Recommendation: The Assistant General Counsel should provide additional information on the process OACP uses to investigate potential consumer protection violations, to assess risk, and to pursue enforcement actions and establish a timeframe for doing so. Such transparency could be provided through the handbook that OACP is currently drafting or through other public means such as providing additional information on its website. (Recommendation 1)

Agency: Department of Transportation: Office of Aviation Consumer Protection
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Assistant General Counsel should take steps to provide transparency and clarity into the results of OACP's enforcement of consume including investigations that do not result in a consent order. Such information could be aggregated data about cases, investigations, or warning letters. (Recommendation 2)

Agency: Department of Transportation: Office of Aviation Consumer Protection
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The SEC Chair should direct the Directors of the Division of Corporation Finance, Division of Enforcement, Office of Compliance Inspections and Examinations, and Office of Credit Ratings to develop written policies and processes to systematically assess the effectiveness of staff procedures (procedures applicable to staff who perform examinations of registered entities, enforcement investigations, and reviews of corporate financial securities filings). Examples of elements SEC could include in the policies and processes are the steps necessary to conduct such assessments, including time frames in which the assessments should be performed and reviewed; assignment of responsibilities related to the assessments; requirements for documenting assessments; and steps for staff to take to mitigate and report deficiencies identified as a result of the assessments. (Recommendation 1)

Agency: United States Securities and Exchange Commission
Status: Open

Comments: As of May 2020, SEC updated its Reference Guide for Compliance with Section 961 of the Dodd-Frank Act to require the Division of Corporation Finance, Division of Enforcement, Office of Compliance Inspections and Examinations, and Office of Credit Ratings to develop and maintain written policies and processes for conducting systematic assessments of the effectiveness of procedures applicable to the staff who perform examinations of registered entities, enforcement investigations, and reviews of corporate financial securities filings. The added requirement for each division and office to develop policies and processes is a positive step toward addressing this recommendation. However, until the divisions and offices establish such policies and processes, this recommendation remains open. SEC staff stated that the divisions and offices are currently working on developing their individual frameworks for assessing staff procedures and will likely be done by the end of fiscal year 2020. We will continue to monitor these efforts.

Recommendation: The Director of the Division of Corporation Finance should ensure that all internal supervisory controls include documentation requirements, detailed procedures, identified follow-up actions, implementation time frames, and assignment of control execution responsibility, in accordance with SEC guidance and federal internal control standards for implementing control activities through documented policies. (Recommendation 2)

Agency: United States Securities and Exchange Commission: Division of Corporation Finance
Status: Open

Comments: As of May 2020, SEC staff said that the Division of Corporation Finance is working to address this recommendation through its normal Risk and Control Matrix review process. Staff said that SEC would have an update for GAO in the Fall 2020. We will update the status of the recommendation when the Division of Corporation Finance provides documentation showing the implementation of responsive actions.

Recommendation: The Director of the Division of Enforcement should ensure that all internal supervisory controls include documentation requirements, detailed procedures, identified follow-up actions, implementation time frames, and assignment of control execution responsibility, in accordance with SEC guidance and federal internal control standards for implementing control activities through documented policies. (Recommendation 3)

Agency: United States Securities and Exchange Commission: Division of Enforcement
Status: Open

Comments: As of May 2020, SEC staff said that the Division of Enforcement is working to address this recommendation through its normal Risk and Control Matrix review process. Staff said that SEC would have an update for GAO in the Fall 2020. We will update the status of the recommendation when the Division of Enforcement provides documentation showing the implementation of responsive actions.

Recommendation: The Director of the Office of Compliance Inspections and Examinations should ensure that all internal supervisory controls include documentation requirements, detailed procedures, identified follow-up actions, implementation time frames, and assignment of control execution responsibility, in accordance with SEC guidance and federal internal control standards for implementing control activities through documented policies. (Recommendation 4)

Agency: United States Securities and Exchange Commission: Office of Compliance Inspections and Examinations
Status: Open

Comments: As of May 2020, SEC staff said that the Office of Compliance Inspections and Examinations is working to address this recommendation through its normal Risk and Control Matrix review process. Staff said that SEC would have an update for GAO in the Fall 2020. We will update the status of the recommendation when the Office of Compliance Inspections and Examinations provides documentation showing the implementation of responsive actions.

Recommendation: The Director of the Office of Credit Ratings should ensure that all internal supervisory controls include documentation requirements, detailed procedures, identified follow-up actions, implementation time frames, and assignment of control execution responsibility, in accordance with SEC guidance and federal internal control standards for implementing control activities through documented policies. (Recommendation 5)

Agency: United States Securities and Exchange Commission: Office of Credit Ratings
Status: Open

Comments: As of May 2020, SEC staff said that the Office of Credit Ratings is working to address this recommendation through its normal Risk and Control Matrix review process. Staff said that SEC would have an update for GAO in the Fall 2020. We will update the status of the recommendation when the Office of Credit Ratings provides documentation showing the implementation of responsive actions.

Recommendation: The Director of CFPB should identify additional sources of information, such as through registering CRAs or leveraging state information, that would help ensure the agency is tracking all CRAs that meet the larger participant threshold. (Recommendation 1)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: In July 2020, CFPB staff noted that they have reviewed state CRA registration information available to them, are working to obtain additional state registration information, and are exploring additional ways to leverage the information. GAO will continue to monitor CFPB's progress in leveraging additional sources of information that would help identify larger participant CRAs.

Recommendation: The Director of CFPB should assess whether its process for prioritizing CRA examinations sufficiently incorporates the data security risks CRAs pose to consumers, and take any needed steps identified by the assessment to more sufficiently incorporate these risks. (Recommendation 2)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: In July 2020, CFPB staff noted that they were assessing whether, and if so, how and when, to incorporate data security risks into their supervisory prioritization. As part of that evaluation, CFPB is assessing whether those processes should incorporate data security risks CRAs pose to consumers in light of the agency's statutory authorities, supervisory responsibilities, and resources. GAO will continue monitoring CFPB's assessment of prioritization of CRA data security risks.

Recommendation: Congress should consider providing the Federal Trade Commission with civil penalty authority for the privacy and safeguarding provisions of the Gramm-Leach-Bliley Act to help ensure that the agency has the tools it needs to most effectively act against data privacy and security violations. (Matter for Consideration 1)

Agency: Congress
Status: Open

Comments: As of July 2020, Congress has not passed legislation to provide FTC with civil penalty authority for the privacy and safeguarding provisions of the Gramm-Leach-Bliley Act.

Recommendation: Congress should consider developing comprehensive legislation on Internet privacy that would enhance consumer protections and provide flexibility to address a rapidly evolving Internet environment. Issues that should be considered include: (1) which agency or agencies should oversee Internet privacy; (2) what authorities an agency or agencies should have to oversee Internet privacy, including notice-and-comment rulemaking authority and first-time violation civil penalty authority; and (3) how to balance consumers' need for Internet privacy with industry's ability to provide services and innovate.

Agency: Congress
Status: Open

Comments: When we confirm what actions Congress has taken in response to this recommendation, we will provide updated information

Recommendation: The Director of CFPB should implement a systematic process for prioritizing risks to consumers and considering how to use the bureau's available policy tools—such as rulemaking, supervision, enforcement, and consumer education—to address these risks. Such a process could incorporate principles from the prior One Bureau process, such as an assessment of the extent of potential harm to consumers in financial markets, to prioritize the most significant risks. (Recommendation 1)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: In October 2019, CFPB staff told us that the CFPB Director approved a proposal to implement a short-term policy prioritization exercise. According to a memorandum describing this exercise, CFPB anticipates that it will involve CFPB's Strategy Office engaging members of cross-bureau working groups to review and update priorities related to addressing risks to consumers. According to CFPB staff, the working groups will need up to a few months to complete this work, and the results should be available in the second quarter of 2020. To fully address this recommendation, CFPB needs to make further progress in implementing this planned prioritization exercise, including by demonstrating steps taken to prioritize risks to consumers and considering how to use CFPB's various policy tools to address these risks.

Recommendation: The Office of the Secretary should assess the feasibility and cost of updating its airline case management system to address data and reporting limitations, and to undertake those updates that are cost effective and feasible. (Recommendation 2)

Agency: Department of Transportation
Status: Open

Comments: DOT concurred with this recommendation and said it would take steps to update its case management tracking system. As of June, 2020, DOT has not provided an update regarding the status of its efforts to implement this recommendation. DOT indicated the agency would provide a response in the coming months, citing delays with workloads due to COVID-19. Once DOT provides a response to this recommendation, we will provide updated information.

Recommendation: The Office of the Secretary should establish performance measures for each of its objectives for its five key airline-compliance activities. (Recommendation 3)

Agency: Department of Transportation
Status: Open

Comments: DOT concurred with this recommendation and said it would take steps to establish appropriate performance measures. As of June, 2020, DOT has not provided an update regarding the status of its efforts to implement this recommendation. DOT indicated the agency would provide a response in the coming months, citing delays with workloads due to COVID-19. Once DOT provides a response to this recommendation, we will provide updated information.

Recommendation: The Office of the Secretary should capture feedback directly from airline passengers or identify other mechanisms to capture passengers' perspectives to inform DOT's education efforts. (Recommendation 4)

Agency: Department of Transportation
Status: Open

Comments: DOT concurred with this recommendation and said it would take steps to capture feedback directly from consumers. As of June, 2020, DOT has not provided an update regarding the status of its efforts to implement this recommendation. DOT indicated the agency would provide a response in the coming months, citing delays with workloads due to COVID-19. Once DOT provides a response to this recommendation, we will provide updated information.

Recommendation: The Office of the Secretary should develop performance measures for DOT's efforts to educate airline passengers. (Recommendation 6)

Agency: Department of Transportation
Status: Open

Comments: DOT concurred with this recommendation and said it would take steps to develop appropriate performance measures for DOT's efforts to educate airline passengers. As of June, 2020, DOT has not provided an update regarding the status of its efforts to implement this recommendation. DOT indicated the agency would provide a response in the coming months, citing delays with workloads due to COVID-19. Once DOT provides a response to this recommendation, we will provide updated information.

Recommendation: The Director of the Consumer Financial Protection Bureau should engage in collaborative discussions with other relevant financial regulators in a group that includes all relevant stakeholders and has defined agency roles and outcomes to address issues related to consumers' use of account aggregation services. (Recommendation 5)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: In a May 2018 letter, the Acting Director of the Bureau stated that the Bureau has previously issued principles that include reasonable and practical means for consumers to dispute and resolve instances of unauthorized payments conducted in connection with or as a result of authorized or unauthorized data sharing access. The letter notes that the Bureau is committed to monitoring developments in data aggregation markets and will continue to assess how the Bureau's consumer protection principles may be best realized, including engaging in discussions with other relevant federal and state financial regulators. In October 2018, Bureau staff advised us that they made a presentation on existing consumer protections that would appear to be applicable to consumers using data aggregators at the June 28, 2018 meeting of the Fintech Interagency Discussion Group, which includes OCC, the Federal Reserve, the Federal Deposit Insurance Corporation, and the National Credit Union Administration. They noted they are monitoring private sector efforts related to resolving data aggregation issues and that additional discussions among the regulators about these issues will be held in the future. We will recontact the agency in the future to obtain information on additional actions it has taken. In January 2020, GAO met with CFPB to discuss the recommendation and potential outcomes that could close the recommendation. CFPB officials stated that they will be hosting a public forum on data aggregation in February 2020. They noted that results from the public forum could include action related to the data aggregation recommendation.

Recommendation: The Chair of the Board of Governors of the Federal Reserve System should engage in collaborative discussions with other relevant financial regulators in a group that includes all relevant stakeholders and has defined agency roles and outcomes to address issues related to consumers' use of account aggregation services. (Recommendation 6)

Agency: Federal Reserve System: Board of Governors
Status: Open
Priority recommendation

Comments: In a May 2018 letter, the Chair of the Federal Reserve Board noted that the Federal Reserve recognizes the importance of working together to determine how best to encourage socially beneficial innovation in the marketplace, while ensuring that consumers' interests are protected. The letter noted that the Federal Reserve staff have been meeting with other regulators and industry participants. The Chair states that the Federal Reserve will continue to facilitate and engage in collaborative discussions with other relevant financial regulators in these and other settings to help market participants address the important issues surrounding reimbursement for consumers who use financial account aggregators and experience unauthorized transactions. In October 2018, Federal Reserve staff advised us that issues related to data aggregation were discussed at a June 28, 2018 meeting of the Fintech Interagency Discussion Group, which includes OCC, the Federal Reserve, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Consumer Financial Protection Bureau. They noted that they are monitoring private sector efforts related to resolving data aggregation issues and expect to hold additional discussions among the regulators about these issues in the future. In March 2019, the agency noted that it continues to collaborate on this issue. As of February 2020, the agency had no further updates on this recommendation. We plan to follow up with Federal Reserve staff to obtain updates on these efforts in the future.

Recommendation: The Chairman of the Federal Deposit Insurance Corporation should engage in collaborative discussions with other relevant financial regulators in a group that includes all relevant stakeholders and has defined agency roles and outcomes to address issues related to consumers' use of account aggregation services. (Recommendation 7)

Agency: Federal Deposit Insurance Corporation
Status: Open
Priority recommendation

Comments: In November 2018, FDIC staff confirmed that they have engaged in collaborative discussions with other relevant financial regulators regarding issues related to consumers' use of account aggregation services and associated liability issues. We followed up in April 2019 and they confirmed that their collaboration had yet to produce outcomes that would satisfy the recommendation.

Recommendation: The Chairman of the National Credit Union Administration should engage in collaborative discussions with other relevant financial regulators in a group that includes all relevant stakeholders and has defined agency roles and outcomes to address issues related to consumers' use of account aggregation services. (Recommendation 8)

Agency: National Credit Union Administration
Status: Open

Comments: In July 2018, NCUA staff indicated that staff from their agency had recently participated in a discussion forum with other federal regulators and other stakeholders on fintech, and, in particular, account aggregation challenges. They stated that they intend to continue to engage other regulators and related industry stakeholders on fintech topics and emerging technology that can have an impact on credit unions and their consumers. In October 2018, NCUA staff advised us that they have been discussing issues related to data aggregation at meetings of the Fintech Interagency Discussion Group, which includes OCC, the Federal Reserve, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Bureau of Consumer Financial Protection. In November 2019, NCUA staff said that the agency continues to participate in meetings through the Fintech Interagency Discussion Group and had taken part in a Data Symposium held by the San Francisco Federal Reserve. We plan to follow up with NCUA staff to obtain updates on these efforts and resulting outcomes in the future.

Recommendation: The Comptroller of the Currency should engage in collaborative discussions with other relevant financial regulators in a group that includes all relevant stakeholders and has defined agency roles and outcomes to address issues related to consumers' use of account aggregation services. (Recommendation 9)

Agency: Department of the Treasury: Office of the Comptroller of the Currency
Status: Open

Comments: In a May 2018 letter, OCC noted that its staff have met with the other banking regulators and with market participants about account aggregation issues in the past. In October 2018, OCC staff advised us that issues related to data aggregation were discussed at a June 28, 2018 meeting of the Fintech Interagency Discussion Group, which includes OCC, the Federal Reserve, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Bureau of Consumer Financial Protection. We followed up in January 2020 and they confirmed that their collaboration had yet to produce outcomes that would satisfy the recommendation. We plan to follow up with OCC staff to obtain updates on these efforts in the future.

Recommendation: The Chairman of the National Credit Union Administration should formally evaluate the feasibility and benefit of establishing an office of innovation or clear contact point, including at least a website with a dedicated email address. (Recommendation 11)

Agency: National Credit Union Administration
Status: Open

Comments: NCUA officials told us that in August 2018 the agency established a working group to formally evaluate the feasibility of establishing a dedicated work unit to oversee and lead fintech and innovation efforts, including creating a website and monitoring a dedicated e-mail account. NCUA officials indicated that as of November 2019 the working group was deliberating key considerations related to establishing a dedicated work unit. We plan to follow up with NCUA staff to obtain updates on these efforts in the future.

Recommendation: The Chair of the Board of Governors of the Federal Reserve System should formally evaluate the feasibility and benefits to their regulatory capacities of adopting certain knowledge-building initiatives related to financial innovation. (Recommendation 12)

Agency: Federal Reserve System: Board of Governors
Status: Open

Comments: In a May 2018 letter, the Chair of the Federal Reserve Board noted that the Federal Reserve recognizes the importance of formally increasing its knowledge base related to financial innovation. The letter noted that the Federal Reserve has recently organized two nationwide teams of experts tasked with monitoring fintech and related emerging technology trends as they relate to its supervisory and payment system mandates, respectively. These new teams include representation from all of the Federal Reserve System's Reserve Banks and have leadership from Board staff. These teams' critical objectives include ensuring that fintech-related information is shared across the Federal Reserve System and is used to inform relevant supervisory, policy, and outreach strategies. As of February 2020, the agency had no updates on this recommendation. We plan to follow up with Federal Reserve staff to obtain updates on these efforts in the future.

Recommendation: The Chairman of the Commodity Futures Trading Commission should formally evaluate the feasibility and benefits to their regulatory capacities of adopting certain knowledge-building initiatives related to financial innovation. (Recommendation 13)

Agency: Commodity Futures Trading Commission
Status: Open

Comments: We followed up in January 2020 and CFTC described its efforts to address this recommendation, which were encouraging. We are awaiting documentation of these efforts and when we confirm the agency's actions, we will provide updated information.

Recommendation: The Chairman of the National Credit Union Administration should formally evaluate the feasibility and benefits to their regulatory capacities of adopting certain knowledge-building initiatives related to financial innovation. (Recommendation 15)

Agency: National Credit Union Administration
Status: Open

Comments: NCUA officials told us that, as of November 2019, the internal working group that the agency established in August 2018 was evaluating the feasibility and benefits of adopting certain knowledge-building initiatives related to financial innovation. Specifically, the working group was assessing initiatives such as stakeholder outreach, research and collaboration opportunities, grants and other technical assistance, and existing supervisory tools. We plan to follow up with NCUA staff to obtain updates on these efforts in the future.

Recommendation: The Director of CFPB should issue public information on its plans for reviewing regulations applicable to banks and credit unions, including information describing the scope of regulations the timing and frequency of the reviews, and the extent to which the reviews will be coordinated with the federal depository institution regulators as part of their periodic EGRPRA reviews. (Recommendation 2)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: CFPB staff noted in a letter in April 2018 that CFPB had issued requests for information (RFI) on the regulations their agency had adopted and inherited from other agencies. These requests seek public comment on the need to amend these regulations. They noted that they included in their spring and fall 2017 Semiannual Regulatory Agenda descriptions of two initiatives intended to review their regulations to identify opportunities to modernize and streamline provisions. In addition, they noted they had created an internal task force to coordinate and bolster continuing efforts to identify and relieve regulatory burdens. They stated that they would continue to publish information on their plans for reviewing regulations as appropriate. We plan to continue following up with CFPB to determine the extent to which they have published information on their plans to review the burden of their agency's regulations.

Recommendation: In the event that Congress again requires an agency to provide affected individuals with identity theft insurance in response to a breach of sensitive personal data, Congress should consider permitting the agency to determine the appropriate level of that insurance.

Agency: Congress
Status: Open

Comments: As of July 2020, Congress had not enacted legislation for which our Matter for Congressional Consideration would be applicable.

Recommendation: The Director of the Office of Management and Budget should, to the extent feasible, conduct an analysis of the effectiveness of the various identity theft services relative to alternatives, and revise OMB's guidance to federal agencies in light of this analysis.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: As we reported in GAO-19-230, we contacted OMB several times between May 2018 and early March 2019 to update the status of this recommendation, and again in July 2020, but as of July 2020, OMB had not responded with an update.

Recommendation: The Director of the Office of Management and Budget should explore options to address the risk of duplication in federal agencies' provision of identity theft services in response to data breaches, and take action if viable options are identified.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: No executive action identified. As of July 2020, OMB had not responded to GAO's request for an update.

Recommendation: To improve operational efficiencies and reduce costs related to product management and services that support commissary operations, the Secretary of Defense should direct the Chief Executive Officer of DeCA to conduct comprehensive cost-benefit analyses to guide decisions on implementing the most cost-effective option as stocking and custodial services contracts are renewed, and on choosing product distribution options.

Agency: Department of Defense
Status: Open

Comments: The Defense Commissary Agency (DeCA) agreed with GAO's March 2017 recommendation that it conduct comprehensive cost-benefit analyses to guide decisions on implementing the most cost-effective option as stocking and custodial services contracts are renewed, and on choosing product distribution options. For example, according to Department of Defense (DOD) officials, DeCA conducted a cost-benefit analysis as part of renewing an agreement with one of the Navy Exchanges in May 2018 and will provide service on a reimbursable basis instead of using the commercial vendor. DeCA officials stated that they will also review product distribution options during commercial negotiations, including taking into account product sales and shipment requirements, among other things. As of January 2020, DOD has not provided documentation to confirm completed actions to implement our recommendations. When we confirm what actions DOD has taken, we will provide updated information.

Recommendation: To help ensure that FDA's foreign offices are able to fully meet their mission of helping to ensure the safety of imported products, as the agency continues to test performance measures and evaluate its Office of International Programs (OIP) strategic workforce plan, the Commissioner of FDA should assess the effectiveness of the foreign offices' contributions by systematically tracking information to measure whether the offices' activities specifically contribute to drug safety-related outcomes, such as inspections, import alerts, and warning letters.

Agency: Department of Health and Human Services: Food and Drug Administration
Status: Open
Priority recommendation

Comments: In June and July 2018 FDA reported on its recent efforts to assess the effectiveness of the foreign offices' contributions to drug-safety related outcomes. These efforts include the development of new performance measures for these offices along with a monitoring and evaluation plan; strengthened communications and collaboration between the foreign offices and FDA program centers and its Office of Regulatory Affairs; and an assessment of the foreign offices to help set their objectives and ensure the right balance of personnel, skillsets, and resources. However, FDA still had to develop intermediate outcomes to link with final outcomes. In an August 2020 written response, the agency reported that because of a reorganization and strategic planning effort for its Office of Global Policy and Strategy, it was still revising and updating its measures and its approach to evaluating impact in 2020 to align with a five-year strategic plan completed in March 2020. The agency indicated that the recommendation should remain open, and GAO will continue to monitor the implementation of this recommendation.

Recommendation: To ensure that FHFA has adequate authority to ensure the safety and soundness of the enterprises and to clarify its supervisory role, Congress should consider granting FHFA explicit authority to examine third parties that do business with and play a critical role in the operations of the enterprises.

Agency: Congress
Status: Open

Comments: As of March 2020, Congress has not taken action on this matter.

Recommendation: Congress should consider whether additional changes to the financial regulatory structure are needed to reduce or better manage fragmentation and overlap in the oversight of financial institutions and activities to improve (1) the efficiency and effectiveness of oversight; (2) the consistency of consumer and investor protections; and (3) the consistency of financial oversight for similar institutions, products, risks, and services. For example, Congress could consider consolidating the number of federal agencies involved in overseeing the safety and soundness of depository institutions, combining the entities involved in overseeing the securities and derivatives markets, transferring the remaining prudential regulators' consumer protection authorities over large depository institutions to the Consumer Financial Protection Bureau, and the optimal role for the federal government in insurance regulation, among other considerations.

Agency: Congress
Status: Open

Comments: At least two bills have been introduced in the 115th Congress that would change the financial regulatory structure, to some degree, to address fragmented and overlapping regulatory authorities among agencies, as GAO suggested in February 2016. The Financial CHOICE Act of 2017 (H.R. 10) was introduced on April 26, 2017, passed the House in June 2017 and the Senate held hearings in July 2017. Among other things, the Financial CHOICE Act of 2017 calls for the federal financial regulatory agencies to implement policies and procedures to minimize the duplication of effort with respect to enforcement actions. For example, it eliminates the authority of the Consumer Financial Protection Bureau to supervise and examine financial institutions and also eliminates the regulatory and enforcement authority of the agency with respect to unfair, deceptive, and abusive acts and practices by depository institutions. Such actions could help reduce fragmentation and overlap in the financial regulatory structure. In addition, the Economic Growth, Regulatory Relief, and Consumer Protection Act (S.2155) was introduced on November 16, 2017 and passed in the Senate in March 2018. The bill, to some extent, may help address fragmentation, overlap, and duplication in the financial regulatory structure. For example, the bill helps to address fragmentation in insurance oversight by finding that the federal agencies and office involved in insurance regulation should achieve consensus with state insurance regulators when they participate in negotiations on insurance issues before any international forum of financial regulators or supervisors, and create an advisory committee to discuss and report on insurance policy issues including international issues. GAO will continue to monitor the reform efforts to determine the extent to which they could help to address fragmentation and overlap between the federal financial regulatory agencies and reduce opportunities for inefficiencies in the regulatory process and inconsistencies in how regulators conduct oversight activities over similar types of institutions, products, and risks.

Recommendation: Congress should consider whether legislative changes are necessary to align FSOC's authorities with its mission to respond to systemic risks. Congress could do so by making changes to FSOC's mission, its authorities, or both, or to the missions and authorities of one or more of the FSOC member agencies to support a stronger link between the responsibility and capacity to respond to systemic risks. In doing so, Congress could solicit information from FSOC on the effective scope of its collective designation authorities, including any gaps.

Agency: Congress
Status: Open

Comments: While some legislative action has been taken that may alter FSOC's authorities, it is not clear that the legislation would address GAO's February 2016 suggestion. The Financial CHOICE Act of 2017 (H.R. 10) was introduced on April 26, 2017, passed the House in June 2017, and the Senate held hearings in July 2017. The bill would change FSOC's authorities by repealing its authorities to designate non-bank financial institutions and financial market utilities (i.e., payment, clearing, and settlement systems) as "systemically important." In addition, the Economic Growth, Regulatory Relief, and Consumer Protection Act (S.2155) was introduced on November 16, 2017 and passed in the Senate in March 2018. The bill may alter some of FSOC's authorities. However, it is unclear if these acts would alter FSOC's mission to better align it with its authorities to respond to systemic risk or addresses a gap in systemic risk mitigation mechanisms. Without legislative changes that would align FSOC's authorities with its mission, FSOC may lack the tools it needs to comprehensively address systemic risks that may emerge and a gap will continue to exist in the mechanisms for mitigating systemic risks. GAO will continue to monitor the reform efforts to determine the extent to which they help to align FSOC's authorities with its mission to respond to systemic risks.

Recommendation: To strengthen FCC's data collection efforts, the Chairman of FCC should develop a strategy to gather additional information on the IP transition to assess the transition's potential effects on public safety and consumers.

Agency: Federal Communications Commission
Status: Open

Comments: As of April 2020, FCC officials said they are exploring options to address this recommendation and hope to have it implemented in fiscal year 2020.

Recommendation: To enhance the effectiveness of its preparations for conducting a retrospective review of its QM regulations, HUD should develop a plan that identifies the metrics, baselines, and analytical methods to be used. Furthermore, to account for and help mitigate the limitations of existing data and the uncertain availability of enhanced datasets, HUD should include in its plan alternate metrics, baselines, and analytical methods that could be used data were to remain unavailable.

Agency: Department of Housing and Urban Development
Status: Open

Comments: In February 2017, HUD noted that it does not currently collect data on the annual percentage rate (APR) for each loan that would allow for a perfect comparison to the average prime offer rate. According to HUD, its Office of Housing has on its long-term list of systems priorities to collect specific information from the Uniform Closing Data that could be used to conduct such a comparison. However, HUD stated that it has not received adequate funding to meet these systems enhancements. According to HUD, it is considering the feasibility and potential utility of alternative data sources or the use of a proxy in an appropriate methodology. For instance, whether it may be possible to approximate the APR based upon the note rate and information on closing costs that is collected in the current data system, or alternatively, whether the APR could be obtained or approximated through matching Home Mortgage Disclosure Act data for FHA loans. In a September 2020 email, HUD officials stated that HUD has certain unique considerations for review of its own QM rule as compared to the other federal agencies covered in the GAO report. HUD officials explained that HUD's QM rule implemented certain changes intended to conform with the Consumer Financial Protection Bureau's (CFPB) rule and constituted only a small subset of FHA's overall requirements related to underwriting and loan characteristics. According to HUD officials, HUD's QM rule was intended to make conforming changes to FHA's requirements, as statutorily required, in order to bring them into greater alignment with the new CFPB-promulgated QM rule requirements. They stated that HUD assesses FHA loan performance on an ongoing basis through a variety of mechanisms including the annual audit requirement and monitoring of the overall market and mortgage portfolio. According to the HUD officials, these mechanisms are used to assess the need for adjustments in underwriting criteria and mortgage insurance premiums as well as to assess the health and risks to safety and soundness of the MMIF Fund. HUD officials said that given these considerations, there is no specific stand-alone full evaluation of the HUD QM rule planned at this time.

Recommendation: To help ensure the safety of food imported into the United States, the Commissioner of Food and Drugs should complete an analysis to determine the annual number of foreign food inspections that is sufficient to ensure comparable safety of imported and domestic food. If the inspection numbers from that evaluation are different from the inspection targets mandated in FSMA, FDA should report the results to Congress and recommend appropriate legislative changes.

Agency: Department of Health and Human Services: Food and Drug Administration
Status: Open
Priority recommendation

Comments: On March 25, 2020, GAO staff met with FDA officials to discuss the status of the recommendation. FDA officials said that they cannot meet the number of foreign inspections required under FSMA due to capacity constraints, and FDA's current strategy for the safety of imported food relies on a "cumulative oversight" approach involving multiple programs (including the Third-Party Certification Program, the Foreign Supplier Verification Program, the Voluntary Qualified Importer Program, and systems recognition), in addition to foreign inspections. FDA officials said that it could be a number of years before these programs are fully implemented and that FDA will provide GAO with more specific status updates on the implementation and monitoring of each of these programs in future responses to this recommendation. Because FDA is still implementing their cumulative oversight approach and has not reported the number of foreign inspections required to ensure imported food safety, the recommendation remains open.

Recommendation: Because challenges associated with the fragmented federal food safety system are long-standing, decision makers do not have an integrated perspective on federal food safety performance, and centralized mechanisms for broad-based collaboration have not been sustained, Congress should consider directing OMB to develop a government-wide performance plan for food safety that includes results oriented goals and performance measures and a discussion of strategies and resources.

Agency: Congress
Status: Open

Comments: As of March 2020, Congress had not acted on this matter. OMB informed GAO in January 2020 that they had no plans to develop a government-wide performance plan for food safety. We continue to believe that such a plan is necessary for effective federal oversight of food safety.

Recommendation: Because challenges associated with the fragmented federal food safety system are long-standing, decision makers do not have an integrated perspective on federal food safety performance, and centralized mechanisms for broad-based collaboration have not been sustained, Congress should consider formalizing the FSWG through statute to help ensure sustained leadership across food safety agencies over time.

Agency: Congress
Status: Open

Comments: As of March 2020, Congress had not acted on this matter.

Recommendation: To achieve greater efficiency and effectiveness, Congress should consider transferring the oversight of the markings of toy and imitation firearms in 15 U.S.C. 5001 from the National Institute of Standards and Technology (within the Department of Commerce) to the Consumer Product Safety Commission.

Agency: Congress
Status: Open

Comments: This matter is an action identified in GAO's annual Duplication and Cost Savings reports. No legislative action identified. The Gun Look-Alike Case Act, H.R. 3224, which was introduced on July 27, 2015, in the 114th Congress, would transfer the authority to regulate the markings of toy, look-alike, and imitation firearms in section 5001 of title 15 of the U.S. Code from NIST to CPSC, as GAO suggested in November 2014. This bill was referred to the Subcommittee on Commerce, Manufacturing, and Trade of the Committee on Energy and Commerce in the United States House of Representatives, and did not pass out of committee. This bill was not reintroduced in the 115th Congress and, as of March 2020, has not been reintroduced by the 116th Congress. Continued regulation of the marking of toy and imitation firearms by NIST rather than CPSC does not leverage each agency's expertise and therefore may not be the most efficient use of scarce federal resources.

Recommendation: To improve existing coordination of oversight for consumer product safety, Congress should consider establishing a formal comprehensive oversight mechanism for consumer product safety agencies to address crosscutting issues as well as inefficiencies related to fragmentation and overlap such as communication and coordination challenges and jurisdictional questions between agencies. Different types of formal mechanisms could include, for example, creating a memorandum of understanding to formalize relationships and agreements or establishing a task force or interagency work group. As a starting point, Congress may wish to obtain agency input on options for establishing more formal coordination.

Agency: Congress
Status: Open

Comments: This matter is an action identified in GAO's annual Duplication and Cost Savings reports. As of March 2020, no legislation was identified that would establish a collaborative mechanism to facilitate communication across the relevant agencies and to help enable them to collectively address crosscutting issues, as GAO suggested in November 2014. Some of the agencies with direct regulatory oversight responsibilities for consumer product safety reported that they continue to collaborate to address specific consumer product safety topics. However, without a formal comprehensive oversight mechanism, the agencies risk missing opportunities to better leverage resources and address challenges, including those related to fragmentation and overlap.

Recommendation: To improve consumers' access to relevant and understandable information on the cost and quality of health care services, the Secretary of HHS should direct the Administrator of CMS to include in the CMS Compare websites, to the extent feasible, estimated out-of-pocket costs for Medicare beneficiaries for common treatments that can be planned in advance.

Agency: Department of Health and Human Services
Status: Open

Comments: As of September 2019, HHS officials have not informed us of any actions taken to implement this recommendation. We will update the status of this recommendation when we receive additional information.

Recommendation: To improve consumers' access to relevant and understandable information on the cost and quality of health care services, the Secretary of HHS should direct the Administrator of CMS to organize cost and quality information in the CMS Compare websites to facilitate consumer identification of the highest-performing providers, such as by listing providers in order based on their performance.

Agency: Department of Health and Human Services
Status: Open

Comments: As of September 2019, HHS officials have not informed us of any actions taken to implement this recommendation. We will update the status of this recommendation when we receive additional information.

Recommendation: To improve consumers' access to relevant and understandable information on the cost and quality of health care services, the Secretary of HHS should direct the Administrator of CMS to include in the CMS Compare websites the capability for consumers to customize the information presented, to better focus on information relevant to them.

Agency: Department of Health and Human Services
Status: Open

Comments: As of September 2019, HHS officials have not informed us of any actions taken to implement this recommendation. We will update the status of this recommendation when we receive additional information.

Recommendation: To improve consumers' access to relevant and understandable information on the cost and quality of health care services, the Secretary of HHS should direct the Administrator of CMS to develop specific procedures and performance metrics to ensure that CMS's efforts to promote the development and use of its own and others' transparency tools adequately address the needs of consumers.

Agency: Department of Health and Human Services
Status: Open

Comments: As of September 2019, HHS officials have not informed us of any actions taken to implement this recommendation. We will update the status of this recommendation when we receive additional information.

Recommendation: To better inform users of the annual monitoring report about the frequency and scope of pesticide tolerance violations, the Secretary of Health and Human Services should direct the Commissioner of FDA to disclose in the agency's annual pesticide monitoring program report which pesticides with EPA-established tolerances the agency did not test for in its pesticide monitoring program and the potential effect of not testing for those pesticides.

Agency: Department of Health and Human Services
Status: Open
Priority recommendation

Comments: In February 2020, FDA said that the recommendation should be closed as not implemented. FDA has previously said that it remained concerned that the disclosure of pesticides for which FDA does not test would enable users to more easily circumvent the pesticide monitoring program, which could jeopardize public health and, at a minimum, would undermine FDA's law enforcement efforts. In addition, FDA said that it discloses in its annual reports all pesticides tested for within the reports' annual scope as required by the Pesticide Monitoring Improvements Act of 1988. FDA's annual reports also clarify that not all pesticides for which EPA has established tolerances were analyzed. FDA said that the Pesticide Monitoring Improvements Act of 1988 does not specifically direct the agency to report information on untested pesticides with EPA-established tolerances. We continue to believe that disclosing the pesticides that are not included in FDA's testing program would be consistent with OMB best practices for reporting limitations relevant to analyzing and interpreting results from a data collection effort. In particular, we continue to believe that FDA should be more transparent about the potential effect of not testing for all pesticides for which EPA has established tolerances. We also note that the Department of Agriculture's Food Safety and Inspection Service implemented a similar recommendation to disclose information about its pesticide monitoring program. As a result, we are keeping this recommendation open.

Recommendation: If Congress agrees that significant paid preparer errors exist, it should consider legislation granting IRS the authority to regulate paid tax preparers.

Agency: Congress
Status: Open

Comments: Multiple bills have been introduced in the Congress that would authorize the Department of Treasury to regulate paid tax preparers, as GAO recommended in April 2014. The most recent bills include: H.R. 3157, H.R. 3330, S. 1192, and Section 5 of S. 1138. As of August 2020, no action has been taken on any of these bills. In addition, multiple other bills were introduced in both the House and Senate between 2014 and 2018 to regulate paid tax preparers. GAO testified on October 1, 2015 on improper payments and the tax gap before Senate Finance and on December 10, 2015 on GAO recommendations before the Subcommittee on Regulatory Affairs and Federal Management, Committee on Homeland Security and Governmental Affairs, US Senate. Both hearings increased attention to GAO's matter to Congress that tax preparers be regulated. Paid preparer regulation may increase the accuracy of tax returns and potentially reduce the tax gap.

Recommendation: Congress should consider strengthening the current consumer privacy framework to reflect the effects of changes in technology and the marketplace--particularly in relation to consumer data used for marketing purposes--while also ensuring that any limitations on data collection and sharing do not unduly inhibit the economic and other benefits to industry and consumers that data sharing can accord. Among the issues that should be considered are: (1) the adequacy of consumers' ability to access, correct, and control their personal information in circumstances beyond those currently accorded under FCRA; (2) whether there should be additional controls on the types of personal or sensitive information that may or may not be collected and shared; (3) changes needed, if any, in the permitted sources and methods for data collection; and (4) privacy controls related to new technologies, such as web tracking and mobile devices.

Agency: Congress
Status: Open

Comments: As of July 2020, Congress has not taken action on this matter.

Recommendation: To improve the awareness, use, and usefulness of SaferProducts.gov, the CPSC should implement cost-effective usability improvements to SaferProducts.gov, taking into account the results of any existing usability testing or any new testing CPSC may choose to conduct.

Agency: Consumer Product Safety Commission
Status: Open

Comments: The Commission has taken some steps to address this recommendation by making usability improvements to SaferProducts.gov that we identified in our consumer testing in our report. For example, in 2015, the Commission addressed issues identified with the search functionality of the website by improving the advanced search function to enable searches by injury, time period, and location. In August 2018, the Commission clarified the purpose of SaferProducts.gov by adding the tagline (brief text that gives users an immediate idea of what the site does) "Report. Search. Protect." to its website. As of August 2019, CPSC has explored further ways to improve the usability of SaferProducts.gov. Specifically, in February 2019, CPSC published a request for information from the public on how to improve SaferProducts.gov. In March 2019, CPSC held a public hearing to obtain a feedback on how the design of SaferProducts.gov and process of submitting safety reports could be improved. For example, two consumer groups recommended that CPSC further improve the website's search function to yield more relevant and streamlined results and that it be designed for better use on mobile devices. Based on this input, CPSC is in the process of developing a plan for re-designing SaferProducts.gov using modern web-design standards, which includes improving the website's layout and styling, search capabilities, and functionality on mobile devices. According to CPSC, its staff plans to explore cost-effective resources to assess usability and identify further improvements to the website, such as coordinating with the General Services Administration on the design aspects of SaferProducts.gov and using other federal best practices to inform this process. However, no such cost-effective changes have yet been made to the website. According to officials, CPSC plans to begin this re-design in 2019 or 2020 pending available future funding. Until the Commission fully addresses this recommendation, it remains open. We will continue to monitor the Commission's progress in implementing our recommendation.

Recommendation: To better enable CPSC to target unsafe consumer products, Congress may wish to amend section 29(f) of CPSA to allow CPSC greater ability to enter into information-sharing agreements with its foreign counterparts that permit reciprocal terms on disclosure of nonpublic information.

Agency: Congress
Status: Open

Comments: As of May 15, 2020, Section 29 of CPSA had not been amended since 2008. In 2013, a bill was introduced (S.1887) but not passed. That bill would have allowed "the Commission, when sharing information under the federal-state cooperation program with a foreign government agency for official law enforcement or consumer protection purposes, to authorize a foreign government agency to make that information available to another agency of the same foreign government (including a political subdivision of that foreign government that is located within the same territory or administrative area as the agency disclosing the information) if an appropriate official of the foreign government agency disclosing the information certifies (by prior agreement, memorandum of understanding with the CPSC, or other written certification) that it will establish and apply specified confidentiality restrictions under the Consumer Product Safety Act."

Recommendation: To better ensure FDA's oversight of the safety of GRAS substances, the Commissioner of FDA should develop a strategy to minimize the potential for conflicts of interest in companies' GRAS determinations, including taking steps such as issuing guidance for companies on conflict of interest and requiring information in GRAS notices regarding expert panelists' independence.

Agency: Department of Health and Human Services: Food and Drug Administration
Status: Open

Comments: On November 16, 2017, FDA published a notification of availability for the draft guidance "Best Practices for Convening a GRAS Panel: Guidance for Industry," with a request for comments on the draft guidance by May 15, 2018. FDA indicated that the draft guidance represents FDA's current thinking on strategies to minimize the potential for conflicts of interest in companies' GRAS determinations, including assessing potential GRAS panel members for conflicts of interest. As of July 2020, FDA had not yet finalized the guidance, so we are leaving the recommendation open.

Recommendation: In order to develop an approach to decision making and the development of evidence on high-clockspeed trends affecting highway safety that are characterized by uncertainty, the Secretary of Transportation should consider and evaluate practices and principles for making decisions under conditions of uncertainty and for using data in such decision making and, on that basis, develop an approach to guide decision making on high-clockspeed trends that, although somewhat uncertain, may affect highway safety.

Agency: Department of Transportation
Status: Open

Comments: In GAO-09-56, GAO recommended the Secretary of Transportation consider and evaluate practices and principles for making conditions under uncertainty and for using data in light of issues encountered in developing evidence on high-clockspeed trends affecting highway safety that are characterized by uncertainty. GAO had studied driver distraction involving electronic devices, in particular cell phones with texting capability and identified these evolving electronic devices as a high clockspeed trend. DOT reports several actions on distracted driving, specifically: (1) an Executive Order to federal employees not to engage in text messaging while driving government-owned vehicles; when using electronic equipment supplied by the government while driving; or while driving privately owned vehicles when they are on official business; (2) the Secretary called on state and local governments to (a) make distracted driving part of their state highway plans, (b) pass state and local laws against distracted driving in all types of vehicles, (c) back up public awareness campaigns with high-visibility enforcement actions; (3) the Secretary directed the Department to establish an on-line clearinghouse on the risks of distracted driving and also (4) pledged to continue the Department's research on how to best combat distracted driving. DOT also notes that the Department's www.distraction.gov website provides information on the latest data on distracted driving and that 34 states have passed laws against texting and driving since the 2009 announcement by the Secretary of DOT.

Recommendation: The Secretary of Transportation should evaluate whether or not new approaches to data collection are needed to better track new trends related to highway safety.

Agency: Department of Transportation
Status: Open

Comments: DOT has not responded to this recommendation.

Recommendation: In order to improve the information available to the Congress for reauthorization, the Secretary of Transportation should analyze and report on trends currently anticipated to affect highway safety through 2020 and beyond in a systematic fashion--including information on high-clockspeed trends, discussion of evidence about these and other individual trends, their implications and potential interactions, and DOT responses.

Agency: Department of Transportation
Status: Open

Comments: DOT has not responded to this recommendation, but DOT announced a distracted driving summit September 30-October 1, 2009, with a limited number of invitees, and invited the GAO Assistant Director on this report to participate. U.S. Transportation Secretary Ray LaHood stated that the purpose of the summit is to "to address the dangers of text-messaging and other distractions behind the wheel." The summit will include "senior transportation officials, elected officials, safety advocates, law enforcement representatives and academics" who will convene in Washington, DC "to discuss ideas about how to combat distracted driving."

Recommendation: In order to improve the information available to the Congress for reauthorization, the Secretary of Transportation should determine, in consultation with relevant congressional committees, schedules for periodic reporting that will be sufficiently frequent to update the Congress on fast-changing trends.

Agency: Department of Transportation
Status: Open

Comments: DOT has not responded to this recommendation.

Recommendation: To provide more efficient, consistent, and effective federal oversight of the nation's food supply, Congress should consider commissioning the National Academy of Sciences or a blue ribbon panel to conduct a detailed analysis of alternative organizational food safety structures and report the results of such an analysis to Congress.

Agency: Congress
Status: Open

Comments: The 2002 Farm Security and Rural Investment Act (2002 Farm Bill) established a national Food Safety Commission charged with making specific recommendations for drafting legislative language. Among other things, the Commission was to make recommendations on how to improve the food safety system, create a harmonized, central framework for managing federal food safety programs, and enhance the effectiveness of federal food safety resources. However, as of January 2017, as far as current staff can ascertain, the Commission was never formed, and no recommendations were ever produced. Thus, although Congress acted to create a food safety commission through legislation, the substance of our matter--recommendations for analyzing alternative food safety structures--was not implemented. GAO subsequently made the same matter for congressional consideration in several later products, and the matter also appeared in the annual GAO Duplication, Overlap, and Fragmentation Report. As of March 2020, it remained unaddressed.