High-Containment Laboratories: Coordinated Actions Needed to Enhance the Select Agent Program's Oversight of Hazardous Pathogens

Safety lapses continue to occur at some of the 276 laboratories in the United States that conduct research on select agents—such as Ebola virus or anthrax bacteria—that may cause serious or lethal infection in humans, animals, or plants, raising concerns about whether oversight is effective.

GAO was asked to review the federal oversight approach for select agents and approaches from other countries or regulatory sectors. This report (1) evaluates the extent to which the Select Agent Program has elements of effective oversight and strategic planning documents to guide it, and (2) identifies approaches selected countries and regulatory sectors have used to promote effective oversight.

GAO convened a meeting of experts with the help of the National Academy of Sciences to discuss oversight of select agents. GAO also reviewed relevant laws, regulations, and guidance, and interviewed officials from the Select Agent Program and laboratories it oversees. GAO also reviewed documents and interviewed officials from two countries and other U.S. sectors selected because they have alternate oversight approaches.

The Federal Select Agent Program (Select Agent Program)—jointly managed by the Departments of Health and Human Services (HHS) and Agriculture (USDA)—oversees laboratories' handling of certain hazardous pathogens known as select agents, but the program does not fully meet all key elements of effective oversight, as illustrated in the following examples:

GAO's past work identified independence as a key element of effective oversight. However, the Select Agent Program is not structurally independent from all laboratories it oversees, and it has not assessed risks posed by its current structure or the effectiveness of mechanisms it has to reduce organizational conflicts of interest. Without conducting such assessments and taking actions as needed to address risks, the program may not effectively mitigate impairments to its independence.

Another key element of effective oversight is the ability to perform reviews. Some experts and laboratory representatives raised concerns that the program's reviews may not target the highest-risk activities, in part because it has not formally assessed which activities pose the highest risk. Without assessing the risk of activities it oversees and targeting its resources appropriately, the program cannot ensure it is balancing its resources against their impact.

Technical expertise is another key element GAO identified in past work. The Select Agent Program has taken steps to hire additional expert staff and improve training, but workforce and training gaps remain.

Moreover, the program does not have joint strategic planning documents to guide its oversight. Although it began taking steps to develop a joint strategic plan during GAO's review, the program is not developing workforce plans as part of this effort. GAO's past work has found that strategic workforce planning is an essential tool to help agencies align their workforces with their missions and develop long-term strategies for acquiring, developing, and retaining staff. Developing a joint workforce plan that assesses workforce and training needs for the program as a whole would help the program leverage resources to ensure all workforce and training needs are met.

Selected countries and regulatory sectors GAO reviewed promote effective oversight using approaches that differ from the U.S. Select Agent Program's approaches:

In Great Britain, oversight of laboratories that work with pathogens is under an independent government agency focused on health and safety.

In both Great Britain and Canada, regulators focus their oversight on (1) biological safety, due to safety incidents which provided the impetus for laboratory oversight in these countries; and (2) regulation of all potentially hazardous pathogens and activities in laboratories.

GAO is making 11 recommendations for the Select Agent Program, including to (1) assess risks from its current structure and the effectiveness of its mechanisms to reduce conflicts of interest and address risks as needed, (2) assess the risk of activities it oversees and target reviews to high-risk activities, and (3) develop a joint workforce plan. HHS and USDA agreed with GAO's recommendations.

or John Neumann at (202) 512-3841 or neumannj@gao.gov .

Safety lapses continue to occur at laboratories in the United States that  conduct research on hazardous pathogens—such as the Ebola virus and  the bacteria that causes anthrax—and toxins that may pose a serious  threat to humans, animals, or plants. These lapses raise concerns about  whether federal oversight of these laboratories is effective. For example,  in November 2016, the Department of Homeland Security discovered that  a private laboratory had inadvertently sent a toxic form of ricin (a  potentially lethal poison) to one of its training centers multiple times since  2011, potentially putting training participants at risk. In May 2015, the  Department of Defense (DOD) discovered that a DOD laboratory had  inadvertently shipped live anthrax bacteria to nearly 200 other  laboratories worldwide over the course of 12 years. And in July 2014, the  National Institutes of Health (NIH) discovered decades-old vials of  smallpox in a storage room of a Food and Drug Administration laboratory  on its campus.

Laboratories that conduct research on pathogens fall into one of four  biological safety levels (BSL), with those at BSL-3 and -4 referred to as  high-containment laboratories for the purpose of this report. We—along  with Congress and various federal committees—have, for many years,  identified challenges and areas for improvement related to the safety,  security, and oversight of high-containment laboratories. In 2008 and  2009, for example, we found a proliferation of high-containment  laboratories across the United States, with the number of such  laboratories in the government, academic, and private sectors increasing  since 2001. We also found that, for the subset of these laboratories  subject to federal oversight, the oversight was duplicative, fragmented,  and dependent on self-policing. More recently, we found in 2016 that  stronger oversight mechanisms for federal high-containment laboratories  were needed at the individual federal department and component agency  levels. We have made numerous recommendations over the years,  including that a single entity be identified to determine the number of  high-containment laboratories needed to meet national goals, the  aggregate risks associated with the proliferation of laboratories, and the  type of oversight needed. Federal departments have made some  progress in implementing recommendations from our past reports,  including addressing issues we identified regarding duplicative oversight.

Certain hazardous pathogens and toxins that may be used in high- containment laboratories are designated as select agents because they  have the potential to pose a severe threat to human, animal, or plant  health and safety, or to animal or plant products. Laboratories conduct  research on select agents for a variety of reasons, including to identify  their characteristics and develop vaccines and other measures to help  diagnose, prevent, or treat exposure to or infection with these agents.  Select agent research is subject to federal oversight and regulations, as  well as guided by the principles and practices of biological safety and  security. The Federal Select Agent Program (Select Agent Program) was  established to regulate the possession, use, and transfer of select agents  in response to security concerns following bioterrorism attacks in the  1990s and early 2000s. The Select Agent Program is jointly managed by  the Division of Select Agents and Toxins within the Department of Health  and Human Services (HHS) Centers for Disease Control and Prevention  (CDC) and the Agriculture Select Agent Services within the U.S.  Department of Agriculture (USDA) Animal and Plant Health Inspection  Service (APHIS). Together, these components within CDC and APHIS  regulate and oversee all high-containment laboratories in the United  States that register to work with select agents. Such laboratories are  required to follow both biological safety and security practices. According  to the Biosafety in Microbiological and Biomedical Laboratories manual,  biological safety practices are intended to reduce or eliminate exposure of  individuals and the environment to potentially hazardous pathogens and  biological security practices are intended to prevent the loss, theft,  release, or misuse of hazardous pathogens and related information by  limiting access to facilities and this information.

Other countries also regulate and oversee hazardous pathogens handled  in high-containment laboratories and may take different approaches to  this oversight. Moreover, other high-risk sectors in the United States,  such as the nuclear industry, in some cases, take different approaches to  oversight. In our past work reviewing some of these sectors, we have  identified five key elements of effective oversight in areas where low- probability adverse events can have significant and far-reaching effects.  These elements are as follows:  Independence: The organization conducting oversight should be  structurally distinct and separate from the entities it oversees.

Ability to perform reviews: The organization should have the access  and working knowledge necessary to review compliance with  requirements.

Technical expertise: The organization should have sufficient staff  with the expertise to perform sound safety and security assessments.

Transparency: The organization should provide access to key  information, as applicable, to those most affected by operations.

Enforcement authority: The organization should have clear and  sufficient authority to require that entities achieve compliance with  requirements.

In our past work, we have also found that requirements under the  Government Performance and Results Act of 1993 (GPRA), as  amended, for strategic planning at the agency level can serve as  leading practices at lower levels within federal agencies, such as for  individual programs. The act requires agencies to develop strategic  plans that include documents and planning tools such as mission  statements, strategic goals and objectives, and performance measures,  which, according to our past work, can help inform agency decision  making to address challenges.

You asked us to review the effectiveness of the current approach to  overseeing select agents as well as approaches from other countries and  regulatory sectors. This report (1) examines the extent to which the Select  Agent Program has the elements of effective oversight and has strategic  planning documents to guide its oversight efforts, and (2) describes  approaches that selected countries and regulatory sectors have used to  promote effective oversight.

To evaluate the extent to which the Select Agent Program has the  elements of effective oversight, we first identified five key elements of  effective oversight we have used in the past for assessing the  effectiveness of oversight in other areas where low probability adverse  events can have significant and far-reaching effects. We discussed these  elements with agency officials, experts, and representatives from  nongovernmental organizations to ensure their applicability to the  oversight of select agents (see app. I for a description of these elements  and our vetting process). We then reviewed relevant laws, select agent  regulations, and joint documents from the Select Agent Program, such as  program guidance, inspection checklists, memorandums of understanding  guiding the program, reports on the program, information on enforcement  actions, inspection data, and other documents to determine the extent to  which the program performed activities or met requirements in the key  elements. We took several steps to determine the reliability of the  inspection data, including interviewing agency officials and comparing a  subset of the data to information from other sources. We determined that  the inspection data were sufficiently reliable for the purpose of this report.

We also reviewed documents from or related to the two components of  the program, CDC and APHIS, such as workforce planning documents,  agency policies, budget justifications, and internal program reviews. In  addition, we contacted the HHS Office of Inspector General (OIG) and  USDA Office of General Counsel to obtain their legal views on the  departments’ authority to impose civil money penalties on federal  laboratories. We interviewed officials from CDC and APHIS—including  senior agency leadership, senior Select Agent Program officials, and  inspectors—to discuss the Select Agent Program’s structure, inspections  and other oversight responsibilities, technical expertise, and other issues  related to the five elements of effective oversight. To gain additional  perspectives on the Select Agent Program, we interviewed officials from  DOD and the Department of Homeland Security as well as  representatives from a nongeneralizeable selection of 18 laboratories  registered with the Select Agent Program. We selected these laboratories  to represent a range of laboratories across various sectors (e.g.,  federal—including CDC and APHIS—academic, commercial, and state  and local government), biological safety levels, and CDC or APHIS  component registration. The views of these representatives are not  generalizable to all registered laboratories, but they provide illustrative  examples.

To evaluate the extent to which the Select Agent Program has strategic  planning documents to guide its oversight efforts, we reviewed relevant  laws and our past work in this area. We also reviewed joint program  documents and documents from the two components of the program,  including mission statements, business plans, performance measures,  and other related documents. In our interviews with program officials, we  discussed the program’s past and ongoing efforts related to strategic  planning.

To obtain expert views on the effectiveness of the approaches the Select  Agent Program and other selected countries and regulatory sectors have  used to promote effective oversight, we worked with the National  Academy of Sciences to convene a meeting with 18 experts with  combined expertise in biological safety, biological security, microbiology,  nuclear safety, worker safety, airline safety, food safety, risk  management, organizational change management, and human factor  assessments. The experts were evaluated for any conflicts of interest,  such as any current or financial or other interest that might conflict with  the service of an individual because it (1) could impair objectivity and  (2) could create an unfair competitive advantage for any person or  organization. The 18 experts were determined to be free of conflicts of  interest, and the group as a whole was judged to have no inappropriate  biases. (See app. II for a list of the experts that participated and a  description of our expert selection methodology.) The 2-day meeting was  composed of six sessions covering a range of topics, such as  effectiveness of the Select Agent Program’s oversight, lessons learned  from other oversight approaches, and considerations for the program  moving forward.

We also reviewed relevant documentation and interviewed officials from  selected countries and sectors about their oversight approaches. To  select countries, we first identified developed countries with high- containment laboratory oversight models based on past reports and  recommendations from experts and nongovernmental organizations. We  then narrowed our list of countries to those with networks of high- containment laboratories comparable to that of the United States (i.e.,  with multiple BSL-3 and -4 laboratories across a range of sectors that  handle hazardous pathogens similar to select agents) and with key  differences in their oversight models compared with that of the United  States. Because of the resources needed to conduct site visits, we  selected two countries from that list to visit, the United Kingdom (UK) and  Canada. In addition, we interviewed officials from four additional  countries—France, Germany, Switzerland, and the Netherlands—to learn  about their oversight approaches. We conducted these interviews at a  meeting of the European subgroup of the International Expert Group on  Biosafety and Biosecurity Regulation in Switzerland. To learn more about  other regulatory sectors’ oversight approaches, we reviewed documents  and interviewed officials from the Nuclear Regulatory Commission (NRC)  and Department of Labor’s Occupational Safety and Health  Administration and collected information from the Department of  Transportation’s Federal Aviation Administration.

We compared information from federal documents about the Select Agent  Program’s oversight and strategic planning efforts, interviews with  laboratory representatives and agency officials, and our expert meeting  against the five elements of effective oversight, federal internal control  standards, requirements from the Office of Management and Budget  (OMB), and our past work. We also reviewed the Select Agent Program’s  responses and actions related to recent federal reviews of the program,  including CDC and APHIS internal reviews, reviews from the HHS and   USDA OIGs, and reports from other federal committees.

We conducted this performance audit from July 2016 to October 2017 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

This section provides information on select agent regulations and  program roles, responsibilities, and requirements; and the history of the  Select Agent Program.

Select Agent Regulations and Program Roles, Responsibilities, and Requirements

The Select Agent Program is fragmented because oversight responsibility  is, by law, split between CDC and APHIS. The two agencies have  delineated roles and responsibilities to regulate laboratories—including  conducting inspections and other activities—that possess, use, or transfer  biological select agents. CDC’s Division of Select Agents and Toxins is  responsible for the oversight and regulation of select agents that could  pose a threat to public health and safety, such as the Ebola virus.  APHIS’s Agriculture Select Agent Services is responsible for the oversight  and regulation of select agents that could pose a threat to animal or plant  health or animal or plant products, such as the virus that causes foot-and- mouth disease. Some select agents, such as Bacillus anthracis (the  bacterium that causes anthrax), are regulated by both agencies because  they pose a threat to both human and animal health; these agents are  known as overlap agents. As part of their oversight, CDC and APHIS  maintain a list of select agents that they are required to review and  republish at least every 2 years.

Generally, laboratories (including those at federal agencies and private  institutions) and individuals who possess, use, or transfer these select  agents must register with CDC or APHIS and renew their registration  every 3 years. Most laboratories registered with the Select Agent  Program are registered with CDC (238 of 276). (See fig. 1 for information  about the laboratories registered with the program.) In fiscal year 2016,  CDC’s budget to manage its component of the Select Agent Program was  about $21 million and APHIS’s was about $5.5 million.

Select agent regulations govern the possession, use, and transfer of  designated select agents. To apply for a certificate of registration, the  laboratory must submit an application package to either CDC or APHIS,  and laboratory personnel must submit to a security risk assessment  conducted by the Federal Bureau of Investigation (FBI). The Select  Agent Program conducts an on-site inspection before issuing a new  certificate of registration or renewing an existing registration; both are  valid for a maximum of 3 years. Once approved, a laboratory’s  certification of registration may be amended to reflect changes in  circumstances, such as replacement of the responsible official or other  personnel changes, changes in ownership or control of the laboratory,  changes in the activities involving any select agents, or the addition or  removal of any select agents. As a condition of registration, the select  agent regulations require each laboratory to designate an individual to be  its responsible official, who is responsible for ensuring compliance with  the regulations. In addition, the regulations require laboratories to develop  various written plans, as well as provide training and maintain records of  training and other activities. For example, the regulations require that  laboratories registered with the program develop and implement a written  security plan sufficient to safeguard each select agent against  unauthorized access, theft, loss, or release; develop and implement a  written biological safety plan that is commensurate with the risk of the  select agent, given its intended use; provide training on biological safety  and security for individuals with access to select agents; and maintain  records on the activities covered by the select agent regulations.

Several historical security incidents involving hazardous pathogens  resulted in a series of laws and other regulatory activity that served to  establish and amend the Select Agent Program. First, Congress passed  section 511 of the Antiterrorism and Effective Death Penalty Act of 1996  after an individual in the United States unlawfully obtained Yersinia pestis,  the bacterium that causes plague, by mail order. Section 511 directed the  Secretary of HHS to promulgate regulations identifying a list of biological  agents that have the potential to pose a severe threat to public health and  safety, providing procedures governing the transfer of those agents, and  establishing safeguards to prevent unauthorized access to those agents  for purposes of terrorism or other criminal activities. The HHS Secretary  delegated the authority to regulate select agents to CDC, thus  establishing the Select Agent Program in its initial form. In carrying out  this authority, CDC required laboratories transferring select agents to be  registered with the program.

After the terrorist events of September 11, 2001, and the subsequent  anthrax attacks in October 2001, Congress passed the USA PATRIOT  Act of 2001 and the Public Health Security and Bioterrorism  Preparedness and Response Act of 2002. These acts significantly  expanded the Select Agent Program by restricting access to select  agents and increasing safeguards and security measures for select  agents. The 2002 act also expanded the program to include not only the  regulation of the transfer but also the use and possession of select  agents, and it granted comparable authority to USDA for select agents  that pose a threat to animal or plant health, or animal or plant products.  The Secretary of Agriculture delegated the authority to regulate select  agents that affect animal or plant health to APHIS. The act also required  HHS and USDA to coordinate on overlap agents and required the  Secretaries of both departments to establish, maintain, and biennially  review and republish the select agent list, making revisions as appropriate  to protect the public.

On July 2, 2010, the President signed Executive Order 13546,  “Optimizing the Security of Biological Select Agents and Toxins in the  United States.” The executive order directed HHS and USDA, as a part of  their ongoing review, to tier the select agents on the list, consider  shortening the list, and establish physical security standards for select  agents with the highest risk of misuse; HHS and USDA did so in final  rules published October 5, 2012. About half of the laboratories  registered with the program as of December 2016 were registered to work  with tier 1 agents (142 of 276).

Select Agent Program Does Not Fully Meet Key Elements of Effective Oversight or Have Joint Strategic Planning Documents to Guide Its Efforts Select Agent Program Does Not Fully Meet Oversight Elements Related to Independence, Performing Reviews, Technical Expertise, Transparency, and Enforcement

The Select Agent Program does not fully meet key elements of effective  oversight. In particular, the program has oversight shortcomings related to  each of the five key elements: independence, performing reviews,  technical expertise, transparency, and enforcement. In addition, the  program does not have joint strategic planning documents to guide its  oversight efforts, such as a joint strategic plan and workforce plan; it did,  however, begin taking steps to develop a joint strategic plan over the  course of our review.

The Select Agent Program does not fully meet our key elements of  effective oversight. Specifically, the program is not independent from all  laboratories it oversees, and it has not formally assessed the potential  risks posed by its current organizational structure. In addition, the  program regularly performs reviews of laboratories’ compliance with  regulatory and program requirements, but these reviews may not target  the activities that pose the highest risk to biological safety and security.  Moreover, even though the program has taken steps to hire additional  staff and enhance the technical expertise of its staff, workforce and  training gaps remain. The program has increased transparency since  2016, but the information it shares is limited and there is no consensus  about what additional information could be shared, given security  concerns. Lastly, the Select Agent Program has authority to enforce  compliance with program requirements, but is still working to address  past concerns about the need for greater consistency and clarity in  actions it takes in exercising this authority.

Program Is Not Independent and Has Not Formally Assessed All Risks Posed by Its Current Structure

Independence  The organization conducting oversight should  be structurally distinct and separate from the  entities it oversees.

According to our key elements of effective oversight, to be independent,  the organization conducting oversight should be structurally distinct and  separate from the entities it oversees. The Select Agent Program is not  structurally distinct and separate from all of the laboratories it oversees  but has taken some steps to reduce conflicts of interest potentially posed  by its current structure within CDC and APHIS. The two components of  the Select Agent Program are located in CDC and APHIS, both of which  also have high-containment laboratories registered with the program.  Many experts at our meeting raised concerns that the Select Agent  Program cannot be entirely independent in its oversight of CDC and  APHIS laboratories because the Select Agent Program is composed of  divisions of those agencies. In particular, one expert stated that to be  independent, the agencies cannot regulate themselves, and others said  that the agencies’ oversight of their own laboratories may present a  conflict of interest. However, laboratories owned by CDC and APHIS are  not generally located within the same agency divisions and thus are not in  the same chain of command as the Select Agent Program. The one  exception is an APHIS-owned complex of laboratories in the same  division as the APHIS component of the program, but that complex is  registered with CDC, which means that CDC leads its inspections and  oversight.

Senior program officials, many laboratory representatives, and some  experts cited a number of benefits to the Select Agent Program’s current  structure within CDC and APHIS, including the ability for inspectors to  have access to experts and other support from their respective divisions.  For example, program officials said that the Select Agent Program had  reached out to CDC scientists for assistance in developing guidance  documents for the program. In addition, inspectors sometimes obtain  technical assistance from experts in CDC and APHIS, such as in cases  where the inspectors are not familiar with certain techniques or equipment  being used in a registered laboratory. However, program officials also  said that they have tried to limit the extent that they rely on CDC and  APHIS scientists from outside the program, so as not to raise concerns  about conflicts of interest. Senior program officials from CDC and APHIS  also said that the Select Agent Program’s current locations within the two  agencies allow for access to additional support as needed, including  additional funds and administrative services. Senior program officials from  CDC further stated that being located in an office focused on  preparedness and response is advantageous because the Select Agent  Program can quickly pivot into incident response mode, allowing for rapid  response and assessment of incidents that occur in registered  laboratories. They noted that this location proved advantageous during an  incident in 2015, for example, when the program responded to the  discovery that a DOD laboratory had inadvertently sent live Bacillus  anthracis, the bacterium that causes anthrax, to nearly 200 laboratories.

The location of the program has also raised some concerns in the past,  which the Select Agent Program has taken some steps to address. In  response to past concerns about conflicts of interest and separation of  duties raised by HHS OIG, APHIS, and us, both CDC and APHIS made  structural changes to increase the Select Agent Program’s independence  within their respective agencies. In particular, in 2003, in response to  concerns from HHS OIG and us, CDC moved its component of the Select  Agent Program into the agency’s Office of Public Health Preparedness  and Response because that office did not have any laboratories  registered with the program. (See fig. 2 for HHS’s organizational chart,  including a depiction of where CDC’s Select Agent Program component  currently sits in relation to other agency divisions.) According to CDC  officials, the director of the CDC component of the Select Agent Program  has access to senior leadership at CDC as needed.

Similarly, since 2013, APHIS has also made some organizational  changes, including realigning supervisory responsibilities for the program  and creating a direct line of communication from the director of the APHIS  component of the Select Agent Program to the APHIS administrator.  Previously, the program reported to a director whose division had a suite  of laboratories that the program inspects. Now it is managed through  APHIS’s National Import Export Services, which has different senior-level  managers that report directly to the Office of the Administrator rather than  the managers who oversee registered laboratories. According to agency  officials, these changes increased the level of independence between the  Select Agent Program and APHIS-owned laboratories but did not fully  address the appearance of a lack of independence within APHIS, since  the agency’s organizational chart still places the APHIS component of the  Select Agent Program under Veterinary Services. (See fig. 3 for USDA’s  organizational chart, including a depiction of where APHIS’s Select Agent  Program component currently sits in relation to other agency divisions).  The APHIS director of the Select Agent Program and the Associate  Administrator of APHIS meet regularly to discuss incidents involving  select agents, enforcement actions, and operation of the Select Agent  Program, among other issues, according to agency officials, but this  reporting structure is not documented. According to federal standards for  internal control, management should establish an organizational  structure, assign responsibility, and delegate authority to achieve the  entity’s objectives and should develop and maintain documentation of its  internal control system. Until APHIS formally documents the reporting  structure for its component of the Select Agent Program from the APHIS  director of the program to the administrator of APHIS, it will continue to  appear to have conflicts of interest in its oversight of APHIS-owned  laboratories.

In addition to these structural changes, the program has put mechanisms  in place to reduce organizational conflicts of interest, but the agencies do  not always follow a key mechanism. In particular, CDC and APHIS signed  a memorandum of understanding in 2012 that stated that APHIS would  provide the lead inspector for all inspections of registered laboratories  owned by CDC. However, in practice, CDC inspectors still participate in  inspection activities because of their expertise in human agents. In  March 2015, the memorandum was amended to state that CDC would  lead inspections of all USDA-owned laboratories.

However, since the memorandum was amended, the APHIS component  of the Select Agent Program has led at least three inspections of USDA- owned or operated laboratories. In particular, APHIS led an inspection of  a laboratory owned by another USDA agency, the Agricultural Research  Service, in November 2015; one run by the Agricultural Research Service  and APHIS scientists in May 2015; and one owned by APHIS in  December 2015. APHIS officials we interviewed said that they had  overlooked this amendment to the memorandum of understanding and  the program does not have a process in place to help ensure the  memorandum is followed. According to federal standards for internal  control, management should design control activities to achieve  objectives and respond to risk. Such internal control activities help  ensure that management directives such as those outlined in the  memorandum of understanding are carried out, and should be effective  and efficient in accomplishing the program’s control objectives. One  example of a control activity would be establishing a process to ensure  APHIS and CDC comply with the memorandum to help ensure APHIS  does not inspect its own laboratories. Without establishing control  activities to help ensure that each component of the program carries out  its inspection responsibilities as outlined in the program’s memorandum  of understanding, the Select Agent Program cannot have reasonable  assurance that its key mechanism to reduce conflicts of interest is  implemented.

Although the Select Agent Program has taken steps to help reduce  conflicts of interest, it has generally done so in response to concerns  raised by others. The program itself has not formally assessed all  potential risks posed by its current structure and the effectiveness of its mechanisms to address those risks. For example, the program did not  identify all of the areas noted above that may present conflicts of interest  and has not considered whether there may be additional areas of  concern. An expert in our meeting identified benefits of an independent,  third-party review of the Select Agent Program. For example, we and  other audit organizations are subject to an external peer review at least  once every 3 years that includes a review of documentation related to  independence, among other issues. According to senior program  officials we interviewed, the program as a whole has not engaged in  comprehensive risk management activities but they would be willing to do  so in the future.

OMB’s Circular A-123 requires federal agencies to integrate risk  management activities into their program management to help ensure  they are effectively managing risks that could affect the achievement of  agency objectives. According to the circular, once initial risks are  identified, it is important for agencies to regularly re-examine risks to  identify new risks or changes to existing risks. In addition, federal internal  control standards state that management should identify, analyze, and  respond to risks related to achieving defined objectives. Without  (1) regularly assessing the potential risks posed by the program’s current  structure and the effectiveness of its mechanisms to address them, such  as by commissioning external reviews, and (2) taking actions as  necessary to ensure any identified risks are addressed, the program may  not be aware of or effectively mitigate impairments to its independence  that could affect its ability to achieve its objectives.

Reviews May Not Target the Highest-Risk Activities

Ability to perform reviews  The organization should have the access and  working knowledge necessary to review  compliance with requirements.

According to our key elements of effective oversight, the organization  conducting oversight should have the ability to perform reviews, including  access to facilities and working knowledge necessary to review  compliance with requirements. The Select Agent Program performs  several types of reviews to ensure compliance with regulatory and  program requirements, including registration inspections for laboratories  seeking certification to use select agents, renewal inspections for  laboratories seeking to renew their registration, and verification  inspections. (See fig. 4 for additional information on these inspections).  The program has the ability to access any registered laboratory for  inspection, including without prior notification. Inspections typically  include review of registration and other documents—such as biological  safety and security plans and inventory and personnel training records— as well as physical inspections of laboratory workspace and interviews  with laboratory representatives, among other inspection activities. During  inspections, Select Agent Program inspectors go through checklists that  are based on the select agent regulations, the Biosafety in Microbiological  and Biomedical Laboratories manual, and guidelines from NIH. The  inspections cover a variety of topics—such as facility design and  operation, incident response, security, training, records management, and  biological safety—and may last anywhere from 1 day with 1 or 2  inspectors for simpler laboratories, to a couple of weeks with up to 10  inspectors for larger and more complex laboratories. Most laboratory  representatives we spoke with said that the inspectors generally had the  working knowledge necessary to review compliance and that the  inspections and resulting reports were in-depth and generally fair and  accurate.

However, the program may not target the highest-risk activities in its  inspections, in part because it has not formally assessed which activities  pose the highest risk to biological safety and security. According to  Select Agent Program officials, the program’s policy is to conduct at least  one verification inspection of all registered laboratories—regardless of  their past history or performance—between each 3-year renewal  inspection, and the program may consider additional inspections at  laboratories that pose a higher risk. Specifically, the program scores  laboratories’ risk based on a number of factors, such as past inspection  findings. However, a 2017 HHS OIG report found that the CDC  component of the Select Agent Program had evaluated some, but not all,  variables that could inform the risk a laboratory poses to health and safety  and concluded that CDC may wish to enhance its risk assessment by  considering additional factors, such as whether a laboratory has  previously reported losses or releases of a select agent, to better inform a  laboratory’s level of risk over time. In addition, some experts at our  meeting and laboratory representatives we interviewed raised concerns  that the program’s inspections do not target resources to the highest-risk  activities. For example, some experts said that the program has  historically not put enough emphasis on verifying that certain laboratory  procedures are safe and effective, which some said may have contributed  to high-profile incidents in 2014 and 2015 in which select agents were  inadvertently released from high-containment laboratories. However,  according to the Select Agent Program, the program does not validate or  verify laboratory procedures as it is the responsibility of the laboratories  themselves to do so. Further, many experts at our meeting and laboratory  representatives we interviewed raised concerns about the amount of time  inspectors spend assessing compliance with inventory controls (e.g., by  counting and examining vials containing select agents) and reviewing  inventory records during the inspection process, which takes time away  from inspecting other aspects of biological safety and security. Experts at  our meeting said that these activities do little to reduce the risk of theft of  select agents because samples could be clandestinely removed from  vials and replicated without being detected by the inventory controls  currently in place. Finally, other laboratory representatives told us that  activities to assess compliance with certain program requirements did  little to reduce risk and were unnecessarily burdensome, such as time- consuming reviews of records so that nicknames such as “Rob” match up  to registered names, such as “Robert.” These inspection activities are  generally intended to address biological security concerns, such as theft;  however, recent high-profile incidents at registered laboratories have  been related to biological safety rather than security, and no thefts have  been reported since 2003, when notification requirements were first  implemented, according to program officials and documents.

Experts at our meeting generally agreed that the Select Agent Program  has historically put more focus on security than on biological safety in its  reviews, given that the program was established in response to terrorist  incidents. For example, some experts said that the program has not  focused enough on ensuring the health and safety of researchers and  reducing the potential for their exposure to select agents, which some  noted are more likely to occur than thefts due to security issues. Many  experts questioned if the focus on security continues to be appropriate, in  light of recent biological safety incidents. According to senior APHIS  officials we interviewed, the Select Agent Program has been mandated to  focus on security and if they move the program’s focus too far from  security to biological safety, they may lose the goals established when the  program was formed. They also noted that, according to the select agent  regulations, laboratories are responsible for developing and implementing  a written biological safety plan, and therefore a balance should be  maintained between the laboratories’ execution of these plans and the  level of oversight from the Select Agent Program. In addition, these  officials stated that, during inspections, it is much easier for inspectors to  ensure laboratories are meeting security requirements than carrying out  their biological safety plans. For example, inspectors can easily check to  make sure laboratories have required security barriers in place, such as  locks on doors, but it is harder to measure whether laboratories are  carrying out laboratory procedures safely. They also noted that the  program does not want to be prescriptive with respect to biological safety  so that laboratories can implement those biological safety practices that  are most appropriate for their facility.

A 2015 internal review of the CDC component of the Select Agent  Program acknowledged uncertainties and gaps in understanding how  best to balance laboratories’ ability to conduct critical research using  select agents with the program’s need to ensure the safety and security of  the public and laboratory workers. The resulting report recommended  that the CDC and APHIS components of the program work together to  analyze inspection and investigation data to identify trends and  associations between inspection findings and risk and to improve the  inspection process. According to program officials we interviewed, the  Select Agent Program has not yet addressed the recommendation  because the program does not currently have adequate tools to do so.  They noted that the program is transitioning to a new database that will  enhance their ability to analyze program data to identify such trends and  associations and thereby guide improvements to the inspection process.  However, the program did not provide a plan for when or how the  program will carry out these analyses or use the information to improve  the inspection process. Federal internal control standards state that  management should identify, analyze, and respond to risks related to  achieving defined objectives. In addition, the Project Management  Institute’s Standard for Program Management calls for program  scheduling planning as a leading practice to ensure organizational  activities are completed. Without developing and implementing a plan to  identify which laboratory activities carry the highest biological safety and  security risks and to respond to those risks by aligning inspections and  other oversight efforts to target those activities, the Select Agent Program  will not have assurance that it is effectively balancing the potential safety  and security gains from its oversight efforts against the use of program  resources and the effect on laboratories’ research.

Select Agent Program Has Taken Steps to Hire Additional Expert Staff and Improve Technical Expertise, but Gaps in Workforce and Training Remain

According to our key elements of effective oversight, the organization  conducting oversight should have sufficient staff with the expertise to  perform sound safety and security assessments. CDC and APHIS have  hired additional staff for the program and improved training to enhance  expertise, but workforce and training gaps remain.

Technical expertise  The organization should have sufficient staff  with the expertise to perform sound safety and  security assessments.

The CDC and APHIS components of the Select Agent Program increased  the number of full-time federal inspectors in 2016 and 2017, but have  faced challenges in hiring and retaining sufficient staff with the requisite  expertise to perform the necessary work in a timely manner. According to  agency reports, agency officials, and laboratory representatives, Select  Agent Program inspectors are subject to a large workload with an  intensive travel schedule. Inspectors perform a variety of tasks, including  conducting on-site inspections of laboratories, developing written reports  of inspection results, processing requests for amendments to laboratory  registrations, and communicating program requirements to laboratory  representatives.

According to agency reports and inspectors we spoke with, inspectors  often travel 30 percent to 50 percent or more of their time in performing  their duties. This intensive workload and travel schedule has led to  delays in both the issuing of inspection reports and processing of  registration amendments. According to a 2017 CDC report, the time to  process CDC’s inspection reports in 2016 ranged from 4 to 224 business  days, with about 27 percent of reports exceeding the Select Agent  Program’s 30-day target for issuance. Workload issues were cited as  one of the key reasons for delays. A 2016 APHIS internal report also  identified delays in issuing inspection reports. According to the 2016  report, the time to process APHIS’s inspection reports in 2014 averaged  36 days, but some reports were issued more than 100 days from the date  the inspection concluded. Similarly, the processing time for amendments  to registrations, which the program has not routinely tracked in the past,  generally varies from a couple of weeks or months to approve simpler  amendments (such as personnel changes) to a year or more to approve  major changes to facilities (such as adding new laboratory space),  according to laboratory representatives. Delays in issuing inspection  reports or processing amendments may hamper the implementation of  corrective measures to address safety issues identified in inspections or  impede laboratories’ research on select agents, according to agency  reports and laboratory representatives. For example, representatives from  one laboratory told us that they lost grant funding because it took over a  year for the Select Agent Program to review and approve an amendment  to its registration to allow the proposed research to be conducted.

Workload issues have also created problems with retention, according to  agency documents and program officials we interviewed, and have  sometimes resulted in staff from the APHIS component of the Select  Agent Program being assigned responsibilities outside their areas of  expertise. For example, at the time of our review, an APHIS security  specialist was given the additional responsibility of conducting reviews not  related to his area of expertise, such as inspecting ventilation systems,  which are critical to ensuring select agents are not released into the  environment. According to the 2016 internal APHIS report, the APHIS  component of the program has historically struggled with resource  deficiencies and has had to implement strategies to fulfill its legal  mandates and meet basic goals and objectives within its limited  resources.

Both the CDC and APHIS components of the Select Agent Program have  individually taken steps to identify and address gaps in their workforce but  have not coordinated these actions to manage fragmentation across the  program. CDC developed a formal workforce plan for its component of  the Select Agent Program in 2016, identified and secured the necessary  resources to implement the plan, and is working to fill needed positions.  As of August 2017, the CDC component of the program had 7 vacancies  out of its 51 total inspector positions. APHIS also identified additional  needed positions, through development of its 5-year business plan, and  has used money from an APHIS contingency fund to fill them. APHIS  hired additional inspectors in 2016 and 2017 and now has 11 inspector  positions, up from 7 in 2015. APHIS also added several other new  positions in the first half of 2017, including a scientific officer, a security  manager, and a program analyst, among others.

However, according to program officials we interviewed, even with the  additional recently hired inspectors, the program may not have adequate  staff to handle surges in workload. For example, if there is a need to  respond to critical incidents similar to those that occurred at CDC and  DOD in 2014 and 2015, the program may find it challenging to respond  to those incidents in addition to meeting its annual inspection schedule.  Moreover, according to the 2016 APHIS internal review and CDC and  APHIS officials we interviewed, the complexity of laboratories that work  with select agents, the select agent regulations, and inspections have  continued to increase, which may continue to contribute to workload  issues in the future. Program officials we interviewed said they are  hopeful that the new database the program is implementing will allow the  program to gain efficiencies in amendment processing and other areas,  which may reduce workload issues in the future.

Training to Improve or Maintain Expertise  Most laboratory representatives we interviewed said that, in their  experience, Select Agent Program inspectors generally had appropriate  expertise to perform reviews. According to agency documents, the vast  majority of the program’s inspectors have advanced degrees, including  many inspectors from CDC with doctoral degrees in microbiology or  related fields and many inspectors from APHIS with doctoral degrees in  veterinary medicine. However, CDC and APHIS internal reviews from  2015 and 2016, respectively, as well as some laboratory  representatives we interviewed, identified some shortcomings and  inconsistencies in inspectors’ expertise and approach related to their  regulatory responsibilities. In particular, the reports found that inspectors  had inconsistent knowledge about the select agent regulations,  variabilities in skill level, and divergent approaches to inspections, both  within and across the two components of the Select Agent Program. In  addition, several laboratory representatives said that some inspectors  imposed requirements on laboratories that the inspectors considered to  be best practices rather than requirements of the select agent regulations  or items on inspection checklists.

Both CDC and APHIS officials in the program identified gaps in the  training available to maintain their expertise. CDC inspectors we  interviewed told us they need additional training opportunities to keep up  with scientific changes in the field, such as advances in laboratory  techniques and equipment. APHIS officials we interviewed also identified  areas where they need additional training, including in facilities and  engineering aspects of laboratories; decontamination; and new laboratory  techniques, technologies, and equipment. In addition, some APHIS  inspectors we interviewed said that they sometimes do not have the  necessary knowledge to effectively perform all aspects of inspections  and, in some cases, depend on inspectors from CDC to address gaps in  expertise. Relying on CDC inspectors when APHIS is inspecting CDC- owned laboratories raises conflict of interest concerns. Furthermore,  according to inspectors from both CDC and APHIS, they are rarely able to  attend external conferences or other external training because of their  intensive workload and travel schedules and because they must compete  for training funds with CDC or APHIS scientists who are not assigned to  the program. Priority is given to those scientists presenting information at  conferences, which Select Agent Program staff rarely do because their  inspection work is not the type of information shared at conferences,  according to program officials.

In response to these concerns, both the CDC and APHIS components of  the Select Agent Program have individually taken steps to improve  training for program staff, including inspectors, but have not always  coordinated steps to manage fragmentation across the program. For  example, in 2016, APHIS increased training opportunities for two  inspectors to better enable them to inspect BSL-4 laboratories. In  addition, CDC developed a training strategy that identified various areas  in its training program that needed improvement, including the need to  provide funding support for existing training activities and enhanced  professional development opportunities.

According to CDC’s training strategy, the complexity of the inspector  position and evolving science on select agents demand ongoing training  and professional development opportunities for staff. Among other  recommendations, the strategy identified the need for three additional full- time-equivalent positions in the training area—in addition to the one the  CDC component of the program currently has; as of August 2017, CDC  was in the process of hiring one additional training specialist. APHIS  has not developed a similar formal training strategy, but during the course  of our review, APHIS sought and received approval and funds to hire a  full-time training coordinator, which it was in the process of filling as of  July 2017. Because APHIS has not had a training coordinator dedicated  to the Select Agent Program in the past, the APHIS component of the  program has generally relied on CDC to address training needs, although  APHIS does provide its own training to its inspectors and has coordinated  with CDC to develop some training, according to APHIS officials. A senior  APHIS official noted that having its own training coordinator moving  forward will help ensure APHIS’s training needs are met, as animal  inspection needs have not explicitly been addressed in the past when  CDC has taken the lead on training.

Security Concerns Have Limited the Program’s Transparency

Transparency  The organization should provide access to key  information, as applicable, to those most  affected by operations.

According to our key elements of effective oversight, the organization  conducting oversight should provide access to key information, as  applicable, to those most affected by operations. Past White House and  other reports, as well as experts at our meeting, also emphasized the  importance of transparency, including the sharing of information on  incidents and lessons learned, in the Select Agent Program. However,  the program limits the information it shares about registered laboratories  and violations of the select agent regulations, mainly because of security  concerns. For example, the program does not disclose to the public or  other laboratories the locations of laboratories registered with the  program, the agents that laboratories work with, or details on violations of  select agent regulations.

The Select Agent Program has recently increased the transparency of  high-level laboratory and program information it shares with the public  and registered laboratories, partly in response to recent federal reports.  For example, in 2016, the Select Agent Program issued its first annual  public report on the program. The report provided a variety of  information, such as background information on the program, statistics  about registered laboratories, and aggregated information on the potential  losses and releases reported to the program. In 2015, the program  developed a mechanism for laboratories to request interpretation of the  select agent regulations from the program and has since published  several regulatory interpretations on its website. In addition, starting in summer 2016, the Select Agent Program worked with a nongovernmental  organization, the American Biological Safety Association International,  to develop an online forum for registered laboratories to share information  with one another, which laboratory representatives told us has been very  helpful. The Select Agent Program also held a workshop for responsible  officials from registered laboratories in December 2016 to disseminate  program information; the workshop also provided the opportunity for  attendees to interact. Many laboratory representatives told us that this  was very helpful, and some noted that they had not had an opportunity to  communicate and share lessons learned with responsible officials from  other registered laboratories in the past.

Even so, some experts, agency officials, and laboratory representatives  we interviewed said there needs to be more transparency to the public  about select agent research and incidents in order to increase public trust  concerning the activities conducted at high-containment laboratories. For  example, several laboratory representatives noted that the media has  incorrectly described their laboratories as conducting “bioterror” research,  when the research they conduct is to mitigate the consequences of a  bioterrorist attack—for example, by developing vaccines and other  measures to help diagnose, prevent, or treat exposure to or infection with  select agents. On the other hand, many laboratory representatives told us  that the program was already sharing an appropriate amount of  information with the public. According to officials from HHS and USDA,  this issue has been examined and discussed extensively within their  departments, partly in response to recent federal reports. CDC officials  pointed out that laboratories themselves could share additional  information about their select agent research and any incidents. For  example, the U.S. Army Medical Research Institute for Infectious  Diseases and the National Biodefense Analysis and Countermeasures  Center, both at Fort Detrick in Maryland, and the Galveston National  Laboratory in Galveston, Texas, voluntarily share information about their  select agent research and incidents with the public via their websites.

In addition, many laboratory representatives we interviewed said the  program needs to be more transparent for registered laboratories. In  particular, some said that it would be helpful for the program to share  more information among laboratories about select agent research and  incidents to enhance the sharing of lessons learned to improve biological  safety and security. According to experts at our meeting, it is important for  information, such as lessons learned from incidents, to be shared among  laboratories so that they can learn from one another’s experiences to  improve their own operations. Some laboratory representatives also  said that it would be helpful for the Select Agent Program to provide  additional guidance in certain areas, such as regarding the use and  storage of toxins. Federal internal control standards state that  management should internally and externally communicate the necessary  quality information to achieve the entity’s objectives. However, there is  no consensus about what additional information should be shared with  laboratories. Without determining what additional information about  laboratories’ use of select agents, incidents, and violations of the select  agent regulations is appropriate for the Select Agent Program to share  with registered laboratories, the program may be missing opportunities to  provide key information that ultimately could help improve biological  safety and security.

Program Has Authority to Enforce Compliance with Requirements and Is Working to Address Concerns about Clarity and Consistency of Enforcement Actions

According to our key elements of effective oversight, the organization  conducting oversight should have clear and sufficient authority to require  entities to achieve compliance with requirements. The Select Agent  Program has the authority to and takes a range of enforcement actions  for violations of the select agent regulations and is working to address  concerns about the clarity and consistency of enforcement actions. When  the Select Agent Program identifies a possible violation of the select  agent regulations, the program may take several types of compliance or  enforcement actions, as follows:

Administrative actions: The Select Agent Program can propose a  corrective action plan; suspend or revoke a registered laboratory’s  registration; or deny a laboratory’s application to possess, use, or  transfer select agents.

Referrals to HHS OIG or APHIS’s Investigative and Enforcement  Services: The Select Agent Program may refer violations to HHS OIG  or APHIS’s Investigative and Enforcement Services, both of which can  levy civil money penalties, issue a Notice of Violation letter, or close  the case.

Referral to the FBI: The Select Agent Program can refer possible  violations involving criminal negligence, criminal intent, or suspicious  activity or person to the FBI for further investigation. Criminal  enforcement may include imprisonment for up to 5 years, a fine, or  both.

The Select Agent Program has taken enforcement actions against  laboratories but did not always do so consistently or according to any  available criteria. The Select Agent Program has taken a range of  enforcement actions for violations of the select agent regulations— including suspending or revoking registrations or proposing corrective  action plans—as well as referring violations to HHS OIG or APHIS’s  Investigative and Enforcement Services for further investigation.

Following investigation, HHS OIG and APHIS’s Investigative and  Enforcement Services have taken other enforcement actions, including  levying civil money penalties and issuing Notice of Violation letters.  However, we previously found in 2016 that the Select Agent Program did  not consistently refer laboratories to investigative entities for violations of  the select agent regulations or enforce regulations related to incidents  involving incomplete inactivation, and we found that this appears to be  true beyond incidents involving incomplete inactivation as well. For  example, from 2003 through 2016, the program suspended or revoked 10  laboratories’ registrations in response to violations of the select agent  regulations, only 1 of which was a federal laboratory, and neither HHS  OIG nor APHIS’s Investigative and Enforcement Services have levied a  civil money penalty against a federal laboratory. Moreover, we  previously found that the program referred various laboratories to HHS  OIG for incidents involving incomplete inactivation but did not refer HHS  laboratories for two incidents in 2014. We recommended in 2016 that the  Select Agent Program develop and implement consistent criteria and  documentation requirements for referring laboratories to investigative  entities and enforcing regulations.

The Select Agent Program is taking steps to address such past concerns  about the need for greater consistency and clarity in enforcement actions  and implement our recommendation. In particular, in September 2017,  the program finalized a document that provides guidance on when to refer  laboratories for violations and options for enforcement. This document  categorizes regulatory departures along a spectrum of severity with  associated enforcement options, so that inspectors and laboratories have  a clear understanding of what to expect during and as a result of  inspections, regardless of which Select Agent Program component  conducts them. In addition, the CDC component of the program worked  with HHS OIG to develop criteria to guide referrals to OIG, which CDC  finalized and implemented in June 2017. APHIS is not developing a  similar document at this time because APHIS officials believe the  guidance on when to refer laboratories for violations and options for  enforcement actions described above provides sufficient guidance on  referrals for the Select Agent Program. The program’s development of  guidance with criteria is a positive step and the program continues to  develop associated documentation requirements for referring violations to  investigative entities and enforcing regulations, according to a senior  program official.

Select Agent Program Does Not Have Joint Strategic Planning Documents to Guide Oversight

As of August 2017, the Select Agent Program does not have joint  strategic planning documents to guide its shared oversight efforts across  CDC and APHIS. For example, the program does not have a joint  mission statement to collectively define what the program seeks to  accomplish through its oversight. It also does not yet have a strategic  plan, although it is taking steps to develop one. Agencies can use  strategic plans to set goals and identify performance measures for  gauging progress towards those goals. Strategic plans can also outline  how agencies plan to collaborate with each other to help achieve goals  and objectives, as well as describe the strategies and resources required  to achieve the goals and objectives.

Mission statements for the two  components of the Federal Select Agent  Program  The Centers for Disease Control and  Prevention’s (CDC) Division of Select Agents  and Toxins reduces the risks for thefts, losses,  and releases of biological agents by ensuring  regulated laboratories or importers are safe  and select agents are secure through its  monitoring of facilities and enforcement of  regulations.  The Animal and Plant Health Inspection  Service’s (APHIS) Agriculture Select Agent  Services is a team of Agriculture Health  Professionals dedicated to providing superior  customer service to safeguard the health of  domestic animals, plants, and their products  from agricultural biological agents and toxins.

Each component of the program has conducted some strategic  planning—each has an individual mission statement, some strategic  planning documents, and performance measures—but the components  differ in what they seek to achieve and how they measure the  effectiveness of their efforts. For example, according to CDC officials, in  the past, the CDC component has developed yearly strategic goals, such  as to improve regulatory oversight through inspections and the biological  safety and security of laboratories. In contrast, APHIS developed a 5-year  business plan for its component of the Select Agent Program in 2014,  which it updated in July 2017. In addition, it identified a number of annual  goals in 2015, 2016, and 2017, such as developing additional BSL-4  training and filling vacancies in existing and new positions. CDC’s and  APHIS’s performance measures also differ. For example, CDC has a  range of performance measures, such as tracking the number of  laboratory-acquired infections and the timeliness of inspection reports,  whereas APHIS’s performance measures address the number of thefts,  losses, and releases involving select agents and the processing of  amendments.

The Select Agent Program also does not have a joint workforce plan that  collectively identifies workforce and training needs to ensure the program  as a whole has the appropriate workforce with sufficient expertise to carry  out its responsibilities and that resources are being leveraged  appropriately across the two components of the program. According to  our past work, strategic workforce planning is an essential tool to help  agencies align their workforces with their current and emerging missions  and develop long-term strategies for acquiring, developing, and retaining  staff. Moreover, the Select Agent Program has not collectively  determined its training needs. The APHIS component of the program has  generally relied on CDC to help meet its ongoing training needs, as  noted, but we found through our review of CDC’s training strategy that it  did not specifically address APHIS’s training needs. According to program  officials, joint training provided in the past has not always explicitly  addressed animal inspection needs, as noted. Program officials noted  that the program has taken some steps to coordinate training, such as  holding joint inspector training and webinars.

Senior program officials told us that, even without joint strategic planning  documents, the CDC and APHIS components of the Select Agent  Program manage fragmentation by collaborating on many aspects of the  program, such as through maintaining frequent communication at the  director level. They also said that the program had not developed a joint  mission statement or strategic planning tools in the past because they  prioritized other efforts in recent years, including responding to incidents  that occurred in 2014 and 2015, addressing recommendations from  recent reports, and developing a new database for the Select Agent  Program. In addition, each component of the program has generally  focused on its own agency’s needs when conducting workforce planning.  One senior CDC official said that the Select Agent Program had always  been in “reactive mode” and noted that the program could improve its  oversight if it took a more strategic view.

During the course of our review, senior program officials told us that they  were taking steps to develop a joint strategic plan for the Select Agent  Program and, in August 2017, the program began soliciting bids from  contractors for the plan’s development. The statement of work for the  contract states that the contractor shall develop guiding principles for the  Select Agent Program along with a mission statement, strategic goals and  objectives, and performance measures, among other requirements.  However, the statement of work for the contract does not have any  requirements related to development of a joint workforce plan. We have  found in the past that agencies’ strategic workforce planning should be  clearly linked to the agency’s mission and long-term goals developed  during the strategic planning process. Developing a joint workforce plan  that assesses workforce and training needs for the program as a whole  would help the program to better manage fragmentation by improving  how it leverages resources to ensure all workforce and training needs are  met; this assessment should be done in conjunction with the development  of the strategic plan. Leveraging of resources is especially important  given fiscal constraints and the uneven level of resources across the two  components of the program.

Selected Countries and Regulatory Sectors Employ Other Approaches to Promote Effective Oversight

Selected countries and regulatory sectors employ approaches to promote  effective oversight that, in some cases, differ from those of the Select  Agent Program. For example, other countries and sectors have regulatory  bodies that are structurally independent from the entities they oversee,  take a risk-based approach to performing reviews, rely on scientists and  other laboratory personnel to have requisite technical expertise on the  pathogens and activities in their laboratories, share incident information  on their public websites, and have prosecutorial authority when incidents  occur.

Structural Independence of Oversight Bodies

Some countries and sectors we reviewed have regulatory bodies that are  structurally independent from the entities they oversee. For example,  Great Britain’s Health and Safety Executive, whose mission is to protect  worker and public health and safety and who oversees laboratories that  work with pathogens, is an independent central government agency,  according to officials. It has a chief executive accountable to the UK  government’s Department of Work and Pensions and a public-private  board composed of representatives from a range of industries, including  trade unions. Officials noted that this structure, an independent agency  with direct access to a departmental head, allows the Health and Safety  Executive to have control over defining its own budget and staffing needs.  According to officials from the Health and Safety Executive and laboratory  representatives we interviewed, one strength of this approach is that it  avoids potential organizational conflicts of interest because none of the  laboratories that the Health and Safety Executive oversees are part of the  same agency.

Great Britain’s Health and Safety Executive  The Health and Safety Executive is an  independent regulator in Great Britain whose  mission is to prevent death, injury, and illness  in the workplace. It was originally established  following a government review of the health  and safety system in the country in 1974.  One division within the Health and Safety  Executive—the Chemical, Explosives and  Microbiological Hazards Division—regulates  sectors that have the potential for low- probability, high-consequence incidents,  including work in high-containment  laboratories. It began overseeing laboratories  following a smallpox outbreak in 1978.  Great Britain reviewed the regulations for  animal pathogens and rewrote them to make  them more aligned with the human pathogen  and genetically modified organism frameworks  after a 2007 safety incident in which a Great  Britain laboratory inadvertently released foot  and mouth disease into the environment. The  Health and Safety Executive is responsible for  safety oversight of pathogens that present a  risk to human health as well as animal  pathogens.  A separate entity, the National Counter  Terrorism Security Office, is responsible for  security oversight of a subset of pathogens  that pose biological security concerns, similar  to the United States’ select agents. The Health  and Safety Executive and the National Counter  Terrorism Security Office work closely together  in providing oversight, according to officials.  As of July 2017, Great Britain had a total of  434 registered high-containment laboratories  across the government, academic, and private  sectors.

Some other regulatory sectors in the United States are also structurally  independent from regulated facilities as a mechanism to ensure  independence. For example, prior to the creation of NRC in 1974, the  U.S. Atomic Energy Commission was responsible for both promotion and  oversight of the nuclear industry. The Energy Reorganization Act of 1974  established NRC as a separate, independent entity. According to a  relevant Senate committee report, this was a response to growing  criticism that there was a basic conflict between the U.S. Atomic Energy  Commission’s regulation of the nuclear power industry and its  development and promotion of new technology for the industry.  Independence is one of NRC’s “Principles of Good Regulation” that the  commission seeks to follow in carrying out its regulatory activities.  NRC’s Office of Nuclear Reactor Regulation uses performance metrics  associated with these principles—including measures of the objectivity  and independence of its inspectors—to annually evaluate the  effectiveness of its Reactor Oversight Process in meeting its pre- established goals and intended outcomes. This office reports the results  of this analysis to NRC in an annual report on the self-assessment of the  Reactor Oversight Process.

Risk-Based Approaches to Performing Reviews

Other countries and sectors we reviewed have adopted risk-based  approaches to reviewing compliance with regulatory requirements. In  particular, regulators in some countries, including Great Britain and  Canada, apply a risk-based approach to target their reviews to  laboratories with a documented history of performance issues or those  conducting higher-risk activities. Great Britain’s Health and Safety  Executive prioritizes which laboratories to inspect during the year by  assessing the level of risk a specific laboratory or program may have on  worker or public health and safety or the environment, according to  officials. This assessment takes into consideration factors such as which  pathogens pose a greater risk, how these pathogens are used in the  laboratory, and the potential consequences of an incident. For example,  officials noted that a laboratory complex that works with many pathogens  that may pose a significant risk to the country—such as animal pathogens  that affect livestock and the food supply—may be subject to more  oversight and additional inspections from regulators, based on the  associated risk assessment, than a diagnostic laboratory that may  destroy samples after testing.

The Public Health Agency of Canada is  responsible for promoting and protecting the  health of Canadians through various public  health initiatives. It was established in 2004,  partly in response to an outbreak of severe  acute respiratory syndrome (SARS) in 2003,  when it became evident that Canada had no  legal requirements for domestic laboratories to  report information such as whether they were  working with SARS samples, and therefore  officials could not determine the potential  scope of the problem.   The agency sits under Canada’s Minister of  Health and its Centre for Biosecurity is  responsible for administering and enforcing  Canada’s Human Pathogens and Toxins Act to  oversee the safe and secure handling of  human pathogens and toxins. The act came  into full force in December 2015, following an  extensive consultation process with  stakeholders.   The Centre for Biosecurity has authority to  license and oversee laboratory activities  involving human pathogens and toxins, some  animal pathogens, and a subset of human  pathogens that have additional biological  security concerns.   Oversight responsibility for the other animal  pathogens rests with the Canadian Food  Inspection Agency.   As of June 2017, Canada had a total of 63  licensed high-containment laboratories across  the government, academic, and private  sectors.

Similarly, officials from the Public Health Agency of Canada’s Centre for  Biosecurity, whose mission is to protect the health and safety of the public  against the risks posed by human pathogens and toxins, stated that their  division for the oversight of laboratories that work with pathogens also  has a risk-based licensing and inspection scheme. Under this scheme,  the stringency of licensing and inspection requirements largely depends  on the pathogen’s risk level. In addition, the Public Health Agency of  Canada places different requirements on activities carried out in  laboratories depending on their sector (e.g., public health or research)  because it determined that activities in certain sectors present a higher  risk than others, with the research sector having the highest associated  risks. As such, the Public Health Agency of Canada places additional  requirements on research scientists conducting certain activities with  pathogens than it does with respect to personnel conducting activities in  other types of laboratories. For example, the agency requires research  scientists to develop and submit documentation that demonstrates a  reasonable plan to manage risk and promote compliance with  requirements. Officials noted that this approach helps the agency to  understand where best to focus its efforts to achieve the desired risk  mitigation results. According to officials from both Great Britain and  Canada, this risk-based approach helps the oversight bodies in both  countries focus their limited resources on laboratories they have identified  as having the highest risks.

In addition, Great Britain’s Health and Safety Executive and the Public  Health Agency of Canada apply a risk-based approach in determining the  focus of their inspections. For example, according to agency officials in  Great Britain and Canada, because they have not found stringent  inventory requirements to be effective in reducing biological safety risks in  the laboratory, neither country places as much focus, time, or resources  on inventory management as the Select Agent Program does. For  example, neither country spends time during every inspection counting  and examining vials and comparing them to inventory logs, according to  officials. Instead, Great Britain’s Health and Safety Executive’s approach  is to sample laboratories’ biological safety measures and assess whether  they have mechanisms in place to mitigate the consequences of incidents  should they occur. Similarly, in Canada, the Canadian Biosafety Standard  requires that laboratories working with pathogens in high-containment  have an inventory tracking system that is based on the risks internally  identified by the laboratory, in order to allow for timely identification of  missing vials if necessary.

In addition to having less prescriptive inventory requirements than the  Select Agent Program, both Great Britain’s Health and Safety Executive  and the Public Health Agency of Canada generally focus their  oversight on (1) biological safety, and (2) regulation of all potentially  hazardous pathogens in laboratories. In contrast, the Select Agent  Program originated from security-related concerns and regulates only  those pathogens identified on the U.S. select agent list and no other  pathogens, such as West Nile virus, that may be handled in high- containment but are not select agents. In both Great Britain and Canada,  specific biological safety incidents provided the impetus for establishing  oversight for laboratories that work with pathogens and, as a result, their  regulatory agencies generally focus on biological safety. Both Great  Britain and Canada have additional oversight requirements, such as  security clearances for personnel, for a limited number of pathogens for  which they have heightened security concerns, similar to the security  requirements for working with select agents in the U.S. For example, in  Great Britain, the Health and Safety Executive focuses on only biological  safety in its oversight of high-containment laboratories and works with the  National Counter Terrorism Security Office for oversight of pathogens  with biological security concerns. In addition, to ensure compliance with  biological safety regulations, officials we interviewed in Great Britain and  Canada told us it was beneficial for their programs to have oversight over  all hazardous pathogens that present biological safety risks to laboratory  workers and the public, regardless of their containment level and their  potential to pose biological security concerns. For example, the Public  Health Agency of Canada regulates any pathogens with characteristics  that require handling in laboratories equivalent to U.S. BSL-2, -3, or -4,  which currently covers thousands of pathogens, according to officials, as  opposed to the 66 agents on the U.S.’s select agent list.

NRC also considers risk in its oversight of nuclear reactors, fuel cycle  facilities, and radioactive materials. In particular, for facilities that work  with nuclear materials, NRC conducts inspections of a fraction of these  facilities each year because, according to officials, there is a lower risk  associated with nuclear materials than there is with nuclear power plants.  There are no resident inspectors at these facilities; instead, the frequency  of inspections for nuclear materials is based on the risk associated with,  among other things, the specific material and each facility’s past  performance. Sites with past issues will receive more attention, while  sites with a history of good performance will generally be subject to the  minimum frequency of inspections applicable to that type of site. In  contrast, as part of its Reactor Oversight Process, NRC places at least  two resident inspectors at each of the country’s commercial nuclear  power plants because they pose a higher risk. For nuclear power plants,  potential incidents can have high-consequences and far-reaching effects,  such as the effects of the 2011 nuclear accident at the Fukushima Daiichi  reactor in Japan. To ensure that each nuclear power plant is complying  with federal safety requirements, these inspectors oversee a variety of  activities on a daily basis, including by visiting control rooms, reviewing  logbooks, performing visual assessments, and observing tests and  repairs.

Drawing on Technical Expertise of Advisory Panels and Laboratories

Other countries have adopted various approaches to help ensure they  have access to individuals with the appropriate expertise to perform  sound safety and security assessments. According to officials in Great  Britain, regulators at the Health and Safety Executive have access to  external expert advisory committees to advise on issues related to new or  emerging pathogens, diseases, or other scientific issues that inspectors  may encounter during inspections or when developing policy. Health and  Safety Executive officials noted that they generally go to the committees  with questions of science and not regulation, as the inspectors are  expected to be experts in biological safety and Great Britain regulations.  Both France and Germany also have expert advisory committees that  regulators can consult on scientific and technical issues, according to  officials from these countries.

Merging Oversight of Human and Animal  Pathogens in Great Britain and Canada  Great Britain merged the inspection and  oversight responsibilities for human and  animal pathogens into one oversight body, the  Health and Safety Executive, in 2008,  following the 2007 accidental release of foot  and mouth disease into the environment.  Oversight of animal pathogens was originally  under the United Kingdom’s Department for  Environment, Food, and Rural Affairs  (DEFRA). When oversight of animal  pathogens was first transferred to the Health  and Safety Executive, DEFRA initially retained  the licensing of sites with animal pathogens. In  2015, DEFRA transferred all oversight  responsibilities, including licensing, to the  Health and Safety Executive, but retained  responsibilities for policy matters. According to  agency officials and laboratory representatives  in Great Britain, this change had a number of  benefits, including creating a single agency  contact for laboratories that work with  regulated pathogens, strengthening the  oversight of animal pathogens, and  improving  the logistics and ease of the system.   Similarly, in 2013, Canada transferred the  oversight responsibility for a subset of animal  pathogens from the Canadian Food Inspection  Agency (CFIA) to the Public Health Agency of  Canada to strengthen and harmonize its  biological safety oversight framework and  reduce the regulatory and administrative  burden on researchers and laboratory officials.  CFIA continues to issue permits for other  animal pathogens, such as emerging animal  diseases, which, according to officials, only  make up a small number of pathogens.

Officials from the Public Health Agency of Canada noted that they  address the issue of technical expertise in part by placing substantial  responsibility on the scientists and other personnel in each laboratory to  understand and address the risks associated with their specific work,  such as the equipment and procedures used in that laboratory. Officials  from the Public Health Agency of Canada noted that personnel working in  licensed laboratories are the ones most at risk if a safety lapse or other  incident occurs, so the agency expects the responsible individuals at the  laboratories to reinforce the requirements and help ensure everyone  works safely and is in compliance with requirements. Under this  approach, the main responsibility is with the laboratory officials to  understand and manage the risks inherent in the work being performed at  their facility, while the role of the inspector is to verify that they have taken  appropriate steps to identify and address the risks.

According to officials in the Netherlands, regulators place responsibility  for laboratory biological safety on biological safety officers at each of the  laboratories by accrediting them for the oversight of biological safety.  Regulators conduct the accreditation process, which includes a review of  personnel credentials, before individuals can be accredited. A 2-day  course on the laws—such as details of biological safety requirements,  case studies, review of transportation rules, and incident examples—is  offered to each new accredited biological safety officer. Biological safety  officers usually first seek accreditation for the equivalent of U.S. BSL-1 or  -2 laboratories and must request additional reviews to receive  accreditation for higher levels after acquiring the requisite knowledge and  applied laboratory experience for the levels for which they are requesting  accreditation. Officials from the Netherlands noted that it is important to  have biological safety officers in laboratories as these individuals are  versed in biological safety and can convey to researchers what they  should be doing to ensure safety, as the regulator cannot be on-site every  day.

Transparency through Sharing Information on Agency Websites and Other Means

Some countries and regulatory sectors have approaches that provide  transparency to entities and the public in a number of ways. For example,  in Great Britain, the Health and Safety Executive shares information on  licensing, enforcement actions, and prosecutions, among other  information, through its website and the public register. Health and Safety  Executive officials noted that the agency also issues information to  licensed laboratories when there are safety alerts, lessons learned, or key  decisions that it feels are pertinent to the regulated community. However,  officials limit the sharing of any information that is sensitive or has  security concerns, such as the names of individuals cleared to work with  pathogens, which poses additional security concerns. Regulators in the  Netherlands stated that they are also authorized to share a great deal of  information related to some regulated pathogens, such as laboratory risk  assessments, with the public and individuals who request the information.  Similarly, in Switzerland, the public can request some information about  laboratory licenses and the types of activities that occur at laboratories,  but regulators do not share information on laboratory exposures because,  according to a Swiss official, the public is not generally affected by them  so the officials do not feel a need to share such information.

NRC shares safety-related information on nuclear facilities with the public,  including by posting the locations of nuclear facilities, inspection reports,  and policies on its website. According to NRC officials, NRC believes  transparency is important because, otherwise, secrecy can lead to  distrust and negatively affect NRC’s relationship with industry and the  public. In addition, NRC has written policies available on its website that  detail what information it shares with registered facilities and the public,  as well as guidance for NRC staff on what they can and cannot share.

NRC officials stated that NRC strives for a balance between openness  and security and that, because the nuclear sector’s needs and the  public’s concerns are constantly changing, it is important to reassess  policies as the necessity arises. For example, after the September 11,  2001, terrorist attacks, NRC decided to remove some information from  the public sphere in response to concerns that such information could be  misused and exploited for future terrorist attacks.

The Federal Aviation Administration also shares information with the  public through its Aviation Safety Information Analysis and Sharing  System, which collects information from multiple databases, including  voluntarily reported near-miss data and accident information. This system  is intended to promote an open exchange of safety information to  continuously improve aviation safety, and it allows users to perform  integrated queries, search safety data, and review incident investigations  conducted by the National Transportation Safety Board. For example,  analysts from the Federal Aviation Administration analyzed data from the  Aviation Safety Information Analysis and Sharing System to determine  which weather-related factors posed the biggest threats to pilots and  aircraft. In addition, the Federal Aviation Administration provides public  access to a library of lessons learned from historically significant, policy- shaping accidents to share key knowledge across the industry to improve  aviation safety through the application of such lessons and to understand  how the current safety regime has been influenced by past accidents. For  example, the library discusses how two similar high-terrain crashes in the  1990s led to a requirement in 2000 to install a warning system in aircraft  to reduce the incidence of such terrain accidents.

Mechanisms of Enforcement and Nonpunitive Reporting Systems

Countries and regulatory sectors we reviewed employ a range of  mechanisms to take enforcement actions against entities or to encourage  incident reporting. For example, Great Britain, Canada, France, and  Switzerland all have the ability to pursue criminal prosecution in response  to serious violations of their laws or regulations governing high- containment laboratories, in addition to the ability to suspend work or shut  down laboratories. In Canada, penalties for the most serious violations  can include up to 10 years in prison. Officials from the Public Health  Agency of Canada and representatives from laboratories we spoke with  noted that laboratory personnel are still encouraged to report incidents in  laboratories, such as laboratory-acquired infections, regardless of the  potentially heavy penalties, because certain information that is voluntarily  provided during the course of an incident cannot then be used in any  subsequent criminal proceedings against that individual. In addition,  experts from our meeting noted that the nonpunitive nature of airline  reporting systems also encourages people to report incidents, which in  turn provides valuable information to regulators, pilots, airlines, and the  public that has been used to improve airline safety, as noted.

In their joint management of the Select Agent Program, CDC and APHIS  share a critical role in ensuring that important research on select agents  can be conducted in high-containment laboratories in a safe and secure  manner. This role is especially important given the significant risks that  pathogens handled in high-containment laboratories may pose to  laboratory workers and the public. The Select Agent Program has made a  number of improvements over the past few years, such as hiring  additional staff and sharing more information with the public and  registered laboratories. Nevertheless, the program does not fully meet all  key elements of effective oversight. For example, the program is not  independent in that it is not structurally distinct and separate from all of  the laboratories it oversees. Both CDC and APHIS have individually made  structural changes and put mechanisms in place to reduce conflicts of  interest, but the APHIS component of the program has not documented  the reporting process it developed to reduce conflicts of interest. Until  APHIS formally documents the reporting structure for its component of  the program from the APHIS director of the program to the administrator  of APHIS, it will continue to appear to have conflicts of interest in its  oversight of APHIS-owned laboratories. Moreover, APHIS has, on at least  three occasions, inspected its own or other USDA laboratories, which is  not in keeping with the memorandum of understanding it signed with the  CDC component of the program. Without establishing control activities to  help ensure that each component of the program carries out its inspection  responsibilities as outlined in the program’s memorandum of  understanding, the Select Agent Program cannot have reasonable  assurance that its key mechanism to reduce conflicts of interest is  implemented.

In addition, the program has not formally assessed all potential risks  posed by its current structure and the effectiveness of its mechanisms to  address those risks. For example, the program did not identify some  areas that may present conflicts of interest, such as APHIS carrying out  inspections of its own laboratories, and has not considered whether there  may be additional areas of concern. Without (1) regularly assessing the  potential risks posed by the program’s current structure and the  effectiveness of its mechanisms to address them, such as by  commissioning external reviews, and (2) taking actions as necessary to  ensure any identified risks are addressed, the program may not be aware  of or effectively mitigate impairments to its independence that could affect  its ability to achieve its objectives.

Further, regarding the ability to perform reviews, the program may not be  targeting the highest-risk laboratory activities in its inspections and other  oversight efforts. Without developing and implementing a plan to identify  which laboratory activities carry the highest biological safety and security  risks and to respond to those risks by aligning inspections and other  oversight efforts to target those activities, the program will not have  assurance that it is effectively balancing the potential safety and security  gains from its oversight efforts against the use of program resources and  the effect on laboratories’ research. Moreover, the program is not fully  transparent because it shares only limited information about lessons  learned and other matters with registered laboratories, and there is no  consensus about what additional information should be shared. Without  determining what additional information about laboratories’ use of select  agents, incidents, and violations of the select agent regulations is  appropriate for the Select Agent Program to share with registered  laboratories, the program may be missing opportunities to provide key  information that ultimately could help improve biological safety and  security. In addition, the program has not had clarity and consistency in  its enforcement actions and is taking steps to address our past  recommendation.

Further, regarding technical expertise, the two components of the Select  Agent Program have individually hired additional staff for the program and  improved training to enhance expertise, but workforce and training gaps  remain. Although the program has begun to take steps towards  development of a joint strategic plan to collectively guide oversight efforts,  it does not have a joint workforce plan. Developing a joint workforce plan  that assesses workforce and training needs for the program as a whole  would help the program to better manage fragmentation by improving  how it leverages resources to ensure all workforce and training needs are  met; this assessment should be done in conjunction with the development  of the strategic plan. Leveraging of resources is especially important  given fiscal constraints and the uneven level of resources across the two  components of the program.

We are making 11 recommendations to the agencies that manage the  Select Agent Program, including 6 to APHIS and 5 to CDC:  To improve independence, the Administrator of APHIS should formally  document the reporting structure for the APHIS component of the Select  Agent Program from the APHIS director of the program to the  Administrator of APHIS. (Recommendation 1)

To improve independence, the CDC director of the Select Agent Program  should work with APHIS to establish control activities to help ensure that  each component of the program carries out its inspection responsibilities  as outlined in the program’s memorandum of understanding.  (Recommendation 2)

To improve independence, the APHIS director of the Select Agent  Program should work with CDC to establish control activities to help  ensure that each component of the program carries out its inspection  responsibilities as outlined in the program’s memorandum of  understanding. (Recommendation 3)

To improve independence, the CDC director of the Select Agent Program  should regularly assess the potential risks posed by the program’s  structure and the effectiveness of its mechanisms to address those risks,  such as by commissioning external reviews, and take actions as  necessary to ensure that any identified risks are addressed so that  impairments to independence do not affect its ability to achieve its  objectives. (Recommendation 4)

To improve independence, the APHIS director of the Select Agent  Program should regularly assess the potential risks posed by the  program’s structure and the effectiveness of its mechanisms to address  those risks, such as by commissioning external reviews, and take actions  as necessary to ensure any identified risks are addressed so that  impairments to independence do not affect its ability to achieve its  objectives. (Recommendation 5)

To improve the ability to perform reviews, the CDC director of the Select  Agent Program should work with APHIS to develop and implement a plan  to identify which laboratory activities carry the highest biological safety  and security risks and to respond to those risks by aligning inspections  and other oversight efforts to target those activities. (Recommendation 6)

To improve the ability to perform reviews, the APHIS director of the Select  Agent Program should work with CDC to develop and implement a plan to  identify which laboratory activities carry the highest biological safety and  security risks and to respond to those risks by aligning inspections and  other oversight efforts to target those activities. (Recommendation 7)

To improve transparency, the CDC director of the Select Agent Program  should work with APHIS to determine what additional information about  laboratories’ use of select agents, incidents, and violations of the select  agent regulations is appropriate for the program to share with registered  laboratories. (Recommendation 8)

To improve transparency, the APHIS director of the Select Agent  Program should work with CDC to determine what additional information  about laboratories’ use of select agents, incidents, and violations of the  select agent regulations is appropriate for the program to share with  registered laboratories. (Recommendation 9)

To improve technical expertise and overcome fragmentation, the CDC  director of the Select Agent Program should work with APHIS to develop  a joint workforce plan that assesses workforce and training needs for the  program as a whole. This assessment should be done in conjunction with  the development of the strategic plan. (Recommendation 10)

To improve technical expertise and overcome fragmentation, the APHIS  director of the Select Agent Program should work with CDC to develop a  joint workforce plan that assesses workforce and training needs for the  program as a whole. This assessment should be done in conjunction with  the development of the strategic plan. (Recommendation 11)

We provided a draft of this report for review and comment to DOD, HHS,  the Department of Homeland Security, NRC, the Department of  Transportation, and USDA. We also provided copies to officials from  Great Britain, Canada, and the Netherlands, as well as experts who  participated in our expert meeting at the National Academy of Sciences.

HHS and USDA—the agencies to whose components our  recommendations are directed—both provided written comments  agreeing with all of our recommendations. These comments are reprinted  in appendixes III and IV, respectively. In their comments, HHS and USDA  provided additional information about steps they are taking, or planning to  take, to improve their oversight of select agents and to address our  recommendations. For example, HHS and USDA stated that the Select  Agent Program will explore options to improve independence, including  reexamining previous reviews and assessing the need for additional  reviews to ensure potential risks posed by the program’s structure are  adequately assessed and addressed. In addition, to improve the ability to  perform reviews, HHS and USDA stated that the Select Agent Program is  transitioning to a new secure information system that will allow the  program to develop analytical tools and procedures to analyze risk- related data to improve the inspection process. Further, to enhance  transparency, HHS and USDA said the program is exploring ways to  disseminate information regarding common deficiencies identified during  inspections. Finally, to improve technical expertise and overcome  fragmentation, HHS and USDA said that the program has initiated  contract support for development of a joint strategic plan that will include  the assessment of workforce and training needs.

HHS and USDA also provided technical comments, as did the  Department of Homeland Security; officials from Great Britain, Canada,  and the Netherlands; and a number of experts who participated in our  expert meeting at the National Academy of Sciences. We incorporated  these comments as appropriate. DOD, NRC, and the Department of  Transportation did not comment on this report.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the appropriate  congressional committees; the Secretaries of Agriculture, Defense,  Health and Human Services, Homeland Security, and Transportation; the  Chairman of NRC; the Director of CDC; the Administrator of APHIS; and  other interested parties. In addition, the report will be available at no  charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  Timothy M. Persons, Chief Scientist, at (202) 512-6412 or  personst@gao.gov or John Neumann, Director, Natural Resources and  Environment, at (202) 512-3841 or neumannj@gao.gov. Contact points  for our Offices of Congressional Relations and Public Affairs may be  found on the last page of this report. GAO staff who made key  contributions to this report are listed in appendix V.

Appendix I: Key Elements of Effective Oversight

This appendix describes the steps we took to confirm the applicability of  five elements of effective oversight we have used in the past for our  evaluation of the Federal Select Agent Program (Select Agent Program).  We have used these key elements in the past for assessing the  effectiveness of oversight in other areas where low probability adverse  events can have significant and far-reaching effects. These elements are  as follows:  Independence: The organization conducting oversight should be  structurally distinct and separate from the entities it oversees.

Ability to perform reviews: The organization should have the access  and working knowledge necessary to review compliance with  requirements.

Technical expertise: The organization should have sufficient staff  with the expertise to perform sound safety and security assessments.

Transparency: The organization should provide access to key  information, as applicable, to those most affected by operations.

Enforcement authority: The organization should have clear and  sufficient authority to require that entities achieve compliance with  requirements.

We took several steps to confirm the applicability of these elements for  our examination of the Select Agent Program. First, we discussed the  applicability of the criteria with senior officials from both components of  the Select Agent Program, within the Centers for Disease Control and  Prevention (CDC) and the Animal and Plant Health Inspection Service  (APHIS). Second, we discussed the elements with representatives from  the American Society of Microbiology and American Biological Safety  Association International, which were selected because of their focus on  microbiology and biological safety, respectively. Finally, we discussed  the elements with experts during our National Academy of Sciences  meeting (see app. II for information on this meeting). The officials,  representatives, and experts generally agreed that the five elements were  appropriate for our examination of the Select Agent Program. We  compared information from federal documents about the Select Agent  Program’s oversight, interviews with laboratory representatives and  agency officials, and our expert meeting against the five elements of  effective oversight.

Appendix II: List of Experts and Selection Methodology

• Bob Buchanan, Ph.D., Professor and Director of Center for Food Safety and

Security Systems, University of Maryland

Andrew Cottam, Ph.D., Head of the Microbiology and Biotechnology Unit, Health  and Safety Executive, United Kingdom  John Eakin, Principal Investigator, Air Data Research

David Franz, DVM and Ph.D., Former Commander, United States Army Medical  Research Institute for Infectious Diseases

Gigi Kwik Gronvall, Ph.D., Senior Associate, Johns Hopkins Center for Health

Marianne Heisz, Ph.D., Director, Office of Biosafety Programs and Planning,  Public Health Agency of Canada

Ruthanne Huising, Ph.D., Associate Professor, McGill University

Gavin Huntley-Fenner, Ph.D., Principal Consultant, Huntley-Fenner Advisors  Joseph Kanabrocki, Ph.D. and NRCM(SM), Associate Vice-President for  Research Safety, Professor of Microbiology, University of Chicago

Paul Keim, Ph.D., Regents Professor and Cowden Chair, Northern Arizona  James LeDuc, Ph.D., Director, Galveston National Laboratory, University of  Texas Medical Branch

Carol Linden, Ph.D., Director, Office of Regulatory Science and Innovation, Food

Allison MacFarlane, Ph.D., Professor and Director, Center for International  Science and Technology Policy, George Washington University

Brian O’Shea, Ph.D., Senior Biological Safety Officer, Battelle Memorial Institute

Karlene Roberts, Ph.D., Professor Emeritus, Haas School of Business, University  Jonathan Rosen, Principal Industrial Hygiene Safety and Health Consultant, AJ  Rosen and Associates, LLC  The comments of these experts generally represented the views of the experts  themselves and not the agency, university, or company with which they are affiliated.

The meeting with these experts was held at NAS in January 2017. To identify  experts to participate in the meeting, we worked iteratively with NAS staff to identify  and review biographical information and relevant qualifications of experts, as well as  factors such as representation from academia, industry, and federal government and  expertise in a range of areas. The Board on Life Sciences of NAS solicited  nominations for the expert panel from its extensive contacts in laboratory safety,  biological security, and other regulatory sectors, such as occupational safety and  health, airline safety, food safety, and chemical safety. These contacts included  current and former committee members, current and former members of the Board  on Life Sciences, and select members of NAS. NAS received responses from  approximately 45 nominees. From this initial list, NAS selected experts based on  their knowledge and expertise in the above-mentioned areas as well as their ability to  attend the meeting on the chosen dates and obtained our approval of its selections.  In order to facilitate discussion among participants, NAS did not include any federal  employees or contractors of the Select Agent Program. The final list of 18 experts  was then evaluated for any conflicts of interest. A conflict of interest was considered  to be any current or financial or other interest that might conflict with the service of an  individual because it (1) could impair objectivity and (2) could create an unfair  competitive advantage for any person or organization. The 18 experts were  determined to be free of conflicts of interest, and the group as a whole was judged to  have no inappropriate biases.

We developed the session topics for the 2-day meeting based on our researchable  objectives and issues that we identified in our audit work, including our analysis of  agency documents and interviews with agency officials and representatives from  registered laboratories. The meeting was recorded and transcribed to ensure that we  accurately captured the experts’ statements, and we reviewed and analyzed the  transcripts as a source of evidence. Although the expert meeting was not designed  to reach formal consensus on the issues, a number of themes emerged from the  group’s discussion to which there was general agreement.

Appendix III: Comments from the Department of Health and Human Services

Appendix IV: Comments from the Department of Agriculture

Appendix V: GAO Contacts and Staff Acknowledgments

In addition to the individuals named above, Mary Denigan-Macauley  (Assistant Director), Sushil Sharma (Assistant Director), Amy Bowser,  William Carrigg, Marcia Crosse, Caitlin Dardenne, Shana Deitch, Karen  Doran, Jack Melling, Cynthia Norris, Lesley Rinner, Sara Sullivan, Walter  Vance, and Elizabeth Wood made key contributions to this report.

Laboratories conduct research on hazardous pathogens—such as Ebola virus or anthrax bacteria—in more than 200 labs in the United States. Safety lapses continue to occur at some of these labs, raising concerns about whether oversight is effective.

We looked at the Federal Select Agent Program, which is responsible for overseeing these labs, and found room for improvement. For example, the program allows some agencies to oversee their own labs, which could potentially lead to conflicts of interest. We recommended 11 actions to improve oversight.