s criterion, “cause mass  casualties or significant health effect,” differently. For example, one of the  operators that we interviewed stated that this criterion could be  interpreted either as a specific number of people affected or a sufficient  volume to overwhelm a local health department, which could vary  depending on the locality.

Without clearly defined criteria for determining pipeline facilities’ criticality,  TSA cannot ensure that pipeline operators are applying guidance  uniformly, that all of the critical facilities across the pipeline sector have  been identified, or that their vulnerabilities have been identified and  addressed. We recommended that TSA’s Security Policy and Industry  Engagement’s Surface Division clarify TSA’s Pipeline Security Guidelines  by defining key terms within its criteria for determining critical facilities.  DHS agreed and estimated that this effort would be completed by June  30, 2019.

TSA conducts pipeline security reviews—CSRs and CFSRs—to assess  pipeline vulnerabilities and industry implementation of TSA’s Pipeline  Security Guidelines. However, the number of reviews conducted has  varied widely from fiscal years 2014 through 2018. These reviews are  intended to develop TSA’s knowledge of security planning and execution  at critical pipeline systems and lead to recommendations for pipeline  operators to help them enhance pipeline security. For an overview of the  CSR and CFSR processes, see Figure 1 below.

We found that the number of CSRs and CFSRs completed by TSA has  varied during the last five fiscal years, ranging from zero CSRs conducted  in fiscal year 2014 to 23 CSRs conducted in fiscal year 2018, as of July  31, 2018 (see Figure 2 below). TSA officials reported that staffing  limitations had prevented TSA from conducting more reviews.

TSA Pipeline Security Branch staffing levels (excluding contractor  support) also varied significantly over the past 9 years ranging from 14  full-time equivalents in fiscal years 2012 and 2013 to one in fiscal year  2014 (see Table 1 below). TSA officials stated that, while contractor  support has assisted with conducting CFSRs, there were no contractor  personnel providing CSR support from fiscal years 2010 through 2017,  but that contractors increased to two personnel in fiscal year 2018. TSA  officials stated that they expected to complete 20 CSRs and 60 CFSRs  per fiscal year with Pipeline Security Branch employees and contract  support, and had completed 23 CSRs through July 2018 for fiscal year  2018.

In addition, pipeline operators that we interviewed emphasized the  importance of cybersecurity skills among TSA staff. Specifically, 6 of the  10 pipeline operators and 3 of the 5 industry representatives we  interviewed reported that the level of cybersecurity expertise among TSA  staff and contractors may challenge the Pipeline Security Branch’s ability  to fully assess the cybersecurity portions of its security reviews.

We found that TSA had not established a workforce plan for its Security  Policy and Industry Engagement or its Pipeline Security Branch that  identified staffing needs and skill sets such as the required level of  cybersecurity expertise among TSA staff and contractors. We therefore  recommended that TSA develop a strategic workforce plan for its Security  Policy and Industry Engagement Surface Division, which could include  determining the number of personnel necessary to meet the goals set for  its Pipeline Security Branch, as well as the knowledge, skills, and abilities,  including cybersecurity, that are needed to effectively conduct CSRs and  CFSRs. DHS agreed and estimated that this effort would be completed by  July 31, 2019.

The Pipeline Security Branch has developed a risk assessment model  that combines all three elements of risk—threat, vulnerability, and  consequence—to generate a risk score for pipeline systems. The Pipeline  Security Branch developed the Pipeline Relative Risk Ranking Tool in  2007 for use in assessing various security risks to the top 100 critical  pipeline systems based on volume of material transported through the  system (throughput).

The risk ranking tool calculates threat, vulnerability, and consequence for  each pipeline system on variables such as the amount of throughput in  the pipeline system and the number of critical facilities using data  collected from pipeline operators, as well as other federal agencies such  as the Departments of Transportation and Defense. The ranking tool then  generates a risk score for each of the 100 most critical pipeline systems  and ranks them according to risk, which was information used by TSA to  prioritize pipeline security assessments.

However, in our December 2018 report we found that the last time the  Pipeline Security Branch calculated relative risk among the top 100  critical pipeline systems using the ranking tool was in 2014. Since the risk  assessment had not changed since 2014, information on threat may be  outdated and may limit the usefulness of the ranking tool in allowing the  Pipeline Security Branch to effectively prioritize reviews of pipeline  systems. We recommended that the Security Policy and Industry  Engagement’s Surface Division update the Pipeline Relative Risk  Ranking Tool to include up-to-date data to ensure it reflects industry  conditions, including throughput and threat data. DHS agreed and in  March 2019 TSA officials reported taking steps to update the data in the  Pipeline Risk Ranking Tool to reflect current pipeline industry data. We  are currently reviewing those actions to determine if they sufficiently  address our recommendation.

We also found that some of the sources of data and vulnerability  assessment inputs to the ranking tool were not fully documented. For  example, threats to cybersecurity were not specifically accounted for in  the description of the risk assessment methodology, making it unclear if  cybersecurity threats were part of the assessment’s threat factor. We  recommended that the Security Policy and Industry Engagement’s  Surface Division fully document the data sources, underlying  assumptions, and judgments that form the basis of the Pipeline Relative  Risk Ranking Tool, including sources of uncertainty and any implications  for interpreting the results from the assessment. In March 2019, TSA  officials stated that they had taken steps to document this information. We  are currently reviewing those steps to determine if they sufficiently  address our recommendation.

In our December 2018 report, we also found that TSA developed three  databases to track CSR and CFSR recommendations and their  implementation status by pipeline facility, system, operator, and product  type. TSA officials stated that the primary means for assessing the  effectiveness of the agency’s efforts to reduce pipeline security risks was  through conducting pipeline security reviews—CSRs and CFSRs.  However, while TSA does track CFSR recommendations, we found that  TSA had not tracked the status of CSR recommendations for security  improvements in over 5 years—information necessary for TSA to  effectively monitor pipeline operators’ progress in improving their security  posture. We recommended that TSA take steps to enter information on  CSR recommendations and monitor and record their status. DHS agreed  and estimated that this effort would be completed by November 30, 2019.

Chairman Rush, Ranking Member Upton, and Members of the  Subcommittee, this completes my prepared statement. I would be  pleased to respond to any questions that you may have at this time.

If you or your staff members have any questions about this testimony,  please contact me at (202) 512-8777 or russellw@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this statement. Other individuals making key  contributions to this work include Ben Atwater, Assistant Director; Steve  Komadina, Analyst-in-Charge; Nick Marinos, Michael Gilmore, Tom  Lombardi, Chuck Bausell and Susan Hsu.

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.

The U.S. depends on interstate pipeline systems to deliver products like oil and gas. These computerized systems are attractive targets for hackers and terrorists. (Cybersecurity, including the protection of cyber critical infrastructure, is on our High Risk List.)

We testified about weaknesses in how TSA manages its pipeline security efforts. For example, it had no process for determining when to update its security guidelines for pipeline operators. We previously made 10 recommendations, including that TSA establish better processes for updating its guidelines. In April 2019, TSA reported new procedures for doing so, which we are reviewing.