Nuclear Security: The International Atomic Energy Agency Could Improve Priority Setting, Performance Measures, and Funding Stabilization

Nuclear terrorism remains a significant threat to the security of the United States and its allies and partners. U.S. efforts to prevent nuclear terrorism include working with IAEA, an autonomous international agency affiliated with the United Nations. The Department of State coordinates the United States' policy with and financial contributions to IAEA. IAEA's nuclear security program aims to assist countries in enhancing the physical protection, control, and accounting of their nuclear and radiological material and nuclear facilities.

GAO was asked to review IAEA's nuclear security program. This report examines (1) the structure and range of nuclear security work that IAEA conducts, (2) how IAEA plans and prioritizes its nuclear security work and measures performance, and (3) the challenges that IAEA's nuclear security program faces. GAO analyzed key IAEA documents and interviewed IAEA officials, U.S. and foreign government officials, and nuclear security experts.

The International Atomic Energy Agency (IAEA) carries out its nuclear security program under its Division of Nuclear Security through four subprograms. IAEA activities under these subprograms include developing guidance, providing training, and assisting countries in enhancing nuclear and radiological material security.

IAEA plans its nuclear security work through several key documents, including a Nuclear Security Plan, which calls for activities to be prioritized. However, IAEA's planning documents do not include guidelines for prioritization. Instead, IAEA officials said they respond to member states' requests as they arrive and to the extent resources are available. By developing guidelines for prioritizing its nuclear security activities, IAEA could help ensure that it is allocating its resources to the areas of greatest need. IAEA has developed performance measures for its nuclear security program, but these measures do not have baselines or targets. This limits IAEA's ability to demonstrate the results of its nuclear security program.

IAEA member states disagree over the agency's role in nuclear security, and according to U.S. and other member-state officials and experts GAO interviewed, these disagreements create challenges for the agency, such as funding its nuclear security efforts. Officials added that states that do not support the agency's nuclear security role resist efforts to substantially raise the agency's regular budget for nuclear security, contributing to the program's heavy reliance on voluntary, or extra-budgetary, contributions from member states.

GAO previously reported that extra-budgetary funding is unreliable. Reliance on such funding affects nuclear security program planning, human resources, and sustainability. Experts and U.S. agency officials have suggested options to stabilize nuclear security program funding, but IAEA has not analyzed such options. By working with the United States and other member states to analyze options to stabilize nuclear security program funding, IAEA could ensure that it has sufficient, reliable resources to implement the Nuclear Security Plan.

GAO is making five recommendations to the Department of State, including that it work with IAEA to develop guidelines for prioritizing IAEA's nuclear security activities, develop program baselines and targets, and work with the United States and other member states to analyze options to stabilize nuclear security funding. State concurred with all five recommendations.

According to the 2018 Nuclear Posture Review, nuclear terrorism  remains among the most significant threats to the security of the United  States and its allies and partners. Nuclear materials stolen from poorly  secured stockpiles in various locations around the world could be used to  construct a nuclear device, and sabotage of a nuclear facility could result  in a dangerous release of radiation. A 2018 study found that 22 countries  have weapons-usable nuclear materials, with nearly 1,000 metric tons of  such materials in countries with deteriorating risk environments. The  same study found that 44 countries and Taiwan have nuclear facilities  that could be vulnerable to sabotage.

Key U.S. efforts to prevent nuclear terrorism include securing nuclear  weapons, materials, and related technology and enhancing cooperation  with international institutions, including the International Atomic Energy  Agency (IAEA). IAEA’s nuclear security program aims to assist countries  in enhancing the physical protection, control, and accounting of their  nuclear and radiological material and nuclear facilities, among other  things. The agency, which has assisted countries in establishing and  improving their nuclear security regimes since the early 1970s, assumed  a more official nuclear security role after the September 11, 2001, terrorist  attacks on the United States. This role has continued to grow in concert  with increased international efforts to strengthen nuclear security. In  2002, IAEA’s Board of Governors approved the agency’s first  comprehensive plan of action to protect against nuclear terrorism and  established the Office of Nuclear Security within the Department of  Nuclear Safety and Security. In 2013, the Office became the Division of  Nuclear Security (DNS) within that department.

In May 2013 we reported that IAEA’s nuclear security program faced a  number of difficulties, including a heavy reliance on voluntary extra- budgetary contributions, which vary from year to year and are often  designated by donors for specific projects in certain countries. We also  found that IAEA did not systematically report on its performance, without  which member countries and the international community at large cannot  gauge the extent to which IAEA is achieving its goals or assess the  nuclear security program’s impact and effectiveness. We recommended  that the Department of State work with IAEA to evaluate the nuclear  security program’s long-term resource needs and systematically report on  the results of the agency’s performance measures for the nuclear security  program. State disagreed with and did not implement the  recommendation on evaluating resource needs but implemented our  recommendation on reporting.

Expectations of the role IAEA could play in international nuclear security  increased in the aftermath of the U.S.-initiated Nuclear Security Summits  that were held between 2010 and 2016. The summits convened world  leaders to make commitments to secure and reduce nuclear material  stocks and enhance the physical protection of nuclear facilities and to  draw high-level political attention to nuclear security. At the last summit in  Washington, D.C., in 2016, summit participants issued an Action Plan in  Support of the IAEA to document their commitment to recognizing and  supporting IAEA’s nuclear security role. Participants in the Action Plan in  Support of the IAEA agreed to, among other things, (1) advocate for IAEA  to continue to develop and implement its nuclear security plans to  address current and emerging nuclear security issues, (2) enhance the  importance of nuclear security within IAEA, and (3) advocate for IAEA to  continue its leading role in coordinating international nuclear security  activities. Some Nuclear Security Summit participants also established  the Nuclear Security Contact Group (NSCG) to continue the work of the  summit process after it ended. The group’s mission includes promoting  and assessing the implementation of nuclear security commitments made  at the summits and developing and maintaining connections to  nongovernmental experts and the nuclear industry.

You asked us to review IAEA’s nuclear security program in the aftermath  of the Nuclear Security Summits and the agency’s ability to play an  effective long-term role in cultivating and deepening international nuclear  security cooperation. This report examines (1) the structure and range of  nuclear security work that IAEA conducts, (2) how IAEA plans and  prioritizes its nuclear security work, and how it measures and reports on  its performance, and (3) the challenges that IAEA’s nuclear security  program faces.

To address all three objectives, we interviewed officials from the  Department of State (State), the Department of Energy’s National Nuclear  Security Administration, the Department of Defense, the National Security  Council, and the Nuclear Regulatory Commission; officials from IAEA;  officials representing IAEA member states; and independent nuclear  security experts. We selected the U.S. agencies based on their  involvement in nuclear security policy, including the extent of their  interactions with IAEA. State is the lead agency for interacting with IAEA  and has represented the United States in the NSCG since September  2018; the National Nuclear Security Administration provides technical  expertise and loans staff to IAEA; the Nuclear Regulatory Commission  provides a regulatory perspective on how IAEA’s guidance may impact  states’ regulations; the Department of Defense collaborates on IAEA  training (for example, for border monitoring); and the National Security  Council leads interagency coordination to develop U.S. priorities for  nuclear security and initially represented the United States in the NSCG  through August 2018.

To gain the perspectives of IAEA member states, we selected states  based on their involvement in IAEA’s nuclear security work and  suggestions from State and nuclear security experts; the selected  member states represent a range of perspectives on IAEA’s nuclear  security role but cannot be generalized to the universe of IAEA member  states. We selected nuclear security experts based on a literature search  and suggestions from the original interviewees. We summarized the  information gathered from officials and experts in the report by using  “some” to refer to three members of a group, “several” to refer to four or  five members of a group, and “many” to refer to more than five members  of a group. We interviewed officials representing 12 member states, and  20 experts.

To examine the structure and range of IAEA’s nuclear security work, how  IAEA plans and prioritizes that work, and how it measures and reports on  performance, we reviewed pertinent legal instruments (such as the  Convention on the Physical Protection of Nuclear Material and the Statute  of the IAEA) and IAEA documents (such as the 2017 Nuclear Security  Resolution, the 2018-2021 Nuclear Security Plan, and IAEA’s most recent  annual reports). To further examine how IAEA plans and prioritizes its  work, we consulted IAEA’s planning documents and the Project  Management Institute’s The Standard for Program Management. To  further examine how the agency measures and reports on performance,  we compared the agency’s planning documents and reports with leading  practices for performance management and reporting—including leading  practices derived from our prior work—and IAEA’s results-based  management approach. We derived some of these leading practices from  standards and practices developed for federal agencies, such as those  established in Standards for Internal Control in the Federal Government.

Although federal standards are not required to be used by international  organizations such as IAEA, the leading practices based on these  standards can be instructive for assessing IAEA performance  measurement and reporting.

To examine the challenges the agency’s nuclear security program faces,  we reviewed the IAEA documents noted above as well as others, such as  proceedings from meetings and conferences, and data on budgetary  contributions from the United States and other member states. We also  assessed actions the agency and member states have taken to  potentially mitigate challenges by comparing those actions with  commitments in the Action Plan in Support of the IAEA. In addition, we  compared IAEA’s coordination practices against GAO key practices for  collaboration. For more information on our scope and methodology, see  appendix I.

We conducted this performance audit from March 2018 to July 2019 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

IAEA’s policy-making bodies include the Board of Governors, which  consists of 35 member states, including the United States as a de-facto  permanent member; and the General Conference, which consists of all  171 member states of IAEA. The agency’s staff, led by the Director  General, is referred to as the Secretariat and is organized into six  departments that implement programs approved by the Board of  Governors and the General Conference. The Division of Nuclear Security,  within the Department of Nuclear Safety and Security, implements the  nuclear security program. Figure 1 shows the position of DNS within the  agency.

The agency’s other departments include the Department of Safeguards,  which carries out technical measures and activities by which IAEA seeks  to verify that nuclear material subject to safeguards is not diverted to  nuclear weapons or other proscribed purposes; and the Department of  Technical Cooperation, which provides nuclear technologies and  expertise to member states. In addition to the departments, the agency  has offices that report to the Director General, such as the Office of Legal  Affairs.

The Nuclear Security Legal Framework and IAEA’s Nuclear Security Role

IAEA’s statute is the foundation of the agency’s dual mission of promoting  the peaceful uses of nuclear energy and verifying through safeguards that  nuclear technologies and materials are used for peaceful purposes and  not diverted to nuclear weapons. Nuclear security is not an explicit part  of this broader mission, but the agency has identified several of its  statutory authorities as underpinning its nuclear security role. For  example, the statute authorizes the agency to exchange scientific and  technical information on peaceful uses of atomic energy, which IAEA  does under its nuclear security program.

In addition, a number of international treaties establish a nuclear security  role for the agency, including:

The Convention on the Physical Protection of Nuclear Material  (CPPNM) and its 2005 amendment. This convention originally  addressed the security of nuclear materials in international transport.  A 2005 amendment, which entered into force in 2016, requires parties  to establish, implement, and maintain a physical protection regime for  nuclear materials and facilities in domestic use, storage, and  transport. The amendment encourages states to consult with IAEA to  obtain guidance on the design, maintenance, and improvement of  their national systems of physical protection of nuclear material.

International Convention for the Suppression of Acts of Nuclear  Terrorism. This convention refers to IAEA as a source of guidance to  States parties on measures for security of nuclear materials and  charges IAEA with transmitting information to States parties, following  an offense under the convention, on the disposition or retention of  radioactive material, devices, or facilities taken control of during the  response.

In addition, United Nations Security Council Resolution 1540 calls upon  states to refrain from supporting by any means non-state actors that  attempt to, among other activities, acquire, use, or transfer nuclear,  chemical, or biological weapons and their delivery systems. The  resolution also calls upon states to engage in activities similar to those  described in IAEA’s Nuclear Security Plan. For example, the resolution  calls on states to take and enforce effective measures to establish  domestic controls to prevent the proliferation of nuclear weapons,  including physical protection measures; IAEA provides guidance and  other support for applying such measures to civilian nuclear materials.  The resolution also calls for measures to prevent illicit trafficking, to  establish effective export controls, and to renew and fulfill commitments to  multilateral cooperation in particular within the framework of the IAEA.

IAEA funds its programs primarily through (1) its regular budget, for which  all member countries are assessed an annual contribution, and (2)  extra-budgetary cash contributions, which are voluntary. In addition, IAEA  has a Technical Cooperation Fund—generally supported through  voluntary annual contributions of member states—to be used for technical  cooperation projects. The State Department coordinates the United  States’ policy with and financial contributions to IAEA and is the lead U.S.  agency for interacting with IAEA.

In 2018, IAEA’s total regular budget was $437.9 million, and  approximately $103.5 million was unfunded (to be funded through extra- budgetary contributions). In 2018, the Division of Nuclear Security’s  regular budget was approximately $6.9 million, and $25.2 million was  unfunded (to be funded through extra-budgetary contributions). The  Nuclear Security Fund, established after the September 2001 terrorist  attacks, holds the extra-budgetary funding for most of IAEA’s nuclear  security activities. Figure 2 shows the levels of regular and extra- budgetary funding for DNS over the last three biennial budget cycles,  from 2014 to 2019.

According to IAEA officials, the agency operates under substantial budget  constraints as a number of member states advocate for zero-nominal- growth budgets. This has generally caused IAEA’s programs to operate  under minimal growth in their regular budgets from year to year and to  seek efficiencies on an ongoing basis. Extra-budgetary contributions are  not subject to these constraints.

As part of an initiative to secure all vulnerable nuclear material around the  world, the United States hosted 47 world leaders in Washington, D.C., for  a Nuclear Security Summit in 2010. The summit organizers invited a  range of participants, taking into account the scale of their nuclear energy  programs and countries’ access to weapons-usable materials. Additional  summits were held in Seoul, South Korea, in 2012; the Hague, the  Netherlands, in 2014; and again in Washington, D.C. in 2016. The  Nuclear Security Summits brought heads of state together to discuss and  bring high-level international attention to nuclear security issues. These  summits led to, among other things, the removal or elimination of nuclear  material from civilian facilities across the globe, ratification and  implementation of treaties, conversion of reactors to operate on low- enriched uranium, and the strengthening of regulations. Summit  participants issued an Action Plan in Support of the IAEA during the final  summit in 2016 to document their commitments to IAEA’s nuclear security  mission. Commitments in the Action Plan in Support of the IAEA included  recognizing the leading role of the agency for coordinating multilateral  nuclear security activities as well as committing high-level support for the  IAEA’s nuclear security activities and advocacy for IAEA’s coordination  role and provision of guidance.

IAEA Structures Its Nuclear Security Work into Four Subprograms That Encompass Activities Ranging from Developing Guidance to Coordinating International Efforts

IAEA’s nuclear security activities are conducted primarily under its  nuclear security program, which consists of four subprograms. Under  these subprograms, IAEA carries out a wide range of nuclear security  activities, including developing and promoting the use of nuclear security  guidance documents, providing assistance to member states, and  developing training programs. IAEA also coordinates international nuclear  security efforts.

IAEA’s Nuclear Security Program Consists of Four Subprograms

IAEA’s nuclear security activities are conducted primarily under the  agency’s nuclear security program, which consists of four subprograms:

Nuclear Security of Materials and Facilities. This subprogram  covers the security of nuclear and other radioactive material and  associated facilities and activities including transport.

Nuclear Security of Materials Outside of Regulatory Control. This  subprogram covers detection of criminal or intentional unauthorized  acts involving nuclear or radioactive material and responding to  nuclear events.

Information Management. This subprogram is responsible for  establishing and maintaining systems to collect and analyze nuclear  security information.

Program Development and International Cooperation. This  subprogram covers international nuclear security coordination and  provides education and training programs. It also manages donor  relations and the Nuclear Security Fund.

The Nuclear Security Program is implemented by IAEA’s Division of  Nuclear Security (DNS), which is structured into four sections that  correspond to the four subprograms. Figure 3 shows the projects carried  out by each section.

Other IAEA offices coordinate with DNS to carry out the agency’s nuclear  security activities. For example, IAEA’s Department of Nuclear Energy  collaborates with DNS to convert reactors to run on low-enriched  uranium, return nuclear materials resulting from the conversion to the  country of origin, and assist with the disposition of disused radioactive  sources. The agency’s Office of Legal Affairs supports DNS by promoting  universal adoption of the Convention on the Physical Protection of  Nuclear Material and its 2005 amendment and helping member states  with legal and regulatory understanding of the convention and drafting  review.

IAEA Develops Guidance, Provides Assistance and Training to Member States, and Coordinates International Nuclear Security Efforts, Among Other Things

Under the four subprograms, IAEA conducts a broad range of nuclear  security activities including (1) developing nuclear security guidance; (2)  providing assistance to member states in areas such as establishing  legal, regulatory, and technical nuclear security infrastructure, and  converting reactors to operate on non-weapons usable materials; (3)  providing training and education; and (4) coordinating international  nuclear security efforts.

IAEA develops nuclear security guidance documents and encourages  member states to adopt and implement the guidance to improve their  nuclear security regimes. IAEA’s Nuclear Security Guidance Committee,  established by the Director General in 2012, makes recommendations to  IAEA on what nuclear security guidance to develop and approves  guidance publications. The Nuclear Security Guidance Committee is open  to all member states. DNS’s four sections contribute to the development  of guidance. For example, the Information Management section develops  guidance relating to computer security at nuclear facilities, and the  Nuclear Security of Materials and Associated Facilities section develops  guidance in the area of physical protection of nuclear materials and  facilities.

DNS develops two main sets of guidance documents: the Nuclear  Security Series and Codes of Conduct.

The Nuclear Security Series, launched in 2006, is continuously updated  by IAEA in cooperation with experts from member states. The series  comprises four broad categories of publications:

Nuclear Security Fundamentals, which establish the fundamental objectives and essential elements of states’ national nuclear security regimes.

Recommendations, which set out measures that states should take to achieve and maintain effective regimes.

Implementing Guides, which provide guidance on implementing  security measures.

Technical Guidance, which provides detailed guidance on specific  methodologies and techniques for implementing security measures.

Within each category, there are specific guidance documents, such as  “Establishing the Nuclear Security Infrastructure for a Nuclear Power  Programme” and “Nuclear Security Systems and Measures for Major  Public Events.”

The publications’ principal users are regulatory bodies for nuclear and  radiation security and other relevant member-state authorities, such as  those involved in law enforcement and forensics, border control and  customs, and intelligence gathering. Other users include international  organizations with responsibilities relevant to nuclear security;  organizations that design, manufacture, and operate nuclear facilities;  and organizations involved in the use of radiation related technologies.

Another set of publications, the Codes of Conduct, are meant to serve as  guidance to states for the development and harmonization of policies,  laws and regulations. They include a Code of Conduct on the Safety and  Security of Radioactive Sources.

IAEA provides a variety of nuclear security assistance, which member  states may request through the Integrated Nuclear Security Support Plan  (INSSP) process, in which DNS works with member states to jointly  conduct a comprehensive and systematic review of their nuclear security  regimes and identify potential areas for improvement. DNS works with  member states that request an INSSP to develop implementation  strategies, based on the nuclear security needs identified, for IAEA or  potential donors to provide assistance to the state. The INSSPs serve as  input for the work plans of each DNS section. Member states may also  request ad hoc assistance outside this process.

IAEA’s nuclear security assistance includes helping member states  establish legal, regulatory, and technical infrastructure to secure nuclear  materials and facilities, and helping states detect and respond to  “materials out of regulatory control”—material present in sufficient  quantity that it should be under regulatory control but is not. IAEA may  help to identify the need for assistance through advisory missions and  peer reviews, such as International Physical Protection Advisory Service  missions. These missions assist countries in strengthening their national  civilian nuclear security regimes by providing (1) guidance on the  protection of nuclear material and facilities, as well as of sealed  radioactive sources and other radioactive material; (2) best practices in  nuclear security; and (3) peer advice on implementing international  agreements related to physical protection of nuclear material and  facilities. Since 1996, IAEA has conducted 84 International Physical  Protection Advisory Service missions in 50 countries. In addition, IAEA  conducts International Nuclear Security Advisory Service missions to help  member states establish effective nuclear security regimes that address  nuclear and other radioactive “material out of regulatory control.”  According to IAEA officials, in 2016 the agency suspended International  Nuclear Security Advisory Service missions while DNS updated the  supporting guidance, but it intends to restart such missions in 2019.

IAEA also assists member states hosting major public events in  strengthening nuclear security measures before and during the events.  Assistance provided for major public events includes coordination  meetings, workshops, and training on the use of detection equipment.  The agency reported that, from July 2017 through June 2018, it assisted  states with preparing for at least seven major public events, such as the  29th Southeast Asian Games in Malaysia in August 2017 and the G20  Buenos Aires Summit in Argentina in November 2018.

In addition, IAEA assists with converting reactors to operate on low- enriched uranium rather than highly enriched uranium and contributes to  the design of reactor cores that operate on low-enriched uranium. IAEA  also assists with the repatriation of fissile and radioactive material from  countries that no longer require or cannot adequately secure those  materials to more secure storage in other countries. As previously noted,  IAEA’s Department of Nuclear Energy assists DNS with converting  reactors to run on low-enriched uranium. The Department of Nuclear Energy also works with DNS on management strategies for disused  radioactive sources. With regard to radioactive material, IAEA reported  that, from July 2017 through June 2018, it helped repatriate three highly  radioactive materials from Lebanon to Canada and 27 such materials  from South America to Germany and the United States.

IAEA conducts several types of nuclear security training and education  activities to support member state capacity building, including workshops  and exercises. The agency reported that, from July 2017 through June  2018, it provided in-person training for more than 2,400 participants from  149 member states on subjects including physical protection of nuclear  material and computer security. IAEA has also developed e-learning  courses to make training more accessible. In addition, IAEA supports  member states in developing Nuclear Security Support Centers. The  purpose of these centers is to effectively develop nuclear security  knowledge and associated technical skills in states to promote the long  term sustainability and effectiveness of nuclear security in those states.

The agency also supports the International Nuclear Security Education  Network, a partnership through which IAEA, educational and research  institutions, and other stakeholders cooperate to promote nuclear security  education. This network connects 170 institutions from 62 member states  to assist them in establishing and enhancing nuclear security education.  Network members collaborate in areas such as the development of peer- reviewed textbooks, instructional material, computer-based teaching  tools, and exercises and materials for laboratory work; faculty  development in different areas of nuclear security; joint research and  development activities to share scientific knowledge and infrastructure;  and quality assurance.

Coordinating International Nuclear Security Efforts

IAEA coordinates international nuclear security efforts through activities  such as hosting information exchange meetings, organizing events and  conferences, and promoting universal adoption of international legal  instruments. Twice a year, IAEA hosts information exchange meetings to  coordinate nuclear security activities with other organizations, such as the  Global Initiative to Combat Nuclear Terrorism. IAEA reported hosting  information exchange meetings in November 2017 and April 2018. The  agency organizes a range of events and conferences, including the  International Conference on Nuclear Security, which brings together  ministerial-level representation to discuss important issues related to  nuclear security. IAEA’s activities to promote the universal adoption of  international agreements relevant to nuclear security—such as the  Convention on the Physical Protection of Nuclear Material and its 2005  amendment—include working with states directly, speaking at  conferences, and offering model legislation for states to follow.

In addition, IAEA manages the Incident and Trafficking Database, which  catalogues reports by participating states about details of thefts, losses,  and other unauthorized activities and events involving nuclear and other  radioactive material out of regulatory control. The details of such incidents  are accessible to participating states, with limited information accessible  to other UN-affiliated organizations.

IAEA Plans Its Nuclear Security Work through a Range of Documents but Does Not Prioritize Activities or Fully Measure or Report on Program Performance IAEA Plans Its Nuclear Security Activities through a Range of Documents but Does Not Prioritize Those Activities

IAEA plans its nuclear security work through a range of documents,  including a biennial Programme and Budget (P&B). However, IAEA does  not prioritize its nuclear security activities. In addition, IAEA’s  performance measures have limitations, and agency reports on nuclear  security do not consistently include performance information.

IAEA has two primary planning documents for nuclear security:

Nuclear Security Plan. This 4-year planning document describes the  nuclear security program’s tasks and outputs by project. The Nuclear  Security Plan, which is approved by the Board of Governors, identifies  broad priority areas, such as physical protection and nuclear security  detection architecture and response.

Programme and Budget (P&B). This biennial document, which is  approved by the General Conference, identifies current IAEA program  funding levels and future funding needs. The P&B also lays out  objectives and associated outcomes and performance measures for  the entire agency, including the nuclear security program and its  subprograms. Figure 4 shows the objectives for the nuclear security  program. In addition, the P&B identifies planned outputs for each  project under the nuclear security subprograms.

However, these documents contain only broad statements on prioritizing  activities, providing limited guidance to DNS. Specifically, the Nuclear  Security Plan calls for the agency to carry out its nuclear security  activities in a prioritized manner with available resources, without further  guidance about how to prioritize activities. Similarly, the P&B establishes  two broad criteria for prioritization:  1)  completion and maintenance of the universally applicable Nuclear  Security Series recommendations and guidance, and provision of  assessment and evaluation services at the request of member  states, and;  2)  the provision, upon request, of assistance based on an analysis of  needs, including those identified through INSSPs.

These criteria for prioritization are broad, effectively including almost all of  the DNS’s activities. When we compared these criteria to DNS’s projects  described in the 2018-2019 P&B, 12 of 13 projects aligned with at least  one criterion. For example, one project under the Information  Management section is to develop and implement INSSPs and a  voluntary self-assessment tool for member states to use. This project  aligns with the second criterion—the provision of assistance, including  assistance identified through the INSSPs—because developing INSSPs  helps the agency provide assistance to member states.

DNS officials said that they use the criteria in the P&B as broad  expectations set by member states for the nuclear security program,  noting that they do not prioritize among activities because member states  do not agree on priorities. Instead of actively prioritizing activities, DNS  officials said they respond to requests from member states as those  requests come in and to the extent that resources are available, taking  into account conditions on funding.

According to leading practices identified in the Project Management  Institute’s The Standard for Program Management, organizations’  resource management plans should describe the guidelines for making  decisions about priorities for using program resources and resolving  resource conflicts. However, DNS does not have guidelines for  prioritizing activities; there is no guidance in the Nuclear Security Plan,  and the criteria for prioritization in the P&B are too broad for division  officials to distinguish among competing needs. Such detailed guidelines  would help DNS ensure it is appropriately targeting its limited program  resources.

IAEA’s Performance Measures Have Limitations, and Agency Reports on Nuclear Security Do Not Consistently Include Performance Information

IAEA has established several performance measures for its nuclear  security program and subprograms, but these measures do not fully align  with leading practices. IAEA issues several reports on the results of the  nuclear security program, but these reports contain only some of the  agency’s performance measures.

DNS Has Developed Performance Measures, but They Have Limitations

IAEA has established four high-level performance measures in the P&B  that it uses to determine progress toward the nuclear security program’s  goals: (1) the number of member states requesting and receiving  assistance through INSSPs, (2) the number of member states  establishing or improving nuclear security measures based on advice  from the agency, (3) the number of activities duplicated by other  initiatives, and (4) the number of activities carried out in conjunction with  the agency. In addition, the P&B identifies from four to six performance  measures for each nuclear security subprogram. For example, the  number of states requesting assistance or participating in IAEA activities  to improve computer and information security capabilities is a  performance measure for the Information Management subprogram.

According to IAEA’s P&B, the agency follows a “results-based  management” approach, which is driven by articulating desired results  and measuring actual performance against those results. The P&B states  that key elements of this approach include establishing program  baselines and targets and measuring actual performance against these  baselines and targets to determine whether the program is achieving its  planned outcomes.

We reviewed IAEA’s nuclear security program performance measures  against four leading practices for performance management we have  previously reported on: (1) linking performance measures to the offices  responsible for implementing the programs, (2) limiting measures to the  vital few, (3) determining whether performance measures for the defined objectives are appropriate for evaluating the agency’s performance in  achieving those objectives, meaning that measures and processes for  measuring performance align with the objective, and (4) measuring  performance against baselines. The practice of measuring performance  against baselines is also consistent with IAEA’s results-based  management approach. Table 1 shows the extent to which DNS’s  performance measures meet leading practices.

We found that DNS’s performance measures fully met two of the four  leading practices. First, IAEA’s nuclear security program performance  measures linked to the offices responsible for implementing them, as  DNS’s four sections are responsible for implementing the four  subprograms of the corresponding name. For instance, a performance  measure linked to the Information Management subprogram within DNS  is the number of states requesting assistance or participating in IAEA  activities to improve computer and information security capabilities, and  the Information Management section implements the associated  subprogram, whose projects include information and computer security.  Second, IAEA’s nuclear security program performance measures are  limited to the vital few; as discussed above, there are four high-level  measures for the program and between four and six measures for each  subprogram.

We found that IAEA’s performance measures partially met the third of the  four leading practices. Specifically, they were generally appropriate for  evaluating their corresponding outcomes and objectives. The program  objective of playing a central role and enhancing international cooperation  in nuclear security fully aligned with its associated outcome of improved  global coordination and cooperation in supporting national efforts to  improve nuclear security. Also, the associated measures by which IAEA  assesses progress toward this outcome—the number of activities  duplicated by others and the number of activities carried out in  conjunction with IAEA—fully aligned with the outcome and objective.  However, for the other two program objectives, outcomes and measures  partially aligned with the objectives. For example, one of the nuclear  security program’s objectives is contributing to global nuclear security  efforts by establishing guidance and providing for its use through advisory  services and capacity building; there is a performance measure related to  advisory services, but no measure related to guidance.

We found that IAEA’s nuclear security program performance measures  did not meet the fourth leading practice, in that they did not include  baselines or targets. For example, the performance measure regarding  the number of states that have established or improved national nuclear  security measures and systems on the basis of advice from the agency  does not include a baseline of the number of states that already have  established effective nuclear security measures. The measure also does  not include a target for the number of states that should establish or  improve nuclear security measures. Without established baselines or  targets for each performance measure, IAEA’s ability to demonstrate  results for its nuclear security program is limited.

DNS officials acknowledged that the performance measures for the  nuclear security program and subprograms do not have targets or  baselines. They said that this is deliberate, based on nuclear security  being a national responsibility and the limitations of IAEA’s nuclear  security mandate. However, many of the performance measures for the  nuclear security program and subprograms are focused on activities the  agency carries out, for which DNS can develop targets and baselines;  they are not focused on activities of member states. DNS officials also  said that the division struggles to develop measures because the nuclear  security environment—for example, threats to computer security—is  continually evolving. However, many of these measures—such as  adherence to the Convention on the Physical Protection of Nuclear  Material—are independent of the security environment, and uncertainty  should not prevent programs from developing measures to track their  performance. By developing baselines and measurable targets to  demonstrate results, DNS can more effectively monitor and assess the  performance of its Nuclear Security Program.

IAEA Issues Several Reports That Provide Information on its Nuclear Security Program, but They Do Not Consistently Include Performance Measures

IAEA issues four sets of reports that provide information on its nuclear  security program to member states, key stakeholders, and the public,  including:

Nuclear Security Report. This annual report, developed by DNS,  describes the nuclear security program’s major achievements and  expenditures of the prior year, as well as goals for the following year.

Program Performance Report. This internal, agency-wide report  describes progress in implementing all of the agency’s programs and  identifies the resources used for each program in a given year.

IAEA Annual Report. This report provides a high-level overview of  the agency’s accomplishments and includes a section on the nuclear  security program.

Individual reports for each donor. These reports detail how DNS  uses extra-budgetary contributions from each donor country (or  government agency) in a given year; these reports are not shared with  other countries or agencies.

We have previously reported that program managers should  communicate necessary quality information so that both internal and  external parties can help the program achieve its objectives.  Communicating necessary quality information through reporting is  consistent with IAEA’s results-based management approach, according to  which results-based reports help the organization, stakeholders, and  funders to better understand the impact of a given program or project. We  have also found that completeness is an element of quality reporting;  completeness entails reporting on every performance goal and  measure.

In May 2013, we recommended that State work with IAEA and its  member states to systematically report on the results of the agency’s  performance measures. IAEA has subsequently taken steps to improve  reporting, such as aligning the Nuclear Security Report with the P&B. In  2018, DNS restructured the format of the Nuclear Security Report so that  each section of the report more clearly aligns with the nuclear security  program and its subprograms. According to IAEA officials, DNS devotes  substantial resources—including two full-time staff—to meeting all of its  reporting requirements.

Our analysis of three IAEA reports for 2016—the Nuclear Security Report,  the Annual Report, and the Program Performance Report—found that  DNS reports on some performance measures for its nuclear security  program, but not all. Specifically, in the Nuclear Security Report, DNS  reports on one measure fully and one partially and does not report on two  measures. Specifically,

DNS reports fully on the number of activities carried out in conjunction  IAEA reports partially on the number of states that request and  receive assistance, as identified in INSSPs. The agency reports on  the number of states that completed INSSPs and provides examples  of assistance but does not report whether that assistance was  requested through INSSPs. For example, in the 2016 Nuclear  Security Report, IAEA reported that five member states formally  approved INSSPs. The agency also reported several examples of  assistance to member states, such as training workshops on  radiological crime scene management for Colombia in February 2015,  Lithuania in February 2015, and the Philippines in June 2015.  However, the report did not specify whether the need for that  assistance was identified through INSSPs.

IAEA does not report on the number of member states that have  established or improved national nuclear security measures based on  advice from IAEA or the number of activities duplicated by other  initiatives.

None of the three IAEA reports we reviewed consistently includes  performance measures for the nuclear security subprograms. Table 2  shows the extent to which at least one of the three 2016 reports we  reviewed includes measures for program and subprogram performance.

Member states have expressed concerns with the effectiveness of IAEA’s  reporting on the nuclear security program. In 2018, IAEA member states  included language in the Nuclear Security Resolution to encourage the  agency to improve communication with the public and member states  about its nuclear security activities and their global impact. U.S. officials  we interviewed said that they are dissatisfied with the reports, including  with the quality of information on nuclear security activities, and would like  to see, among other things, better reporting on how those activities  support the agency’s mission, rather than reports that merely describe  activities completed.

IAEA officials provided two reasons why IAEA is limited in communicating  more comprehensive information on nuclear security program  performance in its reports. First, IAEA officials said that there are  sensitivities around the data IAEA collects about member states, and  member states are hesitant to share information on their security  weaknesses. However, IAEA can report on its program performance  without reporting sensitive information about individual states. Many of its  measures pertain to numbers of states, and in cases where there are  sensitivities, IAEA could aggregate data to a regional level to conceal  state-specific information. Second, IAEA officials said that member states  may not consistently make available to the agency the information it  would need to measure the impact of its work. For example, to measure  the number of states that established or improved national nuclear  security measures based on advice from the agency, IAEA would need to  know whether states implemented the agency’s recommendations.  However, as previously mentioned, most of IAEA’s performance measures are focused on activities the agency carries out and not  activities of member states. For example, one of the nuclear security  subprogram’s measures is the number of states that participate in the  Nuclear Security Guidance Committee. IAEA should have the data it  requires to report on measures focused on activities carried out or  facilitated by the agency.

The lack of completeness in DNS’s reporting limits the effectiveness of  the agency’s communication on the nuclear security program’s  performance. By consistently including the results of its performance  measures in at least one of its reports, IAEA could better communicate  internally and with external stakeholders on the nuclear security  program’s performance.

Member-State Disagreements over IAEA’s Nuclear Security Role Pose Challenges to DNS’s Resources and Coordinating Efforts

IAEA member states disagree over the agency’s role in nuclear security.  These disagreements have frequently contributed to DNS’s challenges  over resources and the agency’s central coordinating role in nuclear  security.

IAEA Member States Disagree over the Agency’s Nuclear Security Role

According to U.S. and member-state officials and experts, IAEA member  states disagree over the agency’s role in nuclear security. According to  U.S. officials, member states supportive of the agency’s nuclear security  role—such as the United States—see nuclear security as an issue with  trans-border implications and believe the agency is well suited to  supporting and facilitating cooperation on international, regional, and  national nuclear security efforts. U.S. officials said that some member  states do not see nuclear security as an international responsibility, but  rather only as a national one, and disagree with IAEA’s nuclear security  role to various extents. The disagreements over the agency’s role are  rooted in a number of issues:

Questions regarding the statutory basis for IAEA’s nuclear  security work. Some U.S. officials and experts told us that some  member states question IAEA’s nuclear security work because it is  not established in the agency’s statute. IAEA officials told us that  disputes over the statutory basis for IAEA’s nuclear security work are  no longer an issue, and officials representing member states that had  raised questions about the statutory basis for the work conceded that  the matter was settled. However, these member-state officials said  they felt strongly that because of the weak statutory basis, IAEA’s  nuclear security work should be limited to core areas such as physical  protection of nuclear facilities, rather than emerging areas such as  cybersecurity. According to U.S. officials, other member states  acknowledge the limited statutory basis for IAEA’s nuclear security  work but still recognize the IAEA’s nuclear security role, which  includes cybersecurity and newer areas of work.

Perception of nuclear security as a barrier to or competition with  IAEA support of civilian nuclear programs. According to IAEA,  U.S. and several member-state officials, some states are concerned  that IAEA’s nuclear security work could create barriers to their civilian  nuclear programs—for example, by requiring recipients of IAEA  technical cooperation to adhere to nuclear security guidance. In  addition, according to U.S. and some member-state officials, some  member states view IAEA’s nuclear security work as competing for  resources with the agency’s other programs, such as the Technical  Cooperation program, which assists member states with developing  civilian nuclear programs. U.S. officials said that the Group of 77  generally advocates for more of the agency’s funds to be allocated to  such programs.

Resistance to nuclear security as a proxy for disagreement on  other issues. U.S. officials, many mission officials, and many experts  said that political disagreements among member states on unrelated  or tangentially related international nuclear issues undermine IAEA’s  nuclear security work. For example, U.S. officials and many member- state officials and experts told us that disagreement between nuclear  weapons states and nonnuclear weapons states about nuclear  disarmament manifests itself as political resistance in various IAEA  forums to the agency’s nuclear security activities.

Resistance to the Nuclear Security Summits. Some U.S. and  member-state officials and experts said that some IAEA member  states resented the perceived exclusive nature of the Nuclear Security  Summits. As previously mentioned, the final summit in 2016 resulted  in an Action Plan in Support of the IAEA in which signatories made  commitments to support IAEA’s nuclear security mission. According to  several mission officials and experts we interviewed, some excluded  member states do not believe that the agency should carry forward  the summits’ work, which in their view represents the priorities of the  approximately 50 summit participants rather than all 171 IAEA  member states. One expert said that within IAEA, there is resistance  to anything associated with the summits among the member states  that did not participate and that those states do not want IAEA  involved in regulating or implementing anything resulting from the  summits.

Disagreements over the Agency’s Role Create Challenges by Reinforcing DNS’s Reliance on Extra- budgetary Contributions

IAEA officials and others we interviewed said that the disagreements over  the agency’s nuclear security role create tangible challenges for the  agency concerning funding, as member states that do not support the  agency’s nuclear security role resist efforts to substantially raise DNS’s  regular budget. As a result, according to IAEA, U.S., and several  member-state officials, DNS continues to rely heavily on extra-budgetary  contributions and has a smaller proportion of regular budget funding than  other IAEA divisions, including other parts of the Department of Nuclear  Safety and Security. DNS’s regular budget funding represents less than a  quarter of total nuclear security program funding, with 78 percent of the  funding coming from extra-budgetary contributions (see fig. 5).

As we have previously reported, the extra-budgetary contributions on  which DNS relies are voluntary, unpredictable from year to year, and  inflexible, as they are often directed to specific purposes and often carry  additional conditions. As a consequence, the nuclear security program’s  large reliance on extra-budgetary support affects program management  and human resources in ways that may undermine effective management  of the program.

IAEA officials identified several ways in which the nuclear security  program’s heavy reliance on extra-budgetary funding affects program  management.

Planning and prioritization. According to IAEA officials, because  extra-budgetary contributions are predominantly directed to specific  purposes and can only be used for direct assistance to states, rather  than support costs, they may not align with DNS’s most critical needs.  IAEA officials also said that reliance on extra-budgetary contributions  leads DNS to plan its activities around conditions stipulated for the  contributions rather than planning around overall program needs.  Donor states may also use the contributions to create cost-free expert  positions for their own personnel that may not meet DNS needs. U.S.  officials said, however, that even within the constraints of extra- budgetary contributions, DNS could take steps to work with donors to  conduct work on a broader range of projects and initiatives, such as  providing donors with plans to address longer-term, strategic needs.

Program sustainability. IAEA officials, several member-state  officials, and some experts we interviewed raised concerns about the  effect of extra-budgetary contributions on the sustainability of IAEA’s  nuclear security efforts. For example, several experts suggested that  the DNS’s planning of work around individually-funded projects means  that IAEA’s focus tends to be on short-term activities rather than long- term sustainability, including through follow-up on prior work. IAEA  officials did not agree with the concern about follow-up work, but did  acknowledge that long-term reliance on extra-budgetary contributions  was unsustainable.

Human resource management. IAEA officials also identified ways in  which the reliance on extra-budgetary funding affects DNS’s human  resource management. First, extra-budgetary funding generally  supports positions that are initially designed to last for only 2 or 3  years, leading to few long-term positions in the division and making it  difficult to sustain continuity of knowledge and experience over time.  Second, staff hired for positions supported by extra-budgetary funding  tend to look for regular-budget-funded positions elsewhere in the  agency, which hurts recruitment as well as retention within DNS.  Furthermore, the division must dedicate several staff to reporting on  the use of extra-budgetary funding provided by each donor. U.S.  officials acknowledged the detrimental impact of DNS’s high reliance  on extra-budgetary contributions on staffing, but said that they are  open to working with DNS to mitigate this impact.

Member states have emphasized through the 2017 and 2018 Nuclear  Security Resolutions, which are approved by the General Conference, the  need to continue providing appropriate resources for the agency to  implement its nuclear security activities. Furthermore, signatories of the  Action Plan in Support of the IAEA, including the United States,  committed to “contribute effectively to the implementation of the IAEA  Nuclear Security Plan, including through reliable and sufficient  resources.” The United States and other member states supportive of  IAEA’s nuclear security role have advocated for increasing the agency’s  regular budget for nuclear security.

IAEA officials stated that, because of the politics around the agency’s  nuclear security work, as well as the zero-growth policy, it is unlikely that  the regular budget for nuclear security will increase substantially in the  short term. As a result, IAEA officials have undertaken short-term  solutions to minimize the impact of its reliance on extra-budgetary  funding, such as reaching out to major donors and cultivating new  sources of funding. However, such new sources of voluntary funding also  would not be guaranteed or predictable and therefore would not improve  the stability of the division’s funding stream. According to IAEA officials,  the agency has not identified options to stabilize DNS’s budget within the  existing constraints.

IAEA officials and experts suggested other options for making the nuclear  security budget more stable and flexible. One option could involve making  structural changes to the Nuclear Security Fund, such as assessing a  percentage of each extra-budgetary contribution and allocating those  assessed funds for general expenditures without conditions. This could  give the program more flexibility in using the funds and to support longer- term needs or projects. Another option could involve shifting funding  within the Department of Nuclear Safety and Security to balance the  proportion of regular and extra-budgetary funding between the Nuclear  Safety and Nuclear Security divisions. U.S. and IAEA officials identified  drawbacks to some of these options but IAEA has not comprehensively  identified and analyzed options to stabilize DNS’s budget within the  existing constraints. By working with the United States and other member  states to analyze options to stabilize funding for the agency’s nuclear  security program, IAEA could ensure that it has sufficient, reliable  resources to implement the Nuclear Security Plan.

Member-State Disagreements and IAEA’s Not Following Key Practices for Collaboration Create Challenges for the Agency’s Central Coordinating Role in Nuclear Security

The member-state disagreements discussed above—together with  IAEA’s not following key practices for collaboration—limit IAEA’s ability to  fulfill its central coordinating role in nuclear security. As noted in the  Nuclear Security Plan, an objective of IAEA’s nuclear security program is  “to play the central role and enhance international cooperation in nuclear  security.” Numerous U.S., IAEA, and member-state officials and experts  we interviewed said that there is a need for coordination of international  nuclear security efforts and that IAEA is the appropriate entity to take on  that role. These officials and experts cited IAEA’s perceived international  legitimacy, technical expertise, and broad range of nuclear security efforts  as key attributes that would allow the agency to play that coordinating  role.

DNS officials told us that they fulfill the agency’s central coordinating role  in nuclear security in two key ways: (1) by providing nuclear security  guidance that establishes the terms of reference for any nation working to  improve its nuclear security and that is used by all member states and (2)  by hosting and participating in key meetings. They said they further fulfill  the role by using the agency’s international legitimacy and neutrality to  work with countries that may be wary of international assistance from  western countries. In addition, according to the agency’s Nuclear Security  Plan, managing international nuclear security education through the  Nuclear Security Support Centre and International Nuclear Security  Education Networks is part of the central coordinating role.

However, we found that IAEA is not fully implementing its central  coordinating role in nuclear security, based on feedback from member  states and experts and our evaluation of the extent to which IAEA has  followed key practices that can sustain effective collaboration. Some  experts told us that IAEA’s limited approach to its central coordinating role  is a response to the resistance among some member states to the  agency’s nuclear security role. According to many officials and experts we  interviewed, IAEA’s approach to its central coordinating role is limited:

Minimal outreach to key nuclear security stakeholders. Many experts expressed concern about the level of coordination with nongovernmental organizations and industry and said that IAEA would benefit from conducting more outreach to key nuclear stakeholders, including states. According to one expert, although IAEA may only conduct nuclear security activities at member-state request, IAEA could conduct more outreach to states about the assistance the agency could provide. Furthermore, some member- state officials and experts said the staff the agency sends to nuclear security meetings are not of the appropriate level of seniority. One  expert said that IAEA does not engage actively with the Nuclear  Security Contact Group, which, as previously mentioned, was  established at the last Nuclear Security Summit to continue the work  of the summit process after it ended. Specifically, according to this  expert, the agency downgraded the level of representation it sent to  Nuclear Security Contact Group proceedings to an official  unauthorized to speak for DNS. However, U.S. officials said that  senior DNS officials represented IAEA in more recent NSCG  meetings.

Logistical rather than substantive management of events. Several  member-state officials and experts told us that IAEA limits its role at  the events it organizes to logistical coordination rather than  substantive management. According to one expert, to coordinate  some of its support centers, IAEA convenes periodic meetings where  participants share what they are doing, but it does not actively  manage the support centers to reduce duplication. Some experts told  us that multiple support centers in the same region teach the same  content to the same students, raising concerns about duplicative  activities. Another expert said that IAEA could more actively manage  the support centers by starting discussions about best practices and,  for example, the value of certification.

To further examine IAEA’s fulfillment of its central coordinating role, we  reviewed certain key practices that we have previously found can  enhance and sustain collaborative efforts, such as: defining and articulating a common outcome, establishing joint strategies and compatible policies and procedures to  operate across boundaries,  identifying and addressing needs by leveraging resources, and agreeing on roles and responsibilities.

IAEA’s planning documents—the Nuclear Security Plan and the P&B— define and articulate a common outcome. However, DNS has not established joint strategies or compatible policies and procedures with  other nuclear security stakeholders,  identified and addressed needs by leveraging resources, or agreed on roles and responsibilities.

DNS officials said that they discuss these issues—such as resources and  roles—at information exchange meetings with other organizations with a  role in international security and said that these meetings have not  resulted in agreed-upon or documented roles and responsibilities. In  addition, the meetings have not resulted in the documentation of needs or  resources, joint strategies, or compatible policies or procedures.

As a result of IAEA’s approach to its central coordinating role in nuclear  security, the agency may be missing opportunities to fully leverage its  international legitimacy, technical expertise, and broad range of nuclear  security efforts. By following key practices for collaboration, DNS could  more formally define IAEA’s central coordinating role in nuclear security  and strengthen the role even within the context of member-state  disagreements.

IAEA’s DNS plays a crucial role in preventing dangerous releases of  radiation by assisting nations in securing their nuclear materials and  protecting their nuclear facilities against sabotage. IAEA plans its nuclear  security activities through a range of documents, but does not prioritize  those activities. The agency’s P&B contains criteria for prioritization, but  the criteria are too broad to help DNS make resource decisions.  Guidelines for prioritizing activities would help DNS ensure that it is  applying its resources toward the areas of greatest program needs.

In addition, IAEA’s performance measures do not have baselines and  targets. By developing baselines and targets to demonstrate results, DNS  can more effectively monitor progress toward achieving the program’s  objectives. Furthermore, none of the three IAEA reports on the nuclear  security program fully addresses performance measure results. Improved  reporting could help IAEA more effectively communicate internally and  with external stakeholders on program performance.

The nuclear security program relies heavily on extra-budgetary  contributions, which adversely affects program management. Options  exist to address this issue but IAEA has not analyzed these options.

IAEA and its member states acknowledge the agency’s central  coordinating role in nuclear security, but the agency has not followed key  practices for collaboration. This has left IAEA’s approach to the central  coordinating role vulnerable to member-state disagreements, and IAEA’s  implementation of the role has not met the expectations of various  member states.

We are making the following five recommendations to the Department of  State:  The Secretary of State should work with IAEA and its member states  through the Board of Governors to develop detailed guidelines for  prioritizing nuclear security activities. (Recommendation 1)

The Secretary of State should work with IAEA and its member states  through the Board of Governors to improve the nuclear security program’s  performance measures by developing baselines and measurable targets.  (Recommendation 2)

The Secretary of State should work with IAEA and its member states  through the Board of Governors to improve how DNS reports to member  states by consistently including the results of performance measures in at  least one of the reports. (Recommendation 3)

The Secretary of State should work with IAEA and its member states  through the Board of Governors to analyze options to stabilize DNS’s  funding within current fiscal and political constraints to enhance the  sustainability of IAEA’s nuclear security program. (Recommendation 4)

The Secretary of State should work with IAEA and its member states  through the Board of Governors to strengthen the agency’s central  coordinating role by following key practices for collaboration.  (Recommendation 5)

We provided a draft of this report to the Departments of State and Energy  and to the International Atomic Energy Agency for review and comment.  In its written comments, reproduced in appendix III, State concurred with  all five of our recommendations.

We are sending copies of this report to the appropriate congressional  committees, the Secretary of State, the Secretary of Energy, and other  interested parties. In addition, this report will be available at no charge on  the GAO website at http://www.gao.gov.

If you or your staff members have any questions about this report, please  contact me at (202) 512-3841 or trimbled@gao,gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found  on the last page of this report. GAO staff who made key contributions to  this report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

This report examines (1) the structure and range of nuclear security work  that the International Atomic Energy Agency (IAEA) conducts; (2) ) how  IAEA plans and prioritizes its nuclear security work, and how it measures  and reports on its performance; and (3) the challenges that IAEA’s  nuclear security program faces.

We focused our review on IAEA’s nuclear security program, specifically  on activities carried out by the Division of Nuclear Security (DNS), within  the Department of Nuclear Safety and Security. To address all three  objectives, we interviewed U.S. officials, IAEA officials, officials  representing IAEA member states, and other nuclear security experts. We  selected the U.S. agencies most involved in nuclear security policy,  including interacting with IAEA. The Department of State is the lead  agency for interacting with IAEA and has represented the United States in  the Nuclear Security Contact Group (NSCG) since September 2018; the  Department of Energy’s National Nuclear Security Administration  provides technical expertise and loans staff to IAEA; Nuclear Regulatory  Commission, as the regulator for the U.S. civilian nuclear industry,  provides perspectives on how IAEA’s guidance may impact states’  regulations, among other things; the Department of Defense collaborates  with IAEA to develop IAEA training (for example, for border monitoring);  and the National Security Council leads interagency coordination to  develop U.S. priorities for nuclear security and initially represented the  United States in the NSCG through August 2018.

To gain the perspectives of IAEA member states, we selected member  states based on their involvement in IAEA’s nuclear security work and  suggestions from State and nuclear security experts; the selected  member states represent a range of informed opinions, but cannot be  generalized to the universe of IAEA member states. While we reached  out to various member states, we predominantly received responses from  member states who have voiced support regarding IAEA’s nuclear  security work. Our statements about member states we spoke to should  be interpreted with the understanding that few member states that have  voiced opposition to IAEAs nuclear security work responded to our  requests. Throughout this report, we use the phrase “member states we  spoke to” or “member states who responded” to refer to all those who  provided us information. In light of political sensitivities surrounding  IAEA’s nuclear security work, we agreed not to identify the member states  whose officials we interviewed.

We selected nuclear security experts based on a literature search and a  snowball sampling technique. Specifically, from our initial literature  search, we selected seven authors who had published at least two  articles since 2010 that were relevant to our review. However, two  authors declined or did not respond to our interview request. During our  interviews with the authors identified in the literature search, as well as  with U.S. government officials, we asked for suggestions of individuals  who were knowledgeable on IAEA’s nuclear security work or nuclear  security more broadly. We added to our sample individuals named at  least twice by other interviewees. Not all experts in the sample were  available to participate in interviews. We summarized the information  gathered from experts and other interviewees in the report by using  “some” to refer to three members of a group, “several” to refer to four or  five members of a group, and “many” to refer to more than five members  of a group. We interviewed officials representing 12 member states, and  20 experts.

To determine the structure and range of IAEA’s nuclear security work, we  reviewed pertinent legal instruments, such as the Statute of the IAEA, the  Convention on the Physical Protection of Nuclear Material and its 2005  amendment, and the International Convention for the Suppression of Acts  of Nuclear Terrorism. We also reviewed IAEA’s planning documents,  including the 2018-2019 Programme & Budget (P&B); 2017 and 2018  Nuclear Security Resolutions; and the 2018-2021 Nuclear Security Plan.  To review how IAEA plans and prioritizes its nuclear security work, we  reviewed these planning documents against the Project Management  Institute’s The Standard for Program Management and interviewed IAEA  officials responsible for planning and prioritizing the agency’s nuclear  security work. To examine how IAEA measures and reports on  performance, we reviewed the previously mentioned IAEA documents, as  well as IAEA’s Nuclear Security Reports from 2016-2018. We also  reviewed the 2015-2016 P&B, the 2016 Nuclear Security Report, 2018  Annual Report, and the 2016 mid-term program performance report to  understand IAEA’s use of objectives, outcomes, and performance  indicators. We chose the 2016 reports because at the time of our review,  the 2016 program performance report was the most recent completed.  We compared the agency’s planning documents and reports with leading  practices for performance management and reporting, including leading  practices derived from our prior work, and IAEA’s results-based  management approach. We derived some of these leading practices from  standards and practices developed for federal agencies, such as those  established in Standards for Internal Control in the Federal Government.  Although federal standards are not required to be used by international  organizations such as IAEA, the leading practices based on these  standards can be instructive for assessing IAEA performance  measurement and reporting practices.

To examine the challenges the agency’s nuclear security role faces, we  reviewed the IAEA documents listed above as well as proceedings from  meetings and conferences and budgetary contributions data from the  United States and other member states. We analyzed statements from  IAEA, U.S., and member-state officials and from experts about IAEA’s  nuclear security challenges. We also assessed actions IAEA and member  states have taken to potentially mitigate challenges by comparing those  actions with written commitments made in support of the agency’s nuclear  security work. We also reviewed IAEA’s central coordinating role in  nuclear security against certain key practices that we have previously  found to enhance and sustain collaborative efforts. We selected five  practices as relevant to our analysis, and combined two practices—those  on establishing joint strategies and establishing compatible policies and  procedures. In our analysis we considered IAEA’s role as a coequal entity  among many rather than one that has authority over other entities.

We conducted this performance audit from March 2018 to July 2019 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Appendix II: The Nuclear Security Contact Group

The Nuclear Security Contact Group (NSCG) was established at the 2016  Nuclear Security Summit to continue the work of the summit process,  including maintaining high-level political attention and momentum on  nuclear security, assessing and following up on commitments made at the  summits, and developing and maintaining connections to  nongovernmental experts and the nuclear industry.

NSCG has 48 members as of March 2019, and its membership is open  to all International Atomic Energy Agency (IAEA) member states.  According to State officials, the group actively focuses on recruiting new  members. NSCG advertises itself through IAEA Board of Governors  statements and has issued joint statements to encourage other member  states to join. Canada was the first country to chair NSCG, followed by  Jordan and Hungary, which is the current chair.

NSCG formally meets on the margins of the IAEA General Conference.  According to U.S. officials, NSCG has convened two to three times per  year since its inception after the 2016 summit. IAEA is an observer, and  an IAEA representative may comment on how NSCG proposals would  impact IAEA. Representatives to the NSCG are government agencies.  The National Security Council was the lead agency to represent the  United States in the NSCG through August 2018, and State has been the  lead agency since September 2018.

According to officials and experts we interviewed, NSCG serves as a  forum for proposing and developing ideas rather than as a formal  decision-making body. Member states described the benefits NSCG has  provided. For example, some member-state officials said NSCG helps  maintain contact among summit participants and between nuclear  security officials in their respective capitals—where nuclear security policy  would be implemented—and those at IAEA. In addition, a member-state  official said that the group is a very important instrument for developing  key messages as part of a communication strategy. As a result of this  strategy, some ideas developed in NSCG have been introduced into IAEA  proceedings by NSCG member states, or into national policymaking  discussions. NSCG has also prepared unofficial position papers.  Furthermore, according to a member-state official we interviewed, NSCG  has discussed or developed internal papers on a number of topics related  to IAEA, including: ways to improve IAEA’s coordinating role in nuclear security whether more regulation is needed in nuclear security  IAEA’s role in dealing with emerging nuclear security challenges promoting a more resource stable and empowered Division of Nuclear  communication and outreach within IAEA  the agency’s networks of nuclear security training centers.

According to State officials, U.S. priorities for NSCG include ensuring that  it is productive and action-oriented, with representatives ready to share  views, brainstorm on ways forward, and lead change both at home and  internationally. State is also focused on preparing the NSCG’s input for its  representatives to significant conferences, such as IAEA’s ministerial- level and technical conferences and the 2021 Review Conference on the  Amendment to the Convention on the Physical Protection of Nuclear  Material. According to a member-state official, the NSCG has discussed  how to engage in preparation for the review conference, the framework of  the review, what to ask of member states, and whether to revise the  Convention.

According to U.S. officials and some member-state officials, NSCG has  also promoted implementation of summit commitments, in which  individual members are responsible for tracking and following up on  commitments made by countries in certain areas. For example, the  United States is the lead for following up on commitments related to  insider–threat mitigation, and the Department of Energy led a meeting in  Belgium in February 2019 on that topic. State officials said that NSCG  also follows up on commitments made during the 2016 International  Conference on Nuclear Security.

Many experts we interviewed said that the NSCG process lacks  transparency. Specifically, it does not publish its proceedings, which  these experts said made it difficult to discern its accomplishments. U.S.  and several member-state officials and experts said that a quiet approach  was necessary to protect the group from IAEA member-state politics.  Several representatives said that NSCG is mindful of the political  sensitivities around its association with the Nuclear Security Summits,  and is committed to supporting IAEA’s nuclear security role without  becoming a distraction. In addition, one expert said that more openness  would weaken the group as a discussion forum. For example, publishing  proceedings would require getting consensus among members, which  would shift the focus of the group from discussion to decision-making.  U.S. officials said that NSCG planned to revamp and update its website,  and to use it to highlight nuclear security successes and events, such as  nuclear security support for major public events or regional training  events, but did not plan to promote its own work.

Appendix III: Comments from the Department of State

Appendix IV: GAO Contact and Staff Acknowledgments

In addition to the contact named above, the following staff members  made key contributions to this report: William Hoehn (Assistant Director);  Alisa Beyninson; Antoinette Capaccio; R. Scott Fletcher; Ellen Fried;  Drew Lindsey; Steven Putansu; Liz Spurgeon; and Sara Sullivan.

Nuclear terrorism remains among the most significant threats to the United States and other nations. Nuclear materials stolen from poorly secured facilities could be used for a nuclear device. The International Atomic Energy Agency’s nuclear security work includes helping countries protect these facilities.

Among other things, we found the agency’s nuclear security program:

Doesn’t have the guidelines it needs to ensure it is appropriately prioritizing its work and targeting its resources

Relies heavily on voluntary contributions and hasn’t analyzed ways to stabilize its funding

We recommended the agency address these and other concerns.