Committee on Foreign Investment in the United States: Treasury Should Coordinate Assessments of Resources Needed to Address Increased Workload

The United States economy has historically been the largest recipient of foreign direct investment in the world—receiving $373 billion in 2016, according to U.S. government statistics. Ensuring that these foreign investments do not harm national security can be a challenge. CFIUS is an interagency group that reviews transactions under its authority—certain foreign acquisitions or mergers of U.S. businesses—to determine their effects on U.S. national security, while maintaining an open investment climate. If CFIUS identifies concerns, it may work with parties to the transaction to mitigate them. In rare cases, CFIUS may recommend that the President block or suspend a transaction.

GAO was asked to review the CFIUS process and possible changes to that process. This report (1) examines changes in CFIUS's workload and staffing from 2011 through 2016, and (2) provides information on stakeholder views on potential changes to CFIUS. GAO analyzed CFIUS information on staffing levels and transactions reviewed, and interviewed officials from member agencies, selected nonmember agencies that have CFIUS-related expertise, and knowledgeable external experts, such as think tanks.

states that management should establish the organizational structure necessary to achieve its objectives and periodically evaluate this structure. Treasury—the agency that leads CFIUS— has not coordinated member agencies' efforts to better understand the staffing levels needed to address the current and future workload associated with core functions of the committee. Without this information, CFIUS may be limited in its ability to fulfill its objectives and address national security concerns.

Officials from CFIUS member agencies and selected nonmember agencies, as well as external experts, expressed a range of views on the potential benefits and drawbacks to possible changes to CFIUS. GAO organized the possible changes into three categories: (1) altering the structure of CFIUS, (2) redefining which transactions should be considered for CFIUS review, and (3) expanding the factors CFIUS considers when evaluating the impacts of a foreign transaction on national security. Agency officials were generally satisfied with CFIUS' structure, such as the committee's chair and membership. Views among officials and experts varied on redefining which transactions should be considered for review, such as requiring CFIUS to review all transactions covered by its authority regardless of notification. Officials and experts generally did not support expanding the list of national security factors CFIUS considers, such as by adding a net economic benefit test. Agency officials and experts agreed that one trade-off related to some possible changes is a likely increase to the CFIUS workload, which they noted is already straining agencies' staff resources.

Treasury, as CFIUS lead, should coordinate member agencies' efforts to better understand the staffing levels needed to address the current and projected CFIUS workload associated with core committee functions. Treasury concurred.

The United States economy has historically been the world’s largest  recipient of foreign direct investment, receiving $373.4 billion in 2016,  according to the Bureau of Economic Analysis. The Bureau also reported  that businesses acquired, established, or expanded by foreign direct  investors employed 480,800 workers in the United States that year.  Ensuring that these foreign investments do not harm U.S. national  security can be a challenge. Concerns have included foreign acquisitions  of U.S. companies in traditional sectors, such as semiconductors, and  cutting-edge fields, such as artificial intelligence, as well as an increase in  the number of acquisitions from certain countries. The Committee on  Foreign Investment in the United States (CFIUS) is an interagency  committee that reviews certain foreign acquisitions, mergers, or takeovers  of U.S. businesses to determine the effect of a transaction on the national  security of the United States. Informed by the committee’s review, the  President of the United States has the authority to block or suspend a  transaction that threatens to impair the national security of the United  States. In the wake of concerns about the acquisition of commercial port  operations for six U.S. ports by Dubai Ports World—a company based in  the United Arab Emirates—Congress passed the Foreign Investment and  National Security Act of 2007 (FINSA). The FINSA amendments  currently guide the CFIUS review process. Congressional bills have been  introduced proposing ways to reform the CFIUS process.

You asked us to review issues related to the CFIUS process and possible  changes to that process. This report (1) examines changes in CFIUS’s  workload and staffing from 2011 through 2016, and (2) provides  information on stakeholder views on potential changes to CFIUS.

To address these objectives, we reviewed relevant laws, executive  orders, and regulations. We analyzed information on workload and  staffing levels to determine the extent to which CFIUS workload and  staffing levels have changed from 2011 through 2016, the most recent  information available at the time of our review. We also conducted  individual semistructured interviews with selected stakeholders, which  consisted of officials from the 9 CFIUS voting member agencies, the 2 ex  officio nonvoting member agencies, and 3 selected nonmember agencies  that have CFIUS case-related expertise, as well as with 16 external  experts to collect views and information on the challenges, such as  workload, that CFIUS faces, potential changes to address the challenges,  and their possible benefits and drawbacks. The information obtained from  these stakeholders cannot be generalized across all stakeholders.  Appendix I provides more information on our scope and methodology.

We conducted this performance audit from December 2016 to February  2018 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

In 1975, an executive order established CFIUS to monitor the impact of  and coordinate U.S. policy on foreign investment in the United States. In  1988, Congress enacted the Exon-Florio amendment adding section 721  to the Defense Production Act of 1950. The amendment authorized the  President to investigate the impact of certain foreign acquisitions of U.S.  companies on national security and to suspend or prohibit acquisitions  that might threaten to impair national security. FINSA further amended  the Defense Production Act, established CFIUS as it currently exists, and  guides the committee. One of the purposes of FINSA’s enactment was to  ensure national security while promoting foreign investment and the  creation of U.S. jobs.

CFIUS reviews transactions involving a large variety of countries and  industry sectors to determine if such transactions pose a threat to national  security and whether the transactions should be allowed to proceed (for  more information on the characteristics of transactions reviewed by  CFIUS, see app. II). FINSA does not formally define national security, but  provides a number of factors for CFIUS and the President to consider in  determining whether a transaction poses a risk. These factors include the  potential national security-related effects on U.S. critical technologies and  whether the transaction could result in the control of a U.S. business by a  foreign government. CFIUS also may consider other factors that it finds  appropriate in determining whether a transaction poses a national  security risk (for a full list of factors, see app. III).

Under FINSA, CFIUS is chaired by the Secretary of the Treasury and  includes voting members from the Departments of Commerce, Defense,  Energy, Homeland Security, Justice, and State; and the Offices of the  U.S. Trade Representative, and Science and Technology Policy. In  addition, the Office of the Director of National Intelligence (ODNI) and the  Department of Labor (DOL) are nonvoting ex officio members. Various  other White House offices also observe and, as appropriate, participate in  CFIUS activities (see fig. 1). CFIUS may also solicit perspectives and  expertise from nonmember agencies, such as the Department of  Agriculture, designating them as members for purposes of the review of  particular transactions, as appropriate, which can include negotiating or  imposing mitigation measures or referring the transaction to the President  for decision. The committee, which meets weekly at a staff level,  generally has three core functions: (1) review transactions that have been  submitted to the committee and take action as necessary to address any  national security concerns; (2) monitor and enforce compliance with  mitigation measures; and (3) identify transactions of concern that have  not been notified to CFIUS for review.

The Secretary of the Treasury, as the chair of CFIUS, is responsible for a  number of tasks. According to Department of the Treasury (Treasury)  officials, these tasks, including coordinating operations of the committee,  facilitating information collection from parties to a transaction, reviewing  and sharing data on mergers and acquisitions with member agencies,  and managing CFIUS timeframes, are carried out by Treasury employees  specifically staffed to support CFIUS. Treasury also communicates on the  committee’s behalf with the parties, members of Congress, and the  general public. When necessary, Treasury is responsible for delivering  the committee’s recommendation that the President should suspend or  prohibit a transaction.

In examining covered transactions, CFIUS members seek to identify and  address, as appropriate, any national security concerns that arise as a  result of the transaction. According to the FINSA amendment, a “covered”  transaction is defined as any merger, acquisition, or takeover by or with  any foreign person that could result in foreign control of any person  engaged in interstate commerce in the United States. CFIUS reviews  “notices” that have been submitted—or notified—to the committee by  parties to transactions. Notices to CFIUS contain information about the  nature of the transaction and the parties involved. According to guidance  on the Treasury website, with limited exceptions, a transaction receives  “safe harbor” when CFIUS has completed its review and determines that  the transaction may proceed. According to Treasury officials, safe harbor  provides the parties to the transaction some certainty that CFIUS and the  President will not subject the transaction to review again.

FINSA does not require that parties notify CFIUS of a transaction;  however, CFIUS may choose to initiate a review of any covered  transaction. Transactions that have not been notified to CFIUS for  review are known as “non-notified transactions.” According to member  agency officials, Treasury and several other member agencies have  processes for identifying non-notified transactions for CFIUS to potentially  review. For instance, Treasury staff compile data on mergers and  acquisitions and distribute information about potential non-notified  transactions to member agencies for review. In addition, according to  member agency officials, in 2010, the Federal Bureau of Investigation  (FBI) began a working group, now called Project Iceberg, which is  responsible for identifying and understanding counterintelligence threats  posed by foreign investments that have not been notified to CFIUS. The  working group holds monthly meetings that intelligence agencies as well  as CFIUS member agencies are invited to attend. In the absence of  voluntary reporting by the parties involved or independent discovery of  the transaction, it is possible that CFIUS may not review a covered  transaction that could pose a risk to national security.

CFIUS Process for Reviewing Notified Transactions

Based on information including FINSA and regulations, the CFIUS  process for reviewing transactions that have been notified to the  committee comprises up to four stages: pre-notice consultation, national  security review, national security investigation, and presidential action.  CFIUS reviews each transaction individually, with a focus on the aspects  of the transaction that could pose a risk. For each transaction reviewed,  the committee identifies agencies with relevant expertise to act as co-lead  with Treasury to guide the transaction through the CFIUS process.  CFIUS reviews are confidential and protected from public disclosure. A  CFIUS review could be concluded when CFIUS members reach  consensus about whether the transaction should be allowed to proceed,  including on the basis of mitigation, if necessary, or when the parties  withdraw their notice, whether for commercial reasons or in light of  CFIUS’s national security concerns. Absent one of these conclusions to  a CFIUS review, the committee may send the transaction to the  President, with a recommendation that the President suspend or prohibit  it. See figure 2 for an overview of the steps that comprise the CFIUS  process for reviewing selected transactions.

Before a transaction is reviewed by CFIUS, Treasury may conduct a pre- notice consultation with parties to a notified transaction. Upon request,  Treasury and other agencies meet with the parties, provide informal  guidance on the CFIUS review process, and may review early drafts of  the notice.

Once the parties have developed the final draft, they submit it to the  committee for review. When Treasury, with input from member agencies,  determines that the notice of the transaction is complete, the official  CFIUS review of the transaction commences.

CFIUS conducts a national security review of each notified transaction,  which includes determining whether it is a covered transaction and  developing a national security threat assessment. The national security  review lasts up to 30 days and begins the day after Treasury determines  the filing is complete and circulates the filing to CFIUS member agencies.  At the beginning of the national security review, CFIUS identifies co-lead  agencies. According to Treasury officials, typically within the first 10 to 12  days of the national security review, CFIUS develops a “covered  transaction analysis,” which determines whether the transaction is a  covered transaction according to FINSA. According to Treasury officials,  there typically is consensus among voting members on whether the  transaction is a covered transaction. During the national security review,  CFIUS also assesses whether there is credible evidence that the foreign  party in control of that U.S. business might take action to impair the  national security of the United States as well as whether the covered  transaction is a foreign government-controlled transaction. Concurrently,  ODNI develops a national security threat assessment, with input and  support from the intelligence community, to be completed during the first  20 days of the national security review.

If CFIUS finds that the covered transaction does not present national  security risks or that other provisions of law provide adequate and  appropriate authority to address the risks, CFIUS may end its review. If  CFIUS chooses to conclude its review at this point, CFIUS is to advise  the parties in writing that the transaction has been cleared and allowed to  proceed. According to information provided by Treasury, CFIUS has  historically concluded action on the majority of transactions during or at  the end of the 30-day national security review. The committee’s  determination must be certified to specified members of Congress after  the review is completed. However, if at the end of the national security  review, CFIUS has not yet determined that there are no unresolved  national security concerns and the committee requires additional time,  CFIUS may proceed to a national security investigation, which must be  completed within 45 days.

If, during the 45-day national security investigation, CFIUS identifies an  unresolved national security concern, it works with the parties to mitigate,  if appropriate, any national security risks that may exist. If an agency  identifies an unresolved national security concern, the agency develops  an analysis of the potential risks posed by the covered transaction and  includes recommendation for action, such as mitigation measures or  referral to the President, and shares this analysis with other members of  the committee. Mitigation measures may include ensuring that only  authorized persons have access to certain technologies, information, or  facilities, or providing the U.S. government the right to review certain  business decisions and to object if the decisions raise national security  concerns. According to Treasury officials, CFIUS member agencies aim  for mitigation that would be effective, can be monitored, and would be  enforceable. If there is a difference of opinion among CFIUS member  agencies about the level or type of mitigation that should be utilized,  CFIUS agencies discuss the matters to reach consensus.

In some cases, parties may choose to withdraw and resubmit the notice.  If CFIUS has determined that national security concerns cannot be  mitigated, according to Treasury officials, CFIUS typically advises the  parties that the committee will refer the matter to the President for  decision. According to Treasury officials, parties have the opportunity to  withdraw and resubmit the notice if they need additional time to discuss  CFIUS’s concerns or to present additional information or mitigation  proposals for CFIUS’s consideration. Sometimes parties choose to  withdraw and abandon the transaction if, for instance, CFIUS proposes  mitigation measures that the parties choose not to accept. Parties may  also abandon the transaction for commercial reasons unrelated to the  CFIUS review. If parties choose to withdraw and resubmit a transaction,  the national security review begins again, and the committee has another  75 days to complete the review of the transaction.

If CFIUS obtains consensus from committee members that there are no  unresolved national security concerns or the national security concerns  have been mitigated, the national security investigation ends, and the  covered transaction receives safe harbor. Treasury and the co-lead  agency send written certification to specified members of Congress that  there are no unresolved national security concerns. However, if the  committee concludes that a proposed foreign investment threatens to  impair the U.S. national security and the threat cannot be mitigated,  CFIUS will elevate the notice to the President for determination and  CFIUS may recommend that the President suspend or prohibit the  transaction. According to Treasury officials, parties may also withdraw  their notice at this point rather than have the President decide whether to  block the transaction.

If, at the end of the national security investigation, CFIUS elevates a  transaction to the President for determination, the President has 15 days  from the completed investigation to decide to prohibit or suspend the  acquisition, or to take no action. Only four transactions reviewed by  CFIUS have been the subject of a presidential prohibition since the  committee was established in 1975.

Stakeholders Have Concerns about the Increased CFIUS Workload but Treasury Has Not Coordinated Staffing Level Assessments

CFIUS has experienced an increase in workload in recent years, but  Treasury, as CFIUS lead, has not coordinated member agency efforts to  better understand staffing levels needed to complete core committee  functions. According to CFIUS member agency officials, the volume of  transactions notified to the committee and the complexity of CFIUS  reviews in terms of technology, transaction structure, and national  security concerns have increased substantially from 2011 through 2016,  while CFIUS staffing levels have experienced a modest increase during  the same time period. Member agency officials stated that CFIUS is able  to review all transactions that have been voluntarily notified to the  committee. However, many stakeholders, including most member agency  officials and several external experts, expressed concerns that CFIUS  member agencies were limited in their ability to complete other CFIUS  functions, such as identifying non-notified transactions. In addition,  agency officials were unsure if they would have sufficient staff if the  CFIUS workload were to continue to increase. Standards for Internal  Control in the Federal Government states that management should  establish the organizational structure necessary to achieve its objectives  and periodically evaluate this structure. Treasury has not coordinated  member agency efforts to better understand the staffing levels needed to  complete the current and future workload associated with core functions  of the committee.

The Volume of Covered Transactions CFIUS Reviewed Increased between 2011 and 2016

Despite figures decreasing in one year, overall, the number of covered  transactions that CFIUS reported it reviewed increased from 111  transactions in 2011 to 172 transactions in 2016, or almost 55 percent  (see table 1). In 2017, CFIUS reviewed 238 transactions, according to  Treasury officials. According to member agency officials, the increased  volume of covered transactions resulted in increased work for all CFIUS  members, no matter which agency is the co-lead, because each member  agency must review each transaction notified to the committee.

The number of reported covered transactions requiring national security  investigations almost doubled during this same period, increasing from 40  transactions in 2011 to 79 transactions in 2016. Treasury officials told us  that they estimated that the total number of transactions that proceeded  to national security investigations was greater in 2017 than it was in  2016. They said that the increase in the number of covered transactions  that require a national security investigation is another indication that the  committee’s workload has increased. One Treasury official noted that the  number of times that parties withdraw and resubmit transactions can  increase the workload of the committee as it must review the transaction  each time it is submitted.

Additionally, the number of reported covered transactions that include  mitigation measures has increased. Each year, CFIUS places mitigation  measures on a relatively small number of covered transactions. For  example, according to Treasury officials, 18 (roughly 10 percent) of 172  transactions the committee reviewed in 2016 resulted in mitigation  measures. According to member agency officials, mitigation measures  rarely expire; thus, the number of these measures increases over time, as  does the accompanying workload for co-lead agencies tasked with  overseeing the measures.

The Increased Complexity of CFIUS Reviews Has Increased CFIUS Workload

Officials from CFIUS member agencies stated that the complexity of  CFIUS reviews in terms of technology, transaction structure, and national  security concerns has increased in recent years. They said that additional  time and staff have been required to address this rise in complexity and to  complete these reviews. For instance, one member agency official told us  that reviews of transactions from parties whose companies use new and  emerging technologies, such as artificial intelligence and robotics,  typically require input from agency subject matter experts to help the  committee understand how, if at all, the acquisition of these technologies  by foreign parties could create national security concerns.

According to member agency officials, the amount of time and number of  staff needed to review a transaction can fluctuate greatly based on,  among other things, the technology involved. One agency official said that  6 of their employees, on average, are involved in reviewing a less  complex transaction, but up to 15 employees may be necessary to  complete the review if the technology involved is more complicated. The  number of agency staff involved can increase further if senior level  management is required to participate in the review. This official also  stated that most of the transactions reviewed in the past were from  sectors that agency officials were familiar with and involved more  predictable issues, but recently, transactions more frequently involved  complex technology, which required additional expertise. Officials from  another member agency stated that a majority of their staff involved in  reviewing transactions do not have CFIUS as a primary duty and that  their agency has reallocated resources to address the increased case  load. One Treasury official stated that one case was so complex that it  required one staff member to dedicate all of their time to its review, and  the other responsibilities of this employee had to be shifted to other  members of the staff.

Additionally, according to member agency officials, reviews of  transactions involving technologies the government frequently uses have  increased, requiring additional time and staff to understand how this  technology affects various agencies. For instance, member agency  officials said that reviewing transactions involving semiconductors, which  are commonly used in an array of products used by the government,  typically requires additional time and staff because CFIUS member  agencies must understand, among other things, how the approval of a  transaction could affect systems across government agencies.

According to CFIUS member agency officials, the structures of the  transactions the committee reviews have also become more complex,  requiring more time and staff to assess. For example, business  arrangements—such as complex corporate arrangements, joint ventures,  loan arrangements, nondisclosure agreements, and memoranda of  understanding—may require the work of additional staff. Treasury officials  also stated that these arrangements can make it more difficult to  determine whether the transaction is covered by CFIUS authorities, as  there may be commercial relationships that affect the parties’ decision- making. According to Treasury officials, such arrangements can also  increase the complexity of the national security review, as they may  create additional “indirect threats” that must also be analyzed.

Member agency officials explained that it has become more challenging  to identify the ultimate beneficial owners—the persons who ultimately own  and control a company—due to the structure of the transaction. According  to Treasury officials, in certain countries, it can be difficult to distinguish  between control by a private entity and control by a state entity due to the  various relationships created by the transaction structure. In these cases,  CFIUS often requires additional information from the parties in such  transactions before the national security review can begin. Member  agency officials stated that they had been encountering these  arrangements more frequently, and additional time and staff had been  required to examine the national security implications of these  transactions.

Finally, the nature of the national security concerns the committee  considers has expanded beyond the traditional threats, requiring more  time and staff to assess them, according to member agency officials.  National security concerns include traditional ones, such as threats to  U.S. critical infrastructure. Emerging concerns include the possibility of a  foreign entity obtaining access to personally identifiable information that, if  disclosed, could be exploited for purposes that have national security  consequences or the proximity of property to areas considered sensitive  by the U.S. government.

Treasury Has Not Coordinated Assessments of Staffing Levels Needed to Complete CFIUS Core Functions

According to agency officials, the number of staff assigned to CFIUS  activities has not kept pace with the increase in covered transactions  reviewed by CFIUS. According to one Treasury official, the more an  agency is required to act as co-lead, the more time and staff are needed  of the agency. After Treasury, which acts as co-lead on every review, the  Departments of Defense (DOD), Energy (DOE), and Homeland Security  (DHS) acted as co-lead on the largest number of CFIUS reviews in 2016  (see table 2).

According to information provided by member agency officials, CFIUS  saw a modest increase in staff assigned to CFIUS activities since 2011,  with Treasury, DOD, DOE, DHS, and State adding a few staff, while  staffing levels did not rise at the other member agencies. The total  number of staff assigned to CFIUS activities increased from 82 in 2011 to  91 in 2016, an increase of 11 percent. During that same period, covered  transactions reviewed by CFIUS increased from 111 transactions in 2011  to 172 transactions in 2016, an increase of almost 55 percent (see fig. 3).

Member agency officials stated that the number of staff assigned to work  on CFIUS activities may fluctuate throughout the year based on the  committee’s work. For example, as previously discussed, CFIUS member  agencies may rely on experts with other responsibilities throughout each  agency to provide assistance with the review as the need arises. For  instance, in fiscal year 2016, DOE had four staff dedicated to CFIUS, but  one DOE official said he reaches out to relevant subject matter experts,  who have other responsibilities, to provide input on transactions within  their area of expertise.

Treasury officials stated that staff have been able to review the number of  transactions that have been voluntarily notified to CFIUS to date. One  Treasury official said that, despite the increase in the number of  transactions reviewed by CFIUS, the committee has almost always  provided a determination to the parties within the timeframes required as  to whether the covered transaction should be allowed to proceed or  blocked by the President. Further, Treasury officials stated that despite  staff constraints, CFIUS has, as needed, appropriately mitigated the  national security concerns for the transactions the committee has  approved.

However, several member agency officials and external experts  expressed concerns that, due to staff constraints, CFIUS member  agencies were limited in their ability to complete other CFIUS functions,  such as monitoring mitigation measures and identifying non-notified  transactions. First, the time and staff necessary to monitor mitigation  measures varies. For instance, according to one member agency official,  some mitigation measures require daily monitoring from officials, while  other mitigation measures require only the review of an annual report  submitted by parties to the transaction. Several member agency officials  acknowledged that they have fewer staff than they would like to devote to  monitoring mitigation measures.

Second, these member agency officials also said that they are not able to  devote the amount of time they would like to the task of identifying non- notified transactions. CFIUS member agencies review data on mergers  and acquisitions to identify non-notified transactions of concern, those  that have not been notified to CFIUS for review. In recent years,  according to agency officials, CFIUS has seen an increase in the number  of non-notified transactions CFIUS could potentially review. One official  indicated that in 2016, their agency examined 2,683 potential non-notified  transactions, an increase of roughly 38 percent from 2014. Member  agency officials stated that because non-notified transactions are  frequently reviewed after the acquisition has been completed, the process  of mitigating potential national security concerns of non-notified  transactions can be difficult. Several member agency officials suggested  that they would like to devote more time to examining non-notified transactions, but staff constraints limit the amount of time agencies can  spend conducting this task.

Several member agency officials said that they do not know if current  staffing levels would be able to address a further increase in CFIUS  workload. Treasury officials noted that the volume of transactions  reviewed by CFIUS will likely continue to increase. Moreover,  congressional bills have been introduced that, if enacted, would alter the  CFIUS process. As discussed later in this report, agency officials stated  that some of these potential changes would likely further increase CFIUS  workload. According to several CFIUS member agency officials, if the  CFIUS workload were to increase, additional staff would likely be  necessary to complete committee functions, such as identifying non- notified transactions and monitoring mitigation measures. Officials from  two member agencies also expressed concerns about their ability to  review transactions that have been notified to the committee if the volume  of CFIUS notices increased.

According to Treasury officials, CFIUS does not have a centralized  budget, and Treasury does not have authority to determine CFIUS  staffing levels at committee member agencies. Treasury officials stated  that they have taken steps, in coordination with the Office of Management  and Budget (OMB), to collect data from the member agencies on current  staffing levels expended on CFIUS core functions but have not  established timeframes for this data collection. Standards for Internal  Control in the Federal Government states that management should  establish the organizational structure necessary to achieve its objectives  and periodically evaluate this structure. Treasury officials stated that they  have conducted an assessment of Treasury’s staffing needs and have  encouraged other agencies to do the same. However, Treasury, as  CFIUS lead, has not coordinated member agencies’ efforts to better  understand the staffing levels needed to address the current and future  CFIUS workload associated with core committee functions, such as  identifying and reviewing non-notified transactions. Without this  information, CFIUS may be limited in its ability to fulfill its objectives and  address threats to the national security of the United States.

CFIUS Member Agencies and External Experts Provided Views on Benefits and Drawbacks of Possible Changes to CFIUS

Officials from CFIUS member agencies (voting and nonvoting) and  selected nonmember participant agencies, as well as external experts,  expressed a range of views on the potential benefits and drawbacks to  possible changes to CFIUS. In our interviews with them, these  stakeholders discussed a variety of possible changes to CFIUS that we  organized into three categories: (1) altering the structure of CFIUS, (2)  redefining which merger and acquisition transactions should be  considered for CFIUS review, and (3) expanding the list of factors CFIUS  considers as it evaluates the impacts of a foreign transaction on national  security. For the most part, CFIUS member agencies and nonmember  participant agencies stated that the existing structure is working  effectively and described drawbacks to potential changes, such as  changing membership or voting rights. Perspectives among agency  officials and external experts varied on the potential effects of redefining  which transactions should be considered for review, such as requiring  CFIUS to review all covered transactions. Agency officials and external  experts described a range of potential effects of expanding the list of  factors CFIUS considers. They generally stated that including a net  economic benefit test in the review, for example, would not be beneficial.  Many officials and external experts agreed that one potential drawback of  many of the possible changes is a likely increase to the CFIUS workload,  generating concerns about the committee’s capacity to complete its core  functions.

Agencies Participating in CFIUS Were Generally Satisfied with the Structure of the Committee

In general, officials from member and nonmember agencies participating  in CFIUS were satisfied with the structure of the committee. Possible  changes, which would affect the way CFIUS is organized and does its  work, include changes to the chairmanship of CFIUS, changes to the  voting membership of CFIUS (adding new voting members and giving  voting rights to current nonvoting members), and changes to the  timeframes under which CFIUS works. However, for the most part, CFIUS  member agencies and nonmember participant agencies reported that the  existing structure works effectively. See tables 3, 4, 5, and 6 for details on  the perspectives expressed on these changes.

Perspectives Varied on the Effects of Changes to the Types of Transactions to Be Considered for CFIUS Review

Member agency officials and external experts offered a range of views  about the effects of changes to the types of transactions reviewed by  CFIUS. Possible changes, which would affect which merger and  acquisition transactions would be considered for CFIUS review, include  changes to the definition of a covered transaction and changing the  voluntary notification process to make review of all or some covered  transactions mandatory. Stakeholders we spoke with identified benefits  and drawbacks to each of these changes. Many stakeholders agreed that  one potential drawback of these possible changes is a likely increase to  the CFIUS workload. See tables 7, 8, and 9 for details on the  perspectives expressed.

Most Stakeholders Were Satisfied with the Factors CFIUS Currently Considers in Reviewing Foreign Transactions

Member agency officials and external experts were generally satisfied  with the list of factors CFIUS currently considers when it reviews foreign  transactions and offered a variety of opinions on the effects of changes to  them. Possible changes include expanding the statutory national security  factors to be considered and introducing an economic impact  assessment. Stakeholders we spoke with identified benefits and  drawbacks to each of these changes. See tables 10 and 11 for details on  the perspectives expressed.

The United States maintains an open investment climate that recognizes  the benefits of foreign investment to its economy. CFIUS reviews certain  foreign acquisitions, mergers, or takeovers of U.S. businesses to  determine the effect of the transaction on the national security of the  United States. The increased number of covered transactions notified to  CFIUS and the complexity of these cases compared with the modest  increase in the number of people assigned to reviewing them have,  according to member agency officials, taxed the staff of CFIUS member  agencies. Member agency officials and external experts have expressed  particular concern that CFIUS member agencies were limited in their  ability to complete core functions, such as identifying non-notified  transactions and monitoring mitigation measures. At the same time,  congressional bills have been introduced proposing changes to FINSA  that could increase the committee’s workload. Officials from Treasury and  other member agencies are aware of pressures on their CFIUS staff  given the current workload and have expressed concerns about possible  workload increases. Treasury and OMB have begun to collect information  from agencies on their current CFIUS staffing levels. This is a crucial first  step that could facilitate a better understanding for both the committee  and Congress of the current staffing levels across the committee’s  organizational structure. However, Treasury, as CFIUS lead, has not  coordinated member agency efforts to assess the current and future  staffing levels needed to complete the committee’s core functions.  Without attaining an understanding of the staffing levels needed to  address the current and future CFIUS workload, particularly if legislative  changes to CFIUS’s authorities further expand its workload, CFIUS may  be limited in its ability to fulfill its objectives and address threats to the  national security of the United States.

The Secretary of the Treasury, as the chair of CFIUS, and working with  member agencies, should coordinate member agencies’ efforts to better  understand the staffing levels needed to address the current and  projected CFIUS workload associated with core committee functions.  (Recommendation 1)

We provided a draft of this report for review and comment to the  Departments of Agriculture, Commerce, Defense, Energy, Health and  Human Services, Homeland Security, Justice, Labor, State, and the  Treasury as well as the Offices of the U.S. Trade Representative, Science  and Technology Policy, and the Director of National Intelligence, and the  Federal Communications Commission. We also provided a draft to the  Office of Management and Budget.

Treasury provided written comments, which are reproduced in appendix  V. In its comments, Treasury stated that it is working with OMB to  determine current resource levels across the CFIUS member agencies  and has encouraged agencies to assess their staffing needs. Treasury  also stated that it generally concurred with the draft report’s  recommendation to “conduct an assessment to better understand staffing  levels needed to address the current and projected CFIUS workload.”  However, Treasury noted that CFIUS does not have a centralized budget,  and Treasury does not have the authority over CFIUS staffing levels at  member agencies. We acknowledge Treasury’s points and, therefore, we  modified the report and clarified the recommendation to focus on  Treasury’s coordination role, since, as we note in the report, Treasury is  responsible for coordinating the operations of the committee and  communicating on the committee’s behalf with the parties, members of  Congress, and the general public. Treasury stated in an email that the  clarifications to the recommendation address the point raised in its  comment letter.

USDA also provided written comments, reproduced in appendix VI. In its  comments, USDA stated that it generally agreed with the findings in  GAO’s draft report. The letter further noted that USDA is satisfied with  Treasury’s willingness to include USDA in cases related to food and  agriculture and is comfortable continuing to work as a non-voting member  of CFIUS.

The Departments of Commerce, Homeland Security, State, Treasury, and  the Offices of the U.S. Trade Representative and Science and  Technology Policy provided written technical comments, which we  incorporated as appropriate.

The Departments of Defense, Energy, Health and Human Services,  Justice, Labor, the Office of the Director of National Intelligence, and the  Federal Communications Commission indicated via email that they did  not have comments.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Departments of  Agriculture, Commerce, Defense, Energy, Health and Human Services,  Homeland Security, Justice, Labor, State, and the Treasury as well as the  Offices of the U.S. Trade Representative, Science and Technology  Policy, and the Director of National Intelligence, and the Federal  Communications Commission. In addition, the report will be available at  no charge on the GAO website at http://www.gao.gov.

If you or your staff have questions about this report, please contact  Kimberly Gianopoulos at (202) 512-8612 or gianopoulosk@gao.gov or  Marie A. Mak at (202) 512-2527 or makm@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found   on the last page of this report. GAO staff who made key contributions to  this report are listed in appendix VII.

This report (1) examines changes in the Committee on Foreign  Investment in the United States’ (CFIUS) workload and staffing from 2011  through 2016, and (2) provides information on stakeholder views on  potential changes to CFIUS.

To address these objectives, we reviewed relevant laws, executive  orders, and regulations. We interviewed officials from each CFIUS voting  member agency, including the Departments of Commerce, Defense,  Energy, Homeland Security, Justice, State, and the Treasury as well as  the Offices of the U.S. Trade Representative and Science and  Technology Policy. We also interviewed officials from the two nonvoting  ex officio members, the Office of the Director of National Intelligence and  the Department of Labor. In addition, we interviewed officials from  nonmember agencies that have CFIUS case-related expertise, including  the Departments of Agriculture and Health and Human Services, and the  Federal Communications Commission.

To examine the changes in CFIUS workload and staffing levels over the  past 5 years, we analyzed information on workload and staffing levels at  the voting member agencies from 2011 through 2016, the most recent  information available at the time of our review. We also reviewed the  2014 and 2015 CFIUS annual reports. In addition, we interviewed officials  from the nine CFIUS voting member agencies about their workload and  staffing levels; any changes in the volume, types, and complexity of  transactions reviewed by CFIUS; and their ability to complete the core  functions of the committee. We requested information from the 9 CFIUS  voting member agencies on the number of staff assigned to CFIUS more  than 50 percent of their time.

To collect information on stakeholder views on potential changes to  CFIUS, we conducted individual semi-structured interviews with selected  stakeholders, which consisted of officials from the nine CFIUS voting  member agencies, the two ex officio nonvoting member agencies, and  three selected nonmember agencies that have CFIUS case-related  expertise, as well as with external experts. To identify external experts,  we asked stakeholders to recommend other stakeholders we should  speak with (i.e., snowball sampling). From our list of potential  stakeholders, we selected 16 external experts, including former  government officials, lawyers who represent parties with transactions  notified to CFIUS, and representatives from industry associations and  think tanks. In our interviews, we collected views and information on the  challenges that CFIUS faces, options for addressing the challenges, and  the possible benefits and drawbacks of these options. The information  obtained from these stakeholders cannot be generalized across all  stakeholders; however, these stakeholders provided insights into the  possible effects of implementing certain changes to CFIUS.

Appendix II: Characteristics of Transactions Reviewed by the Committee on Foreign Investment in the United States (CFIUS)

Appendix II: Characteristics of Transactions  Reviewed by the Committee on Foreign  Investment in the United States (CFIUS)

CFIUS reviews covered transactions from a large variety of industries, but  the largest number of transactions reviewed come from the manufacturing  sector. In 2016, the manufacturing sector represented approximately 42  percent of the 172 covered transactions reviewed by CFIUS and, in  recent years, the number of transactions reviewed from that sector has  increased from 49 transactions in 2011 to approximately 72 transactions  in 2016. Computer and electronic transactions, such as those by  companies that produce semiconductor technology, accounted for  approximately 32 of the 72 covered transactions from the manufacturing  sector that CFIUS reviewed in 2016. For instance, in 2016, CFIUS  reviewed the potential acquisition of Aixtron, a Germany-based  semiconductor firm with assets in the United States, by the Chinese firm  Fujian Grand Chip Investment Fund. That year, the President chose to  prohibit the acquisition of the U.S. business of Aixtron upon determining  that the foreign purchasers might take action that threatens to impair the  national security of the United States in exercising control of the U.S.  business of Aixtron. Treasury, as the chair of CFIUS, stated in a press  release that the national security risks posed by the transaction related to,  among other things, a Chinese firm obtaining the company’s body of  knowledge and experience.

Transactions from the manufacturing sector involve a variety of other  industries, including textiles, chemicals, and food manufacturing. For  example, in 2013, according to a report from the U.S.-China Economic  and Security Review Commission, CFIUS reviewed the acquisition of  Smithfield Foods Inc., for $7.1 billion, by China’s Shuanghui International  Holdings Ltd. A letter submitted by members of the Senate Agriculture  Committee raised concerns that the transaction posed a threat to the  nation’s food security; however, according to Security and Exchange  Commission filings, CFIUS ultimately completed its investigation and  cleared the transaction to proceed.

Acquisitions by Chinese-owned companies accounted for the largest  number of covered transactions reviewed by CFIUS from 2014 through  2016. According to CFIUS, the number of covered transactions the  committee reviewed from China has increased substantially in recent  years, from 10 transactions in 2011 to 67 in 2016. In previous years,  companies from the United Kingdom were party to the largest share of  covered transactions submitted for CFIUS review; however, from 2013  through 2015, parties from the United Kingdom and Canada submitted  the second and third largest number of notices. Forty-four percent of all  covered transactions reviewed by the committee during this time period  involved companies from China, the United Kingdom, or Canada.

Appendix III: Factors to Determine Whether Submitted Transactions Pose a National Security Risk

Appendix III: Factors to Determine Whether  Submitted Transactions Pose a National  Security Risk The potential effects of the transaction on the domestic production needed for  projected national defense requirements.  The potential effects of the transaction on the capability and capacity of domestic  industries to meet national defense requirements, including the availability of human  resources, products, technology, materials, and other supplies.  The potential effects of a foreign person’s control of domestic industries and  commercial activity on the capability and capacity of the United States to meet the  requirements of national security.  The potential effects of the transaction on U.S. international technological leadership  in areas affecting U.S. national security.  The potential national security-related effects on U.S. critical technologies.  The potential effects on the long-term projection of U.S. requirements for sources of  energy and other critical resources and material.  The potential national security-related effects of the transaction on U.S. critical  infrastructure, including critical physical infrastructure such as major energy assets.  The potential effects of the transaction on the sales of military goods, equipment, or  technology to countries that present concerns related to terrorism; missile  proliferation; chemical, biological, or nuclear weapons proliferation; or regional  military threats.  The potential that the transaction presents for transshipment or diversion of  technologies with military applications, including the relevant country’s export control  system.

Whether the transaction could result in the control of a U.S. business by a foreign  government or by an entity controlled by or acting on behalf of a foreign  government.  The relevant foreign country’s record of adherence to nonproliferation control  regimes and record of cooperating with U.S. counterterrorism efforts.

Other factors that the President or the committee may determine to be appropriate,  generally or in connection with a specific review or investigation.

Appendix IV: Reported Number of Agency Staff Assigned to Committee Activities

Appendix V: Comments from the Department of the Treasury

Appendix VI: Comments from the Department of Agriculture

Appendix VII: GAO Contacts and Staff Acknowledgments

Kimberly M. Gianopoulos, (202) 512-8612 or gianopoulosk@gao.gov.  Marie A. Mak, (202) 512-4841 or makm@gao.gov.

In addition to the contacts named above, Christine Broderick (Assistant  Director), Christina Werth (Analyst-in-Charge), Anthony Costulas, Scott  Purdy, Kendal Robinson, Lynn Cothern, Grace Lui, Justin Fisher, and Neil  Doherty contributed to this report.

Foreign investments in U.S. companies can benefit the economy, but could pose risks to national security.

The Committee on Foreign Investment in the United States (CFIUS) reviews certain foreign acquisitions and mergers and can work with the parties involved to mitigate national security risks or block transactions.

The committee reviewed over 50% more transactions in 2016 than in 2011. We recommended assessing staffing needs to address the concern that increased workload could limit the committee's effectiveness.

We also asked stakeholders about potential changes to the committee's structure and priorities. Their views varied widely.


Information Technology: SSA Has Improved Acquisitions and Operations, but Needs to Fully Address the Role of Its Chief Information Officer

SSA delivers services that touch the lives of almost every American, and relies heavily on IT resources to do so. Its systems support a range of activities, such as processing Disability Insurance payments, to calculating and withholding Medicare premiums, and issuing Social Security numbers and cards. For fiscal year 2018, the agency planned to spend approximately $1.6 billion on IT.

GAO has previously reported that federal IT projects have often failed, in part, due to a lack of oversight and governance. Given the challenges that federal agencies, including SSA, have encountered in managing IT acquisitions, Congress and the administration have taken steps to improve federal IT, including enacting federal IT acquisition reform legislation and issuing related guidance.

This statement summarizes GAO's previously reported findings regarding SSA's management of IT acquisitions and operations. In developing this testimony, GAO summarized findings from its reports issued in 2011 through 2018, and information on SSA's actions in response to GAO's recommendations.

The Social Security Administration (SSA) has improved its management of information technology (IT) acquisitions and operations by addressing 14 of the 15 recommendations that GAO has made to the agency. For example,

Incremental development . The Office of Management and Budget (OMB) has emphasized the need for agencies to deliver IT investments in smaller increments to reduce risk and deliver capabilities more quickly. In November 2017, GAO reported that agencies, including SSA, needed to improve their certification of incremental development. As a result, GAO recommended that SSA's CIO (1) report incremental development information accurately, and (2) update its incremental development policy and processes. SSA implemented both recommendations.

Software licenses . Effective management of software licenses can help avoid purchasing too many licenses that result in unused software. In May 2014, GAO reported that most agencies, including SSA, lacked comprehensive software license policies. As a result, GAO made six recommendations to SSA, to include developing a comprehensive software licenses policy and inventory. SSA implemented all six recommendations.

However, SSA's IT management policies have not fully addressed the role of its CIO. Various laws and related guidance assign IT management responsibilities to CIOs in six key areas. In August 2018, GAO reported that SSA had fully addressed the role of the CIO in one of the six areas (see table). Specifically, SSA's policies fully addressed the CIO's role in the IT leadership and accountability area by requiring the CIO to report directly to the agency head, among other things.

In contrast, SSA's policies did not address or minimally addressed the IT workforce and IT strategic planning areas. For example, SSA's policies did not include requirements for the CIO to annually assess the extent to which personnel meet IT management skill requirements or to measure how well IT supports agency programs. GAO recommended that SSA address the weaknesses in the remaining five key areas. SSA agreed with GAO's recommendation and stated that the agency plans to implement the recommendation by the end of this month.

GAO has made 15 recommendations to SSA to improve its management of IT acquisitions and operations from 2011 through 2018, and 1 recommendation to improve its CIO policies. While SSA has implemented nearly all of them, it would be better positioned to overcome longstanding IT management challenges when it addresses the CIO's role in its policies.

I am pleased to be here to participate in your hearing on the Social  Security Administration’s (SSA) management of information technology  (IT) and the authorities of its chief information officer (CIO). SSA is  responsible for delivering services that touch the lives of almost every  American, and the agency extensively relies on IT resources to do so. Its  computerized information systems support a wide range of activities— from processing Disability Insurance and Supplemental Security Income  payments to calculating and withholding Medicare premiums and issuing  Social Security numbers and cards. For fiscal year 2018, the agency  plans to spend approximately $1.6 billion on hardware and software,  computer maintenance, and contractor support, among other things.

We have previously reported that federal IT projects have often failed, in  part, due to a lack of oversight and governance. Executive-level  governance and oversight across the government has often been  ineffective, in particular from CIOs. For example, our work has found that  some CIOs do not have the authority to review and approve the entire  agency IT portfolio.

Given the challenges that federal agencies, including SSA, have long  encountered in managing IT, in December 2014, Congress enacted  federal IT acquisition reform legislation (commonly referred to as the  Federal Information Technology Acquisition Reform Act, or FITARA).  This law was intended to improve agencies’ acquisitions and enable  Congress to hold agencies accountable for reducing duplication and  achieving cost savings. Among other things, the law requires agency  action to consolidate federal data centers, ensure adequate  implementation of incremental development, review and approve IT  acquisitions, purchase software government-wide, and enhance agency  CIO authority.

In February 2015, we added improving the management of IT acquisitions  and operations to our list of high-risk areas for the federal government. In  February 2017, we issued an update to our high-risk report and noted  that, while progress has been made in addressing the high-risk area of IT  acquisitions and operations, significant work remained to be completed.  To address these shortcomings, we have made numerous  recommendations aimed at improving federal IT acquisitions and  operations.

At your request, my testimony today summarizes our previously reported  findings regarding SSA’s management of IT acquisitions and operations  and the authorities of its CIO. In developing this testimony, we relied on  reports that we previously issued between July 2011 and August 2018,  which discussed various aspects of the agency’s IT management. These  reports, cited throughout this statement, include detailed information on  the scope and methodology of our prior reviews. We also incorporated  information on SSA’s actions in response to recommendations we made  in our previous reports.

We conducted the work upon which this statement is based in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

SSA’s mission is to deliver Social Security services that meet the  changing needs of the public. The Social Security Act and amendments  established three programs that the agency administers:

Old-Age and Survivors Insurance provides monthly retirement and  survivors benefits to retired and disabled workers, their spouses and  their children, and the survivors of insured workers who have died.  SSA has estimated that, in fiscal year 2019, $892 billion in old-age  and survivors insurance benefits are expected to be paid to a monthly  average of approximately 54 million beneficiaries.

Disability Insurance provides monthly benefits to disabled workers  and their spouses and children. The agency estimates that, in fiscal  year 2019, a total of approximately $149 billion in disability insurance  benefits will be paid to a monthly average of about 10 million eligible  workers.

Supplemental Security Income is a needs-based program financed  from general tax revenues that provides benefits to aged adults, blind  or disabled adults, and children with limited income and resources.  For fiscal year 2019, SSA estimates that nearly $59 billion in federal  benefits and state supplementary payments will be made to a monthly  average of approximately 8 million recipients.

SSA relies heavily on its IT resources to support the administration of its  programs and related activities. For example, its systems are used to  handle millions of transactions on the agency’s website, maintain records  for the millions of beneficiaries and recipients of its programs, and  evaluate evidence and make determinations of eligibility for benefits.  According to the agency’s most recent Information Resources Strategic  Plan, its systems supported the processing of an average daily volume of  about 185 million individual transactions in fiscal year 2015.

SSA’s Office of the Deputy Commissioner for Systems is responsible for  developing, overseeing, and maintaining the agency’s IT systems.

Comprised of approximately 3,800 staff, the office is headed by the  Deputy Commissioner, who also serves as the agency’s CIO.

SSA Has a History of Unsuccessful IT Management

SSA has long been challenged in its management of IT. As a result, we  have previously issued a number of reports highlighting various  weaknesses in the agency’s system development practices, governance,  requirements management, and strategic planning, among other areas.   Collectively, our reports stressed the need for the agency to strengthen its  IT management controls.

In 2016, we reported that SSA’s acting commissioner had stated that the  agency’s aging IT infrastructure was not sustainable because it was  increasingly difficult and expensive to maintain. Accordingly, the agency  requested $132 million in its fiscal year 2019 budget to modernize its IT  environment. As reflected in the budget, these modernization efforts are  expected to include projects such as updating database designs by  converting them to relational databases, eliminating the use of outdated  code, and upgrading infrastructure.

Among the agency’s priority IT spending initiatives in the budget is its  Disability Case Processing System, which has been under development  since December 2010. This system is intended to replace the 52  disparate Disability Determination Services’ component systems and  associated processes with a modern, common case processing system.  According to SSA, the new system is to modernize the entire claims  process, including case processing, correspondence, and workload  management.

However, SSA has reported substantial difficulty in the agency’s ability to  carry out this initiative, citing software quality and poor system  performance as issues. Consequently, in June 2016, the Office of  Management and Budget (OMB) placed the initiative on its government- wide list of 10 high-priority programs requiring attention.

Congress and the Administration Have Undertaken Efforts to Improve Federal IT

As previously mentioned, Congress enacted federal IT acquisition reform  legislation (commonly referred to as FITARA) in December 2014. This  legislation was intended to improve agencies’ acquisitions of IT and  enable Congress to monitor agencies’ progress and hold them  accountable for reducing duplication and achieving cost savings. It  includes specific requirements related to seven areas: (1) agency CIO  authority enhancements, (2) federal data center consolidation initiative,  (3) enhanced transparency and improved risk management, (4) portfolio  review, (5) IT acquisition cadres, (6) government-wide software  purchasing program, and (7) the Federal Strategic Sourcing Initiative.

In June 2015, OMB released guidance describing how agencies are to  implement FITARA. The guidance identifies a number of actions that  agencies are to take to establish a basic set of roles and responsibilities  (referred to as the common baseline) for CIOs and other senior agency  officials and, thus, to implement the authorities described in the law.

More recently, on May 15, 2018, the President signed Executive Order  13833, Enhancing the Effectiveness of Agency Chief Information Officers.  Among other things, this executive order is intended to better position  agencies to modernize their technology, execute IT programs more  efficiently, and reduce cybersecurity risks. The order pertains to 22 of  the 24 Chief Financial Officers Act agencies; the Department of Defense  and the Nuclear Regulatory Commission are exempt.

For the covered agencies, including SSA, the executive order strengthens  the role of the CIO by, among other things, requiring the CIO to report  directly to the agency head; to serve as the agency head’s primary IT  strategic advisor; and to have a significant role in all management,  governance, and oversight processes related to IT. In addition, one of the  cybersecurity requirements directs agencies to ensure that the CIO works  closely with an integrated team of senior executives, including those with  expertise in IT, security, and privacy, to implement appropriate risk  management measures.

In June 2018, we issued a report that examined the cybersecurity  workforce of the government. We noted that most of the 24 agencies we  examined had developed baseline assessments to identify cybersecurity  personnel within their agencies that held certifications, but the results  were potentially unreliable. However, SSA’s baseline was found to be  reliable because it addressed all of the reportable information, such as  the extent to which personnel without professional certifications were  ready to obtain them or strategies for mitigating any gaps. Further, we  found that most of the 24 agencies had established procedures to assign  cybersecurity codes to positions, including SSA. We also have ongoing  work at SSA, including reviewing its cybersecurity workforce;  standardized approach to security assessment, authorization, and  continuous monitoring; cybersecurity strategy; and intrusion detection and  prevention capabilities.

From July 2011 through January 2018, we issued a number of reports  that addressed specific weaknesses in SSA’s management of IT  acquisitions and operations and in the role of its CIO. These reports  included 15 recommendations aimed at improving the agency’s efforts  with regard to data center consolidation, incremental development, IT  acquisitions, and software licenses. We also made a recommendation to  SSA to address weaknesses related to the role of the CIO in key  management areas.

SSA Has Improved the Management of Selected Areas of IT Acquisitions and Operations, but Has Not Fully Addressed the Role of Its CIO

SSA has taken steps to improve its management of IT acquisitions and  operations by addressing 14 of the 15 recommendations that we  previously directed to the agency regarding data center consolidation,  incremental development, IT acquisitions, and software licenses.

Data center consolidation. OMB established the Federal Data  Center Consolidation Initiative in February 2010 to improve the  efficiency, performance, and environmental footprint of federal data  center activities. The enactment of FITARA in 2014 codified and  expanded the initiative. In addition, pursuant to FITARA, in August  2016, the Federal CIO issued a memorandum that announced the  Data Center Optimization Initiative as a successor effort to the  Federal Data Center Consolidation Initiative. Further, in August 2016,  OMB released guidance which established the Data Center  Optimization Initiative and included instructions on how to implement  the date center consolidation and optimization provisions of FITARA.  Among other things, the guidance required agencies to consolidate  inefficient infrastructure, optimize existing facilities, improve their  security posture, and achieve cost savings.

In addition, the guidance directed agencies to develop a data center  consolidation and optimization strategic plan that defines the agency’s  data center strategy for fiscal years 2016, 2017, and 2018. This  strategy is to include, among other things, a statement from the  agency CIO indicating whether the agency has complied with all data  center reporting requirements in FITARA. Further, the guidance  indicates that OMB is to maintain a public dashboard to display  consolidation-related cost savings and optimization performance  information for the agencies.

In a series of reports that we issued from July 2011 through August  2017, we noted that, while data center consolidation could  potentially save the federal government billions of dollars,  weaknesses existed in agencies’ data center consolidation plans and  data center optimization efforts. Specifically with regard to SSA, in  2011, we reported that the agency had an incomplete consolidation  plan and inventory of IT assets. In 2016, we reported that SSA did not  meet any of the seven applicable data center optimization targets, as  required by OMB. In addition, in 2017, we reported that the agency  had an incomplete data center optimization plan. We stressed that  until SSA completed these required activities, it might not be able to  consolidate data centers, as required, and realize expected savings.

We made a total of four recommendations to SSA in our 2011, 2016,  and 2017 reports to help improve the agency’s reporting of data  center-related cost savings and to achieve data center optimization  targets. As of September 2018, SSA had implemented all four  recommendations. Consequently, the agency is better positioned to  improve the efficiency of its data centers and achieve cost savings.

In addition, we reported in May 2018 that the agencies participating  in the Data Center Optimization Initiative had communicated mixed  progress toward achieving OMB’s goals for closing data centers by  September 2018. With regard to SSA, we noted that the agency had  not yet achieved its planned savings but that its data centers were  among the most optimized that we reviewed. In particular, while SSA  reported that it planned to save $1.08 million on its data center  initiative from 2016 through 2018, it had not achieved any of those  savings. However, the agency reported having met the goal of closing  25 percent of its tiered data centers.

Further, SSA reported the most progress among the 22 applicable  agencies in meeting OMB’s data center optimization targets.  Specifically, SSA reported that it had met four of the five targets. (One  other agency reported that it had met three targets, 6 agencies  reported having met either one or two targets, and 14 agencies  reported meeting none of the targets). Consequently, we did not make  any additional recommendations to SSA in our May 2018 report. We  also have ongoing work involving SSA related to agencies’ progress  on closing data center and achieving optimization targets.

Incremental development. OMB has emphasized the need to deliver  investments in smaller parts, or increments, in order to reduce risk,  deliver capabilities more quickly, and facilitate the adoption of  emerging technologies. In 2010, it called for agencies’ major  investments to deliver functionality every 12 months and, since 2012,  every 6 months. Subsequently, FITARA codified a requirement that  covered agency CIOs certify that IT investments are adequately  implementing incremental development, as defined in the capital  planning guidance issued by OMB. Further, subsequent OMB  guidance on the law’s implementation, issued in June 2015, directed  agency CIOs to define processes and policies for their agencies to  ensure that they certify that IT resources are adequately implementing  incremental development.

In November 2017, we reported that 21 agencies, including SSA,  needed to improve their certification of incremental development.  We pointed out that, as of August 2016, agencies had reported that  103 of 166 major IT software development investments (62 percent)  were certified by the agency CIO for implementing adequate  incremental development in fiscal year 2017, as required by FITARA.

With regard to SSA, we noted that only 3 of the agency’s 10  investments primarily in development had been certified by the  agency CIO as using adequate incremental development, as required  by FITARA. In addition, we noted that SSA’s incremental development  certification policy did not describe the CIO’s role in the certification  process or how CIO certification would be documented. However,  accurate agency CIO certification of the use of adequate incremental  development for major IT investments is critical to ensuring that  agencies are making the best effort possible to create IT systems that  add value while reducing the risks associated with low-value and  wasteful investments.

As a result of these findings, we recommended that SSA ensure that  its CIO (1) reports major IT investment information related to  incremental development accurately, in accordance with OMB  guidance; and (2) updates the agency’s policy and processes for the  certification of incremental development and confirm that the policy  includes a description of how the CIO certification will be documented.  SSA agreed with our recommendations and implemented both of  them. Thus, the agency should be better positioned to realize the  benefits of incremental development practices, such as reducing  investment risk, delivering capabilities more rapidly, and permitting  easier adoption of emerging technologies.

IT acquisitions. FITARA includes a provision to enhance covered  agency CIOs’ authority through, among other things, requiring agency  heads to ensure that CIOs review and approve IT contracts. OMB’s  FITARA implementation guidance expanded upon this aspect of the  legislation in a number of ways. Specifically, according to the  guidance, CIOs may review and approve IT acquisition strategies and  plans, rather than individual IT contracts, and CIOs can designate  other agency officials to act as their representatives.

In January 2018, we reported that most of the CIOs at 22 selected  agencies, including SSA, were not adequately involved in reviewing  and approving billions of dollars of IT acquisitions. In particular, we  found that SSA’s process to identify IT acquisitions for CIO review did  not involve the acquisition office, as required by OMB. In addition, we  noted that SSA had a CIO review and approval process in place that  fully satisfied the requirements set forth in OMB’s guidance. However,  while SSA provided evidence of the CIO’s review of most of the IT  contracts we examined, the agency had not ensured that the CIO or a  designee reviewed and approved each IT acquisition plan or strategy.  Specifically, of 10 randomly selected IT contracts that we examined at  SSA, 7 acquisitions associated with those contracts had been  reviewed and approved, as required by OMB.

We pointed out that, until SSA ensured that its CIO or designee  reviewed and approved all IT acquisitions, the agency would have  limited visibility and input into its planned IT expenditures and would  not be effectively positioned to benefit from the increased authority  that FITARA’s contract approval provision is intended to provide.

Further, the agency could miss an opportunity to strengthen the CIO’s  authority and the oversight of IT acquisitions—thus, increasing the  potential to award IT contracts that are duplicative, wasteful, or poorly  conceived.

Accordingly, we made three recommendations to SSA to address  these weaknesses. As of September 2018, the agency had made  progress by implementing two of the recommendations: to ensure that  (1) the acquisition office is involved in identifying IT acquisitions and  (2) the CIO or designee reviews and approves IT acquisitions  according to OMB guidance. By taking these actions, SSA should be  better positioned to properly identify and provide oversight of IT  acquisitions.

However, SSA has not yet implemented our third recommendation  that it issue guidance to assist in the identification of IT acquisitions.  SSA stated that, in September 2017, it updated its policy for  acquisition plan approval to address this recommendation; however,  upon review of this policy, we did not find guidance for identifying IT  acquisitions. Without the proper identification of IT acquisitions, SSA’s  CIO cannot effectively provide oversight of these acquisitions.

Software licenses. Federal agencies engage in thousands of  software licensing agreements annually. The objective of software  license management is to manage, control, and protect an  organization’s software assets. Effective management of these  licenses can help avoid purchasing too many licenses, which can  result in unused software, as well as too few licenses, which can  result in noncompliance with license terms and cause the imposition  of additional fees.

As part of its PortfolioStat initiative, OMB has developed policy that  addresses software licenses. This policy requires agencies to  conduct an annual, agency-wide IT portfolio review to, among other  things, reduce commodity IT spending. Such areas of spending could  include software licenses.

In May 2014, we reported on federal agencies’ management of  software licenses and determined that better management was  needed to achieve significant savings government-wide. Of the 24  agencies we reviewed, SSA was 1 of 22 that lacked comprehensive  policies that incorporated leading practices.

In particular, SSA’s policy partially met four of the leading practices  and did not meet one. Further, we noted that SSA was among 22 of  the 24 selected agencies that had not established comprehensive  software license inventories—a leading practice that would help the  agencies to adequately manage their software licenses.

As such, we made six recommendations to SSA to improve its  policies and practices for managing software licenses. These included  recommendations that the agency develop a comprehensive policy for  the management of software licenses and establish a comprehensive  inventory of software licenses. SSA agreed with the recommendations  and, as of September 2018, had implemented all six of them. As a  result, the agency should be better positioned to manage its software  licenses and identify opportunities for reducing software license costs.

SSA Needs to Further Address the CIO’s Role in Its Policies

While SSA has taken steps that improved its IT management in the areas  of data center consolidation, incremental development, IT acquisitions,  and software licenses, we reported in August 2018 that the agency had  not fully addressed the role of the CIO in its policies.

As previously mentioned, FITARA and the President Executive Order  13833, among other laws and guidance, outline the roles and  responsibilities for agency CIOs in an attempt to improve the  government’s performance in IT and related information management  functions. Within these laws and guidance, we identified IT management  responsibilities assigned to CIOs in six key IT areas:

Leadership and accountability. CIOs are responsible and  accountable for the effective implementation of IT management  responsibilities. For example, CIOs are to report directly to the agency  head or that official’s deputy and designate a senior agency  information security officer.

Strategic planning. CIOs are required to lead the strategic planning  for all IT management functions. An example of a CIO requirement  related to the strategic planning area is measuring how well IT  supports agency programs and reporting annually on the progress in  achieving the goals.

IT workforce. CIOs are to assess agency IT workforce needs and  develop strategies and plans for meeting those needs. For example,  CIOs are responsible for annually assessing the extent to which  agency personnel meet IT management knowledge and skill  requirements, developing strategies to address deficiencies, and  reporting to the head of the agency on the progress made in  improving these capabilities.

IT budgeting. CIOs are responsible for the processes for all annual  and multi-year IT planning, programming, and budgeting decisions.  For example, CIOs are to have a significant role in IT planning,  programming, and budgeting decisions.

IT investment management. CIOs are to manage, evaluate, and  assess how well the agency is managing its IT resources. In  particular, CIOs are required to improve the management of the  agency’s IT through portfolio review.

Information security. CIOs are to establish, implement, and ensure  compliance with an agency-wide information security program. For  example, CIOs are required to develop and maintain an agency-wide  security program, policies, procedures, and control techniques.

In our August 2018 report, we noted that SSA, along with 23 other  agencies, did not have policies that fully addressed the role of the CIO in  these six key areas, consistent with the laws and guidance.

To its credit, SSA had fully addressed the role of the CIO in the IT  leadership and accountability area. In particular, the agency’s policies  addressed the requirements that the CIO report directly to the agency  head, assume responsibility and accountability for IT investments, and  designate a senior agency information security officer.

However, the policies did not fully address the role of the CIO in the other  five areas (i.e., strategic planning, workforce, budgeting, investment  management, and information security). For example, the agency’s  policies did not address the IT workforce area at all, including the  requirements that the CIO annually assess the extent to which agency  personnel meet IT management knowledge and skill requirements,  develop strategies to address deficiencies, and report to the head of the  agency on the progress made in improving these capabilities.

Further, SSA’s policies minimally addressed the requirements for IT  strategic planning. Specifically, while the agency’s policies required the  CIO to establish goals for improving agency operations through IT, the  policies did not require the CIO to measure how well IT supports agency  programs and report annually on the progress in achieving the goals.

Table 1 summarizes the extent to which SSA’s policies addressed the  role of its CIO, as reflected in our August 2018 report.

As a result of these findings, we made a recommendation to SSA to  address the weaknesses in its policies with regard to the remaining five  key management areas. In response, the agency agreed with our  recommendation and, subsequently, stated that it planned to do so by the  end of September 2018. Following through to ensure that the identified  weaknesses are addressed in its policies will be essential to helping SSA  overcome its longstanding IT management challenges.

In conclusion, effective IT management is critical to the performance of  SSA’s mission. Toward this end, the agency has taken steps to improve  its management of IT acquisitions and operations by implementing 14 of  the 15 recommendations we made from 2011 through 2018 to improve its  IT management. Nevertheless, SSA would be better positioned to  effectively address longstanding IT management challenges by ensuring  that it has policies in place that fully address the role and responsibilities  of its CIO in the five key management areas, as we previously  recommended.

Chairman Johnson, Ranking Member Larson, and Members of the  Subcommittee, this completes my prepared statement. I would be  pleased to respond to any questions that you may have.

If you or your staffs have any questions about this testimony, please  contact Carol C. Harris at (202) 512-4456 or harriscc@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this testimony statement. GAO staff who  made key contributions to this statement are Kevin Walsh (Assistant  Director), Jessica Waselkow (Analyst in Charge), and Rebecca Eyler.

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.