Department of Justice: ATF and U.S. Marshals Service Can Further Strengthen Controls over Employee Misconduct Processes

Within the Department of Justice, ATF and USMS employ more than 10,000 staff responsible for protecting communities from violent criminals, investigating the illegal use of firearms, and apprehending wanted persons, among other things. Our recent studies of employee misconduct processes have highlighted the importance of internal controls to help ensure the quality and independence of these processes. We have also reported on employee misconduct investigations being used to retaliate against individuals who report wrongdoing.

GAO was asked to review ATF and USMS employee misconduct investigation and disciplinary processes. This report (1) summarizes data on the number, characteristics, and outcomes of ATF and USMS misconduct investigations that were opened from fiscal years 2014 through 2018 and were closed by the time of GAO's review, and (2) examines the extent to which ATF and USMS have developed, implemented, and monitored internal controls for their employee misconduct processes. For each component, GAO reviewed policies, guidance, and performance reports; analyzed case management system data; analyzed random samples of misconduct cases; and interviewed officials involved in investigation and discipline processes.

From fiscal years 2014 through 2018, the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) and U.S. Marshals Service (USMS) collectively investigated about 3,900 allegations of employee misconduct, as shown in the table below. About one-half of these investigations were closed with no disciplinary action because the components found that the allegations were unsubstantiated. For allegations that were substantiated by an investigation, the most common ATF offenses were poor judgment and failure to adequately secure property, while the most common USMS offenses were general violations of policy or procedure and failure to follow instruction. The most common outcomes for both ATF and USMS substantiated investigations were discipline including suspensions of up to 14 days and lesser penalties such as verbal or written warnings. During this period, ATF and USMS investigated over 300 allegations of management retaliation, with few resulting in discipline.

ATF and USMS have developed some internal controls for managing their employee misconduct investigation and disciplinary processes, but have not consistently documented or monitored key control activities. For example:

USMS policy requires supervisory review of district and division investigations, but the agency has not consistently documented this control in accordance with policy. ATF and USMS also lack policy for verifing the accuracy and completeness of information in employee misconduct systems. Ensuring supervisory review is documented as required and developing policy for verifying information in misconduct systems would provide greater assurance that controls are operating as intended.

ATF and USMS have established policies and goals related to timeliness in completing various types of employee misconduct investigations (e.g., within 120 days). However, ATF has not established performance measures to monitor progress toward meeting the goals. USMS has measures to monitor timeliness for some types of investigations, but not for others. Establishing measures to monitor timeliness of investigations would provide more complete information to ATF and USMS managers responsible for oversight.

ATF and USMS have established oversight mechanisms, such as internal management reviews, to monitor certain aspects of the components' operations, such as financial operations. However, ATF and USMS have not fully used these mechanisms to monitor internal controls related to employee misconduct processes, which would help ATF and USMS management ensure that controls are implemented as required by policy.

GAO is making seven recommendations, including that USMS ensure supervisory review is documented; and that ATF and USMS develop policy for verifying system information, establish measures to monitor the timeliness of investigations, and improve monitoring of employee misconduct processes. DOJ concurred with our recommendations.

Our recent studies of employee misconduct investigation and disciplinary  processes within the federal government have highlighted the importance  of internal controls to help ensure the quality, independence, and  timeliness of these processes. For example, in July 2018, we reported  that federal agencies needed to take additional actions to effectively  address employee misconduct. We have also previously reported on  individuals who report wrongdoing being retaliated against through  investigations of employee misconduct.

Within the Department of Justice (DOJ), the Bureau of Alcohol, Tobacco,  Firearms and Explosives (ATF) and U.S. Marshals Service (USMS)  employ more than 10,000 staff responsible for protecting communities  from violent criminals, investigating the illegal use of firearms and  explosives, apprehending wanted criminals, and seizing assets, among  other things. ATF and USMS have each established processes to  receive, investigate, and adjudicate allegations of employee misconduct.  Depending on the facts and circumstances of an investigation, possible  outcomes of discipline by the components can include no action, letter of  reprimand, suspension, and termination.

You asked us to review ATF and USMS employee misconduct  investigation and adjudication processes. This report (1) summarizes data  on the number, characteristics, and outcomes of ATF and USMS  employee misconduct investigations that were opened during fiscal years  2014 through 2018 and were closed at the time of our review, and (2)  examines the extent to which ATF and USMS have developed,  implemented, and monitored key internal controls for their employee  misconduct investigation and adjudication processes, including  management retaliation against employees who report wrongdoing.

To summarize data on the number, characteristics, and outcomes of ATF  and USMS employee misconduct investigations, we analyzed data from  each component’s case management systems for all investigations that  were opened during fiscal years 2014 through 2018—the most recent  available data over the past 5 years—and were closed at the time of our  review. These data included misconduct investigations related to  allegations of management retaliation. Where possible, we combined  similar categories of offenses. We also reviewed each component’s  annual reports that described their investigations. To summarize data  related to ATF and USMS employees filing claims of management  retaliation through formal channels other than ATF and USMS Internal  Affairs Division (Internal Affairs), we analyzed fiscal year 2014 through  2018 data from the DOJ Office of Inspector General (OIG), the U.S.  Office of Special Counsel (OSC), and each of the components’ Equal  Employment Opportunity (EEO) office. We also analyzed EEO and  employee misconduct data to determine how many employees who filed  an EEO claim of management retaliation were also subject to a  misconduct investigation.

As part of this work, we assessed data reliability by analyzing electronic  data fields for potential missing values and anomalies and by interviewing  component officials to discuss the mechanisms in place to ensure data  completeness. While we identified some instances of missing and  inaccurate data, including missing data about dates, we found the data  sufficiently reliable for providing general information on the nature and  characteristics of employee misconduct investigations and adjudications.

To determine the extent to which ATF and USMS have developed internal  controls to help ensure the quality and independence of investigation and  adjudication processes, we reviewed each component’s policies,  procedures, and guidance for addressing employee misconduct. We also  interviewed ATF and USMS officials to help us determine which control  activities they considered important for ensuring the quality and  independence of investigations and adjudications of employee  misconduct. We then compared each component’s procedures for  investigations and adjudications with their respective policies and  guidance, as well as with criteria in Standards for Internal Control in the  Federal Government, Quality Standards for Investigations, and  Department of Justice Community of Practices for Internal Affairs. Based  on our review of policies and procedures, interviews with ATF and USMS  officials, and relevant standards and guidance, we determined that the  key internal controls are investigative supervisory review, legal sufficiency  review, DOJ OIG review, and verification of case management system  data.

To assess the extent to which ATF and USMS have implemented these  key internal controls, we selected a stratified random sample of case files  within the population of employee misconduct allegation case  management system files that were opened for investigation from fiscal  years 2014 through 2018 and were closed at the time of our review. For  ATF, this included headquarters’ investigations that the agency closed as  of April 2019 and division investigations (management referrals for action)  that were closed as of July 2019. For USMS, this included investigations  that the agency closed as of March 2019 (for cases opened during fiscal  years 2014 through 2017) and April 2019 (for cases opened during fiscal  year 2018). Strata were separate for each component, and included the  severity of misconduct and whether the employee under investigation had  also filed a claim of management retaliation to their respective EEO  office. We used fiscal year 2014 through 2018 data from the components’  information systems from which we randomly selected a generalizable  sample of 65 misconduct cases for ATF and 100 cases for USMS. See  appendix I for additional information on our sampling methodology.

We analyzed these sample cases to test whether the components  consistently operated and documented the key internal control activities  appropriately in their case management systems or other case file  records. Specifically, we tested each misconduct case by analyzing data  recorded in ATF and USMS systems to determine whether the  component had documented key control activities, which serves as  evidence that the component implemented the control activities. We also  reviewed the case file records that each component retains outside its  case management information systems (e.g., physical case files) for  documentation of supervisory investigative review, legal sufficiency  review, and case management data. To assess whether the components  forwarded allegations to the DOJ OIG for review, we compared ATF and  USMS records with DOJ OIG records. We also reviewed component  policies, procedures, and management reports to determine the extent to  which the agencies had established performance measures and  monitored the timeliness of investigations. Further, we examined  mechanisms used by each component for monitoring compliance with  internal controls (e.g., annual self-assessment programs).

To address both objectives, we interviewed officials from each component  involved in employee misconduct processes. Specifically, we met with  officials from ATF and USMS Internal Affairs Division, which are the  organizations that investigate allegations centrally at agency  headquarters. ATF’s Internal Affairs resides within the Office of  Professional Responsibility and Security Operations, which reports  directly to the ATF Deputy Director. USMS Internal Affairs reports directly  to the USMS Deputy Assistant Director within the Office of Professional  Responsibility. We also interviewed human resources and employee  relations officials and officials from other offices involved with the  adjudication process at each component, including the Offices of General  Counsel. Further, we interviewed ATF and USMS officials who oversee  each component’s case management information system to discuss and  obtain documentation related to the employee misconduct process, such  as system user guides. To learn of any past issues related to processing  employee misconduct allegations and the status of their resolution, we  reviewed our past work in this subject area, and reports on federal  employee misconduct from the DOJ Office of Inspector General.

Additionally, for both objectives, we conducted site visits to review local  procedures and interview field staff involved in handling employee  misconduct cases for each component. We selected locations based on  geographic dispersion and the high volume of employee misconduct  cases associated with their locations. For both ATF and USMS, we  interviewed officials who conduct inquiries of employee misconduct  (investigations referred to local management by Internal Affairs) in  Georgia, the District of Columbia, and Texas. Specifically, we interviewed  officials at ATF’s Atlanta and Houston Field Divisions and the Firearms  and Explosives Services Division located in Martinsburg, West Virginia,  each of which manages a high volume of misconduct investigations. We  also interviewed USMS officials from the Southern Texas District, who  manage a high volume of misconduct investigations, and from USMS  District of Northern Georgia and District of Columbia District Court based  on geographic locations. At these locations, we also interviewed senior  officials—ATF Special Agents in Charge and Assistant Special Agents in  Charge, and Division Chiefs and U.S. Marshals and Chief Deputy  Marshals who are responsible for adjudicating employee misconduct  cases. During these site visits, we also met with other staff who assist  these senior officials with the adjudication process. The information  provided by ATF and USMS officials at these locations is not  generalizable to all employees at each component, but provided insights  into their respective employee misconduct processes.

We conducted this performance audit from August 2018 to February 2020  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

According to ATF and USMS policy, the Directors of ATF and USMS  have the authority to develop various policies, procedures, and guidance  that specify the steps the components must or should take while  investigating and adjudicating employee misconduct.

ATF and USMS can receive allegations of employee misconduct from a  variety of sources, including agency staff, the general public, and the DOJ  OIG. Allegations of employee misconduct can include, for example, not  following procedures associated with managing government-issued  property or not reporting time and attendance accurately. Employee  misconduct can occur outside of the workplace as well, such as local  arrests of employees for domestic violence or driving under the influence  of alcohol. ATF and USMS each have an intake or hotline function that is  to initially assess the reported information and seriousness of each  allegation to determine the appropriate next step in terms of which group  or office within their respective component will conduct an investigation, if  warranted. The investigation process involves engaging in fact-finding to  the extent necessary to make an informed decision on the merit of an  allegation.

In accordance with ATF and USMS policy, for each misconduct allegation  received, the components’ investigative office (Internal Affairs) must  provide the DOJ OIG with “right of first refusal.” This review allows the  DOJ OIG to either open an investigation or send the allegation back to  the component for action. If the DOJ OIG declines the opportunity to  investigate, the components assign the case to Internal Affairs.  Specifically:

For ATF, cases that involve matters related to integrity are  investigated by ATF Internal Affairs, while other cases are generally  referred to ATF divisions to conduct inquiries (known as management  referrals).

USMS typically assigns higher-level (i.e., more egregious) misconduct  cases to Internal Affairs. For cases typically considered to involve  lower-level offenses, USMS managers in divisions or districts conduct  inquiries or fact finding locally.

Each component has policies, procedures, and guidance for its Internal  Affairs and local management for investigating cases of employee  misconduct. Based on the investigative findings, the responsible office for  each component can make a preliminary determination of whether there  is sufficient evidence to support an allegation.

After investigations are completed, each component has an adjudication  process whereby delegated officials propose discipline. For ATF, a  headquarters entity—referred to as the Professional Review Board— proposes discipline for all cases investigated by ATF Internal Affairs. For  cases involving misconduct by ATF employees outside of Internal Affairs  jurisdiction, division management proposes and decides discipline. USMS  utilizes various, delegated agency officials to propose and decide  discipline depending on the type of investigation. Discipline for both ATF  and USMS employees can range in severity, depending on the unique  findings and circumstances of each investigation. For misconduct within  USMS warranting a suspension of 14 days or less, local management  proposes and decides discipline.

For both ATF and USMS, during adjudication, proposing and deciding  officials determine whether an allegation is substantiated or  unsubstantiated when considering if an action is warranted. For  substantiated cases that are determined to warrant action, components  use their respective Table of Offenses and Penalties as a guide for  disciplinary actions, which provides guidance for determining appropriate  penalties. Each component is to provide employees with a letter of  proposed discipline and an opportunity to respond before it makes a final  decision on the discipline.

After discipline is proposed and the employee’s response is considered,  final discipline is determined by a delegated official (deciding official),  distinct from the proposing official. In addition, delegated officials are to  consider particular mitigating and aggravating factors on a case-by-case  basis when determining the appropriate penalty for an act of employee  misconduct. The relevant factors that are considered, as appropriate, in  determining the severity of the discipline include, but are not limited to,  the nature and seriousness of the offense and its relation to the  employee’s duties, position, and responsibilities. This includes  considering whether the offense was intentional or inadvertent, or was  committed maliciously or for gain; the employee’s past disciplinary record;  and whether the offense was frequently repeated. For both ATF and  USMS, there are three categories of employee misconduct outcomes:

Corrective/Non-disciplinary action. This is an administrative or non- disciplinary action, such as a letter of counseling or a letter of  guidance and direction, that informs an employee about unacceptable  performance or conduct that should be corrected or improved.

Disciplinary action. This includes actions resulting in a letter of  reprimand up to a suspension of 14 days or less. A letter of reprimand  describes the unacceptable conduct that is the basis for a disciplinary  action, and represents the least severe form of disciplinary action.  Suspensions in this category involve the placement of an employee in  a nonduty, non-pay status for up to and including 14 days.

Adverse action. This involves a suspension of more than 14 days  (including an indefinite suspension), demotion to a lower pay band or  rate of pay, or removal (an involuntary separation from  employment). According to the U.S. Merit Systems Protection  Board, an indefinite suspension is appropriate when evidence exists  to demonstrate misconduct of a serious nature, such as an employee  has committed a crime for which a sentence of imprisonment can be  imposed, when the agency has concerns that an employee’s medical  condition makes the person’s presence in the workplace dangerous or  inappropriate, or when an employee’s access to classified information  has been suspended. Also, according to the board, a demotion is a  reduction in grade or a reduction in pay, while a removal terminates  the employment of an individual.

Figure 1 provides an overview of ATF and USMS employee misconduct  processes.

ATF and USMS have case management systems that are designed to  maintain employee misconduct data––such as the date of the alleged  incident, source of the allegation, description of the alleged misconduct,  and the status of the investigation. ATF’s Professional Review Board  uses another system to manage outcome data associated with Internal  Affairs investigations. After adjudication of ATF Internal Affairs  investigations, the board is to provide this outcome data to ATF Internal  Affairs for inclusion in its system. Similarly, after the adjudication of  management referrals for action, ATF managers are to provide outcome  data to ATF Internal Affairs to include in its system. In addition to the  system USMS uses to manage Internal Affairs investigations, the agency  has a separate system to record outcome data.

ATF and USMS Completed About 3,900 Employee Misconduct Investigations from Fiscal Years 2014 through 2018, with about 320 Involving Claims of Management Retaliation

ATF Initiated About 1,600 Investigations of Employee Misconduct from Fiscal Years 2014 through 2018

Our analysis of ATF employee misconduct data found that ATF opened  1,581 employee misconduct investigations during fiscal years 2014  through 2018. As shown in table 1, the majority of ATF misconduct  cases during this period were management referrals to divisions for  informational purposes or for action.

Table 2 shows that the most common allegation category of misconduct  that ATF received from fiscal year 2014 through 2018 was job  performance failure, representing 8 percent of all allegations, which  includes not attending meetings, submitting reports of inspection late, or  becoming agitated during performance feedback, among other things.

ATF Offense Categories and Disciplinary Outcomes

After investigations are completed, results are forwarded to the  Professional Review Board for adjudication, and adjudication results are  to be entered into ATF’s Human Resources system. For investigations  that were adjudicated during the period we reviewed, six types of offense  categories made up about 60 percent of those substantiated and  captured in the ATF Human Resources system, as shown in figure 2. The  exercise of poor judgment (14 percent) and the failure to adequately  secure government property (13 percent) were the most common  offenses.

The employee misconduct outcomes for offenses ranged from corrective  actions (e.g., letters of counseling or caution) to adverse actions such as  suspensions and removals. Specifically, of the 503 investigations that  had final actions reported in ATF case management system, disciplinary  action—suspensions of 15 days or less and letters of reprimand— accounted for 176 (about 35 percent) of the final outcomes. Also, 135  (about 27 percent) of investigations adjudicated resulted in corrective  actions (cautions such as a verbal or written warning). Further, 87 (about  17 percent) of these 503 investigations and management referrals were  closed for various reasons, such as insufficient evidence of an  employee’s inappropriate behavior or clearance of the charges after  investigation, while adverse actions represented 47 (about 9 percent) of  these outcomes, as shown in figure 3.

USMS Completed About 2,300 Investigations of Employee Misconduct from Fiscal Years 2014 through 2018

Our analysis of USMS employee misconduct data show that USMS  opened 2,347 employee misconduct investigations during fiscal years  2014 through 2018 that were also closed at the time USMS responded to  our request for information. As shown in table 3, USMS Internal Affairs  investigated the majority of the component’s employee misconduct cases.

As shown in table 4, the most common misconduct allegations for USMS  were violations of the code of professional responsibility (21 percent),  conduct unbecoming or discourteous behavior (13 percent), and failure to  follow procedures (12 percent).

USMS Offense Categories and Disciplinary Outcomes

As shown in figure 4, general misconduct while on duty and failure of staff  to follow instructions were the most frequent offenses from fiscal years  2014 through 2018, representing 383 (about 25 percent) and 266 (about  18 percent) of offenses respectively.

Additionally, according to USMS adjudication data, of the 2,347  investigations that were opened in fiscal years 2014 through 2018, USMS  had adjudicated 1,729 misconduct cases at the time USMS responded to  our request for information (March 2019 for investigations opened in fiscal  years 2014 through 2017 and April 2019 for investigations opened in  fiscal year 2018). As shown in figure 5, the most common disciplinary  outcomes for USMS were non-adverse actions (corrective and  disciplinary actions), which accounted for 988 (about 58 percent) of final  outcomes. USMS did not take disciplinary action on 533 (about 31  percent) of completed investigations forwarded for adjudication. The  deciding official will not determine an action against an employee if he or  she does not believe the allegations warrant action. Adverse actions were  less common, with removals, suspensions of 15 days or more, and  demotions accounting for 83 (about 5 percent) of all employee actions.  The remaining 120 (about 7 percent) of completed investigations  forwarded for adjudication resulted in retirements, resignations, transfers  and other outcomes such as settlement agreements.

Over 300 Management Retaliation Claims from ATF and USMS Employees Were Investigated In Fiscal Years 2014 through 2018, with Few Resulting in Discipline

According to the U.S. Merit Systems Protection Board, to prove a claim of  management retaliation, the investigation must show that the employee  engaged in a protected activity (e.g., filing an EEO claim); the agency  official with knowledge of the employee’s protected activity took, failed to  take, or threatened to take a personnel action against the employee; and  there is a causal connection between the protected activity and the  personnel action. From fiscal years 2014 through 2018, ATF and USMS  employees submitted 70 claims of management retaliation directly to their  Internal Affairs division or the DOJ OIG, and about 240 to their EEO  Office. OSC does not record data in its case management system related  to DOJ employee disclosures (claims) by component.

From fiscal years 2014 through 2018, ATF, USMS, and the DOJ OIG  completed 70 investigations of employee misconduct that alleged  management retaliation.

ATF Internal Affairs retaliation investigations. According to ATF  investigations data, from fiscal years 2014 through 2018, ATF Internal  Affairs investigated 23 cases alleging management retaliation. Of these  23 cases, Internal Affairs referred 20 to division management for  informational purposes. Of the three cases that were investigated by ATF,  two cases were investigated by division management and resulted in the  employees being counseled by their supervisors. The third case was  investigated by Internal Affairs and resulted in one employee receiving a  clearance letter and another receiving a letter of caution, with another two  employees retiring.

USMS Internal Affairs retaliation investigations. According to USMS  investigations data, from fiscal years 2014 through 2018, USMS Internal  Affairs investigated 26 cases alleging management retaliation. Of these  26 cases, 12 were closed after the investigation was completed due to  insufficient evidence. Of the remaining 14 cases, four resulted in  employees retiring during or after adjudication, four had no employee  action, three closed due to ongoing related cases, and there was one oral  admonishment, one letter of counseling, and one suspension of 14  days.

DOJ OIG retaliation investigations. According to our analysis of DOJ  OIG data, from fiscal years 2014 through 2018, the DOJ OIG investigated  21 ATF or USMS cases alleging management retaliation (four ATF cases  and 17 USMS cases). The DOJ OIG filed all four ATF cases in its  management system for informational purposes only (no action), and also  sent one of the four cases to ATF for informational purposes. Of the 17  USMS cases, the DOJ OIG filed 12 cases in its management system for  informational purposes (no action), found that three cases lacked  sufficient evidence, closed one case due to one of the involved  employees being reassigned and the other resigning, and in one case  made a procedural recommendation to the Director of USMS. Figure 6 shows the number of ATF, USMS, and DOJ OIG management retaliation  investigations from fiscal years 2014 through 2018.

ATF and USMS employees may file claims of management retaliation  through their agency’s EEO office. We analyzed ATF and USMS  employee misconduct and EEO data to determine (1) the number of  employees who had filed an EEO claim of management retaliation and (2)  whether these employees were also subject to a misconduct  investigation.

ATF EEO management retaliation investigations. From fiscal years  2014 through 2018, the ATF EEO Office received 128 claims from 104  employees that included management retaliation as the basis, but none of  these claims have been found to support a finding of retaliation. ATF EEO  and employee misconduct data show that employees in 54 of the 128  EEO cases (36 total individuals) were also subject to misconduct  investigations that were adjudicated during this time period. Of the 36  employees, 24 submitted their EEO claim subsequent to their misconduct  investigation. The remaining 12 employees submitted their EEO claim  prior to their first employee misconduct investigation. Figure 7 shows  the number of ATF employees who filed EEO claims of management  retaliation and were also the subject of an employee misconduct  investigation.

USMS EEO retaliation claims. From fiscal years 2014 through 2018, the  USMS EEO Office received 110 claims from 69 individuals with  management retaliation as the basis, of which one resulted in a final  agency decision supporting the claim. USMS EEO and employee  misconduct data show that individuals in 75 of the 110 EEO cases (49  total individuals) were also subject to a total of 134 employee misconduct  investigations that were adjudicated from fiscal years 2014 through 2018.  Of these 49 individuals, 32 submitted their EEO complaint subsequent to  their misconduct investigation. The remaining 17 employees submitted  their EEO claim prior to their first employee misconduct investigation, of  which three claims resulted in a settlement agreement. Figure 8 shows  the number of USMS employees who filed EEO claims of management  retaliation and were also the subject of an employee misconduct  investigation.

U.S. Office of Special Counsel Investigations of Management Retaliation

From fiscal years 2014 through 2018, OSC did not report any instances of  management retaliation for ATF or USMS. OSC reported one  investigation related to one USMS employee who improperly secured  personally identifiable information, for which USMS took corrective  actions. According to data maintained in an ATF Office of Chief Counsel  case management system, ATF recorded eight instances where ATF  counsel rendered assistance to OSC on retaliation-related matters.  USMS Office of General Counsel does not maintain OSC-related data in  any USMS case management system.

ATF and USMS Did Not Consistently Document Some Key Internal Controls for Processing Allegations of Employee Misconduct or Fully Monitor These Processes ATF and USMS Documented the Implementation of Some Key Internal Controls, but Not for Others

ATF and USMS have incorporated some key internal controls for  processing employee misconduct allegations into their policies and  procedures, but have not consistently documented the implementation of  these controls. ATF and USMS have also established policy requirements  related to timeliness in completing employee misconduct investigations,  but have not established performance measures to monitor all of these  requirements. Further, both ATF and USMS have established  mechanisms to monitor various aspects of the components’ operations,  but do not use these mechanisms to fully monitor key internal controls  related to their employee misconduct investigation and adjudication  processes.

ATF and USMS documented the implementation of some key control  activities that are important for ensuring the quality and independence in  processing allegations of employee misconduct. However, they did not  document other key control activities.

Supervisory review of investigations. According to Federal Quality  Standards for Investigations, supervisory or management review of  misconduct investigations helps ensure that investigations are  comprehensive and performed correctly. ATF and USMS both require  this review in policy for misconduct investigations and have incorporated  it in their respective procedures. Both ATF and USMS also have a policy  or procedure for documenting this control activity in either their case  management system or case file records.

We found that ATF consistently documented supervisory review of its  employee misconduct investigations. Overall, based on our case file  reviews, we estimate that 98 percent of the population of ATF  investigations or management referrals for action from fiscal year 2014  through fiscal year 2018 documented supervisory review. For our  sample, we found documentation of supervisory review in all 36 Internal  Affairs investigations and all 26 management referrals for action. We  also found supervisory review for all 12 investigations or referrals in our  sample with proposed adverse actions and all nine investigations or  referrals in our sample that involved an individual who had filed an EEO  claim of management retaliation.

For USMS, we found that the agency consistently documented  supervisory review of its Internal Affairs investigations, but did not  consistently document this review for its district and division  investigations. Overall, based on our case file reviews, we estimate that  60 percent of the population of USMS investigations (2,347) from fiscal  year 2014 through fiscal year 2018 documented supervisory review. For  our samples, we found documentation of supervisory review in 29 out of  30 of Internal Affairs investigations. However, for USMS district and  division investigations, we found that 23 of 59 investigations had  documentation of supervisory review through the required use of a field  incident report.

We also found that all 20 investigations in our sample with proposed  adverse actions had documentation of supervisory review. Further, we  found that six of the 12 USMS investigations in our sample that involved  an individual who had filed an EEO claim of management retaliation had  documentation of supervisory review. The remaining six cases without  documentation of supervisory review were district or division  investigations, which are typically considered to involve lower-level  offenses.

Although USMS policy on Field Operational Reports requires the use of a  standard form to document supervisory review for district and division  misconduct investigations, USMS officials stated that district and division  management periodically document a completed investigation with an electronic email confirmation for various reasons, including that the  investigation may involve non-adverse actions. However, according to  USMS policy, a memorandum does not serve as a substitution for the  required field report. Taking steps to ensure that supervisory review of  division and district investigations is documented in accordance with  USMS policy would provide greater management assurance that  investigations are performed comprehensively and consistently, and that  this control is operating as intended.

Legal sufficiency review. ATF policy on Integrity and Other  Investigations states that managers will review the investigative findings  with the Office of Chief Counsel’s management division to propose and  decide discipline or other actions. ATF also has procedures for  documenting these activities in its case management systems.

We found that ATF consistently documented legal sufficiency review  during the adjudication phase for its Internal Affairs investigations.  Specifically, we found that 32 of 36 cases investigated by Internal Affairs  documented legal counsel review during the adjudication phase. One  case of these 32 had review for the proposal, but was ultimately cleared.  For the four cases without documentation of legal counsel review, this  review was not applicable. Specifically, one case involved an employee  who received a clearance letter; one case was still pending a final  decision; one case involved an employee who was on military leave; and  one case involved an employee who had retired. We also found that legal  counsel review was documented in 11 of the 12 cases in our sample  where adverse action was proposed—all of which were investigated by  Internal Affairs—and the remaining case was still pending adjudication as  of August 2019. Further, we found documentation of legal counsel review  for six of the nine employee misconduct investigations that involved an  EEO claim of management retaliation. Of the three investigations that did  not have documentation, one was an Internal Affairs case where the final  action was pending, and the other two cases were management referrals  for action.

Regarding ATF Internal Affairs investigations referred to division  management for action, we found that legal counsel review was  documented for nine of 26 cases during the adjudication phase for the  proposed discipline, the final disciplinary action, or both. Documenting  legal counsel review for cases referred to division management for action  would provide ATF management greater assurance that all proposed  discipline or other actions are legally sufficient. Although ATF policy  requires managers to review investigative findings with the Office of Chief  Counsel when handling management referrals, ATF officials stated that  supervisors may handle the matters within the division without informing  or consulting with legal counsel if there is no proposed discipline.  According to ATF officials, the agency plans to revise its policy on  Integrity and Other Investigations in August 2020, the next scheduled  recertification of the order, to allow managers discretion in determining  whether legal review is needed in instances where discipline is not  imposed.

USMS policy on Discipline Management Business Rules requires legal  review for Internal Affairs investigations that involve a proposed adverse  action, but does not require legal reviews for investigations that involve  non-adverse actions. USMS also has procedures for documenting this  activity in its case management system and physical case files. We found  that USMS consistently documented the legal sufficiency internal control.  Specifically, we found that all of the 20 proposed adverse actions in our  sample documented legal counsel review. Of the 12 cases in our sample  that involved an individual who had also filed an EEO claim, three had  proposed adverse actions, all of which had documentation of USMS legal  review.

DOJ OIG right of first refusal. According to ATF and USMS policies on  misconduct investigations and management referrals, for each  misconduct allegation received, the components must provide the DOJ  OIG the opportunity to review the case for right of first refusal. This review  allows the DOJ OIG to either open an investigation or defer the case back  to the component for investigation. This review is designed to maintain  independence by determining which cases warrant investigation outside  of ATF and USMS.

We found that ATF and USMS consistently forwarded allegations of  employee misconduct to the DOJ OIG for right of first refusal. Specifically,  our analysis of ATF and DOJ OIG data found that the DOJ OIG did not  have a record of receiving five out of 1,581 ATF investigations or  management referrals for right of first refusal. There were also 41  instances for which ATF did not have a DOJ OIG case number, which  prevented the DOJ OIG from checking its records for evidence that ATF  had forwarded the case for right of first refusal. We found that 37 of the  41 cases occurred in fiscal years 2014 or 2015, with only four cases  occurring in fiscal years 2016 through 2018. Our analysis of USMS and  DOJ OIG data found that the DOJ OIG did not have a record of receiving  10 out of 2,347 investigations for right of first refusal.

Verification of accuracy of case management system data. ATF and  USMS do not have a policy requirement for the use of a method or tool to  verify system data associated with both investigation and disciplinary  processes. However, according to Standards for Internal Control in the  Federal Government, management is to use quality information to make  informed decisions and evaluate the entity’s performance in achieving key  objectives and addressing risks. The standards also state that data  maintains value to management in controlling operations and making  decisions, and management is to design control activities so that all  records are complete and accurate. Regular reviews of case  management data can identify outliers or abnormalities, such as missing  information.

ATF officials stated that agency managers verify that the initial  information related to the allegation is accurate in the case management  system. However, additional reviewers in the misconduct process do not  verify investigation and adjudication information subsequent to the  allegation in the case management system. The officials added that after  Internal Affairs investigations and management referrals for action are  completed, the record of investigation and supporting materials are  reviewed by management to assess the quality of the investigation before  uploading to the case management system. However, we found that  information related to the investigation and adjudication of these  allegations was sometimes not captured in automated data fields. Since  uploaded documents cannot be analyzed easily, the Office of  Professional Responsibility manually reviews these documents to compile  an annual report on employee misconduct activities, such as the number  of investigations and outcomes.

According to ATF and USMS officials, employee misconduct procedures  include supervisor review in several areas. For example, ATF and USMS  officials stated that managers review reports of investigation and other  documents to ensure certain information is recorded in case files or case  management systems. ATF officials provided evidence that they verify  certain data when a case is initiated, such as the identity of the subject  and allegation. ATF officials also provided evidence that managers review  the report of investigation for quality. USMS officials stated that they  confirm that the employee under investigation is the correct employee in  the system record and that the case was referred to the DOJ OIG for right  of first refusal.

ATF officials also stated that reviewers involved in employee misconduct  processes compare case file documentation against case management  system records. However, we found that hundreds of case management  system records were missing key information, such as the final outcomes  of employee misconduct investigations and DOJ OIG case numbers for  ATF, and dates related to district or division investigations for USMS. We  also found that ATF and USMS lack policy for verifying the accuracy and  completeness of data recorded in their respective employee misconduct  case management systems. This policy could be implemented, for  example, through the use of a method or tool, such as a data entry  checklist, that would guide agency officials when entering information into  systems. Establishing policy could help ensure that case management  system data are accurate and complete and would allow ATF and USMS  to effectively monitor and report on their employee misconduct processes.

ATF and USMS Have Established Timeliness Requirements for Completing Employee Misconduct Investigations, but Have Not Fully Established Performance Measures

ATF and USMS have established requirements in their policies regarding  timeliness in completing employee misconduct investigations. However,  ATF has not developed performance measures to monitor its timeliness  requirements. USMS has developed a measure to monitor its Internal  Affairs investigations, but not for its district and division investigations.  Standards for Internal Control in the Federal Government state that  management should define objectives in measurable terms so that  responsible personnel and management are held accountable, and their  performance toward achieving those objectives can be assessed.

ATF Does Not Have a Performance Measure to Monitor Timeliness

ATF policy on Integrity and Other Investigations requires completing  Internal Affairs investigations generally within 120 days, and management  referrals for action within 60 days. ATF officials acknowledged the  importance of addressing employee misconduct allegations in a timely  manner. For example, ATF may withhold a positive human resource  action or personnel assignment pending completion of a misconduct  investigation, such as a promotion or becoming a member of a task force.  ATF employees under investigation for misconduct may also be placed  on restricted duty, which depending on the case may prevent the  employee from accessing information systems and require the employee  to surrender his or her government-issued firearms, vehicle, other  property, and credentials.

ATF officials stated that ATF management tracks ongoing  investigations—for both Internal Affairs investigations and management  referrals for action—and the amount of time they are open. ATF Internal  Affairs officials stated that managers track the duration of all  investigations on a weekly basis, and will inquire about the status of  investigations and reasons why any exceed the duration standards.  However, ATF has not developed a performance measure to monitor  performance against timeliness requirements—for example, whether a  certain percent of Internal Affairs investigations during a definite time  period were completed within the required 120 days.

Based on our analysis of ATF data, Internal Affairs met its policy  requirement of completing its investigations within 120 days about 36  percent of the time (86 of 240 investigations). ATF data also show that  the agency met its policy requirement of 60 days for about 49 percent  (205 of 419) of its management referrals for action (see fig. 9).

According to ATF officials, ATF does not use measures to monitor  performance related to the duration of Internal Affairs investigations and  management referrals for action due to numerous factors, such as  investigators handling multiple cases at the same time and the  involvement of the DOJ OIG. We have previously reported that other  federal agencies have established such performance measures, which  have taken these challenges into account when developing their  methodology for measuring timeliness. Establishing a performance  measure to monitor the timeliness of Internal Affairs and management  referrals for action could provide ATF management more complete  information in overseeing investigations and help improve the efficiency of  employee misconduct processes.

USMS Met Timeliness Goals for District and Division Investigations, but Lacks a Measure to Monitor These Investigations

USMS policy requires completing Internal Affairs investigations within 90  days, and within 30 days for investigations referred to its districts and  divisions. USMS officials noted the importance of addressing employee  misconduct allegations in a timely manner, with regards to effecting  positive human resource actions such as promotions.

USMS Internal Affairs has developed a performance measure to monitor  whether it is completing its investigations within the required 90-day time  frame. According to USMS officials, the agency plans to change the  required time frame for completing Internal Affairs investigations from 90  days to 180 days, which according to the officials is a time standard used  by most other law enforcement agencies. USMS does not have a  performance measure to monitor the duration of investigations conducted  by its districts and divisions. According to USMS officials, these  investigations do not involve high-level offenses that would pose a  significant risk to the agency.

Based on our analysis of USMS data, Internal Affairs met its policy  requirement of completing its investigations within 90 days 35 percent of  the time (468 of 1,320 investigations for which data were recorded in  USMS systems), as shown in figure 10. Our analysis also shows that  USMS met its policy requirement of completing its district and division  investigations within 30 days over 99 percent of the time (489 of 490  investigations for which data were recorded in USMS systems).

Although we found that USMS met its timeliness requirement related to  district and division investigations over 99 percent of the time,  management responsible for oversight have not developed a  performance measure to monitor whether the agency meets its policy  requirement. Therefore, the agency will not be able to identify any  potential future performance issues. Monitoring these investigations is  also important since data on the duration for about 25 percent (165 of  655) of district and division investigations that were opened from fiscal  years 2014 through 2018 were not recorded in USMS systems at the time  the agency provided the data. Developing a measure for the duration of  district and division investigations would provide USMS leadership with  greater assurance that the agency is complying with policy requirements.

ATF and USMS Do Not Use Existing Oversight Mechanisms to Fully Monitor Key Internal Controls for Their Employee Misconduct Processes

ATF and USMS do not use their existing oversight mechanisms to fully  monitor key internal controls related to employee misconduct processes.  Standards for Internal Control in the Federal Government call for  management to establish and implement activities to monitor the internal  control system and evaluate the results, as well as remediate identified  internal control deficiencies.

ATF has two oversight mechanisms that it uses to monitor internal  controls related to financial reporting, compliance activities, and  operations—annual self-assessments and internal management reviews.  However, according to ATF officials, the component does not use these  mechanisms to monitor any internal controls related to its employee  misconduct processes.

Specifically, according to an ATF official, as part of ATF’s annual self- assessment program, all component divisions, including Internal Affairs,  are to test financial processes, such as government credit card payments.  The ATF Inspection Division also conducts internal management reviews  to test compliance with the same activities that are covered by the self- assessment program. ATF officials stated that the scope of the self- assessment program does not include key internal control activities  related to employee misconduct processes due to competing priorities.  According to an Inspection Division official, the division also has not  conducted an internal management review of the offices responsible for  employee misconduct processes (e.g., the Internal Affairs division, the  Professional Review Board, Bureau Deciding Official activities) in about  10 years due to competing priorities.

ATF officials stated that the agency plans to review these divisions and  offices in the future, but did not have any specific plans for how internal  management reviews would be used for divisions and offices in the  misconduct process or when these reviews would begin. While the scope  of these reviews has not been determined, the officials stated that internal  management reviews could include testing internal control activities  related to allegations of employee misconduct, such as investigative  review and approval, legal sufficiency review; and case management  information system data reliability and completeness. Monitoring key  internal controls related to employee misconduct processes through  existing oversight mechanisms would help ATF management ensure that  controls are being implemented as required by policy.

USMS has two oversight mechanisms that it uses to monitor internal  controls related to financial reporting, compliance activities, and  operations. Specifically, USMS’s Compliance Review Office, within the  Office of Professional Responsibility, conducts on-site management  reviews at USMS districts and divisions. USMS also has an annual self- assessment program that requires divisions and districts to self-assess  their compliance with certain requirements by testing for and remediating  any internal control deficiencies. However, because of competing  priorities, USMS does not use these mechanisms to fully monitor key  internal controls over employee misconduct processes.

According to Office of Professional Responsibility Compliance Review  officials, the scope of on-site management reviews conducted at selected  USMS districts and divisions during fiscal years 2014 through 2018 did  not include employee misconduct processes. The officials also stated that  on-site reviews during this period did not include the Internal Affairs and  Discipline Management divisions. According to USMS officials, the  agency plans to conduct an on-site management review at the Internal  Affairs division in fiscal year 2021. The officials added that the compliance  review cycle for each district and division currently occurs once every 9  years, but that this review cycle will increase to once every 4 years.

Our analysis of USMS annual self-assessment guides showed that from  fiscal years 2014 through 2018, the guides included testing for most key  controls related to employee misconduct processes. For example,  Internal Affairs and Discipline Management self-assessment guides  included questions on whether Internal Affairs forwards cases to the  DOJ OIG for right of first refusal, the Chief of Internal Affairs reviews  investigative reports, investigations are completed within 90 days, and  data on allegations is entered into the case management system.

The self-assessment guide for USMS districts and divisions included  questions to assess compliance with the timeliness of investigations  (within 30 days); use of the Table of Offenses and Penalties,  consideration of Douglas Factors (certain factors that USMS is to  consider about an employee when deciding discipline, such as the  employee’s need for training); Delegations of Authority for proposing  and deciding officials, and other Human Resource policy areas, such  as administrative leave and eligibility for promotion.

However, although legal sufficiency review of proposed adverse actions is  required by policy and a key internal control, USMS did not design its self- assessment guides for the Internal Affairs and Discipline Management  divisions to include testing for such reviews.

Revising the scope of on-site management reviews to include employee  misconduct processes and revising self-assessment guides to include  testing for legal sufficiency of proposed adverse actions would help  USMS gain greater assurance that these controls are implemented as  required by policy.

ATF and USMS have established internal controls related to some  employee misconduct investigation and disciplinary processes, but  additional actions could strengthen their controls. Specifically, USMS  does not ensure that supervisory review of division and district  investigations is documented in accordance with agency policy. ATF and  USMS also have not developed policy for verifying the accuracy and  completeness of information in employee misconduct systems. Ensuring  supervisory review is documented as required and establishing policy for  verifying information in misconduct systems would provide greater  consistency in processes, assurance that controls are operating as  intended, and corrective actions are implemented as needed.

ATF and USMS policy also have required timelines for completing  investigations. However, ATF does not have a performance measure to  monitor whether it is meeting its timeliness requirement, such as the  percentage of Internal Affairs investigations completed within 120 days.  USMS does not have a performance measure to monitor and assess its  performance in meeting the required time to complete its district and  division investigations within 30 days. Developing performance measures  to monitor the timeliness of all investigations could provide more complete  information for ATF and USMS management responsible for oversight  and allow them to address any related performance issues in a timely  manner.

Further, ATF and USMS have established oversight mechanisms, such  as internal management reviews, to monitor select aspects of the  components’ operations, such as financial operations. However, ATF and  USMS generally have not used these mechanisms to monitor internal  controls related to employee misconduct processes, which would help  ATF and USMS management ensure that controls are implemented as  required by policy.

We are making a total of seven recommendations, including three to ATF  and four to USMS. Specifically:  The Director of the U.S. Marshals Service should take steps to ensure  that supervisory review of division and district investigations is  documented in accordance with USMS policy. (Recommendation 1)

The Director of ATF should develop policy for verifying the accuracy and  completeness of information in ATF employee misconduct systems.  (Recommendation 2)

The Director of the U.S. Marshals Service should develop policy for  verifying the accuracy and completeness of information in USMS  employee misconduct systems. (Recommendation 3)

The Director of ATF should develop a performance measure to monitor  the timeliness of misconduct investigations, according to policy  requirements. (Recommendation 4)

The Director of the U.S. Marshals Service should develop a performance  measure to monitor the timeliness of district and division misconduct  investigations, according to policy requirements. (Recommendation 5)

The Director of ATF should modify existing oversight mechanisms to  include the monitoring of key internal controls related to employee  misconduct investigations. (Recommendation 6)

The Director of the U.S. Marshals Service should modify existing  oversight mechanisms to fully monitor key internal controls related to  employee misconduct investigations. (Recommendation 7)

We provided a draft of this product to DOJ for review and comment. DOJ  concurred with all of our recommendations and did not provide written  comments. ATF and USMS provided technical comments, which we  incorporated as appropriate.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to the Attorney  General, the ATF Acting Director, the USMS Director, appropriate  congressional committees, and other interested parties. In addition, the  report will be available at no charge on the GAO website at  http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-8777 or McNeilT@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix II.

To assess the extent to which the Bureau of Alcohol, Tobacco, Firearms  and Explosives (ATF) and United States Marshals Service (USMS)  components implemented key internal controls, we selected a stratified  random sample of case files within the population of employee  misconduct investigations that were opened by each component from  fiscal years 2014 through 2018, and that were considered closed as by  USMS as of March 13, 2019, for fiscal years 2014 through 2017 and April  26, 2019, for fiscal year 2018, with corresponding data on the outcomes  of the investigations (resulting employee actions) as of March 27, 2019  for fiscal years 2014 through 2017 and May 3, 2019, for fiscal year 2018.  ATF data are as of April 9, 2019, for internal investigations and as of  August 2, 2019, for management referrals.

We also stratified our samples based on whether the case files included  adverse actions (a suspension of at least 15 days, demotion or removal)  and whether an employee under a misconduct investigation had also filed  an Equal Employment Opportunity (EEO) claim of management  retaliation to assure that representation from both subgroups were  included in our sample. We used fiscal year 2014 through 2018 data from  the components’ information systems from which to randomly select a  generalizable sample of 65 employee misconduct cases for ATF out of a  population of 150 and 100 cases for USMS out of a population of 1,281.

Because we followed a probability procedure based on random  selections, our sample is only one of a large number of samples that we  might have drawn. Since each sample could have provided different  estimates, we express our confidence in the precision of our particular  sample’s results as a 95 percent confidence interval. This is the interval  that would contain the actual population value for 95 percent of the  samples we could have drawn.

The sample was designed to produce 95 percent confidence intervals for  percentage estimates that are within no more than plus or minus 10  percentage points within component. The precision is not high enough to  generalize to the strata level and results should only be generalized to the  component level (i.e. ATF and USMS).

As part of these samples, we included investigation that resulted in  proposed adverse actions and that involved employees who also  submitted an EEO claim of management retaliation. Specifically:

For ATF, our sample included 12 cases with proposed adverse  actions and nine cases that involved individuals who had also  submitted an EEO claim of management retaliation.

For USMS, our sample included 12 cases with proposed adverse  actions and 12 cases that involved individuals who had also submitted  an EEO claim of management retaliation.

Because some items we assessed applied only to a subset of cases,  resulting in a smaller sample size, we report some findings as the range  from the lower to upper bound of the 95 percent confidence interval. In  cases with particularly small sample sizes, we describe results for the  sample only, rather than attempting to generalize to the population of  cases within the component.

Appendix II: GAO Contact and Staff Acknowledgments

Triana McNeil at (202) 512-8777 or McNeilT@gao.gov  In addition to the contact named above Eric Erdman (Assistant Director),  Willie (Billy) Commons III, Dominick Dale, Anthony DeFrank, Justin  Fisher, Eric Hauswirth, Ying Long, Amanda Miller, and Mike Tropauer  made key contributions to this report.

The Bureau of Alcohol, Tobacco, Firearms and Explosives and the U.S. Marshals Service collectively investigated about 3,900 allegations of employee misconduct in FY 2014-2018. About half of the investigations found that the allegations were unsubstantiated. In the others, the most common offenses included poor judgment at ATF and general violations of policy or procedure at the Marshals Service.

Both agencies could strengthen the management of their employee misconduct processes. Our 7 recommendations to the agencies include better monitoring of their misconduct processes and ensuring that supervisory reviews of investigations are documented.