This is the accessible text file for GAO report number GAO-03-315R 
entitled 'Homeland Security: CDC’s Oversight of the Select Agent 
Program' which was released on November 22, 2002.

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 


United States General Accounting Office: 
Washington, DC 20548: 

November 22, 2002: 

The Honorable Tommy G. Thompson: 
Secretary of Health and Human Services: 

Subject: Homeland Security: CDC’s Oversight of the Select Agent 

Dear Mr. Secretary: 

The intentional dissemination of anthrax in the U.S. mail last fall 
demonstrates the devastating effect a biological agent can have if it 
falls into the wrong hands. Exposures to anthrax-tainted mail resulted 
in five deaths and 17 other infections, as well as significant 
disruption to postal service and other government operations. The
sources from which terrorists can potentially obtain biological agents 
include public and private research laboratories located in the United 
States, and there is concern that the anthrax used in these incidents 
may have been obtained from federal or other domestic laboratories. 

In the Antiterrorism and Effective Death Penalty Act of 1996,[Footnote 
1] the Congress included provisions to regulate the transfer between 
laboratories of certain biological agents and toxins—called select 
agents—and required the Secretary of Health and Human Services (HHS) to 
issue regulations to implement these provisions. In response, HHS
established in 1997 the Laboratory Registration/Select Agent Transfer 
Program at the Centers for Disease Control and Prevention (CDC), which 
developed the current list of 42 select agents covered by the program. 
The Select Agent Program is responsible for regulating the transfer of 
select agents to limit their distribution to only those laboratories 
that have the appropriate safety and security controls for handling
biologic agents.[Footnote 2] Facilities interested in 
transferring—sending or receiving—select agents must be registered with 
CDC.[Footnote 3] To register, facilities must demonstrate in their
applications that they meet the conditions for safety and security and 
have legitimate research needs for the agents, and CDC may inspect 
facilities before and after registration to ensure compliance. 
Laboratories possessing but not transferring select agents are not 
subject to the act. 

In the wake of the anthrax incidents and mounting concerns about the 
potential for another bioterrorism attack, we have assessed CDC’s 
oversight of the Select Agent Program. We brought program weaknesses we 
identified to the immediate attention of CDC and HHS officials, who 
agreed that improvements were warranted. The purpose of this report is 
to summarize our findings and confirm your agreement to take prompt 
corrective action. 

In conducting our work, we evaluated the Select Agent Program’s 
operations by applying the criteria in the Office of Management and 
Budget’s (OMB) Circular A-123, Management Accountability and Control 
[Footnote 4] and in our Internal Control: Standards for Internal 
Control in the Federal Government,[Footnote 5] which lays out five 
standards of internal control. These five standards—control 
environment, risk assessment, control activities, information and 
communication, and monitoring[Footnote 6]—define the minimum level of 
quality acceptable for internal control in government. We also
reviewed the registration applications for a nongeneralizable 10 
percent random sample of Select Agent Program registrants and those 
registrants’ transfer forms, which are required for transferring select 
agents; all CDC laboratory inspection reports; information in CDC’s 
database on registered facilities and select agent transfers; and 
Select Agent Program policies and procedures. We interviewed program 
and management staff in CDC’s Select Agent Program in Atlanta, Ga., and 
in HHS. Additionally, we reviewed the Public Health Security and 
Bioterrorism Preparedness and Response Act of 2002. Our review was 
limited to CDC’s management of the Select Agent Program and does not 
include the actual shipments of select agents or the safety and 
security of registered facilities. In addition, consistent with the 
scope of the Select Agent Program, we did not assess the merits of the 
research conducted by program registrants. We conducted our review from
November 2001 through September 2002 in accordance with generally 
accepted government auditing standards. 

Results in Brief: 

As the agency responsible for identifying and controlling biological 
agents that have the potential to pose a severe threat to public health 
and safety, CDC can improve its management of the Select Agent Program 
to reduce the likelihood of unauthorized access to biological agents. 
During the course of our review, we identified and brought to the 
immediate attention of CDC and HHS officials areas in which program
oversight could be strengthened, including inspection and approval of 
facilities and monitoring of the transfer and shipment of select 
agents. To better position CDC to reasonably ensure that appropriate 
security and safety protections are in place for select agents, we made 
recommendations aimed at establishing proper internal control in 
accordance with OMB Circular A-123 over the Select Agent Program. In
discussing these recommendations with CDC officials, they concurred and 
noted improvements planned or already in progress. 


Biological agents pose a severe public health threat in our country if 
individuals or groups intent on harming the United States are able to 
obtain them. To better ensure the safe transfer of select agents, the 
Antiterrorism and Effective Death Penalty Act of 1996 required the 
Secretary of HHS to: 

* provide for safeguards to prevent access to such agents for use in 
domestic or international terrorism or for other criminal purposes; 

* provide for the establishment and enforcement of safety procedures 
for the transfer of the listed biological agents, including measures to 
ensure proper training and appropriate skills to handle agents and 
proper laboratory facilities to contain and dispose of agents; 

* establish and maintain a list of biological agents that have the 
potential to pose a severe threat to public health and safety; and; 

* provide for the establishment of procedures to protect the public 
safety in the event of an actual or potential illegal transfer of a 
biological agent. 

HHS established the Select Agent Program within the Office of External 
Activities under the Office of Health and Safety at CDC. Program 
funding has increased substantially since the program was established 
in 1997. Funding for fiscal year 2002 was originally $1 million. As a 
result of Public Law 107-117, enacted on January 10, 2002, an 
additional $3.6 million was made available to the program for fiscal 
year 2002. The program was authorized to fund 21 staff in fiscal year 
2002—up from 9 in fiscal year 2001. 

The regulations governing the Select Agent Program became effective on 
April 15, 1997.[Footnote 7] The regulations include six primary 
components: (1) a list of select agents that have the potential to pose 
a severe threat to public health and safety,[Footnote 8] (2) 
registration of facilities prior to the domestic transfer of select 
agents, (3) a process to document successful transfer of agents, (4) 
audit, quality control, and accountability mechanisms, (5) agent 
disposal requirements, and (6) research and clinical exemptions. 
[Footnote 9] 

To limit the distribution of select agents to laboratories with 
appropriate safety and security controls for handling biologic agents 
and a legitimate need for such agents, CDC requires U.S.-based research 
institutions, government agencies, universities, manufacturers, and 
other entities interested in transferring select agents to be 
registered.[Footnote 10] Registration is for 3 years. As part of the 
registration process, facilities must demonstrate in their applications 
that they meet the requirements delineated in Biosafety in 
Microbiological and Biomedical Laboratories (BMBL)[Footnote 11] for 
working with particular select agents. Such requirements include having 
proper laboratory and personal protective equipment, precautionary 
signage, and ventilation; controlled access; and biosafety operations 
manuals. Facilities must also describe the laboratory procedures that 
will be used, provide a laboratory floor plan where the select agent 
will be handled and stored, and describe how access will be limited to 
authorized personnel. In addition, facilities must describe the 
objectives of the work that requires the select agent. Each facility 
must identify a responsible facility official who is authorized to 
transfer and receive select agents on behalf of the facility. 
Individuals making false, fictitious, or fraudulent statements or 
representations on registration forms may be punished by a fine of up 
to $250,000, imprisonment up to 5 years, or both. Violations by 
organizations are punishable by a fine of up to $500,000 per 
violation.[Footnote 12] To ensure compliance with these requirements, 
the program established a goal of inspecting these facilities once 
during the 3-year registration period. Facilities may be inspected 
before and after registration, but there is no requirement that 
inspections be performed. 

In June 2002, the President signed into law the Public Health Security 
and Bioterrorism Preparedness and Response Act of 2002, which revises 
and expands the Select Agent Program.[Footnote 13] Among other 
requirements, the new law: 

* requires all facilities possessing select agents to register with the 
Secretary of HHS, not just those facilities sending or receiving select 
agents;[Footnote 14] 

* restricts access to biological agents and toxins by persons who do 
not have a legitimate need and who are considered a risk by federal law
enforcement and intelligence officials; 

* requires transfer registrations to include information regarding the
characterization of agents and toxins to facilitate their 
identification, including their source;[Footnote 15] 

* requires the creation of a national database with information on all
facilities and persons possessing, using, or transferring select 

* directs the Secretary of HHS to review and publish the select agent 
list biennially, making revisions as appropriate to protect the public; 

* requires the Secretary to impose more detailed and different levels of
security for different select agents based on their assessed level of 
threat to the public. 

Select Agent Program staff estimate that this new law could result in a 
tenfold expansion of their responsibilities because many more 
facilities possess select agents than those registered to transfer them 
so far. 

CDC Needs to Improve Internal Control Weaknesses to Better Manage the 
Select Agent Program: 

We found significant management weaknesses in CDC’s facility 
registration and transfer monitoring processes that impede effective 
program oversight. As discussed with CDC officials, we recommended that 
CDC establish proper internal control in accordance with OMB Circular A-
123. This would include improvements in the following areas: 

* inspection and approval of facilities registering to transfer select 

* monitoring of the transfer and shipment of select agents; 

* accuracy of CDC databases of registered facilities and select agent
transfers, and; 

* CDC organizational structure to improve oversight. 

HHS agreed with the need for these corrective actions and stated that 
improvements were already underway in some areas. Correcting these 
internal control weaknesses is essential to CDC’s ability to 
effectively oversee both the original and the expanded program required 
by the Public Health Security and Bioterrorism Preparedness and 
Response Act of 2002. Because of the urgent and potentially serious 
public health threat in our country if corrective action is not taken 
expeditiously, we will be conducting periodic work to follow up on your 
progress in implementing our recommendations. 

We are sending copies of this report to the Senate Committees on 
Appropriations; Governmental Affairs; and Health, Education, Labor, and 
Pensions; and the House Committees on Appropriations; Energy and 
Commerce; and Government Reform. We will also make copies available to 
others on request. In addition, the report will be available at no 
charge on GAO’s Web site at [hyperlink,]. If you or 
your staff have any questions, please contact me at (202) 512-7101. 

Sincerely yours, 

Singed by: 

Cynthia A. Bascetta: 
Director, Health Care: 


[End of section] 


Internal Controls: 

Our Internal Control: Standards for Internal Control in the Federal 
Government[Footnote 16] lays out the standards for internal control. 
Internal control is an integral part of a government organization's 
management that provides reasonable assurance that the following four 
objectives are being achieved: 

* operations are effective and efficient; 

* financial and other reporting is reliable; 

* applicable laws and regulations are complied with; and; 

* unauthorized acquisition, use, or disposition of an agency's assets is
prevented or detected. 

To achieve these four objectives, agencies should meet five standards 
for internal control in the federal government. Agencies should: 

* have an effective control environment; 

* conduct risk assessments; 

* implement control activities; 

* properly record information and communicate to management, and; 

* ensure monitoring. 

A brief explanation of each of the five standards for internal control 

Control Environment: 

Management and employees should establish and maintain an environment
throughout the organization that sets a positive and supportive 
attitude toward internal control and conscientious management. 

Risk Assessments: 

Agencies should provide for an assessment of risk the agency faces from 
both internal and external sources in accomplishing its mission. 

Control Activities: 

Agencies should establish and carry out specific control 
activities—policies, procedures, techniques, and mechanisms—that 
enforce management's directives to help ensure that actions are taken 
to address risks and to document critical events and transactions. 

Information and Communication Channels: 

Information should be recorded and communicated to management and 
others within the entity who need it and in a form and within a time 
frame that enable them to carry out their internal control and other 


Internal control monitoring should assess the quality of performance 
over time and ensure that the findings of audits and other reviews are 
promptly resolved. 

[End of section] 


[1] Pub. L. No. 104-132, § 511, 110 Stat. 1214, 1284-1285 (1996). 

[2] CDC oversees the domestic transfer and possession of select agents. 
The Commerce Department’s Bureau of Export Administration oversees a 
separate select agent export program for transfers outside the United 

[3] CDC’s own laboratories that transfer select agents must also 
register with the program and are subject to its requirements. 

[4] Office of Management and Budget, OMB Circular A-123, Management 
Accountability and Control, (Washington, D.C.: 1995). This document 
provides the specific requirements for assessing and reporting on 

[5] U.S. General Accounting Office, Internal Control: Standards for 
Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 
(Washington, D.C.: November 1999). The Federal Managers’ Financial 
Integrity Act of 1982 (FMFIA) requires us to issue standards for 
internal control in government. Among other things, the standards 
provide the overall framework for establishing and maintaining internal 

[6] See the enclosure of this report for a more detailed discussion of 
internal controls. 

[7] The regulations are set forth at 42 C.F.R. Part 72 (2002). 

[8] CDC’s select agent list consists of 42 viruses, bacteria, 
rickettsiae, fungi, and toxins. CDC worked with representatives of 
several countries, U.S. intelligence officials, and safety 
professionals to establish its list based on a list of biological 
agents for export control developed by the Australia Group—an informal 
network of 33 countries that aims to minimize the proliferation of 
chemical and biological weapons. 

[9] For example, vaccines at certain stages of clinical research and 
clinical specimens are exempt. 

[10] There are a number of circumstances under which a facility might 
want to send or receive a select agent. For example, some facilities 
have select agents that other facilities would need to conduct
research, such as vaccine development. 

[11] U.S. Department of Health and Human Services, Public Health 
Service, Centers for Disease Control and Prevention and National 
Institutes of Health, Biosafety in Microbiological and Biomedical
Laboratories, Fourth Edition (Washington, D.C.: May 1999). 

[12] 42 C.F.R. § 72.7. 

[13] Pub. L. No. 107-188, 116 Stat. 594, 637-647. 

[14] The law required all persons possessing select agents to register 
with HHS by September 10, 2002, and HHS issued guidance for how the 
notification of possession should be made in July 2002. 67 Fed.
Reg. 46,363 (2002). The department must promulgate regulations for the 
select agent program by December 9, 2002, to implement other 
requirements of the law. 

[15] According to the Conference Report accompanying the law, one 
purpose of the registration and database requirements is to collect 
sufficiently detailed information on the registered select agents so
that the database can differentiate between and within strains of a 
given agent or toxin. Such information should be in a format that 
public health and law enforcement officials can use to identify
the origin or source of an agent that is used to cause harm to the 
public. H.R. Conf. Rep. No. 107-481, at 121 (2002). 

[16] U.S. General Accounting Office, GAO/AIMD-00-21.3.1 (Washington, 
D.C.: November 1999). 

[End of section] 

GAO's Mission: 

The General Accounting Office, the investigative arm of Congress, 
exists to support Congress in meeting its constitutional 
responsibilities and to help improve the performance and accountability 
of the federal government for the American people. GAO examines the use 
of public funds; evaluates federal programs and policies; and provides 
analyses, recommendations, and other assistance to help Congress make 
informed oversight, policy, and funding decisions. GAO's commitment to 
good government is reflected in its core values of accountability, 
integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through the Internet. GAO's Web site [hyperlink,] contains abstracts and full-text files of current 
reports and testimony and an expanding archive of older products. The 
Web site features a search engine to help you locate documents using 
key words and phrases. You can print these documents in their entirety, 
including charts and other graphics. 

Each day, GAO issues a list of newly released reports, testimony, and 
correspondence. GAO posts this list, known as "Today's Reports," on its 
Web site daily. The list contains links to the full-text document 
files. To have GAO e-mail this list to you every afternoon, go to 
[hyperlink,] and select "Subscribe to e-mail alerts" 
under the "Order GAO Products" heading. 

Order by Mail or Phone: 

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to: 

U.S. General Accounting Office: 
441 G Street NW: 
Room LM: 
Washington D.C. 20548: 

To order by Phone: 

Voice: (202) 512-6000:
TDD: (202) 512-2537:
Fax: (202) 512-6061: 

To Report Fraud, Waste, and Abuse in Federal Programs: 


Web site: [hyperlink,]: 

Automated answering system: (800) 424-5454 or (202) 512-7470: 

Public Affairs: 

Jeff Nelligan, managing director, 
(202) 512-4800: 
U.S. General Accounting Office: 
441 G Street NW, Room 7149: 
Washington, D.C. 20548: