National Preparedness: FEMA Has Taken Steps to Strengthen Grant Management, But Challenges Remain in Assessing Capabilities

The Department of Homeland Security (DHS), through FEMA, provides preparedness grants to state, local, tribal, and territorial governments to improve the nation's readiness in preventing, protecting against, responding to, recovering from and mitigating terrorist attacks, major disasters and other emergencies.

According to DHS, the department has awarded over $49 billion to a variety of DHS preparedness grant programs from fiscal years 2002 through 2017, to enhance the capabilities of grant recipients. For example, the State Homeland Security Program which awards grants to the nation's 56 states and territories, and the Urban Areas Security Initiative which awards grants to urban areas based on DHS's risk methodology, are the largest of the preparedness grant programs (see figure).

This statement addresses progress and challenges in FEMA's efforts to manage preparedness grants and GAO's prior recommendations to strengthen these programs. This statement is based on prior GAO reports issued from March 2011 through February 2016 and selected updates conducted in December 2017 through April 2018. To conduct the prior work and updates, GAO analyzed relevant FEMA data and documentation and interviewed relevant officials.

In February 2012, GAO identified coordination challenges among Federal Emergency Management Agency (FEMA) grant programs that share similar goals and fund similar projects, which contribute to the risk of duplication among the programs. GAO recommended that FEMA take steps, as it develops its new grant management system, to collect project information with sufficient detail to identify potential duplication among the grant programs. FEMA has since addressed these recommendations. Specifically, in 2014, FEMA modified a legacy grants data system to capture more robust grant project-level data, and in fiscal year 2017, procured a software tool and developed a set of standard operating procedures to assist its staff in identifying potentially duplicative projects. These actions should help FEMA strengthen the administration and oversight of its grant programs. Furthermore, FEMA is also developing a new grants management modernization system to consolidate and better manage its grants. GAO is currently reviewing the system for this Committee and will report out next year.

GAO reported in March 2011 on the need for FEMA to improve its oversight of preparedness grants by establishing a framework with measurable performance objectives for assessing urban area, state, territory, and tribal capabilities to identify gaps and prioritize investments. Specifically, GAO recommended that FEMA complete a national preparedness assessment of capability gaps at each level based on tiered, capability-specific performance objectives to enable prioritization of grant funding. FEMA has taken some steps to address GAO's prior recommendation. Specifically, in February 2018, FEMA reported developing capability-specific performance objectives that will enable a national preparedness assessment of capability gaps. However, FEMA plans to finalize these efforts in 2020 and it is too early to tell how this will impact grant allocations. Until these efforts are completed, GAO will not be able to determine the extent that they address past challenges and recommendations.

GAO has made prior recommendations designed to address the challenges discussed in this statement. FEMA has taken actions to address some but not all of these recommendations.

I appreciate the opportunity to participate in today’s hearing to provide an  update on the efforts of the Federal Emergency Management Agency  (FEMA)—a component of the Department of Homeland Security (DHS)— to manage preparedness grants and measure and assess national  preparedness capabilities. Our work over the last seven years has  focused on FEMA’s efforts to coordinate federal interagency  preparedness and manage and assess the impact of FEMA’s  preparedness grants on state and local preparedness. As described in  more detail below, our recommendations have identified additional steps  FEMA can take to improve the efficiency and effectiveness of these  efforts, including enhancing coordination and providing guidance on  preparedness. FEMA has taken actions to address some of these  recommendations, but more fully addressing all of them could lead to  additional savings, better services to the public, improved program  performance and accountability, and, ultimately, a better prepared nation.

Following the federal response to Hurricane Katrina in 2005, Congress  enacted the Post-Katrina Emergency Management Reform Act of 2006  (Post-Katrina Act). In response to the act, among other things, DHS  centralized its preparedness grants under FEMA’s Grant Programs  Directorate (GPD) to better integrate and coordinate grant management.  The act also requires that FEMA develop a national preparedness system  and assess preparedness capabilities to determine the nation’s  preparedness. GPD provides preparedness grants to state, local, tribal,  and territorial governments, as well as transportation authorities, nonprofit  organizations, and the private sector, to improve the nation’s readiness in  preventing, protecting against, responding to, recovering from and  mitigating terrorist attacks, major disasters and other emergencies. In  fiscal year 2017, DHS announced the availability of 10 preparedness  grant programs totaling more than $1.6 billion for fiscal year 2017.  According to DHS, from fiscal years 2002 through 2017 the department  has awarded over $49 billion to a variety of DHS preparedness grant  programs to enhance the capabilities of state, local, tribal, and territorial  grant recipients to carry out the above activities related to terrorist attacks  and other disasters.

My testimony today covers our prior work on FEMA preparedness efforts  from March 2011 through February 2016 and selected updates conducted  in December 2017 and February 2018. This statement specifically  addresses FEMA’s efforts to manage preparedness grants and our prior  recommendations.

To conduct our prior work, we reviewed relevant presidential directives,  laws, regulations, policies, strategic plans, and key program documents;  and interviewed federal, state, and local officials, among others. More  detailed information on our scope and methodology can be found in each  of the reports cited throughout this statement. To update our work, we  interviewed relevant FEMA officials to obtain updates on efforts to  improve coordination among preparedness grant programs. The work  upon which this testimony is based was conducted in accordance with  generally accepted government auditing standards. Those standards  require that we plan and perform the audit to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe that the evidence obtained  provides a reasonable basis for our findings and conclusions based on  our audit objectives.

Over the past decade, the federal government has expanded financial  assistance to public and private stakeholders for preparedness activities  through various grant programs administered by DHS through its  component agency, FEMA. Through these grant programs, DHS has  sought to enhance the capacity of states, localities, and other entities,  such as ports or transit agencies, to prevent, respond to, and recover  from a natural or manmade disaster, including terrorist incidents. Two of  the largest preparedness grant programs are the State Homeland  Security Program and the Urban Areas Security Initiative.

The State Homeland Security Program provides funding to support  states’ implementation of homeland security strategies to address the  identified planning, organization, equipment, training, and exercise  needs at the state and local levels to prevent, protect against, respond  to, and recover from acts of terrorism and other catastrophic events.  FEMA allocated $402 million for the program in fiscal year 2017.

The Urban Areas Security Initiative provides federal assistance to  address the unique needs of high-threat, high-density urban areas,  and assists the areas in building an enhanced and sustainable  capacity to prevent, protect, respond to, and recover from acts of  terrorism. FEMA allocated $580 million for the program in fiscal year  2017.

The State Homeland Security Program (SHSP), awarded to the nation’s  56 states and territories, and the Urban Areas Security Initiative (UASI),  awarded to urban areas based on DHS’s risk assessment methodology,  are the largest of the preparedness grant programs, accounting for about  60 percent of Fiscal Year 2017 grant funding. See figure 1 for a history of  funding levels for these programs. Eligible candidates for the FY 2017  UASI program are determined through an assessment of relative risk of  terrorism faced by the 100 most populous metropolitan statistical areas in  the United States, in accordance with the Homeland Security Act of 2002,  as amended.

FEMA Has Strengthened Its Coordination, Oversight, and Assessments of Grants But Challenges Remain in the Effectiveness of FEMA’s Grant Management

FEMA Has Taken Some Steps to Address Coordination Challenges Between Headquarters and Regional Offices, But Some Challenges Still Remain

In February 2016, we reported that FEMA has taken some steps, but has  not fully addressed longstanding preparedness grant management  coordination challenges between its headquarters and regional offices.  We found that for several preparedness grant programs, FEMA  headquarters staff in GPD and regional staff share management and  monitoring responsibilities. For example, we found that assessments by  GPD and others since 2009 had recommended that regional offices,  rather than headquarters offices, be responsible for managing and  monitoring preparedness grants to avoid confusion and duplication, and  to strengthen coordination with state and local grantees. Further, in July  2011, we found that GPD had efforts underway to regionalize grant  management responsibilities and improve coordination of preparedness  grants, and that these efforts were consistent with internal control  standards. However, GPD officials reported that in 2012 it changed course and decided to continue sharing grant management roles between  headquarters and regions, referred to as a hybrid grant management  structure. GPD officials told us that they changed course because, among  other things, estimates that the costs of regionalization would be greater  than the annual savings FEMA identified in an earlier study and concerns  that inconsistent program implementation would occur across the regions,  and outweighed the potential benefits. GPD officials at that time said they  had taken steps to address coordination challenges associated with this  hybrid grant management structure.

However, we found in February 2016 that these challenges continue. For  example, states and FEMA regional officials told us that GPD staffs in  headquarters and regions did not always coordinate their monitoring  visits, which can be disruptive to the state emergency management  agency’s day-to-day operations. FEMA regional officials also reported  that GPD staffs in headquarters and regions sometimes provided  inconsistent guidance to grantees. Further, while GPD officials identified  some steps they plan to take to address the challenges, we found that  GPD lacked a plan with time frames and goals for addressing them. We  recommended that FEMA develop a plan with time frames, goals,  metrics, and milestones detailing how GPD intends to resolve  longstanding challenges associated with its existing hybrid grants  management model, which divides responsibilities between regional and  headquarters staff. FEMA, however, did not concur with our  recommendation, stating that it disagreed with our characterization of  longstanding challenges in managing preparedness grants. As we stated  in the report, multiple assessments dating back to 2009 have reported  challenges with the hybrid model. As also noted in our report, officials  from four FEMA regional offices and officials from three states within  those regions provided various examples of a lack of coordination  between headquarters and regional staff in managing preparedness  grants, including instances that took place in 2014 and as recently as  September 2015.

In October 2017, FEMA developed a plan—the Milestone Action Plan—to  track efforts aimed at improving coordination issues associated with its  hybrid grants management model, as we recommended in February  2016. The plan divides responsibilities for the management of  preparedness grants between regional and headquarters staff and  describes completed, ongoing, and planned efforts taken by FEMA to  improve grants management coordination along with steps taken, goals,  and time frames, among other things. For example, the plan shows that  FEMA developed and finalized the Monitoring Actions Tracker in August  2016, a tool shared by GPD in FEMA headquarters and staff in regional  offices. Through the tracker, GPD headquarters and regional staffs are  able to view planned and completed monitoring activities related to grants  management, as well as the status of any open corrective actions. In  addition to developing the Milestone Action Plan, FEMA officials  described other efforts taken to improve coordination issues. For  example, FEMA officials told us they increased the use of an online  collaboration tool, which allows for instant information sharing between  GPD and the regions. By taking these steps, FEMA should be better  positioned to track and evaluate efforts to improve regional coordination,  as we recommended in 2016.

FEMA Has Taken Steps to Increase Oversight Across Preparedness Grant Programs

FEMA has been delayed in addressing the need for improved  coordination among grant programs identified in our prior work.  Specifically, we found in February 2012 that multiple factors contribute to  the risk of duplication among four FEMA preparedness grant programs— the State Homeland Security Program, Urban Areas Security Initiative,  Port Security Grant Program, and Transit Security Grant Program—as  these programs share similar goals, fund similar projects, and provide  funds in the same geographic regions. Further, we found that DHS’s  ability to track grant funding, specific funding recipients, and funding  purposes varies among the programs, giving FEMA less visibility over  some grant programs. Also, DHS’s award process for some programs  based allocation decisions on high-level, rather than specific, project  information, which could further contribute to the risk of duplication.  Although our February 2012 analysis identified no cases of duplication  among a sample of grant projects, the above factors collectively put  FEMA at risk of funding duplicative projects. As a result, in 2012, we  included these challenges in our annual report on duplication, overlap,  and fragmentation in federal programs, agencies, offices, and initiatives.  FEMA has not yet taken action to fully address our concerns.

We recommended in February 2012 that as FEMA developed its new  grants management information system (the Non-Disaster Grants  Management System, or ND Grants at that time), that the agency collect  project information with the level of detail needed to better position the  agency to identify any potential unnecessary duplication within and  across the four grant programs. In December 2012, FEMA officials  reported that the agency intended to start collecting and analyzing  project-level data from grantees in fiscal year 2014. Further, in December  2017, FEMA took actions to identify potential unnecessary duplication  across four preparedness grant programs, as we recommended in  February 2012. Although the development of FEMA’s grants  management information system is ongoing, FEMA issued guidance and  adopted interim processes to help identify potential duplication across  these preparedness grant programs until the system’s capabilities are  upgraded over the next several years. For example, in fiscal year 2014,  FEMA modified a legacy grants data system to capture more robust  project-level data—such as project budget data—for the Homeland  Security Grant Program, which includes the State Homeland Security  Grant Program and the Urban Areas Security Initiative.

In addition, in fiscal year 2017, FEMA procured a software visualization  tool and developed a set of standard operating procedures to assist staff  in identifying potentially duplicative projects. Specifically, the visualization  tool will use grants award data from the Port Security Grant Program, the  Transit Security Grant Program, and compare the grant programs named  above to highlight ZIP codes that contain multiple projects. These projects  will then be analyzed by FEMA officials. According to the standard  operating procedure, if duplication is suspected within a particular  geographic area, further collaborative reviews should be conducted in  coordination with the Office of Chief Counsel to determine appropriate  remedies. Using an interim approach to collect more specific project-level  data during the grant application process and utilizing the new software  visualization tool should help FEMA strengthen the administration and  oversight of its grant programs until FEMA implements its long-term  solution for the agency’s grants management information system.

FEMA Is Validating Grant Performance Data,

In the area of performance assessment, we reported in June 2013 on  limitations in FEMA’s ability to validate the performance data it collects.  Specifically, we found that two of FEMA’s preparedness grant  programs—Emergency Management Performance Grants (EMPG) and  Assistance to Firefighters Grants (AFG) programs—collect performance  information through a variety of reporting mechanisms but face  challenges in identifying verifiable program outcomes. These reporting  mechanisms collect performance data used by FEMA regional offices and  headquarters for different purposes. For example, headquarters focuses  on the development of future program priorities and on reporting progress  toward the National Preparedness Goal, while regions use program  information to monitor primary grant recipients for compliance. DHS  developed agency priority goals that reflect agency-wide, near-term  priorities. According to FEMA officials, the EMPG and AFG programs  have an indirect link to a DHS agency priority goal, as well as the National  Preparedness Goal, because they support states’ level of preparedness  for disasters. According to FEMA officials, neither program has a  standardized tool with which to validate the performance data that are  self-reported by recipients; additionally, the regions are inconsistent in  their approaches to verifying program performance data. We concluded  that the absence of a formal established validation and verification  procedure, as directed by the Office of Management and Budget’s  Circular No. A-11, could lead to the collection of erroneous performance  data.

In our June 2013 report, we recommended that FEMA ensure that there  are consistent procedures in place at the headquarters’ office and  regional level to ensure verification and validation of grant performance  data that allow the agency to attest to the reliability of EMPG and AFG  grant data used for reporting progress toward goals. DHS concurred with  our recommendation and stated that FEMA would explore effective and  affordable ways to verify and validate EMPG and AFG grant performance  data. In April 2015, FEMA officials reported that FEMA was in the process  of developing the data verification and validation checks of EMPG  grantee performance reporting. For example, according to FEMA officials,  they have revised reporting templates and uniform table definitions to  make it easier for grantees to submit accurate, complete, and consistent  information on programmatic activities such as the completion of training  and exercise requirements. However, these processes have not yet been  fully implemented, and FEMA officials have not yet provided similar tools  and checklists for the AFG program. In March 2017, FEMA grants  management staff provided us with documentation on the process FEMA  uses to verify and validate grantee data from the EMPG and AFG grant  programs, as we recommended. As a result of having a consistent  approach to verifying data, FEMA’s efforts should reduce the collection of  erroneous performance data.

In addition, as part of our September 2016 review of FEMA Fire  Assistance Grant program, we reported that FEMA officials said they  planned to develop and implement a consolidated grant management  system to integrate data used to manage fire grant programs with the  data gathered for FEMA’s other preparedness grants, and ultimately  better measure the impact of fire grants on national preparedness  efforts. Specifically, as we reported in May 2016, FEMA plans to develop  and implement a new Grants Management Modernization system to  provide agency-wide management for all of FEMA’s disaster and  preparedness grants. Further, we are currently performing an on-going  review of FEMA’s consolidated grant management system and plan to  report on this effort later this year.

FEMA Has Made Progress Assessing Its Grant Preparedness Capabilities, but Continues to Face Challenges Developing a National Preparedness System

We also reported in March 2011 that FEMA needed to improve its  oversight of preparedness grants by establishing a framework with  measurable performance objectives for assessing urban area, state,  territory, and tribal capabilities to identify gaps and prioritize investments.  Specifically, we recommended that FEMA complete a national  preparedness assessment of capability gaps at each level based on  tiered, capability-specific performance objectives to enable prioritization of  grant funding. With such an assessment, FEMA could identify the  potential costs for establishing and maintaining capabilities at each level  and determine what capabilities federal agencies should provide. We  reported in March 2013 that FEMA has made some progress in assessing  its preparedness capabilities, but continued to face challenges developing  a national preparedness system that could assist FEMA in prioritizing  preparedness grant funding. For example, in March 2012, FEMA issued  the first National Preparedness Report, which describes progress made  to build, sustain, and deliver capabilities. In April 2012, FEMA issued  guidance on developing Threat and Hazard Identification and Risk  Assessments (THIRA) to facilitate the self-assessments of regional, state,  and local capabilities. FEMA requires state, territory, tribal, and urban  area governments receiving homeland security funding to annually  complete THIRAs and use the results to determine the resources required  to achieve the capability targets they set for their jurisdiction. However,  we found in March 2013 that FEMA faced challenges that may reduce the  usefulness of these efforts. For example, the National Preparedness  Report noted that while many programs exist to build and sustain  preparedness capabilities, challenges remain in measuring their progress  over time. According to the report, in many cases, measures do not yet  exist to gauge the performance of these programs, either quantitatively or  qualitatively.

FEMA has taken some steps to address our recommendation.  Specifically, FEMA reported in February 2018 that the agency has  developed capability-specific performance objectives that will enable a  national preparedness assessment of capability gaps, but no such report  has been issued at this time. FEMA reported that it plans on  implementing new methodology for some core capabilities in December  2018 and for all core capabilities by December 2019, and will be able to  provide complete results in 2020. In addition, FEMA reported that they  are developing a new Threat and Hazard Identification and Risk  Assessment (THIRA) methodology that will assist in measuring the  effectiveness of state and urban areas’ grant projects in reducing risk.  According to FEMA, the new methodology will measure changes in state  and urban area preparedness through the use of standardized capability  targets and key indicators that will show how FEMA preparedness grants  are being used to address gaps in capability targets. This should also  lead to a better understanding of the Nation’s overall preparedness.  Regardless, as of February 2018, FEMA had taken steps to assess  preparedness capabilities, but had not yet completed a national  preparedness assessment with clear, objective, and quantifiable  capability requirements against which to assess preparedness, as we  recommended. Developing such an assessment would help FEMA to  identify what capability gaps exist at the federal level and what level of  resources are needed to close such gaps.

Chairman Donovan, Ranking Member Payne, and Members of the  Subcommittee, this concludes my prepared statement. I would be happy  to respond to any questions you may have.

For questions about this statement, please contact Chris Currie at (404)  679-1875 or curriec@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this statement. Individuals making key contributions to this statement  include Aditi Archer (Assistant Director), John Vocino (Analyst-In- Charge), Dorian Dunbar, Alexandra Gebhard, Eric Hauswirth, Chuck  Bausell, Heidi Nielson, and Adam Vogt.

Federal Emergency Management Agency: Progress and Continuing  Challenges in National Preparedness Efforts GAO-16-560T: Washington,  D.C.: Apr 12, 2016.

Fire Grants: FEMA Could Enhance Program Administration and  Performance Assessment GAO-16-744: Washington, D.C.: Sep 15, 2016.

Federal Emergency Management Agency: Strengthening Regional  Coordination Could Enhance Preparedness Efforts. GAO-16-38,  .Washington, D.C.: February 4, 2016.

Emergency Management: FEMA Has Made Progress since Hurricanes  Katrina and Sandy, but Challenges Remain. GAO-16-90T. Washington,  D.C.: October 22, 2015.

Emergency Management: FEMA Collaborates Effectively with Logistics  Partners but Could Strengthen Implementation of Its Capabilities  Assessment Tool. GAO-15-781. Washington, D.C.: September 10, 2015.

Emergency Preparedness: Opportunities Exist to Strengthen Interagency  Assessments and Accountability for Closing Capability Gaps. GAO-15-20.  . Washington, D.C.: December 4, 2014.

Federal Emergency Management Agency: Opportunities to Achieve  Efficiencies and Strengthen Operations. GAO-14-687T. Washington,  D.C.: July 24, 2014.

National Preparedness: Actions Taken by FEMA to Implement Select  Provisions of the Post-Katrina Emergency Management Reform Act of  2006. GAO-14-99R. Washington, D.C.: November 26, 2013.

National Preparedness: FEMA Has Made Progress, but Additional Steps  Are Needed to Improve Grant Management and Assess Capabilities.  GAO-13-637T. Washington, D.C.: June 25, 2013.

Grants Performance: Justice and FEMA Collect Performance Data for  Selected Grants, but Action Needed to Validate FEMA Performance Data.  GAO-13-552. Washington, D.C.: June 24, 2013.

Managing Preparedness Grants and Assessing National Capabilities:  Continuing Challenges Impede FEMA’s Progress. GAO-12-526T.  Washington, D.C.: March 20, 2012.

Homeland Security: DHS Needs Better Project Information and  Coordination among Four Overlapping Grant Programs. GAO-12-303.  Washington, D.C.: February 28, 2012.  2012 Annual Report: Opportunities to Reduce Duplication, Overlap and  Fragmentation, Achieve Savings, and Enhance Revenue.  GAO-12- 342SP. Washington, D.C.: February 28, 2012.

Port Security Grant Program: Risk Model, Grant Management, and  Effectiveness Measures Could Be Strengthened. GAO-12-47.

Washington, D.C.: November 17, 2011. FEMA Has Made Progress in  Managing Regionalization of Preparedness Grants. GAO-11-732R.  Washington, D.C.: July 29, 2011.

Measuring Disaster Preparedness: FEMA Has Made Limited Progress in  Assessing National Capabilities. GAO-11-260T. Washington, D.C.: March  17, 2011.

Opportunities to Reduce Potential Duplication in Government Programs,  Save Tax Dollars, and Enhance Revenue. GAO-11-318SP. Washington,  D.C.: March 1, 2011.

FEMA Has Made Limited Progress in Efforts to Develop and Implement a  System to Assess National Preparedness Capabilities. GAO-11-51R.  Washington, D.C.: October 29, 2010.

Urban Area Security Initiative: FEMA Lacks Measures to Assess How  Regional Collaboration Efforts Build Preparedness Capabilities.   GAO-09-651. Washington, D.C.: July 2, 2009.

Transit Security Grant Program: DHS Allocates Grants Based on Risk,  but Its Risk Methodology, Management Controls, and Grant Oversight  Can Be Strengthened. GAO-09-491. Washington, D.C.: June 8, 2009.

National Preparedness: FEMA Has Made Progress, but Needs to  Complete and Integrate Planning, Exercise, and Assessment Efforts.  GAO-09-369. Washington, D.C.: April 30, 2009.

Homeland Security: DHS Improved its Risk-Based Grant Programs’  Allocation and Management Methods, But Measuring Programs’ Impact  on National Capabilities Remains a Challenge. GAO-08-488T.  Washington, D.C.: March 11, 2008.

Homeland Security: DHS’ Efforts to Enhance First Responders’ All-  Hazards Capabilities Continue to Evolve. GAO-05-652. Washington,  D.C.: July 11, 2005.

Homeland Security: Management of First Responder Grant Programs  Has Improved, but Challenges Remain. GAO-05-121. Washington, D.C.:  February 2, 2005.

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.


High-Containment Laboratories: Coordinated Efforts Needed to Further Strengthen Oversight of Select Agents

Safety lapses have occurred at laboratories in the United States that conduct research on select agents—such as Ebola virus or anthrax bacteria—that may cause serious or lethal infection in humans, animals, or plants, raising concerns about whether oversight is effective. This statement summarizes information contained in GAO's October 2017 report, titled High-Containment Laboratories: Coordinated Actions Needed to Enhance the Select Agent Program's Oversight of Hazardous Pathogens ( GAO-18-145 ).

The Federal Select Agent Program—jointly managed by the Departments of Health and Human Services (HHS) and Agriculture (USDA)—oversees laboratories' handling of certain hazardous pathogens known as select agents. However, the program does not fully meet all key elements of effective oversight. For example, the program is not structurally independent from all laboratories it oversees and has not assessed risks posed by its current structure or the effectiveness of mechanisms it has to reduce organizational conflicts of interest. Without conducting such assessments and taking actions as needed to address risks, the program may not effectively mitigate impairments to its independence.

In addition, some experts and laboratory representatives GAO interviewed raised concerns that the program's reviews may not target the highest-risk activities, in part because it has not formally assessed which activities pose the highest risk. Without assessing the risk of activities it oversees and targeting its resources appropriately, the program cannot ensure it is balancing its resources against their impact.

Moreover, the program does not have strategic planning documents, such as a joint strategic plan and workforce plan, to guide its oversight. Although it began taking steps to develop a joint strategic plan, the program is not developing workforce plans as part of this effort. Developing a joint workforce plan that assesses workforce and training needs for the program as a whole would help the program leverage resources to ensure all workforce and training needs are met.

Selected countries and regulatory sectors GAO reviewed employ other approaches to promote effective oversight. For example, in Great Britain, an independent government agency focused on health and safety oversees laboratories that work with pathogens. In addition, in both Great Britain and Canada, regulators (1) focus their oversight on biological safety, because safety incidents provided the impetus for laboratory oversight in these countries and (2) regulate all potentially hazardous pathogens and activities in laboratories.

GAO's recommendations in GAO-18-145 included that the Federal Select Agent Program (1) assess risks posed by its current structure and address risks as needed; (2) assess the risk of activities it oversees and target reviews to the highest-risk activities; and (3) develop a joint workforce plan. HHS and USDA agreed with GAO's recommendations and outlined actions they are taking, or plan to take, to address them, which GAO will continue to monitor.

I am pleased to be here today to discuss our recent work on the oversight  of select agents in high-containment laboratories in the United States.  Safety lapses have occurred at laboratories in the United States that  conduct research on hazardous pathogens and toxins (known as select  agents) that may pose a serious threat to humans, animals, or plants.  These lapses raise concerns about whether federal oversight of these  laboratories is effective. For example, in November 2016, the Department  of Homeland Security discovered that a private laboratory had  inadvertently sent a toxic form of ricin (a potentially lethal poison) to one  of its training centers multiple times since 2011, potentially putting training  participants at risk. In May 2015, the Department of Defense (DOD)  discovered that a DOD laboratory had inadvertently shipped live anthrax  bacteria to nearly 200 other laboratories worldwide over the course of 12  years. And in July 2014, the National Institutes of Health discovered  decades-old vials of smallpox in a storage room of a Food and Drug  Administration laboratory on its campus.

We have, for many years, identified challenges and areas for  improvement related to the safety, security, and oversight of high- containment laboratories. In 2009, for example, we found a proliferation of  high-containment laboratories across the United States, with the number  of such laboratories in the government, academic, and private sectors  increasing since 2001. In addition, we found that there was no single  entity overseeing this proliferation, and that no federal agency knew how  many such laboratories existed in the United States or the aggregate  risks associated with the proliferation. We also found in 2009 and 2014  that, for the subset of these laboratories subject to federal oversight, the  oversight was duplicative, fragmented, and dependent on self-policing.  More recently, we found in 2016 that stronger oversight mechanisms for  federal high-containment laboratories were needed at the individual  federal department and component agency levels. We have made  numerous recommendations over the years, including that a single entity  be identified to determine the number of high-containment laboratories  needed to meet national goals, the aggregate risks associated with the  proliferation of laboratories, and the type of oversight needed. Federal  departments have made some progress in implementing  recommendations from our past reports, including addressing issues we  identified regarding duplicative oversight. However, the United States still  has not identified a single entity to perform the functions we  recommended.

All high-containment laboratories in the United States that register to work  with select agents are regulated by the Federal Select Agent Program  (which this statement subsequently refers to as the Select Agent  Program), through which two agencies share oversight responsibility.

Specifically, oversight is shared by the Division of Select Agents and  Toxins within the Department of Health and Human Services’ (HHS)  Centers for Disease Control and Prevention (CDC) and the Agriculture  Select Agent Services within the U.S. Department of Agriculture’s (USDA)  Animal and Plant Health Inspection Service (APHIS). The program was  established to regulate the possession, use, and transfer of select agents  in response to security concerns following bioterrorism attacks in the  1990s and early 2000s.

Other countries also regulate and oversee hazardous pathogens handled  in high-containment laboratories, and they sometimes take approaches  that differ from that of the United States. Moreover, other high-risk sectors  in the United States, such as the nuclear industry, sometimes take  different approaches to oversight. Notwithstanding such differences, our  past work reviewing some of these sectors has identified five key  elements of effective oversight in areas where low-probability adverse  events can have significant and far-reaching effects. These elements are  as follows:  Independence: The organization conducting oversight should be  structurally distinct and separate from the entities it oversees.

Ability to perform reviews: The organization should have the access  and working knowledge necessary to review compliance with  requirements.

Technical expertise: The organization should have sufficient staff  with the expertise to perform sound safety and security assessments.

Transparency: The organization should provide access to key  information, as applicable, to those most affected by operations.

Enforcement authority: The organization should have clear and  sufficient authority to require that entities achieve compliance with  requirements.

My remarks today are based on our October 2017 report on the oversight  of select agents in high-containment laboratories. Our report  (1) examined the extent to which the Select Agent Program has the  elements of effective oversight and has strategic planning documents to  guide its oversight efforts, and (2) described approaches that selected  countries and regulatory sectors have used to promote effective  oversight. Today, I will discuss key findings and recommendations from  that report.

For our report, we discussed the five key elements of effective oversight  above with agency officials, experts, and representatives from  nongovernmental organizations to ensure their applicability to the  oversight of select agents. We reviewed laws, regulations, and  documents related to the Select Agent Program to determine the extent to  which the program met the key elements. We also interviewed officials  from CDC and APHIS and registered laboratories to discuss the  program’s inspections and other oversight responsibilities and other  issues related to the five key elements. To obtain expert views on the  effectiveness of the approaches the Select Agent Program and other  selected countries and regulatory sectors have used to promote effective  oversight, we worked with the National Academy of Sciences to convene  a 2-day meeting with 18 experts. We also reviewed relevant  documentation and interviewed regulatory officials from selected  countries—including the United Kingdom and Canada—and other sectors  such as nuclear energy. More detailed information on the scope and  methodology of our work can be found in the October report. The work  upon which this statement is based was conducted in accordance with  generally accepted government auditing standards.

In summary, we found that the Select Agent Program does not fully meet  all key elements of effective oversight. For example, the program is not  structurally distinct and separate from all laboratories it oversees and,  therefore, does not meet the key element of independence. Regarding  another key element—the ability to perform reviews—some experts and  laboratory representatives raised concerns that the program’s reviews  may not target the highest-risk activities, in part because it has not  formally assessed which activities pose the highest risk. Moreover, the  program does not have joint strategic planning documents, including a  joint workforce plan, to guide its shared oversight efforts. We made 11  recommendations to address these issues. HHS and USDA agreed with  our recommendations and outlined actions they are taking, or plan to  take, to address them.

Select Agent Program Does Not Fully Meet Key Elements of Effective Oversight or Have Joint Strategic Planning Documents to Guide Its Efforts

The Select Agent Program does not fully meet key elements of effective  oversight. In particular, the program has oversight shortcomings related to  each of our five key elements: independence, performing reviews,  technical expertise, transparency, and enforcement. In addition, the  program does not have joint strategic planning documents to guide its  oversight efforts, such as a joint strategic plan and workforce plan. It did,  however, begin taking steps to develop a joint strategic plan during the  summer of 2017.

First, regarding independence, the Select Agent Program is not  structurally distinct and separate from all of the laboratories it oversees  because the two components of the Select Agent Program are located in  CDC and APHIS, both of which also have high-containment laboratories  registered with the program. Many experts at our meeting raised  concerns that the Select Agent Program cannot be entirely independent  in its oversight of CDC and APHIS laboratories because the Select Agent  Program is composed of divisions of those agencies. To help reduce  conflicts of interest, the program has taken steps such as having APHIS  lead inspections of CDC laboratories. However, it has generally done so  in response to concerns raised by others. The program itself has not  formally assessed all potential risks posed by its current structure and the  effectiveness of its mechanisms to address those risks. The Office of  Management and Budget’s Circular A-123 requires federal agencies to  integrate risk management activities into their program management to  help ensure they are effectively managing risks that could affect the  achievement of agency objectives. In addition, federal internal control  standards state that management should identify, analyze, and respond  to risks related to achieving defined objectives. Without (1) regularly  assessing the potential risks posed by the program’s current structure  and the effectiveness of its mechanisms to address them and (2) taking  actions as necessary to ensure any identified risks are addressed, the  program may not be aware of or effectively mitigate impairments to its  independence that could affect its ability to achieve its objectives.

Second, regarding the ability to perform reviews, we found that the Select  Agent Program performs several types of reviews to ensure compliance  with regulatory and program requirements. However, the program may  not target the highest-risk activities in its inspections, in part because it  has not formally assessed which activities pose the highest risk to  biological safety and security. For example, many experts at our  meeting and laboratory representatives we interviewed raised concerns  about the amount of time inspectors spend assessing compliance with  inventory controls (e.g., by counting and examining vials containing select  agents) and reviewing inventory records during the inspection process,  which takes time away from inspecting other aspects of biological safety  and security. Experts at our meeting said that these activities do little to  reduce the risk of theft of select agents (a security concern) because  samples could be clandestinely removed from vials and replicated without  being detected by the inventory controls currently in place. Further, other  laboratory representatives told us that activities to assess compliance  with certain program requirements, such as time-consuming reviews of  records, did little to reduce risk and were unnecessarily burdensome to  both researchers and inspectors. These inspection activities are generally  intended to address biological security concerns; however, recent high- profile incidents at registered laboratories have concerned biological  safety rather than security.

To improve the inspection process and identify trends and associations  between inspection findings and risk, a 2015 internal review of the CDC  component of the Select Agent Program recommended that the CDC and  APHIS components of the program work together to analyze inspection  and investigation data. According to program officials, they have not yet  addressed the recommendation because they do not currently have  adequate tools to do so, but the program is transitioning to a new  database that will enhance their ability to identify trends and associations  and thereby guide improvements to the inspection process. However, the  program did not provide a plan for when or how the program will carry out  these analyses to improve the inspection process. Federal internal control  standards state that management should identify, analyze, and respond  to risks related to achieving defined objectives. Without developing and  implementing a plan to identify which laboratory activities carry the  highest biological safety and security risks and to respond to those risks  by aligning inspections and other oversight efforts to target those  activities, the Select Agent Program will not have assurance that it is  effectively balancing the potential safety and security gains from its  oversight efforts against the use of program resources and the effect on  laboratories’ research.

We also found that the Select Agent Program did not fully meet the other  three key elements of effective oversight: technical expertise,  transparency, and enforcement. For example, although the program has  taken steps to hire additional staff and enhance the technical expertise of  its staff, workforce and training gaps remain. In addition, although the  program has increased transparency about registered laboratories and  violations of the select agent regulations to the public and registered  laboratories since 2016, the information it shares is limited and there is no  consensus about what additional information could be shared, given  security concerns. Lastly, although the program has authority to enforce  compliance with program requirements, it is still working to address past  concerns about the need for greater consistency and clarity in actions it  takes in exercising this authority.

In addition to not fully meeting the five key elements of effective oversight,  we found that the Select Agent Program does not have joint strategic  planning documents to guide its shared oversight efforts across CDC and  APHIS. For example, the program does not have a joint mission  statement to collectively define what the program seeks to accomplish  through its oversight. It also does not yet have a strategic plan. Agencies  can use strategic plans to set goals and identify performance measures  for gauging progress towards those goals. Strategic plans can also  outline how agencies plan to collaborate with each other to help achieve  goals and objectives. The program began taking steps to develop a joint  strategic plan during the course of our review and, in August 2017, began  soliciting bids from contractors for the plan’s development. The statement  of work for the contract stipulates that the contractor shall develop guiding  principles for the Select Agent Program along with a mission statement  and strategic goals and objectives, among other requirements. However,  it does not have any requirements related to development of a joint  workforce plan. We have found in the past that agencies’ strategic  workforce planning should be clearly linked to the agency’s mission and  long-term goals developed during the strategic planning process.  Developing a joint workforce plan that assesses workforce and training  needs for the program as a whole would help the program to better  manage fragmentation by improving how it leverages resources to ensure  all workforce and training needs are met. Leveraging resources is  especially important given fiscal constraints.

In our report, we recommended that CDC and APHIS take several steps  to address these findings. First, we made five recommendations to  improve independence, including that CDC and APHIS regularly assess  the potential risks posed by the program’s structure and the effectiveness  of its mechanisms to address those risks, and take actions as necessary  to ensure any identified risks are addressed so that impairments to  independence do not affect its ability to achieve its objectives. Second, to  improve the ability to perform reviews, we recommended that the  directors of the Select Agent Program work together to develop and  implement a plan to identify which laboratory activities carry the highest  biological safety and security risks and to respond to those risks by  aligning inspections and other oversight efforts to target those activities.  We also made several other recommendations, including recommending  that the directors of the Select Agent Program develop a joint workforce  plan that assesses workforce and training needs for the program as a  whole.

Selected Countries and Regulatory Sectors Employ Other Approaches to Promote Effective Oversight

Selected countries and regulatory sectors employ approaches to promote  effective oversight that sometimes differ from those of the Select Agent  Program by, for example, having regulatory bodies that are structurally  independent from the entities they oversee or taking a risk-based  approach to performing reviews. To illustrate, with regard to  independence, Great Britain’s Health and Safety Executive, whose  mission is to protect worker and public health and safety and which  oversees laboratories that work with pathogens, is an independent  government agency. According to officials from the Health and Safety  Executive and laboratory representatives, one strength of this approach is  that it avoids potential organizational conflicts of interest because none of  the laboratories it oversees are part of the same agency. Some other  regulatory sectors in the United States, including the Nuclear Regulatory  Commission (NRC), are also structurally independent from regulated  facilities as a mechanism to ensure independence. Prior to the creation of  NRC in 1974, the U.S. Atomic Energy Commission was responsible for  both promotion and oversight of the nuclear industry. The Energy  Reorganization Act of 1974 established NRC as a separate, independent  entity. According to a Senate committee report, this was a response to  growing criticism that there was a basic conflict between the U.S. Atomic  Energy Commission’s regulation of the nuclear power industry and its  development and promotion of new technology for the industry.

Related to the ability to perform reviews, regulators in Great Britain and  Canada apply a risk-based approach by targeting laboratories with a  documented history of performance issues or those conducting higher- risk activities. In both Great Britain and Canada, the organizations that  oversee laboratories generally focus their oversight on (1) biological  safety, and (2) regulation of all potentially hazardous pathogens in  laboratories. In contrast, the Select Agent Program originated from  security-related concerns and regulates only those pathogens identified  on the U.S. select agent list and no other pathogens that may be handled  in high-containment but are not select agents, such as West Nile virus.

Other differences we found in approaches include relying on scientists  and other laboratory personnel to have requisite technical expertise on  the pathogens and activities in their laboratories, sharing incident  information on their public websites, and having prosecutorial authority  when incidents occur.

In conclusion, CDC and APHIS share a critical role in ensuring that  important research on select agents can be conducted in high- containment laboratories in a safe and secure manner. The Select Agent  Program has made a number of improvements over the past few years,  such as hiring additional staff and improving training to enhance  expertise. Nevertheless, the program does not fully meet all key elements  of effective oversight and more is needed to develop joint strategic plans  to collectively guide its shared oversight efforts. In our prior work, we  have found that existing federal oversight of high-containment  laboratories is fragmented and largely self-policing, among other things.  Our October 2017 report, in combination with these past findings,  continues to raise questions about whether the current government  framework and oversight are adequate.

Vice Chairman Griffith, Ranking Member DeGette, and Members of the  Subcommittee, this concludes our prepared statement. We would be  pleased to respond to any questions that you may have at this time.

If you or your staff have any questions about this statement, please  contact Mary Denigan-Macauley, Ph.D., Acting Director, Health Care, at  (202) 512-7114 or deniganmacauleym@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this statement. Individuals who made key contributions to  this statement include Sushil Sharma, Ph.D., Dr.PH (Assistant Director);  Amy Bowser; Caitlin Dardenne, Ph.D.; John Neumann; Cynthia Norris;  Timothy M. Persons, Ph.D.; and Lesley Rinner. Staff who made key  contributions to the report(s) cited in the statement are identified in the  source products.

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.

Laboratories conduct research on hazardous pathogens—such as Ebola virus or anthrax bacteria—in more than 200 labs in the United States. Safety lapses have occurred at some of these labs, raising concerns about whether oversight is effective.

For this testimony, we looked at the Federal Select Agent Program, which is responsible for overseeing these labs, and found room for improvement. For example, the program allows some agencies to oversee their own labs, which could potentially lead to conflicts of interest. In the report on which this testimony is based, we recommended 11 actions to improve oversight.


Telecommunications: Additional Action Needed to Address Significant Risks in FCC's Lifeline Program

Created in the mid-1980s, FCC's Lifeline program provides discounts to eligible low-income households for home or wireless telephone and, as of December 2016, broadband service. Lifeline reimburses telephone companies that offer discounts through the USF, which in turn is generally supported by consumers by means of a fee charged on their telephone bills.

This testimony is based on GAO's May 2017 report and discusses steps FCC has taken to measure Lifeline's performance in meeting goals; steps FCC and USAC have taken to enhance controls over finances, subscribers, and providers; and any weaknesses that might remain.

For the May 2017 report, GAO analyzed documents and interviewed officials from FCC and USAC. GAO also analyzed subscriber data from 2014 and performed undercover tests to identify potential improper payment vulnerabilities. The results of this analysis and testing are illustrative, not generalizable.

In its May 2017 report, GAO found the Federal Communications Commission (FCC) has not evaluated the Lifeline program's (Lifeline) performance in meeting its goals of increasing telephone and broadband subscribership among low-income households by providing financial support, but it has recently taken steps to begin to do so. FCC does not know how many of the 12.3 million households receiving Lifeline as of December 2016 also have non-Lifeline phone service, or whether participants are using Lifeline as a secondary phone service. FCC revamped Lifeline in March 2016 to focus on broadband adoption; however, broadband adoption rates have steadily increased for the low-income population absent a Lifeline subsidy for broadband. Without an evaluation, which GAO recommended in March 2015, FCC is limited in its ability to demonstrate whether Lifeline is efficiently and effectively meeting its program goals. In a March 2016 Order, FCC announced plans for an independent third party to evaluate Lifeline design, function, and administration by December 2020.

FCC and the Universal Service Administrative Company (USAC)—the not-for-profit organization that administers the Lifeline program—have taken some steps to enhance controls over finances and subscriber enrollment. For example, FCC and USAC established some financial and management controls regarding billing, collection, and disbursement of funds for Lifeline. To enhance the program's ability to detect and prevent ineligible subscribers from enrolling, FCC oversaw completion in 2014 of an enrollment database and, in June 2015, FCC adopted a rule requiring Lifeline providers to retain eligibility documentation used to qualify consumers for Lifeline support to improve the auditability and enforcement of FCC rules.

Nevertheless, in its May 2017 report, GAO found weaknesses in several areas. For example, Lifeline's structure relies on over 2,000 Eligible Telecommunication Carriers that are Lifeline providers to implement key program functions, such as verifying subscriber eligibility. This complex internal control environment is susceptible to risk of fraud, waste, and abuse as companies may have financial incentives to enroll as many customers as possible. On the basis of its matching of subscriber to benefit data, GAO was unable to confirm whether about 1.2 million individuals of the 3.5 million it reviewed, or 36 percent, participated in a qualifying benefit program, such as Medicaid, as stated on their Lifeline enrollment application. FCC's 2016 Order calls for the creation of a third-party national eligibility verifier by the end of 2019 to determine subscriber eligibility. Further, FCC maintains the Universal Service Fund (USF)—with net assets of $9 billion, as of September 2016—outside the Department of the Treasury in a private bank account. In 2005, GAO recommended that FCC reconsider this arrangement given that the USF consists of federal funds. In addition to addressing any risks associated with having the funds outside the Treasury, FCC identified potential benefits of moving the funds. For example, by having the funds in the Treasury, USAC would have better tools for fiscal management of the funds. In March 2017, FCC developed a preliminary plan to move the USF to the Treasury. Until FCC finalizes and implements its plan and actually moves the USF funds, the risks that FCC identified will persist and the benefits of having the funds in the Treasury will not be realized.

In its May 2017 report, GAO made seven recommendations, including that FCC ensure plans to transfer the USF from the private bank to the Treasury are finalized and implemented expeditiously. FCC generally agreed with all the recommendations.

I am pleased to be here today to discuss the Federal Communications  Commission’s (FCC) oversight of the Lifeline program (Lifeline). Over the  past two decades, telecommunications carriers and their customers have  paid over $100 billion to support the federal policy of “universal service.”  Universal service is the principle that all Americans should have access to  communications services. FCC carries out this policy through four  programs, including Lifeline. Lifeline was created in the mid-1980s to  promote telephone subscribership among low-income households. In the  mid-2000s, such service came to include wireless communications, and,  in December 2016, FCC also began including broadband service.  Average Lifeline enrollment as of the fourth quarter of calendar year 2016  was approximately 12.3 million subscribers.

To participate in Lifeline, households must either have an income that is  at or below 135 percent of the Federal Poverty Guidelines or participate in  one of several qualifying assistance programs, such as Medicaid or the  Supplemental Nutrition Assistance Program (SNAP). After subscribers  are enrolled in Lifeline, they receive a monthly benefit on home or  wireless phone and broadband service. The Lifeline benefit can lower or  eliminate the cost of a subscriber’s monthly phone or Internet bill.

By statute, every telecommunications carrier providing interstate  telecommunications services—including Lifeline providers—must  contribute to federal universal service unless exempted by FCC.  Contributions are deposited into the Universal Service Fund (USF).  Although not required to do so, carriers typically pass on the cost of USF  fees as a separate line item to their customers’ phone bills. A not-for- profit, private corporation designated by FCC as the administrator of  universal service programs, the Universal Service Administrative  Company (USAC) pays Lifeline providers a subsidy from the USF for  each subscriber to offset forgone revenues. From calendar year 1998  through 2016, USAC had disbursed approximately $20.2 billion to Lifeline  providers.

In May 2017, we published a report on FCC’s oversight of Lifeline that  identified steps FCC has taken in the last few years to enhance the  integrity of the program and stated the weaknesses that remained. We  also made seven recommendations to improve FCC’s oversight of the  program, which the agency agreed to implement.

My statement today discusses key findings from our May 2017 report, as  well as steps FCC has taken and the related recommendations we made.  Specifically, this testimony discusses (1) the extent to which Lifeline  demonstrates effective performance towards program goals; (2) steps  FCC and USAC have taken to improve financial controls in place for  Lifeline and the USF, and any remaining weaknesses that might exist; (3)  steps FCC and USAC have taken to improve subscriber eligibility  verification, and any remaining weaknesses that might exist; and (4)  steps FCC and USAC have taken to improve oversight of Lifeline  providers, and any remaining weaknesses that might exist.

For our May 2017 report, we reviewed documents and interviewed  multiple stakeholders associated with Lifeline, including FCC, FCC’s  Office of Inspector General (OIG), and USAC, among others. We also  examined USAC financial data, including USF bank account statements  and payment data, and interviewed USF account managers at the bank  that holds USF funding. Further, we reviewed internal financial controls  established by FCC and USAC and performed data matching and  analysis to identify potential improper payments using Lifeline’s  enrollment data from the National Lifeline Accountability Database  (NLAD) and relevant beneficiary databases. The results of the data  analysis are illustrative rather than generalizable. We also performed  undercover work to test the vulnerability for improper payments of funds  disbursed to both subscribers and Lifeline providers. For example, we  submitted 21 Lifeline applications using false information and fabricated  supporting documents to determine whether we could obtain Lifeline  benefits. These undercover tests were for illustrative purposes to highlight  any potential internal control vulnerabilities and are not generalizable to  the broader universe of subscribers and providers. Additional information  on our scope and methodology is available in our May 2017 report. Our  audit work was performed in accordance with generally accepted  government auditing standards, and our related investigative work was  done in accordance with investigative standards prescribed by the  Council of the Inspectors General on Integrity and Efficiency.

FCC Has Not Evaluated Lifeline’s Performance in Meeting Program Goals but Has Taken Recent Steps toward Evaluation

FCC has not evaluated Lifeline’s performance in meeting program goals  but, as we found in May 2017, has taken recent steps toward evaluation.  According to GAO’s Cost Estimating and Assessment Guide, to use  public funds effectively the government must meet the demands of  today’s changing world by employing effective management practices and  processes, including the measurement of government program  performance. In the past, FCC has called for program evaluations to  review the administration of universal service generally, including Lifeline,  but has not completed such evaluations. For example, FCC specified that  it would review USAC 1 year after USAC was appointed as the  permanent administrator to determine whether the universal service  programs were being administered effectively. This review, which was  planned to have been completed by 1999, was never done. In 2005, FCC  awarded a contract to the National Academy of Public Administration to  study the administration of the USF programs generally, examine the  tradeoffs of continuing with the current structure, and identify ways to  improve the oversight and operation of universal service programs.  However, we reported in May 2017 that FCC officials stated FCC  subsequently terminated the contract and the study was not conducted.

In March 2015, we found that FCC had not evaluated Lifeline’s  effectiveness in achieving its performance goals of ensuring the  availability of voice service for low-income Americans, while minimizing  the burden on those who contribute to the USF. We recommended, and  FCC agreed, to conduct a program evaluation to determine the extent to  which Lifeline is efficiently and effectively reaching its performance goals.

Our May 2017 report raised additional questions about Lifeline’s  effectiveness in meeting its program goals. For example, we reported  that:

FCC did not know how many of the 12.3 million households receiving  Lifeline as of December 2016 also have non-Lifeline phone service  (for which they pay out of pocket) along with their Lifeline benefit.  Without knowing whether participants are using Lifeline as a primary  or secondary phone service, we concluded that it is difficult for FCC to  determine whether it is achieving the program’s goal of increasing  telephone subscribership among low-income consumers while  minimizing the USF contribution burden.

FCC revamped Lifeline in March 2016 to focus on broadband  adoption and generally phase out phone service, in part because FCC  recognized that most eligible consumers have phones without Lifeline  and to also close the “digital divide” of broadband adoption between  low-income households and the rest of the country. However,  broadband adoption rates have steadily increased for the low-income  population absent a Lifeline subsidy for broadband. We found that at  least two companies operating in a total of at least 21 states had  begun offering in-home non-Lifeline broadband wireline support for  less than $10 per month to individuals that participate in public- assistance programs, such as SNAP or public housing. The offered  rate of these providers’ own low-income broadband service of $10 per  month was less expensive than FCC’s broadband reasonable- comparability cost benchmark of approximately $55 per month, which  Lifeline subscribers would be paying for a similar level of service.

Our May 2017 report also found that FCC has recently taken some steps  toward evaluating Lifeline’s performance in meeting program goals.  Specifically, in the 2016 Lifeline Modernization Order, FCC instructed  USAC to hire an outside, independent, third-party evaluator to complete a  program evaluation of Lifeline’s design, function, and administration. The  order stipulated the outside evaluator must complete the evaluation and  USAC must submit the findings to FCC by December 2020. As FCC  expects Lifeline enrollment to increase as the program is expanded to  include broadband service, this expansion could carry with it increased  risks for fraud, waste, and abuse, as was the case with past expansions  of the program. Completing the program evaluation as planned, and as  we recommended in 2015, would help FCC determine whether Lifeline is  meeting its stated goals of increasing telephone and broadband  subscribership among low-income consumers, while minimizing the  burden on those who contribute to the USF.

Financial Controls Exist, with Others Planned, for the Lifeline Program, but Weaknesses Remain

In our May 2017 report we found that FCC and USAC have established  financial controls for Lifeline, including obtaining and reviewing  information about billing, collecting, and disbursing funds. They have also  developed plans to establish other controls, such as establishing a  national eligibility verifier (National Verifier) for Lifeline providers to  determine the eligibility of applicants seeking Lifeline service. However,  as discussed in our May 2017 report, we found that weaknesses remain,  including the lack of requirements to effectively control program  expenditures above approved levels, concerns about the transparency of  fees on customers’ telephone bills, and a lack of FCC guidance that could  result in Lifeline and other providers paying inconsistent USF  contributions. To address these concerns, we recommended the  Chairman of FCC (1) require Commissioners to review and approve, as  appropriate, spending above the budget in a timely manner; (2) require a  review of customer bills as part of the contribution audit to include an  assessment of whether the charges, including USF fees, meet FCC  Truth-in-billing rules with regard to labeling, so customer bills are  transparent, and appropriately labeled and described, to help consumers  detect and prevent unauthorized changes; and (3) respond to USAC  requests for guidance and address pending requests concerning USF  contribution requirements to ensure the contribution factor is based on  complete information and that USF pass-through charges are equitable.  FCC generally agreed with those recommendations.

In addition, we found that USAC’s banking practices for the USF result in  oversight and accountability risks that FCC has plans to mitigate.  Specifically, FCC maintains USF funds—whose net assets as of  September 2016 exceeded $9 billion—outside of the U.S. Treasury  pursuant to Office of Management and Budget (OMB) advice provided in  April 2000. OMB had concluded that the USF does not constitute public  money subject to the Miscellaneous Receipts Statute, 31 U.S.C. § 3302,  a statute that requires that money received for the use of the United  States be deposited in the Treasury unless otherwise authorized by law.  As such, USF balances are held in a private bank account. However,  subsequent to this OMB advice, in February 2005 we reported that FCC  should reconsider this determination in light of the status of universal  service monies as federal funds.

As discussed in our May report, according to correspondence we  received from the FCC Chairman’s Senior Legal Counsel, as of March  2017, FCC had decided to move the funds to the Treasury. FCC identified  potential benefits of moving the funds to the Treasury. For example, FCC  explained that having the funds in the Treasury would provide USAC with  better tools for fiscal management of the funds, including access to real- time data and more accurate and transparent data. According to FCC,  until the USF is moved into the Treasury, there are also some oversight  risks associated with holding the fund in a private account. For example,  the contract governing the account does not provide FCC with authority to  direct bank activities with respect to the funds in the event USAC ceases  to be the administrator of the USF. After we raised this matter with FCC  officials during the course of our review, beginning in November 2016,  FCC sought to amend the contract between USAC and the bank to  enable the bank to act on FCC instructions independently of USAC in the  event USAC ceases to be the administrator. However, as of May 2017,  the amended contract had not yet been signed.

While FCC has put in place a preliminary plan to move the USF funds to  the Treasury, as well as plans to amend the existing contract with the  bank as an interim measure, several years have passed since this issue  was brought to FCC’s attention without corrective actions being  implemented. Further, under FCC’s preliminary plan, it would not be until  next year, at the earliest, that the funds would be moved to the Treasury.  In May 2017, while reviewing a draft of this report, a senior FCC official  informed us that FCC experienced some challenges associated with  moving the funds to the Treasury, such as coordinating across the  various entities involved, which raised some questions as to when and  perhaps whether the funds would be moved. Until FCC finalizes and  implements its plan and moves the USF funds, the risks that FCC  identified will persist and the benefits of having the funds in the Treasury  will not be realized. As a result, in our May 2017 report, we recommended  that the Chairman of FCC take action to ensure that the preliminary plans  to transfer the USF funds from the private bank to the Treasury are  finalized and implemented as expeditiously as possible. FCC agreed with  this recommendation.

FCC and USAC Have Implemented Some Controls to Improve Subscriber Eligibility Verification, but Weaknesses Remain

FCC and USAC have implemented controls to improve subscriber  eligibility verification, such as implementing the NLAD database in 2014,  which helps carriers identify and resolve duplicate claims for Lifeline- supported services. However, as discussed in our May 2017 report, our  analysis of data from 2014, as well as our undercover attempts to obtain  Lifeline service, revealed significant weaknesses in subscriber eligibility  verification. Lifeline providers are generally responsible for verifying the  eligibility of potential subscribers, but we found that their ability to do so is  hindered by a lack of access to, or awareness of, state eligibility  databases that can be used to confirm eligibility prior to enrollment. For  example, not all states have databases that Lifeline providers can use to  confirm eligibility and some providers with whom we spoke were unaware  of databases that were potentially available to them. These challenges  might be overcome if FCC establishes a National Verifier, as it plans to do  nationwide by the end of 2019, to remove responsibility for verifying  eligibility from the providers. Additionally, since USAC was not  maintaining and providing information to providers about these  databases, we recommended they maintain and disseminate an updated  list of state eligibility databases available to Lifeline providers that  includes the qualifying programs those databases access to confirm  eligibility, to help ensure Lifeline providers are aware of state eligibility  databases and USAC audits of Lifeline providers can verify that available  state databases are being utilized to verify subscriber eligibility. FCC  agreed with the recommendation.

For our May 2017 report, to identify Lifeline subscribers who were  potentially ineligible to participate in the program, we tested the eligibility  of subscribers who claimed participation in Medicaid, SNAP, and  Supplemental Security Income (SSI) using NLAD data as of November  2014. We focused our analysis on these three programs because FCC  reported in 2012 that these were the three qualifying programs through  which most subscribers qualify for Lifeline. We compared approximately  3.4 million subscribers who, according to information entered in NLAD,  were eligible for Lifeline due to enrollment in one of these three programs  to eligibility data for these programs.

On the basis of our analysis of NLAD and public-assistance data, we  could not confirm that a substantial portion of selected Lifeline  beneficiaries were enrolled in the Medicaid, SNAP, and SSI programs,  even though, according to the data, they qualified for Lifeline by stating on  their applications that they participated in one of these programs. In  total, we were unable to confirm whether 1,234,929 subscribers out of the  3,474,672 who we reviewed, or about 36 percent, participated in the  qualifying benefit programs they stated on their Lifeline enrollment  applications or were recorded as such by Lifeline providers.

If providers claimed and received reimbursement for each of the 1.2  million subscribers, then the subsidy amount associated with these  individuals equals $11.4 million per month, or $137 million annually, at the  current subsidy rate of $9.25 per subscriber. Because Lifeline  disbursements are based on providers’ reimbursement claims, not the  number of subscribers a provider has in NLAD, our analysis of NLAD data  could not confirm actual disbursements associated with these individuals.  Given that our review was limited to those enrolled in SNAP or Medicaid  in selected case-study states, and SSI in states that participated in NLAD  at the time of our analysis, our data results are likely understated  compared to the entire population of Lifeline subscribers. These results  indicate that potential improper payments have occurred and have gone  undetected. We plan to refer potentially ineligible subscribers identified  through our analysis for appropriate action as warranted.

Our undercover testing, as discussed in our May 2017 report, also found  that Lifeline may be vulnerable to ineligible subscribers obtaining service  and the testing found examples of Lifeline providers being nonresponsive,  or providing inaccurate information. To conduct our 21 tests, we  contacted 19 separate providers to apply for Lifeline service. We applied  using documentation fictitiously stating that we were enrolled in an eligible  public-assistance program or met the Lifeline income requirements. We  were approved to receive Lifeline services by 12 of the 19 Lifeline  providers using fictitious eligibility documentation. We also experienced  instances during our undercover tests where our calls to providers were  disconnected, and where Lifeline provider representatives transmitted  erroneous information, or were unable to provide assistance on questions  about the status of our application. For example, one Lifeline provider told  us that our application was not accepted by the company because our  signature had eraser marks; however our application had been submitted  via an electronic form on the provider’s website and was not physically  signed. While our tests are illustrative and not representative of all Lifeline  providers or applications submitted, these results suggest that Lifeline  providers do not always properly verify eligibility and that applicants may  potentially encounter similar difficulties when applying for Lifeline benefits.  As described above, these challenges might be overcome if FCC  establishes a National Verifier, as it plans to do nationwide by the end of  2019, to remove responsibility for verifying eligibility from the providers.

FCC and USAC Have Taken Some Steps to Improve Oversight of Lifeline Providers, but Remaining Gaps Could Allow Noncompliance with Program Rules

FCC and USAC have implemented some mechanisms to enhance  oversight of Lifeline providers, as discussed in our May 2017 report, but  we found that remaining gaps could allow noncompliance with program  rules. For example, in July 2014, FCC took additional measures to  combat fraud, waste, and abuse by creating a strike force to investigate  violations of USF program rules and laws. According to FCC, the creation  of the strike force is part of the agency’s commitment to stopping fraud,  waste, and abuse and policing the integrity of USF programs and funds.  Similarly, in June 2015, FCC adopted a rule requiring Lifeline providers to  retain eligibility documentation used to qualify consumers for Lifeline  support to improve the auditability and enforcement of FCC rules.

However, we found FCC and USAC have limited oversight of Lifeline  provider operations and the internal controls used to manage those  operations. The current structure of the program relied throughout 2015  and 2016 on over 2,000 Eligible Telecommunication Carriers (ETC) to  provide Lifeline service to eligible beneficiaries. These companies are  relied on to not only provide telephone service, but also to create Lifeline  applications, train employees and subcontractors, and make eligibility  determinations for millions of applicants. USAC’s reliance on Lifeline  providers to determine eligibility and subsequently submit accurate and  factual invoices is a significant risk for allowing potentially improper  payments to occur, and under current reporting guidelines these  occurrences would likely go undetected and unreported. Federal internal  control standards state that management retains responsibility for the  performance and processes assigned to service organizations performing  operational functions. Consistent with internal control standards, FCC and  USAC would need to understand the extent to which a sample of these  internal controls are designed and implemented effectively to ensure  these controls are sufficient to address program risks and achieve the  program’s objectives.

We identified key Lifeline functions for which FCC and USAC had limited  visibility. For example, we found instances of Lifeline providers utilizing  domestic or foreign-operated call centers for Lifeline enrollment. When we  asked FCC officials about Lifeline providers that outsource program  functions to call centers, including those overseas, they told us that such  information is not tracked by FCC or USAC. With no visibility over these  call centers, FCC and USAC do not have a way to verify whether such  call centers comply with Lifeline rules. FCC and USAC have limited  knowledge about potentially adverse incentives that providers might offer  employees to enroll subscribers. For example, some Lifeline providers  pay commissions to third-party agents to enroll subscribers, creating a  financial incentive to enroll as many subscribers as possible. Companies  responsible for distributing Lifeline phones and service that use incentives  for employees to enroll subscribers for monetary benefit increase the  possibility of fictitious or ineligible individuals being enrolled into Lifeline.  Highlighting the extent of the potential risk for companies, in April 2016  FCC announced approximately $51 million in proposed fines against one  Lifeline provider, due to, among other things, its sales agents purposely  enrolling tens of thousands of ineligible and duplicate subscribers in  Lifeline using shared or improper eligibility documentation.

To test internal controls over employees associated with Lifeline for our  May 2017 report, we sought employment with a company that enrolls  individuals to Lifeline. We were hired by a company and were allowed to  enroll individuals in Lifeline without ever meeting any company  representatives, conducting an employment interview, or completing a  background check. After we were hired, we completed two fictitious  Lifeline applications as an employee of the company, successfully  enrolled both of these fictitious subscribers into Lifeline using fabricated  eligibility documentation, and received compensation for these  enrollments. The results of these tests are illustrative and cannot be  generalized to any other Lifeline provider. We plan to refer this company  for appropriate action as warranted. As stated above, these challenges  might be overcome if FCC establishes a National Verifier, as it plans to do  nationwide by the end of 2019, to remove responsibility for verifying  eligibility from the providers. In addition, in May 2017, we made two  recommendations to help address control weaknesses and related  program-integrity risks. Specifically, we recommended that FCC establish  time frames to evaluate compliance plans and develop instructions with  criteria for FCC reviewers how to evaluate these plans to meet Lifeline’s  program goals. We also recommended that FCC develop an enforcement  strategy that details what violations lead to penalties and apply this as  consistently as possible to all Lifeline providers to ensure consistent  enforcement of program violations. FCC generally agreed with these  recommendations.

In conclusion, Lifeline’s large and diffuse administrative structure creates  a complex internal control environment susceptible to significant risk of  fraud, waste, and abuse. FCC’s and USAC’s limited oversight of  important aspects of program operations further complicates the control  environment—heightening program risk. We are encouraged by FCC’s  recent steps to address weaknesses we identified, such as the 2016  order establishing a National Verifier, which, if implemented as planned,  could further help to address weaknesses in the eligibility-determination  process. We also plan to monitor the implementation status of the  recommendations we made in May 2017.

Chairman Thune, Ranking Member Nelson, and members of the  Committee, this concludes my prepared remarks. I would be happy to  answer any questions that you may have at this time.

For further information regarding this testimony, please contact Seto J.  Bagdoyan at (202) 512-6722 or bagdoyans@gao.gov. In addition, contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this statement. Individuals who made key  contributions to this testimony are Dave Bruno (Assistant Director), Scott  Clayton (Analyst-in-Charge), and Daniel Silva.

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.