Federal Management: Selected Reforms Could Be Strengthened By Following Additional Planning, Communication, and Leadership Practices

In June 2018, the administration released its government-wide reform plan, which included 32 proposals aimed at achieving management improvements and organizational efficiencies, among other things. OMB has a central role in overseeing these reform proposals, with support from various lead agencies. In July 2018, GAO reported on key questions to consider when developing and implementing reforms.

GAO was asked to examine reform implementation. This report discusses three selected reforms that the administration prioritized: (1) moving background investigations from OPM to DOD, (2) solving the cybersecurity workforce shortage, and (3) establishing the GEAR Center. For each selected reform, GAO determined the extent to which OMB and the lead agencies addressed key practices for effectively implementing reforms, among other issues.

GAO reviewed relevant documentation and interviewed OMB staff and agency officials. GAO assessed OMB's and lead agencies' efforts against relevant key practices for effective reforms.

In working to implement three selected government-wide reforms that GAO reviewed, the Office of Management and Budget (OMB) and lead agencies followed some, but not all, of the key practices associated with effective reforms. Following key practices, such as those reflected in the questions below, would better position OMB and lead agencies to effectively implement such major change initiatives and achieve their intended objectives.

Moving background investigations from the Office of Personnel Management (OPM) to the Department of Defense (DOD) : As required, the transfer of background investigations took place by September 30, 2019. OMB, OPM, and DOD generally addressed most key reform practices in this transfer, including involving employees and stakeholders, establishing an implementation team, and developing implementation plans. With the transfer complete, DOD officials told GAO they are shifting focus toward addressing GAO's high-risk area on the government-wide personnel security clearance process.

Solving the cybersecurity workforce shortage : OMB and the Department of Homeland Security (DHS) partially addressed most leading practices through their efforts to implement several projects, such as reskilling employees to fill vacant cybersecurity positions, and streamlining hiring processes. However, GAO found that OMB and DHS have not established a dedicated implementation team, or a government-wide implementation plan, among other practices. Without these practices in place, OMB and DHS may not be able to monitor implementation activities and determine whether progress is being made toward solving the cybersecurity workforce shortage.

Establishing the Government Effectiveness Advanced Research (GEAR) Center : According to OMB, the GEAR Center will bring together researchers from private and public sectors to inform and develop ways to improve government services and operations. OMB is working toward establishing the GEAR Center by collecting input from the public, academia, and industry for how the Center could be structured and ideas for possible research projects. However, OMB has not yet developed an implementation plan with key milestones and deliverables to track its progress. Developing and communicating an implementation plan will help OMB track the GEAR Center's progress and communicate its results.

GAO is making 7 recommendations to OMB to follow certain key practices to help solve the cybersecurity workforce shortage and to establish the GEAR Center. OMB did not comment on the report.

Reforming and reorganizing the federal government is a major endeavor.  It can include refocusing, realigning, or enhancing agency missions, as  well as taking steps to improve services by identifying and eliminating  inefficiencies to improve effectiveness. Equally important is examining the  possible impact of reforms on employees, stakeholders, and program  customers. Our earlier work has shown that effective government reform  initiatives (1) require a combination of people, processes, technologies,  and other critical success factors to achieve results; and (2) are  dependent upon following essential change management practices, such  as the involvement of Congress, federal employees, and other key  stakeholders.

In June 2018, the administration released its government-wide reform  plan, Delivering Government Solutions in the 21st Century: Reform Plan  and Reorganization Recommendations (reform plan). It put forward a set  of 32 government-wide reform proposals aimed at organizational  realignments, changes in mission focus, management improvements,  achieving operational efficiencies, and developing new capabilities. The  Office of Management and Budget (OMB) has a central role in  coordinating and overseeing the reform proposals, with support from lead  agencies that are most directly affected by the reforms.

In June 2018, we issued a set of key questions to consider when  developing and implementing government reforms. OMB’s then Deputy  Director for Management acknowledged the importance of following  sound change management principles in implementing reforms, and  publicly stated that the administration plans to follow the key questions for  assessing reforms included in our June 2018 report.

You asked us to examine reform implementation. This report determines  the extent to which OMB and lead agencies addressed key practices for  effectively implementing selected government-wide reforms, and  describes OMB’s and lead agencies’ assessments of the legal authorities  they are relying on to implement the selected reforms.

To address both parts of our objective, we selected five of the 32  government-wide reforms in the reform plan for more detailed review. We  selected reforms that the administration had publicly stated were priorities  for implementation:  (1)  moving background investigations from the Office of Personnel  Management (OPM) to the Department of Defense (DOD),  (2)  solving the cybersecurity workforce shortage,  (3)  establishing the Government Effectiveness Advanced Research  (GEAR) Center,  (4)  reorganizing OPM, and  (5)  developing a customer experience improvement capability.

The lead agencies for these selected reforms are OPM, the General  Services Administration (GSA), the Department of Homeland Security  (DHS), and DOD (see table 1). Our assessments of the selected reforms  are not generalizable to all proposed reforms.

To determine the extent to which OMB and lead agencies addressed key  practices, we reviewed the reform plan, the President’s fiscal year 2019,  fiscal year 2020, and fiscal year 2021 budget requests, and relevant  congressional hearing statements to obtain additional information on the  administration’s priorities and time frames. Since being announced in  June 2018, the administration’s reform proposals have evolved and  important planning and implementation details have gradually emerged.  As information became available, we analyzed documentation provided  by OMB and lead agencies related to the selected reforms. We then  spoke with OMB staff and officials from the lead agencies for these  reforms. We also coordinated with the Office of Inspector General (OIG)  in each of these agencies. We also reviewed our prior work on  fragmentation, overlap, and duplication, and high-risk areas, as well as  major management challenges identified by lead agencies’ OIGs.

We then selected and applied relevant key practices for assessing  government reform efforts from our June 2018 report. We chose  practices that were most relevant to each of the selected reforms based  on the information presented in the reform plan, and updates from OMB  and lead agencies on the status of implementation. We grouped these  criteria into categories, subcategories of selected key practices, and  selected key questions, as shown in figure 1. In addition, appendix I  provides a full list of the key questions and practices from our June 2018  report.

In December 2019, Congress enacted legislation effectively halting the  proposed reorganization of OPM pending the completion of a report by  the National Academy of Public Administration (NAPA), and a  subsequent report by OPM. In appendix II, we are providing information  on the extent to which OMB and lead agencies responsible for the OPM  reorganization proposal followed key reform practices prior to the  December 2019 legislation. In addition, the reform proposal to implement  a customer experience improvement capability was delayed during the  course of our review, and no actions are planned in fiscal year 2020.  Therefore, we did not assess its progress against our key reform  practices. We provide descriptive information about this reform in  appendix III.

To describe OMB’s and lead agencies’ assessments of the legal  authorities they are relying on to implement the selected reforms, we sent  written requests to OMB and the lead agencies (OPM, GSA, DOD and  DHS) asking for their views on the legal authorities they are using to  implement the selected reforms, and of any additional authority that they  believe may be required for implementation. OMB and all four lead  agencies responded to our request. We also interviewed OMB staff and  officials from the four lead agencies.

We conducted this performance audit from April 2018 to April 2020 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Background Government-wide Reform Plan Requirements and Timeline

As shown in figure 2, a number of activities led up to OMB publishing the  reform plan in June 2018, and subsequently OMB has provided updates  on the proposals in the reform plan.

In March 2017, the President issued an executive order requiring  comprehensive reorganization plans for executive branch agencies. In  April 2017, OMB provided guidance to federal agencies for developing  their respective reform plans. According to this guidance, the  government-wide reform plan was to have been based on the agency  reform plans, OMB-coordinated crosscutting proposals, and public input.  In addition, OMB’s guidance indicated that OMB would track the progress  of the reforms in coordination with the President’s Management Council.  OMB’s guidance also stated that it would track progress of the reforms by  leveraging the federal performance planning and reporting framework that  was originally put into place by the Government Performance and Results  Act of 1993 (GPRA), and significantly enhanced by the GPRA  Modernization Act of 2010 (GPRAMA). Accordingly, OMB’s guidance  explained that progress would be tracked through the use of cross- agency priority (CAP) goals, agency priority goals, and  Performance.gov.

In March 2018, OMB released the President’s Management Agenda,  which identified a set of CAP goals, required under GPRAMA. The CAP  goals target areas where multiple agencies must collaborate to effect  change, and agencies must report CAP goal progress in a manner the  public can easily track.

In June 2018, the administration released its government-wide reform  plan, Delivering Government Solutions in the 21st Century: Reform Plan  and Reorganization Recommendations (reform plan). In July 2019, the  administration reported on the first year of progress toward its reform  proposals. According to the 1-year update, the President’s Fiscal Year  2020 Budget included 18 of the proposed reform proposals in whole, or in  part, and also described administrative actions by agencies to implement  more than 20 of its 32 proposals. Of these proposals, the administration  reported progress toward four of the five reforms we selected for review:  (1) moving personnel security clearance background investigations from  OPM to DOD; (2) solving the cybersecurity workforce shortage; (3)  establishing the GEAR Center; and (4) reorganizing OPM. OMB officials  said that they are not planning to move forward with the customer  experience improvement capability reform during fiscal year 2020  because they are pursuing other customer experience activities, such as  those included in the CAP goal for Improving Customer Experience with  Federal Services.

The Extent to Which Key Practices for Effective Reforms Were Followed Has Varied, and Agencies Identified Some Legal Authorities for Implementation

Moving Background Investigations from OPM to DOD: Most Selected Key Practices Addressed

We added the government-wide personnel security clearance process to  our High-Risk List in January 2018 because it continues to face  challenges in the timely processing of clearances, measuring the quality  of investigations, and ensuring the security of related information  technology (IT) systems. The National Defense Authorization Act (NDAA)  for Fiscal Year 2018 included provisions that resulted in the transfer of  background investigations from OPM’s National Background  Investigations Bureau (NBIB) to DOD for certain DOD personnel, which  represented approximately 70 percent of all federal background  investigations performed by NBIB. Subsequently, the selected reform  proposal recommended moving the remaining 30 percent of  investigations to DOD. According to the reform plan, this transfer would  provide an opportunity to conduct the background investigations more  efficiently and economically than having them be performed by separate  agencies.

In January 2019, DOD formally established the Personnel Vetting  Transformation Office (PVTO) to implement and oversee activities related  to the transfer of NBIB functions. In April 2019, the President issued  Executive Order 13869 which generally provided for the transfer of the  remaining background investigation operations from OPM to DOD. The  executive order also called on the Secretary of Defense to enter into an  agreement with the Director of OPM to set forth expectations and  designate the appropriate support functions for the transfer. As directed,  in June 2019, OPM and DOD signed an interagency memorandum that  set forth expectations for activities necessary for the transfer of functions  of NBIB and associated employees and resources from OPM to DOD,  including measurable deliverables, key considerations for executing  deliverables, and processes for coordination and governance. According  to documents we received from DOD, the transfer of NBIB functions to  DOD occurred by September 30, 2019, as required by the April executive  order.

As shown in figure 3, OMB, OPM, and DOD have generally addressed  most key reform practices in implementing the transfer of background  investigations from OPM to DOD. According to DOD, more than 99  percent of NBIB employees, totaling 2,979 individuals, accepted positions  transferring them to DOD’s Defense Counterintelligence and Security  Agency (DCSA) by September 30, 2019. According to the DOD’s PVTO  Director, 17 individuals chose not to transfer, and instead retired as  permitted. Going forward, we will continue to monitor the government- wide personnel security clearance process as part of our work to identify  and assess high-risk issues across the government.

OMB, OPM, and DOD have generally addressed key practices related to  establishing goals and outcomes. The NDAA for Fiscal Year 2018 and  Executive Order 13869 established a goal and related requirements for  the transfer of OPM’s NBIB personnel, resources, and functions to  DOD. Specifically, the executive order established a goal to complete  the transfer of all NBIB administrative and operational functions to DOD  by September 30, 2019. The executive order also outlined a series of  deliverables and objectives for OMB, OPM, and DOD to achieve during  the transfer. For example, the executive order required DOD to execute a  written agreement with OPM to establish expectations for the transition  period related to detailing personnel, safeguarding information  technology, contracting, and funding background investigations, among  others. OPM and DOD achieved their intended goal, and as of September  30, 2019, DOD is the primary provider of national security background  investigations for the federal government.

As directed, OPM and DOD signed an interagency agreement in June  2019 to address expectations, including governance, information  technology, contracting, and funding issues, among others. According to  documents provided by DOD, the Transfer Tollgate group and the  Executive Steering Committee provided interagency leadership including  an executive-level decision venue for implementation, resourcing, and  other decisions. According to DOD, these interagency groups also  provided accountability for implementation milestones. Under the  leadership of these two groups, DOD officials shared with us that they  worked with OPM to resolve a host of issues such as the transfer of  personnel, funding for transfer costs, transfer of information technology  assets, financial management issues, and acquisition concerns, among  other critical issues. To help address differences in the financial  management and funding of background investigations between OPM  and DOD, the agreement required DOD to establish a Working Capital  Fund to fund DCSA’s background investigation mission by September 1,  2019. According to DOD officials and the agency’s Transfer Status  Dashboard, the Working Capital Fund was established prior to the  September 1, 2019, deadline; and, as of October 7, 2019, the fund had a  balance of approximately $1 billion.

Neither the NDAA for Fiscal Year 2018 nor the executive order outlined  measurable outcomes related to the efficient and effective delivery of  background investigations, but rather goals and deliverables related to  transferring NBIB functions to DOD, among other things. According to  DOD officials we spoke with, the reform’s objective was the timely  transfer of background investigation functions and coordination between  affected agencies and stakeholders. DOD officials explained that  following completion of the transfer, on October 1, 2019, PVTO, in  coordination with other DOD components and federal stakeholders,  began work transforming DCSA’s processes and procedures, including  the background investigation process, to improve outcomes.

Involving Employees and Key Stakeholders

OMB, OPM, and DOD generally addressed key practices related to  involving employees and key stakeholders. OPM and DOD generally  communicated with affected employees and key stakeholders and  involved them in the implementation of the transfer of NBIB functions to  DOD. Agencies’ communication included email correspondence to  affected staff from agency leaders including OPM’s Acting Director, and  the Director of NBIB. These emails provided NBIB staff regular updates  on the status and details surrounding the transfer of NBIB functions to  DOD.

Based on documents provided by OPM, communication to affected staff  began in June 2017, informing staff that Congress was considering a  legislative proposal to move certain NBIB functions to DOD. According to  documents we received, communication with staff has continued regularly  since this time, including a July 29, 2019, message to affected staff with  an official notice that NBIB employees would be offered an appointment  to DOD’s DCSA effective September 29, 2019. This notice explained that  OPM’s NBIB employees accepting this appointment would transfer to  DOD without changes to their duty stations, grades, or benefits.

In addition to email communication, in-person town hall meetings were  held between agency leaders and affected staff to provide updates on the  status of the transfer and answer questions. According to OPM’s then  NBIB Director, a July 2017 town hall was held addressing the  congressional proposal to move the majority of NBIB staff to DOD. The  Director also reported that OPM and DOD had worked via meetings,  information exchanges, site visits, and communication at all levels in the  organization to assemble information on the implication of the transfer  and its potential impacts.

OPM officials testified at a number of hearings in 2018 and 2019 related  to the transfer, and OPM officials told us that they joined DOD in  providing quarterly briefings required by the NDAA for Fiscal Year 2018,  on the status and progress of the transfer. DOD and OPM also  developed a Joint Transfer Plan that described strategic communication  activities with affected employees, contractors, and other stakeholders  including public media outlets, ourselves, and state and local law  enforcement agencies, among others. DOD officials at the PVTO  explained that they developed a more detailed communication plan in  March 2019 that was implemented prior to the transfer.

Addressing High-Risk Areas and Longstanding Management Challenges

OMB, OPM, and DOD have partially addressed key practices related to  addressing high-risk areas and longstanding management challenges. As  previously mentioned, we placed the government-wide personnel security  clearance process on our High-Risk List because of continuing  challenges in the timely processing of clearances, measuring the quality  of investigations, and ensuring the security of related IT systems. While  OMB and lead agencies have considered our related high-risk work, the  reform proposal and implementation plans do not demonstrate how the  transfer and delegation of background investigation functions from OPM  to DOD will address these challenges. Moreover, in November 2019,  OPM’s Inspector General identified the background investigation legacy  information systems as an ongoing top management challenge that will  need to be addressed by both OPM and DOD moving forward.

The Director of the PVTO told us that the office’s initial goal was to  ensure a smooth and timely transition of functions from OPM’s NBIB to  DOD by the beginning of fiscal year 2020. The Director also told us that  after the transfer occurred, the office would shift its focus to address our  high-risk area by, among other things, transforming these security  clearance services to optimize processes government-wide. Specifically,  the PVTO charter established a goal to “identify efficiencies to be gained,  areas where the organizational structure and business services may be  incomplete, maximize synergy where possible, and propose mitigation  strategies to address gaps and shortfalls.” We will continue to monitor the  government’s progress toward addressing security clearance challenges  as part of our work to track high-risk issues across the government.

OMB, OPM, and DOD have generally addressed key practices related to  leadership focus and attention. In particular, Executive Order 13869  outlined the roles and responsibilities of OMB, OPM, and DOD, and  authorized a new office (PVTO) to assist in the execution of the transfer.  The executive order also clarified agencies’ roles and requirements for  coordinating the transfer, delegation, and other activities. Specifically, the  executive order directed the Secretary of Defense and the OPM Director,  in consultation with the OMB Director and the Security Executive Agent,  to provide for the transfer of the bulk of OPM’s investigative functions to  the DCSA, along with any appropriate OPM-associated personnel and  resources, including infrastructure and certain investigation-related  support functions.

With regard to a dedicated implementation team, PVTO was responsible  for ensuring coordination and resource alignment during the transfer, as  well as ensuring that personnel security background investigations  continued without disruption during the transfer. The PVTO Director told  us in July 2019 that his team reports directly to the Office of the Under  Secretary of Defense for Intelligence. The Director stated that he has  experience in the areas of acquisitions, mergers, and reorganizations,  and has support from experts and top leadership throughout the  department. In addition, the PVTO charter states that the office be  composed of employees with extensive experience and expertise in  personnel vetting processes and reform efforts, as well as business and  technology innovation, program evaluation, acquisitions and mergers, and  organization and change management.

OMB, OPM, and DOD have generally addressed key practices related to  managing and monitoring. Specifically, PVTO developed a joint transfer  plan outlining critical assumptions for the transfer, major activities, and  time frames across nine functional areas, including personnel, training,  information technology, financial management, acquisitions, strategic  communications, and security, among others. For each functional area,  the transfer plan provided a summary of the functional area’s objective  and a set of recommended major activities. For example, the functional  area for IT had an objective to provide secure, current hardware and  software in compliance with DOD and federal standards, and promote the  unique requirements of a highly mobile, geographically dispersed  workforce managing significant volumes of personally identifiable  information and other sensitive data. Major activities included:  (1) the transfer of IT infrastructure,  (2) the completion of a gap analysis to determine which NBIB systems  and hardware are transferrable or require new acquisitions, and  (3) the provision of secure devices that support mobile operations.

The PVTO Director also showed us a detailed implementation plan  organized around the nine functional areas identified in the broader joint  transfer plan. The implementation plan tracked thousands of activities and  provided a detailed timeline for completion. The Director also provided us  a dashboard that his team used to track implementation progress. The  Director told us that his office used the dashboard to manage and monitor  the transfer daily. The dashboard allowed the implementation team to  identify areas where attention was needed using red, yellow, and green  stoplight indicators signaling the status of major objectives.

The annual assessments of timeliness and quarterly briefings required by  the NDAA for Fiscal Year 2018 also serve as mechanisms for Congress  and the executive branch to monitor timeliness, costs, and continuous  evaluation, among other things. OMB also publishes quarterly milestone  progress and metrics on the related Security Clearance, Suitability, and  Credentialing Reform cross-agency priority goal on Performance.gov.

OMB, OPM, and DOD have generally addressed key practices related to  employee engagement. In addition to the communication and outreach  activities described above, OPM and DOD have undertaken additional  efforts to engage affected employees and monitor levels of employee  engagement at both agencies. For example, according to DOD officials,  to engage and communicate with affected employees the agency held  several town hall meetings to provide information and answer questions.  They also said that DOD leadership regularly emailed affected staff  providing updates on the status of the transfer and held separate  question-and-answer sessions to keep staff informed and engaged.  According to PVTO planning documents, the office also developed a  strategy to achieve stakeholder buy-in through empowering leaders and  through efforts to build a coalition of stakeholders around a common  vision for the future of the background investigation function at DOD.

In April 2019, OPM also conducted an internal survey of agency staff to  collect information on employees’ perceptions of the transition to DOD,  personal work experiences, satisfaction with their job, and any intent to  leave DOD and reasons for leaving. The survey asked NBIB employees  the extent to which they felt informed about the upcoming transition to  DOD. According to the roughly one-third of staff who responded, 35  percent felt extremely or moderately informed, 32 percent felt somewhat  informed, and 33 percent felt slightly or not at all informed.

Approximately 75 percent of the survey respondents reported that they  had enough information to do their job well, and 74 percent reported that  they were proud to tell others they worked at their organization. When  asked about satisfaction with involvement with decisions that affect their  work, 38 percent of respondents were positive, 34 percent were neutral,  and 28 percent were negative. OPM officials told us that they continued to  monitor engagement of NBIB staff throughout the transition.

OPM and DOD have partially addressed key practices related to strategic  workforce planning. In March 2019, we reported that, to make progress  on removing the Government-wide Personnel Security Clearance  Process from our High-Risk List, OPM and DOD should develop and  implement a comprehensive strategic workforce plan that identifies the  workforce needed to meet the current and future demand for its services,  as well as reduce the current backlog to a manageable level. OPM  completed this action in September 2019 with the release of the NBIB  Strategic Workforce Plan for the Background Investigation Mission. The  strategic workforce plan includes initiatives to strengthen investigative  workforce capacity and training, promote the use of different hiring  authorities, and provide succession planning, among other initiatives.  According to the plan, senior leadership will build upon the strategic  workforce plan to create an implementation strategy. While OPM has  taken action, DOD has yet to complete its workforce plan. As of October  2019, DOD’s strategic workforce plan for the new DCSA enterprise was  under development.

Moving Background Investigations from OPM to DOD: Agencies Identified a Number of Legal Authorities

In response to our request for information, OPM, DOD, and OMB  provided information regarding the authorities they are using to implement  the reform proposal to move all background investigations from OPM to  DOD. According to OPM and OMB, the legal authorities by which NBIB  moved to DOD consisted of section 925 of the National Defense  Authorization Act for Fiscal Year 2018 (NDAA 2018) and Executive Order  13869, issued in April 2019, which re-designated DOD’s DCSA as the  primary investigative service provider for national security  investigations. OPM also cited 5 U.S.C. § 1104, which permits OPM to  delegate certain personnel management functions to other agencies.

Section 925 of the NDAA 2018 authorized DOD to conduct its own  background investigations and required DOD to begin carrying out an  implementation plan required under the National Defense Authorization  Act for Fiscal Year 2017 (NDAA 2017) by October 1, 2020. The NDAA  2018 also required the Secretary of Defense, in consultation with the  OPM Director, to provide for a phased transition of DOD background  investigations from OPM to DOD. According to OPM, the DOD  background investigations, consisting of investigations for civil service,  military, contract, and non-appropriated fund personnel, constitute  approximately 70 percent of the work performed by NBIB.

Executive Order 13869 provided for the transfer of the primary  responsibility for conducting national security background investigations,  government-wide, from OPM to DOD. The executive order designated  DOD, rather than OPM, as the agency to serve as the primary entity for  conducting background investigations for national security adjudications,  pursuant to and consistent with the NDAA 2018 and section 3001(c) of  the Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA).  According to OPM, this has the effect of moving the remaining national  security investigations, not already transferred by section 925 of the  NDAA 2018, to DOD.

The Executive Order also acknowledged that OPM will delegate, pursuant  to 5 U.S.C. § 1104, other background investigation functions to DOD for  non-DOD personnel, such as investigations performed to enable the  adjudication of the subject’s suitability or fitness for federal employment,  eligibility for logical or physical access to systems and facilities, fitness to  perform work for a federal agency under a government contract, and  fitness to work as a nonappropriated fund employee. In accordance with  the executive order, DOD and OPM signed an agreement on June 25,  2019 that set forth the expectations for necessary activities for the  transfer of functions of the NBIB from OPM to DOD. The agreement  provided that the period of transition was from June 24, 2019, through  September 30, 2019. The agreement covered such areas as personnel,  information technology, facilities and property, contracting, administrative  support, records access, claims, and funding.

Solving the Cybersecurity Workforce Shortage: Most Selected Key Practices Partially Addressed

This reform proposal directs OMB and DHS, in coordination with other  agencies, to prioritize and accelerate efforts to recruit, evaluate, hire, pay,  and distribute cybersecurity talent across the federal government.  Ensuring the cybersecurity of the nation is a longstanding challenge that  has been on our High-Risk List for more than two decades. Efforts to  solve the cybersecurity workforce shortage will help to address a number  of high-risk issues we have previously identified. To accomplish the  objective of filling cybersecurity vacancies, the reform lays out a series of  projects and activities intended to identify and close workforce skills gaps  and develop a standardized approach to hiring, training, and retaining  qualified cybersecurity professionals. Specifically, the proposal calls for:  identifying and categorizing the federal cybersecurity workforce using  the National Initiative for Cybersecurity Education Cybersecurity  Workforce Framework (NICE framework),  implementing DHS’s Cyber Talent Management System (CTMS) with  options to expand the capability across the government,  rationalizing and expediting the security clearance process,  standardizing training for cybersecurity employees,  increasing the mobility of cybersecurity positions, developing plans to establish a cybersecurity reservist program to  provide needed surge capacity,  reskilling federal employees to fill critical cyber positions, and  rationalizing the size and scope of federal cybersecurity education  programs.

As shown in table 2, OMB, DHS, and other federal agencies have made  progress in implementing certain projects and activities included in the  reform proposal.

Although OMB and DHS have several projects and activities underway  related to this reform, they did not provide us with information about the  government-wide goals or implementation plans for the proposal. In  November 2019, OMB staff told us that they did not have additional  information to share regarding their application of key reform practices  because they are still developing this reform. As a result, we found that  most of the key reform practices were partially met (see figure 4). We did  obtain information showing that OMB and DHS addressed key practices  for some of the projects and activities included in the reform proposal, but  the extent to which these practices were being applied to the reform  proposal as a whole, or being coordinated government-wide, was unclear.

OMB and DHS have partially addressed key practices related to  establishing goals and outcomes. We found that this reform established  an objective to solve the cybersecurity workforce shortage across the  government, and DHS established outcome-oriented goals and  performance measures for certain agency-specific projects that are part  of the reform. For example, as shown in table 2, DHS established a  measure to hire at least 150 cybersecurity professionals at the agency  during fiscal year 2020 using its new Cyber Talent Management System.  In addition, DHS provided us its 2017 Comprehensive Cybersecurity  Workforce Update, which includes an array of data and analysis,  including cybersecurity workforce trends, metrics on DHS components’  vacancies, attrition, capacity gaps, hiring, and other information  describing the status of the agency’s cybersecurity workforce. The  administration also released a National Cyber Strategy in September  2018 outlining broad activities related to the government-wide reform  such as building a talent pipeline, reskilling employees, and improving the  process of recruiting and retaining qualified cybersecurity professionals.  These documents may provide a first step toward developing clear  outcome-oriented goals and performance measures for the reform as a  whole.

However, OMB and DHS have not yet established measurable outcome- oriented goals for the government-wide projects and activities outlined in  the reform proposal. For example, there are not government-wide  measurable goals for hiring cybersecurity professional across the  government, reductions to attrition, training, or other aspects of the  reform. As shown in table 2, OMB and agencies have made progress on  a number of areas related to the reform; however, without establishing  government-wide measurable goals and outcomes, OMB and DHS will  not be able to determine whether progress is being made across the  federal government to solve the cybersecurity workforce shortage.

OMB and DHS have partially addressed key practices related to involving  employees and key stakeholders. We obtained information on targeted  outreach to employees and stakeholders for certain projects and activities  outlined in the reform, but as of November 2019, OMB and DHS did not  have information on how they were addressing these key practices for the  reform as a whole.

For example, DHS’s Cybersecurity and Infrastructure Security Agency  (CISA) officials told us that they participate in interagency coordination  activities related to the NICE framework with OMB, the Department of  Commerce National Institute of Standards and Technology (NIST), the  Federal Chief Information Officers Council, and outside stakeholders.  CISA officials said they worked with government and industry  stakeholders to develop the NICE framework, and are working with  educators and certification vendors to help build a pipeline of  cybersecurity talent. Additionally, in March 2019, we reported that OPM  and NIST coordinated with academia and the private sector to develop a  cybersecurity coding structure that aligns with the work roles identified in  the NICE framework.

While OMB and DHS conducted outreach for certain projects and  activities included in the reform proposal, it is unclear what, if any,  outreach occurred for other projects. However, without a government- wide or project-by-project plan for communicating with and involving  employees and stakeholders across the government, OMB and lead  agencies will not know if certain agencies or employee groups are being  adequately involved and informed. We have previously reported that  creating an effective, ongoing communication strategy is essential to  implementing a government-wide reform. The most effective strategies  involve communicating early and often, ensuring consistency of message,  encouraging two-way communication, and providing information to meet  the specific needs of affected employees. This reform will be more likely  to achieve its intended objective if OMB and DHS establish effective lines  of communication with affected federal employees and the broader  cybersecurity community.

OMB and DHS have partially addressed key practices related to  addressing high-risk areas and longstanding management challenges.  We have designated information security as a government-wide high-risk  area since 1997. We expanded this high-risk area in 2003 to include protection of critical cyber infrastructure and, in 2015, to include  protecting the privacy of personally identifiable information. OMB and  DHS generally considered areas that we previously identified as high-risk.  OMB staff and DHS officials told us that they considered our high-risk  reports when developing reform proposals, and have provided some  documentation of these considerations. For example, OMB’s former  Deputy Director for Management stated that, when developing the  Solving the Cybersecurity Workforce Shortage reform, OMB used our  2017 High-Risk Series and noted that of more than 2,500 past  recommendations, about 1,000 still needed to be implemented. OMB  also identified several of our reports that touch on cybersecurity workforce  issues.

Although OMB and DHS have considered our prior work, as of November  2019, they had not demonstrated how the projects and activities outlined  in the reform proposal would address our related high-risk issues and  open recommendations. Without more detailed information describing  how our high-risk issues are being addressed across the reform projects  and activities, it is unclear which issues and recommendations are being  targeted, and which are outside of the scope of this reform.

OMB and DHS have partially addressed key practices related to  leadership focus and attention. In May 2019, the President issued  Executive Order 13870 requiring federal agencies to take a variety of  actions related to cybersecurity, including efforts to enhance the mobility  of cybersecurity practitioners, support the development of cybersecurity  skills, and create organizational and technological tools to maximize  cybersecurity talents and capabilities. Many of the actions outlined in  this executive order align with the stated objectives and components  outlined in the reform proposal.

However, neither OMB nor DHS have created a dedicated team with  necessary resources to manage and implement this reform on a  government-wide scale. Moreover, DHS staff we spoke with told us that OMB was the government-wide lead for this reform, and their agency was  responsible for a subset of the projects and activities outlined in the  reform proposal. OMB staff did not provide us with any plans or other  documents regarding the individuals or team responsible for  implementation across the government. OMB staff explained that DHS’s  CISA and the Federal Chief Information Security Officer Council have  some responsibility for federal cybersecurity workforce issues; however,  they did not clarify which organization, team, or individuals were  responsible for coordinating and implementing the reform government- wide.

Our prior work has shown that establishing a strong and stable team that  will be responsible for the transformation’s day-to-day management is  important to ensuring that it receives the resources and attention needed  to be successful. A dedicated leadership team responsible for  overseeing and implementing the reform can also help ensure that  various change initiatives are sequenced and implemented in a coherent  and integrated way.

OMB and DHS have partially addressed key practices related to  managing and monitoring. DHS has developed some agency-specific  implementation plans and mechanisms to monitor progress. For example,  DHS provides progress updates to Congress related to its continued  efforts to code cybersecurity positions and to review the readiness of the  cybersecurity workforce to meet DHS mission requirements, among other  agency-specific assessments. However, OMB and DHS have not yet  developed a government-wide implementation plan with goals, timelines,  key milestones, and deliverables for the reform proposal as a whole. As  previously discussed, OMB staff told us that they did not yet have a  government-wide reform plan because they are still developing this  reform. Without a government-wide implementation plan to track and  communicate implementation progress, OMB and DHS will be unable to  determine whether the reform is achieving its intended objectives, or  whether unanticipated challenges or negative workforce trends are  impeding efforts to close the cybersecurity workforce gaps across the  government.

OMB and DHS have not addressed key practices related to employee  engagement. In February 2019, DHS officials told us that the agency had  not yet reached the stage of implementation for its projects and activities  where they were considering employee engagement in this reform.  According to DHS officials, they have started collecting data on  employees, but have not interacted with individual employees on specific  reform initiatives. As of November 2019, OMB had not provided  information on its efforts to engage affected employees across the  government on this reform.

We have reported that employee engagement affects attrition,  absenteeism, and productivity. Moreover, we have found that failure to  adequately address a wide variety of people and cultural issues, including  employee engagement, can also lead to unsuccessful change. We  identified six key drivers of engagement based on our analysis of selected  questions in the Federal Employee Viewpoint Survey, such as  communication from management. Given that the objective of this  reform is to address a critical workforce skills gap, it is important that  OMB and DHS remain attentive to the engagement levels of  cybersecurity employees across the government to ensure that  productivity and morale are not adversely affected. As previously  discussed, OMB and DHS lack a government-wide or project-by-project  plan for communicating with and involving employees across the  government. Such a communications strategy could be used to inform  and, as appropriate, involve employees on implementation of the reform.

OMB and DHS have partially addressed key practices related to strategic  workforce planning. As set forth in the Cybersecurity Workforce  Assessment Act, DHS developed and published its Cybersecurity  Workforce Strategy for 2019 through 2023. DHS’s strategy contains a 5- year implementation plan and a set of goals and objectives. Goals and  objectives include an analysis of DHS’s cybersecurity workforce needs, a  multi-phase recruitment strategy, professional and technical development  opportunities, and plans to develop a talent management system, among  others.

OMB and DHS have yet to develop a government-wide cybersecurity  strategic workforce plan that addresses the needs of all federal agencies.  However, because this reform is focused on addressing a government- wide workforce shortage, it is particularly important that OMB and DHS  complete their efforts to develop a strategic workforce plan for  cybersecurity professionals that takes into account existing workforce  capabilities, workforce trends, and shortages across the government.  Without this information, DHS and OMB will not be able to determine if  they are making progress or when they have addressed the government’s  cybersecurity workforce shortage.

Solving the Cybersecurity Workforce Shortage: OMB and DHS Identified Legal Authorities for Certain Reform Activities, and Stated That Additional Authority Would Be Sought If Needed

DHS identified some existing legal authority for implementing aspects of  the reform proposal, but neither DHS nor OMB provided us with a legal  analysis for full implementation of the reform. OMB’s General Counsel  stated, in a November 2019 letter to us, that OMB continues to  collaborate with DHS and other federal agencies on a wide range of  measures to address the cybersecurity workforce shortage. OMB stated  that efforts had been within the confines of various current laws and  appropriations, and that new legislation had not been required for any of  these efforts. OMB did not provide additional details on the existing legal  authorities on which it is relying. OMB also stated that the administration  would seek legislation for any efforts beyond the scope of what is  permitted under current law.

DHS identified activities it is currently implementing related to the reform  proposal that were previously authorized or required by law. For example,  the CISA Chief Counsel identified DHS’s effort in establishing the  forthcoming Cyber Talent Management System (CTMS) as a reform  activity authorized by statute. The Chief Counsel noted DHS was  authorized to establish this new personnel system for recruitment and  retention of cybersecurity workers by the Border Patrol Agent Pay Reform  Act of 2014. Under the act, DHS may establish cybersecurity positions;  appoint personnel; fix rates of pay; and provide additional compensation,  incentives, and allowances, subject to certain restrictions. The authority to  implement this new system, however, is limited to DHS, and DHS officials  acknowledged that CTMS cannot be implemented government-wide  without statutory authorization.

Additionally, DHS officials identified work being conducted at DHS to  identify and categorize cybersecurity workforce positions, another activity  related to the reform proposal and required by statute. Specifically, DHS  was required by the Homeland Security Cyber Workforce Assessment Act  of 2014, to:  identify all cybersecurity workforce positions, determine the cybersecurity work category and specialty area of such assign data element codes developed by OPM in alignment with the  NICE framework for each position.

Furthermore, the Federal Cybersecurity Workforce Assessment Act of  2015 required OPM, in consultation with DHS, to identify critical needs  for the IT, cybersecurity, or cyber-related workforce across federal  agencies and to report to Congress on the identification of IT,  cybersecurity, or cyber-related work roles of critical need. DHS officials  also explained that, consistent with the 2015 act, it is currently working  with other agencies and with industry to catalogue the federal  cybersecurity workforce.

The CISA Chief Counsel also identified DHS authorities that, under  subchapter II of chapter 35 of Title 44 of the United States Code, CISA  could leverage when implementing reform activities having government- wide or interagency impacts. Under these authorities, CISA (in  consultation with OMB) administers the implementation of agency  information security policies and practices, assists OMB with carrying out  its responsibilities for overseeing agency information security policies and  practices, and coordinates government-wide efforts on information  security policies and practices. The Chief Counsel added that CISA  “continues to consider, new, more specific…statutory authority aligned to  specific reform responsibilities.”

Establishing the GEAR Center: OMB Generally or Partially Addressed Selected Key Practices

The administration is working toward establishing the GEAR Center,  which it described in the reform plan as a vehicle for applied research that  would help improve government operations and decision-making. OMB  staff stated that the GEAR Center would be administered as a public- private partnership, and that the administration spent about $3 million for  it in fiscal years 2018 through 2020 from available appropriations (see  table 3). On Performance.gov, OMB provided options for the GEAR  Center’s structure; it could be housed in a physical location, composed of  a network of researchers working in multiple locations, or follow a  different model.

The administration does not envision that the GEAR Center will require  government funds to conduct all of its initiatives in the long term. Instead,  OMB staff said that the private sector would help fund its work after an  initial stand-up period. According to the reform plan, GEAR Center research could help inform, for example, how the government responds to  technological advances, how to provide better customer service  experiences, and how to better leverage government data.

In March 2019, OMB staff told us that they planned to establish the GEAR  Center in fiscal year 2019, but as of February 2020, the center had not  been formally established. To date, OMB staff have conducted  preparation activities for establishing the GEAR Center, such as gathering  stakeholder input through a Request for Information and a GSA- administered GEAR Center challenge competition to learn more about the  types of projects a GEAR Center could facilitate.

Through the challenge, GSA requested ideas on possible research  projects, as well as related materials such as a project plan and ways to  measure success. The challenge competition judges, which included  OMB staff, selected three winning project plans with a prize of $300,000  each (for a total of $900,000). GSA specified that the cash prizes were for  high potential project plans, and not grants to execute work on behalf of  the government. In September 2019, GSA announced and awarded the  winners of the GEAR Center challenge. The grand prize winners  submitted 1-year project plans to:  (1)  help solve the federal cybersecurity workforce shortage by  involving neurodiverse individuals, such as those with autism;  (2)  integrate currently disparate datasets to measure the impact of a  federally funded program; and  (3)  train federal employees on how to better use their data for  decision-making and accountability.

In addition to the challenge competition, OMB contracted with the Center  for Enterprise Modernization, a Federally Funded Research and  Development Center operated by the MITRE Corporation, to examine  options for operating the GEAR Center, in two projects. The first project— conducted from July 2019 through September 2019—was to explore a  number of options for operating the GEAR Center. Following the first  project, OMB staff laid out three tasks to accomplish during calendar year  2020 that they said would help them establish the GEAR Center:  (1)  establish a central coordinating function for the GEAR Center,  (2)  build the GEAR Center’s network of research partners, and  (3)  develop a draft government-wide learning agenda with input from  federal agencies to inform the GEAR Center’s research and  piloting activities.

For the second project—which began in September 2019 and is  scheduled to be completed in July 2020—the contractor is to provide  additional detail on options for operating the GEAR Center, including on  creating a network of research partners to support the GEAR Center.  Table 3 provides details on these expenditures.

As shown in figure 5, OMB has generally addressed most of our relevant  key reform practices, and partially addressed the others.

Determining the Appropriate Role of the Federal Government

OMB staff generally addressed key practices related to determining the  appropriate role of the federal government for the GEAR Center. While  OMB staff have not developed a detailed governance structure for the  GEAR Center, they have determined, with input from the private sector,  that the GEAR Center will be a public-private partnership. Specifically,  OMB staff considered the private sector’s ability or likelihood to invest its  own resources in the initiatives the GEAR Center undertakes and  otherwise contribute to the GEAR Center’s work. OMB did this by formally  seeking the private sector’s input on these topics first through a Request  for Information, and subsequently through a challenge competition.

OMB has partially addressed key practices related to establishing goals  and outcomes. Specifically, OMB has initiated a process for developing  outcome-oriented goals and performance measures for the GEAR  Center, but has not finalized them. The GEAR Center challenge  competition asked respondents to provide short- and long-term outcome- focused measures of success for the proposed projects in their  submissions. However, as of November 2019, OMB staff told us they  have not finalized these goals and measures for the GEAR Center. They  stated that this is because they have not yet analyzed the results of the  progress made by the challenge competition’s grand prize winners, and  because they believe the purpose, or broad goal, of the GEAR Center is  sufficient for their purposes at this stage of implementation. OMB staff  told us that while they acknowledge that grand prize winners are not  required to complete the projects they proposed, they anticipate the  winners will carry them out to some extent, and they plan to monitor their  work to inform GEAR Center planning activities. As OMB moves forward  with establishing the GEAR Center, OMB staff should complete their  efforts to develop goals and measures, because they will be necessary to  track and communicate the GEAR Center’s progress over time.

In addition, OMB staff have not yet fully assessed the costs and benefits  of the various options OMB is considering for operating the GEAR Center.  As previously discussed, OMB has stated that the GEAR Center could be  housed in a physical location, composed of a network of researchers  working in multiple locations, or follow a different model. Also, as  previously stated, MITRE is currently exploring details of options for  operating the center, and plans to provide them to OMB in July 2020.  However, OMB has not yet conducted an analysis of the costs and  benefits of the options for operating the center. In July 2018, OMB’s then  Deputy Director for Management said that defining costs and benefits is  dependent on refining and finalizing implementation plans. As of  November 2019, OMB had not developed an implementation plan for  establishing the GEAR Center. As OMB moves forward with establishing  the center, assessing the costs and benefits of the various options for  operating it will enable OMB to communicate the value of each option to  Congress and other stakeholders. This assessment can help build a  business case for OMB’s ultimate choice of how to operate the GEAR  Center that presents facts and supporting details among competing  alternatives.

OMB has generally addressed key practices related to involving  employees and relevant stakeholders. Specifically, OMB has coordinated  with internal government stakeholders, sought input from the private  sector, and publicly communicated GEAR Center progress. For example,  OMB staff said that they have worked to develop the GEAR Center with  the President’s Management Council, the National Science Foundation,  and DOD’s National Security Technology Accelerator group. Also, OMB  held a Virtual Stakeholder Forum to provide information about the GEAR  Center and to gather stakeholder input. During the forum, OMB sought  attendees’ input through live polls, and announced that attendees could  ask questions and provide additional input by sending messages to an  OMB email account. OMB also sought stakeholder input through the  GEAR Center Request for Information and challenge competition. Finally,  as shown in figure 6, OMB has publicly reported on the GEAR Center’s  progress on Performance.gov.

OMB has generally addressed key practices related to leadership focus  and attention. To accomplish this, OMB has designated leaders, including  OMB’s former Deputy Director for Management, a member of OMB’s  Performance Team, and other staff to be responsible for implementing  the reform.

OMB has partially addressed key practices related to managing and  monitoring the reform to establish the GEAR Center. Specifically, OMB  has gathered input from stakeholders on what research it could pursue,  and from both stakeholders and a contractor on how the GEAR Center  could be operated. OMB has done some analysis of that input, but has  neither determined how the GEAR Center will operate nor developed an  implementation plan. For example, OMB’s analysis of Request for  Information responses shows that OMB is considering several options for  how to execute the GEAR Center’s public-private partnership—a network  of researchers, a physical location, etc.—but has not decided on one. In  addition, as discussed previously, OMB contracted with MITRE to further  assist with determining how the GEAR Center will operate. As OMB  moves forward with establishing the GEAR Center, it will be able to track  the GEAR Center’s progress, and communicate these results to  Congress and key stakeholders, by developing and communicating an  implementation plan with key milestones and deliverables.

Establishing the GEAR Center: OMB Stated That It Will Seek Additional Authority to Conduct Implementation Activities, If Needed

In response to our request to identify the legal authority OMB will need to  implement this reform, OMB’s General Counsel stated in a November  2019 letter to us that it and its agency partners have relied upon existing  legal authorities and available appropriations to develop the Request for  Information, obtain external submissions for ideas to develop the GEAR  Center, and issue the prize challenge. OMB stated that in conducting any  future implementation activities, it would seek new legislative authority, if  necessary.

While planning and implementation progress has been made since the  administration’s government-wide reform plan was released in June 2018,  important details surrounding the implementation of certain reform  proposals have not been developed or communicated. OMB has a central  role in overseeing and prioritizing these reforms for implementation, with  support from lead agencies. In our previous work on government  reorganization and reforms, we have found that there are key practices  that, if followed, can help manage the risk of reduced productivity and  effectiveness that often occurs as a result of major change initiatives.  Important practices such as engaging and communicating with Congress,  employees, and key stakeholders; dedicating a senior leadership team;  and developing implementation plans, can help to ensure the successful  implementation of reorganizations and reforms.

OMB and DHS partially addressed most of the leading practices through  their efforts to implement several projects related to the cybersecurity  workforce reform, including efforts to reskill employees to fill vacant  cybersecurity positions, establish a cybersecurity reservist program to  provide needed surge capacity, and streamline relevant hiring processes.  However, OMB, in coordination with DHS, has not yet followed relevant  key practices to implement its reforms government-wide. Specifically,  OMB and DHS have not yet developed a communications strategy to  involve Congress, employees, and other stakeholders; established a  dedicated government-wide leadership team; or developed a  government-wide implementation plan with outcome-oriented goals,  timelines, key milestones, deliverables, and processes to monitor  implementation progress. In addition, OMB and DHS have not  demonstrated how the projects and activities outlined in the reform  proposal would address our related high-risk issues and major  management challenges, or developed workforce plans that assess the  effects of the proposal on the current and future workforce. If OMB, in  coordination with DHS, applied key reform practices government-wide,  they would be better positioned to manage the reform, and track progress  across all agencies facing cybersecurity workforce shortages.

OMB has taken steps toward determining how the GEAR Center will  operate, such as, by determining the appropriate role of the federal  government; providing leadership focus and attention; and collecting input  from the public, academia, and industry on how the center could operate  and on ideas for possible research projects. However, OMB has neither  assessed the costs and benefits of the options it is considering for  operating the center, nor developed an implementation plan with  outcome-oriented goals and performance measures for it. As OMB moves  forward with establishing the GEAR Center, completing these two  activities can help OMB (1) make a case for why OMB’s ultimate  decisions on how to operate the center are the most optimal, and (2)  provide greater transparency to the public and private partners involved in  its development, help build momentum, and demonstrate the center’s  value.

We are making a total of seven recommendations to OMB.

The Director of OMB, working with DHS, should develop a government- wide communications strategy to inform and, as appropriate, involve  Congress, employees, and other stakeholders in implementation of the  reform proposal to solve the cybersecurity workforce shortage.  (Recommendation 1)

The Director of OMB, working with DHS, should establish a dedicated  government-wide leadership team with responsibility for implementing the  reform proposal to solve the cybersecurity workforce shortage.  (Recommendation 2)

The Director of OMB, working with DHS, should develop a government- wide implementation plan with goals, timelines, key milestones, and  deliverables to track and communicate implementation progress of the  reform proposal to solve the cybersecurity workforce shortage.  (Recommendation 3)

The Director of OMB, working with DHS, should provide additional  information to describe how the projects and activities associated with the  reform proposal to solve the cybersecurity workforce shortage will  address our high-risk issues related to ensuring the cybersecurity of the  nation. (Recommendation 4)

The Director of OMB, working with DHS, should develop a government- wide workforce plan that assesses the effects of the reform proposal to  solve the cybersecurity workforce shortage on the current and future  federal workforce. (Recommendation 5)

The Director of OMB should assess the costs and benefits of options for  operating the GEAR Center. (Recommendation 6)

The Director of OMB should develop an implementation plan that includes  outcome-oriented goals, timelines, key milestones, and deliverables to  track and communicate implementation progress of the reform proposal  to establish the GEAR Center. (Recommendation 7)

We provided a draft of this report for review and comment to the  Directors of OMB and OPM, the Secretary of DOD, the Acting Secretary  of DHS, and the Administrator of GSA.

OMB did not comment on the report. DHS and DOD provided technical  clarifications, which we incorporated as appropriate. OPM and GSA  responded that they did not have comments on the report.

We are sending copies of this report to the Director of OMB and the  heads of the agencies we reviewed as well as appropriate congressional  committees and other interested parties. In addition, the report is  available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-6806 or Mcneilt@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made key contributions to this report  are listed in appendix IV.

Appendix I: Key Practices and Questions to Assess Agency Reforms

In a 2018 report, we developed key questions based on our prior work on  key practices that can help assess agency reform efforts. The 58  questions are organized into four broad categories and 12 subcategories,  as shown in table 4. For the purpose of this review, we selected those  subcategories and key questions that were most relevant to the selected  reforms based on the information contained in the reform proposals,  agency documentation, and interviews with the Office of Management  and Budget and lead agencies for each of the reforms.

Appendix II: Reform Plan Effort to Reorganize the Office of Personnel Management

Reorganizing OPM: Most Key Practices Partially Addressed; National Defense Authorization Act for Fiscal Year 2020 Calls for Study of OPM

The administration’s proposal to reorganize the Office of Personnel  Management (OPM) evolved from June 2018 through November 2019,  and was effectively halted by Congress in December 2019. In the June  2018 government-wide reform plan, the administration proposed:  (1) moving OPM’s policy functions to a new office in the Executive Office  of the President, which would also provide a government-wide view of  human capital policy issues,  (2) merging a number of OPM’s responsibilities with the General Service  Administration’s (GSA) or other government entities’ to be determined at  a later date, and  (3) renaming GSA as the Government Services Agency.

The goals of this proposal were to help elevate the importance of these  functions, improve efficiency of operations, and save money, according to  the reform plan. Specifically, the administration suggested integrating the  following duties into the Government Services Agency or other  government entities: administration of healthcare and insurance programs,

Human Resources Solutions (HRS), which provides products and  services to other federal agencies on a reimbursable basis, and  information technology services.

In addition, the reform plan contained another proposal to move all of  OPM’s national security background investigation functions to the  Department of Defense (DOD).

The President’s Fiscal Year 2020 Budget, published in March 2019,  expanded and modified the original OPM reorganization proposal. It  proposed that all of OPM’s functions beyond those moving to the  Executive Office of the President and DOD be transferred to GSA, rather  than merging a portion of them into a newly formed Government Services Agency. It also called for creating a new GSA service area to house  certain functions, and for moving OPM’s Office of the Inspector General  to GSA.

In May 2019, the administration submitted a legislative proposal to  Congress requesting new authority to implement aspects of the OPM  reorganization reform proposal. As of December 2019, this proposal had  not been introduced in Congress.

In May 2019, we testified on issues to consider in the proposed  reorganization of OPM. We found that the Office of Management and  Budget (OMB) and the two lead agencies (OPM and GSA) had generally  not addressed key practices for reforms, such as establishing outcome- oriented goals, assessing costs and benefits, or developing an  implementation plan, and had not fully involved or communicated their  efforts with Congress, employees, and other key stakeholders. We also  found that OMB, OPM, and GSA had not shown how they would address  management challenges that may affect their ability to successfully  reorganize the government’s central human capital functions. Between  May and September 2019, OPM provided us with additional information,  which contributed to our assessment of the extent to which OMB, OPM,  and GSA addressed key practices for this reform (see figure 7).

In October and November 2019, OMB staff and OPM and GSA officials  provided us with updates on the status of the OPM reorganization reform  proposal. OMB staff and OPM and GSA officials told us that the transfer  of major functions from OPM to GSA, such as retirement services and  HRS, was on hold until Congress, through legislation, provided the  necessary authority to move these functions. They also told us that they  were working together on moving the following functions from OPM to  GSA through their existing authorities: (1) administrative responsibilities  for the Chief Human Capital Officers (CHCO) Council; (2) the Program  Management Office for the Security, Suitability, and Credentialing  Performance Accountability Council (PAC); and (3) management of two  OPM office buildings—the Theodore Roosevelt Building, which houses  OPM’s headquarters in Washington, D.C., and the Federal Executive  Institute located in Charlottesville, Virginia.

OMB staff and OPM and GSA officials stated that the primary purpose of  these moves was to achieve greater efficiency of operations, and that  these transfers were not components of the OPM reorganization reform  proposal. In November 2019, OPM’s Inspector General expressed  concern over ongoing efforts to merge these functions with GSA, noting  that the specific details of the full merger continued to evolve, and every  iteration of the proposed reorganization would fundamentally alter how  agency functions and duties are performed.

In the National Defense Authorization Act (NDAA) for Fiscal Year 2020,  signed into law in December 2019, Congress effectively halted actions to  reorganize OPM pending the completion of reports by the National  Academy of Public Administration (NAPA) and OPM. The law directed  OPM to enter into a contract with NAPA to conduct a study to identify  challenges associated with OPM’s execution of its functions and make  recommendations for addressing them, including a cost-benefit analysis  of proposed changes, and the identification of statutory or regulatory  changes needed to execute recommended actions, among other things.  Approximately 6 months after the NAPA report, OPM must submit a  report providing its views on the NAPA report and its recommendations  for changes to its functions. OPM is also to include a business case  analysis associated with such changes and a proposal for legislative and  regulatory action required to effect the changes. Many of these  requirements reflect the issues we raised in our May 2019 testimony on  the extent to which the proposal to reorganize OPM was consistent with  our key reform practices.

According to the President’s fiscal year 2021 budget request, the  administration continues to pursue implementation of OPM’s  reorganization. Specifically, it proposes to transfer the functions of OPM  to GSA, contingent upon enactment of authorizing legislation.

OMB, OPM, and GSA partially addressed the key practices related to  establishing goals and outcomes. First, OMB, OPM, and GSA considered  how the upfront costs of the reform would be funded by, for example,  requesting funds through the President’s Fiscal Year 2020 Budget.  However, OMB, OPM, and GSA did not fully address other aspects of the  key practices.

Specifically, since our May 2019 testimony, OPM provided us  information on additional draft goals and measures for some portions of  the reform. For example, according to a document we received from OPM  in August 2019, a team leading the reform effort was developing “critical  to quality” metrics in areas such as cost reduction, employee  engagement, and flexible operations. However, these metrics did not  have targets and had not been finalized.

In November 2019, OMB staff told us that metrics were not yet final  because they were still working with Congress to develop a legislative  proposal authorizing the reform, and implementation of the merger was  not yet underway. The NDAA for Fiscal Year 2020 requires NAPA and  OPM to make recommendations for changes to OPM’s structure,  functions, responsibilities and authorities, which may differ from those the  administration proposed.

We have also previously reported that major change initiatives should be  based on either a clearly presented business case or analysis of costs  and benefits grounded in accurate and reliable data, both of which can  show stakeholders why a particular initiative is being considered and the  range of alternatives considered. While OPM officials had some  information on the costs and benefits they planned to achieve by merging  functions with other agencies, they did not have an analysis or underlying  data supporting their conclusions. Specifically, OPM provided us with its  rationale for the reform in several documents, including: a summary of the agency’s financial and management challenges, a qualitative business case, a list of state and foreign governments’ administrative models where  human resources and administrative functions are merged, and a presentation providing OPM’s estimate of the annual savings that  could be realized by “fully integrating OPM’s operations into GSA.”

However, the information that OPM provided did not include measurable  performance or outcome metrics, or quantify benefits relative to costs, to  provide a complete assessment of the costs and benefits and any  alternative solutions to the reform proposal. OPM’s Office of Inspector  General also found, in its fiscal year 2020 top management challenges  report, that OPM had not developed a thorough analysis of costs and  benefits.

Shortly after OMB published the reform plan, OMB’s then Deputy Director  for Management, who also served as OPM’s Acting Director, said that  defining costs and benefits was dependent on refining and finalizing  implementation plans. Since then, in the NDAA for Fiscal Year 2020,  Congress required that NAPA’s study include an analysis of the benefits,  costs, and feasibility of each recommendation, and a timetable for  implementing these options. In addition, the law requires that OPM’s  report include a business case analysis that describes the operational  efficiencies and cost savings (both short- and long-term) associated with  its recommendations.

OMB, OPM, and GSA partially addressed the key practices related to  involving employees and key stakeholders. Specifically, since our May  2019 testimony, OPM officials provided us with documents to  demonstrate that the agency took additional actions in this area, as  discussed in more detail below. However, we found that OPM’s early  outreach efforts to employees and stakeholders were insufficient, the  agency did not have a plan for incorporating employee and stakeholder  feedback, and it did not share relevant implementation details that may  have affected employees and stakeholders.

For example, OPM provided us with a communications tracker that listed  meetings and correspondence with Congress, staff, and employee groups  from OPM’s Acting Director, Deputy Director, and Deputy Chief of Staff.  While this document listed a number of meetings and calls, it showed that  most of OPM’s efforts to involve Congress, employees, and employee  groups began in April 2019, more than 9 months after OMB published the  reform plan, and more than 8 months after OPM’s Director and GSA’s  Administrator testified before Congress about their plans for carrying out  the reform proposal.

In addition, both members of Congress and employee groups expressed  dissatisfaction with initial outreach from OMB, OPM, and GSA, including  lack of transparency. For example, during a House Committee on  Oversight and Reform Subcommittee on Government Operations hearing  on May 21, 2019, members of Congress and employee groups testified  that they felt insufficiently involved in the reform. Both groups stated that  OPM officials communicated with them on few occasions, and members  of Congress said that they had not received key documents they  requested from OPM, including an implementation plan.

In August 2019, OPM provided us with a strategic communications plan  that included high level messages and strategies for reaching out to  Congress, employees, and the public. This and other OPM documents  demonstrated that OPM communicated with employees and key  stakeholders, and provided opportunities for its employees to ask  questions and provide comments about the reform, activities consistent  with our key practices.

However, the documents did not indicate how senior OPM officials  planned to use the feedback they received from their employees.  Similarly, neither OMB nor GSA described how they planned to use  employee feedback to inform their reform efforts. The NAPA study  required by the NDAA for Fiscal Year 2020 must include methods for  involving, engaging with, and receiving input from other federal agencies,  departments, and entities potentially affected by any change in OPM that  NAPA recommends. The study must also incorporate the views of  stakeholders.

OMB, OPM, and GSA partially addressed the key practices related to  addressing high-risk areas and longstanding management challenges,  consistent with our assessment in May 2019. Since then, OPM provided  additional documents related to (1) our relevant high-risk area of strategic  human capital management, as well as (2) longstanding challenges at  OPM we and OPM’s Inspector General have reported. However, OMB,  OPM, and GSA did not explain how the OPM reorganization reform  proposal would address our high-risk issue or mitigate major  management challenges, and did not have plans to monitor the potential  effects of the reform on these issues. As a result, OMB, OPM, and GSA  did not fully consider the potential risks of transferring OPM systems with  longstanding weaknesses to GSA, and of GSA taking on duties in areas  such as information technology, where it faces major management  challenges. They also lacked a means of monitoring the reform’s potential  effects on our strategic human capital management high-risk area and on  major management challenges. Moreover, in November 2019, OPM’s  Office of the Inspector General continued to identify the proposed merger  of OPM with GSA as a top management challenge because the proposal  did not include an implementation plan, and created a burden for the  agency to fully study, plan, and execute reorganization activities.

In November 2019, OMB staff told us that, because the proposed merger  was a long-term effort and plans were still under development, they had  not yet determined how our high-risk and other management challenges  would be addressed. The NDAA for Fiscal Year 2020 requires the NAPA  study to include analyses of OPM’s challenges and a recommended  course of action for resolving them.

OMB, OPM, and GSA generally addressed the key practices related to  leadership focus and attention. Specifically, since our May 2019  testimony, OPM officials provided us with documents demonstrating that  OMB, OPM, and GSA made progress in this area. For example, OPM  documents showed that OPM, OMB, and GSA leaders approved a  governance structure for leading reform efforts that included: an executive steering committee that provided guidance and made  decisions. Its members included the OMB Deputy Director for  Management (serves as executive sponsor and chair), the OPM  Director (serves as a vice-chair), and the GSA Administrator (serves  as a vice-chair). The group used the Lean Six Sigma management  approach to make decisions related to planning and implementing the  reform during Tollgate meetings. an interagency task force that led activities to implement the reform,  and that raised issues to the Executive Steering Committee as  needed. Its members included leaders from OMB, OPM, and GSA.  interagency teams, which provided subject matter expertise and  performed tasks and activities to implement the reform. Their  members were OPM and GSA officials.

From August 2018 through April 2019, our analysis of OPM documents  showed that these groups met and communicated frequently—from every  few days to every few weeks, depending on the group. From May 2019— when the administration transmitted their legislative proposal to Congress  to reorganize OPM—to November 2019, these groups met less  frequently, according to OMB staff and GSA officials.

OMB, OPM, and GSA partially addressed the key practices related to  managing and monitoring. Since our May 2019 testimony, OPM provided  us with documents that demonstrated improvements in this area, but as  of November 2019, had yet to finalize an implementation plan.  Specifically, the documents showed that OMB, OPM, and GSA held  leadership meetings and systematically tracked various aspects of the  reform. For example, OPM officials tracked the status of certain activities  associated with the reform, such as progress on developing a plan for  communicating with employees and stakeholders, through leadership  meetings. Also, OPM had a document identifying risks associated with  the reform, such as ensuring continuity of services, as well as mitigation  strategies, such as including provisions in OPM-GSA interagency  agreements. The document also specified individual agency officials  responsible for each risk.

OMB, OPM, and GSA did not develop an implementation plan for the  OPM reorganization reform that included key milestones and  deliverables. In November 2019, OMB staff told us that their plans were  still being developed because they were waiting for Congress to pass the  administration’s legislative proposal authorizing the reform. The NDAA for  Fiscal Year 2020 requires NAPA and OPM to make recommendations for  changes to OPM’s structure, functions, responsibilities, and authorities,  which may differ from those the administration proposed.

OMB, OPM, and GSA partially addressed the key practices related to  employee engagement. Specifically, while OMB and agencies undertook  activities to measure employee engagement, such as surveying and  communicating with employees, they did not develop a comprehensive  strategy for sustaining and strengthening employee engagement during  and after the reform. For example, GSA officials told us that they  established a GSA-OPM change management and communications  workgroup, which developed a change management and communications  plan that included employee engagement activities. Also, in April 2019,  OPM conducted an internal survey of agency staff to measure employee  engagement, among other factors.

OPM officials also identified employee morale issues as a risk in a  document identifying risks associated with the reform and risk mitigation  strategies. To address employee dissatisfaction and low morale, OPM  officials, including OPM’s then-Acting Director, shared the survey results  with employees, held listening sessions to determine employees’  preferences for communications about the OPM reorganization reform  proposal, and developed a communications strategy.

However, OPM officials did not determine how they planned to use these  communications to sustain and strengthen employee engagement. In  November 2019, OMB staff told us that because they were still in the  planning stages of the reorganization, the proposed reform had not yet  involved major changes for employees, so they put employee  engagement efforts on hold. The NAPA study required by the NDAA for  Fiscal Year 2020 is to include methods for involving, engaging with, and  receiving input from other federal agencies, departments, and entities  potentially affected by any change in OPM that NAPA recommends. The  study is to also incorporate the views of stakeholders.

OMB, OPM, and GSA did not address the key practices related to  strategic workforce planning. OPM and GSA officials told us that they  were conducting workforce planning activities associated with the OPM  reorganization reform. Also, the President’s Fiscal Year 2020 Budget  provided some information about staff levels at OPM and GSA. However,  OMB, OPM, and GSA did not produce strategic workforce plans for OPM  and GSA employees. OPM and GSA officials stated that they had not  provided us with these plans because they were under development. In  November 2019, GSA officials added that they were waiting for  congressional authorization to carry out the reform proposal, so they had  put their efforts to develop a workforce plan on hold. The NDAA for Fiscal  Year 2020 requires that NAPA and OPM make recommendations on  changes to OPM, which may differ from the administration’s proposed  reorganization of OPM.

Reorganizing OPM: NDAA for Fiscal Year 2020 Provides for the Identification of Legal Authorities

As part of our review, our Office of General Counsel sent letters to the  Offices of General Counsel at OPM, GSA, and OMB requesting they  provide us with a description of the legal authorities they were using to  support the proposed OPM reorganization. OMB, OPM, and GSA  provided responses to our letter, but did not identify which aspects of the  OPM reorganization could be carried out under existing law and which  would require legislative authority. GSA, OPM, and OMB officials stated  that they had not yet finalized their legal analysis, and that they were still  determining which legal authorities they could use to implement elements  of the reform. OMB General Counsel stated that to implement the  administration’s proposed reorganization, both legislative and  administrative actions would be necessary and dependent on each other  “in the long run.”

In May 2019, the administration submitted a legislative proposal  requesting authority to transfer OPM functions—such as Human  Resources Solutions, Information Technology, Retirement, and Health  and Insurance Services—to GSA. As of December 2019, the proposal  had not been introduced in Congress. OMB staff told us that the  legislative proposal was an effort to communicate transparently about the  extent to which new authorities would be required.

As discussed earlier, in December 2019, Congress passed the NDAA for  Fiscal Year 2020. In the NAPA study required under the NDAA, NAPA is  to provide a comprehensive assessment and analysis of the statutory or  regulatory changes needed to implement any recommended course of  action, and to submit this report to Congress and the Director of OPM.  The Director of OPM is then to submit a report to Congress that lays out  OPM’s views on the findings and recommendations of the NAPA study,  along with OPM’s recommendations for change. Any recommendation  submitted by OPM for change is to include a business case analysis that  sets forward the efficiencies and cost savings (both short- and long-term)  associated with the change, and a proposal for legislative or  administrative action required to effect the change.

The statutory provisions in the act generally provide that no aspect of the  agency that is assigned in law to OPM may be moved to GSA, OMB, or  the Executive Office of the President until 180 days after OPM’s report is  submitted to congressional committees, and subject to the enactment of  any required legislation.

Appendix III: Reform Plan Effort to Develop a Capability to Improve the Customer Experience

This reform proposal aims to modernize and streamline the way citizens  interact with the federal government, and to raise customer experience to  a level comparable with leading private sector organizations. With  support from the United States Digital Service (USDS) and GSA’s  Technology Transformation Service, OMB has stated that it will lead an  effort to establish a government-wide capability that will enable agencies  to identify their customers, map their interactions (or journeys) with  federal programs or services, and leverage digital tools and services to  improve their experiences and overall satisfaction. For example, as  reported in the reform plan, the U.S. Department of Agriculture created a  “digital front door,” accessible at Farmers.gov, that is organized around  the user experience rather than the government’s structure. The reform  plan further explains that the improved capability provided by USDS and  GSA would also provide for a government-wide resource to manage  organizational change, including improved project planning, facilitating  interagency collaboration, and sharing best practices on change  management.

OMB staff told us in early 2019 that they have delayed implementation of  this reform, and instead will focus on other customer experience activities,  such as those outlined in the related Cross-Agency Priority (CAP) goal.  Upon release of the President’s Fiscal Year 2020 budget in March 2019,  we confirmed that this reform was not included in the administration’s  reorganization priorities, and OMB confirmed that no funding was  requested for its implementation. OMB and agencies are also pursuing a  related but distinct CAP goal under the President’s Management  Agenda–Improving Customer Experience with Federal Services–with the  aim of providing a modern, streamlined, and responsive customer  experience across government, comparable to leading private-sector  organizations. According to OMB, the reform proposal is meant to stand  up a central capacity, or office, within GSA to manage customer  experience government-wide; whereas, the CAP goal is intended to  support capacity growth and accountability within agencies to develop  and manage their own customers’ experience and satisfaction.

Because OMB has not yet begun to implement this reform, and no  actions are planned for fiscal year 2020, we are not able to assess the  extent to which the reform is adhering to key reform practices. When the  administration moves forward with implementing this reform, it will be  better positioned for its successful implementation if the key reform  practices are followed. In response to our request to identify the legal  authority OMB will need to implement this reform, OMB’s General  Counsel responded in a November 2019 letter that the initiative will not  require new legislation. OMB stated the reform can be implemented  within current law and available appropriations.

Appendix IV: GAO Contacts and Staff Acknowledgments

Triana McNeil at (202) 512-6806 or Mcneilt@gao.gov.

In addition to the contact named above, Sarah E. Veale (Assistant  Director, Strategic Issues), Peter Beck (Analyst-in-Charge, Strategic  Issues), Colenn Berracasa, Karin Fangman, Steven Putansu, Janet  Temko-Blinder, Peter Verchinski, and Kellen Wartnow made key  contributions to this report. Timothy Carr, Jacqueline Chapin, Tom Costa,  Sara Cradic, Brenda Farrell, Patrick Hickey, Shirley Jones, Tammi  Kalugdan, Brian Mazanec, Kimberly Seay, Gregory Wilshusen, and Alicia  White also contributed to this report.

In 2018, the administration released its government-wide reform plan aimed at making the federal government more efficient and effective. The Office of Management and Budget oversees the proposals with support from other lead agencies.

We reviewed 5 reform proposals, including addressing the cybersecurity workforce shortage and establishing a Government Effectiveness Advanced Research Center. Planning and implementation have progressed since 2018, but some reform proposals are still missing key details.

We recommended that OMB and lead agencies follow reform practices related to planning, communicating, and leading major reforms.