This is the accessible text file for GAO report number GAO-03-315R entitled 'Homeland Security: CDC’s Oversight of the Select Agent Program' which was released on November 22, 2002. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. GAO-03-315R: United States General Accounting Office: Washington, DC 20548: November 22, 2002: The Honorable Tommy G. Thompson: Secretary of Health and Human Services: Subject: Homeland Security: CDC’s Oversight of the Select Agent Program: Dear Mr. Secretary: The intentional dissemination of anthrax in the U.S. mail last fall demonstrates the devastating effect a biological agent can have if it falls into the wrong hands. Exposures to anthrax-tainted mail resulted in five deaths and 17 other infections, as well as significant disruption to postal service and other government operations. The sources from which terrorists can potentially obtain biological agents include public and private research laboratories located in the United States, and there is concern that the anthrax used in these incidents may have been obtained from federal or other domestic laboratories. In the Antiterrorism and Effective Death Penalty Act of 1996,[Footnote 1] the Congress included provisions to regulate the transfer between laboratories of certain biological agents and toxins—called select agents—and required the Secretary of Health and Human Services (HHS) to issue regulations to implement these provisions. In response, HHS established in 1997 the Laboratory Registration/Select Agent Transfer Program at the Centers for Disease Control and Prevention (CDC), which developed the current list of 42 select agents covered by the program. The Select Agent Program is responsible for regulating the transfer of select agents to limit their distribution to only those laboratories that have the appropriate safety and security controls for handling biologic agents.[Footnote 2] Facilities interested in transferring—sending or receiving—select agents must be registered with CDC.[Footnote 3] To register, facilities must demonstrate in their applications that they meet the conditions for safety and security and have legitimate research needs for the agents, and CDC may inspect facilities before and after registration to ensure compliance. Laboratories possessing but not transferring select agents are not subject to the act. In the wake of the anthrax incidents and mounting concerns about the potential for another bioterrorism attack, we have assessed CDC’s oversight of the Select Agent Program. We brought program weaknesses we identified to the immediate attention of CDC and HHS officials, who agreed that improvements were warranted. The purpose of this report is to summarize our findings and confirm your agreement to take prompt corrective action. In conducting our work, we evaluated the Select Agent Program’s operations by applying the criteria in the Office of Management and Budget’s (OMB) Circular A-123, Management Accountability and Control [Footnote 4] and in our Internal Control: Standards for Internal Control in the Federal Government,[Footnote 5] which lays out five standards of internal control. These five standards—control environment, risk assessment, control activities, information and communication, and monitoring[Footnote 6]—define the minimum level of quality acceptable for internal control in government. We also reviewed the registration applications for a nongeneralizable 10 percent random sample of Select Agent Program registrants and those registrants’ transfer forms, which are required for transferring select agents; all CDC laboratory inspection reports; information in CDC’s database on registered facilities and select agent transfers; and Select Agent Program policies and procedures. We interviewed program and management staff in CDC’s Select Agent Program in Atlanta, Ga., and in HHS. Additionally, we reviewed the Public Health Security and Bioterrorism Preparedness and Response Act of 2002. Our review was limited to CDC’s management of the Select Agent Program and does not include the actual shipments of select agents or the safety and security of registered facilities. In addition, consistent with the scope of the Select Agent Program, we did not assess the merits of the research conducted by program registrants. We conducted our review from November 2001 through September 2002 in accordance with generally accepted government auditing standards. Results in Brief: As the agency responsible for identifying and controlling biological agents that have the potential to pose a severe threat to public health and safety, CDC can improve its management of the Select Agent Program to reduce the likelihood of unauthorized access to biological agents. During the course of our review, we identified and brought to the immediate attention of CDC and HHS officials areas in which program oversight could be strengthened, including inspection and approval of facilities and monitoring of the transfer and shipment of select agents. To better position CDC to reasonably ensure that appropriate security and safety protections are in place for select agents, we made recommendations aimed at establishing proper internal control in accordance with OMB Circular A-123 over the Select Agent Program. In discussing these recommendations with CDC officials, they concurred and noted improvements planned or already in progress. Background: Biological agents pose a severe public health threat in our country if individuals or groups intent on harming the United States are able to obtain them. To better ensure the safe transfer of select agents, the Antiterrorism and Effective Death Penalty Act of 1996 required the Secretary of HHS to: * provide for safeguards to prevent access to such agents for use in domestic or international terrorism or for other criminal purposes; * provide for the establishment and enforcement of safety procedures for the transfer of the listed biological agents, including measures to ensure proper training and appropriate skills to handle agents and proper laboratory facilities to contain and dispose of agents; * establish and maintain a list of biological agents that have the potential to pose a severe threat to public health and safety; and; * provide for the establishment of procedures to protect the public safety in the event of an actual or potential illegal transfer of a biological agent. HHS established the Select Agent Program within the Office of External Activities under the Office of Health and Safety at CDC. Program funding has increased substantially since the program was established in 1997. Funding for fiscal year 2002 was originally $1 million. As a result of Public Law 107-117, enacted on January 10, 2002, an additional $3.6 million was made available to the program for fiscal year 2002. The program was authorized to fund 21 staff in fiscal year 2002—up from 9 in fiscal year 2001. The regulations governing the Select Agent Program became effective on April 15, 1997.[Footnote 7] The regulations include six primary components: (1) a list of select agents that have the potential to pose a severe threat to public health and safety,[Footnote 8] (2) registration of facilities prior to the domestic transfer of select agents, (3) a process to document successful transfer of agents, (4) audit, quality control, and accountability mechanisms, (5) agent disposal requirements, and (6) research and clinical exemptions. [Footnote 9] To limit the distribution of select agents to laboratories with appropriate safety and security controls for handling biologic agents and a legitimate need for such agents, CDC requires U.S.-based research institutions, government agencies, universities, manufacturers, and other entities interested in transferring select agents to be registered.[Footnote 10] Registration is for 3 years. As part of the registration process, facilities must demonstrate in their applications that they meet the requirements delineated in Biosafety in Microbiological and Biomedical Laboratories (BMBL)[Footnote 11] for working with particular select agents. Such requirements include having proper laboratory and personal protective equipment, precautionary signage, and ventilation; controlled access; and biosafety operations manuals. Facilities must also describe the laboratory procedures that will be used, provide a laboratory floor plan where the select agent will be handled and stored, and describe how access will be limited to authorized personnel. In addition, facilities must describe the objectives of the work that requires the select agent. Each facility must identify a responsible facility official who is authorized to transfer and receive select agents on behalf of the facility. Individuals making false, fictitious, or fraudulent statements or representations on registration forms may be punished by a fine of up to $250,000, imprisonment up to 5 years, or both. Violations by organizations are punishable by a fine of up to $500,000 per violation.[Footnote 12] To ensure compliance with these requirements, the program established a goal of inspecting these facilities once during the 3-year registration period. Facilities may be inspected before and after registration, but there is no requirement that inspections be performed. In June 2002, the President signed into law the Public Health Security and Bioterrorism Preparedness and Response Act of 2002, which revises and expands the Select Agent Program.[Footnote 13] Among other requirements, the new law: * requires all facilities possessing select agents to register with the Secretary of HHS, not just those facilities sending or receiving select agents;[Footnote 14] * restricts access to biological agents and toxins by persons who do not have a legitimate need and who are considered a risk by federal law enforcement and intelligence officials; * requires transfer registrations to include information regarding the characterization of agents and toxins to facilitate their identification, including their source;[Footnote 15] * requires the creation of a national database with information on all facilities and persons possessing, using, or transferring select agents; * directs the Secretary of HHS to review and publish the select agent list biennially, making revisions as appropriate to protect the public; and; * requires the Secretary to impose more detailed and different levels of security for different select agents based on their assessed level of threat to the public. Select Agent Program staff estimate that this new law could result in a tenfold expansion of their responsibilities because many more facilities possess select agents than those registered to transfer them so far. CDC Needs to Improve Internal Control Weaknesses to Better Manage the Select Agent Program: We found significant management weaknesses in CDC’s facility registration and transfer monitoring processes that impede effective program oversight. As discussed with CDC officials, we recommended that CDC establish proper internal control in accordance with OMB Circular A- 123. This would include improvements in the following areas: * inspection and approval of facilities registering to transfer select agents; * monitoring of the transfer and shipment of select agents; * accuracy of CDC databases of registered facilities and select agent transfers, and; * CDC organizational structure to improve oversight. HHS agreed with the need for these corrective actions and stated that improvements were already underway in some areas. Correcting these internal control weaknesses is essential to CDC’s ability to effectively oversee both the original and the expanded program required by the Public Health Security and Bioterrorism Preparedness and Response Act of 2002. Because of the urgent and potentially serious public health threat in our country if corrective action is not taken expeditiously, we will be conducting periodic work to follow up on your progress in implementing our recommendations. We are sending copies of this report to the Senate Committees on Appropriations; Governmental Affairs; and Health, Education, Labor, and Pensions; and the House Committees on Appropriations; Energy and Commerce; and Government Reform. We will also make copies available to others on request. In addition, the report will be available at no charge on GAO’s Web site at [hyperlink, http://www.gao.gov]. If you or your staff have any questions, please contact me at (202) 512-7101. Sincerely yours, Singed by: Cynthia A. Bascetta: Director, Health Care: Enclosure: [End of section] Enclosure: Internal Controls: Our Internal Control: Standards for Internal Control in the Federal Government[Footnote 16] lays out the standards for internal control. Internal control is an integral part of a government organization's management that provides reasonable assurance that the following four objectives are being achieved: * operations are effective and efficient; * financial and other reporting is reliable; * applicable laws and regulations are complied with; and; * unauthorized acquisition, use, or disposition of an agency's assets is prevented or detected. To achieve these four objectives, agencies should meet five standards for internal control in the federal government. Agencies should: * have an effective control environment; * conduct risk assessments; * implement control activities; * properly record information and communicate to management, and; * ensure monitoring. A brief explanation of each of the five standards for internal control follows. Control Environment: Management and employees should establish and maintain an environment throughout the organization that sets a positive and supportive attitude toward internal control and conscientious management. Risk Assessments: Agencies should provide for an assessment of risk the agency faces from both internal and external sources in accomplishing its mission. Control Activities: Agencies should establish and carry out specific control activities—policies, procedures, techniques, and mechanisms—that enforce management's directives to help ensure that actions are taken to address risks and to document critical events and transactions. Information and Communication Channels: Information should be recorded and communicated to management and others within the entity who need it and in a form and within a time frame that enable them to carry out their internal control and other responsibilities. Monitoring: Internal control monitoring should assess the quality of performance over time and ensure that the findings of audits and other reviews are promptly resolved. [End of section] Footnotes: [1] Pub. L. No. 104-132, § 511, 110 Stat. 1214, 1284-1285 (1996). [2] CDC oversees the domestic transfer and possession of select agents. The Commerce Department’s Bureau of Export Administration oversees a separate select agent export program for transfers outside the United States. [3] CDC’s own laboratories that transfer select agents must also register with the program and are subject to its requirements. [4] Office of Management and Budget, OMB Circular A-123, Management Accountability and Control, (Washington, D.C.: 1995). This document provides the specific requirements for assessing and reporting on controls. [5] U.S. General Accounting Office, Internal Control: Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999). The Federal Managers’ Financial Integrity Act of 1982 (FMFIA) requires us to issue standards for internal control in government. Among other things, the standards provide the overall framework for establishing and maintaining internal control. [6] See the enclosure of this report for a more detailed discussion of internal controls. [7] The regulations are set forth at 42 C.F.R. Part 72 (2002). [8] CDC’s select agent list consists of 42 viruses, bacteria, rickettsiae, fungi, and toxins. CDC worked with representatives of several countries, U.S. intelligence officials, and safety professionals to establish its list based on a list of biological agents for export control developed by the Australia Group—an informal network of 33 countries that aims to minimize the proliferation of chemical and biological weapons. [9] For example, vaccines at certain stages of clinical research and clinical specimens are exempt. [10] There are a number of circumstances under which a facility might want to send or receive a select agent. For example, some facilities have select agents that other facilities would need to conduct research, such as vaccine development. [11] U.S. Department of Health and Human Services, Public Health Service, Centers for Disease Control and Prevention and National Institutes of Health, Biosafety in Microbiological and Biomedical Laboratories, Fourth Edition (Washington, D.C.: May 1999). [12] 42 C.F.R. § 72.7. [13] Pub. L. No. 107-188, 116 Stat. 594, 637-647. [14] The law required all persons possessing select agents to register with HHS by September 10, 2002, and HHS issued guidance for how the notification of possession should be made in July 2002. 67 Fed. Reg. 46,363 (2002). The department must promulgate regulations for the select agent program by December 9, 2002, to implement other requirements of the law. [15] According to the Conference Report accompanying the law, one purpose of the registration and database requirements is to collect sufficiently detailed information on the registered select agents so that the database can differentiate between and within strains of a given agent or toxin. Such information should be in a format that public health and law enforcement officials can use to identify the origin or source of an agent that is used to cause harm to the public. H.R. Conf. Rep. No. 107-481, at 121 (2002). [16] U.S. General Accounting Office, GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999). [End of section] GAO's Mission: The General Accounting Office, the investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through the Internet. GAO's Web site [hyperlink, http://www.gao.gov] contains abstracts and full-text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as "Today's Reports," on its Web site daily. The list contains links to the full-text document files. To have GAO e-mail this list to you every afternoon, go to [hyperlink, http://www.gao.gov] and select "Subscribe to e-mail alerts" under the "Order GAO Products" heading. Order by Mail or Phone: The first copy of each printed report is free. Additional copies are $2 each. A check or money order should be made out to the Superintendent of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a single address are discounted 25 percent. Orders should be sent to: U.S. General Accounting Office: 441 G Street NW: Room LM: Washington D.C. 20548: To order by Phone: Voice: (202) 512-6000: TDD: (202) 512-2537: Fax: (202) 512-6061: To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: E-mail: fraudnet@gao.gov: Automated answering system: (800) 424-5454 or (202) 512-7470: Public Affairs: Jeff Nelligan, managing director, NelliganJ@gao.gov: (202) 512-4800: U.S. General Accounting Office: 441 G Street NW, Room 7149: Washington, D.C. 20548: