Amphibious Combat Vehicle: Program Should Take Steps to Ensure Manufacturing Readiness

In June 2018, the United States Marine Corps plans to select a contractor and begin low-rate production for the ACV, a vehicle used to transport Marines from ship to shore under hostile conditions. The ACV will replace all or part of the current Assault Amphibious Vehicle fleet.

The National Defense Authorization Act for Fiscal Year 2014 included a provision for GAO to annually review and report on the ACV program until 2018. This report, GAO's last under that provision, assesses the extent to which the Marine Corps is making progress toward (1) meeting cost and schedule goals for the ACV program and (2) demonstrating manufacturing readiness.

GAO reviewed program cost estimates, updated schedules, and program assessments of test results and production readiness, as well as compared ACV acquisition efforts to DOD guidance and GAO-identified best practices. GAO also interviewed program and testing officials, and visited both ACV primary assembly locations.

The first version of the Amphibious Combat Vehicle (ACV 1.1) is on track to meet development cost goals with no additional anticipated delays for major acquisition milestones. With regard to costs, the development phase of ACV 1.1 is on pace to not exceed cost goals that were established at the start of development, based on a recent Navy estimate, the ACV program office, and reporting from the contractors. For example, a September 2017 program progress review reported a Navy estimate of the cost of development at $750.7 million, less than the $810.5 million baseline established at the beginning of development. With regard to schedule, the ACV program has made no major changes to the acquisition schedule since GAO previously reported on the program in April 2017. ACV 1.1 program officials are in the process of preparing to down-select to a single contactor and enter low-rate production in June 2018, start a second round of low rate production the following year, and begin full-rate production in 2020. ACV 1.1 may be followed by the acquisition of other versions (ACV 1.2 and ACV 2.0) with advanced capabilities such as higher water speeds.

The ACV program is preparing to start production of ACV 1.1, which includes determining that the contractors' manufacturing capabilities are sufficiently mature. However, program officials are considering entering production with a lower level of manufacturing maturity than called for in Department of Defense (DOD) guidance or GAO identified best practices. The ACV program measures manufacturing maturity with manufacturing readiness levels (MRL) for risk areas such as design, materials, process capability and control, and quality management. DOD guidance for weapons acquisition production recommends that programs achieve an MRL of 8 across all risk areas before entering low-rate production and that a program achieve an MRL of 9 at the start of full-rate production. GAO's previous reviews about manufacturing best practices found that achieving manufacturing maturity and identifying production risks early in the acquisition cycle and assessing those risks prior to key decision points, such as the decision to enter production, reduces the likelihood of quality issues, cost growth, and delays. The Marine Corps contract option for producing the first round of low-rate production for ACV 1.1 will be exercised after June 2018; the contract also contains additional options for production vehicles. Making the decisions to proceed with the second round of low-rate production and for the start of full-rate production before meeting called-for levels of manufacturing readiness criteria increases the risk that ACV 1.1 will witness delays and increased costs.

GAO recommends the Marine Corps (1) not enter the second year of low-rate production for ACV 1.1 until after the contractor has achieved an overall MRL of 8 and (2) not enter full-rate production until achieving an overall MRL of 9. DOD partially concurred with both recommendations, but noted that it is reasonable to proceed at lower MRL levels if steps are taken to mitigate risk. GAO made no changes to its recommendations in response to these comments.

The United States Marine Corps established the Amphibious Combat  Vehicle (ACV) program as a way to acquire an enhanced capability to  transport Marines from ship-to-shore under hostile conditions. The ACV is  envisioned to potentially replace all or part of the current Assault  Amphibious Vehicle (AAV) fleet, which has been providing this capability  since 1972. According to the Marine Corps, the AAVs fall short of  currently needed capabilities such as water and land mobility, lethality,  and force protection. Previously, the Marine Corps sought to achieve  enhanced capabilities in these areas through the Expeditionary Fighting  Vehicle (EFV) program, but due to concerns about the program’s  affordability, after more than a decade in development and the  expenditure of $3.7 billion, the program was cancelled in 2011. Following  the cancellation of the EFV program, the Department of Defense (DOD)  authorized the Marine Corps to seek a new replacement for the AAVs,  emphasizing the need for cost-effectiveness, resulting in the start of the  ACV acquisition in 2011. The ACV acquisition approach calls for ACV  development in three increments with increasing amphibious capability,  referred to as ACV 1.1, 1.2 and 2.0. The program awarded contracts in  2015 to two competing contractors to each design and develop 16 ACV  1.1 prototypes for testing. The program plans to down-select by awarding  and exercising the option to one of the two contractors for production,  which is scheduled to start in 2018.

The National Defense Authorization Act for Fiscal Year 2014 included a  provision that we annually review and report to the congressional defense  committees on the ACV program until 2018. This report—our last under  that provision—discusses the Marine Corps’ progress toward (1) meeting  cost and schedule goals for the ACV 1.1 program and (2) demonstrating  manufacturing readiness.

To conduct this work, we reviewed program documents such as: the  Acquisition Strategy; Test and Evaluation Master Plan; System  Engineering Plan; the ACV 1.1 engineering, manufacturing and  development contracts; and solicitation for the ACV 1.1 production. These  documents were provided primarily by the ACV program office and the  Marine Corps’ Office of the Program Manager for Advanced Amphibious  Assault. We identified acquisition best practices based on our extensive  body of work, as well as the DOD acquisition guidance, to assess the  ACV acquisition approach and acquisition activities to date.

To assess the Marine Corps’ progress towards meeting cost and  schedule goals for the ACV 1.1 program, we reviewed recent cost  estimates, contractor performance reports, and updated program  schedules, and interviewed officials from the ACV program office. We  compared current program cost and schedule information to cost and  schedule goals in the acquisition program baseline established at  development and updated information reported in previous GAO reports  addressing the ACV.

To review Marine Corps efforts to meet ACV 1.1 production readiness  goals, we analyzed results of developmental, live fire, and sustainment  reliability testing provided by the ACV program office and the Marine  Corps’ Combat Development and Integration. We also interviewed testing  officials and visited testing facilities at the Aberdeen Proving Ground,  Aberdeen, Maryland. We conducted interviews with officials at Science  Applications International Corporation (SAIC) and BAE Systems Land  and Armaments L. P. (BAE)—the two contractors competing for the  production down-select—and visited their production and assembly  facilities at North Charleston, South Carolina and York, Pennsylvania,  respectively. We reviewed reports about contractor production readiness  and interviewed officials from the Defense Contract Management Agency  (DCMA) responsible for oversight at the contractors’ respective facilities.  We also analyzed vehicle acceptance reports for all prototype ACV  vehicles delivered to the government. We then applied DOD guidance  and GAO-identified best practices to ACV program efforts to prepare for  the start of production. In addition to interviewing Marine Corps program  officials, we also interviewed officials at the DOD Office of the Director,  Operation Test and Evaluation and the Office of the Deputy Assistant  Secretary of Defense for Developmental Test and Evaluation.

Information related to testing results, production readiness, and vehicle  quality upon delivery is competition sensitive and is restricted from being  presented in a public report. Because the ACV program has not yet  concluded the evaluation of the two competitors to determine which will  produce the ACVs to be fielded, we are unable to publicly address and  include in this report some of our findings relating to information that is  considered by DOD to be competition sensitive. However, we agreed to  brief staff of the congressional defense committees on those findings at a  later date.

We conducted this performance audit from July 2017 to April 2018 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  objectives. We believe that the evidence obtained provides a reasonable  basis for our findings and conclusions based on our audit objectives.

The ACV is being developed as a partial or full replacement for the AAV,  which is a tracked (non-wheeled) vehicle with capability to launch from  ships to reach the shore carrying up to 21 Marines at a speed of up to  approximately 6 knots. This speed effectively limits its range for traveling  from ship to shore to no farther than 7.4 nautical miles. In order to  upgrade the AAV to meet current threats and establish a path toward an  enhanced platform, DOD and the Marine Corps implemented an  incremental approach. The first step was to improve the AAVs’ protection  from threats such as improvised explosive devices by installing enhanced  armor and other equipment—referred to as survivability upgrades—efforts  which are currently underway. The second step was to establish a plan to  replace the AAV with a new vehicle, the ACV, which would develop and  enhance capabilities in three incremental steps:

ACV 1.1 would be a wheeled vehicle that provides improved  protected land mobility but limited amphibious capability. In  operations, it is expected to be part of an amphibious assault through  the use of a surface connector craft to travel from ship to shore. This  increment would leverage prototypes, demonstration testing, and  other study results from the previously suspended Marine Personnel  Carrier program.

ACV 1.2 would have improved amphibious capability, including the  ability to self-deploy and swim to shore. The development phase of  the second ACV increment (ACV 1.2) is scheduled to begin in  February 2019.

ACV 2.0 would focus on exploring technologies to attain higher water  speed capability.

The ACV 1.1 program was initiated in 2014 and development of ACV 1.1  vehicles started in November 2015. The remainder of this report is  focused on development and acquisition of the ACV 1.1, which we will  refer to as ACV. The Marine Corps acquisition of the ACV employs a two- phase strategy for selecting a contractor to produce the ACV fleet. In the  first phase, the program issued a solicitation for offerors to submit  proposals and provided for award of multiple contracts for each contractor  to design and develop 16 prototypes for performance assessment. In the  second phase, referred to as the down-select process, after testing the  prototypes, the Marine Corps intends to select a single contractor to  continue into the start of production. The Marine Corps received five initial  proposals and ultimately awarded contracts to BAE and SAIC to develop  the ACV prototypes. The Marine Corps considered the ACV to be a  substantially non-developmental item because both contractors’ designs  were based on vehicles that were already in production and deployed by  other militaries.

Figure 1 depicts the BAE and SAIC prototype vehicles. After testing the  prototypes, the Marine Corps plans to select a single contractor to  continue into the production phase.

The first prototypes were delivered in January 2017 and have since been  undergoing developmental, operational, and live fire testing.

Developmental testing assesses whether the system meets all technical  requirements and is used to: verify the status of technical progress,  determine that design risks are minimized, substantiate achievement of  contract technical performance, and certify readiness for initial operational  testing. ACV developmental testing includes testing for sustainability,  system survivability, and water and land mobility.

Operational testing (assessment) is the field test, under realistic  conditions, for the purpose of determining effectiveness and suitability of  the weapons for use in combat by typical military users.

Live fire testing is used to demonstrate vehicle capability against a  range of ballistic and non-ballistic threats expected to be encountered in  the modern battlefield, such as improvised explosive devices among  others.

In January 2018 the Marine Corps started an operational assessment,  which was scheduled to be completed in March 2018. The assessments  consist of field tests, under realistic conditions, to inform the decision to  enter production. Ongoing test results, including the operational  assessment, will be used to inform the ACV June 2018 production  decision.

Figure 2 is a timeline of the ACV program’s progress and plans to full  capability. The ACV program plans to produce at least 208 vehicles after  exercising contract options for 2 years of low-rate production of 30  vehicles each year starting in 2018 and then exercise options for 2 years  of full-rate production for the remaining 148 or more vehicles starting in  2020.

In addition to testing the prototype vehicles, the program is holding a  production readiness review that started in November 2017 and  according to program officials, they will keep the review open until April  2018. During this review, the program will determine whether the designs  are ready for production and whether the contractors have accomplished  adequate production planning to enter production. Officials from DCMA,  which conducts contract performance oversight, have provided support in  assessing production readiness. After receiving the proposals for the  production down-select, the program will hold a system verification review  in April 2018 to verify that the performance of the ACV prototypes meets  capability requirements and performance specifications.

This report represents the last in the series of reports we are to issue in  response to the fiscal year 2014 National Defense Authorization Act,  which contains a provision that we review and report annually on the ACV  program until 2018. Previously,  In October 2015 we found that the Marine Corps made efforts to  adopt best practices and minimize acquisition risk, including: adopting  an incremental approach to update capabilities, using proven  technologies, increasing competition, and awarding fixed-price  incentive contracts for much of the development work.

In April 2017, we found that DOD’s life cycle cost estimate for ACV  1.1 of about $6.2 billion, fully or substantially met the criteria for the  four characteristics of a high-quality reliable cost estimate. However,  we also found that changes the Marine Corps made to the acquisition  schedule — partly in response to a stop work order following a bid  protest that was denied by GAO in March 2016 — raised acquisition  risk by increasing the overlap between development activities, such  as testing of the vehicles, with production. This is a risk we had  identified in a previous report. As a result, we recommended that the  Marine Corps delay the production decision until 2019. DOD did not  concur with that recommendation.

ACV Program Is on Track to Meet Development Cost Goals with No Additional Schedule Delays

Costs for the development phase of ACV are on track to meet cost goals  established at the start of development, based on a recent Navy estimate,  the ACV program office, and reporting from the contractors. In September  2017, the ACV program’s Defense Acquisition Executive Summary  Report for ACV provided a Navy cost estimate for development of $750.7  million, less than the $810.5 million baseline established at the start of  development in November 2015. Program officials also indicated that the  ACV program was on track to meet cost goals. They noted that the  contractors have not contacted the government to negotiate an increase  in billing prices, as of December 2017. Since both of the contractors have  delivered all 16 of their required prototypes and the manufacturing of the  prototypes is the largest anticipated portion of ACV development contract  costs, most of the costs associated with the manufacturing of the  prototypes have likely been realized.

The Marine Corps made efforts to reduce cost risk to the government by  adopting a fixed-price incentive (firm target) contract type for the  construction of the prototype vehicles. As we previously reported in  October 2015, the Marine Corps planned to award hybrid contracts to  each of the ACV development contractors, which would apply different  pricing structures for different activities. The Marine Corps awarded the  contracts in November 2015 as planned. Most critically, a fixed-price  incentive contract type is being used for items in the contract associated  with the manufacturing of the development prototypes, which was  anticipated to be the largest portion of ACV development contract costs.  Under this contract type, the government’s risk is generally limited to the  contract’s price ceiling. Incentive contracts are appropriate when a firm- fixed-price contract is not appropriate and the required supplies can be  acquired at lower costs by relating the amount of profit or fee to the  contractor’s performance.

According to Federal Acquisition Regulation, since it is usually to the  government’s advantage for the contractor to assume substantial cost  responsibility and appropriate share of the cost risk, fixed-price incentive  contracts are preferred over cost-reimbursement incentive contracts when  contract costs and performance requirements are reasonably certain.  The fixed-price incentive (firm target) contract type provides for adjusting  profit and establishing the final contract price by application of a formula  based on the relationship of total final negotiated cost to total target cost.  The final price is subject to a price ceiling, negotiated at the outset. If  the final negotiated cost exceeds the price ceiling, the contractor absorbs  the difference. As we also previously reported, however, the Marine  Corps received a waiver to forgo the establishment of a certified Earned  Value Management System for the ACV program, which reduces the  regularly-available cost, schedule, and performance data available for the  program to review.

The ACV program office and DOD also indicated that they anticipate  production costs will be within goals established at the start of  development, though key production costs have not yet been determined.  The program’s development contracts with the two competing contractors  contain fixed-price incentive options for 4 years of production. The pricing  of the production vehicles will not occur, however, until DOD makes a  production decision in June 2018 and negotiates the final terms and  exercises the production option with one of the contractors.

The Marine Corps has made no major changes to the ACV acquisition  schedule since we previously reported on the program in April 2017. In  that report we found that the production decision was moved from  February to June 2018 after a stop work order was issued to the  contractors in response to a bid protest from a vendor that was not  selected for one of the ACV development contracts. A senior program  official emphasized the importance of keeping the ACV acquisition on  schedule because the capability it provides is complementary to a  broader set of capability updates across multiple platforms that the  Marine Corps is in the process of procuring.

ACV May Enter Production with Manufacturing Maturity That Does Not Meet Best Practices

The ACV program office is in the process of conducting tests and  assessments to determine if the program is on track to meet the criteria to  enter production, but program officials told us the Navy—which has the  authority to approve major acquisition milestone decisions for the  program—may choose to start low-rate production without meeting  established best practices for manufacturing maturity. At the start of  development, DOD established criteria for entering production in areas  such as capability performance and the status of the contractors’  manufacturing readiness to manufacture the ACV vehicles. Leading up to  the production decision, the program is engaged in a number of activities  such as the operational assessment and production readiness review to  inform the decision to start production. The production readiness review  has a critical role in informing the decision to enter production because it  represents an opportunity for the program to determine the maturity of the  contractor’s manufacturing process and assess potential risks related to  cost, schedule, or performance. Our previous reviews about  manufacturing best practices found that identifying manufacturing risks  early in the acquisition cycle and assessing those risks prior to key  decision points, such as the decision to enter production, reduces the  likelihood of cost growth and potential delays.

The ACV program has used the DOD Manufacturing Readiness Level  (MRL) Deskbook to identify levels of manufacturing capability and  establish targets for minimal levels of manufacturing readiness at specific  acquisition milestones. The ratings are applied to various risk areas  such as design, materials, process capability and control, and quality  management. Table 1 shows the basic MRL definitions provided by the  Joint Defense Technology Panel.

The MRL Deskbook recommends that a program is expected to  demonstrate a MRL of 8 by the time of the low-rate production decision.  However, GAO’s previously identified best practices for managing  manufacturing risks recommend programs reach a higher level—MRL- 9— for the risk area of process capability and control before entering low- rate production. At MRL-9, a program is expected to have its applicable  manufacturing processes in statistical control. The MRL Deskbook recommends that a program achieve an MRL-9 at the start of full-rate  production.

The Marine Corps has eliminated manufacturing capability as a criterion  for consideration in the down-select production decision. In the solicitation  issued to the two competing contractors for the production decision in  December 2017, the Marine Corps identified two criteria that would be  considered to determine the winner of the down-select competition for the  production decision. They are, in descending order of importance: (1)  technical performance of the prototype vehicles and (2) the contractors’  submitted cost proposals. Previously, the ACV acquisition strategy and  development contracts identified five criteria for the selection process,  with manufacturing capability as the second most important factor (behind  technical performance). The development contracts stipulated that the  government reserved the right to adjust the factors and their order of  importance prior to the release of the solicitation for the production down- select decision. Program officials said that narrowing the down-select  factors to performance test results and cost was in line with the original  intent of the program to use the best value tradeoff process described in  the Federal Acquisition Regulation and that the revised criteria were  appropriate for a non-developmental item such as the ACV.

While the program removed manufacturing capabilities from its criteria for  selecting the contractor for production, ACV program officials are still  assessing manufacturing readiness to support their production decision.  Program officials stated that they could enter production at a lower level  of manufacturing readiness than DOD guidance or GAO identified best  practices suggest. The program started a production readiness review in  November 2017 to determine the contractors’ respective manufacturing  maturity. According to program officials, they will keep the review open  until April 2018, at which point the program will make a determination  about the contractors’ manufacturing readiness levels. The program office  confirmed that the ACV criterion for entering production is to achieve an  MRL-8 but noted that it is possible that the program could choose to enter  into production without an overall MRL-8. Program officials stated that if  there are any specific risk areas that are assessed below that threshold,  the program office will define the risk and make a recommendation to the  Navy for entry into production based on whether or not they consider the  risk acceptable.

To help inform its determination, program officials said that they will  review the manufacturing readiness assessments produced by the  contractors, as well as reviews by the DCMA, which is responsible for  assisting with contract oversight. Because the two contractors were still in  competition at the time of the release of this report, we are unable to  publicly report additional, more detailed, information about production  readiness or performance tests. However, we have previously found that  programs with insufficient manufacturing knowledge at the production  decision face increased risk of production quality issues, cost growth, and  schedule delays.

Entering the production phase of the ACV acquisition with manufacturing  readiness levels lower than those recommended by DOD guidance and  GAO-identified best practices would increase the likelihood of outcomes  associated with insufficiently mature manufacturing capabilities, such as  production quality issues and schedule delays. The Marine Corps has  already been authorized funding to start production and plans to exercise  options in 2018 to produce 30 vehicles for the first year of low-rate  production. However, the Marine Corps has two upcoming decisions  that would provide opportunities to refocus on manufacturing readiness  for the ACV—specifically the decision to enter into the second year of  low-rate production in 2019 for 30 vehicles, and the decision to enter the  first year of full-rate production in 2020 and acquire 56 of the remaining  148 vehicles. Acquiring additional vehicles before ensuring sufficient  manufacturing maturity could raise the risk that the contractor may not be  sufficiently prepared for continued production, which could result in delays  in delivery of acceptable vehicles or additional costs to the government.

The Marine Corps has long identified the need for the enhanced  capabilities envisioned through the ACV program and is nearing the  potential production of such a vehicle. Following the cancellation of the  EFV program after the expenditure of $3.7 billion, the ACV program  represents an opportunity to follow a better acquisition approach. It is too  early to determine whether the contractors will meet targets for production readiness by the time of the production decision, but the program office is  considering entering production without meeting the recommended  manufacturing maturity levels established by DOD or GAO-identified best  practices.

We have already identified the ACV program as adopting an aggressive  acquisition schedule in which the amount of concurrent developmental  testing and production is more than typical acquisition programs. In fiscal  year 2018, Congress authorized funding for the program to start  production, but the decision to enter a second year of low-rate production  and the decision to start full-rate production represent opportunities for  the ACV program to verify the manufacturer has achieved a sufficient  level of readiness before commencing production of the bulk of vehicles.  If the Marine Corps does not take steps to ensure that the contractor’s  manufacturing readiness is sufficiently mature, as demonstrated through  MRLs, prior to committing to additional production beyond the first year of  low-rate production, there is an increased risk for production quality  issues, cost growth, and schedule delays.

We are making two recommendations to DOD.

The Secretary of the Navy should take steps to ensure that the Marine  Corps not enter the second year of low-rate production until after the  Marine Corps has determined that the contractor has achieved an MRL of  at least an 8 for all risk areas. (Recommendation 1)

The Secretary of the Navy should take steps to ensure that the Marine  Corps not enter full-rate production until the Marine Corps has determined  that the contractor has achieved an MRL of at least 9 for all risk areas.  (Recommendation 2)

We provided a draft of this product to DOD for comment. In its comments,  reproduced in appendix I, DOD partially concurred with GAO’s  recommendations.

DOD agreed that manufacturing readiness should be assessed prior  entering both the second year of low-rate production and the start of full- rate production, and plans to do so. DOD acknowledged that the MRL  Deskbook provides best practices for identifying risks, but noted that the  ACV program is not required to follow it. DOD noted that it may be  reasonable to proceed into manufacturing at lower MRLs, if steps to  mitigate identified risks are taken.  However, DOD disagreed that not  demonstrating a specified MRL for any individual risk area, in itself,  should delay the start of either production milestone. DOD expressed  concern that delaying subsequent years of production, if MRLs are not at  the levels recommended, could lead to counterproductive breaks in  production.

We agree that adopting the MRL Deskbook is not required by DOD and  represents best practices to minimize production risk.  However, we also  believe that demonstrating the MRL levels recommended in the MRL  Deskbook for all risk areas mitigates increased risk associated with the  aggressive schedule pursued by the ACV program—about which we have  previously expressed concerns. We believe our recommendation to  achieve an overall MRL-8 by the second year of low-rate production is a  reasonable goal, considering it gives the ACV program an additional year  after the point at which the MRL Deskbook recommends reaching MRL- 8—the start of low-rate production. In addition, ensuring that all  manufacturing readiness risk areas are at MRL-9 for the start of full-rate  production, as recommended by best practices in the MRL Deskbook,  would help further alleviate risks associated with the program’s  aggressive schedule. We appreciate the DOD concerns about delaying  subsequent years of production if MRLs have not reached those identified  in the best practices in the MRL Deskbook, but note that not doing so  increases the likelihood of production quality issues that could lead to  cost growth and schedule delays in future years. Therefore, we made no  changes to the recommendations in response to the comments.

We are sending copies of this report to interested congressional  committees; the Secretary of Defense; the Under Secretary of Defense  for Acquisition and Sustainment; the Secretary of the Navy; and the  Commandant of the Marine Corps. This report also is available at no  charge on GAO’s website at http://www.gao.gov.

Should you or your staff have any questions on this report, please contact  me at (202) 512-4841 or ludwigsonj@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. Key contributors to this report GAO staff who  made key contributions to this report are listed in appendix II.

Appendix I: Comments from the Department of Defense

Appendix II: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Bruce H. Thomas (Assistant  Director), Matt Shaffer (Analyst in Charge), Pete Anderson, Alexandra  Jeszeck, Jennifer Leotta, Roxanna Sun, and Marie Ahearn made key  contributions to this report.

The Marine Corps is developing the Amphibious Combat Vehicle to upgrade its ability to move Marines from ship to shore under hostile conditions.

Two contractors have produced prototypes; only one contractor will be selected to produce the vehicle.

The program is on track to meet cost and schedule targets. However, it may start the first phase of production in 2018 before having reached a best-practices level of readiness to begin manufacturing. This could increase risk of schedule slips and cost increases.

We recommended that the program achieve a higher level of manufacturing readiness before entering the second year of initial production.


Transportation Security Acquisition Reform Act: TSA Generally Addressed Requirements, but Could Improve Reporting on Security-Related Technology

Enacted in December 2014, TSARA introduced legislative reforms to promote greater transparency and accountability in TSA's SRT acquisitions.

TSARA contains a provision that GAO submit two reports to Congress on TSA's progress in implementing TSARA. In February 2016, GAO issued the first report that found TSA had taken actions to address TSARA.

This second report examines TSA's (1) progress in addressing TSARA requirements since 2016, (2) reporting to Congress on SRT acquisitions, and (3) internal communication of its implementation decisions. GAO examined TSARA and TSA documents and guidance; analyzed TSA contract data and reports from TSARA's enactment in December 2014 through July 2018 and September 2018, respectively; and interviewed DHS and TSA officials on actions taken to implement TSARA. GAO also conducted interviews with TSA officials on parameters for reporting on SRT acquisitions.

Since 2016, the Transportation Security Administration (TSA) generally addressed Transportation Security Acquisition Reform Act (TSARA) requirements through its policies and procedures for acquisition justifications, baseline requirements, and management of inventory. TSA also, among other actions, submitted a technology investment plan and annual small-business contracting goals reports to Congress as required.

Since December 2014, TSA reported limited security-related technology (SRT) acquisitions to Congress under TSARA, submitting its first report in August 2018. TSARA contains a report and certification provision pursuant to which TSA is to submit information to Congress 30 days prior to the award of a contract for an SRT acquisition exceeding $30 million. Through July 2018, TSA obligated about $1.4 billion on SRT and associated services. TSA officials explained that none of these obligations—including 7 SRT orders, each in excess of $30 million—invoked the report and certification provision because the obligations did not align with TSA's implementation policy, which provides that the $30 million threshold relates to the contract ceiling of the initial SRT contract and not to individual task and delivery orders. Revising TSA's policy to include contracts for services that enhance the capabilities of SRT, including any orders for SRT and associated services in excess of $30 million, would better ensure that Congress has the information it needs to effectively oversee TSA's SRT acquisitions.

TSA has not effectively communicated internally its implementation decisions for what constitutes an SRT under TSARA. TSA officials described to GAO that SRT must be equipment that is public facing, but TSA's policy does not clearly state the parameters of what is considered an SRT. Without clear guidance, TSA staff may be unaware of these parameters and how they apply to future acquisitions under TSARA. For example, TSA acquisition program staff were initially unable to confirm for GAO whether the technologies TSA had acquired were SRTs and thus subject to TSARA. Updating TSA policy to include detailed parameters for what constitutes an SRT would better ensure consistency in applying the act.

GAO recommends that TSA revise its policies for the report and certification provision of TSARA to include reporting on task and delivery orders and services associated with SRT, and clarify in policy what constitutes an SRT under TSARA. DHS generally concurred with the recommendations and described steps it plans to take to implement them.

The Transportation Security Administration (TSA) relies on security- related screening technologies–such as explosives detection systems–to  deter, detect, and prevent prohibited items on board commercial aircraft.  TSA, a component of the Department of Homeland Security (DHS),  anticipates spending a significant portion of its $3.6 billion security  capability acquisition budget on these technologies by fiscal year 2020.  Such technologies are vital to TSA efforts to prevent a terrorist attack on  an aircraft using explosives or other prohibited items. In 2017, TSA was  responsible for the screening of about 2.4 million passengers, 4.4 million  carry-on bags, and 1.2 million checked bags at over 440 TSA-regulated  airports in the United States on an average day.

In past work, we found that TSA encountered challenges in effectively  acquiring and deploying passenger and checked baggage screening  technologies and had not consistently implemented DHS policy and best  practices for procurement. Additionally, Congress has recognized that  TSA historically faced challenges in meeting key performance  requirements for several major acquisitions and procurements, resulting  in reduced security effectiveness and inefficient expenditures among  other things. Enacted in December 2014, the Transportation Security  Acquisition Reform Act (TSARA) introduced legislative reforms to  promote greater transparency and accountability with respect to TSA’s  acquisitions of security-related technology (SRT).

Under TSARA, we were directed to submit a report to Congress not later  than 1 year after enactment, and are to submit a subsequent report 3  years thereafter, evaluating TSA’s progress in implementing the act. We  provided Congress with the first report in February 2016. We found that  TSA was using its existing acquisitions policies, among other actions, to  meet TSARA requirements. This second report examines (1) TSA’s  progress in addressing TSARA requirements since 2016, (2) the extent to  which TSA reports to Congress on security-related technology  acquisitions under TSARA, and (3) the extent to which TSA internally  communicates its TSARA implementation decisions.

To determine TSA’s progress in addressing TSARA requirements since  2016, we reviewed any updated policy documents and interviewed  officials from DHS and TSA with responsibilities for implementing TSARA  to gain insights on the extent to which TSA’s policies and procedures  have changed since our February 2016 report. In addition, to determine  the extent to which TSA addressed the requirements for the Strategic  Five-Year Technology Investment Plan (technology investment plan) and the small business contracting reports in TSARA, we reviewed TSA’s  technology investment plan and TSA’s fiscal years 2015 through 2017  small business contracting reports. Specifically, we (1) analyzed the  updated technology investment plan and small business reports against  TSARA’s requirements and (2) interviewed agency officials to provide  insights into the procedures they used to develop the technology  investment plan and the small business report. To determine whether  TSA is able to ensure it executes its responsibilities under TSARA in a  manner consistent with and not duplicative of the Federal Acquisition  Regulation and departmental policies and directives, we reviewed TSA’s  TSARA Implementation Strategy Memo and supporting documentation,  and interviewed DHS and TSA acquisition officials to verify that policies  contain such assurances. We also interviewed security industry  representatives to gain their perspective on the usefulness of TSA’s  technology investment plan.

To determine the extent that TSA reports to Congress on SRT  acquisitions under TSARA, we reviewed TSA’s TSARA Implementation  Strategy Memo—which recognizes awards for both indefinite-quality  contracts and blanket purchase agreements as subject to TSARA—and  other supporting documentation to identify TSA’s policy for reporting SRT  acquisitions under TSARA and obtained information that TSA submitted  to Congress regarding SRT acquisitions. We interviewed agency officials  to clarify information and provide insights into the rationale for TSA’s  reporting policy. We also interviewed select security manufacturing  vendors for their perspective on TSARA. We reviewed congressional  committee reports to understand the legislative history behind TSARA. To  determine TSA’s obligations for SRT-related acquisitions, we asked TSA  to identify its contracts used for acquisitions of SRT and services  associated with the operation of SRT. We analyzed data from Federal  Procurement Data System-Next Generation (FPDS-NG) from December  18, 2014—TSARA’s date of enactment—through July 2018 on obligations  for SRT contracts and task and delivery orders issued under those  contracts. We obtained FPDS-NG data on obligations for the same time  period for contracts and orders that provide services associated with the  installation, operation, networking, and maintenance of SRT. Additionally,  we reviewed any of TSA’s TSARA-related reporting to Congress from  December 18, 2014 through September 2018. We assessed the reliability  of the FPDS-NG data by performing electronic testing to identify missing  data or data that is out of the appropriate range and comparing it to data  from TSA’s financial management and accounting system. We  determined that the FPDS-NG data are sufficiently reliable for the  purposes of this report. We interviewed TSA officials responsible for  managing TSA’s security screening programs, related acquisitions, and  the implementation of TSARA to clarify information and provide insights  into the rationale for TSA’s reporting policy.

To determine the extent to which TSA internally communicates its TSARA  implementation decisions, we reviewed TSA’s TSARA Implementation  Strategy Memo for consistency with the parameters TSA officials  described for what constitutes an SRT. We interviewed TSA officials to  gain insights on TSA’s implementation approach—including their  parameters—and how TSA communicates that approach to staff and  compared the implementation approach to relevant federal internal  control standards.

We conducted this performance audit from November 2017 to January  2019 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

The Aviation and Transportation Security Act established TSA as the  federal agency with primary responsibility for securing the nation’s civil  aviation system, which includes acquiring technology to screen and  secure travelers at the nation’s TSA-regulated airports. TSARA defines  SRT as any technology that assists TSA in the prevention of, or defense  against, threats to United States transportation systems, including threats  to people, property, and information. As illustrated in figure 1, TSA  acquired various SRT for passenger and baggage screening, including:

Advanced Imaging Technology (AIT)—screens passengers for  metallic and nonmetallic threats;

Explosives Trace Detection—detects various types of commercial and  military explosives through chemical analysis on passengers and their  property; and

Explosives Detection System (EDS)—provides imaging, screening,  and detection capabilities to identify possible threats in checked  baggage contents.

TSA follows DHS’s policies and procedures for managing its acquisition  programs, including for acquisition management, test and evaluation, and  resource allocation of its SRT. TSA’s acquisition programs and policies  are primarily set forth in DHS Acquisition Management Directive 102-01  (DHS’s acquisition directive) and DHS Instruction Manual 102-01-001,  Acquisition Management Instruction/Guidebook. DHS acquisition policy  establishes that an acquisition program’s decision authority should review  the program at a series of predetermined acquisition decision events to  assess whether the program is ready to proceed through the acquisition  life cycle phases. An acquisition program is established once it has  passed through the phases that establish the acquisition need and  selects an option that meets this need. Figure 2 depicts the DHS  acquisition life cycle.

Under DHS’s acquisition directive, TSA is to ensure, among other things,  that required acquisition documents are completed. Two of these key  acquisition documents are:  (1) the life cycle cost estimate, which provides an exhaustive and  structured accounting of all resources and associated cost elements  required to develop, produce, deploy, and sustain a program; and  (2) the acquisition program baseline, which establishes a program’s cost,  schedule, and performance metrics.

These documents are used throughout the process to identify instances  when an acquisition program exceeds cost, schedule, or performance  thresholds.

TSA’s acquisition policies, which supplement DHS policies, generally  designate roles and responsibilities and identify the procedures that TSA  is to use to implement the requirements in DHS policies. In December  2017, TSA reorganized its acquisition offices, which are responsible for  implementing TSARA’s requirements, from two offices (Office of  Acquisition and Office of Security Capabilities) into three offices:  Requirements and Capabilities, Acquisition Program Management, and  Contracting and Procurement.

TSARA includes a number of requirements for TSA, including developing  and submitting a biennial technology investment plan and annual small  business contracting goals reports to Congress, adhering to various  acquisition and inventory policies and procedures, and ensuring  consistency with Federal Acquisition Regulation and departmental  policies and directives. TSARA also includes requirements for justifying  acquisitions and establishing acquisition baselines, which largely codify  aspects of DHS’s existing acquisition policy described in DHS’s  acquisition directive. TSA fulfills these requirements through the  processes outlined in DHS’s acquisition directive when establishing a new  acquisition program or modifying an existing acquisition program. See  Appendix I for the list of TSARA’s requirements.

TSA Generally Addressed TSARA Requirements

Since 2016, TSA generally addressed TSARA requirements through its  acquisitions policies and procedures. Since our February 2016 report,  TSA has also developed and issued an updated technology investment  plan. Further, TSA has continued to submit an annual report to Congress  on TSA’s performance record in meeting its published small business  contracting goals.

TSA Policies and Procedures Continue to Address TSARA’s Requirements

TSA continues to address TSARA’s requirements, including those related  to acquisition justifications, baseline requirements, managing inventory  and consistency with regulations. In addition, TSA developed an updated  technology investment plan and submitted small business contracting  goals reports to Congress in accordance with TSARA.

TSARA provides that before TSA implements any SRT acquisition, the  agency must, in accordance with DHS policies and directives, conduct an  analysis to determine whether the acquisition is justified. The analysis  must include elements such as cost effectiveness and confirmation that  there are no significant risks to human health or safety posed by the  proposed acquisition, among others. In February 2016, we reported that  DHS and TSA had policies and procedures that were in place prior to  TSARA addressed each of the elements required in the analysis. For  example, DHS’s acquisition directive includes several of these elements  in its process for establishing a new acquisition program. TSARA also  includes a provision requiring TSA to submit information (i.e. report) to  Congress 30 days prior to the award of a contract for an SRT acquisition  over $30 million. TSA established procedures that address this  provision, as discussed later in this report, by developing a template for  providing justifications under this provision.

We found that, since 2016, TSA continues to have policies in place, such  as DHS’s acquisition directive, to address the analysis-related  requirements. TSA officials stated they would use these policies and  procedures to address TSARA’s requirements.

TSARA requires that before TSA implements any SRT acquisition, the  appropriate acquisition official from the department shall establish and  document a set of formal baseline requirements and subsequently review  whether acquisitions are meeting these requirements. Additionally,  TSARA provides that TSA must report a breach if results of any  assessment find that (1) actual or planned costs exceed the baseline  costs by more than 10 percent, (2) actual or planned schedule for delivery  has been delayed more than 180 days, or (3) there is a failure to meet  any performance milestone that directly impacts security effectiveness.  Pursuant to TSARA, in March 2016, TSA reported two breaches to  Congress for the Passenger Screening Program and Security Technology  Integrated Program (STIP), a data management system that connects  transportation security equipment to a single network. Further, in  February 2016, we reported that TSA had policies in place that require it  to prepare an acquisition program baseline, risk management plan, and  staffing requirements before acquiring SRT, in accordance with TSARA  requirements. We found that since our February 2016 report, TSA  continues to leverage the existing DHS acquisition directive to meet all of  TSARA’s baseline requirements.

TSARA requires that TSA, among other things:  to the extent practicable, use existing units in inventory before  procuring more equipment to fulfill a mission need;  track the location, use, and quantity of security-related equipment in  inventory; and  implement internal controls to ensure accurate and up-to-date data on  SRT owned, deployed, and in use.

In 2016, we reported that TSA’s policies and procedures address TSARA  requirements for managing inventory.

We found that since our February 2016 report, TSA continues to use  established policies and procedures to address TSARA’s inventory  management requirements. For example, TSA continues to use the  Security Equipment Management Manual, which describes the policies  and procedures that require TSA to use equipment in its inventory if, for  example, an airport opens a new terminal. Additionally, TSA has  procedures to track the location, use, and quantity of security-related  equipment in inventory, regardless of whether such equipment is in use.  Specifically, TSA has procedures to track the entire life cycle of  equipment, including initial possession, any moves, and disposal. Further,  TSA continues to use standard operating procedures developed by its  Internal Control Branch, which describe TSA’s system of internal controls  to conduct reviews, report, and follow-up on corrective actions.

TSARA provides that TSA must execute its acquisition-related  responsibilities in a manner consistent with and not duplicative of the  Federal Acquisition Regulation and DHS policies and directives. In  2016, we reported that TSA’s policy documents state that TSA is required  to ensure that its policies and directives are in accordance with the  Federal Acquisition Regulation and DHS acquisition and inventory  policies and procedures. We also reported that according to TSA’s  TSARA Implementation Strategy Memo (implementation strategy memo),  TSA was able to address this requirement by, among other things,  forming a working group as part of an effort to ensure that TSA  implemented TSARA in a manner consistent with the Federal Acquisition  Regulation and DHS policies and directives. We found that no changes  have been made to the implementation strategy memo since our 2016  report and TSA still has policies in place to execute the responsibilities  set forth in TSARA in a manner consistent with and not duplicative of the  Federal Acquisition Regulation and DHS policies and directives.

TSA Developed an Updated Technology Investment Plan in Accordance with TSARA

TSARA requires TSA to develop and submit to Congress a Strategic  Five-Year Technology Investment Plan (technology investment plan) and  update it on a biennial basis. The technology investment plan is to  include, among other things, a set of SRT acquisition needs that includes  planned technology programs and projects with defined objectives, goals,  timelines and measures, and an identification of currently deployed SRTs  that are at or near the end of their life cycles.

In August 2015, TSA developed and submitted to Congress the first  technology investment plan and in 2016 we reported that the 2015 plan  generally addressed TSARA requirements. In December 2017, TSA  developed and submitted to Congress an updated technology investment  plan in accordance with TSARA. The updated plan details the aviation  security efforts TSA initiated, developed, or completed since the initial  plan was released. The updated plan also includes the extent to which  TSA’s acquisitions were consistent with technology programs and  projects identified in the initial plan, as required by TSARA.

TSA officials stated that a positive effect of TSARA’s requirement to  develop the technology investment plan has been the establishment of  the Innovation Task Force. The task force, created in the Spring of 2016,  is tasked to identify and demonstrate emerging capabilities and facilitate  other innovative projects at select airports. TSA established the task force  based on feedback from industry representatives provided during  development of the initial plan. A TSA official who manages the task  force said that it led to efficiencies in TSA’s acquisition process. The  official noted, for example, that the task force began demonstrating  Automated Screening Lanes in March 2016 and by October 2016 DHS  approved additional deployments of the technology. For a video of TSA’s  Innovation Task Force demonstration of Automated Screening Lanes, see  the hyperlink in the note for figure 3.

TSA Continues to Submit Required Small Business Reports to Congress

TSARA requires TSA to submit an annual report to Congress on TSA’s  performance record in meeting its published small business contracting  goals during the preceding fiscal year.

If the preceding year’s goals were not met or TSA’s performance was  below the published small business contracting goals set for the  department, TSARA requires that TSA’s small business report includes a  list of challenges that contributed to TSA’s performance and an action  plan, with benchmarks, for addressing each of the challenges identified  that is prepared after consultation with other federal departments and  agencies. Since our last review, TSA has submitted small business  reports for fiscal years 2014 through 2017 and has reported achieving its  small business contracting goals.

TSA’s Narrow Application of TSARA Has Resulted in Limited Reporting to Congress on SRT- related Acquisitions

Through July 2018, TSA’s narrow application of TSARA’s report and  certification provision resulted in no SRT acquisitions being reported to  Congress pursuant to TSARA. In August 2018, TSA provided its first  three notifications on SRT acquisitions to Congress under this provision.

None of the Over $1 Billion TSA Obligated to Acquire SRT and Associated Services From December 18, 2014 Through July 2018 Resulted in TSA Reporting Under TSARA

TSA did not provide any information on contract awards or task or  delivery orders for the acquisition of SRT and associated services to  Congress under TSARA’s report and certification provision from  enactment through July 2018. Under the provision, TSA is to provide  Congress with a comprehensive justification and a certification that the  benefits to transportation security justify the contract cost not later than 30  days preceding the award of a contract for any SRT acquisition over $30  million.

Our analysis of FPDS-NG data on contract obligations from December  18, 2014 through July 2018 found approximately $1.4 billion in obligations  for acquisitions of SRT and for services associated with the operation of  SRT, as shown in table 1. Specifically, TSA obligated $591 million for  SRT. For services associated with an SRT that are necessary to ensure  its continuous and effective operation, such as maintenance and  engineering support services, TSA obligated $772 million during this  timeframe.

TSA’s Policy for Implementing TSARA’s Report and Certification Provision Reflects a Narrow Application of the Act

TSA officials said that none of the agency’s acquisition activities from  enactment through July 2018 invoked TSARA’s report and certification  provision because the activities did not align with TSA’s policy that  identifies SRT acquisitions subject to this provision. TSA’s policy on what  constitutes an SRT and the award of a contract for an SRT acquisition  ultimately determine what acquisitions are subject to TSARA’s report   and certification provision. See table 2 for TSA’s policy.

TSA’s TSARA Implementation Strategy Memo states, “o support   and ensure Congress is receiving the necessary information  regarding critical TSA acquisitions, TSA will focus on security screening  related technologies” which will ensure “the necessary actions are  implemented for those technologies the public directly interacts with (i.e.  is impacted by).” According to TSA officials, security screening related  technologies, i.e. SRT, subject to TSARA must (1) be equipment or  technology and (2) interact with (or impact) the public. Specific examples  of SRT subject to TSARA, as identified by TSA officials, are the  equipment typically deployed to airports to assist in the physical  screening of passengers and their property, such as AIT, EDS, and  boarding pass scanners.

TSA officials explained that in accordance with its policy, TSA provided its  first three notifications to Congress under TSARA’s report and  certification provision in August 2018, more than 30 days prior to the  award of three new SRT contracts, each with ceiling values in excess of  $30 million.

TSA Does Not Report SRT- Associated Services Under TSARA

Since the enactment of TSARA through July 2018, TSA awarded multiple  indefinite-delivery/indefinite-quantity (IDIQ) contracts and entered into a  blanket purchase agreement for services associated with the operation of  SRT, each with values in excess of $30 million, and issued orders under  the contracts and agreement that exceeded $30 million. In accordance  with TSA’s implementation policy, which applies to acquisitions of  physical screening equipment, TSA did not report these acquisition  actions under TSARA’s report and certification provision.

TSA officials said, consistent with its implementation policy, that services  associated with the operation of the SRT, such as engineering support,  maintenance services, and other services described in table 1, are not  SRT, as TSARA defines the term, because they are not equipment that  directly interacts with the public. Associated services, however, are  necessary to ensure the effective performance of SRT. For example,  engineering support can assist in addressing changing security needs,  such as through the development of threat detection algorithms and other  software or hardware improvements. Associated services have also been  used to extend the intended lifecycle of SRT already deployed to airport  checkpoints. TSA officials said that research and development  advancements have allowed TSA to upgrade existing equipment that had  reached the end of its initial lifecycle rather than acquire new equipment.  Further, TSA will likely need to increase spending on maintenance  services because the equipment parts may break down when used past  their intended life cycles. Consequently, through maintenance and  hardware improvements, for example, TSA has been able to offset the  need to procure new SRT by upgrading and maintaining existing SRT.

Examples of contract actions for the associated services described in  table 1 include:

Maintenance Services: TSA awarded three IDIQ contracts in 2015  and 2016, with ceiling values ranging from $76 million to $222 million,  and issued 10 orders under these IDIQ contracts with obligations that  each exceeded $30 million;

System Integration: TSA awarded three IDIQ contracts in 2015, each  with a ceiling value of $450 million;

STIP: In November 2017, TSA awarded a blanket purchase  agreement with a ceiling value of $250 million; and

Security Technology Support Services: TSA awarded three IDIQ  contracts in 2017 with ceiling values ranging from $65 million to $169  million.

The report of the Committee on Homeland Security of the House of  Representatives on TSARA explains that the law introduces greater  transparency and accountability for TSA spending decisions and codifies  acquisition best-practices that the committee believes will result in more  effective and efficient SRT acquisitions at TSA. As explained in the  report, TSARA is, in part, a response to historical examples where TSA  spent significant funds on SRT acquisitions that failed to meet security  performance objectives or wasted federal funds. Consistent with the  purpose of the statute expressed in the committee report, TSARA’s report  and certification provision promotes greater transparency over TSA  acquisition practices.

TSA obligates a significant amount of funds—approximately $772 million  from TSARA’s enactment through July 2018—for services that help  ensure the effective and continuous operation of SRT. Applying TSARA’s  report and certification provision to a broader range of services  associated with the operation of SRT would provide Congress with  increased transparency and improved oversight of TSA’s SRT acquisition  practices.

TSA Does Not Report SRT Task and Delivery Orders Under TSARA

According to TSA’s TSARA implementation policy, indefinite-quantity  contracts or blanket purchase agreements for “security screening related  technology equipment”, i.e. SRT, are subject to TSARA’s report and  certification provision when the ceiling value exceeds $30 million. The  implementation policy also explains that the provision does not apply to  individual task and delivery orders placed under these contracts or  agreements. However, IDIQ contracts typically have a lengthy period of  performance—for example one base year followed by four option years.  Specifically, from December 18, 2014 through July 2018, all of TSA’s 14  active contracts for SRT were IDIQ contracts awarded prior to the  enactment of TSARA on December 18, 2014. Further, 8 of the 14  contracts had been in place for 5 or more years, and according to TSA  officials, the agency had extended the original period of performance for 9  of the 14 contracts. Per its implementation policy, TSA did not report to  Congress under TSARA’s report and certification provision on the seven  task orders, ranging from $31 million to $70 million, to purchase and  install EDS, EDS upgrade kits, and explosives trace detection systems  issued under IDIQ contracts in place at the time of TSARA’s enactment.

See figure 4 for an example of an EDS IDIQ contract where TSA issued  orders in excess of $30 million and extended the contract’s original period  of performance.

One of TSA’s most recent SRT contract awards further illustrates how  TSA’s policy to only report on initial contract awards, and not orders  issued pursuant to the contract, has resulted in limited reporting under  TSARA’s report and certification provision. In September 2018, TSA  awarded a new $500 million IDIQ contract for the acquisition of medium  speed explosives detection systems. TSA reported this contract award to  the requisite committees pursuant to the report and certification provision  and consistent with its implementation policy. However, under TSA’s  policy, this is the only notification that Congress will receive pursuant to  TSARA over the course of the contract’s period of performance. For  example, TSA also issued a $55 million order to purchase and install  medium speed EDS units under this IDIQ contract, but per its  implementation policy, TSA did not report on this order under the  provision to Congress and per its policy would not do so for any  subsequent orders during the contract’s period of performance.

TSA has developed a policy with parameters for determining which  contract actions are subject to TSARA. However, TSA’s policy limits the  application of the report and certification provision only to initial contract  awards for physical security screening equipment. According to TSA  officials, TSA established this policy in order to ensure Congress is  informed as early as possible that there is potential for an award in  excess of $30 million as opposed to the point at which amounts awarded  reach $30 million. However, the implementation policy expressly excludes  orders in excess of $30 million issued under IDIQ contracts or blanket  purchase agreements for SRT.

Due to this narrow application of TSARA to its SRT acquisitions, TSA did  not report any information to Congress pursuant to TSARA’s report and  certification provision through July 2018. In addition, as currently  implemented this policy will continue to result in TSA providing Congress  with limited information in the future. As described earlier, TSARA was  enacted to introduce greater transparency and accountability for TSA  spending decisions. Because TSA’s policy for the report and  certification provision excludes reporting on task and delivery orders, TSA  misses the opportunity to inform Congress of the more routine SRT  obligations that exceed TSARA’s $30 million threshold. In addition,  applying TSARA’s report and certification provision to services that result  in new capabilities, enhancements, or otherwise upgrade SRTs would  provide Congress with increased transparency and improved oversight of  TSA’s SRT acquisition practices.

TSA Has Not Effectively Communicated Internally Its TSARA Implementation Decisions

TSA has not effectively communicated its implementation decisions  internally for what constitutes an SRT under TSARA. After the enactment  of TSARA, TSA formed a working group to evaluate the act and develop  an implementation strategy. The resulting policy is documented in TSA’s  TSARA Implementation Strategy Memo, published in June 2015.  According to TSA officials, the memo is the only formal document that  describes TSA’s TSARA policy. Among other things, the memo  designates roles and responsibilities for TSARA’s requirements and  outlines TSA’s approach to implementing each requirement.

To explain what constitutes an SRT for the purposes of TSARA, TSA  officials described various parameters to us that guide their decision- making. However, not all of these parameters are documented in the  implementation strategy memo. Specifically, the memo states that, “To  support  and ensure Congress is receiving the necessary  information regarding critical TSA acquisitions, TSA will focus on security  screening related technologies. This ensures the necessary actions are  implemented for those technologies the public directly interacts with (i.e.  is impacted by).” TSA officials clarified for us that technologies the public  does not directly interact with or that do not otherwise impact the public in  some physical manner, such as STIP and Secure Flight, are not  considered SRT and thus not subject to TSARA, but this distinction is not  clearly documented. Further, the memo does not explicitly explain which  technologies are considered SRT and which are not. For example, TSA  officials told us that SRT under TSARA excludes software such as  updates to threat detection algorithms, and other associated services  such as STIP, but this is not documented in the memo.

TSA acquisition program staff are responsible for determining if a new  acquisition qualifies as SRT under TSARA and initiating TSA’s  congressional notification process. TSA officials stated that program staff  rely upon the TSARA Implementation Strategy Memo to make these  decisions. During our review, TSA’s acquisition program staff were initially  unable to confirm in all instances whether the security-related equipment  they had acquired were subject to TSARA. Over the course of our review,  TSA officials clarified the application of TSARA’s SRT definition to us and  based on our inquiries, confirmed a list of existing technologies that are  considered SRT. However, this information has not been documented in  the TSARA Implementation Strategy Memo. TSA officials explained that  there was a lot of activity after TSARA was initially enacted to determine  how to comply with TSARA, but after the implementation working group  disbanded, activity subsequently faded. Consequently, the  implementation strategy memo has not been updated since its initial  distribution in June 2015. TSA officials stated that they plan to update the  implementation strategy memo by the end of calendar year 2018 to reflect  the new offices responsible for implementing TSARA’s requirements due  to an internal reorganization.

Effective information and communication are vital for an entity to achieve  its objectives. Standards for Internal Control in the Federal Government  states that management should document policies in the appropriate level  of detail and internally communicate the necessary quality information to  achieve the entity’s objectives. In the absence of a policy that clearly  states what constitutes an SRT and with several large acquisitions  pending, TSA may be missing an opportunity to ensure effective and  consistent implementation of TSARA.

TSA spends hundreds of millions of dollars each year developing,  acquiring, deploying, and maintaining technologies in furtherance of its  mission to ensure civil aviation security. Through TSARA, Congress  sought to address challenges faced by TSA in effectively managing its  acquisitions and procurements by specifying measures for TSA to  implement that align with identified acquisition best practices and  increase the transparency and accountability of TSA’s SRT acquisitions.  Overall, TSA has policies and procedures in place to accomplish many of  the reforms sought by TSARA, but more could be done to improve the  transparency of its spending on SRTs. Specifically, reporting on individual  task and delivery orders as well as associated services under TSARA’s  report and certification provision would help TSA ensure that Congress  has timely information it could use to effectively oversee TSA  acquisitions. TSA took a positive step towards greater transparency on  SRT spending with its first notifications to Congress in August 2018—in  accordance with its policy—, but TSA’s existing policy does not require  similar notification for associated services or for individual task and  delivery orders issued that exceed $30 million.

Further, while TSA developed the TSARA Implementation Strategy  Memo, which serves as TSA’s policy for implementing TSARA,  designated roles and responsibilities for TSARA’s requirements, and  outlined TSA’s approach to implement each requirement, TSA has not  clearly documented and internally communicated its parameters on what  constitutes an SRT under TSARA. With several large acquisitions  pending, clear guidance would better assure that staff understand how  TSARA’s reporting requirements apply. In the absence of updated  internal policy to clearly communicate what is or is not an SRT, TSA will  continue to be at risk of inconsistent and incomplete implementation of  TSARA.

We are making the following three recommendations to TSA:  The TSA Administrator should revise TSA’s policy to require that TSA  also submit information under TSARA’s report and certification provision  prior to the award of contracts and blanket purchase agreements for  services associated with the operation of security-related technology,  such as maintenance and engineering services, that exceed $30 million.  (Recommendation 1)

The TSA Administrator should revise TSA’s policy to require that TSA  also submit information under TSARA’s report and certification provision  prior to the issuance of individual task and delivery orders for security- related technology acquisitions that exceed $30 million.  (Recommendation 2)

The TSA Administrator should clarify and document what constitutes an  SRT under TSARA as part of the planned update of TSA’s TSARA  implementation policy. (Recommendation 3)

We provided a draft of this product to DHS for comment. In its comments,  reproduced in appendix II, DHS generally concurred with each of the  three recommendations and described steps it plans to take to implement  them. TSA also provided technical comments, which we incorporated as  appropriate.

While DHS concurred with our recommendation to revise TSA's policy to  include reporting on contracts over $30 million for services associated  with the operation of security-related technology, in its letter, DHS stated  that not all services associated with an SRT should be subject to  TSARA's reporting requirements. Specifically, it noted that TSA will revise  policy language and instructions to ensure that the justification analysis  and certification analysis required under TSARA is submitted prior to the  award contracts and blanket purchase agreements for services that would  result in new capabilities, enhancements, or otherwise upgrade SRT. It  distinguishes these services from services that are indirectly related to the  SRT or used to keep the SRT operational, such as deployment and  system integration.

We agree with this distinction and do not consider all of the associated  services mentioned in this report as necessary for inclusion in TSA’s  revised policy. Further, we recognize that TSA, in conjunction with  feedback from Congress, is best positioned to determine the services  included in its revised policy for reporting under TSARA, consistent with  its interest in avoiding duplicative or administratively burdensome  reporting and delays in the acquisition process. We are encouraged by  DHS’s plans to implement this recommendation and its recognition that  the additional information will provide Congress with increased  transparency and an opportunity for more effective oversight of TSA’s  acquisitions.

DHS also described planned actions to address our recommendation to  revise TSA’s policy to include reporting on individual task and delivery  orders that exceed $30 million. DHS expects to complete the revisions by  September 30, 2019. If implemented, this action should provide Congress  with greater transparency over TSA’s SRT acquisitions.

DHS also noted that, in accordance with our recommendation to update  its implementation guidance, it plans to (1) clarify and document what  constitutes an SRT under TSARA and (2) document all offices  responsible for implementing TSARA’s requirements in its TSARA  implementation strategy memo by September 30, 2019. If implemented,  guidance that is clear and documented will better assure that staff across  all DHS offices will understand how to consistently implement TSARA.

We are sending copies of this report to the appropriate congressional  committees and the Secretary of Homeland Security. In addition, the  report is available at no charge on the GAO website at  http://www.gao.gov.

If you or your staff have any questions concerning this report, please  contact me at (202) 512-8777 or russellw@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found  on the last page of this report. GAO staff who made significant  contributions to this report are listed in Appendix III.

Appendix I: Transportation Security Acquisition Reform Act Requirements

In tables three through eight, we identify the requirements of the  Transportation Security Acquisition Reform Act (TSARA), as enacted on  December 18, 2014.

Appendix II: Comments from the Department of Homeland Security

Appendix III: GAO Contact and Staff Acknowledgements

In addition to the contact named above, Kevin Heinz (Assistant Director),  Amber Edwards (Analyst-in-Charge), Winchee Lin, Cristina Norland,  Richard Hung, Thomas Lombardi, Amanda Miller, and Richard  Cederholm made key contributions to this report.

Security technologies—such as body scanners and explosives detection systems—are a crucial and often expensive part of TSA's work.

To help ensure that TSA's technology purchases are strategic and efficient, Congress required TSA to justify technology acquisitions costing more than $30 million at least 30 days before awarding a contract.

This particular requirement stems from a 2014 law, but TSA did not submit its first justifications under the law until August 2018. While we found that TSA has generally been consistent with the law's requirements, we also recommended that TSA revise its policies to report more frequently under the law.