Indian Health Service: Considerations Related to Providing Advance Appropriation Authority

IHS, an agency within the Department of Health and Human Services (HHS), receives an annual appropriation from Congress to provide health care services to over 2 million American Indians and Alaska Natives (AI/AN) who are members of 573 tribes. IHS generally provides services through direct care at facilities such as hospitals and health centers. Some tribes receive IHS funding to operate their own health care facilities. Tribal representatives have sought legislative approval to provide IHS advance appropriation authority stating that it would facilitate planning and more efficient spending. Experts have reported that agencies can use the authority to prevent funding gaps, and avoid uncertainties associated with receiving funds through CRs.

House Report 114-632 included a provision for GAO to review the use of advance appropriations authority and applications to IHS. Among other things, this report (1) describes advance appropriation authority considerations identified by stakeholders for providing IHS-funded health care services, and (2) identifies other considerations for policymakers related to providing the authority to IHS. GAO reviewed its prior reports related to IHS, VA, government shutdowns, and CRs, and interviewed officials from IHS, several tribes and other organizations representing AI/AN interests, the Office of Management and Budget, VA and other experts.

GAO provided a draft of this report to HHS, which had no comments; to VA, which provided general comments; and to tribal representatives, which provided technical comments that were incorporated as appropriate.

The Indian Health Service (IHS), like most federal agencies, must use appropriations in the year for which they are enacted. However, there has been interest in providing IHS with advance appropriation authority, which would give the agency authority to spend a specific amount 1 or more fiscal years after the fiscal year for which the appropriation providing it is enacted. Currently, the Department of Veterans Affairs (VA) is the only federal provider of health care services to have such authority.

Stakeholders interviewed by GAO, including IHS officials and tribal representatives, identified effects of budget uncertainty on the provision of IHS-funded health care as considerations for providing IHS with advance appropriation authority. Budget uncertainty arises during continuing resolutions (CR)—temporary funding periods during which the federal government has not passed a budget—and during government shutdowns. Officials said that advance appropriation authority could mitigate the effects of this uncertainty. IHS officials and tribal representatives specifically described several effects of budget uncertainty on their health care programs and operations, including the following:

Provider recruitment and retention. Existing challenges related to the recruitment and retention of health care providers—such as difficulty recruiting providers in rural locations—are exacerbated by funding uncertainty. For example, CRs and government shutdowns can disrupt recruitment activities like application reviews and interviews.

Administrative burden and costs. Both IHS and tribes incur additional administrative burden and costs as IHS staff calculate proportional allocations for each tribally operated health care program and modify hundreds of tribal contracts each time a new CR is enacted by Congress to conform to limits on available funding.

Financial effects on tribes. Funding uncertainty resulting from recurring CRs and from government shutdowns has led to adverse financial effects on tribes and their health care programs. For instance, one tribe incurred higher interest on loans when the uncertainty of the availability of federal funds led to a downgraded credit rating, as it was financing construction of a health care facility.

GAO identified various considerations for policymakers to take into account for any proposal to change the availability of the appropriations that IHS receives. These considerations include operational considerations, such as what proportion of the agency's budget would be provided in the advance appropriation and under what conditions changes to the funding provided through advance appropriations would be permitted in the following year. Additionally, congressional flexibility considerations arise because advance appropriation authority reduces what is left for the overall budget for the rest of the government. Another consideration is agency capacity and leadership, including whether IHS has the processes in place to develop and manage an advance appropriation. GAO has reported that proposals to change the availability of appropriations deserve careful scrutiny, an issue underscored by concerns raised when GAO added IHS to its High-Risk List in 2017.

The Indian Health Service (IHS), an agency within the Department of  Health and Human Services (HHS), receives an annual appropriation  from Congress to provide certain health care services to over 2 million  American Indians and Alaska Natives (AI/AN) who are members of  federally recognized tribes. IHS services are generally provided through  direct care at IHS facilities such as hospitals and health centers, and  when services are unavailable at these facilities, the facilities may pay for  patients to obtain services, including specialty care, from external  providers. In addition to federally operated IHS facilities, some federally  recognized tribes choose to operate their own health care facilities, for  which they receive at least partial support through IHS funding.

IHS, like most federal agencies, receives appropriations through annual  appropriations acts and the appropriations become available upon  enactment, not at some future date. However, there has been interest in  providing IHS with advance appropriation authority—an appropriation of  new budget authority that becomes available one or more fiscal years  after the fiscal year for which the appropriation providing it is enacted.  Organizations representing AI/AN people have advocated for Congress to  provide IHS with advance appropriation authority, stating that advance  appropriations would allow for greater planning, more efficient spending,  and higher quality of care for AI/AN individuals. Although not commonly  provided for federal programs, experts have reported that advance  appropriations have implications for agencies’ ability to manage during  periods of budget uncertainty, in terms of preventing funding gaps, and  avoiding issues associated with receiving short-term funds through  continuing resolutions (CR). The Department of Veterans Affairs (VA) is  the only federal agency that currently receives advance appropriations for  its health care program, which is administered by its Veterans Health  Administration (VHA).

House Report 114-632 included a provision for us to report on the use of  advance appropriation authority for health care programs across the  federal government, and applications to IHS. This report  1.  describes the advance appropriation authority that VA has for its  2.  describes the advance appropriation authority considerations  identified by stakeholders for providing IHS-funded health care  services; and  3.  identifies other considerations for policymakers related to providing  advance appropriation authority to IHS.

To describe the advance appropriation authority that VA has for its health  care program, we reviewed statutes related to VA’s specific advance  appropriation authority and interviewed VHA officials, including  headquarters officials from the Office of Finance and the Office of Rural  Health. In addition, we interviewed officials from the Office of  Management and Budget (OMB) who work with VA in planning for  advance appropriations. We also reviewed our prior reports examining  VHA budget processes and experience with advance appropriations.

To describe the advance appropriation authority considerations identified  by stakeholders for providing IHS-funded health care services, we  reviewed our prior reports that examined the effects of CRs and  government shutdowns on federal agencies, and interviewed IHS officials  and tribal representatives. Specifically, we interviewed IHS officials and  tribal representatives about their perceptions of the potential advantages  or disadvantages of advance appropriations for IHS, including their  perceptions of the effects of budget uncertainty on the provision of IHS- funded health care. IHS officials we interviewed included individuals from  the Office of the Director, the Office of Finance and Accounting, the Office  of Direct Service and Contracting Tribes, the Office of Tribal-Self  Governance, and the Division of Acquisition Policy, among others.

Additionally, we interviewed tribal officials, including those who currently  serve as co-chairs for IHS’s National Tribal Budget Formulation  Workgroup (who collectively represent multiple individual tribes and  groups of tribes). We selected tribal officials to interview to help ensure a  range of experiences and different types of funding agreements with IHS.  We also obtained information from representatives of several additional  tribes and tribal organizations. Our interviews and other information  obtained from representatives of these tribes and tribal organizations are  not generalizable to all federally recognized tribes. We also interviewed  officials from associations representing tribal and AI/AN interests,  including the National Indian Health Board and the National Council of  Urban Indian Health. For context, we also spoke with VA officials from  two regional networks—Veterans Integrated Service Networks (VISN)— about their experience with advance appropriations; VA officials indicated  that these VISNs have extensive experience in serving rural populations,  including AI/AN veterans.

To identify other considerations for Congress and agency officials related  to providing advance appropriation authority to IHS, we reviewed  materials documenting past efforts to obtain advance appropriation  authority for IHS—including proposed legislation and documents from  advocacy groups such as the National Indian Health Board, as well as our  prior work related to the consideration of advance appropriations for VA.  For context, we also reviewed our past reports and those from the  Congressional Research Service on various aspects of IHS—including  budgeting processes. We interviewed IHS officials regarding their  processes for budget planning and VA officials regarding their  experiences planning for advance appropriations. In addition, we  interviewed officials from OMB, the Congressional Research Service, and  the Congressional Budget Office.

We conducted this performance audit from August 2017 to September  2018 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

IHS Health Care System and Tribal Health Care

IHS was established within the Public Health Service in 1955 to provide  certain health services to members of federally recognized AI/AN tribes,  primarily in rural areas on or near reservations. IHS provides services  directly through a network of hospitals, clinics, and health stations  operated by IHS, and also funds services provided at tribally operated  facilities.

As of October 2017, IHS, tribes, and tribal organizations operated 168  service units, 48 hospitals, and 560 ambulatory care centers—including  health centers, school health centers, health stations, and Alaska village  clinics. See table 1.

According to IHS officials, the agency provides services almost  exclusively in locations designated as Health Professional Shortage  Areas, with most locations identified as extreme shortage areas. In  addition, IHS data indicate that about 35 percent of certain IHS facilities,  including four hospitals, were identified as isolated hardship posts in  2016.

IHS oversees its health care facilities through a decentralized system of  12 area offices, which are led by area directors; 10 of these 12 IHS areas  have federally operated IHS facilities. IHS’s headquarters office is  responsible for setting health care policy, helping to ensure the delivery of  quality comprehensive health services, and advocating for the health  needs and concerns of AI/AN people. The IHS area offices are  responsible for distributing funds to the facilities in their areas, monitoring  their operation, and providing guidance and technical assistance.

IHS’s estimated budget authority for fiscal year 2018 is over $5.6 billion,  an increase of almost $580 million from its enacted budget authority of  just over $5 billion in fiscal year 2017. IHS has agreements with tribes  and tribal organizations by which it transfers a substantial portion of its budget authority to tribes and tribal organizations. For example, in 2017,  the agency transferred approximately 54 percent of its total budget  authority to tribes and tribal organizations to operate part or all of their  own health care programs through self-determination contracts and self- governance compacts.

Self-determination contracts: IHS had 373 self-determination  contracts in place with 220 tribes in 2017.

Self-governance compacts: IHS had 98 self-governance compacts in  place—including 124 funding agreements—with 360 tribes in 2017.  See figure 1 for the percentage of IHS’s total budget authority  transferred to tribes in fiscal year 2017.

According to IHS officials, over the last few years an increasing number of  tribes have sought to enter into contracts and compacts with IHS to  assume responsibility for some or all of their health care programs, and  thereby receive funding from IHS.

Unless otherwise specified in law, funding included in annual  appropriation acts is available for obligation during a single fiscal year,  after which it expires. For this reason, the continuation of normal  government operations depends upon the enactment each fiscal year of a  new appropriations act. Any lapse in appropriations—a funding gap— causes most government functions to shut down. To avert a  government shutdown, Congress may enact one or more CRs. CRs are  spending bills that provide funds to allow agencies to operate during a  specified period of time while Congress works to pass an annual  appropriations act. Relevant aspects of the federal budget environment  include the following.

Frequency of CRs and shutdowns. In all but 4 of the last 40 fiscal  years—including fiscal year 2018—Congress has enacted CRs. Since  fiscal year 1999, CRs have varied greatly in their number and duration— the number of CRs enacted in each year ranged from 2 to 21, and the  duration of CRs has ranged from 1 to 187 days. Regarding lapses in  appropriations that resulted in government shutdowns, in January 2018  the government partially shut down for 3 calendar days after the CR in  place expired. Other shutdowns have lasted longer—16 calendar days in  October 2013 and 21 calendar days in December 1995 through January  1996. We have previously reported on the effects of CRs and shutdowns  for federal agencies.

Budget authority during a CR. CRs provide “such amounts as may be  necessary” to maintain operations consistent with the prior fiscal year’s  appropriations and authorities. To control spending in this manner, CRs  generally prohibit agencies from initiating new activities and projects for  which appropriations, funds, or other authorities were not available in the  prior fiscal year. They also require agencies to take the most limited  funding actions necessary to maintain operations at the prior fiscal year’s  level.

Budget authority during a funding gap. Certain federal health care  programs have various budget authorities that can allow for continued  operations during a funding gap. For example, VA’s advance  appropriations authority for its health care programs allows operations to  continue after one appropriation expires, using the previously enacted  budget for the next year. Although IHS does not have this authority,  Congress has enacted longer periods of availability for certain IHS  appropriations that would allow the activities they support to continue  during a funding gap, assuming the appropriation has not run out. For  example, IHS’s appropriation for Indian health facilities remains available  until expended, in contrast to its appropriation for Indian health services,  which is generally available for a single fiscal year.

In this regard, funds for Indian health services that IHS transfers to tribes  and tribal organizations during the 1-year period of availability are  deemed to be obligated at the time of the award and thereafter remain  available to the tribes to operate their own health care programs without  fiscal year limitation. Thus, to the extent sufficient funding remained  available from federal or other sources during a lapse in appropriations, a  tribe could continue to operate its own health care programs during a  shutdown. To operate IHS’s health care system on an emergency basis  during a funding gap, IHS would need to determine what programs and  activities qualified for an emergency exception under the law.

Contingency planning for government shutdowns. Federal agencies  must determine what activities and programs they are permitted or  required to continue prior to a potential shutdown. This includes  designating certain employees as “excepted” employees who would be  expected to continue to work during the shutdown and who would be paid  upon the enactment of an appropriation. Employees who are not  “excepted” would be subject to furlough.

Interest in Advance Appropriation Authority for IHS

Citing funding uncertainty associated with continued use of CRs, AI/AN  advocacy groups such as the National Indian Health Board have  requested that Congress grant IHS advance appropriation authority;  legislation to provide IHS this authority has been introduced more than  once. The most recent such legislation, H.R. 235, introduced in January  2017 (not enacted), would have provided IHS with 2-year fiscal budget  authority for its Indian health services and Indian health facilities  accounts, similar to the authority that VA currently has for its health care  appropriation accounts. HHS, on behalf of IHS, has not requested that  IHS be granted advance appropriation authority during its annual budget  submissions to Congress.

VA’s Advance Appropriation Authority for Health Care

VA, through the VHA, operates one of the nation’s largest health care  systems, with 171 VA medical centers, more than 1,000 outpatient  facilities, and total health care budget authority of about $69 billion in  fiscal year 2017. VA provided health care services to about 6.8 million  veterans in fiscal year 2017, and the agency forecasts that demand for its  services is expected to grow in the coming years.

VA was granted advance appropriation authority for specified medical  care accounts in the Veterans Health Administration in 2009. Currently,  VA’s annual appropriations for health care include advance  appropriations that become available in the fiscal year after the fiscal year  for which the appropriations act was enacted. Under this authority, VA  receives advance appropriations for VHA’s Medical Services, Medical  Support and Compliance, Medical Facilities, and Medical Community  Care appropriations accounts and is required to provide Congress with  detailed estimates of funds needed to provide its health care services for  the fiscal year for which advance appropriations are to be provided.  According to VA officials, veterans service organizations were the primary  advocates who sought advance appropriation authority for VA’s health  care program.

In its health care budget proposal each year, VA submits a request for the  upcoming fiscal year, as well as an advance appropriation request for the  following year. In early 2018, for example, VA submitted a request for  fiscal year 2019, as well as a fiscal year 2020 advance appropriation  request. According to VA, more than 90 percent of its budget request is  developed using an actuarial model that is based in part on VA’s actual  health care utilization data from prior years; for example, the 2020  advance appropriation request used fiscal year 2016 data. VHA officials  said that the agency calculates its advance appropriation request to fund  needed care as estimated by its actuarial model, with less funding  requested for other expenses (such as non-recurring maintenance) and  officials told us this is consistent with direction provided by OMB. OMB  officials told us that the amount provided in the advance appropriation is  intended to provide VA with some assurances that it will be able to  continue health care operations seamlessly across fiscal years.

In the subsequent year (the year during which the advance appropriation  can be used), VA may request an adjustment to the amount previously  provided through advance appropriations—referred to by agency officials  as a “second bite”—an arrangement that is intended by design to help  respond to more recent policy changes or significant events. For  example, VA requested a “second bite” increase of $2.65 billion for fiscal  year 2018, to the $66.4 billion initially provided to its VHA accounts  through its advance appropriation. Both OMB and VHA officials said this  “second bite” provides an opportunity to make an adjustment to VA’s  advance appropriation using updated utilization data. VHA officials told us  that changes in policy (such as determining which veterans or what health  benefits can be covered) sometimes drive changes from the initial budget  request. For example, policy changes can include adding an additional  presumptive condition—such as health conditions associated with Agent  Orange exposure—resulting in a new health benefit, or a costly new drug  treatment, as in the case of the addition to the drug formulary of a new  Hepatitis C drug treatment.

Despite having advance appropriation authority, VA has faced challenges  in budget formulation, in addition to the general management and  oversight challenges we cited in adding VA to our High-Risk List in  2015. Specifically, we reported in our 2017 update to the High-Risk List  that VA faces challenges regarding the reliability, transparency, and  consistency of its budget estimates for medical services, as well as  weaknesses in tracking obligations for medical services and estimating  budgetary needs for future years. These challenges were evident in  June 2015, when VA requested authority from Congress to move funds  from another appropriation account because agency officials projected a  fiscal year 2015 funding gap of about $3 billion in its medical services  appropriation account.

Budget Uncertainty Effects on the Provision of IHS- Funded Health Care That Were Cited by Stakeholders

IHS officials, tribal representatives, and other stakeholders we spoke with  described how budget uncertainty resulting from CRs and government  shutdowns can have a variety of effects on the provision of IHS-funded  health care services for AI/ANs. The following summarizes these  effects, along with the views of IHS officials, tribal representatives, and  other stakeholders on how advance appropriation authority could mitigate  them, and VA’s related experiences:  Provision of health care services. IHS officials said that, in general,  most health care services would be expected to continue at IHS-operated  facilities during a shutdown, as health care providers would be deemed  “excepted” personnel under the agency’s contingency plan. However,  officials noted some health care procedures could be delayed, as  determined on a case-by-case basis at the local level. IHS officials also  acknowledged that tribal health care programs may not have access to  furloughed IHS staff who do not work during a shutdown, such as support  staff at local IHS area offices, who may carry out administrative duties on  their behalf. For example, tribal representatives told us that during a  previous government shutdown, finance employees from the local IHS  area offices were furloughed (and thus not permitted to work), which  created challenges for tribal health care operations that depended on  these IHS employees to process payments and agreements.

IHS officials stated they believe advance appropriations could help  ensure continuity of health care services through certainty of funding. IHS  officials also said that while lapses in appropriations do not halt patient  care, they do create complications—such as the determination of  excepted personnel as described above—that could be eliminated by  funding provided through advance appropriations. Tribal representatives  said the certainty of funding that would come with IHS having advance  appropriations would create a sense of stability in tribal health care  programs as well.

VA VISN officials we spoke to said having advance appropriations has  improved their ability to manage resources for continuity of services and  allowed them to avoid the substantial additional planning that occurs  before a potential government shutdown when agencies are determining  which providers and staff would be deemed excepted. According to the  VISN officials, knowing that funding is coming—as opposed to having  less certainty—would allow an agency to plan and prioritize its services  more efficiently.

Health care program planning. Tribal representatives said operating  health care programs with short-term funding provided through a series of  CRs—and facing potential government shutdowns—rather than a full  year’s apportionment hinders their ability to plan for new programs and for  improvements that need to be carried out across budget years or that  require large up-front investments, such as an electronic medical records  system or other significant information technology purchases. Tribal  representatives said there are often plans that they have to set aside  because they don’t have enough funds to start a project during a CR,  and—if there are multiple CRs—there is not enough time left in the  budget year to start bigger projects once an annual appropriation is  passed. Tribal representatives also told us that they believe that advance  appropriations would help tribal health care programs plan for current and  future needs. For example, one tribal official told us advance  appropriations would allow tribes to plan for long-term health initiatives.  The official’s specific tribe has a gestational diabetes program in  conjunction with a local university that the tribe could plan to take full  responsibility for if they had more funding stability.

VA VISN officials we interviewed provided several examples of how they  believe advance appropriations facilitate their planning. For example,  VISN officials told us advance appropriations allow them to plan  strategically for equipment purchases: if they need to buy a CT scanner,  they would plan to do site preparation in one year—for example,  reconfiguring the space for the new equipment by moving walls, electrical  rewiring, etc.—and buy the scanner in the next year. With advance  appropriations, they know they are going to have funds for an expensive  equipment purchase available the next year; without an advance  appropriation, they would not be sure, and could spend funds on  preparation and then ultimately not have the funds to make the equipment  purchase. These officials also said having advance appropriations gave  them confidence in making current plans to provide the new shingles  vaccine for their over-50 population in 2019, including the ability to secure  an adequate supply of the vaccine from the manufacturer.

Provider recruitment and retention. IHS officials and tribal  representatives said existing challenges related to their recruitment and  retention of health care providers—many of which are related to the rural  and remote locations of many of IHS’s facilities—are exacerbated by  funding uncertainty resulting from CRs or potential government  shutdowns. IHS officials said CRs and government shutdowns can  disrupt recruitment activities such as IHS marketing efforts, job  advertisements, application review, interviews, and candidate site visits.  Additionally, when recruiting health care providers, IHS officials said CRs  and potential government shutdowns create doubt about the stability of  employment at IHS amongst potential candidates, which may result in  reduced numbers of candidates or withdrawals from candidates during  the pre-employment process. IHS officials said that many providers in  rural and remote locations are the sole source of income for their families,  and the potential for delays in pay resulting from a government shutdown  can serve as a disincentive for employees considering public service in  critical shortage areas that do not offer adequate spousal employment  opportunities. Tribal representatives said CRs create challenges for tribes  in funding planned pay increases—such as cost-of-living adjustments— for health care staff at their facilities, and they may, as a result, defer  increases.

IHS officials and tribal representatives stated they believe advance  appropriations could mitigate these challenges. For example, IHS officials  said that with advance appropriations, recruitment and outreach activities  could continue without disruption, and selected candidates could be  brought on board as scheduled. One tribal representative stated that  advance appropriations could help with recruitment by providing  perceived job stability that is similar to VA or the private sector.

According to VA VISN officials, the agency’s experience with advance  appropriation authority suggests that advance appropriations can facilitate  physician recruitment, including hiring. If, for example, they were far along  in the hiring process at the end of a fiscal year, but could not finalize the  hire before the end of the year, having advance appropriations for the  next fiscal year provides the certainty that they will be able to make the  hire in the new fiscal year.

Commercial contracts and vendor negotiations. IHS officials and tribal  representatives said budget uncertainty can lead to vendor reluctance to  provide services to IHS and tribally operated facilities. IHS officials said  they have heard from vendors—who are typically Indian- or veteran- owned small businesses in the communities being served by IHS—that  they lose trust in IHS and federally-funded tribal health care programs  when they are affected by budget uncertainty. One tribal organization told  us delays in receiving full funding because of CRs has inhibited its ability  to pay invoices for pharmaceuticals in a timely manner, which has  harmed its relationship with its vendors.

VISN officials told us that advance appropriations can provide an element  of stability to agency funding that may serve to reassure potential  vendors. According to VISN officials, vendors can be hard to find in  remote and rural areas, and their perception of funding certainty can play  a role in encouraging their participation as government contractors. As  contracting with the federal government can be burdensome, particularly  for smaller vendors, VISN officials said, any measures—such as advance  appropriations—that could enhance the stability of agency contracting  could make these vendors more likely to participate in government  contracting.

Administrative burden and costs. IHS officials and tribal  representatives said the agency and tribes incur additional administrative  burden and costs when the government is funded through multiple CRs,  due to the high proportion of IHS funding that is transferred to tribes  through contracts and compacts. Specifically, IHS officials said there is  an additional administrative burden generated by each CR that results in  the distribution of funds to tribes. For each CR period, IHS headquarters  staff generate proportional funding allotments, which they provide to  individual area offices, which then also conduct processing activities to  generate payments from these allotments to the tribes in their areas. As  part of this process, IHS officials said they modify hundreds of tribal  contracts and make amendments to funding agreements associated with  tribal compacts, and those efforts represent a significant administrative  burden for IHS staff. Tribal representatives also described administrative  burden associated with CRs. As one representative of a group  representing several tribes told us, each CR requires the same  processing and manpower for each partial payment as for a full  apportionment, and moreover, CRs require tracking and reconciliation  that is not necessary for a single, full apportionment. IHS officials and  tribal representatives noted that time and money spent on these  additional administrative activities detract from other priorities, including  patient care.

IHS officials said that advance appropriations would reduce this  administrative burden, and added that having advance appropriations  would allow for more efficiency in processing payments to tribes. IHS  officials suggested that the agency would have to do less administrative  work overall, because currently, under a single year appropriation (with  recurrent CRs), they may modify or amend agreements 7 or 8 times  within a fiscal year. Although acknowledging that advance appropriation  authority would entail the additional burden of preparing budget requests  for more than one fiscal year, they expect this administrative burden to be  less than those under repeated CRs.

Financial effects on tribes. According to tribal representatives we spoke  with, funding uncertainty from recurring CRs and from government  shutdowns has led to particular adverse financial effects on tribes that  operate their own health care programs with funding from IHS. For  example, according to tribal representatives,

Funding uncertainty surrounding a CR results in more expensive  commercial loans (with higher interest rates) to finance construction of  new health care facilities. Specifically, a tribal representative said the  uncertainty of the availability of funds due to a CR resulted in a  downgrading of the tribe’s credit rating, and hence higher interest  rates, as it was planning a clinic expansion.

During a government shutdown, some tribes must redistribute funds  from other budget categories to replace health care funding from IHS  in order to continue providing health care services. Some tribes have  economic development activities that provide additional funding and  facilitate this redistribution, but others do not. For example, one tribal  organization said that during the 2013 government shutdown, it had to  take out loans and maintain a line of credit in order to pay for services  and make payroll. Subsequently, that tribal organization had to pay  interest on those loans, causing greater financial hardship.

Tribes attempt to mitigate the challenge of not knowing their final  annual payment from IHS under recurrent CRs by keeping extra funds  in reserve for emergencies, which limits the remaining funds available  for providing health care services.

Short-term funding under CRs or delayed funding after a lapse in  appropriations can limit the ability of tribes and tribal organizations to  invest funds from IHS and generate interest that can be reinvested in  tribal health care programs.

CRs have affected the ability of tribes to reduce costs by planning for  bulk purchases at favorable rates. For example, some tribes in Alaska  prefer to make bulk purchases of heating oil during “barge season’’— when waterways are still navigable and not frozen. If they do not have  enough money for a bulk purchase because of a CR’s limited funding,  they must purchase fuel in smaller quantities, which is ultimately  significantly more expensive. Tribal representatives told us one  beneficial financial effect of advance appropriations for tribes could be  providing opportunities for longer term contracts with vendors, which  could result in cost savings that could be used for tribal health care  programs.

Considerations for Policymakers Related to Providing Advance Appropriation Authority to IHS

We identified three types of considerations for policymakers related to  providing advanced appropriation authority to IHS—operational,  congressional flexibility, and agency capacity and leadership  considerations. We identified these considerations based on a review of  our 2009 testimony that examined considerations for granting VA  advance appropriation authority, in which we identified key questions that  would be applicable to any agency being granted such authority, and our  interviews with VA, IHS, and other officials. In our 2009 testimony, we  noted that proposals to change the availability of the appropriations for  VA deserved careful scrutiny, given the challenges the agency faces in  formulating its health care budget and the changing nature of health  care. Similar consideration would apply to IHS.

Operational considerations. If Congress were to grant IHS advance  appropriation authority, it would need to make operational decisions  regarding what amount of IHS funding would be provided in advance  appropriations, with input from OMB and IHS as appropriate. Specifically,  Congress could consider the following questions:  (1) What proportion of IHS’s estimated budget would be provided in  the advance appropriation—the full amount, or less (as is the case for  VA)? Which appropriations accounts would be included? Further,  would funds intended for transfer to tribes be handled differently?  (2) Under what conditions, if any, would there be changes to funding  provided through advance appropriations during the next budget  cycle? For example, would Congress expect to adjust the advance  appropriation amount through a “second bite,” as is the case with VA?

Congressional flexibility considerations. We reported in 2009 that  consideration of any proposal to change the availability of the  appropriations VA receives for health care should take into account the  impact of any change on congressional flexibility and oversight. These  same considerations hold merit regarding potential changes to the  appropriation status of any federal agency, including IHS. Specifically,  advance appropriation authority reduces flexibility for congressional  appropriators, because it reduces what is left for the overall budget for the  rest of the government—meaning the total available for appropriations for  a budget year is reduced by the amount of advance appropriations for  that year, when budgets have caps.

Agency capacity and leadership considerations. IHS officials told us  they believe the agency’s current budget planning processes would be  adequate for estimating advance appropriation budget requests, because  IHS begins planning for its budget request 3 years in advance. Officials  added that IHS plans its budget so far in advance to have sufficient time  to work with tribes in formulating recommendations for its budget request.  IHS officials said that a downside to planning so far in advance is that  they do not necessarily have the most current information while  formulating the budget request. In addition, we noted prior to VA receiving  advance appropriation authority that advance appropriation authority  could potentially exacerbate existing challenges when developing or  managing a budget, generally, due in part to the higher risk of uncertainty  when developing estimates that are an additional 12 months out from the  actual budget year (e.g., 30 months out instead of 18 months).

We raised certain capacity and leadership concerns based on our  previous work when we added IHS to our High-Risk List in 2017.  Further, in June 2018, we found that while IHS had taken some actions to partially address these concerns, additional progress was needed to fully  address these management weaknesses. For example, IHS still does  not have permanent leadership—including a Director of IHS—which is  necessary for the agency to demonstrate its commitment to improvement.  Additionally, while the agency has made some progress in demonstrating  it has the capacity and resources necessary to address the program risks  we identified in our reports, there are still vacancies in several key  positions, including in the Office of Finance and Accounting. While not  directly related to consideration of advance appropriations, IHS’s high-risk  designation and continuing challenges in mitigating the deficiencies in its  program point to questions about the agency’s capacity to implement  such a change to its budget formulation process.

We provided a draft of this report to HHS and VA for review and  comment. HHS did not have any comments. We received general  comments from VA that are reprinted in appendix I.

We also provided relevant draft portions of this report to NIHB, which  represents tribal and AI/AN interests. NIHB provided technical comments,  which we incorporated as appropriate.

We are sending copies of this report to the Secretaries of the Department  of Health and Human Services and the Department of Veterans Affairs,  and other interested parties. In addition, the report is available at no  charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-7114 or farbj@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page   of this report. GAO staff who made key contributions to this report are  listed in appendix II.

Appendix I: Comments from the Department of Veterans Affairs

Appendix II: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Kathleen M. King (Director),  Karen Doran (Assistant Director), Julie T. Stewart (Analyst-in-Charge),  Kristen J. Anderson, and Leonard S. Brown made key contributions to  this report. Also contributing were Sam Amrhein, George Bogart,  Christine Davis, and Vikki Porter.

The Indian Health Service (IHS) funds health care for over 2 million American Indians and Alaska Natives. Currently, IHS receives its funding as part of the annual fiscal year appropriations cycle.

Delays in passing appropriations create uncertainty and disrupt operations. For example, tribal representatives told us that such delays have led them to pay invoices late—hurting their relationship with a pharmaceutical vendor.

We identified issues and questions for policymakers to consider when deciding whether to give IHS an uncommon type of budget authority that would fund an additional year.


Information Technology: Continued Implementation of High-Risk Recommendations Is Needed to Better Manage Acquisitions Operations and Cybersecurity

The federal government plans to invest almost $96 billion in IT in fiscal year 2018. Historically, IT investments have too often failed or contributed little to mission-related outcomes. Further, increasingly sophisticated threats and frequent cyber incidents underscore the need for effective information security. As a result, GAO added two areas to its high-risk list: IT security in 1997 and the management of IT acquisitions and operations in 2015.

This statement summarizes agencies' progress in improving IT management and ensuring the security of federal IT. It is primarily based on GAO's prior reports issued between February 1997 and May 2018 (and an ongoing review) on (1) CIO responsibilities, (2) agency CIOs' involvement in approving IT contracts, (3) data center consolidation efforts, (4) the management of software licenses, and (5) compliance with cybersecurity requirements.

The Office of Management and Budget (OMB) and federal agencies have taken steps to improve the management of information technology (IT) acquisitions and operations and ensure the security of federal IT through a series of initiatives. As of May 2018, agencies had fully implemented about 61 percent of the approximately 800 IT management-related recommendations that GAO made from fiscal years 2010 through 2015. Likewise, since 2010, agencies had implemented about 66 percent of the approximately 2,700 security-related recommendations as of May 2018. Even with this progress, significant actions remain to be completed.

Chief Information Officer (CIO) responsibilities . Laws such as the Federal Information Technology Acquisition Reform Act (FITARA) and related guidance assigned 35 key IT management responsibilities to CIOs to help address longstanding challenges. However, in a draft report on CIO responsibilities, GAO's preliminary results suggest that none of the 24 selected agencies have policies that fully address the role of their CIO, as called for by federal laws and guidance. GAO intends to recommend that OMB and each of the selected 24 agencies take actions to improve the effectiveness of CIO's implementation of their responsibilities.

IT contract approval . According to FITARA, covered agencies' CIOs are required to review and approve IT contracts. Nevertheless, in January 2018, GAO reported that most of the CIOs at 22 selected agencies were not adequately involved in reviewing billions of dollars of IT acquisitions. Consequently, GAO made 39 recommendations to improve CIO oversight over IT acquisitions.

Consolidating data centers . OMB launched an initiative in 2010 to reduce data centers, which was codified and expanded in FITARA. According to agencies, data center consolidation and optimization efforts have resulted in approximately $3.9 billion of cost savings through 2018. Even so, additional work remains. GAO has made 160 recommendations to OMB and agencies to improve the reporting of related cost savings and to achieve optimization targets; however, as of May 2018, 80 of the recommendations have not been fully addressed.

Managing software licenses . Effective management of software licenses can help avoid purchasing too many licenses that result in unused software. In May 2014, GAO reported that better management of licenses was needed to achieve savings, and made 135 recommendations to improve such management. Four years later, 78 of the recommendations remained open.

Improving the security of federal IT systems . While the government has acted to protect federal information systems, agencies need to improve security programs, cyber capabilities, and the protection of personally identifiable information. Over the last several years, GAO has made about 2,700 recommendations to agencies aimed at improving the security of federal systems and information. These recommendations identified actions for agencies to take to strengthen their information security programs and technical controls over their computer networks and systems. As of May 2018, about 800 of the information security-related recommendations had not been implemented.

From fiscal years 2010 through 2015, GAO made about 800 recommendations to OMB and federal agencies to address shortcomings in IT acquisitions and operations. Since 2010, GAO also made about 2,700 recommendations to federal agencies to improve the security of federal systems. These recommendations include those to improve the implementation of CIO responsibilities, the oversight of the data center consolidation initiative, software license management efforts, and the strength of security programs and technical controls. Most agencies agreed with these recommendations, and GAO will continue to monitor their implementation.

I am pleased to be here today to provide an update on federal agencies’  efforts to address our high-risk areas on improving the management of  information technology (IT) acquisitions and operations, as well as  ensuring the security of federal IT. The federal government has spent  billions of dollars on failed and poorly performing IT investments, which  often suffered from ineffective management. Consequently, we added  improving the management of IT acquisitions and operations to our high- risk areas for the federal government in February 2015. We recently  noted that, while progress has been made in addressing the high-risk  area of IT acquisitions and operations, significant work remains to be  completed.

With regard to cybersecurity, the increasingly sophisticated threats and  frequent cyber incidents underscore the continuing and urgent need for  effective information security. Consequently, we first identified federal IT  security as a government-wide high-risk area in 1997. Subsequently, in  2003, we expanded this area to include computerized systems  supporting the nation’s critical infrastructure and, in 2015, we further  expanded this area to include protecting the privacy of personally  identifiable information. We continued to identify federal information  security as a government-wide high-risk area in our February 2017 high- risk update report.

My statement today provides an update on agencies’ progress in  improving the management of IT acquisitions and operations and the  security of federal IT. The statement is based on our prior reports issued  between February1997 and May 2018 that discuss federal agencies’ (1)  implementation of Chief Information Officer (CIO) responsibilities, (2)  fulfillment of CIO IT acquisition review requirements, (3) data center  consolidation efforts, (4) management of software licenses, and (5)  compliance with federal cybersecurity requirements. A more detailed  discussion of the objectives, scope, and methodology for this work is  included in each of the reports that are cited throughout this statement. In  addition, we have included preliminary results from our ongoing work  reviewing the authorities of federal CIOs. The draft report related to this  work is currently being reviewed by the agencies and we expect to issue  it in June 2018.

We conducted the work upon which this statement is based in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

According to the President’s budget, the federal government plans to  invest more than $96 billion for IT in fiscal year 2018—the largest amount  ever budgeted. Despite such large IT expenditures, we have previously  reported that investments in federal IT too often result in failed projects  that incur cost overruns and schedule slippages, while contributing little to  the desired mission-related outcomes. For example:

The tri-agency National Polar-orbiting Operational Environmental  Satellite System was disbanded in February 2010 by the White  House’s Office of Science and Technology Policy after the program  spent 16 years and almost $5 billion.

The Department of Homeland Security’s (DHS) Secure Border  Initiative  Network program was ended in January 2011, after the  department obligated more than $1 billion for the program.

The Department of Veterans Affairs’ Financial and Logistics  Integrated Technology Enterprise program was intended to be  delivered by 2014 at a total estimated cost of $609 million, but was  terminated in October 2011.

The Department of Defense’s Expeditionary Combat Support System  was canceled in December 2012 after spending more than a billion  dollars and failing to deploy within 5 years of initially obligating  funds.

The United States Coast Guard (Coast Guard) decided to terminate  its Integrated Health Information System project in 2015. As reported  by the agency in August 2017, the Coast Guard spent approximately  $60 million over 7 years on this project, which resulted in no  equipment or software that could be used for future efforts.

Our past work has found that these and other failed IT projects often  suffered from a lack of disciplined and effective management, such as  project planning, requirements definition, and program oversight and  governance. In many instances, agencies had not consistently applied  best practices that are critical to successfully acquiring IT.

Such projects have also failed due to a lack of oversight and governance.  Executive-level governance and oversight across the government has  often been ineffective, specifically from CIOs. For example, we have  reported that some CIOs’ roles were limited because they did not have  the authority to review and approve the entire agency IT portfolio.

In addition to failures when acquiring IT, security deficiencies can  threaten systems once they become operational. As we previously  reported, in order to counter security threats, 23 civilian Chief Financial  Officers Act agencies spent a combined total of approximately $4 billion  on IT security-related activities in fiscal year 2016. Even so, our  cybersecurity work at federal agencies continues to highlight information  security deficiencies. The following examples describe the types of risks  we have found at federal agencies.

In November 2017, we reported that the Department of Education’s  Office of Federal Student Aid did not consistently analyze privacy  risks for its electronic information systems, and policies and  procedures for protecting information systems were not always up to  date.

In August 2017, we reported that, since the 2015 data breaches, the  Office of Personnel Management (OPM) had taken actions to prevent,  mitigate, and respond to data breaches involving sensitive personal  and background investigation information. However, we noted that  the agency had not fully implemented recommendations made to  OPM by DHS’s United States Computer Emergency Readiness Team  to help the agency improve its overall security posture and improve its  ability to protect its systems and information from security breaches.

In July 2017, we reported that IT security at the Internal Revenue  Service had weaknesses that limited its effectiveness in protecting the  confidentiality, integrity, and availability  of financial and sensitive  taxpayer data. An underlying reason for these weaknesses was that  the Internal Revenue Service had not effectively implemented  elements of its information security program.

In May 2016, we reported that the National Aeronautics and Space  Administration, the Nuclear Regulatory Commission, OPM, and the  Department of Veteran Affairs did not always control access to  selected high-impact systems, patch known software vulnerabilities,  and plan for contingencies. An underlying reason for these  weaknesses was that the agencies had not fully implemented key  elements of their information security programs.

In August 2016, we reported that the IT security of the Food and Drug  Administration had significant weaknesses that jeopardized the  confidentiality, integrity, and availability  of its information systems and  industry and public health data.

FITARA Increases CIO Authorities and Responsibilities

Congress and the President have enacted various key pieces of reform  legislation to address IT management issues. These include the federal  IT acquisition reform legislation commonly referred to as the Federal  Information Technology Acquisition Reform Act (FITARA). This  legislation was intended to improve covered agencies’ acquisitions of IT  and enable Congress to monitor agencies’ progress and hold them  accountable for reducing duplication and achieving cost savings. The  law includes specific requirements related to seven areas:

Agency CIO authority enhancements. CIOs at covered agencies  have the authority to, among other things, (1) approve the IT budget  requests of their respective agencies and (2) review and approve IT  contracts.

Federal data center consolidation initiative (FDCCI). Agencies  covered by FITARA are required, among other things, to provide a  strategy for consolidating and optimizing their data centers and issue  quarterly updates on the progress made.

Enhanced transparency and improved risk management. The  Office of Management and Budget (OMB) and covered agencies are  to make detailed information on federal IT investments publicly  available, and agency CIOs are to categorize their investments by  level of risk.

Portfolio review. Covered agencies are to annually review IT  investment portfolios in order to, among other things, increase  efficiency and effectiveness and identify potential waste and  duplication.

Expansion of training and use of IT acquisition cadres. Covered  agencies are to update their acquisition human capital plans to  support timely and effective IT acquisitions. In doing so, the law calls  for agencies to consider, among other things, establishing IT  acquisition cadres (i.e., multi-functional groups of professionals to  acquire and manage complex programs), or developing agreements  with other agencies that have such cadres.

Government-wide software purchasing program. The General  Services Administration is to develop a strategic sourcing initiative to  enhance government-wide acquisition and management of software.  In doing so, the law requires that, to the maximum extent practicable,  the General Services Administration should allow for the purchase of  a software license agreement that is available for use by all executive  branch agencies as a single user.

Maximizing the benefit of the Federal Strategic Sourcing  Initiative. Federal agencies are required to compare their  purchases of services and supplies to what is offered under the  Federal Strategic Sourcing Initiative.

In June 2015, OMB released guidance describing how agencies are to  implement FITARA. This guidance is intended to, among other things: assist agencies in aligning their IT resources with statutory establish government-wide IT management controls to meet the law’s  requirements, while providing agencies with flexibility to adapt to  unique agency processes and requirements; strengthen the relationship between agency CIOs and bureau CIOs; strengthen CIO accountability for IT costs, schedules, performance,  and security.

The guidance identifies a number of actions that agencies are to take to  establish a basic set of roles and responsibilities (referred to as the  common baseline) for CIOs and other senior agency officials; and thus, to  implement the authorities described in the law. For example, agencies are  to conduct a self-assessment and submit a plan describing the changes  they intend to make to ensure that common baseline responsibilities are  implemented.

In addition, in August 2016, OMB released guidance intended to, among  other things, define a framework for achieving the data center  consolidation and optimization requirements of FITARA. The guidance  directs agencies to develop a data center consolidation and optimization  strategic plan that defines the agency’s data center strategy for fiscal  years 2016, 2017, and 2018. This strategy is to include, among other  things, a statement from the agency CIO indicating whether the agency  has complied with all data center reporting requirements in FITARA.  Further, the guidance indicates that OMB is to maintain a public  dashboard to display consolidation-related costs savings and optimization  performance information for the agencies.

Congress Has Undertaken Efforts to Continue Selected FITARA Provisions and Modernize Federal IT

Congress has recognized the importance of agencies’ continued  implementation of FITARA provisions, and has taken legislative action to  extend selected provisions beyond their original dates of expiration.  Specifically, Congress and the President enacted laws to:  remove the expiration date for enhanced transparency and improved  risk management provisions, which were set to expire in 2019;  remove the expiration date for portfolio review, which was set to  expire in 2019; and extend the expiration date for FDCCI from 2018 to 2020.

In addition, Congress and the President enacted a law to authorize the  availability  of funding mechanisms to help further agencies’ efforts to  modernize IT. The law, known as the Modernizing Government  Technology (MGT) Act, authorizes agencies to establish working capital  funds for use in transitioning from legacy IT systems, as well as for  addressing evolving threats to information security. The law also creates  the Technology Modernization  Fund, within the Department of the  Treasury, from which agencies can “borrow” money to retire and replace  legacy systems, as well as acquire or develop systems.

Further, in February 2018, OMB issued guidance for agencies to  implement the MGT Act. The guidance was intended to provide  agencies additional information regarding the Technology Modernization  Fund, and the administration and funding of the related IT working capital  funds. Specifically, the guidance allowed agencies to begin submitting  initial project proposals for modernization on February 27, 2018. In  addition, in accordance with the MGT Act, the guidance provides details  regarding a Technology Modernization Board, which is to consist of (1)  the Federal CIO; (2) a senior official from the General Services  Administration; (3) a member of DHS’s National Protection and Program  Directorate; and (4) four federal employees with technical expertise in IT  development, financial management, cybersecurity and privacy, and  acquisition, appointed by the Director of OMB.

FISMA Establishes Responsibilities for Agencies to Address Federal Cybersecurity

Congress and the President enacted the Federal Information Security  Modernization Act of 2014 (FISMA) to improve federal cybersecurity  and clarify government-wide responsibilities. The act addresses the  increasing sophistication of cybersecurity attacks, promotes the use of  automated security tools with the ability to continuously monitor and  diagnose the security posture of federal agencies, and provides for  improved oversight of federal agencies’ information security programs.

Specifically, the act clarifies and assigns additional responsibilities to  entities such as OMB, DHS, and the federal agencies. Table 1 describes  a selection of OMB, DHS, and agency responsibilities.

The Current Administration Has Undertaken Efforts to Improve, Modernize, and Strengthen the Security of Federal IT

Beyond the implementation of FITARA,  FISMA,  and related actions, the  current administration has also initiated other efforts intended to improve  federal IT. Specifically, in March 2017, the administration established the  Office of American Innovation,  which has a mission to, among other  things, make recommendations to the President on policies and plans  aimed at improving federal government operations and services. In doing  so, the office is to consult with both OMB and the Office of Science and  Technology Policy on policies and plans intended to improve government  operations and services, improve the quality of life for Americans, and  spur job creation.

In May 2017, the Administration also established the American  Technology Council, which has a goal of helping to transform and  modernize federal agency IT and how the federal government uses and  delivers digital services. The President is the chairman of this council,  and the Federal CIO and the United States Digital Service Administrator  are among the members.

In addition, on May 11, 2017, the President signed Executive Order  13800, Strengthening the Cybersecurity of Federal Networks and Critical  Infrastructure. This executive order outlined actions to enhance  cybersecurity across federal agencies and critical infrastructure to  improve the nation’s cyber posture and capabilities against cyber security  threats. Among other things, the order tasked the Director of the  American Technology Council to coordinate a report to the President  from the Secretary of DHS, the Director of OMB, and the Administrator of  the General Services Administration, in consultation with the Secretary of  Commerce, regarding the modernization of federal IT. As a result, the  Report to the President on Federal IT Modernization was issued on  December 13, 2017, and outlined the current and envisioned state of  federal IT. The report focused on modernization efforts to improve the  security posture of federal IT and recognized that agencies have  attempted to modernize systems but have been stymied by a variety of  factors, including resource prioritization, ability to procure services  quickly, and technical issues. The report provided multiple  recommendations intended to address these issues through the  modernization and consolidation of networks and the use of shared  services to enable future network architectures.

Further, in March 2018, the Administration issued the President’s  Management Agenda, which lays out a long-term vision for modernizing  the federal government. The agenda identifies three related drivers of  transformation—IT modernization; data, accountability, and transparency;  and the workforce of the future—that are intended to push change across  the federal government.

The Administration also established 14 related Cross-Agency Priority  goals, many of which have elements that involve IT. In particular, the  Cross-Agency Priority goal on IT modernization states that modern IT  must function as the backbone of how government serves the public in  the digital age and provides three priorities that are to guide the  Administration’s efforts to modernize federal IT: (1) enhancing mission  effectiveness by improving the quality and efficiency of critical services,  including the increased utilization of cloud-based solutions; (2) reducing  cybersecurity risks to the federal mission by leveraging current  commercial capabilities and implementing cutting edge cybersecurity  capabilities; and (3) building a modern IT workforce by recruiting,  reskilling, and retaining professionals able to help drive modernization  with up-to-date technology.

Most recently, on May 15, 2018, the President signed Executive Order  13833, Enhancing the Effectiveness of Agency Chief Information Officers.  Among other things, this executive order is intended to better position  agencies to modernize their IT systems, execute IT programs more  efficiently, and reduce cybersecurity risks. The order pertains to 22 of  the 24 Chief Financial Officer Act agencies: the Department of Defense  and the Nuclear Regulatory Commission are exempt.

For the covered agencies, the executive order strengthens the role of  agency CIOs by, among other things, requiring to report directly to their  agency head; to serve as their agency head’s primary IT strategic  advisor; and to have a significant role in all management, governance,  and oversight processes related to IT. In addition, one of the  cybersecurity requirements directs agencies to ensure that the CIO works  closely with an integrated team of senior executives, including those with  expertise in IT, security, and privacy, to implement appropriate risk  management measures.

Agencies Have Not Fully Addressed the IT Acquisitions and Operations High-Risk Area

In the February 2017 update to our high-risk series, we reported that   agencies still needed to complete significant work related to the  management of IT acquisitions and operations  We stressed that OMB  and federal agencies should continue to expeditiously implement FITARA  and OMB’s related guidance, which include enhancing CIO authority,  consolidating data centers, and acquiring and managing software  licenses.

Our update to this high-risk area also stressed that OMB and agencies  needed to continue to implement our prior recommendations in order to  improve their ability to effectively and efficiently invest in IT. Specifically,  from fiscal years 2010 through 2015, we made 803 recommendations to  OMB and federal agencies to address shortcomings in IT acquisitions and  operations. In addition, in fiscal year 2016, we made 202 new  recommendations, thus, further reinforcing the need for OMB and  agencies to address the shortcomings in IT acquisitions and operations.

As stated in the update, OMB and agencies should demonstrate  government-wide progress in the management of IT investments by,  among other things, implementing at least 80 percent of our  recommendations related to managing IT acquisitions and operations  within 4 years. As of May 2018, OMB and agencies had fully implemented  489 (or about 61 percent) of the 803 recommendations. Figure 1  summarizes the progress that OMB and agencies have made in  addressing our recommendations as compared to the 80 percent target.

Overall, federal agencies would be better positioned to realize billions in  cost savings and additional management improvements if they address  these recommendations, including those aimed at implementing CIO  responsibilities, review of IT acquisitions; improving data center  consolidation; and managing software licenses.

Agencies Need to Address Shortcomings and Challenges in Implementing CIO Responsibilities

In all, the various laws, such as FITARA, and related guidance assign  35 IT management responsibilities to CIOs in six key areas. These areas  are: leadership and accountability, budgeting, information security,  investment management, workforce, and strategic planning.

In a draft report on CIO responsibilities that we have provided to the  agencies for comment and plan to issue in June 2018, our preliminary  results suggest that none of the 24 agencies we reviewed had policies  that fully addressed the role of their CIO, as called for by federal laws and  guidance. In this regard, a majority of the agencies fully or substantially  addressed the role of their CIOs for the area of leadership and  accountability. In addition, a majority of the agencies substantially or  partially addressed the role of their CIOs for two areas: information  security and IT budgeting. However, most agencies partially or minimally  addressed the role of their CIOs for two areas: investment management  and strategic planning. These preliminary results are shown in figure 2.

Despite these shortfalls, most agency officials stated that their CIOs are  implementing the responsibilities even if the agencies do not have  policies requiring implementation.

Nevertheless, the CIOs of the 24 selected agencies acknowledged in  responses to a survey that we administered for our draft report that they  were not always very effective in implementing the six IT management  areas. Specifically, our preliminary results show that at least 10 of the  CIOs indicated that they were less than very effective for each of the six  areas of responsibility. We believe that until agencies fully address the  role of CIOs in their policies, agencies will be limited in addressing  longstanding IT management challenges.

Figure 3 depicts that extent to which the CIOs reported their effectiveness  in implementing the six areas of responsibility.

Beyond the actions of the agencies, however, our preliminary results  indicate that shortcomings in agencies’ policies also are partially  attributable to two weaknesses in OMB’s FITARA  implementation  guidance. First, the guidance does not comprehensively address all CIO  responsibilities, such as those related to assessing the extent to which  personnel meet IT management knowledge and skill requirements, and  ensuring that personnel are held accountable for complying with the  information security program. Correspondingly, the majority of the  agencies’ policies did not fully address nearly all of the responsibilities  that were not included in OMB’s guidance.

Second, OMB’s guidance does not ensure that CIOs have a significant  role in (1) IT planning, programming, and budgeting decisions and (2)  execution decisions and the management, governance, and oversight  processes related to IT, as required by federal law and guidance. In the  absence of comprehensive guidance, CIOs will not be positioned to  effectively acquire, maintain, and secure their IT systems.

Based on our preliminary results, 24 agency CIOs also identified a  number of factors that enabled and challenged their ability to effectively  manage IT. As shown in figure 4, five factors were identified by at least  half of the 24 CIOs as major enablers and three factors were identified by  at least half of the CIOs as major challenges. Specifically, most agency  CIOs cited five factors as being enablers to effectively carry out their  responsibilities: (1) NIST guidance, (2) the CIO’s position in the agency  hierarchy, (3) OMB guidance, (4) coordination with the Chief Acquisition  Officer (CAO), and (5) legal authority. Further, three factors were cited by  CIOs as major factors that have challenged their ability to effectively carry  out responsibilities: (1) processes for hiring, recruiting, and retaining IT  personnel; (2) financial resources; and (3) the availability  of  personnel/staff resources.

As our draft report states, although OMB has issued guidance aimed at  addressing the three factors that were identified by at least half of the  CIOs as major challenges, the guidance does not fully address those  challenges. Further, regarding the financial resources challenge, OMB  recently required agencies to provide data on CIO authority over IT  spending; however, its guidance does not provide a complete definition of  the authority. We believe that in the absence of such guidance, agencies  have created varying definitions of CIO authority. Further, until OMB  updates its guidance to include a complete definition of the authority that  CIOs are to have over IT spending, it will be difficult for OMB to identify  any deficiencies in this area and to help agencies make any needed  improvements.

In order to address challenges in implementing CIO responsibilities, we  intend to include in our draft report recommendations to OMB and each of  the selected 24 federal agencies to improve the effectiveness of CIOs’  implementation of their responsibilities for each of the six IT management  areas.

Agencies Need to Ensure That IT Acquisitions Are Reviewed and Approved by CIOs

FITARA includes a provision to enhance covered agency CIOs’ authority  through, among other things, requiring agency heads to ensure that CIOs  review and approve IT contracts. OMB’s FITARA implementation  guidance expanded upon this aspect of the legislation in a number of  ways. Specifically, according to the guidance:

CIOs may review and approve IT acquisition strategies and plans,  rather than individual IT contracts;

CIOs can designate other agency officials to act as their  representatives, but the CIOs must retain accountability;

CAOs are responsible for ensuring that all IT contract actions are  consistent with CIO-approved acquisition strategies and plans; and

CAOs are to indicate to the CIOs when planned acquisition strategies  and acquisition plans include IT.

In January 2018, we reported that most of the CIOs at 22 selected  agencies  were not adequately involved in reviewing billions of dollars of  IT acquisitions. For instance, most of the 22 agencies did not identify all  of their IT contracts. In this regard, the agencies identified 78,249 IT- related contracts, to which they obligated $14.7 billion in fiscal year 2016.  However, we identified 31,493 additional contracts with $4.5 billion  obligated, raising the total amount obligated by these agencies to IT  contracts in fiscal year 2016 to at least $19.2 billion. Figure 5 reflects the  obligations that the 22 selected agencies reported to us relative to the  obligations we identified.

The percentage of additional IT contract obligations we identified varied  among the selected agencies. For example, the Department of State did  not identify 1 percent of its IT contract obligations. Conversely, 8  agencies did not identify over 40 percent of their IT contract obligations.

Many of the selected agencies that did not identify these IT contract  obligations did not follow OMB guidance. Specifically, 14 of the 22  agencies did not involve the acquisition office in their process to identify  IT acquisitions for CIO review, as required by OMB. In addition, 7  agencies did not establish guidance to aid officials in recognizing IT. We  concluded that until these agencies involve the acquisitions office in their  IT acquisition identification processes and establish supporting guidance,  they cannot ensure that they will identify all IT acquisitions. Without  proper identification of IT acquisitions, these agencies and CIOs cannot  effectively provide oversight of these acquisitions.

In addition to not identifying all IT contracts, 14 of the 22 selected  agencies did not fully satisfy OMB’s requirement that the CIO review and  approve IT acquisition plans or strategies. Further, only 11 of 96  randomly selected IT contracts at 10 agencies that we evaluated were  CIO-reviewed and approved as required by OMB’s guidance. The 85 IT  contracts not reviewed had a total possible value of approximately $23.8  billion.

We believe that until agencies ensure that CIOs are able to review and  approve all IT acquisitions, CIOs will continue to have limited visibility and  input into their agencies’ planned IT expenditures and will not be able to  use the increased authority that FITARA’s contract approval provision is  intended to provide. Further, agencies will likely miss an opportunity to  strengthen CIOs’ authority and the oversight of IT acquisitions. As a  result, agencies may award IT contracts that are duplicative, wasteful, or  poorly conceived.

As a result of these findings, we made 39 recommendations in our  January 2018 report. The recommendations included that agencies  ensure that their acquisition offices are involved in identifying IT  acquisitions and issuing related guidance, and that IT acquisitions are  reviewed in accordance with OMB guidance. OMB and the majority of the  agencies generally agreed with or did not comment on the  recommendations.

Agencies Have Made Progress in Consolidating Data Centers, but Need to Take Action to Achieve Planned Cost Savings

In our February 2017 high-risk update, we stated that OMB and agencies  needed to demonstrate additional progress on achieving data center  consolidation savings in order to improve the management of IT  acquisitions and operations. Further, data center consolidation efforts are  key to implementing FITARA. Specifically, OMB established the FDCCI in  February 2010 to improve the efficiency, performance, and environmental  footprint of federal data center activities. The enactment of FITARA in  2014 codified and expanded the initiative.

In a series of reports that we issued from July 2011 through August 2017,  we noted that, while data center consolidation could potentially save the  federal government billions of dollars, weaknesses existed in several  areas, including agencies’ data center consolidation plans, data center  optimization, and OMB’s tracking and reporting on related cost savings.  In these reports, we made a total of 160 recommendations to OMB and  24 agencies to improve the execution and oversight of the initiative. Most  agencies and OMB agreed with our recommendations or had no  comments. As of May 2018, 80 of these 160 recommendations remained  unimplemented.

Further, we recently reported in May 2018 that the 24 agencies  participating in OMB’s Data Center Optimization Initiative  (DCOI) had  communicated mixed progress toward achieving OMB’s goals for closing  data centers by September 2018. Over half of the agencies reported  that they had either already met, or planned to meet, all of their OMB- assigned goals by the deadline. This would result in the closure of 7,221  of the 12,062 centers that agencies reported in August 2017. However, 4  agencies reported that they do not have plans to meet all of their  assigned goals and 2 agencies are working with OMB to establish revised  targets. With regard to agencies’ progress in achieving cost savings, 24  agencies reported $3.9 billion in cost savings through 2018.

The 24 agencies also reported limited progress against OMB’s five data  center optimization targets for server utilization and automated  monitoring, energy metering, power usage effectiveness, facility  utilization, and virtualization. As of August 2017, 1 agency reported that it  had met four targets, 1 agency reported that it had met three targets, 6  agencies reported having met either one or two targets, and 14 agencies  reported meeting none of the targets.

Further, as of August 2017, most agencies were not planning to meet  OMB’s fiscal year 2018 optimization targets. Specifically, 4 agencies  reported plans to meet all of their applicable targets by the end of fiscal  year 2018; 14 agencies reported plans to meet some of the targets; and 4  reported that they did not plan to meet any targets. Figure 6 summarizes  agency-reported plans to meet or exceed the OMB’s data center  optimization targets, as of August 2017.

In 2016 and 2017, we made 81 recommendations to OMB and the 24  DCOI agencies to help improve the reporting of data center-related cost  savings and to achieve optimization targets. As of May 2018, 71 of these  81 recommendations have not been fully addressed.

Agencies Need to Better Manage Software Licenses to Achieve Savings

In our 2015 high-risk report’s discussion of IT acquisitions and operations,  we identified the management of software licenses as an area of concern,  in part because of the potential for cost savings. Federal agencies  engage in thousands of software licensing agreements annually. The  objective of software license management is to manage, control, and  protect an organization’s software assets. Effective management of these  licenses can help avoid purchasing too many licenses, which can result in  unused software, as well as too few licenses, which can result in  noncompliance with license terms and cause the imposition of additional  fees.

As part of its PortfolioStat initiative, OMB has developed policy that  addresses software licenses. This policy requires agencies to conduct an  annual, agency-wide IT portfolio review to, among other things, reduce  commodity IT spending. Such areas of spending could include software  licenses.

In May 2014, we reported on federal agencies’ management of software  licenses and determined that better management was needed to achieve  significant savings government-wide. Of the 24 selected agencies we  reviewed, only 2 had comprehensive policies that included the  establishment of clear roles and central oversight authority for managing  enterprise software license agreements, among other things. Of the  remaining 22 agencies, 18 had policies that were not comprehensive, and  4 had not developed any policies.

Further, we found that only 2 of the 24 selected agencies had established  comprehensive software license inventories, a leading practice that would  help them to adequately manage their software licenses. The inadequate implementation of this and other leading practices in software license  management was partially due to weaknesses in agencies’ policies. As a  result, we concluded that agencies’ oversight of software license  spending was limited or lacking, thus potentially leading to missed  savings. However, the potential savings could be significant considering  that, in fiscal year 2012, 1 major federal agency reported saving  approximately $181 million by consolidating its enterprise license  agreements, even when its oversight process was ad hoc.

Accordingly, we recommended that OMB issue a directive to help guide  agencies in managing software licenses. We also made 135  recommendations to the 24 agencies to improve their policies and  practices for managing licenses. Among other things, we recommended  that the agencies regularly track and maintain a comprehensive inventory  of software licenses and analyze the inventory to identify opportunities to  reduce costs and better inform investment decision making.

Most agencies generally agreed with the recommendations or had no  comments. As of May 2018, 78 of the 135 recommendations had not  been implemented. Table 2 reflects the extent to which the 24 agencies  implemented the recommendations in these two areas.

Agencies Need to Address Shortcomings in Information Security Area

Since information security was added to the high-risk list in 1997, we  have consistently identified shortcomings in the federal government’s  approach to cybersecurity. We have previously testified that, even  though agencies have acted to improve the protections over federal and  critical infrastructure information and information systems, the federal  government needs to take the following actions to strengthen U.S.  cybersecurity:

Effectively implement risk-based entity-wide information security  programs consistently over time. Among other things, agencies  need to (1) implement sustainable processes for securely configuring  operating systems, applications, workstations, servers, and network  devices; (2) patch vulnerable systems and replace unsupported  software; (3) develop comprehensive security test and evaluation  procedures and conduct examinations on a regular and recurring  basis; and (4) strengthen oversight of contractors providing IT  services.  Improve its cyber incident detection, response, and mitigation  capabilities. DHS needs to expand the capabilities and support wider  adoption of its government-wide intrusion detection and prevention  system. In addition, the federal government needs to improve cyber  incident response practices, update guidance on reporting data  breaches, and develop consistent responses to breaches of  personally identifiable information.

Expand its cyber workforce planning and training efforts. The  federal government needs to (1) enhance efforts for recruiting and  retaining a qualified cybersecurity workforce and (2) improve  cybersecurity workforce planning activities.

Expand efforts to strengthen cybersecurity of the nation’s critical  infrastructures. The federal government needs to develop metrics to  (1) assess the effectiveness of efforts promoting the National Institute  of Standards and Technology’s (NIST) Framework for Improving  Critical Infrastructure Cybersecurity and (2) measure and report on  the effectiveness of cyber risk mitigation activities and the  cybersecurity posture of critical infrastructure sectors.

Better oversee protection of personally identifiable information.  The federal government needs to (1) protect the security and privacy  of electronic health information, (2) ensure privacy when face  recognition systems are used, and (3) protect the privacy of users’  data on state-based health insurance marketplaces.

As we have previously noted, in order to take the preceding actions and  strengthen the federal government’s cybersecurity posture, agencies  should implement the information security programs required by FISMA.  In this regard, FISMA  provides a framework for ensuring the effectiveness  of information security controls for federal information resources. The law  requires each agency to develop, document, and implement an agency- wide information security program. Such a program includes risk  assessments; the development and implementation of policies and  procedures to cost-effectively reduce risks; plans for providing adequate  information security for networks, facilities, and systems; security  awareness and specialized training; the testing and evaluation of the  effectiveness of controls; the planning, implementation, evaluation, and  documentation of remedial actions to address information security  deficiencies; procedures for detecting, reporting, and responding to  security incidents; and plans and procedures to ensure continuity of  operations.

Since 2010, we have made 2,733 recommendations to agencies aimed at  improving the security of federal systems and information. These  recommendations have identified actions for agencies to take to  strengthen technical security controls over their computer networks and  systems. They also have included recommendations for agencies to fully  implement aspects of their information security programs, as mandated  by FISMA.  Nevertheless, many agencies continue to be challenged in  safeguarding their information systems and information, in part because  many of these recommendations have not been implemented. As of May  2018, 793 of information security-related recommendations we have  made have not been implemented.

Agencies’ Inspectors General Are to Identify Information Security Program Weaknesses

In order to determine the effectiveness of the agencies’ information  security programs and practices, FISMA  requires that federal agencies’  inspectors general conduct annual independent evaluations. The  agencies are to report the results of these evaluations to OMB, and OMB  is to summarize the results in annual reports to Congress.

In these evaluations, the inspectors general frame the scope of their  analysis, identify key findings, and detail recommendations to address the  findings. The evaluations also are to capture maturity model ratings for  their respective agencies. Toward this end, in fiscal year 2017, the  inspector general community, in partnership with OMB and DHS, finalized  a 3-year effort to create a maturity model for FISMA  metrics that align to  the five function areas in the NIST Framework for Improving Critical  Infrastructure Cybersecurity (Cybersecurity Framework): identify, protect,  detect, respond, and recover. This alignment is intended to help  promote consistent and comparable metrics and criteria and provides  agencies with a meaningful independent assessment of their information  security programs.

This maturity model is designed to summarize the status of agencies’  information security programs on a five-level capability maturity scale.  The five maturity levels are defined as follows:

Level 1 Ad-hoc: Policies, procedures, and strategy are not formalized;  activities are performed in an ad-hoc, reactive manner.

Level 2 Defined: Policies, procedures, and strategy are formalized  and documented but not consistently implemented.

Level 3 Consistently Implemented: Policies, procedures, and strategy  are consistently implemented, but quantitative and qualitative  effectiveness measures are lacking.

Level 4 Managed  and Measurable: Quantitative and qualitative  measures on the effectiveness of policies, procedures, and strategy  are collected across the organizations and used to assess them and  make necessary changes.

Level 5 Optimized: Policies, procedures, and strategy are fully  institutionalized, repeatable, self-generating, consistently implemented  and regularly updated based on a changing threat and technology  landscape and business/mission needs.

In March 2018, OMB issued its annual FISMA  report to Congress, which  showed the combined results of the inspectors general’s fiscal year 2017  evaluations. Based on data from 76 agency inspector general and  independent auditor assessments, OMB determined that the  government-wide median maturity model ratings across the five NIST  Cybersecurity Framework areas did not exceed a level 3 (consistently  implemented). Table 3 shows the inspectors general’s median ratings for  each of the NIST Cybersecurity Framework areas.

OMB Requires Agencies to Meet Targets for Cybersecurity Metrics

In its efforts toward strengthening the federal government’s cybersecurity,  OMB also requires agencies to submit related cybersecurity metrics as  part of its Cross-Agency Priority goals. In particular, OMB developed the  IT modernization goal so that federal agencies will be able to build and  maintain more modern, secure, and resilient IT. A key part of this goal is  to reduce cybersecurity risks to the federal mission through three  strategies: manage asset security, protect networks and data, and limit  personnel access. The key targets supporting each of these strategies  correspond to areas within the FISMA  metrics. Table 4 outlines the  strategies and their associated targets.

In conclusion, FITARA and FISMA  present opportunities for the federal  government to address the high-risk areas on improving the management  of IT acquisitions and operations, and ensuring the security of federal IT,  thereby saving billions of dollars. Most agencies have taken steps to  execute key IT management and cybersecurity initiatives, including  implementing CIO responsibilities, requiring CIO review of IT acquisitions,  realizing data center consolidation cost savings, managing software  assets, and complying with FISMA  requirements. The agencies have also  continued to address the recommendations that we have made over the  past several years. However, further efforts by OMB and federal agencies  to implement our previous recommendations would better position them  to improve the management and security of federal IT. To help ensure  that these efforts succeed, we will continue to monitor agencies’ efforts  toward implementing these recommendations.

Chairmen Meadows and Hurd, Ranking Members Connolly and Kelly,  and Members of the Subcommittees, this completes my prepared  statement. I would be pleased to respond to any questions that you may  have at this time.

If you or your staff have any questions about this testimony, please  contact David A. Powner, Director, Information Technology, at (202) 512- 9286 or pownerd@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this statement. GAO staff who made key contributions to this testimony  are Kevin Walsh (Assistant Director), Chris Businsky, Rebecca Eyler,  Meredith Raymond, and Jessica Waselkow (Analyst in Charge).

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.