2020 Census: Actions Needed to Mitigate Key Risks Jeopardizing a Cost-Effective Enumeration

One of the Bureau's most important functions is to conduct a complete and accurate decennial census of the U.S. population. The decennial census is mandated by the Constitution and provides vital data for the nation. A complete count of the nation's population is an enormous undertaking as the Bureau seeks to control the cost of the census, implement operational innovations, and use new and modified IT systems. In recent years, GAO has identified challenges that raise serious concerns about the Bureau's ability to conduct a cost-effective count. For these reasons, GAO added the 2020 Census to its High-Risk list in February 2017.

In light of these challenges, GAO was asked to testify about the reasons the 2020 Census was placed on the High-Risk List. To do so, GAO summarized its prior work regarding the Bureau's planning efforts for the 2020 Census. GAO also included observations from its ongoing work on the 2018 End-to-End Test. This information is related to, among other things, recent decisions on preparations for the 2020 Census; progress on key systems to be used for the 2018 End-to-End Test, including the status of IT security assessments; execution of the address canvassing operation at the test sites; and efforts to update the life-cycle cost estimate.

GAO added the 2020 Census to its high-risk list because of challenges associated with (1) developing and testing key innovations; (2) implementing and securing IT systems; and (3) controlling any further cost growth and preparing reliable cost estimates. The Census Bureau (Bureau) is planning several innovations for the 2020 Decennial Census, including re-engineering field operations by relying on automation, using administrative records to supplement census data, verifying addresses in-office using on-screen imagery, and allowing the public to respond using the Internet. These innovations show promise for controlling costs, but they also introduce new risks, in part because they have not been used extensively in earlier enumerations, if at all. As a result, robust testing is needed to ensure that key systems and operations will function as planned. However, citing budgetary uncertainties, the Bureau canceled its 2017 field test and then scaled back its 2018 End-to End Test. Without sufficient testing, operational problems can go undiscovered and the opportunity to improve operations will be lost, as key census-taking activities will not be tested across a range of geographic locations, housing types, and demographic groups.

The Bureau continues to face challenges in managing and overseeing the information technology (IT) programs, systems, and contracts supporting the 2020 Census. For example, GAO's ongoing work indicates that the system development schedule leading up to the 2018 End-to-End test has experienced several delays. Further, the Bureau has not addressed several security risks and challenges to secure its systems and data, including making certain that security assessments are completed in a timely manner and that risks are at an acceptable level. Given that certain operations for the 2018 End-to-End Test began in August 2017, it is important that the Bureau quickly address these challenges. GAO plans to monitor the Bureau's progress as part of its ongoing work.

In addition, the Bureau needs to control any further cost growth and develop cost estimates that reflect best practices. Earlier this month, the Department of Commerce (Department) announced that it had updated the October 2015 life-cycle cost-estimate and now projects the life-cycle cost of the 2020 Census will be $15.6 billion, more than $3 billion (27 percent) increase over its earlier estimate. The higher estimated life-cycle cost is due, in part, to the Bureau's failure to meet best practices for a quality cost-estimate. The Bureau and Department are still finalizing the documentation used to develop the $15.6 billion cost-estimate. Until these documents are complete and made available for inspection, GAO cannot determine the reliability of the estimate.

Over the past decade, we have made 84 recommendations specific to the 2020 Census to address the issues raised in this testimony and others. The Bureau generally has agreed with our recommendations. As of October 2017, 36 recommendations had not been implemented.

I am pleased to be here today to discuss the U.S. Census Bureau’s  (Bureau) progress in preparing for the 2020 Decennial Census.  Conducting the decennial census of the U.S. population is mandated by  the Constitution and provides vital data for the nation. The information  that the census collects is used to apportion the seats of the House of  Representatives; redraw congressional districts; allocate billions of dollars  each year in federal financial assistance; and provide a social,  demographic, and economic profile of the nation’s people to guide policy  decisions at each level of government. Further, businesses use census  data to market new services and products and to tailor existing ones to  demographic changes.

For 2020, a complete count of the nation’s population is an enormous  undertaking as the Bureau seeks to control the cost of the census while it  implements several innovations and manages the processes of acquiring  and developing new and modified information technology (IT) systems. In  recent years, we have identified challenges that raise serious concerns  about the Bureau’s ability to conduct a cost-effective count of the nation,  including issues with the agency’s research, testing, planning, scheduling,  cost estimation, systems development, and IT security practices. Over the  past decade, we have made 84 recommendations specific to the 2020  Census to help address these and other issues. The Bureau has  generally agreed with those recommendations; however 36 of them had  not been implemented as of October 2017. We also added the 2020  Decennial Census to GAO’s High-Risk List in February 2017. As  preparations for 2020 ramp-up, addressing the risks jeopardizing the  2020 Census by implementing our recommendations is more critical than  ever.

The Bureau is currently conducting the 2018 End-to-End Test, which  began in August 2017 and runs through April 2019. It is the Bureau’s final  opportunity to test all key systems and operations to ensure readiness for  the 2020 Census.

My testimony today will describe (1) why we added the decennial census  to our high risk list, and (2) the steps the Department of Commerce and  the Bureau need to take going forward to mitigate the risks jeopardizing a  cost-effective census.

The information in this statement is based primarily on prior work  regarding the Bureau’s planning efforts for 2020. For that body of work,  we reviewed, among other things, relevant Bureau documentation,  including the 2020 Census Operational Plan, recent decisions on  preparations for the 2020 Census, and outcomes of key IT milestone  reviews. Other details on the scope and methodology for our prior work  are provided in each published report on which this testimony is based.  We also discussed the status of recommendations with Department of  Commerce and Bureau staff.

In addition, we included information in this statement from our ongoing  work on the 2018 End-to-End Test. For our ongoing work examining the  address canvassing operation, we reviewed plans for and the execution  of the address canvassing portion of the 2018 End-to-End Test at each of  the three test sites—in Pierce County, Washington; Providence County,  Rhode Island; and Bluefield-Beckley-Oak Hill, West Virginia. Across the  three test sites, we observed 18 census workers conduct address  canvassing operations and interviewed local office staff at each location.  These observations are not generalizable.

For our ongoing work on the readiness of the Bureau’s IT systems, we  collected and reviewed documentation on the status and plans for system  development, testing, and security assessments for the 2018 End-to-End  Test. This includes the Bureau’s integration and implementation plan,  solution architecture, and memorandums documenting outcomes of  security assessments. We also interviewed agency officials.

We provided a copy of the new information we are reporting in this  testimony to the Bureau for comment on October 19, 2017. The Bureau  provided technical comments, which we addressed as appropriate.

We conducted the work on which this statement is based in accordance  with generally accepted government auditing standards. Those standards  require that we plan and perform the audit to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe that the evidence obtained  provides a reasonable basis for our findings and conclusions based on  our audit objectives.

The cost of the census has been escalating over the last several  decennials. The 2010 decennial was the costliest U.S. Census in history  at about $12.3 billion, and was about 31 percent more costly than the  $9.4 billion 2000 Census (in 2020 dollars). The average cost for counting  a housing unit increased from about $16 in 1970 to around $92 in 2010  (in 2020 dollars). According to the Department of Commerce  (Department), the total cost of the 2020 Census is now estimated to be  approximately $15.6 billion dollars, more than $3 billion higher than  previously reported by the Bureau.

Meanwhile, the return of census questionnaires by mail (the primary  mode of data collection) declined over this period from 78 percent in 1970  to 63 percent in 2010 (see figure 1). Declining mail response rates—a key  indicator in determining the cost-effectiveness of the census—are  significant and lead to higher costs. This is because the Bureau sends  temporary workers to each non-responding household to obtain census  data. As a result, non-response follow-up is the Bureau’s largest and  most costly field operation. In many ways, the Bureau has had to invest  substantially more resources each decade to conduct the enumeration.

Achieving a complete and accurate census is becoming an increasingly  daunting task, in part, because the nation’s population is growing larger,  more diverse, and more reluctant to participate. When the census misses  a person who should have been included, it results in an undercount;  conversely, an overcount occurs when an individual is counted more than  once. Such errors are particularly problematic because of their impact on  various subgroups. Minorities, renters, and children, for example, are  more likely to be undercounted by the census.

The challenges to an accurate count can be seen, for example, in the  difficulties associated with counting people residing in unconventional and  hidden housing units, such as converted basements and attics. In figure  2, what appears to be a small, single-family house could contain an  apartment, as suggested by its two doorbells. If an address is not in the  Bureau’s address file, its residents are less likely to be included in the  census.

The Bureau Plans to Rely Heavily on IT for the 2020 Census

The Bureau plans to rely heavily on both new and legacy IT systems and  infrastructure to support the 2018 End-to-End Test and the 2020 Census  operations. For example, the Bureau plans to deploy and use 43 systems  in the 2018 End-to-End Test. Eleven of these systems are being  developed or modified as part of an enterprise-wide initiative called  Census Enterprise Data Collection and Processing (CEDCaP), which is  managed within the Bureau’s IT Directorate. This initiative is a large and  complex modernization program intended to deliver a system-of-systems  to support all of the Bureau’s survey data collection and processing  functions, rather than continuing to rely on unique, survey-specific  systems with redundant capabilities. According to Bureau officials, the  remaining 32 IT systems are being developed or modified by the 2020  Census Directorate or other Bureau divisions.

To support the 2018 End-to-End Test, the Bureau plans to incrementally  deploy and use the 43 systems for nine operations from December 2016  through the end of the test in April 2019. These nine operations are: (1)  in-office address canvassing, (2) recruiting staff for address canvassing,  (3) training for address canvassing, (4) in-field address canvassing, (5)  recruiting staff for field enumeration, (6) training for field enumeration, (7)  self-response (i.e., Internet, phone, or paper), (8) field enumeration, and  (9) tabulation and dissemination.

Key Risks are Jeopardizing a Cost- Effective Enumeration

We added the 2020 Census to our list of high-risk programs in February,  2017, because (1) innovations never before used in prior enumerations  will not be fully tested; (2) the Bureau continues to face challenges in  implementing and securing IT systems; and (3) the Bureau needs to  control any further cost growth and develop reliable cost estimates. Each  of these key risks are discussed in greater detail below; if not sufficiently  addressed, these risks could adversely impact the cost and/or quality of  the enumeration. Moreover, they compound the inherent challenges of  conducting a successful census such as the nation’s increasingly diverse  population and concerns over personal privacy.

Key Risk #1: Reduced Operational Testing Limits Confidence in 2020 Census Innovation Areas

The basic design of the enumeration—mail out and mail back of the  census questionnaire with in-person follow-up for non-respondents—has  been in use since 1970. However, a key lesson learned from the 2010  Census and earlier enumerations, is that this “traditional” design is no  longer capable of cost-effectively counting the population.

In response to its own assessments, our recommendations, and studies  by other organizations, the Bureau has fundamentally re-examined its  approach for conducting the 2020 Census. Specifically, its plan for 2020  includes four broad innovation areas: re-engineering field operations,  using administrative records, verifying addresses in-office, and  developing an Internet self-response option (see table 1).

If they function as planned, the Bureau initially estimated that these  innovations could result in savings of over $5 billion (in 2020 dollars)  when compared to its estimates of the cost for conducting the census with  traditional methods. However, in June 2016, we reported that the  Bureau’s life-cycle cost estimate of $12.5 billion, developed in October  2015, was not reliable and did not adequately account for risk. As  discussed earlier in this statement, the Department has recently updated  this figure and now estimates a life-cycle cost of $15.6 billion. At this  higher level, the cost savings would be reduced to around $1.9 billion.

While the planned innovations could help control costs, they also  introduce new risks, in part, because they include new procedures and  technology that have not been used extensively in earlier decennials, if at  all. Our prior work has shown the importance of the Bureau conducting a  robust testing program, including the 2018 End-to-End Test. Rigorous  testing is a critical risk mitigation strategy because it provides information  on the feasibility and performance of individual census-taking activities,  their potential for achieving desired results, and the extent to which they  are able to function together under full operational conditions. To address  some of these challenges we have made several recommendations  aimed at improving reengineered field operations, using administrative  records, verifying the accuracy of the address list, and securing census  responses via the Internet  The Bureau has held a series of operational tests since 2012, but  according to the Bureau, has scaled back recent tests because of funding  uncertainties. For example, the Bureau canceled the field components of  the 2017 Census Test including non-response follow-up, a key census  operation. In November 2016, we reported that the cancelation of the  2017 field test was a lost opportunity to test, refine, and integrate  operations and systems, and that it put more pressure on the 2018 End- to-End Test to demonstrate that enumeration activities will function under  census-like conditions as needed for 2020. However, in May 2017, the  Bureau scaled back the operational scope of the 2018 End-to-End and, of  the three planned test sites; only the Rhode Island site would fully  implement the 2018 End-to-End Test. The Washington and West Virginia  state test sites would test just one field operation, address canvassing. In  addition, due to budgetary concerns, the Bureau decided to remove three  coverage measurement operations (and the technology that supports  them) from the scope of the test.

Without sufficient testing, operational problems can go undiscovered and  the opportunity to improve operations will be lost, in part because the  2018 End-to-End Test is the last opportunity to demonstrate census  technology and procedures across a range of geographic locations,  housing types, and demographic groups.

Operational Issues Observed in the End-to-End Test Will Need to Be Addressed

On August 28, 2017, temporary census employees known as address  listers began implementing the in-field component of address canvassing  for the 2018 End-to-End Test. Listers walked the streets of designated  census blocks at all three test sites to verify addresses and geographic  locations. The operation ended on September 27, 2017. As part of our  ongoing work, we visited all three test sites and observed 18 listers  conduct address canvassing. Generally, we found that listers were able to  conduct address canvassing as planned. However, we also noted several  challenges. We shared the following preliminary observations from our  site visits with the Bureau:  Internet connectivity was problematic at the West Virginia test site.  We spoke to four census field supervisors who described certain  areas as dead spots where Internet and cell phone service were not  available. We also were told by those same supervisors that only  certain cell service providers worked in certain areas. In order to  access the Internet or cell service in those areas, census workers  sometimes needed to drive several miles.

The allocation of lister assignments was not always optimal. Listers  were supposed to be provided assignments close to where they live in  order to optimize their local knowledge and to limit the numbers of  miles being driven by listers to and from their assignment area.  Bureau officials told us this was a challenge at all three test sites.  Moreover, at one site the area census manager told us that some  listers were being assigned work in another county even though  blocks were still unassigned closer to where they resided. Relying on  local knowledge and limiting the number of miles can increase both  the efficiency and effectiveness of address canvassing.

The assignment of some of the large blocks early in the operations  was not occurring as planned. At all three 2018 End-to-End Test sites  Bureau managers had to manually assign some large blocks (some  blocks had hundreds of housing units). It is important to assign large  blocks early on because leaving the large blocks to be canvassed  until the end of the operation could jeopardize the timely completion of  address canvassing.

According to Bureau officials,during the test, completed address and  map updates for some blocks did not properly transmit. This  happened at all three test sites, and included data on 11 laptops for  25 blocks. The address and map information on seven of the laptops  was permanently deleted. However, data on four laptops were still  available. The Bureau is examining those laptops to determine what  occurred that prevented the data from being transmitted. In  Providence, Rhode Island, where the full test will take place, the  Bureau recanvassed those blocks where data were lost to ensure that  the address and map information going forward was correct. It will be  important for the Bureau to understand what happened and ensure all  address and map data is properly transmitted for the 2020 Census.

We have discussed these challenges with Bureau officials who stated that  overall they are satisfied with the implementation of address canvassing  but also agreed that resolving challenges discovered during address  canvassing, some of which can affect the operation’s efficiency and  effectiveness, will be important before the 2020 Census. We plan to issue  a report early in 2018 on address canvassing at the three test sites.

Key Risk #2: The Bureau Continues to Face Challenges Implementing and Securing IT Systems

We have previously reported that the Bureau faced challenges in  managing and overseeing IT programs, systems, and contractors  supporting the 2020 Census. Specifically, it has been challenged in  managing schedules, costs, contracts, governance and internal  coordination, and security for its IT systems. As a result of these  challenges, the Bureau is at risk of being unable to fully implement key IT  systems necessary to support the 2020 Census and conduct a cost- effective enumeration. We have previously recommended that the Bureau  take action to improve its implementation and management of IT in areas  such as governance and internal coordination. We also have ongoing  work reviewing each of these areas.

Our ongoing work has indicated that the Bureau faces significant  challenges in managing the schedule for developing and testing systems  for the 2018 End-to-End Test that began in August 2017. In this regard,  the Bureau still has significant development and testing work that remains  to be completed. As of August 2017, of the 43 systems in the test, the  Bureau reported that 4 systems had completed development and  integration testing, while the remaining 39 systems had not completed  these activities.

Of these 39 systems, the Bureau reported that it had deployed a portion  of the functionality for 21 systems to support address canvassing for the  2018 End-to-End Test; however, it had not yet deployed any functionality  for the remaining 18 systems for the test. Figure 3 summarizes the  development and testing status for the 43 systems planned for the 2018  End-to-End Test.

Moreover, due to challenges experienced during systems development,  the Bureau has delayed key IT milestone dates (e.g., dates to begin  integration testing) by several months for several of the systems in the  2018 End-to-End Test. Figure 4 depicts the delays to the deployment  dates for the operations in the 2018 End-to-End Test, as of August 2017.

Our ongoing work also indicates that the Bureau is at risk of not meeting  the updated milestone dates. For example, in June 2017 the Bureau  reported that at least two of the systems expected to be used in the self- response operation (the Internet self-response system and the call center  system) are at risk of not meeting the delayed milestone dates. In  addition, in September 2017 the Bureau reported that at least two of the  systems expected to be used in the field enumeration operation (the  enumeration system and the operational control system) are at risk of not  meeting their delayed dates.

Combined, these delays reduce the time available to conduct the security  reviews and approvals for the systems being used in the 2018 End-to- End Test. We previously testified in May 2017 that the Bureau faced  similar challenges leading up to the 2017 Census Test, including  experiencing delays in system development that led to compressed time  frames for security reviews and approvals.  Specifically, we noted that  the Bureau did not have time to thoroughly assess the low-impact  components of one system and complete penetration testing for another  system prior to the test, but accepted the security risks and uncertainty  due to compressed time frames. We concluded that, for the 2018 End-to- End Test, it will be important that these security assessments are  completed in a timely manner and that risks are at an acceptable level  before the systems are deployed.

The Bureau noted that, if it continues to be behind schedule, key field  operations for the 2018 End-to-End Test (such as non-response follow- up) could be delayed or canceled, which may affect the Bureau’s ability to  meet the test’s objectives. As we stated earlier, without sufficient testing,  operational problems can go undiscovered and the opportunity to improve  operations will be lost. Bureau officials are evaluating options to decrease  the impact of these delays on integration testing and security review  activities by, for example, utilizing additional staff. We have ongoing work  reviewing the Bureau’s development and testing delays and the impacts  of these delays on systems readiness for the 2018 End-to-End Test.

The Bureau faces challenges in reporting and controlling IT cost growth.  In April 2017, the Bureau briefed us on its efforts to estimate the costs for  the 2020 Census, during which it presented IT costs of about $2.4 billion  from fiscal years 2018 through 2021. Based on this information and other  corroborating IT contract information provided by the Bureau, we testified  in May 2017 that the Bureau had identified at least $2 billion in IT costs.

However, in June 2017, Bureau officials in the 2020 Census Directorate  told us that the data they provided in April 2017 did not reflect all IT costs  for the 2020 program. The officials provided us with an analysis of the  Bureau’s October 2015 cost estimate that identified $3.4 billion in total IT  costs from fiscal years 2012 through 2023. These costs included, among  other things, those associated with system engineering, test and  evaluation, and infrastructure, as well as a portion of the costs for the  CEDCaP program.

Yet, our ongoing work determined the Bureau’s $3.4 billion cost estimate  from October 2015 did not reflect its current plans for acquiring IT to be  used during the 2020 Census and that the related costs are likely to  increase:  In August 2016, the Bureau awarded a technical integration contract  for about $886 million, a cost that was not reflected in the $3.4 billion  expected IT costs. More recently, in May 2017, we testified that the  scope of work for this contract had increased since the contract was  awarded; thus, the corresponding contract costs were likely to rise  above $886 million, as well.

In March 2017, the Bureau reported that the contract associated with  the call center and IT system to support the collection of census data  over the phone was projected to overrun its initial estimated cost by at  least $40 million.

In May 2017, the Bureau reported that the CEDCaP program’s cost  estimate was increasing by more than $400 million—from its original  estimate of $548 million in 2013 to a revised estimate of $965 million  in May 2017.

In June 2017, the Bureau awarded a contract for mobile devices and  associated services for about $283 million, an amount that is about  $137 million higher than the cost for these devices and services  identified in its October 2015 estimate.

As a result of these factors, the Bureau’s $3.4 billion estimate of IT costs  is likely to be at least $1.4 billion higher, thus increasing the total costs to  at least $4.8 billion. Figure 5 identifies the Bureau estimate of total IT  costs associated with the 2020 program as of October 2015, as well as  anticipated cost increases as of August 2017.

IT cost information that is accurately reported and clearly communicated  is necessary so that Congress and the public have confidence that  taxpayer funds are being spent in an appropriate manner. However,  changes in the Bureau’s reporting of these total costs, combined with cost  growth since the October 2015 estimate, raise questions as to whether  the Bureau has a complete understanding of the IT costs associated with  the 2020 program. In early October 2017, the Secretary of Commerce  testified that he expected the total IT costs for the 2020 Census to be  about $4.96 billion. This estimate of IT costs is approximately $1.6 billion  higher than the Bureau’s October 2015 estimate and further confirms our  analysis of expected IT cost increases discussed above. As of late  October 2017, the Bureau and Department were still finalizing the  documentation used to develop the new cost estimate. After these  documents are complete and made available for inspection, as part of our  ongoing work, we plan to evaluate whether this updated IT cost estimate  includes the cost increases, discussed above, that were not included in  the October 2015 estimate.

Our ongoing work also determined that the Bureau faces challenges in  managing its significant contractor support. The Bureau is relying on  contractor support in many key areas of the 2020 Census. For example, it  is relying on contractors to develop a number of key systems and  components of the IT infrastructure. These activities include (1)  developing the IT platform that is intended to be used to collect data from  those responding via the Internet, telephone, and non-response follow-up  activities; (2) procuring the mobile devices and cellular service to be used  for non-response follow-up; and (3) developing the infrastructure in the  field offices. According to Bureau officials, contractors are also providing  support in areas such as fraud detection, cloud computing services, and  disaster recovery.

In addition to the development of key technology, the Bureau is relying on  contractor support for integrating all of the key systems and infrastructure.  The Bureau awarded a contract to integrate the 2020 Census systems  and infrastructure in August 2016. The contractor’s work was to include  evaluating the systems and infrastructure and acquiring the infrastructure  (e.g., cloud or data center) to meet the Bureau’s scalability and  performance needs. It was also to include integrating all of the systems,  supporting technical testing activities, and developing plans for ensuring  the continuity of operations. Since the contract was awarded, the Bureau  has modified the scope to also include assisting with operational testing  activities, conducting performance testing for two Internet self-response  systems, and technical support for the implementation of the paper data  capture system.

However, our ongoing work has indicated that the Bureau is facing  staffing challenges that could impact its ability to manage and oversee the  technical integration contractor. Specifically, the Bureau is managing the  integration contractor through a government program management office,  but this office is still filling vacancies. As of October 2017, the Bureau  reported that 35 of the office’s 58 federal employee positions were  vacant. As a result, this program management office may not be able to  provide adequate oversight of contractor cost, schedule, and  performance.

The delays during the 2017 Test and preparations for the 2018 End-to- End Test raises concerns regarding the Bureau’s ability to effectively  perform contractor management. As we reported in November 2016, a  greater reliance on contractors for these key components of the 2020  Census requires the Bureau to focus on sound management and  oversight of the key contracts, projects, and systems. As part of our  ongoing work, we plan to monitor the Bureau’s progress in managing its  contractor support.

Effective IT governance can drive change, provide oversight, and ensure  accountability for results. Further, effective IT governance was envisioned  in the provisions referred to as the 2014 Federal Information Technology  Acquisition Reform Act (FITARA), which strengthened and reinforced  the role of the departmental CIO. The component CIO also plays a role in  effective IT governance as subject to the oversight and policies of the  parent department or agency implementing FITARA.

To ensure executive-level oversight of the key systems and technology,  the Bureau’s CIO (or a representative) is a member of the governance  boards that oversee all of the operations and technology for the 2020  Census. However, in August 2016 we reported on challenges the Bureau  has had with IT governance and internal coordination, including  weaknesses in its ability to monitor and control IT project costs,  schedules, and performance. We made several recommendations to the  Department of Commerce to direct the Bureau to, among other things,  better ensure that risks are adequately identified and schedules are  aligned. The Department agreed with our recommendations. However, as  of October 2017, the Bureau had only fully implemented one  recommendation and had taken initial steps toward implementing others.

Further, given the schedule delays and cost increases previously  mentioned, and the vast amount of development, testing, and security  assessments left to be completed, we remain concerned about executive- level oversight of systems and security. Moving forward, it will be  important that the CIO and other Bureau executives continue to use a  collaborative governance approach to effectively manage risks and  ensure that the IT solutions meet the needs of the agency within cost and  schedule. As part of our ongoing work, we plan to monitor the steps the  Bureau is taking to effectively oversee and manage the development and  acquisition of its IT systems.

In November 2016, we described the significant challenges that the  Bureau faced in securing systems and data for the 2020 Census, and we  noted that tight time frames could exacerbate these challenges. Two  such challenges were (1) ensuring that individuals gain only limited and  appropriate access to the 2020 Census data, including personally  identifiable information (PII) (e.g., name, personal address, and date of  birth), and (2) making certain that security assessments were completed  in a timely manner and that risks were at an acceptable level. Protecting  PII, for example, is especially important because a majority of the 43  systems to be used in the 2018 End-to-End Test contain PII, as reflected  in figure 6.

To address these and other challenges, federal law and guidance specify  requirements for protecting federal information and information systems,  such as those to be used in the 2020 Census. Specifically, the Federal  Information Security Management Act of 2002 and the Federal  Information Security Modernization Act of 2014 (FISMA) require executive  branch agencies to develop, document, and implement an agency-wide  program to provide security for the information and information systems  that support operations and assets of the agency.

Accordingly, the National Institute of Standards and Technology (NIST)  developed risk management framework guidance for agencies to follow in  developing information security programs. Additionally, the Office of  Management and Budget’s (OMB) revised Circular A-130 on managing  federal information resources required agencies to implement the NIST risk management framework to integrate information security and risk  management activities into the system development life cycle.

In accordance with FISMA, NIST guidance, and OMB guidance, the  Office of the CIO established a risk management framework. This  framework requires that system developers ensure that each of the  systems undergoes a full security assessment, and that system  developers remediate critical deficiencies. In addition, according to the  Bureau’s framework, system developers must ensure that each  component of a system has its own system security plan, which  documents how the Bureau plans to implement security controls. As a  result, system developers for a single system might develop multiple  system security plans which all have to be approved as part of the  system’s complete security documentation. We have ongoing work that is  reviewing the extent to which the Bureau’s framework meets the specific  requirements of the NIST guidance.

According to the Bureau’s framework, each of the 43 systems in the 2018  End-to-End Test will need to have complete security documentation (such  as system security plans) and an approved authorization to operate  prior to their use in the 2018 End-to-End Test. However, our ongoing  work indicates that, while the Bureau is completing these steps for the 43  systems to be used in the 2018 End-to-End Test, significant work  remains. Specifically, as we reported in October 2017:

None of the 43 systems are fully authorized to operate through the  completion of the 2018 End-to-End Test. Bureau officials from the  CIO’s Office of Information Security stated that these systems will  need to be reauthorized because, among other things, they have  additional development work planned that may require the systems to  be reauthorized; are being moved to a different infrastructure  environment (e.g., from a data center to a cloud-based environment);  or have a current authorization that expires before the completion of  the 2018 End-to-End Test. The amount of work remaining is  concerning because the test has already begun and the delays  experienced in system development and testing mentioned earlier  reduce the time available for performing the security assessments  needed to fully authorize these systems before the completion of the  2018 End-to-End test.

Thirty-seven systems have a current authorization to operate, but the  Bureau will need to reauthorize these systems before the completion  of the 2018 End-to-End Test. This is due to the reasons mentioned  previously, such as additional development work planned and  changes to the infrastructure environments.

Two systems have not yet obtained an authorization to operate.

For the remaining four systems, the Bureau has not yet provided us  with documentation about the current authorization status.

Figure 7 depicts the authorization to operate status for the systems being  used in the 2018 End-to-End Test, as reported by the Bureau.

Because many of the systems that will be a part of the 2018 End-to-End  Test are not yet fully developed, the Bureau has not finalized all of the  security controls to be implemented; assessed those controls; developed  plans to remediate control weaknesses; and determined whether there is  time to fully remediate any deficiencies before the systems are needed for  the test. In addition, as discussed earlier, the Bureau is facing system  development challenges that are delaying the completion of milestones  and compressing the time available for security testing activities.

While the large-scale technological changes (such as Internet self- response) increase the likelihood of efficiency and effectiveness gains,  they also introduce many information security challenges. The 2018 End- to-End Test also involves collecting PII on hundreds of thousands of  households across the country, which further increases the need to  properly secure these systems. Thus, it will be important that the Bureau  provides adequate time to perform these security assessments,  completes them in a timely manner, and ensures that risks are at an  acceptable level before the systems are deployed. We plan to continue  monitoring the Bureau’s progress in securing its IT systems and data as  part of our ongoing work.

Key Risk #3: Lack of Reliable Costs Estimates Limits Support for 2020 Census Funding

Earlier this month, the Department announced that it had updated the  October 2015 life-cycle cost estimate and now projects the life-cycle cost  of the 2020 Census will be $15.6 billion, more than a $3 billion (27  percent) increase over the Bureau’s earlier estimate. The higher  estimated life-cycle cost is due, in part, as we reported in June 2016, to  the Bureau’s failure to meet best practices for a quality cost-estimate.  Specifically, we reported that, although the Bureau had taken steps to  improve its capacity to carry out an effective cost estimate, such as  establishing an independent cost estimation office, its October 2015  version of the estimate for the 2020 Census only partially met the  characteristics of two best practices (comprehensive and accurate) and  minimally met the other two (well-documented and credible). We also  reported that risks were not properly accounted for in the cost estimate.

We recommended that the Bureau take action to ensure its 2020 Census  cost estimate meets all four characteristics of a reliable cost estimate, as  well as properly account for risk to ensure there are appropriate levels for  budgeted contingencies. The Bureau agreed with our recommendations.  In response, the Department of Commerce reported that in May 2017, a  multidisciplinary team was created to evaluate the 2020 Census program  and to produce an independent cost estimate. Factors driving the  increased cost-estimate include changes to assumptions relating to self- response rates, wage levels for temporary census workers, as well as the  fact that major contracts and IT scale-up plans and procedures were not  effectively planned, managed, and executed. The new estimate also  includes a contingency of 10 percent of estimated costs per year as  insurance against “unknown-unknowns”, such as a major cybersecurity  event.

The Bureau and Department are still finalizing the documentation used to  develop the $15.6 billion cost-estimate. Until these documents are  complete and made available for inspection, we cannot determine the  reliability of the estimate. We will review the documentation when it is  available. In order for the estimate to be deemed high quality, and thus  the basis for any 2020 Census annual budgetary figures, the new cost- estimate will need to address the following four best practices, and do so  as quickly as possible given the expected ramp-up in spending:

Comprehensive. To be comprehensive an estimate should have  enough detail to ensure that cost elements are neither omitted nor  double-counted, and all cost-influencing assumptions are detailed in  the estimate’s documentation, among other things, according to best  practices. In June 2016, we reported that, while Bureau officials were  able to provide us with several documents that included projections  and assumptions that were used in the cost estimate, we found the  estimate to be partially comprehensive because it was unclear if all  life-cycle costs were included in the estimate or if the cost estimate  completely defined the program.

Accurate. Accurate estimates are unbiased and contain few  mathematical mistakes. We reported in June 2016 that the estimate  partially met best practices for this characteristic, in part because we  could not independently verify the calculations the Bureau used within  its cost model, which the Bureau did not have documented or  explained.

Well-documented. Cost estimates are considered valid if they are  well-documented to the point they can be easily repeated or updated  and can be traced to original sources through auditing, according to  best practices. In June 2016, we reported that, while the Bureau  provided some documentation of supporting data, it did not describe  how the source data were incorporated.

Credible. Credible cost estimates must clearly identify limitations due  to uncertainty or bias surrounding the data or assumptions, according  to best practices. In June 2016, we reported that the estimate  minimally met best practices for this characteristic in part because the  Bureau carried out its risk and uncertainty analysis only for about $4.6  billion (37 percent) of the $12.5 billion total estimated life-cycle cost,  excluding, for example, consideration of uncertainty over what the  decennial census’s estimated part will be of the total cost of CEDCaP.

Continued Management Attention Needed to Keep Preparations on Track and Help Ensure a Cost- Effective Enumeration

2020 Challenges Are Symptomatic of Deeper Long-Term Organizational Issues

The difficulties facing the Bureau’s preparation for the decennial in such  areas as planning and testing; managing and overseeing IT programs,  systems, and contractors supporting the enumeration; developing reliable  cost estimates; prioritizing decisions; managing schedules; and other  challenges, are symptomatic of deeper organizational issues.

Following the 2010 Census, a key lesson learned for 2020 we identified  was ensuring that the Bureau’s organizational culture and structure, as  well as its approach to strategic planning, human capital management,  internal collaboration, knowledge sharing, capital decision-making, risk  and change management, and other internal functions are aligned toward  delivering more cost-effective outcomes.

The Bureau has made improvements over the last decade, and continued  progress will depend in part on sustaining efforts to strengthen risk  management activities, enhancing systems testing, bringing in  experienced personnel to key positions, implementing our  recommendations, and meeting regularly with officials from its parent  agency, the Department of Commerce. Going forward, our experience  has shown that the key elements needed to make progress in high-risk  areas are top-level attention by the administration and agency officials to  (1) leadership commitment, (2) ensuring capacity, (3) developing a  corrective action plan, (4) regular monitoring, and (5) demonstrated  progress. Although important steps have been taken in at least some of  these areas, overall, far more work is needed.

On the one hand, the Secretary of Commerce has taken several actions  towards demonstrating leadership commitment. For example, the  previously noted multidisciplinary review team included members with  Bureau leadership experience, as well as members with private sector  technology management experience. Additional program evaluation and  the independent cost estimate was produced by a team from the  Commerce Secretary’s Office of Acquisition Management that included a  member detailed from OMB. Commerce also reports senior officials are  now actively involved in the management and oversight of the decennial.  Likewise, with respect to monitoring, the Commerce Secretary reports  having weekly 2020 Census oversight reviews with senior Bureau staff  and will require metric tracking and program execution status on a real- time basis.

On the other hand, demonstrating the capacity to address high risk  concerns remains a challenge. For example, our ongoing work has  indicated that the Bureau is facing staffing challenges that could impact  its ability to manage and oversee the technical integration contractor.  Specifically, the Bureau is managing the integration contractor through a  government program management office, but this office is still filling  vacancies. As of October 2017, the Bureau reported that 35 of 58, or 60  percent, of the office’s federal employee positions were vacant. As a  result, this program management office may not be able to provide  adequate oversight of contractor cost, schedule, and performance.

In the months ahead, we will continue to monitor the Bureau’s progress in  addressing in each of the 5 elements essential for reducing the risk to a  cost-effective enumeration.

Leadership Continuity Will Be Critical For Keeping Efforts on Track

At a time when strong Bureau management is needed, vacancies in the  agency’s two top positions—Director and Deputy Director—are not helpful  for keeping 2020 preparations on-track. These vacancies are due to the  previous director’s retirement on June 30, 2017, and the previous deputy  director’s appointment to be the Chief Statistician of the United States  within the Office of Management and Budget in January 2017. Although  interim leadership has since been named, in our prior work we have  noted how openings in the Bureau’s top position makes it difficult to  ensure accountability and continuity, as well as to develop and sustain  efforts that foster change, produce results, mitigate risks, and control  costs over the long term.

The census director is appointed by the President, by and with the advice  and consent of the Senate, without regard to political affiliation. The  director’s term is a fixed 5-year term of office, and runs in 5-year  increments. An individual may be reappointed and serve 2 full terms as  director. The director’s position was first filled this way beginning on  January 1, 2012, and cycles every fifth year thereafter. Because the new  term began on January 1, 2017, the time that elapses until a new director  is confirmed counts against the 5-year term of office. As a result, the next  director’s tenure will be less than 5 years.

Going forward, filling these top two slots should be an important priority.  On the basis of our prior work, key attributes of a census director, in  addition to the obvious ones of technical expertise and the ability to lead  large, long-term, and high risk programs, could include abilities in the  following areas:

Strategic Vision. The Director needs to build a long-term vision for  the Bureau that extends beyond the current decennial census.  Strategic planning, human-capital succession planning, and life-cycle  cost estimates for the Bureau all span the decade.

Sustaining Stakeholder Relationships. The Director needs to  continually expand and develop working relationships and  partnerships with governmental, political, and other professional  officials in both the public and private sectors to obtain their input,  support, and participation in the Bureau’s activities.

Accountability. The life-cycle cost for a decennial census spans a  decade, and decisions made early in the decade about the next  decennial census guide the research, investments, and tests carried  out throughout the decennial census. Institutionalizing accountability  over an extended period may help long-term decennial initiatives  provide meaningful and sustainable results.

Further Actions Needed on Our Recommendations

Over the past several years we have issued numerous reports that  underscored the fact that if the Bureau was to successfully meet its cost  savings goal for the 2020 Census, the Bureau needs to take significant  actions to improve its research, testing, planning, scheduling, cost  estimation, system development, and IT security practices. Over the past  decade, we have made 84 recommendations specific to the 2020 Census  to help address these and other issues. The Bureau has generally agreed  with those recommendations; however 36 of them had not been  implemented as of October 2017. We have designated 20 of these  recommendations as a priority for the Department of Commerce and 5  have been implemented. In August 2017, we sent the Secretary of  Commerce a letter that identified our open priority recommendations at  the Department, 15 of which concern the 2020 Census. We believe that  attention to these recommendations is essential for a cost-effective  enumeration. The recommendations included implementing reliable cost  estimation and scheduling practices in order to establish better control  over program costs, as well as taking steps to better position the Bureau  to develop an Internet response option for the 2020 Census. Appendix I  summarizes our priority recommendations related to the 2020 Census  and the actions the Department has taken to address them.

On October 3, 2017, in response to our August 2017 letter, the  Commerce Secretary noted that he shared our concerns about the 2020  Census and acknowledged that some of the programs had not worked as  planned, and are not delivering the savings that were promised. The  Commerce Secretary also stated that he intends to improve the  timeliness for implementing our recommendations.

We meet quarterly with Bureau officials to discuss the progress and  status of open recommendations related to the 2020 Census. We are  encouraged by the actions taken by the Department and the Bureau in  addressing our recommendations. Implementing our recommendations in  a complete and timely manner is important because it would improve the  management of the 2020 Census and help to mitigate continued risks.

In conclusion, while the Bureau has made progress in revamping its  approach to the census, it faces considerable challenges and  uncertainties in (1) implementing key cost-saving innovations and  ensuring they function under operational conditions; (2) managing the  development and security of key IT systems; and (3) developing a quality  cost estimate for the 2020 Census and preventing further cost increases.  Without timely and appropriate actions, these challenges could adversely  affect the cost, accuracy, and schedule of the enumeration.

For these reasons, the 2020 Census is a GAO high risk area. Going  forward, continued management and Congressional attention—such as  hearings like this one—will be vital for ensuring risks are managed,  preparations stay on-track, and the Bureau is held accountable for  implementing the enumeration as planned.

We will continue to assess the Bureau’s efforts to conduct a cost-effective  enumeration and look forward to keeping Congress informed of the  Bureau’s progress. Chairman Johnson, Ranking Member McCaskill, and  Members of the Committee, this completes my prepared statement. I  would be pleased to respond to any questions that you may have.

If you have any questions about this statement, please contact Robert  Goldenkoff at (202) 512-2757 or by e-mail at goldenkoffr@gao.gov or  David A. Powner at (202) 512-9286 or by e-mail at pownerd@gao.gov.  Contact points for our Offices of Congressional Relations and Public  Affairs may be found on the last page of this statement. Other key  contributors to this testimony include Lisa Pearson (Assistant Director);  Jon Ticehurst (Assistant Director); Katherine Wulff (Analyst in Charge);  Mark Abraham; Brian Bothwell; Jeffrey DeMarco; Hoyt Lacy; Jason Lee;  Ty Mitchell; LaSonya Roberts; Kate Sharkey; Andrea Starosciak; Umesh  Thakkar; and Timothy Wexler.

Appendix I: Priority Recommendations from GAO’s Work Related to the 2020 Census

The Department of Commerce and Census Bureau have taken some  actions to address our recommendations related to implementation of the  2020 Census; however, a large number of recommendations remain  open. Since just prior to the 2010 Census, we have made 84  recommendations in 23 reports to the Department of Commerce and  Census Bureau aimed at helping the Bureau prepare for and implement a  successful 2020 Census (table 1). Of those 84, the Department of  Commerce and the Census Bureau have implemented 48  recommendations. Thirty-six recommendations require additional action.

Of these 84 recommendations, we have designated 20 as priorities for  Commerce to address. The Census Bureau has taken some action on our  priority recommendations, implementing 5 of the 20 priority  recommendations we have made.

The following table presents each of the 20 priority recommendations  along with a summary of actions taken to address it.

Results of the 2020 Census will be used to apportion congressional seats, redraw districts, and allocate federal assistance. But the Census Bureau faces challenges, including:

Controlling costs, estimated at $15.6 billion for 2020, up $3 billion from its original estimate.

Counting a larger population in light of a historical decline in response rates.

Managing innovations such as allowing online responses.

Managing development and security of IT systems.

We testified that management issues and development delays have increased risks to systems. We have made recommendations in past reports to improve census management and mitigate risks.