This is the accessible text file for GAO report number GAO-10-341 entitled 'Homeland Security: Federal Protective Service's Contract Guard Program Requires More Oversight and Reassessment of Use of Contract Guards' which was released on April 14, 2010. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Report to Congressional Requesters: United States Government Accountability Office: GAO: April 2010: Homeland Security: Federal Protective Service's Contract Guard Program Requires More Oversight and Reassessment of Use of Contract Guards: GAO-10-341: GAO Highlights: Highlights of GAO-10-341, a report to congressional requesters. Why GAO Did This Study: To accomplish its mission of protecting about 9,000 federal facilities, the Federal Protective Service (FPS) currently has a budget of about $1 billion, about 1,225 full-time employees, and about 15,000 contract security guards. FPS obligated $659 million for guard services in fiscal year 2009. This report assesses the challenges FPS faces in managing its guard contractors, overseeing guards deployed at federal facilities, and the actions, if any, FPS has taken to address these challenges. To address these objectives, GAO conducted site visits at 6 of FPS’s 11 regions; interviewed FPS officials, guards, and contractors; and analyzed FPS’s contract files. GAO also conducted covert testing at 10 judgmentally selected level IV facilities in four cities. A level IV facility has over 450 employees and a high volume of public contact. What GAO Found: FPS faces a number of challenges in managing its guard contractors that hamper its ability to protect federal facilities. FPS requires contractors to provide guards who have met training and certification requirements, but 7 of 7 guard contractors we reviewed were not in compliance with this requirement. Specifically, we reported in July 2009 that 62 percent, or 411, of the 663 guards employed by 7 of FPS’s 38 contractors and deployed to federal facilities had at least one expired certification, including those showing that the guard has not committed domestic violence, which make the guards ineligible to carry firearms. As of February 2010, according to FPS data, 435 of the 663 guards are now fully certified, 167 are not fully certified, and 61 guards are no longer working on the contract. FPS’s guard contract also states that a contractor who does not comply with the contract is subject to enforcement action. FPS did not take any enforcement actions against these 7 contractors for noncompliance. In fact, FPS exercised the option to extend their contracts. FPS also did not comply with its requirement that a performance evaluation of each contractor be completed annually and that these evaluations and other performance-related data be included in the contract file. FPS also faces challenges in ensuring that many of the 15,000 guards have the required training and certification to be deployed at a federal facility. In July 2009, we reported that since 2004, FPS had not provided X-ray and magnetometer training to about 1,500 guards in one region. As of January 2010, these guards had not received this training and continued to work at federal facilities in this region. X- ray and magnetometer training is important because guards control access points at federal facilities. In addition, once guards are deployed to a federal facility, they are not always complying with assigned responsibilities (post orders). For example, we identified security vulnerabilities when GAO investigators successfully passed undetected through security checkpoints monitored by FPS guards with components for an improvised explosive device concealed on their persons at 10 level IV facilities in four cities in major metropolitan areas. Since July 2009, FPS has conducted 53 similar tests, and in over half of these tests some guards did not identify prohibited items, such as guns and knives. In response to GAO’s July 2009 testimony, FPS has taken a number of actions that once fully implemented could help address challenges it faces in managing its contract guard program. For example, FPS has increased the number of guard inspections at federal facilities in some metropolitan areas. FPS also revised its X-ray and magnetometer training; however, guards will not all be fully trained until the end of 2010, although they are deployed at federal facilities. FPS recognized that its guard program has long-standing challenges and in 2009 contemplated a number of changes to the program, including assuming responsibility for all guard training and/or federalizing some guard positions at some federal facilities. However, FPS has not taken any actions in pursuing these ideas. What GAO Recommends: GAO recommends, among other things, that the Secretary of the Department of Homeland Security (DHS) direct the Director of FPS to (1) identify other approaches that would be cost-beneficial for protecting federal buildings, and (2) increase contract guard program oversight and step up enforcement when noncompliance occurs. DHS concurred with seven of GAO’s eight recommendations. DHS did not fully concur with GAO’s recommendation to issue a standardized record- keeping format to ensure that contract files have required documentation. View [hyperlink, http://www.gao.gov/products/GAO-10-341] or key components. For more information, contact Mark Goldstein at (202) 512- 2834 or goldsteinm@gao.gov. [End of section] Contents: Letter: Scope and Methodology: Background: FPS Faces Challenges Managing Its Guard Contractors That Hamper Its Ability to Protect Federal Facilities: FPS Faces Challenges with Overseeing Guards That Raise Concern about Protection of Federal Facilities: Recent Actions Taken by FPS May Help Improve Oversight of the Contract Guard Program: Conclusions: Recommendations for Executive Action: Agency Comments and Our Evaluation: Appendix I: Comments from the Department of Homeland Security: Appendix II: GAO Contact and Staff Acknowledgments: Table: Table 1: Guard Training and Certifications Required by FPS Contracts: Figure: Figure 1: Number of FPS Guards and Federal Facilities with Guards, by Region: Abbreviations: CCG: Consolidated Contracting Group: CERTS: Contract Guard Employment Requirements Tracking System: COTR: Contracting Officer Technical Representative: CPARS: Contractor Performance Assessment System: CPR: cardiopulmonary resuscitation: DHS: Department of Homeland Security: DVD: digital video disc: FAR: Federal Acquisition Regulation: FPS: Federal Protective Service: GSA: General Services Administration: ICE: Immigration and Customs Enforcement: IED: improvised explosive device: NPPD: National Protection and Programs Directorate: RAMP: Risk Assessment Management Program: [End of section] United States Government Accountability Office: Washington, DC 20548: April 13, 2010: Congressional Requesters: Over 1 million government employees work in federal facilities, and members of the public visit such facilities each year. Protecting these facilities from a potential terrorist attack or acts of violence remains a daunting challenge. The Federal Protective Service (FPS) is the primary agency with responsibility for providing law enforcement and related security services for the nearly 9,000 facilities that are under the control and custody of the General Services Administration (GSA). To accomplish its mission of protecting federal facilities, FPS currently has a budget of about $1 billion,[Footnote 1] about 1,225 full-time employees, and about 15,000 contract security guards (guards) deployed at about 2,360 federal facilities across the country.[Footnote 2] In fiscal year 2009, FPS obligated $659 million for guard services, which represents the single largest item in its budget. FPS's contract guard program is the most visible component of its operations as well as the first public contact for individuals entering a federal facility. FPS relies heavily on its guards and considers them to be the agency's "eyes and ears" while performing their duties. Guards are primarily responsible for controlling access to federal facilities by (1) checking the identification of government employees who work there as well as members of the public who visit, and (2) operating security equipment, such as X-ray machines and magnetometers to screen for prohibited materials, such as firearms, knives, explosives, or items intended to be used to fabricate an explosive or incendiary device.[Footnote 3] Guards do not have arrest authority but can detain individuals who are being disruptive or pose a danger to public safety. You requested that we evaluate FPS's oversight of its contract guard program. We provided you with testimony on our preliminary findings in July 2009 in which we specified a number of our concerns with FPS's management of its contract guard program.[Footnote 4] This report provides additional information and analysis on the challenges FPS faces in managing its guard contractors and guards, and it describes what actions, if any, FPS has taken to address these challenges. During our review, FPS transferred from the Department of Homeland Security's (DHS) U.S. Immigration and Customs Enforcement (ICE) to the National Protection and Programs Directorate (NPPD) on October 28, 2009. Scope and Methodology: To determine the challenges FPS faces in managing its guard contractors and guards, we conducted site visits at 6 of FPS's 11 regions. To select these 6 regions, we considered the number of FPS guards, contractors, and federal facilities, and the geographic dispersion of the regions across the United States. At each region, we observed FPS's guard inspection process and interviewed FPS's regional manager, contract guard program managers, inspectors who are responsible for conducting guard inspections; guards, and contractors. We also interviewed officials at GSA headquarters and regional security officials in all 11 FPS regions, to identify any concerns GSA has with FPS's contract guard program.[Footnote 5] We also met with representatives of the National Association of Security Companies to learn about the contract security guard industry. In addition, we reviewed and analyzed FPS's contract requirements and training and certifications requirements, and reviewed the Security Guard Information Manual. We also randomly selected 663 out of approximately 15,000 guard training records that were maintained in FPS's Contract Guard Employment Requirements Tracking System (CERTS) and validated them against the contractual requirements that were in effect at the time of our review. To assess the reliability of the CERTS data, we interviewed agency officials about data quality, reviewed relevant documentation, and performed our own electronic testing of the data. Because CERTS was not fully reliable for our purpose of determining the extent to which there were guards with expired certifications or training records, we corroborated our findings using FPS regional spreadsheets and information provided by the contractors, or the actual guard files. To determine what actions, if any, FPS has taken against contractors for not complying with the terms of the contract, we reviewed the contract files for 7 of FPS's 38 guard contractors. We selected these 7 contractors because our previous work showed that they had contract compliance issues. In addition to reviewing FPS's contract files, we interviewed contracting officials in these locations to learn about what information should be included in the contract files. We also requested all contract evaluations for January 2006 through June 2009. We estimate that the number of guard contracts requiring a performance evaluation during this period would have totaled approximately 375. [Footnote 6] We analyzed a random sample of 99 FPS contractor evaluations to determine how FPS evaluated the performance of its contractors on an annual basis. We conducted covert testing at 10 judgmentally selected level IV facilities. The facilities were selected from FPS's most current listing of federal facilities by security level. The criteria for choosing these facilities include public access, location in a major metropolitan area, and level IV facility security level. The results of our audit work are not generalizable. However, almost 54 percent of FPS's 15,000 guards and 52 percent of the 2,360 facilities that have guards are located in the 6 regions where we conducted our audit work. Because of the sensitivity of some of the information in our report, we cannot provide information about the specific locations of the incidents discussed. To determine what actions, if any, FPS has taken to address challenges with managing its contract guard program, we reviewed new contract guard program guidance issued since our July 2009 testimony. We conducted follow-up site visits at 3 of the original 6 FPS regions that we visited and interviewed FPS officials, contractors, and guards who are responsible for implementing FPS's new contract guard program guidance. We also observed guard inspections and covert testing done by FPS in August and November 2009. We conducted this performance audit from July 2008 to February 2010 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Background: Since the 1995 bombing of the Alfred P. Murrah Federal Building in Oklahoma City, FPS has relied on a substantial contract guard force to help accomplish its mission of protecting federal facilities. The level of security FPS provides at each of the 9,000 federal facilities varies depending on the building's security level.[Footnote 7] While the contractor has the primary responsibility for training and ensuring that the guards have met certification requirements, FPS is ultimately responsible for oversight of the guards and relies on about 752 inspectors located in its 11 regions to inspect guard posts and verify that training, certifications, and time cards are accurate. It is also responsible for providing X-ray and magnetometer training to the guards. Figure 1 shows the location of FPS's 11 regions and the number of guards and federal facilities with guards in each of these regions, as of July 2009. Figure 1: Number of FPS Guards and Federal Facilities with Guards, by Region: [Refer to PDF for image: illustrated map of the U.S.] (1) New England Region: Guards: 4443; Federal facilities with guards: 101. (2) Northeast & Caribbean Region: Guards: 1,050; Federal facilities with guards: 185. (3) Mid-Atlantic Region: Guards: 1,356; Federal facilities with guards: 259. (4) Southeast Region: Guards: 1,801; Federal facilities with guards: 385. (5) Great Lakes Region: Guards: 1,396; Federal facilities with guards: 301. (6) The Heartland Region: Guards: 571; Federal facilities with guards: 135. (7) Greater Southwest Region: Guards: 1,476; Federal facilities with guards: 294. (8) Rocky Mountain Region: Guards: 359; Federal facilities with guards: 132. (9) Pacific Rim Region: Guards: 1,022; Federal facilities with guards: 292. (10) Northwest/Arctic Region: Guards: 369; Federal facilities with guards: 111. (11) National Capital Region: Guards: 2,998; Federal facilities with guards: 165. Sources: GAO analysis of FPS data and Map Resources (map). [End of figure] Some of the key responsibilities of FPS's guards include controlling access, enforcing property rules and regulations, detecting and reporting criminal acts, and responding to emergency situations involving the safety and security of the facility. Guards may only detain, not arrest, an individual, and their authority typically does not extend beyond the facility. Before guards are assigned to a post or an area of responsibility at a federal facility, FPS requires that they all undergo background suitability checks and complete approximately 128 hours of training provided by the contractor or FPS, including 8 hours of X-ray and magnetometer training. Guards must also pass an FPS-administered written examination and possess the necessary certificates, licenses, and permits as required by the contract. FPS also requires its guards to complete 40 hours of refresher training every 2 to 3 years, depending on the terms of the contract. Some states also require that guards obtain additional training and certifications. In addition, in response to our July 2009 report, in August 2009, FPS revised its X-ray and magnetometer training requirements and began requiring its guards to watch a 15-minute digital video disc (DVD) on bomb component detection that addresses types of bombs, bomb components, abnormal behavioral such as apprehension or nervousness, and actions to take if a bomb threat is detected. FPS also requires the contractor to ensure that all guards view this DVD when they receive refresher training, which occurs every 2-3 years after the basic training. As of October 2009, FPS had 125 guard contracts with 38 different contractors.[Footnote 8] The majority of FPS guard service contracts are for routine security services at federal facilities and are for a 12-month base period. They also have four 12-month options. FPS's contractors are responsible for providing and maintaining all guard services as described in the contract statement of work, including: * management, * supervision, * training, * equipment, * supplies, and: * licensing. FPS has three Consolidated Contracting Groups (CCG) located in Philadelphia, Pennsylvania; Grand Prairie, Texas; and Federal Way, Washington, that provide contracting support for guard services and other FPS mission-related acquisitions. Within the CCGs, 43 warranted contracting officers are dedicated to FPS contracts. After awarding a contract, the contracting officers are responsible for enforcing the terms and conditions of the guard contracts, including authorizing and negotiating any changes to the contract. Each year the contracting officer is required to perform an annual review of the contract and take enforcement action if the services have not been provided, in accordance with the terms of the contract.[Footnote 9] The contracting officer also issues modifications and ensures proper payments are made in accordance with the contract. In addition to the 43 warranted contracting officers, approximately 60 Contracting Officer Technical Representatives (COTR) work with the contracting officers to complete annual contractor performance evaluations and determine if a contract option should be exercised. COTRs are responsible for daily contract oversight, assessing a contractor's performance, and ensuring that the contractor is meeting all training, certification, and suitability requirements. Many of the COTRs are current or former inspectors and may have other job duties in addition to their COTR responsibilities, depending on their regional resource alignment. FPS's inspectors are also involved in the oversight of contract guards. The inspectors help the COTRs oversee guards and contractors. For example, the COTR relies on inspectors to perform guard inspections and report any problems with respect to the performance of guards on post to the COTR. Finally, FPS has a contract guard program manager in each of its 11 regions who is responsible for coordinating with the contracting officers and the COTRs to ensure that performance monitoring and reporting are being used to ensure continuous high- quality contractor performance in their regions. FPS Faces Challenges Managing Its Guard Contractors That Hamper Its Ability to Protect Federal Facilities: Some FPS Guard Contractors Did Not Always Comply with the Terms of Contracts: FPS continues to face challenges with overseeing its guard contractors that hamper its ability to protect federal facilities. FPS generally requires its contractors to provide guards who have completed the training and certification requirements shown in table 1. The most notable area where FPS contract requirements vary is regarding X-ray and magnetometer training. For example, for 3 of the 7 contractors we reviewed, FPS's contracts do not require X-ray and magnetometer training if the guards were not assigned to an access control point. In contrast, guards employed by the other 4 contractors we reviewed were required to receive X-ray and magnetometer training regardless of their duty station. Table 1: Guard Training and Certifications Required by FPS Contracts: Training: Contractor provided: * 64 hours of basic training; * 32 hours of live firearms training; * 8 hours of classroom firearms training; * 8 hours of basic baton training; Training: FPS provided: * 8 hours of government training; * 8 hours of X-ray and magnetometer training; * 40 hours of refresher training (including X-ray and magnetometer) every 2 to 3 years; Certifications: * DHS background investigation; * Medical examination certificate; * Domestic violence declaration; * Passing score on written examination; * Firearms qualification certificate; * Expandable/straight baton training certificate; * Cardiopulmonary resuscitation (CPR) training certificate; * Basic training certificate; * Firearms training certificate; * Government-provided training certificate; * Magnetometer/X-ray training certificate; * First aid training certificate. Source: FPS. [End of table] On the basis of our review of FPS's contractual requirements and guard training and certification records maintained by FPS and/or the contractor, we reported in July 2009 that 62 percent, or 411, of the 663 guards employed by 7 of FPS's 38 guard contractors and subsequently deployed to a federal facility had at least one expired certification. Examples of expired certifications included firearms qualification, background investigation, domestic violence declaration, CPR, or first aid training certification. More specifically, we also found that over 75 percent of the 354 guards at one level IV facility had expired certifications or the contractor had no record of the training. According to the contractor information for another contract, almost 40 percent of the 191 guards at another level IV facility had domestic violence declarations that had expired. Guards are not permitted to carry firearms unless they have such declarations. Since our July 2009 report, we have requested information from FPS to determine whether the status of these guards' certifications had changed. FPS's data showed that of the 663 guards, 435 are now fully certified and trained, 167 are not fully certified and trained, and 61 guards are no longer working on the contract. We also testified in July 2009 that some guard contractors were not providing building-specific training, such as on actions to take during a building evacuation or a building emergency. This lack of training may have contributed to several incidents in which guards neglected their assigned responsibilities. For example, * At a level IV facility, the guards did not follow evacuation procedures and left two access points unattended, thereby leaving the facility vulnerable. * At a different level IV facility, a guard allowed employees to enter the building while an incident involving suspicious packages was being investigated. * At a level III facility, a guard allowed employees to access an area that was required to be evacuated because of a suspicious package. In addition to receiving insufficient building-specific training, guards generally said that they did not receive scenario-based training and thus were not sure what they should do in certain situations. During our site visits at 6 FPS regions, we interviewed over 50 guards and presented them with an incident that occurred at a federal facility in 2008. Specifically, we asked the guards whether they would assist an FPS inspector chasing an individual escaping from a federal facility in handcuffs.[Footnote 10] According to FPS policies and in accordance with contract requirements, contract guards are responsible for detecting, delaying, detaining, or apprehending persons attempting to gain unauthorized access to government property or otherwise violating laws, rules, and regulations. The guards' responses varied, however. Some guards stated that they would assist the FPS inspector and apprehend the individual, while others stated that they would likely do nothing and stay at their posts because they feared being fired for leaving their posts. Some guards also told us that they would not intervene because of the threat of a liability lawsuit for use of force and did not want to risk losing their jobs. Moreover, guards employed by some contractors were not always complying with post orders once they were deployed to federal facilities. FPS's post orders describe a number of things that guards are prohibited from doing while on post. For example, guards are prohibited from sleeping, using government property such as computers, and test-firing a weapon unless at a range course. However, as we testified in July 2009, when FPS routinely inspects guard posts, it has found incidents at level IV facilities where guards were not complying with post orders, including the following: * A guard was caught using government computers while he was supposed to be standing post, to further his private for-profit adult Web site. * A guard attached a motion sensor to a pole at the entrance to a federal facility garage to alert him whenever a person was approaching his post. Another law enforcement agency discovered the device and reported it to FPS. * A guard, during regular business hours, accidentally fired his firearm in a restroom while practicing drawing his weapon. * A guard failed to recognize or did not properly X-ray a box containing semiautomatic handguns at the loading dock at one federal facility we visited. FPS became aware of the situation only because the handguns were delivered to FPS. In each of these incidents, the guards were fired or disciplined. However, FPS continues to find instances where guards are not complying with post orders. For example, 2 days after the July 2009 hearing, another guard fired his firearm in a restroom in a level IV facility while practicing drawing his weapon. FPS Has Not Taken Actions against Some Contractors for Not Meeting the Terms of the Contract: FPS has not taken actions against some guard contractors that did not comply with the terms of the contracts. According to FPS guard contracts, a contractor has not complied with the terms of the contract if the contractor has a guard working without valid certifications or background suitability investigations, falsifies a guard's training records, does not have a guard at a post, or has an unarmed guard working an armed post. If FPS determines that a contractor does not comply with these contract requirements, it can-- among other things--assess a financial deduction for nonperformed work; elect not to exercise a contract option; or terminate the contract for default or cause. Deductions are one type of action FPS may use to address contractor nonperformance issues. We reviewed the official contract files for the 7 contractors who, as we testified in July 2009, had guards performing on contracts with expired certification and training records to determine what action, if any, FPS had taken against these contractors for contract noncompliance. According to the documentation in the contract files, FPS did not take any enforcement action against them for not complying with the terms of the contract, a finding consistent with DHS's Inspector General's 2009 report.[Footnote 11] In fact, FPS exercised the option to extend the contracts of these 7 contractors. FPS contracting officials told us that the contracting officer who is responsible for enforcing the terms of the contract considers the appropriate course of action among the available contractual remedies on a case-by-case basis. For example, the decision of whether to assess financial deductions is a subjective assessment in which the contracting officer and the COTR take into account the value of the nonperformance and the seriousness of the deficiency, according to FPS contracting officials. According to FPS's Acquisitions Division Director, financial deductions are rarely taken for contract noncompliance and when they are the amount is generally insignificant. FPS Did Not Always Comply with Its Procedures for Completing Annual Performance Evaluations: FPS requires that a performance evaluation be completed annually and at the conclusion of the contract for those contracts exceeding $100,000. Contractor performance evaluations are one of the most important tools available for ensuring that the contractor meets the terms of the contract. According to contracting officials, monetary deductions do little to change contractor behavior, but contractors recognize the importance of evaluations and that FPS uses them to help determine whether to extend the contract. FPS policy also requires contracting officials to consider past performance as one of several technical evaluation factors in awarding new contracts. In addition, given that other federal agencies rely on many of the same contractors to provide security services, the need to complete accurate evaluations of a contractor's past performance is critical. FPS's contracting officers and COTRs did not always evaluate contractors' performance as required, and some evaluations were incomplete and not consistent with contractors' performance. We reviewed a random sample of 99 contract performance evaluations from calendar year 2006 through June 2009. These evaluations were for 38 contractors. Eighty-two of the 99 contract performance evaluations showed that FPS assessed the quality of services provided by the majority of its guard contractors as "satisfactory," "very good," or "exceptional." For the remaining 17 evaluations, 11 showed that the contractor's performance was "marginal," 1 as "unsatisfactory," and assessments for 5 contractors were not complete. According to applicable guidance, a contractor must meet contractual requirements to obtain a satisfactory evaluation and a contractor should receive an unsatisfactory evaluation if its performance does not meet most contract requirements and recovery in a timely manner is not likely. [Footnote 12] Nevertheless, we found instances where some contractors received a satisfactory or better rating although they had not met some of the terms of the contract. For example, contractors receiving satisfactory or better ratings included the 7 contractors that had guards with expired certification and training records working at federal facilities. In addition, some performance evaluations that we reviewed did not include a justification for the rating and there was no other supporting documentation in the official contract file to explain the rating. Moreover, there was no information in the contract file that indicated that the COTR had communicated any performance problems to the contracting officer. FPS Did Not Always Comply with Procedures for Maintaining Contract Files: FPS's contracting officials told us that the contract files should contain annual performance evaluations. In addition, if a contractor has not met the terms of the contract, the contract file should also contain guard inspection reports and correspondence between the contracting officer and contractor, and any other written reports that can be used to evaluate the contractor's performance in meeting the terms of the contract. In addition, DHS's Office of Procurement Operations has also established procedures for preparing and organizing contract files and has provided contracting officials with a standard checklist to identify the documentation required in each stage of the contract award life cycle. According to this checklist, the contract file should contain information about performance monitoring, quality assurance records, and evaluations of contractor performance for contracts over $100,000. The Federal Acquisition Regulation (FAR) also prescribes requirements for establishing, maintaining, and disposing of contract files. It requires the head of each office that performs contracting, contract administration, or payment functions to establish files containing records of all contractual actions. FPS's CCGs did not follow these procedures for the contract files we reviewed. Specifically, our review of the official contract files for the 7 contractors who had guards with expired training and certification records working at federal facilities showed that the files were poorly documented, did not contain all of the required performance-related information, and varied among the CCGs. For example, contract files for 5 of the 7 contractors we reviewed did not have guard inspection reports, justifications for extending the contract, or annual performance evaluations. Without the performance- related information, FPS has difficulty deciding whether to exercise a contract option. Moreover, because federal agencies rely on many of the same contractors to provide security services, the need to consistently document contractor performance is important in determining future contracts. FPS Faces Challenges with Overseeing Guards That Raise Concern about Protection of Federal Facilities: FPS Is Not Providing All Guards with X-ray and Magnetometer Training in Some Regions: While FPS has given its guard contractors the responsibility to conduct most of the training of guards, FPS is responsible for conducting the 8 hours of X-ray and magnetometer training that all guards are required to have. However, as we reported in July 2009, FPS was not providing some of its guards with all of the required training in the six regions we visited. For example, in one region, FPS has not provided the required X-ray or magnetometer training to its almost 1,500 guards since 2004. X-ray and magnetometer training is important because the majority of the guards are primarily responsible for using this equipment to monitor and control access points at federal facilities. Controlling access to a facility helps ensure that only authorized personnel, vehicles, and materials are allowed to enter, move within, and leave the facility. In the absence of the X-ray and magnetometer training, one contractor in the region said that it is relying on veteran guards who have experience operating these machines to provide some on-the-job training to new guards. FPS officials subsequently told us that the contract for this region requires that only guards who are assigned to work on posts that contain screening equipment are required to have 8 hours of X-ray and magnetometer training. However, in response to our July 2009 testimony, FPS now requires all guards to receive 16 hours of X-ray and magnetometer training. As of January 2010, these guards had not received the 16 hours of training but continued to work at federal facilities in this region. FPS plans to provide X-ray and magnetometer training to all guards by the end of 2010. Lapses and weaknesses in FPS's X-ray and magnetometer training have contributed to several incidents at federal facilities in which the guards neglected to carry out their responsibilities. For example, at a level IV federal facility in a major metropolitan area, an infant in a carrier was sent through the X-ray machine. Specifically, according to an FPS official in that region, a woman with her infant in a carrier attempted to enter the facility, which has child care services. While retrieving her identification, the woman placed the carrier on the X-ray machine.[Footnote 13] Because the guard was not paying attention and the machine's safety features had been disabled, causing the belt to operate continuously, the infant in the carrier was sent through the X-ray machine. FPS investigated the incident and dismissed the guard. However, the guard subsequently sued FPS for not providing the required X-ray training. The guard won the suit because FPS could not produce any documentation to show that the guard had received the training, according to an FPS official. FPS Lacks Assurance That Its Guards Have Required Certifications: As we reported in July 2009, FPS's primary system--CERTS--for monitoring and verifying whether guards have the training and certifications required to stand post at federal facilities is not fully reliable. Moreover, five of the six regions we visited did not have current information on guard training and certifications. Guard contractors are responsible for maintaining the status of each element of the guards' certifications, such as firearms qualification, domestic violence certification, and first aid training. These certifications are subsequently entered into and tracked in CERTS by FPS personnel in the regional program offices. According to FPS officials in these five regions, updating CERTS is time-consuming and they do not have the resources needed to keep up with the thousands of paper files. Consequently, these five regions were not generally relying on CERTS and instead were relying on the contractor to self- report training and certification information about its guards. Not having a fully reliable system to better track whether training has occurred may have contributed to a situation in which a contractor allegedly falsified training records. As we reported last summer, in 2007, FPS was not aware that a contractor who was responsible for providing guard service at several level IV facilities in a major metropolitan area had allegedly falsified training records until it was notified by an employee of the company. According to FPS's affidavit, the contractor allegedly repeatedly self-certified to FPS that its guards had satisfied CPR and first aid training requirements, as well as the contractually required biannual recertification training, although the contractor knew that the guards had not completed the required training and were not qualified to stand post at federal facilities. According to FPS's affidavit, in exchange for a $100 bribe, contractor officials provided a security guard with certificates of completion for CPR and first aid. The case is currently being litigated in U.S. District Court. FPS Has Limited Assurance That Guards Are Complying with Post Orders once They Are Deployed to Federal Facilities: FPS has limited assurance that its 15,000 guards are complying with post orders. As we testified in July 2009, we identified substantial security vulnerabilities related to FPS's guard program. Each time they tried, our investigators successfully passed undetected through security checkpoints monitored by FPS guards with the components for an improvised explosive device (IED) concealed on their persons at 10 level IV facilities in four cities in major metropolitan areas. We planned additional tests but suspended them after achieving 100 percent test results, which highlighted the vulnerabilities federal facilities face. The specific components for this device, items used to conceal the device components, and the methods of concealment that we used during our covert testing are classified, and thus are not discussed in this report. Of the 10 level IV facilities we penetrated, 8 were government owned and 2 were leased facilities. The facilities included field offices of a U.S. Senator and a U.S. Representative as well as agencies of the Departments of Homeland Security, Transportation, Health and Human Services, Justice, and State, and others. The 2 leased facilities did not have any guards at the access control point at the time of our testing. In August 2009, FPS told us that the 2 leased facilities did not have guards because the facilities were recently reclassified from a level IV to level II based on the new Interagency Security Committee security standards. Using publicly available information, our investigators identified a type of device that a terrorist could use to cause damage to a federal facility and threaten the safety of federal workers and the general public. The device was an IED made up of two parts--a liquid explosive and a low-yield detonator--and included a variety of materials not typically brought into a federal facility by employees or the public. Although the detonator itself could function as an IED, investigators determined that it could also be used to set off a liquid explosive and cause significantly more damage. To ensure safety during this testing, we took precautions so that the IED would not explode. For example, we lowered the concentration level of the material.[Footnote 14] To gain entry into each of the 10 level IV facilities, our investigators showed photo identification (state driver's licenses) and walked through the magnetometer machines without incident. The investigators also placed their briefcases with the IED material on the conveyor belts of the X-ray machines, but the guards detected nothing. Furthermore, our investigators did not receive any secondary searches from the guards that might have revealed the IED material that we brought into the facilities. At security checkpoints at 3 of the 10 facilities, our investigators noticed that the guard was not looking at the X-ray screen as some of the IED components passed through the machine. A guard questioned an item in the briefcase at 1 of the 10 facilities, but the materials were subsequently allowed through the X-ray machine. At each facility, once past the guard screening checkpoint, our investigators proceeded to a restroom and assembled the IED. At some of the facilities, the restrooms were locked. Our investigators gained access by asking employees to let them in. With the IED completely assembled in a briefcase, our investigators walked freely around several floors of the facilities and into various executive and legislative branch offices. In addition, recent FPS penetration testing--similar to the covert testing we conducted in May 2009--showed that guards continued to experience problems with complying with post orders. Since July 2009, FPS has conducted 53 penetration tests in the six regions we visited. The guards identified the prohibited items (guns, knives, and fake bombs) in 18 tests but did not identify the items in 35 tests. More specifically, in August 2009, we accompanied FPS on 2 of these penetration tests at a level IV facility. During 1 test, FPS agents placed a bag containing a fake gun and knife on the X-ray machine belt. The guard failed to identify the gun and knife on the X-ray screen, and the undercover FPS official was able to retrieve his bag and proceed to the check-in desk without incident. During a second test, a knife was hidden on an FPS officer. During the test, the magnetometer detected the knife, as did the hand wand, but the guard failed to locate the knife and the FPS officer was able to gain access to the facility. According to the FPS officer, the guards who failed the test had not been provided the required X-ray and magnetometer training. Upon further investigation, only 2 of the 11 guards at the facility had the required X-ray and magnetometer training. In response to the results of this test, FPS debriefed the contractor and moved one of the guard posts to improve access control. In November 2009, we accompanied FPS on another test of security countermeasures at a different level IV facility. As in the previous test, a FPS agent placed a bag containing a fake bomb on the X-ray machine belt. The guard operating the X-ray machine did not identify the fake bomb and the inspector was allowed to enter the facility with it. In a second test, a FPS inspector placed a bag containing a fake gun on the X-ray belt. The guard identified the gun and the FPS inspector was detained. However, the FPS inspector was told to stand in a corner and was not handcuffed or searched as required. In addition, while all the guards were focusing on the individual with the fake gun, a second FPS inspector walked through the security checkpoint with two knives without being screened. In response to the results of this test, FPS suspended 2 guards and provided additional training to 2 guards. Recent Actions Taken by FPS May Help Improve Oversight of the Contract Guard Program: FPS Is Increasing Guard Inspections at Facilities in Some Metropolitan Areas, while the Number of Inspections at Other Facilities May Not Increase: In response to our July 2009 testimony, FPS has increased the number of guard inspections at federal facilities in some metropolitan areas. [Footnote 15] FPS currently requires two guard inspections to be completed a week at level IV facilities. Prior to this new requirement, FPS did not have a national requirement for guard inspections, and each region we visited had requirements that ranged from no inspection requirements to each inspector having to conduct five inspections per month. Overall, FPS's data show that the number of guard inspections has increased nearly 40 percent, from 4,639 inspections in July 2009 to 6,501 in October 2009. However, about 54 percent of these inspections occurred either at level IV facilities or in metropolitan areas and not in rural areas, where we found that guard inspections are rarely done. In our 2008 report, we found incidents in which guards deployed to federal facilities in rural areas had not been inspected in over 1 year or where the inspections were done over the telephone, instead of in person. In addition, while FPS's Director authorized overtime to complete the additional inspections, previous funding challenges that resulted in FPS limiting overtime raise questions about whether it will be able to continue to authorize overtime to fund these increased inspections. Moreover, concerns remain about the quality of guard inspections. According to officials in one region, guard program officials recently provided training for inspectors on how to conduct and document guard inspections. However, despite this training, program officials said that the quality of the guard inspections and reports remains inconsistent. The guard inspection reports are one of the key factors FPS uses to assess a contractor's performance. FPS Is Modifying X-ray and Magnetometer Training Requirements for Inspectors and Guards, but Has Not Addressed Other Training Issues: FPS is in the process of providing additional X-ray and magnetometer training, in response to our July testimony, but guards will not be fully trained until the end of 2010. FPS plans to train its inspectors--who will subsequently be responsible for training the guards--first. Under the new program, FPS will require inspectors to receive 30 hours of X-ray and magnetometer training and guards to receive 16 hours of training. Prior to this new requirement, FPS required guards to receive 8 hours of training on X-ray and magnetometer machines. In July 2009, FPS also required each guard to watch a government-provided DVD on bomb component detection by August 20, 2009. According to FPS, as of January 2010, approximately 78 percent, or 11,711, of the 15,000 guards had been certified as having watched the DVD. While the changes FPS has made to its X-ray and magnetometer training will help to address some of the problems we found, there are some weaknesses in the guard training. For example, one contractor told us that one of the weaknesses associated with FPS's guard training program is that it focuses primarily on prevention and detection but does not adequately address challenge and response.[Footnote 16] This contractor has developed specific scenario training and provides its guards on other contracts with an additional 12 hours of training on scenario-based examples, such as how to control a suicide bomber or active shooter situation, evacuation, and shelter in place. The contractor, who has multiple contracts with government agencies, does not provide this scenario-based training to its guards on FPS contracts because FPS does not require it. We also found that some guards were still not provided building-specific training, such as what actions to take during a building evacuation or a building emergency. According to guards we spoke to in one region, guards receive very little training on building emergency procedures during basic training or the refresher training. These guards also said that the only time they receive building emergency training is once they are on post. Consequently, some guards do not know how to operate basic building equipment, such as the locks or the building ventilation system, which is important in a building evacuation or building emergency. FPS Is Developing a New System to Monitor Guard Training and Certifications, but More Work Remains: In 2007, FPS began developing a new system to replace several legacy GSA systems including CERTS, Security Tracking System, and other systems associated with the facility security assessment program. The new system, referred to as the Risk Assessment Management Program (RAMP), is designed to be a central database for capturing and managing facility security, including the risks posed to federal facilities and the countermeasures that are in place to mitigate risk. It is also expected to enable FPS to manage guard certifications and to conduct and track guard inspections electronically as opposed to manually. RAMP will also allow FPS to produce regular reports on the status of guards and guard contracts and to address issues with guards and contractors as they arise. According to FPS officials, the first phase of RAMP training started in some regions in October 2009. However, as of December 2009, about half of the 752 inspectors had not received RAMP training. FPS also has experienced technical difficulties with RAMP, for example, server issues, and the system is not always available for use. Consequently, the 386 inspectors that were trained are not able to use RAMP and are doing guard inspections manually, a fact that increases the risk of inaccurate data. We are encouraged that FPS is attempting to replace some of its legacy GSA systems with a more reliable and accurate system. However, FPS has not fully addressed some issues associated with implementing RAMP. For example, we are concerned about the accuracy and reliability of the information that will be entered into RAMP. According to FPS, the agency plans to transfer data from several of its legacy systems, including CERTS, into RAMP. In July 2009, we testified on accuracy and reliability issues associated with CERTS. Since that time, FPS has taken steps to review and update all guard training and certification records. For example, FPS is conducting an internal audit of its CERTS database. As of February 2010, the results of that audit showed that FPS was able to verify the status for about 8,600 of its 15,000 guards. FPS is experiencing difficulty verifying the status of the remaining 6,400 guards, in part because it does not have a system to obtain reliable information on a real-time basis. Despite FPS's recent efforts, challenges remain. While RAMP is a step in the right direction, it is not fully operational. Equally important, RAMP will not put FPS in an effective position to provide the oversight and decision making that are necessary to ensure that its 15,000 guards deployed at federal facilities in metropolitan and rural areas, private contractors, and 1,225 full-time employees in headquarters and 11 regions are performing as required and achieving FPS's facility protection mission. We have previously reported that for an agency to effectively manage and control its operations, it must have relevant and reliable information relating to its mission on a real-time basis.[Footnote 17] FPS does not have this capability. FPS relies on its 11 regions to manage its contract guard program, including the collection and analysis of performance information. However, each of the 11 regions differs in how it manages, collects, and reports contract guard information. Without the ability to access contract guard information on a real-time basis, FPS cannot ensure appropriate oversight and accountability, or that the agency's facility protection mission is accomplished. In addition, since 2002, we and DHS's Inspector General have reported that oversight of the contract guard program is a challenge for FPS. [Footnote 18] For example, in 2008, we reported on the poor quality of contract guards and the lack of guard inspections. However, FPS has only recently begun addressing some of these challenges and has not undertaken a comprehensive review of the agency's use of contract guards to protect federal facilities since the bombing of Alfred P. Murrah Federal Building in 1995. We also identified a number of changes that have had a cascading impact on FPS's management of the contract guard program. Chief among them is FPS's decision to move to an inspector-based workforce. Under this approach, FPS eliminated its police officer position and is primarily using about 752 inspectors and special agents to oversee its 15,000 contract guards, provide law enforcement services, conduct building security assessments, and perform other duties as assigned. Many inspectors in the regions we visited stated that they are not provided sufficient time to complete guard inspections because FPS's priority is physical security activities, such as completing facility security assessments. The combined effect of recent changes and long-standing challenges has contributed to the poor oversight of the contract guard program, and we believe it indicates a need for a reassessment of the current approach to protect federal facilities and greater oversight. FPS also has not completed a workforce analysis to determine if its current staff of about 752 inspectors will be able to effectively complete the additional inspections as required and provide the X-ray and magnetometer training to 15,000 guards in addition to their current physical security and law enforcement responsibilities. Our previous work has raised questions about the wide range of responsibilities inspectors have and the quality of facility security assessments and guard oversight. According to the Director of FPS, while having more resources would help address the weaknesses in the guard program, the additional resources would have to be trained and thus could not be deployed immediately. Finally, according to the Director of FPS, the agency recognized that its guard program has long- standing challenges, and in response to recent concerns about the guard program identified by GAO and others, FPS contemplated assuming responsibility for all guard training and/or federalizing some guard positions at some federal facilities. However, FPS decided not to pursue federalizing guard positions because of the cost. While federalizing guard positions may not be cost-beneficial, we believe that given the long-standing challenges FPS faces with managing its guard program, it should continue to conduct research to determine if other options for protecting federal facilities may be more cost- beneficial. Conclusions: FPS continues to face challenges in ensuring that its $659 million guard program is effective in protecting federal facilities. While FPS has recently taken some actions, such as requiring more guard training and inspections, to address these long-standing challenges, guards employed by private contractors continue to neglect or inadequately perform their assigned responsibilities. We believe that FPS continues to struggle with managing its contract guard program in part because, although it has used guards to supplement the agency's workforce since the 1995 bombing of the Alfred P. Murrah Federal Building, it has not undertaken a comprehensive review of its use of guards to protect federal facilities to determine whether other options and approaches would be more cost-beneficial. FPS also has not acted diligently in ensuring that its guard contractors meet the terms of the contract and taking enforcement action when noncompliance occurs. In addition, we believe that FPS's overall approach to protecting federal facilities, coupled with many unresolved operational issues, has hampered its oversight of the contract guard program. The combined effect of these long-standing challenges suggests that FPS needs to do more to protect the over 1 million government employees and members of the public who visit federal facilities each year. Thus, we believe that among other things, FPS needs to reassess how it protects federal facilities and take a stronger role in overseeing contractor performance. We also believe that completing the required contract performance evaluations for its contractors and maintaining contract files will put FPS in a better position to determine whether it should continue to exercise contract options with some contractors. FPS's decision to increase guard inspections at federal facilities in metropolitan areas is a step in the right direction. However, it does not address issues with guard inspections at federal facilities outside metropolitan areas, which are equally vulnerable. Thus, without routine inspections of guards at these facilities, FPS has no assurance that guards are complying with their post orders. In addition, ensuring that its guards are adequately trained to respond to building-specific situations, for example, how to handle an evacuation or shelter in place situation at a federal facility, is equally important. The lack of building-specific and scenario-based training may have contributed to several incidents in which guards neglected their assigned responsibilities. Moreover, maintaining accurate and reliable data on whether the 15,000 guards deployed at federal facilities have met the training and certification requirements is important for a number of reasons. First, without accurate and reliable data, FPS cannot consistently ensure compliance with contract requirements and lacks information critical for effective oversight of its guard program. Second, given that other federal agencies rely on many of the same contractors to provide security services, the need to complete accurate evaluations of a contractor's past performance is critical to future contract awards. Finally, until FPS develops and implements a management tool, in addition to RAMP, that provides it with reliable contract guard data on a real-time basis, the agency will not be in an effective position to provide the oversight and decision making that are necessary to ensure that its 15,000 guards deployed at federal facilities in metropolitan and rural areas, private contractors, and 1,225 full-time employees in headquarters and 11 regions are performing as required and achieving FPS's facility protection mission. Recommendations for Executive Action: Given the long-standing and unresolved issues related to FPS's contract guard program and challenges in protecting federal facilities, employees, and the public who use these facilities, we recommend that the Secretary of Homeland Security direct the Under Secretary of NPPD and the Director of FPS to take the following eight actions: * identify other approaches and options that would be most beneficial and financially feasible for protecting federal facilities; * rigorously and consistently monitor guard contractors' and guards' performance and step up enforcement against contractors that are not complying with the terms of the contract; * complete all contract performance evaluations in accordance with FPS and FAR requirements; * issue a standardized record-keeping format to ensure that contract files have required documentation; * develop a mechanism to routinely monitor guards at federal facilities outside metropolitan areas; * provide building-specific and scenario-based training and guidance to its contract guards; * develop and implement a management tool for ensuring that reliable, comprehensive data on the contract guard program are available on a real-time basis; and: * verify the accuracy of all guard certification and training data before entering them into RAMP, and periodically test the accuracy and reliability of RAMP data to ensure that FPS management has the information needed to effectively oversee its guard program. Agency Comments and Our Evaluation: We provided a draft of this report to DHS for review and comment. DHS concurred with seven of the eight recommendations in this report. Regarding the report's recommendation--issue a standardized record- keeping format to ensure that contract files have required documentation--DHS concurred that contract files must have required documentation and did not concur that a new record-keeping format should be issued. DHS commented that written procedures already exist and are required for use by all DHS's Office of Procurement Operations staff and the components it serves, including NPPD. We believe that the policies referenced by DHS are a step in the right direction in ensuring that contract files have required documentation; however, although these policies exist, we found a lack of standardization and consistency in the contract files we reviewed among the three Consolidated Contract Groups. In response to this recommendation, DHS also commented it will conduct an internal audit of the contract files to determine the extent and quality of contract administration. We agree with this next step. In addition, while DHS agreed with our other recommendations, we are concerned that some of the steps it described may not address our recommendation--to develop a mechanism to routinely monitor guards at federal facilities outside metropolitan areas. In response to this recommendation, FPS commented that to provide routine oversight of guards in remote regions it will use an employee of a tenant agency (referred to as an Agency Technical Representative) who has authority to act as a representative of a COTR for day-to-day monitoring of contract guards. However, during the course of this review, several FPS regional officials told us that the Agency Technical Representatives were not fully trained and did not have an understanding of the guards' roles and responsibilities. These officials also said that the program may not be appropriate for all federal facilities. We believe that if FPS plans to use Agency Tenant Representatives to oversee guards, it is important that the agency ensures that the representatives are knowledgeable of the guards' responsibilities and are trained on how and when to conduct guard inspections as well as how to evacuate facilities during an emergency. Furthermore, while we support FPS's overall plans to better manage its contract guard program, we believe it is also important for FPS to have performance metrics to evaluate whether its planned actions are fully implemented and are effective in addressing the challenges it faces managing its contract guard program. DHS's comments are presented in appendix I. Finally, DHS provided technical clarifications, which we incorporated into the report as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to appropriate congressional committees, the Secretary of Homeland Security, and other interested parties. In addition, the report will be available at no charge on GAO's Web site at [hyperlink, http://www.gao.gov]. If you have any questions about this report, please contact me at (202) 512-2834 or goldsteinm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix II. Signed by: Mark L. Goldstein: Director, Physical Infrastructure Issues: List of Requesters: The Honorable Joseph L. Lieberman: Chairman: The Honorable Susan M. Collins: Ranking Member: Committee on Homeland Security and Governmental Affairs: United States Senate: The Honorable Daniel K. Akaka: Chairman: The Honorable George V. Voinovich: Ranking Member: Subcommittee on Oversight of Government Management, the Federal Workforce and the District of Columbia: Committee on Homeland Security and Governmental Affairs: United States Senate: The Honorable Bennie G. Thompson: Chairman: The Honorable Peter T. King: Ranking Member: Committee on Homeland Security: House of Representatives: The Honorable James L. Oberstar: Chairman, Committee on Transportation and Infrastructure: House of Representatives: The Honorable Eleanor Holmes Norton: Chairwoman: Subcommittee on Public Buildings, Economic Development, and Emergency Management: Committee on Transportation and Infrastructure: House of Representatives: [End of section] Appendix I: Comments from the Department of Homeland Security: U.S. Department of Homeland Security: Office of the Under Secretary: National Protection and Programs Directorate: Washington, DC 20528: March 26, 2010: Mr. Mark L. Goldstein: Director: Physical Infrastructure Issues: Government Accountability Office: 441 G Street, NW: Washington, DC 20548: Subject: GA0-10-341, Federal Protective Service's Contract Guard Program Requires More Oversight and Reassessment of Use of Contract Guards: Dear Mr. Goldstein: The Department of Homeland Security (DHS) appreciates the opportunity to review and comment on the U.S. Government Accountability Office's (GAO's) draft report referenced above. GAO provided several conclusions and made eight recommendations with regard to the current level of FPS contract guard compliance with training and qualifications requirements. The Department concurs with seven of the recommendations and non-concurs with one as referenced below. GAO Recommendation 1: Conduct research to identify other approaches and options that would be most beneficial and financially feasible for protecting federal buildings. Response: Concur. The Federal Protective Service (FPS) was created to designate a centralized provider of integrated security and law enforcement services to the federal community. Throughout its existence, FPS has remained flexible in implementing the variety of means used to accomplish its protective mission and has continually examined past actions, best practices, and available resources and technology to determine the best available means to protect federal facilities. Largely due to resource constraints, FPS' approaches and options to protecting federal facilities have focused efforts on providing more robust and analytical risk assessments, enhancing the training and oversight of protective security officers, and entering into various contracts to facilitate streamlining the implementation of countermeasures on a nationwide basis. FPS recently increased its interaction with the research and development community, through the DHS Science and Technology Directorate, to better define requirements for the next generation of security technology. FPS is simultaneously testing new developments in countermeasures to assess their maximum effectiveness as part of the integrated set of countermeasures. These initiatives are driven by the need to provide a comprehensive approach to facility protection that capitalizes on FPS' law enforcement knowledge and expertise in physical security within the framework of available resources to support mission requirements. GAO Recommendation 2: Rigorously and consistently monitor guard contractors and guards' performance and step up enforcement against contractors and/or guards that are not complying with the terms of the contract. Response: Concur. FPS continues to rigorously and consistently monitor guard contractors, and through the development and implementation of new policies and initiatives, FPS will strengthen its assurances that contract Protective Security Officer (PSO) providers are complying with the terms and conditions of their contracts. These policies and initiatives establish organizational responsibilities for post, site, and administrative inspections. As an example of the measures being taken to increase its oversight of contract compliance, FPS is increasing its minimum requirements for post inspection and administrative audits of individual PSO files from 10 percent annually to 10 percent monthly. Results of post inspections and administrative audits are entered into the Risk Assessment and Management Program (RAMP), allowing FPS to effectively monitor overall contractor performance by location, contract, and contract company. A number of other initiatives and programs have been implemented to improve contract guard oversight. Beyond certifying that guard personnel are qualified on paper to perform their assigned duties, FPS has developed and implemented a Covert Testing Program to further enhance and complement the ongoing efforts of FPS' operational oversight of the contract guard program. Policies have been revised to increase the number, frequency and scope of guard post, administrative, and site inspections. In addition to increasing the frequency of scheduled inspections. FPS increased the number of unannounced inspections by more than 100 percent during the past nine months. Finally, in addition to the increased monitoring of on-site performance of the contract security force, FPS has significantly increased its review of contract deliverables such as contractor quality control plans, supervision plans, and certification documentation, an action which better allows FPS to identify and take enforcement actions against contractors who are not meeting the terms of their contracts. GAO Recommendation 3: Complete all contract performance evaluations in accordance with FPS and FAR requirements. Response: Concur. DHS is prepared to implement this recommendation through strict adherence to applicable internal policy/procedure (DHS Office of Procurement Operations (OPO) Procurement Operating Procedure (POP) 40381, "Contractor Performance Assessment Reporting and Procedure") and capitalization of the knowledge and skills acquired by staff through the contractor performance assessment training. While staff training in this area is an ongoing DHS initiative, National Protection and Programs Directorate (NPPD) Contracting Officer Technical Representatives (COTRs) and OPO Contracting Officers have received (I) a web-based training session presenting an overview of the reporting requirements and the Contractor Performance Assessment Reporting System (CPARS) and (2) a classroom session with specific role-based instruction and live demonstration in CPARS, This training was provided during fourth quarter FY09 and first quarter FY10. DHS OPO Contracting Officers and NPPD/FPS COTRs have also been provided with copies of POP 403R1, CPARS Guidebooks tailored to their respective roles, and other tools to aid them in providing quality narratives within a contractor performance assessment. Furthermore, NPPD/FPS will ensure visibility of contractor performance assessments at the leadership level and will hold employees accountable for failure to promptly and properly complete contractor performance assessments. To this end, NPPD has implemented reporting requirements and will incorporate completion of contractor performance assessments into the performance goals of those employees responsible for this function. GAO Recommendation 4: Issue a standardized recordkeeping format to ensure that contract files have required documentation. Response: Non-concur. While both NPPD and DHS OPO concur that contract files must have required documentation, we do not concur that a new recordkeeping format should be issued. Written procedures already exist and are required for use by all DHS OPO staff and the components it services, including NPPD. These policies are set forth in the DHS OPO POP 301R1. "Contract File Checklists," and OPO POP 404R1, "Contracting Officer's Technical Representative (COTR) Roles, Responsibilities and Requirements." * POP 301R1 includes a standard contract file checklists which include pre-solicitation, solicitation, pre-award, award, post-award, contract administration, contract modification, deliver/task order, and close- out documentation requirements. * POP 301R1 requires that Contracting Officers and Contract Specialists include documents in files consistent with the checklists and further requires that supervisors monitor the consistency of documentation with standard checklists. * POP 404R1 requires COTRs to maintain a working file to document their actions and sets forth the minimum required contents of the COTR's working file. Standardized checklists are tools that aid the Contracting Officer in ensuring that all required documentation is in place and the extent of documentation required under those checklists is dictated by the nature, complexity, commercial availability, estimated value of the requirement, and the applicability of laws and regulations to that particular action. OPO also has an electronic took kit for more standardized contract administration available to Contracting Officers and Specialists. In response to this recommendation, .DHS OPO will conduct an internal audit of contract files to determine the extent and quality of contract administration. It is projected that this audit will occur in the first quarter of FY11. Prior to that time, OPO staff and NPPD COTRs will again be provided all applicable policies for proper file documentation and alerted to the upcoming audit. Upon review of internal audit findings, OPO will develop and/or provide training as needed. GAO Recommendation 5: Develop a mechanism to routinely monitor guards at federal facilities outside metropolitan areas. Response: Concur. To address this issue and to ensure routine monitoring of PSOs, FPS established aggressive schedules for conducting post inspections. For Level IV facilities, the inspection frequency is a minimum of two posts (any shift) weekly, without regard to the geographic location of the facility. Inspection results are immediately entered into RAMP, documenting the number of inspections by location and PSO. Additionally, to compensate for inadequate resources and to provide routine oversight of guards in remote regions, FPS developed and implemented the Agency Technical Representative Program. The Agency Technical Representative is an employee of a tenant agency who has the authority to act as a representative of a COTR for day-to-day monitoring of contract PSO performance. GAO Recommendation 6: Provide building specific and scenario based training and guidance to its contract guards. Response: Concur. FPS already uses a variety of tactics to provide building-specific and scenario-based information to contract guards but is also enhancing methods of delivery and measurement of retention. Following are several examples of current practices: * Basic Training and Written Examination — Basic training that is required for all contract guards includes instruction on a variety of scenarios that are common to contract guard functions. Grounded in the FPS Security Guard Information Manual (SLIM) content, after completing the course, contract guards must pass a written examination to demonstrate their mastery of the material. * Post Desk Books — As defined by FPS Policy FPS-08-003, post desk books are the complete operational reference book provided for each contract security guard post. The consistent structure and content required provides information that is building-specific and scenario- based. They include information ranging from the facility occupants and points of contact to procedures on how to respond to HAZMAT incidents. All contract guards are contractually required to be familiar with the content of these Desk Books prior to standing post. * Occupant Emergency Plan Guide — In 2007, FPS developed and published a comprehensive guide for the development of Occupant Emergency Plans (OEPs) by all Federal Departments and Agencies. The guide and its supplements contain templates for OEPs, which contain emergency- specific scenarios for prevention, protection, response, and recovery. This guide and its scenarios are used to develop the OEP containing specific procedures for the facility emergency response team and occupants and the procedures in the post orders that are specific to the actions required of the contract guards. FPS measures the knowledge of the contract guards through written examination, routine post inspections, and Operation Shield, a program in which unannounced inspections measure the effectiveness of the contract guards. To further enhance current capabilities to identify specific knowledge gaps, the inspection process will provide post- specific questions for the on-duty contract guards. Where knowledge gaps are identified, the enhanced specificity in the inspections will allow for more efficient and effective remediation for individual contract guards. It will also allow FPS to identify trends across companies or the country that could indicate changes are needed in content or instructional methodology. threats and needs arise. Recent examples include specific training on active shooter scenarios along with an intelligence bulletin associated with the shooting at the Las Vegas Courthouse, and training on techniques and procedures to detect weapons at screening posts. GAO Recommendation 7: Develop and implement a management tool for ensuring that reliable comprehensive data on the contract guard program is available on a real time basis. Response: Concur. FPS has incorporated a comprehensive guard management module into RAMP to provide reliable real time data on the contract PSO program. This module includes capabilities to record contract information centrally, maintain and update PSO information (including certifications), conduct post inspections, and align posts to facilities. These capabilities allow FPS to measure contractor performance continuously and take corrective actions as necessary. GAO Recommendation 8: Verify the accuracy of all guard certification and training data before entering into RAMP, and periodically test the accuracy and reliability of RAMP data to ensure that FPS management has the information needed to effectively oversee its guard program. Response: Concur. FPS applies several tactics to oversee and validate information pertaining to contractor certifications before and after entry into RAMP. Activities conducted before data entry range from monitoring of contractor-provided training and weapons qualifications to proctoring and scoring of the FPS written examination, FPS is also responsible for the entry of information associated with contractor suitability determinations. After data is entered through the electronic reporting of certifications by contractors, FPS conducts audits and inspections to test the accuracy and reliability of RAMP data to ensure that RAMP provides an up-to-date database from which to measure compliance with contract requirements. The FPS Risk Management Division is currently revising FPS directive 09-001, which details the site inspection and audit procedures of contractors. This policy will increase the requirement for audits from 10 percent of the files annually to 10 percent of the files monthly and provide prescriptive instructions on method, which will result in a more than 100 percent increase in frequency of record validation. In addition, FPS policy requires that FPS monitor contractor-provided training and weapons qualifications to ensure accuracy of content, delivery, and records. We appreciate the opportunity to comment on this draft report, and we look forward to working with you on future homeland security issues. Sincerely, Signed by: Rand Beers: Under Secretary: [End of section] Appendix II: GAO Contact and Staff Acknowledgments: GAO Contact: Mark L. Goldstein, (202) 512-2834 or goldsteinm@gao.gov: Acknowledgments: In addition to the contact name above, Tammy Conquest, Assistant Director; Jonathan Carver; John Cooney; Collin Fallon; Brandon Haller; Daniel Hoy; Susan Michal-Smith; and Josh Ormond made key contributions to this report. [End of section] Footnotes: [1] Funding for FPS is provided through revenues and collections charged to building tenants of properties protected by FPS. The revenues and collections are credited to FPS's appropriation and are available until expended for the protection of federally owned and leased buildings and for FPS operations. [2] While FPS does not use guards at the remaining 6,700 facilities under its protection, it uses other security countermeasures such as cameras and perimeter lighting to help protect these facilities. [3] Title 41 CFR Sections 102-74.435 and 102-74-440 identify and list items that are prohibited by law from being introduced into a federal facility except for law enforcement purposes and other limited circumstances. Those items are explosives, firearms, or other dangerous weapons. In addition, Facility Security Committees, which are composed of representatives of tenant agencies at federal facilities, have broad latitude in determining items in addition to those specifically prohibited by statute that can be prohibited in their facilities. [4] GAO, Homeland Security: Preliminary Results Show Federal Protective Service's Ability to Protect Federal Facilities Is Hampered by Weaknesses in Its Contract Security Guard Program, [hyperlink, http://www.gao.gov/products/GAO-09-859T] (Washington, D.C.: July 8, 2009). [5] In 2003, FPS transferred from GSA to DHS. FPS is responsible for providing physical security and law enforcement services to about 9,000 federal facilities, which are under the control or custody of GSA. [6] As of October 2009, FPS had 125 guard contracts with 38 different contractors. We requested that FPS provide us with contract performance evaluations from January 2006 through June 2009. On the basis of FPS's requirement that a contract evaluation be completed annually, we estimated that we should have received 375 contract evaluations for the 125 contracts over that 3-year time period. [7] According to the Department of Justice's 1995 Vulnerability Assessment Guidelines, there are five security levels. A level I facility is typically a small storefront-type operation such as a military recruiting office with 10 or fewer employees and a low volume of public contact. A level II facility has from 11 to 150 employees; a level III facility has from 151 to 450 employees and a moderate to high volume of public contact; a level IV facility has over 450 employees, a high volume of public contact, and includes high-risk law enforcement and intelligence agencies. FPS does not have responsibility for a level V facility such as the White House or the Central Intelligence Agency. [8] FPS acquires guard services using an indefinite delivery indefinite quantity contract or a blanket purchase agreement. An indefinite delivery indefinite quantity contract provides for an indefinite quantity of supplies or services during a fixed period of time, whereas a blanket purchase agreement is a simplified acquisition method that government agencies use to procure anticipated repetitive services or supplies from qualified sources of supply. [9] The Federal Acquisition Regulation also requires that agencies evaluate a contractor's performance for each contract that exceeds the simplified acquisition threshold at the time the work is completed and for agencies to provide interim evaluation for contracts, including options that exceed 1 year. FAR Subpart 42.15. [10] GAO, Homeland Security: The Federal Protective Service Faces Several Challenges That Hamper Its Ability to Protect Federal Facilities, [hyperlink, http://www.gao.gov/products/GAO-08-683] (Washington, D.C.: June 11, 2008). [11] The Inspector General found that FPS does not always take deductions against a contractor for services that are not provided in accordance with contract requirements. Department of Homeland Security, Office of Inspector General, Federal Protective Service Contract Guard Procurement and Oversight Process, OIG-09-51 (Washington, D.C.: April 6, 2009). [12] As part of DHS, FPS is required to use the Department of Defense Contractor Performance Assessment System (CPARS) to officially document its performance evaluations. CPARS requires the use of an adjectival rating scale by evaluators that includes ratings of "exceptional," "very good," "satisfactory," "marginal," and "unsatisfactory." [13] X-ray machines are hazardous because of the potential radiation exposure. In contrast, magnetometers do not emit radiation and are used to detect metal. [14] Tests that we performed at a national laboratory in July 2007 and in February 2006 clearly demonstrated that a terrorist using these devices could cause severe damage to a federal facility and threaten the safety of federal workers and the general public. Our investigators obtained the components for these devices at local stores and over the Internet for less than $150. [15] [hyperlink, http://www.gao.gov/products/GAO-09-859T]. [16] Challenge and response refers to being more proactive instead of reactive to an incident. [17] GAO, Internal Control Management and Evaluation Tool, [hyperlink, http://www.gao.gov/products/GAO-01-1008G] (Washington, D.C.: August 2001). [18] GAO, Building Security: Security Responsibilities for Federal Owned and Leased Facilities, [hyperlink, http://www.gao.gov/products/GAO-03-8] (Washington, D.C.: Oct. 31, 2002); Homeland Security: Transformation Strategy Needed to Address Challenges Facing the Federal Protective Service, [hyperlink, http://www.gao.gov/products/GAO-04-537] (Washington, D.C.: July 14, 2004); and [hyperlink, http://www.gao.gov/products/GAO-08-683]. See also Department of Homeland Security, Office of Inspector General, Federal Protective Service Needs to Improve its Oversight of the Contract Guard Program, OIG-07-05 (Washington, D.C.: Oct. 30, 2006), and OIG-09-51. [End of section] GAO's Mission: The Government Accountability Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to [hyperlink, http://www.gao.gov] and select "E-mail Updates." Order by Phone: The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s Web site, [hyperlink, http://www.gao.gov/ordering.htm]. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: E-mail: fraudnet@gao.gov: Automated answering system: (800) 424-5454 or (202) 512-7470: Congressional Relations: Ralph Dawn, Managing Director, dawnr@gao.gov: (202) 512-4400: U.S. Government Accountability Office: 441 G Street NW, Room 7125: Washington, D.C. 20548: Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov: (202) 512-4800: U.S. Government Accountability Office: 441 G Street NW, Room 7149: Washington, D.C. 20548: