This is the accessible text file for GAO report number GAO-06-206 entitled 'Homeland Security: DHS Needs to Improve Ethics-Related Management Controls for the Science and Technology Directorate' which was released on December 22, 2005. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Report to the Ranking Minority Member, Committee on Homeland Security and Governmental Affairs, United States Senate: December 2005: Homeland Security: DHS Needs to Improve Ethics-Related Management Controls for the Science and Technology Directorate: [Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-06-206]: GAO Highlights: Highlights of GAO-06-206, a report to the Ranking Minority Member, Committee on Homeland Security and Governmental Affairs,: United States Senate: Why GAO Did This Study: The Department of Homeland Security’s (DHS) Science and Technology (S&T) Directorate was established to focus on areas such as addressing countermeasures for biological threats. To do this, it hired experts from the national laboratories under the authority of the Intergovernmental Personnel Act (IPA). The Directorate is organized into portfolios, led by portfolio managers. Questions have been raised about potential conflicts of interest for these individuals, since a portion of the Directorate’s research funds have gone to the national laboratories. GAO was asked to examine (1) the management controls established within the Directorate to help guard against conflicts of interest for IPA portfolio managers; and (2) the role of the IPA portfolio managers, particularly those from national laboratories, in determining where research and development projects were directed. What GAO Found: DHS’s S&T Directorate is working to improve its management controls to help guard against conflicts of interest for its IPA portfolio managers, but it can do more. In the first few years of DHS’s existence, the S&T Directorate focused on the urgency of organizing itself to meet the nation’s homeland security research and development requirements, and had few resources devoted to developing its management infrastructure, including the management controls to guard against conflicts of interest. In the past year, steps have been taken to improve these controls. For example, in June 2005, DHS implemented a new process for hiring IPA employees. Although the S&T Directorate is taking steps to improve its ethics-related management controls, several conditions still need to be addressed to better ensure that its IPA portfolio managers comply with the conflict of interest laws. First, the process for determining where research and development projects and funds are directed, including the role of the IPA portfolio managers, has never been finalized. Second, the S&T Directorate does not require documentation of how determinations are made about where research and development projects and funds are directed. Third, S&T Directorate officials are only now seeking waivers, where appropriate, and considering whether to take other actions that would allow IPA portfolio managers to participate in certain matters. Finally, DHS officials told us that S&T Directorate employees, including those hired under the IPA, are offered the same new employee and annual ethics training as are all DHS employees. However, employees hired under the IPA do not receive regular training that addresses their unique situation; namely that they have an agreement for future employment with an entity that may benefit from the S&T Directorate’s funding. The role of the IPA portfolio managers, five of whom came from the national laboratories, in determining where research and development projects and associated funds were directed was unclear. This was due to several factors. First, as previously discussed, the S&T Directorate has never finalized a standard process for determining where research and development projects and funds are directed, or the decision-making role of the IPA portfolio managers within such a process. Second, the extent of the IPA portfolio managers’ participation in making these determinations was unclear because there was no documentary evidence of how these determinations were actually made. Third, the testimonial evidence on the extent of the IPA portfolio managers’ involvement was inconsistent and, at times, vague. Because we could not determine whether or not the IPA portfolio managers participated “personally and substantially” in the decision-making process, which is precluded by 18 U.S.C. § 208, GAO contacted the Acting Director of the Office of Government Ethics (OGE) in September 2005. GAO suggested that OGE review this matter further in conjunction with its planned ethics program review of DHS. In December 2005, OGE officials told us that they plan to examine, among other matters, the transparency and accountability issues in DHS’s ethics program raised by our findings. What GAO Recommends: To improve the S&T Directorate’s ethics-related management controls, GAO recommends that DHS take several related actions to help ensure that IPA portfolio managers comply with conflicts of interest laws. DHS concurred with our recommendations, and noted several actions they plan to take. If implemented effectively, these actions would be responsive to some of our recommendations. www.gao.gov/cgi-bin/getrpt?GAO-06-206. To view the full product, including the scope and methodology, click on the link above. For more information, contact George H. Stalcup at (202) 512-6806 or stalcupg@gao.gov. [End of section] Contents: Letter: Results in Brief: Background: DHS's S&T Directorate Can Do More to Improve Its Management Controls Related to Conflicts of Interest for Its IPA Portfolio Managers: IPA Portfolio Managers' Role in Determining Where R&D Projects and Funds Were Directed Was Unclear: Conclusions: Recommendations for Executive Action: Agency Comments and Our Evaluation: Appendixes: Appendix I: DHS Research and Development Funding Distribution in Fiscal Year 2004: Appendix II: Scope and Methodology: Appendix III: Comments from the Department of Homeland Security: Figures: Figure 1: The S&T Directorate's Offices and Overview of Their Functions: Figure 2: The S&T Directorate's R&D Funding Obligations in Fiscal Year 2004: Abbreviations: BTS: Border and Transportation Security: DAEO: Designated Agency Ethics Officer: DHS: Department of Homeland Security: DOE: Department of Energy: ERB: Executive Review Board: FFRDC: Federally Funded Research and Development Center: HSARPA: Homeland Security Advanced Research Projects Agency: IPT: Integrated Project Team: IPA: Intergovernmental Personnel Act: OGC: Office of General Counsel: OGE: Office of Government Ethics: OPM: Office of Personnel Management: ORD: Office of Research and Development: PPB: Office of Programs, Plans, and Budgets: R&D: Research and Development: SED: Systems Engineering and Development: S&T: Science and Technology: Letter December 22, 2005: The Honorable Joseph I. Lieberman: Ranking Minority Member: Committee on Homeland Security and Governmental Affairs: United States Senate: Dear Senator Lieberman: The Department of Homeland Security's (DHS) Science and Technology (S&T) Directorate was established by the Homeland Security Act of 2002[Footnote 1] to coordinate the federal government's civilian efforts to identify and develop countermeasures to chemical, biological, radiological, nuclear, and other emerging terrorist threats on our nation. This activity was not the previous responsibility of any one agency. The Office of Programs, Plans, and Budget (PPB) was created within the S&T Directorate to establish and oversee the priorities of DHS's research and development activities. At the beginning of our review, PPB was organized into 18 portfolios, each focused on a particular discipline, such as addressing countermeasures for biological threats and border and transportation security.[Footnote 2] Each portfolio was headed by a portfolio manager who, according to DHS, helped to establish the research and development needs and priorities of their portfolios. When the S&T Directorate began operating in March 2003, it hired scientists, engineers, and experts in needed disciplines from federal laboratories, universities, and elsewhere in the federal government under authority provided by the Intergovernmental Personnel Act (IPA) of 1970.[Footnote 3] Portfolio managers hired under the IPA were brought to DHS from these employers because of their expertise in the areas of greatest risk to the nation's security. These managers were hired for a specified limited period with the understanding that they would subsequently return to their "home" institution. Seven of the 16 portfolio managers for the 18 portfolios were employed by DHS under the IPA. Five of these 7 employees came from the national laboratories, which are owned by the Department of Energy (DOE) and operated by private contractors, and the two others came from a nonprofit organization and a federally funded research and development center (FFRDC).[Footnote 4] You have raised questions about potential conflicts of interest for these individuals, since a portion of the Directorate's research funds have gone to these laboratories. In fiscal year 2004, 23 percent of the S&T Directorate's $761 million in research and development project funding obligations went to the national laboratories. (Appendix I provides more detailed budgetary data). IPA employees are generally subject to the same conflict of interest laws and regulations as all other federal employees. One of these laws, Section 208 of Title 18 of the United States Code (18 U.S.C. § 208), generally precludes federal employees from personally and substantially participating in decisions in which they have a financial interest, including participating in decisions that affect an entity, such as the national laboratories, with which they have an agreement for future employment. However, the agency official responsible for hiring the employee can grant a waiver of this law's application if the official determines that the conflicting interest is not so substantial as to be deemed likely to affect the integrity of the services the government may expect. Further, the Office of Management and Budget (OMB) requires agencies to establish a set of management controls.[Footnote 5] GAO issues standards for internal control in the federal government,[Footnote 6] as required by the Federal Managers' Financial Integrity Act of 1982,[Footnote 7] which provide the overall framework for establishing and maintaining internal control and for identifying and addressing major performance challenges and areas at greatest risk for fraud, waste, abuse, and mismanagement. As agreed with your office, we examined (1) the management controls that have been established within DHS's S&T Directorate to help guard against conflicts of interest for portfolio managers hired under the IPA, and (2) the role of the IPA portfolio managers (particularly those from the national laboratories) in determining where research and development (R&D) projects and associated funds are directed. To address our objectives, we reviewed DHS documentation of management controls related to conflicts of interest and other relevant documents, as well as its Web-based research and development process currently under development. In addition, we reviewed ethics laws and regulations, guidance on internal controls, and prior GAO and DHS Inspector General work pertaining to DHS's S&T Directorate and ethics issues. We also interviewed senior DHS officials, including the Assistant Secretary for Programs, Plans, and Budgets for the S&T Directorate and DHS's Designated Agency Ethics Officer (DAEO), as well as other officials in the S&T Directorate, including the IPA portfolio managers. In addition, we judgmentally selected two portfolios within the S&T Directorate, and interviewed members of these portfolio teams, to examine in more detail the existence of their process and management controls and compare any differences in the application of such processes and controls. These portfolios were: (1) the Biological Countermeasures portfolio, which is the largest portfolio in the S&T Directorate and led by an IPA; and (2) the Border and Transportation Security portfolio, a smaller portfolio led by a career federal employee. We also met with the Acting Director of the Office of Government Ethics (OGE) and her staff. OGE is the federal agency responsible for overseeing the executive branch's ethics programs. Appendix II contains more detailed information on our scope and methodology. We performed our work from September 2004 through December 2005 in accordance with generally accepted government auditing standards. Results in Brief: DHS's S&T Directorate is working to improve its management controls to help guard against conflicts of interest for employees hired under the IPA, but it can do more. In the first few years of DHS's existence, the S&T Directorate focused on the urgency of organizing itself to meet the nation's homeland security research and development requirements, and had few resources devoted to developing its management infrastructure, including the management controls to guard against conflicts of interest. However, in the past year, steps have been taken to improve these controls. For example, in June 2005, DHS implemented a new process for hiring IPA employees. Although DHS is taking steps to improve its management controls, there is more the Directorate can do to better ensure that its IPA portfolio managers comply with the conflict of interest laws. First, the process for determining where R&D projects and funds are directed, including the role of the IPA portfolio managers, has never been finalized. Second, the S&T Directorate does not require documentation of how determinations are made about where R&D projects and funds are directed. Third, S&T Directorate officials are only now seeking waivers, where appropriate, and considering whether to take other actions that would allow IPA portfolio managers to participate in certain matters. Finally, DHS officials told us that S&T Directorate employees, including those hired under the IPA, are offered the same new employee and annual ethics training as are all DHS employees. However, employees hired under the IPA do not receive regular training that addresses their unique situation; namely that they have an agreement for future employment with an entity that may benefit from the S&T Directorate's funding. The role of the IPA portfolio managers, five of whom were hired from the national laboratories, in determining where research and development projects and associated funds are directed was unclear. This was due to several factors. First, as previously discussed, the S&T Directorate has never finalized a standard process for determining where R&D projects and funds are directed, or for the decision-making role of the IPA portfolio managers within such a process. Second, the extent of the IPA portfolio managers' participation in making the determinations was unclear because there was no documentary evidence of how those determinations were actually made. Finally, the testimony regarding the extent of the IPA portfolio managers' involvement in the decision-making process was inconsistent and, at times, vague. For example, one IPA portfolio manager told us that he/she recused him/herself from any decision that may have involved his/her national laboratory, although this portfolio manager noted that he/she was present and "facilitated" the meetings when such decisions were made. Other IPA portfolio managers told us that they participated to varying degrees. However, because there was no documentation of the decision- making process, we could not determine the extent of the IPA portfolio managers' actual involvement on any particular funding matter, or whether their involvement affected their national laboratory. Because we could not determine whether or not the IPA portfolio managers participated "personally and substantially" in the decision-making process, we contacted the Acting Director of OGE in September 2005, and suggested that OGE review this matter further in conjunction with its planned ethics program review of DHS. In December 2005, OGE officials told us that they plan to examine, among other matters, the transparency and accountability issues in DHS's ethics program raised by our findings. To help IPA portfolio managers comply with conflict of interest laws, we are making recommendations that the Secretary of DHS direct the Undersecretary for Science and Technology to work with DHS's DAEO and OGE to establish additional ethics-related management controls for the S&T Directorate by: * finalizing the R&D process; * developing a system to document how decisions are made within the R&D portfolio teams; * determining whether waivers of 18 U.S.C. § 208 are appropriate or other actions are needed; * providing regular ethics training for IPA portfolio managers; and: * establishing a monitoring and oversight program of ethics-related management controls. We provided a draft of this report to the Secretary of Homeland Security. DHS concurred with our recommendations and noted several actions that they plan to take. If implemented effectively, these actions would be responsive to some of our recommendations. For example, the S&T Directorate plans to (1) coordinate with the DAEO and OGE in seeking waivers under 18 U.S.C. § 208 for some of the IPAs in the S&T Directorate; (2) enhance its ethics-related training for IPAs; and (3) strengthen its monitoring and oversight programs for ethics- related management controls. Although DHS agreed with all of our recommendations, it believed that we misstated the facts in asserting that IPA employees do not routinely receive specific training regarding conflicts of interest. We revised the report to indicate that the ethics training we believe is still needed should focus on the application of the ethics statutes and regulations to the unique financial relationship between the IPA portfolio managers and their "home" institutions. Second, we are encouraged that the S&T Directorate is seeking waivers under 18 U.S.C. § 208 for some IPAs. However, IPA portfolio managers continue to be vulnerable to violating the conflict of interest laws because the S&T Directorate has not finalized the process for determining where research and development projects and funds are directed. DHS's comments are provided in appendix III. In addition, we received technical comments from DHS, which we incorporated as appropriate. We also provided a draft to OGE. On December 8, 2005, we met with OGE officials, including the Deputy Director of the Office of Agency Programs, who provided us with technical comments, which we incorporated as appropriate. Background: The S&T Directorate consists of four offices responsible for managing and executing DHS's R&D programs: (1) the Office of Programs, Plans and Budgets (PPB); (2) Office of Research and Development (ORD); (3) Homeland Security Advanced Research Projects Agency (HSARPA); and (4) Systems Engineering and Development (SED), as seen in figure 1 below. Figure 1: The S&T Directorate's Offices and Overview of Their Functions: [See PDF for image] [A] On June 29, 2005, a Chief Financial Officer position was created for the S&T Directorate to consolidate and execute budgetary planning. Because the budgetary responsibility for the S&T Directorate was moved out of the Office of Programs, Plans, and Budgets, its name was changed to the Office of Programs, Plans and Requirements (PPR). This new position and name change are not reflected in this figure. [End of figure] In the first few years of DHS's existence, the S&T Directorate focused on the urgency of organizing itself to meet the nation's homeland security research and development requirements, and had few resources devoted to developing its management infrastructure, including the management controls to guard against conflicts of interest. In our 2004 report on DHS's potential use of the national laboratories, we noted that when the S&T Directorate began operating in March 2003, they sought and hired scientists, engineers, and experts in needed disciplines from federal laboratories, universities, and elsewhere in the federal government.[Footnote 8] These individuals were brought into the S&T Directorate to use their knowledge in ways that would help the Directorate achieve its mission quickly and effectively. DHS officials told us that these individuals came to DHS out of a sense of urgency and motivated by a strong sense of patriotism. Some of these scientists were hired from the national laboratories, and they came with the understanding that they would return to their laboratories following their time at DHS. As part of their responsibilities, portfolio managers led and facilitated Integrated Project Teams (IPT), which included representatives from ORD, HSARPA, and SED.[Footnote 9] In addition to identifying R&D projects and budgets, IPTs were responsible for determining which office (ORD, HSARPA, or SED) within the S&T Directorate would be responsible for them. These determinations were important because it influenced whether the project and associated funds went to the public or private sector. According to a March 2004 Office of Inspector General report,[Footnote 10] ORD generally executes programs that involve the national laboratories and which the private sector should not, could not, or would not perform. HSARPA generally executes programs for which technology development involves the private sector. SED generally executes programs employing proven technologies and resulting in transition to operational systems. As previously discussed, IPA employees are generally subject to the same laws and regulations that govern the ethical conduct of other federal employees. Section 208 of Title 18 of the United States Code, a criminal statute, generally precludes federal employees from personally and substantially participating in any particular matter that would have a direct and predictable effect on their financial interests, or the financial interest of any organization attributable to them. An employee's participation is "substantial" if their participation is meaningful to the matter. An employee can be personally and substantially involved in a variety of ways, including making a recommendation, rendering advice, or making a decision on a particular matter. The law can be waived if the employee first makes a full disclosure of the conflict of interest to the official responsible for his or her appointment, "and receives in advance a written determination made (i.e., waiver) by such official that the interest is not so substantial as to be deemed likely to affect the integrity of the services which the government may expect."[Footnote 11] Executive departments and agencies are required to forward documentation of such waivers to OGE.[Footnote 12] Waivers cannot be granted to cover past activities. In addition to avoiding conflicts of interest, executive branch employees must avoid even the appearance of a conflict of interest. However, when there is potential for such an appearance of a conflict, an employee can be granted an "authorization" to work on a matter even in situations where a reasonable person with knowledge of the relevant facts can question the employee's impartiality in a matter.[Footnote 13] As mentioned earlier, OMB requires agencies to establish a set of management controls and GAO issues standards for internal control in the federal government.[Footnote 14] In addition, GAO developed the Internal Control Management and Evaluation Tool[Footnote 15] to help managers and evaluators determine how well an agency's internal control is designed and functioning and help determine what, where, and how improvements, when needed, may be implemented. The five standards for internal control are: control environment, risk assessment, control activities, information and communications, and monitoring. Two of these standards, control environment and control activities, include key factors related to conflicts of interest. If effectively implemented, these internal controls can help to guard against employees participating in actions that present a personal conflict of interest. Examples of relevant key factors that address the establishment and maintenance of an effective control environment of an agency are: * establishment and use of a formal code of conduct and other policies communicating appropriate ethical and moral behavioral standards and addressing acceptable operational practices and conflicts of interest; * establishment of an ethical tone at the top of the organization and communicated throughout the agency; and: * implementation of policies and procedures for hiring employees. Internal control activities are the policies, procedures, techniques, and mechanisms that help ensure that management's directives to mitigate identified risks are carried out. Examples of relevant key factors that address internal control activities are: * existence of appropriate policies, procedures, techniques, and mechanisms with respect to each of the agency's activities; * providing appropriate training and other control activities to give employees the tools they need to perform their duties and responsibilities to meet the demands of changing organizational needs; and: * documentation of transactions and other significant events is complete and accurate and facilitates tracing the transaction or event and related information from authorization and initiation, through its processing, to after it is completed. DHS's S&T Directorate Can Do More to Improve Its Management Controls Related to Conflicts of Interest for Its IPA Portfolio Managers: DHS's S&T Directorate has implemented several management controls to help its IPA portfolio managers comply with conflict of interest laws and regulations. Most of these were implemented during the course of our review. Since the S&T Directorate was created in 2003, individuals employed in the S&T Directorate under the IPA have completed an "assignment agreement", as required by OPM. Having procedures in place for hiring employees and implementing them is one aspect of an effective management control environment. The assignment agreements include a section on conflicts of interest and employee conduct. As part of the assignment agreement, each applicant must acknowledge that: * "applicable Federal, State or local conflict-of-interest laws have been reviewed with the employee to assure that conflict-of-interest situations do not inadvertently arise during this assignment"; and: * "the employee has been notified of laws, rules and regulations, and policies on employee conduct which apply to him/her while on this assignment." We reviewed the IPA assignment agreements for all of the IPA portfolio managers and found that the IPA portfolio managers acknowledged these provisions. The S&T Directorate's leadership took steps to establish an ethical tone and communicate it through a March 15, 2004, memorandum from DHS's Undersecretary for S&T to all S&T Directorate employees emphasizing that they should strictly adhere to all applicable ethics laws. The memo summarized ethics laws, called attention to the consequences of noncompliance, provided points of contact for those with questions, and explained that S&T employees "have the responsibility to be scrupulous in complying with all applicable ethics laws." Further, the memo specifically mentioned that employees hired under the IPA may not participate in matters involving their "home" institution (which, in the S&T Directorate, has often been a DOE national laboratory). The memo explained provisions of 18 U.S.C. § 208, stating that an employee may not participate "personally and substantially" in a particular matter that may affect an entity in which he has a financial interest and that "personal and substantial participation can occur if the employee participates in a decision, approval, disapproval, recommendation, investigation, or the rendering of advice on the matter." According to DHS's DAEO, the IPAs in the S&T Directorate were employed before a process was in place to screen them for personal conflict of interest issues. On June 30, 2005, the S&T Directorate issued new, internal procedures for hiring employees under the IPA. These new procedures outline the responsibilities of the parties involved in the hiring process and detail the steps necessary to hire an IPA. These steps include a preliminary review of financial disclosure forms by DHS's Office of General Counsel (OGC) to determine whether conflicts of interest exist based on the roles and responsibilities of the proposed position. Along with these new hiring procedures, the S&T Directorate began requiring applicants being considered under the IPA to complete written disqualification statements meant to bar their involvement in any matter that could reasonably be perceived to affect the interests of their national laboratory or other employer. In addition, once hired, IPAs can complete a memorandum that provides their supervisor with a written recusal from "certain Government matters" that affect the institution to which they will return after their employment at DHS, and allows them "to describe the screening arrangement" they are implementing to ensure that they comply with their "obligation to recuse." In this memorandum, the employee then lists each asset, entity, or other interest that gives rise to a disqualifying interest under 18 U.S.C. § 208. DHS officials told us that S&T Directorate employees, including those hired under the IPA, are offered the same new employee and annual ethics training as are all new DHS employees. Having training and orientation programs for new employees, with ongoing training for all employees, are key activities for establishing effective controls.[Footnote 16] On January 7, 2005, the Assistant Secretary of PPB also held a mandatory meeting for all IPAs in the S&T Directorate. S&T Directorate officials told us that this meeting was called to discuss the ethics issues that apply specifically to employees hired under the IPA, including the conflict of interest statutes. Other important management controls that could help ensure portfolio managers comply with conflict of interest laws are not yet in place in the S&T Directorate. Importantly, the process for determining where R&D projects and funds are directed, including the role of the IPA portfolio managers, has never been finalized. Establishment of a process for each agency activity is one of the key factors for meeting internal control standards. Though IPTs were created to help make this determination, as previously discussed, we were told that each IPT worked differently and there were no requirements to operate in the same way. In addition, neither the S&T Directorate nor its draft process requires documentation of how determinations are made about where R&D projects and funds are directed. Further, the S&T Directorate is only now seeking waivers, where appropriate, and considering whether to grant authorizations or take other actions for their portfolio managers hired under the IPA. As we discussed, under 18 U.S.C. § 208(b)(1), the official responsible for an employee's appointment may grant a waiver in advance allowing participation in certain matters if he or she makes a written determination that the affected financial interest "is not so substantial as to be deemed likely to affect the integrity" of the employee's services. In May 2005, an S&T Directorate official stated to us that they first needed to "scrutinize all of their positions to determine whether an actual or apparent conflict requires such action." In August 2005, senior S&T officials told us that, in conjunction with DHS's DAEO and OGE, they had begun the process of determining whether to issue waivers to IPA portfolio managers. During our exit briefing with DHS in September 2005, DHS officials indicated that one option might be to not hire anyone for which a waiver may be needed. In DHS's December 2005 letter to us commenting on our report, it noted that the S&T Directorate is now seeking waivers for at least 6 of its IPAs. Finally, IPA portfolio managers in the S&T Directorate are not routinely offered specific training that focuses on the application of the ethics statutes and regulations to the unique financial relationship between the IPA portfolio managers and their "home" institution. The January 2005 meeting held with all IPAs in the S&T Directorate to discuss the specific ethics issues related to their circumstances is not scheduled to be repeated. Ensuring that management conveys the message on a periodic basis that integrity and ethical values must not be compromised is part of maintaining an effective control environment. Because of IPA portfolio managers' ties to their "home" institution, and that their responsibilities at DHS may involve issues that affect their "home" institution, ensuring that these managers receive regular training that targets the application of conflict of interest laws to IPAs may keep them alert to those actions that could constitute a violation of such laws. IPA Portfolio Managers' Role in Determining Where R&D Projects and Funds Were Directed Was Unclear: The recent changes and further improvements to the S&T Directorate's ethics-related management controls are critical because we found that the role of the IPA portfolio managers in determining where R&D projects and associated funds were directed was unclear. This was due to several factors, as discussed in more detail below. First, the process that was to be followed by IPA portfolio managers when determining where R&D projects and funds are directed, and the decision-making role of the IPA portfolio managers within such a process, has never been finalized. DHS provided us with a draft version of this process as part of a Web-based tool. However, IPTs were not required to follow this draft process and team members from the two IPTs that we examined said that they were becoming familiar with the process. In this draft, DHS stated that IPTs, facilitated by portfolio managers, were to "decide" which office within the S&T Directorate would execute a project, (i.e., ORD, HSARPA, or SED). The draft stated that if the members of the IPT could not reach agreement, the project would be reviewed by the Executive Review Board (ERB), which consisted of the Assistant Secretary, Programs, Plans, and Budgets, and the Directors of SED, ORD, and HSARPA. However, in September 2005, senior S&T Directorate officials told us that the information regarding the decision-making role of the IPT in the draft Web-based tool was inaccurate, indicating that IPTs can only make recommendations to the ERB, but not a final decision. However, as we noted, 18 U.S.C. § 208 guards against "personal and substantial participation" through various actions which include "decision" and "recommendation." Second, DHS officials, portfolio managers, and IPT members were unable to provide us with any documentation, such as meeting minutes, to indicate the actual role that the five IPA portfolio managers from the national laboratories played in the decision-making process within the IPTs. Third, the testimony regarding the extent of the IPA portfolio managers' involvement in the decision-making process was inconsistent and, at times, vague. For example, one IPA portfolio manager told us that he/she recused himself/herself from any decision that may have involved his/her national laboratory, although this manager noted that he/she was present and "facilitated" the IPT meetings when such decisions were made. Other IPA portfolio managers told us that they participated to varying degrees. For example, one told us that he/she was involved in the IPT decisions regarding which S&T Directorate office would execute a project only when the other IPT members could not reach agreement. Another told us that he/she participated in all IPT discussions that helped make this determination. However, because there was no documentation of the decision-making process, we could not determine the extent of the IPA portfolio managers' actual involvement on any particular funding matter, or whether their involvement affected their "home" institution, such as a national laboratory. In March 2005, we discussed our review with OGE to obtain their views on the ethics issues, both in general and as they may specifically apply to the S&T Directorate. During these discussions, OGE officials told us that they planned to begin their first audit of DHS's ethics program in late 2005. Because we could not determine whether or not the IPA portfolio managers participated "personally and substantially" in the decision-making process, however, we contacted the Acting Director of OGE in September 2005 and suggested that OGE review this matter further in conjunction with its planned ethics program review of DHS. In December 2005, OGE officials told us that they plan to examine, among other matters, the transparency and accountability issues in DHS's ethics program raised by our findings. Conclusions: In the first few years of its existence, the S&T Directorate focused on rapidly organizing itself to meet the nation's homeland security R&D requirements. During this time, DHS had few resources devoted to developing the S&T Directorate's management infrastructure, including management controls to guard employees against conflicts of interest. Although the S&T Directorate has recently implemented management controls to help protect against conflicts of interest, and is currently considering others, more needs to be done. In the absence of a process for deciding what entities will implement R&D projects, the role that IPA portfolio managers played has been inconsistent and the potential exists that they may have unknowingly violated conflict of interest laws. By developing and carrying out a process to decide which office will execute a project, and clearly defining the roles and responsibilities of those involved in the process, the S&T Directorate may help its IPA portfolio managers avoid such situations in the future. In addition, documenting how the decisions are made while implementing this process may help protect both DHS and its employees if questions are raised. Ensuring that the S&T Directorate continues to have access to the best personnel with needed expertise is important to the success of DHS's mission. The IPA provides the S&T Directorate with a mechanism to hire some of these people. However, because IPA portfolio managers have an arrangement for future employment with an entity that could benefit from the S&T Directorate's work, determining whether (1) waivers of the conflict of interest laws are appropriate, (2) IPA portfolio managers should be authorized to work on these issues regardless of any appearance of a conflict, or (3) DHS should take other steps to facilitate the use of their expertise to achieve the S&T Directorate's mission, could help ensure that these valuable employees are protected against violating conflict of interest laws. Further, once hired, IPA employees must understand how the ethics laws address their unique situations; namely, that they have an agreement for future employment with an entity that stands to benefit from the S&T Directorate's funding. Regular training for IPA portfolio managers that targets the conflict of interest laws could help them understand what actions are not permitted. Finally, to help ensure that DHS's ethics-related management controls are implemented and working in a satisfactory manner, it is critical that DHS establish a monitoring and oversight program. Such a monitoring mechanism will allow the S&T Directorate to assess its ethics-related management controls in order to facilitate awareness and mitigation of risk in DHS, while providing a greater degree of impartiality and integrity. Recommendations for Executive Action: To help IPA portfolio managers comply with the conflict of interest law, we are recommending that the Secretary of Homeland Security direct the Undersecretary of the S&T Directorate to improve the S&T Directorate's management controls related to potential conflicts of interest by: * finalizing the S&T Directorate's R&D process and defining and standardizing the role of the IPA portfolio managers in this process; * developing a system to document how decisions are made within the IPTs; * determining, in consultation with DHS's DAEO and OGE, whether waivers of 18 U.S.C. § 208 or authorizations related to the appearance of a conflict of interest are appropriate, or other actions are needed; * providing regular ethics training for IPA portfolio managers that focuses on the application of the ethics statutes and regulations to their unique financial situation; and: * establishing a monitoring and oversight program of ethics-related management controls. Agency Comments and Our Evaluation: We provided a draft of this report to the Secretary of Homeland Security. DHS concurred with our recommendations and noted some actions that they plan to take. If implemented effectively, these actions would be responsive to some of our recommendations. For example, the S&T Directorate plans to (1) coordinate with the DAEO and OGE in seeking waivers under 18 U.S.C. § 208 for some of the IPAs in the S&T Directorate; (2) enhance its ethics-related training for IPAs; and (3) strengthen its monitoring and oversight programs for ethics-related management controls. Although DHS agreed with all of our recommendations, it believed that we misstated the facts in asserting that IPA employees do not routinely receive specific training regarding conflicts of interest. We revised the report to indicate that the ethics training we believe is still needed should focus on the application of the ethics statutes and regulations to the unique financial relationship between the IPA portfolio managers and their "home" institutions. Second, we are encouraged that the S&T Directorate has reviewed the individual circumstances of all of the IPAs in the S&T Directorate and is seeking waivers under 18 U.S.C. § 208 for at least six of these individuals. However, as stated in our report, the S&T Directorate has not finalized the process for determining where research and development projects and associated funds are directed, nor has it defined and standardized the role of the IPA portfolio managers in this process. Further, the ability of IPA portfolio managers themselves to influence or control where projects and funds are directed has been inconsistent and, at times, vague within the S&T Directorate. Thus, IPA portfolio managers continue to be vulnerable to violating the conflict of interest laws. DHS's comments are provided in appendix III. In addition, we received technical comments from DHS, which we incorporated as appropriate. We also provided a draft to OGE. On December 8, 2005, we met with OGE officials, including the Deputy Director of the Office of Agency Programs, who provided us with technical comments, which we made as appropriate. We are sending copies of this report to the Secretary of Homeland Security and other interested parties. In addition, this report is available at no charge on the GAO Web site at [Hyperlink, http://www.gao.gov]. If you or your staff have any further questions about this report, please contact me at (202) 512-6806 or [Hyperlink, stalcupg@gao.gov]. Major contributors to this report included Ben Crawford, Terry Draver, John Krump, James Lager, Andrea Levine, Sarah Veale, and Michael Volpe. Sincerely yours, George H. Stalcup: Director, Strategic Issues: [End of section] Appendixes: Appendix I: DHS Research and Development Funding Distribution in Fiscal Year 2004: In fiscal year 2004, the most recent year in which the Science and Technology (S&T) Directorate could provide us with detailed breakdowns of its obligated funds, about 41 percent of the $761 million obligated for its research and development (R&D) funding was distributed to Department of Energy and federal laboratories (mostly the Office of Research and Development's programs) and about 40 percent to the private sector (mostly the Homeland Security Advanced Research Projects Agency's programs), as seen in figure 2 below. Figure 2: The S&T Directorate's R&D Funding Obligations in Fiscal Year 2004: [See PDF for image] Note: This chart is presented for background purposes only; therefore we did not assess the reliability of the data. [A] Includes Federally Funded Research and Development Centers, nonprofits, etc. [B] Includes DHS-funded laboratories. [End of figure] [End of section] Appendix II: Scope and Methodology: The objectives of our review were to examine (1) the management controls that have been established within the Department of Homeland Security's (DHS) Science and Technology (S&T) Directorate to help guard against conflicts of interest for portfolio managers hired under the Intergovernmental Personnel Act (IPA), and (2) the role of the IPA portfolio managers (particularly those from the national laboratories) in determining where research and development (R&D) projects and associated funds are directed. To address our objectives, we analyzed DHS documentation of management controls related to conflicts of interest and other relevant documents. These documents included such materials as agency directives, official memos, human capital procedures, fiscal years 2007-2011 Planning, Programming, and Budgeting Cycle guidance, DHS reports and testimony to Congress, and IPA agreement forms for the Directorate's employees hired under the IPA. In addition, we reviewed the most current, but incomplete, draft of an electronic version of the Research, Development, Testing and Evaluation process to be used by the S&T Directorate. We reviewed relevant laws and regulations, including the Homeland Security Act of 2002, Title 18 U.S.C. Section 208(a); (b); and 5 C.F.R. pt. 2635. In addition, we used GAO's Standards for Internal Control in the Federal Government and Internal Control Management and Evaluation Tool. We also reviewed prior work from DHS's Office of the Inspector General (OIG) and GAO on the DHS S&T Directorate and ethics- related issues. We interviewed officials in the S&T Directorate, including the Deputy Secretary for S&T and head of Programs, Plans, and Budgets (PPB); Director of the Office of Research and Development (ORD); Acting Director of the Homeland Security Advanced Research Projects Agency (HSARPA); S&T portfolio managers, five of whom were employed by DHS on IPA agreements from the national laboratories; and the human capital director for S&T. We did not interview the Director of Systems, Engineering, and Development (SED) because SED works with mature technologies at or near the deployment stage, rather than technologies needing R&D by an entity like the national laboratories. More specifically, we examined the role of the IPA portfolio managers from the national laboratories in determining where R&D projects and associated funds were directed during the period from December 2004 through May 2005. In addition, we interviewed DHS's Designated Agency Ethics Officer, attorneys in DHS's General Counsel's Office, and DHS's OIG. We judgmentally selected two portfolios within the S&T Directorate to examine in more detail the existence of their process and management controls and compare any differences in the application of such processes and controls. These portfolios were: (1) the Biological Countermeasures portfolio, which is the largest portfolio in the S&T Directorate and is run by an IPA; and (2) the Border and Transportation Security (BTS) portfolio, a smaller portfolio managed by a career federal employee. We interviewed the members of these Integrated Project Teams, which included representatives of PPB, HSARPA, ORD and SED. In addition, we reviewed the fiscal years 2004 and 2005 Execution Plans for the Biological Countermeasures portfolio, the fiscal year 2004 Execution Plan for the BTS portfolio, and the fiscal year 2004 BTS portfolio funding allocations by type of entity. (e.g., national laboratory, university, private industry, etc.) We also met with the Acting Director of the Office of Government Ethics (OGE) and her staff to discuss the ethics issues we were reviewing at DHS. OGE exercises leadership in the executive branch to prevent conflicts of interest on the part of government employees and to resolve those conflicts of interest that do occur. The responsibilities of the Director of OGE include, among other things, consulting with agency ethics counselors and other responsible officials regarding the resolution of conflict of interest problems in individual cases, and ordering corrective action on the part of agencies and employees which the Director deems necessary. Written comments from DHS are included in appendix III. We performed our work from September 2004 through December 2005 in accordance with generally accepted government auditing standards. [End of section] Appendix III: Comments from the Department of Homeland Security: U.S. Department of Homeland Security: Washington, DC 20528: December 7, 2005: Mr. George H. Stalcup: Director, Strategic Issues: U.S. Government Accountability Office: 441 G Street, N.W. Washington, D.C. 20548: Dear Mr. Stalcup: Thank you for the opportunity to review and comment on draft report GAO- 06-206, HOMELAND SECURITY. DHS Needs to Improve Ethics-Related Management Controls for the Science and Technology Directorate. Technical comments have been provided under separate cover. With respect to the assertion that Intergovernmental Personnel Act (IPA) portfolio managers within the Science and Technology (S&T) Directorate do not routinely receive specific training regarding conflicts of interest, we believe this misstates the facts. While it is clear that the identification and administration of detailees under the IPA in S&T has been problematic, there is no question that once an IPA is identified to the Department's Legal Advisor for Ethics (the Department's Designated Agency Ethics Officer or DAEO), that individual is required to complete new employee and annual ethics training, as appropriate. As discussed in your report, the January 2005 meeting with all IPAs in S&T that was held to discuss ethics issues was a direct result of discussions with IPAs at the annual ethics training session held in December 2004 for S&T personnel. A review of the ethics training records for Calendar Year (CY) 04 and 05 shows that in CY 04, the Ethics Office provided 7 one-hour face-to- face annual ethics training sessions for S&T staff who filed financial disclosures, to include the IPA employees. In CY 05, the number of these face-to-face sessions increased to 12. For CY 05, while developing the S&T focused annual training, the ethics instructors identified ethics issues unique to S&T personnel after consultation with S&T officials, reviewed requests for ethics advisory opinions submitted by S&T personnel throughout the past year, and considered ethical concerns raised by S&T staff in discussion with the ethics staff. As a result, the training sessions to S&T personnel integrated discussion of ethical problems, such as conflicts of interest likely to arise in S&T due to the component's unique mission and component specific programs. As the S&T IPAs have become known to the Ethics Office and added to those notified about annual ethics training, the number of IPAs attending appropriate ethics training has steadily increased. Overall, the Department concurs with the recommendations contained in the report. However, we would like to call your attention to some corrective actions already underway with respect to three of the Recommendations for Executive Action and ask that these efforts be acknowledged in the final report. * Determining, in consultation with DHS's DAEO and OGE, whether waivers of 18 U.S.C § 208, authorizations related to the appearance of a conflict of interest, or other actions are needed: In November 2005, officials from the Science and Technology's Offices of General Counsel and Human Capital thoroughly reviewed the records, and assignments, of all IPA employees that are assigned to S&T. This review was conducted under the premise that we would seek a waiver under 18 U.S.C. 208(b) if the duties of the incumbent IPA could potentially affect the financial interests of a family member or their sending institution. This review standard was intended to be stricter than that in 18 U.S.C. 208 - -personal and substantial participation of employee in a matter in which he/she has a financial interest. Given the recent allegations that IPAs at S&T were in positions to direct work to their sending institutions, we were especially focused on both the raw ability of an IPA to direct work to any particular institution (including the national labs) as well as their ability to shape requirements which could be the subject of future work which their institution might seek to perform. As a result of this zero-based review, we identified 7 IPAs in S&T that are candidates for 18 U.S.C. 208 waivers. This is in addition to the disqualification statements that all IPAs in S&T have signed admonishing them of their obligations under 18 U.S.C. 208 and requiring them to involve their named supervisor in any official matter in which their sending institution, or a corporate affiliate, may become involved. One individual is at the end of her IPA term so, depending on timing, a waiver may not be sought in her case by S&T. In no case did S&T find an instance where an IPA - regardless of assignment - is specifically directing work to his/her sending institution or, to the best of our knowledge, helping shape requirements which could benefit his/her sending institution. S&T is now preparing waiver packages - using templates provided by Office of Government Ethics (OGE) - for the appropriate individuals. Those packages will be coordinated with the DAEO and the OGE. As new IPAs join S&T, each case will be analyzed prior to that person's assignment to determine whether the new hire IPA presents 18 U.S.C. 208 challenges that would need to be addressed in some manner. * Providing regular ethics training for IPA portfolio managers that focuses on the application of the ethics statutes and regulations to their unique financial situation. Officials from the Department's Office of General Counsel (OGC) and S&T's Offices of General Counsel and Human Capital determined that the appropriate course of action for long-term ethics training would be to enhance the new ethics website called Ethicsburg to include new training web pages devoted strictly to IPAs. If approved by Ethicsburg management, this web-based approach would allow the IPA job candidate to complete his/her ethics training before joining the Directorate. Upon completion of the required training, Ethicsburg automatically generates a completion certificate, which is routed to the Department's OGC. The Directorate is in the process of submitting recommendations for the long-term Ethicsburg initiative to add IPA training to Ethicsburg management. In the interim, pending approval of the long-term Ethicsburg initiative, the short-term training solution is the creation of a MS PowerPoint © presentation devoted to the IPA's unique ethics training requirements. Section one of this presentation would be devoted to training ethics-related laws and statutes, while section two would be a multiple choice test that each IPA would need to complete with a passing score. The Directorate is in the process of developing this presentation which will be distributed to all current S&T IPAs for completion no later than January 31, 2006. Additionally, all IPAs are required to fulfill their annual ethics training requirement unless they are new hires or have completed the ethics training during the current calendar year. S&T's annual ethics training is conducted in two settings: several classroom sessions with an OGC instructor, or electronically through Ethicsburg. Instructions were sent to all IPAs regarding filing the Confidential Disclosure Report (OGE-450) and the Public Financial Disclosure Report (SF-278). Instructions were also sent to IPAs on how to access Ethicsburg. * Establishing a monitoring and oversight program of ethics-related management controls. In those situations where Ethicsburg is determined to be an appropriate means for providing ethics training, it affords a simple mechanism for notifying the Ethics Office and the supervisor of the employee involved that the employee has completed certain required modules of ethics education. Ethicsburg will, at the request of the employee who has completed a training module, send an electronic notification to a data file maintained by the Ethics Office and to the employee's supervisor that the employee has successfully completed the training. Meanwhile, during CY05, the Directorate created numerous ethics related guidance documents regarding ethics non-disclosure report filing requirements. Within these documents were instructions to reference the OGC website to access required ethics laws and past legal actions for training purposes. Distribution lists were created for OGE-450 and SF- 278 filers for the purpose of disseminating ethics related announcements regarding training and the filing of non-disclosure reports. By early 2006, S&T will launch a new Staffing Management System (SMS) database which will contain the names of all current S&T employees to include IPAs. Included within the SMS system, we will track and monitor completion of ethics training requirements; submission of new financial disclose forms; disqualification statements; and Section 208 waivers for all IPAs. Until the SMS system is launched, current management controls include audit mechanisms now in place to ensure each item is addressed. In addition, S&T receives reports from the OGC office on financial reports by calendar year. With regard to the two other Recommendations for Executive Action, in general we concur. The Directorate has taken action to strengthen existing processes. It should be noted that the S&T/Office of the Chief Financial Officer, the Requirements Office, and the program execution officers have instituted internal controls which require that before any requirements are validated or funds allocated to an executing organization (Office of Research and Development, Systems Engineering and Development, or Homeland Security Advanced Research Projects) that there is significant oversight by S&T's senior management. We thank you again for the opportunity to provide comments on this draft report and look forward to working with you on future homeland security issues. Sincerely, Signed by: Steven J. Pecinovsky: Director: Departmental GAO/OIG Liaison Office: [End of section] (450346): FOOTNOTES [1] Pub. L. No. 107-296 § 301, 116 Stat. 2135, 2163 (2002). [2] As of September 2005, there were 13 portfolios. [3] 5 U.S.C. §§ 3371-76. The IPA facilitates the temporary hiring of skilled personnel or specialists to and from other federal entities, state and local governments, colleges and universities, and Indian tribal governments. Such assignments may be used to achieve objectives such as assisting the transfer and use of new technologies. DHS hires IPAs under a 2-year agreement that can be renewed one time for 2 additional years, consistent with Office of Personnel Management (OPM) regulations. [4] FFRDCs are nonprofit organizations that are generally financed on a sole-source basis by federal agencies. [5] OMB Circular No. A-123 (June 1995). [6] GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999). [7] 31 U.S.C. § 3512(c). [8] GAO, Homeland Security: DHS Needs a Strategy to Use DOE's Laboratories for Research on Nuclear, Biological, and Chemical Detection and Response Technologies, GAO-04-653 (Washington, D.C.: May 24, 2004). [9] For more information on the use of IPTs, see GAO, Best Practices: DOD Teaming Practices Not Achieving Potential Results, GAO-01-510 (Washington, D.C.: Apr. 10, 2001). [10] Department of Homeland Security Office of Inspector General, Survey of the Science and Technology Directorate, OIG-04-24 (Washington, D.C.: March 2004). [11] 18 U.S.C. § 208(b)(1). [12] 5 C.F.R. § 2640.303. [13] 5 C.F.R. § 2635.502. Authorizations are based upon a determination "that the interest of the Government in the employee's participation outweighs the concern that a reasonable person may question the integrity of the agency's programs and operations." [14] GAO/AIMD-00-21.3.1. [15] GAO, Internal Control Management and Evaluation Tool, GAO-01-1008G (Washington, D.C.: August 2001). [16] For more on DHS's training program, see GAO, Department of Homeland Security: Strategic Management of Training Important for Successful Transformation, GAO-05-888 (Washington, D.C.: Sept. 23, 2005). GAO's Mission: The Government Accountability Office, the investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through the Internet. GAO's Web site ( www.gao.gov ) contains abstracts and full-text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as "Today's Reports," on its Web site daily. The list contains links to the full-text document files. To have GAO e-mail this list to you every afternoon, go to www.gao.gov and select "Subscribe to e-mail alerts" under the "Order GAO Products" heading. Order by Mail or Phone: The first copy of each printed report is free. Additional copies are $2 each. A check or money order should be made out to the Superintendent of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a single address are discounted 25 percent. Orders should be sent to: U.S. Government Accountability Office 441 G Street NW, Room LM Washington, D.C. 20548: To order by Phone: Voice: (202) 512-6000: TDD: (202) 512-2537: Fax: (202) 512-6061: To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.gov Automated answering system: (800) 424-5454 or (202) 512-7470: Public Affairs: Jeff Nelligan, managing director, NelliganJ@gao.gov (202) 512-4800 U.S. Government Accountability Office, 441 G Street NW, Room 7149 Washington, D.C. 20548: