Recommendation: The Commissioner of the Social Security Administration should ensure the Office of Acquisition and Grants, in consultation with the Chief Information Officer, revises relevant guidance to identify the role of contracting officials in the Agile software development process.

Agency: Social Security Administration
Status: Open

Comments: The Social Security Administration agreed with the recommendation but has not yet taken actions to implement it.

Recommendation: The NPO Cost Savings Program Manager should work with CNS to evaluate the remaining site reinvestment funds and develop and implement a plan for how best to aggregate and use them. (Recommendation 1)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA concurred with the recommendation. In comments on a draft of the report, DOE stated that NPO plans to work with CNS on a plan for the remaining reinvestment funds, with an estimated completion date of December 31, 2020.

Recommendation: The Associate Administrator for Acquisition and Project Management should gather data on and document an analysis of the Cost Savings Program, including its cost effectiveness, to determine whether it is exportable to existing or future contracts. (Recommendation 2)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA concurred, in principle, with the recommendation. In its comments on a draft of the report, NNSA stated that potential benefits of the cost savings program should be considered for future contracts, as applicable. NNSA stated that it believes this recommendation is closed with actions to address other recommendations. We disagree and continue to believe that NNSA should document an analysis of the cost savings program, including its cost effectiveness, to determine the exportability of the program to other contracts.

Recommendation: The NPO Cost Savings Program Manager should share relevant lessons learned with other NNSA sites so that those sites can determine if efficiencies CNS has achieved can be implemented at other sites. (Recommendation 3)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA concurred with the recommendation. In its comments on a draft of the report, NNSA stated that it plans to upload lessons learned into DOE's Corporate Lessons Learned Database so they can be considered by other sites by December 31, 2020.

Recommendation: The Associate Administrator for Acquisition and Project Management should evaluate whether to require all other sites to institute an Annual Controlled Baseline. (Recommendation 4)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA concurred with the recommendation. In its comments on a draft of the report, NNSA stated that it plans to evaluate whether to expand use of Annual Controlled Baselines to other sites by December 31, 2020.

Recommendation: FirstNet's Chief Executive Officer should take steps to ensure that the integrated master schedule for the program is developed and maintained in accordance with the best practices provided in GAO's Schedule Assessment Guide. (Recommendation 1)

Agency: Department of Commerce: National Telecommunications and Information Administration: First Responder Network Authority
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: FirstNet's Chief Executive Officer should identify additional information about the program, including FirstNet's oversight and monitoring activities, that can be shared with public-safety stakeholders and periodically communicate and report this information to them. (Recommendation 2)

Agency: Department of Commerce: National Telecommunications and Information Administration: First Responder Network Authority
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: FirstNet's Chief Executive Officer should share relevant portions of the accepted state-specific commitment reports with the states, as specified in the contract. (Recommendation 3)

Agency: Department of Commerce: National Telecommunications and Information Administration: First Responder Network Authority
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: FirstNet's Chief Executive Officer should, in consultation with public-safety stakeholders and its contractor, as appropriate, identify and obtain periodic information or meaningful indicators on end-users' satisfaction that would serve as a metric to gauge performance quality, including the effect of the FirstNet network and products on public-safety operations. (Recommendation 4)

Agency: Department of Commerce: National Telecommunications and Information Administration: First Responder Network Authority
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Acquisition and Sustainment designates an accountable official responsible for (a) developing job specialty descriptions to help identify non-acquisition personnel supporting services acquisitions; and (b) establishing a schedule to identify these personnel. (Recommendation 1)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with this recommendation, but has not yet taken any necessary actions to implement it. In its concurrence, DOD noted that the Office of the Secretary of Defense (OSD) would develop and provide the guidance and job specialty descriptions for DOD components to use for identifying acquisition and non-acquisition personnel supporting services acquisitions. DOD also noted that the Director of Human Capital Initiatives has deployed an enterprise-wide coding capability for components to use in identifying acquisition and non-acquisition civilians across DOD. A DOD official stated that during 2020, both OSD and the Office of Human Capital Initiatives have developed reports that discuss issues related to the identification and training of non-acquisition personnel, including those supporting services acquisitions. This official noted that both of these reports are going through the coordination and staffing process and have not been issued. Additionally, DOD has not yet designated an accountable official responsible for efforts to help identify non-acquisition personnel supporting services acquisitions.

Recommendation: The Secretary of Defense should ensure that the Component Acquisition Executives provide non-acquisition personnel training needs to the Defense Acquisition University as part of the annual planning, programming, budgeting, and execution process. (Recommendation 2)

Agency: Department of Defense
Status: Open

Comments: DOD concurred with this recommendation. In July 2020, a DOD official stated that DOD is planning a revision to its instruction related to the education and training of DOD's acquisition workforce. The official said the revision is intended to help define the acquisition and non-acquisition workforces and the responsibilities for their respective training needs, among other things. However, the revision is in the planning stages and not be expected to be completed until the end of 2021. As a result, DOD is still not ensuring that Component Acquisition Executives provide non-acquisition personnel training needs to the Defense Acquisition University.

Recommendation: Congress should consider requiring Ginnie Mae to evaluate the adequacy of its current guaranty fee for single-family mortgage-backed securities and report to Congress with recommendations, if any, on revising the fee, such as by adopting standards under which the fee should be determined. (Matter for Consideration 1)

Agency: Congress
Status: Open

Comments: As of September 2020, Congress had not enacted legislation to require Ginnie Mae to evaluate the adequacy of its current guaranty fee for single-family mortgage-backed securities and report to Congress with recommendations.

Recommendation: Congress should consider requiring Ginnie Mae to evaluate its reliance on contractors and report to Congress on how it would use fee revenue available to hire contractors to also hire in-house staff. (Matter for Consideration 2)

Agency: Congress
Status: Open

Comments: As of September 2020, Congress had not enacted legislation to require Ginnie Mae to evaluate its reliance on contractors and report to Congress on its findings.

Recommendation: Congress should consider requiring Ginnie Mae to provide a report on how it would use greater flexibility or broader authority to set the compensation of its in-house staff. (Matter for Consideration 3)

Agency: Congress
Status: Open

Comments: As of September 2020, Congress has not enacted legislation to require Ginnie Mae to report on how it would use greater flexibility or broader authority to set the compensation of its in-house staff.

Recommendation: Congress should consider reforms to Ginnie Mae's oversight structure that can help address its increasing risks. (Matter for Consideration 4)

Agency: Congress
Status: Open

Comments: As of September 2020, Congress has not enacted legislation that considers reforms to Ginnie Mae's oversight structure that can help address its increasing risks.

Recommendation: The Chief Risk Officer of Ginnie Mae should periodically conduct an actuarial or similar analysis that includes a stress test to evaluate the extent to which the current level of the guaranty fee for single-family MBS provides Ginnie Mae with sufficient reserves to cover potential losses under different economic scenarios. (Recommendation 1)

Agency: Department of Housing and Urban Development: Government National Mortgage Association (Ginnie Mae)
Status: Open
Priority recommendation

Comments: Ginnie Mae (HUD) agreed with this recommendation. As of September 2020, Ginnie Mae took steps to address this recommendation. First, according to its 2020 budget justification, Ginnie Mae has concluded that it would be advantageous to have the authority to administratively adjust its guarantee fee and requested that the permissible guarantee fee be established within a range. Upon receipt of this authority, Ginnie Mae would then establish an administrative process through which an adjustment could be made. Second, Ginnie Mae has developed a stress test framework and solicited public comment. According to officials, by early 2021, Ginnie Mae plans to have its contractor develop an economic model to explore the current level of the guaranty fee under different economic scenarios including variations in issuer types and across Ginnie Mae programs. To fully implement this recommendation, Ginnie Mae needs to follow through on this effort and provide additional detail on changes to the existing models and its plan to periodically conduct this analysis. We will continue to monitor Ginnie Mae's progress in implementing our recommendation.

Recommendation: The Senior Vice President of Ginnie Mae's Office of Management Operations should analyze the costs of using contractors for its operations and develop a plan to determine the optimal mix of contractor or in-house staff for operations. (Recommendation 2)

Agency: Department of Housing and Urban Development: Government National Mortgage Association (Ginnie Mae)
Status: Open
Priority recommendation

Comments: Ginnie Mae (HUD) agreed with this recommendation. As of September 2020, Ginnie Mae said it procured a contractor to do this analysis on their behalf at the end of fiscal year 2020. Officials expected the cost analysis to commence in early 2021. To fully implement this recommendation, Ginnie Mae should ensure the analysis and plan are completed. We will continue to monitor Ginnie Mae's progress in implementing our recommendation.

Recommendation: The Senior Vice President of Ginnie Mae's Office of Management Operations should assess its contract administration options to determine the most efficient and effective use of funds. (Recommendation 3)

Agency: Department of Housing and Urban Development: Government National Mortgage Association (Ginnie Mae)
Status: Open
Priority recommendation

Comments: Ginnie Mae (HUD) agreed with this recommendation. As of October 2020, Ginnie Mae stated it assesses procurement approaches on a per contract basis on whether to administer a contract within HUD or outsource the contract administration. However, GAO recommends Ginnie Mae comprehensively evaluate whether the outsourcing of its contract administration has met its intended purposes and is the most efficient and effective use of funds. In order to implement this recommendation, Ginnie Mae should reevaluate its decision to use an external provider.

Recommendation: The Chief Financial Officer of Ginnie Mae and Senior Vice President of Ginnie Mae's Office of Management Operations should finalize efforts to assess the costs and benefits of options to revise its compensation structure within current authority and submit proposals, if warranted, to HUD for review and consideration. (Recommendation 4)

Agency: Department of Housing and Urban Development: Government National Mortgage Association (Ginnie Mae)
Status: Open
Priority recommendation

Comments: Ginnie Mae (HUD) agreed with this recommendation. As of September 2020, Ginnie Mae has taken steps to assess options to revise its compensation structure. More specifically, according to Ginnie Mae, in the development of its fiscal year 2020 budget request, Ginnie requested authority to develop alternative pay options, such as premium pay, pay bands and critical pay. In August 2020, Ginnie Mae was given authority to proceed with implementing critical pay by the Office of Personnel Management. Critical Pay authority permits an agency to set a higher rate of basic pay than would otherwise be payable for a position that requires expertise of an extremely high level in a scientific, technical, professional, or administrative field and is critical to the successful accomplishment of an important mission. As of September 2020, Ginnie Mae is working with HUD on developing an implementation plan to implement critical pay within its Office of Enterprise Risk. In addition, Ginne Mae is working with OMB to ensure program execution and outcomes are aligned between the agencies. We will continue to monitor Ginnie Mae's progress in implementing our recommendation.

Recommendation: The Administrator for the National Nuclear Security Administration should develop and document clear procedures for implementing NAP-4C, specifying the process for collecting contractor performance information and describing how officials are to ensure this information can be traced to rating determinations. (Recommendation 1)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: The National Nuclear Security Administration (NNSA) concurred with the recommendation. In February 2020, NNSA issued its fiscal year 2020 Corporate Performance Evaluation Process Annual Implementation Guidance. This guidance included a new section specifying the process for collecting contractor performance information and further details regarding the preparation of interim feedback reports and final performance evaluation reports. However, the guidance is unclear regarding how this information can be traced to rating determinations. In order to provide more transparency and ensure this traceability, NNSA guidance and the Performance Evaluation Reports themselves should more clearly link how collected performance information tracks to rating determinations.

Recommendation: The Assistant Secretary for the Office of Energy Efficiency and Renewable Energy should update its policy to require that Performance Evaluation Reports include quality information on cost performance to enable an overall assessment of Management and Operating contractor cost performance. (Recommendation 2)

Agency: Department of Energy: Office of Energy Efficiency and Renewable Energy
Status: Open

Comments: The Office of Energy Efficiency and Renewable Energy (EERE) partially concurred with the recommendation. As of April 2020, EERE officials stated that cost performance feedback was included in the 2019 final performance evaluation for the EERE Management and Operating contractor. EERE officials also stated that they had incorporated cost performance evaluation criteria into the fiscal year 2020 Performance Evaluation Measurement Plan (PEMP) for NREL. EERE officials noted that these actions ensure cost performance will be included as part of the ongoing contractor evaluation process. We have requested documentation of the new PEMP and performance evaluation report and, in order to ensure cost performance evaluation criteria are included in the future, EERE should update its policy to require quality information on cost performance going forward.

Recommendation: The Assistant Secretary for the Office of Environmental Management should update its policy to require that Performance Evaluation Reports include quality information on cost performance to enable an overall assessment of Management and Operating contractor cost performance. (Recommendation 3)

Agency: Department of Energy: Office of Environmental Management
Status: Open

Comments: The Office of Environmental Management (EM) concurred with the recommendation. As of April 2020, EM officials stated that they will include the requirement for quality information on cost performance in EM's Cleanup Project Management Policy. According to officials, EM is working on this policy, along with an additional Cleanup Program Management Policy that they expect to complete by the end of fiscal year 2020.

Recommendation: The Assistant Secretary for the Office of Fossil Energy should update its policy to require that Performance Evaluation Reports include quality information on cost performance to enable an overall assessment of Management and Operating contractor cost performance. (Recommendation 4)

Agency: Department of Energy: Office of Fossil Energy
Status: Open

Comments: The Office of Fossil Energy (FE) concurred with the recommendation. As of April 2020, FE officials stated that they had revised and executed the Performance Evaluation and Measurements Plan (PEMP), for the current Management and Operating contract to add a new PEMP measure that addresses monitoring cost growth, additional activities in internal audit, and data quality that addresses our recommendation. We have requested documentation of the PEMP showing the new measures and an updated policy requiring inclusion of quality information on cost performance in Performance Evaulation Reports. Upon receiving those, we will review to determine if it addresses our recommendation.

Recommendation: The Administrator for the National Nuclear Security Administration should update its policy to require that Performance Evaluation Reports include quality information on cost performance to enable an overall assessment of Management and Operating contractor cost performance. (Recommendation 5)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: The National Nuclear Security Administration (NNSA) concurred with the recommendation. In February 2020, NNSA issued its fiscal year 2020 Corporate Performance Evaluation Process Annual Implementation Guidance. This guidance provides instructions regarding the evaluation of cost performance, including examples of the types of cost information that should be collected and how cost data should be analyzed and described. However, the guidance's template for Performance Evaluation and Measurement Plans does not include any explicit cost performance Objectives or Key Outcomes and it is unclear how the cost performance information discussed in the guidance would enable an overall assessment of Management and Operating contractor cost performance. In order to provide quality cost information that does enable such an overall assessment, NNSA should clarify its guidance regarding cost performance information and how this information links to overall Management and Operating contractor performance.

Recommendation: The Assistant Secretary for the Office of Nuclear Energy should update its policy to require that Performance Evaluation Reports include quality information on cost performance to enable an overall assessment of Management and Operating contractor cost performance. (Recommendation 6)

Agency: Department of Energy: Office of Nuclear Energy
Status: Open

Comments: The Office of Nuclear Energy (NE) partially concurred with the recommendation. As of May 2020, NE officials stated that they will include criteria for "day-to-day" cost performance in the annual Performance Evaluation Measurement Plan (PEMP) for fiscal year 2020. NE's evaluation of the contractor's performance against those criteria will be included in the year-end performance reports of its Management and Operating contractor beginning in fiscal year 2020. NE officials stated that modifying the fiscal year 2020 PEMP with added cost criteria, usually done in April, has been delayed due to COVID-19 and that they expect to complete the modification by the end of May 2020. Once the cost criteria are included and evaluated in the Performance Evaluation Report, we will review to determine if it addresses our recommendation. In addition to changes to the fiscal year 2020 report, NE should update its policy to require such criteria for evaluating contractor cost performance going forward.

Recommendation: The Director of the Office of Science should update its policy to require that Performance Evaluation Reports include quality information on cost performance to enable an overall assessment of Management and Operating contractor cost performance. (Recommendation 7)

Agency: Department of Energy: Office of Science
Status: Open

Comments: The Office of Science (SC) partially concurred with the recommendation. In commenting on our report in August 2019, DOE stated that by focusing on the annual Performance Evaluation Reports (PER), our report does not capture the cost performance reviews conducted in day-to-day contract oversight, the annual laboratory planning process, and contract extend/compete decisions. In its comments, DOE stated that since SC conducts cost performance reviews in normal operations and at the year-end annual evaluation process, adequate information is available to assess whether the contractor cost performance is acceptable to the department. As of April 2020, SC had not updated these comments. In the report, we note that SC conducts some cost performance evaluation activities outside of the annual performance evaluation process, although we did not assess these efforts. While there may be adequate information available, SC does not commonly document this information or assessments from such activities in the PERs. We continue to believe that the PERs are important sources of information for contract management--particularly for acquisition decisions and oversight of spending on cost-reimbursement contracts--and that action is needed to improve these formal records of contractor performance. By not including quality information on overall cost performance and assessments in PERs, SC is missing a valuable opportunity to better document contractors' cost performance, improve acquisition decision-making, and strengthen oversight of billions of dollars in contracting. We continue to believe that it is important for SC to implement the recommendation and that by doing so, the office would have better assurance that Management and Operating contractor performance evaluations fully address required elements.

Recommendation: To enhance management attention to closing out contracts, the Secretary of Health and Human Services should develop a means for department-wide oversight into components' progress in meeting their goals on closing contracts and the status of contracts eligible for closeout. (Recommendation 2)

Agency: Department of Health and Human Services
Status: Open

Comments: The Department of Health and Human Services agreed with the recommendation and has developed a template and instructions for quarterly reporting from its divisions. The Department identified some performance measures that it will monitor on a quarterly basis, such as contracts closed on time and total backlog. Due to competing priorities and focus on the COVID-19 response, the Department plans to provide additional steps toward progress at the next reporting cycle.

Recommendation: To enhance management attention to closing out contracts, the Attorney General should direct the Senior Procurement Executive to ensure the development of a means to track data on the number and type of contracts eligible for closeout and where the contracts are in the closeout process, as well as a means to assess--at the agency or component level--progress by establishing goals and performance measures for closing contracts. (Recommendation 4)

Agency: Department of Justice
Status: Open

Comments: The Department of Justice agreed with the recommendation and in early fiscal year 2020 enhanced its financial management system to allow the Bureaus to assess whether a contract needs to be closed out. The Department anticipates that the associated guidance, which includes performance measures, will be issued in late summer 2020.

Recommendation: To enhance management attention to closing out contracts, the Secretary of State should develop a means at the agency level to track data on the entirety of the number and type of contracts eligible for closeout, where the contracts are in the closeout process, and establish goals and performance measures for closing contracts. (Recommendation 5)

Agency: Department of State
Status: Open

Comments: The Department of State agreed with the recommendation and is upgrading its system to improve data quality and enable the tracking and sharing of contract closeout information. The enhancements to the contracting system would allow the Department to establish a baseline and develop metrics to measure progress on closing contracts. The Department anticipates that the upgrades and data utilization will continue into fiscal year 2021.

Recommendation: To help foster strategic decision making and improvements in the acquisition of services, the Under Secretary of Defense for Acquisition, Technology, and Logistics should, as part of its effort to update the January 2016 instruction, reassess the roles, responsibilities, authorities, and organizational placement of key leadership positions, including functional domain experts, senior services managers, and component level leads.

Agency: Department of Defense: Office of the Secretary of Defense: Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics
Status: Open
Priority recommendation

Comments: DOD concurred with the recommendation. In July 2018, DOD officials told us that they planned to fully implement this recommendation in the revised instruction once it was issued. In January 2020, DOD issued an updated instruction that, among other things, revised elements of the management structure. We plan to begin work later in 2020 that will assess whether the changes reflected in the January 2020 instruction address the issues we identified.

Recommendation: To help foster strategic decision making and improvements in the acquisition of services, the Under Secretary of Defense for Acquisition, Technology, and Logistics should, as part of its effort to update the January 2016 instruction, clarify the purpose and timing of the Services Requirements Review Board process to better align it with DOD's programming and budgeting processes.

Agency: Department of Defense: Office of the Secretary of Defense: Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics
Status: Open
Priority recommendation

Comments: DOD concurred with the recommendation. In July 2018, DOD officials told us that they planned to fully implement this recommendation in the revised instruction once it was issued. In January 2020, DOD issued an updated instruction that, among other things, revised elements of the Services Requirements Review Board process. We plan to begin work later in 2020 that will assess whether the changes reflected in the January 2020 instruction address the issues we identified.

Recommendation: The Chief Executive Officer should direct the Chief Information Officer to take steps needed to ensure that system requirements are defined to align with the business needs of CNCS's future risk-based grants monitoring process (Recommendation 1).

Agency: Corporation for National and Community Service
Status: Open

Comments: In November 2018, CNCS officials stated that the agency made the decision to terminate the development of the Grants and Member Management (GMM) system. They subsequently awarded a contract to assess the state of development for the GMM system and to provide recommendations on the actions CNCS needed to take in order to implement a commercial off-the-shelf (COTS) application for core grants management functions. According to CNCS officials, based on the findings from that assessment, further investments in developing customized applications (even an implementation of a COTS application) were not likely to be successful. As of September 2019, CNCS officials stated that they were pursuing the option of a federal shared service as a solution to grants management. As of November 2019, according to CNCS officials, the agency had not yet defined requirements for the grant monitoring system project because the decision to pursue the federal shared services as a solution for grants management is very recent. CNCS officials agreed to provide GAO with an update as further progress is made on this recommendation.

Recommendation: The Chief Executive Officer should direct the Chief Information Officer to ensure that the system development project schedule identifies in the baseline both planned and actual dates for completing all project-level activities, and can be used to monitor and measure progress of the grant monitoring system project (Recommendation 2).

Agency: Corporation for National and Community Service
Status: Open

Comments: In November 2018, CNCS officials stated that the agency made the decision to terminate the development of the GMM system. They subsequently awarded a contract to assess the state of development for the GMM system and to provide recommendations on the actions CNCS needed to take in order to implement a COTS application for core grants management functions. According to CNCS officials, based on the findings from that assessment, further investments in developing customized applications (even an implementation of a COTS application) were not likely to be successful. As of September 2019, CNCS officials stated that they were pursuing the option of a federal shared service as a solution to grants management. As of November 2019, according to CNCS officials, the agency had not yet established a project schedule for completing the grant monitoring system project because the decision to pursue the federal shared services as a solution for grants management is very recent. CNCS officials agreed to provide GAO with an update as further progress is made on this recommendation.

Recommendation: The Chief Executive Officer should direct the Chief Information Officer to ensure that test plans are defined and implemented to include the second version of the grant monitoring system in all stages of testing during development, and results of initial stages are approved before conducting subsequent test stages (Recommendation 3).

Agency: Corporation for National and Community Service
Status: Open

Comments: In November 2018, CNCS officials stated that the agency made the decision to terminate the development of the GMM system. They subsequently awarded a contract to assess the state of development for the GMM system and to provide recommendations on the actions CNCS needed to take in order to implement a COTS application for core grants management functions. According to CNCS officials, based on the findings from that assessment, further investments in developing customized applications (even an implementation of a COTS application) were not likely to be successful. As of September 2019, CNCS officials stated that they were pursuing the option of a federal shared service as a solution to grants management. As of November 2019, according to CNCS officials, the agency had not yet established a timeframe to define test plans for the selected solution for the grant monitoring system project because the decision to pursue the federal shared services as a solution for grants management is very recent. CNCS officials agreed to provide GAO with an update as further progress is made on this recommendation.

Recommendation: To ensure that DHS effectively implements FITARA, the Secretary of Homeland Security should direct the Under Secretary for Management to direct the Chief Information Officer to establish time frames and implement a plan for (1) identifying the department's future IT skillset needs as a result of DHS's new delivery model, (2) conducting a skills gap analysis, and (3) resolving any skills gaps identified.

Agency: Department of Homeland Security
Status: Open

Comments: In 2018 and 2019, the DHS Office of the Chief Information Officer implemented a Strategic Workforce Planning initiative that included (1) identifying the department's future IT skillset needs, and (2) conducting a skills gap analysis related to these needs. The department is currently working to resolve the skills gaps identified during the initiative. We will continue to monitor and evaluate the Department's efforts to resolve these skills gaps.

Recommendation: To ensure that DHS effectively implements FITARA, the Secretary of Homeland Security should direct the Under Secretary for Management to update the department's acquisition policies and guidance to be consistent in identifying that the DHS CIO is to certify investments' incremental development activities.

Agency: Department of Homeland Security
Status: Open

Comments: In response to our recommendation, DHS updated its agile development policy to specify that the DHS CIO is responsible for certifying investments' incremental development activities, which is consistent with the Department's Acquisition Management Instruction. However, DHS has not yet updated its Systems Engineering Life Cycle Instruction and Guidebook to be consistent in specifying that this certification is the responsibility of the DHS CIO. We will continue to monitor the Department's progress in implementing this recommendation.

Recommendation: To ensure that DHS effectively implements FITARA, the Secretary of Homeland Security should direct the Under Secretary for Management to update DHS headquarters', Customs and Border Protection's, and U.S. Coast Guard's processes to track, for all contracts and agreements, the IT investment with which each is associated (as applicable).

Agency: Department of Homeland Security
Status: Open

Comments: In response to our recommendation, Customs and Border Protection implemented a process to track the IT investments associated with each contract and agreement. The U.S. Coast Guard also implemented a process to track the IT investments associated with its contracts; however, it has not yet demonstrated that it has implemented such a process for tracking the IT investments associated with its agreements. Further, DHS headquarters is still working to establish a process for tracking the IT investments associated with its contracts and agreements. We will continue to monitor and evaluate the Department's progress in implementing this recommendation.

Recommendation: To ensure that DHS effectively implements FITARA, the Secretary of Homeland Security should direct the Under Secretary for Management to update and implement the process DHS uses for assessing the risks of major IT investments to ensure that the CIO rating reported to the Dashboard fully reflects the CIO's assessment of each major IT investment.

Agency: Department of Homeland Security
Status: Open

Comments: DHS concurred with our recommendation. In May 2020, DHS officials stated that the Office of the CIO began piloting a new program health assessment process in the second quarter of fiscal year 2020, and DHS intends to report the program ratings resulting from that process to the IT Dashboard. We will continue to monitor and evaluate the Department's efforts to implement this new process.

Recommendation: To allow DOE management to effectively monitor invoice reviews and have assurance that this control activity is operating as intended, the Secretary of Energy should establish a DOE-wide invoice review policy that includes requirements for sites to establish well-documented invoice review operating procedures.

Agency: Department of Energy
Status: Open

Comments: In its comments on a draft of the report in March 2017, DOE concurred in principle with this recommendation, stating that it already had an established, detailed DOE-wide invoice review policy provided in DOE's Financial Management Handbook and in the DOE Acquisition Guide. In February 2020, DOE issued an update to its Financial Management Handbook that included additional procedures to address intra-governmental payment and collection transactions. However, neither the prior version of the Financial Management Handbook nor the additional information includes invoice review procedures. The Financial Management Handbook refers users to the DOE Acquisition Guide for procedures for invoice review. However, the Acquisition Guide states that it is intended to offer general guiding principles for approving officials to consider when reviewing and analyzing cost elements included in contract invoices--as opposed to detailed procedures for invoice review--and does not require sites to establish well-documented invoice review operating procedures, as we recommended.

Recommendation: To help DOE take a more strategic approach to managing improper payments and risk, including fraud risk, the Secretary of Energy should implement leading practices for managing the department's risk of fraud, including creating a structure with a dedicated entity within DOE to design and oversee fraud risk management activities.

Agency: Department of Energy
Status: Open
Priority recommendation

Comments: In its comments on a draft of the report in March 2017, DOE partially agreed with the recommendation. In its written comments on the report, DOE stated that it considered the recommendation to be closed without corrective action and that it would rely on the existing Office of Financial Policy and Internal Controls and on the DOE Office of Inspector General (OIG) to design and oversee financial fraud risk management activities. However, we disagree that relying in part on the OIG to design and oversee fraud risk management activities meets best practices because, according to GAO's Fraud Risk Framework, the dedicated entity should not include the OIG so that the OIG can maintain its independence. In May 2020, DOE officials said they were developing a fraud risk and data analytics framework. Among other steps, DOE expects to establish a new group in fiscal year 2020 that will oversee DOE's fraud risk management activities. We will continue to monitor DOE's progress in implementing this recommendation.

Recommendation: To help DOE take a more strategic approach to managing improper payments and risk, including fraud risk, the Secretary of Energy should implement leading practices for managing the department's risk of fraud, including conducting fraud risk assessments that are tailored to each program and use the assessments to develop a fraud risk profile

Agency: Department of Energy
Status: Open

Comments: In its comments on a draft of the report in March 2017, DOE concurred with the substance of the recommendation; however they considered the recommendation to be closed without corrective action because DOE believed that its risk assessments met the requirements of the Improper Payments Elimination and Recovery Improvement Act of 2012, as reported by the Office of Inspector General (OIG), and because it has implemented updates to OMB Circular A-123 that added requirements related to managing fraud risk and adherence to GAO's Fraud Risk Framework. However, we found that DOE has not conducted fraud risk assessments that were tailored to its programs and, therefore, do not allow the department to create a fraud risk profile. We also found that, although DOE updated its internal control assessment tools with a list of fraud risks as required by OMB Circular A-123, the list of risks were the same for all DOE sites and were not tailored to the sites' different programs. In May 2020, DOE officials said they were developing a fraud risk and data analytics framework. Among other steps, the framework is expected to include changes to DOE's process to develop its fraud risk profile, beginning in fiscal year 2020. We will continue to monitor DOE's progress in implementing this recommendation.

Recommendation: To help DOE take a more strategic approach to managing improper payments and risk, including fraud risk, the Secretary of Energy should implement leading practices for managing the department's risk of fraud, including developing and documenting an antifraud strategy that describes the programs' approaches for addressing the prioritized fraud risks identified during the fraud risk assessment.

Agency: Department of Energy
Status: Open

Comments: In its comments on the draft report in March 2017, DOE concurred with this recommendation but considered the recommendation closed without corrective action because DOE had implemented the updated OMB Circular A-123 and because DOE's antifraud strategy was embedded in the DOE internal control program. However, DOE officials told us that they had not developed or documented a DOE-wide antifraud strategy or directed individual programs to develop program-specific strategies. Furthermore, DOE's implementation of OMB Circular A-123 included adding a list of potential risks to their internal control assessment tool that were the same for all DOE sites and were not tailored to the sites' different programs. In May 2020, DOE officials said they were developing a fraud risk and data analytics framework. Among other steps, DOE is planning to develop an antifraud strategy in fiscal year 2021. We will continue to monitor DOE's progress in implementing this recommendation.

Recommendation: To help DOE take a more strategic approach to managing improper payments and risk, including fraud risk, the Secretary of Energy should implement leading practices for managing the department's risk of fraud, including designing and implementing specific control activities, including fraud awareness training and data analytics, to prevent and detect fraud and other improper payments.

Agency: Department of Energy
Status: Open

Comments: In its comments on the draft report in March 2017, DOE stated that it concurred in principle with the recommendation, but that it had implemented the recommendation. In May 2020, DOE officials said they were developing a fraud risk and data analytics framework. Among other steps, DOE is planning to begin in fiscal year 2022 to use data analytics across the agency to prevent fraud. We will continue to monitor DOE's progress in implementing this recommendation.

Recommendation: To help ensure that necessary data are available to employ data analytics as a tool to perform contractor cost-surveillance activities, the Secretary of Energy should require contractors to maintain sufficiently detailed transaction-level cost data that are reconcilable with amounts charged to the government, including (1) cost data that, at a minimum, represent a full data population and (2) the details necessary to determine the nature of each cost transaction, with such identifiers as transaction date, dollar amount, item or service description, and transaction codes to indicate the type of cost represented (e.g., construction materials, property lease, and office supplies).

Agency: Department of Energy
Status: Open

Comments: In its comments on the draft report in March 2017, DOE did not agree to implement this recommendation because officials believe that the recommendation establishes agency-specific requirements for DOE contractors that are more prescriptive than current federal requirements. In May 2020, DOE officials said they were developing a fraud risk and data analytics framework. Among other steps, DOE is planning to begin in fiscal year 2022 to use data analytics across the agency to prevent fraud. We will continue to monitor DOE's progress in implementing this recommendation.

Recommendation: To help ensure that NNSA effectively manages the performance of its programs, the Secretary of Energy should establish a program management policy that (1) assigns responsibilities and delegates authority to program managers and establishes expectations of competence for them, in accordance with federal internal control standards, and (2) addresses leading program management practices, such as developing program plans.

Agency: Department of Energy
Status: Open
Priority recommendation

Comments: DOE stated that it will address our recommendation as part of its effort to meet the requirements of the Program Management Improvement Accountability Act of 2016 (Act). This Act requires the Office of Management and Budget (OMB) to adopt government-wide standards, policies, and guidelines for program and project management for agencies. In June 2018, OMB issued guidelines requiring federal agencies to submit a 5-year plan for implementing the Act. In November 2018, DOE submitted a draft implementation plan to OMB that described DOE's strategy for developing a DOE program management policy. In particular, its draft plan stated that DOE has established a working group to help develop the department's program management policy. To address our recommendation, DOE needs to finalize and issue its program management policy. We will continue to monitor DOE's actions.

Recommendation: To help ensure that NNSA develops and maintains a cadre of professional, effective, and capable program managers in accordance with leading program management practices and federal internal control standards, the Secretary of Energy should establish a training program for program managers.

Agency: Department of Energy
Status: Open

Comments: DOE stated that it will address our recommendation as part of its effort to meet the requirements of the Program Management Improvement Accountability Act of 2016 (Act). This Act requires the Office of Personnel Management (OPM) to issue regulations identifying key program management skills and competencies, as well as to establish a new career path for program managers within an agency. In April and May of 2019, OPM issued guidance documents that identify competencies for program managers and update the job series classification for program managers. OPM officials also said that they have drafted a career path for program managers, which will highlight training and skills needed to progress in a program management career. In addition, DOE stated that it is holding working group meetings to develop strategies for program management training and certification. To address our recommendation, DOE needs to continue working with OPM and finalize its training program for program managers.

Recommendation: To assist CISOs in carrying out their responsibilities, the Director of OMB should issue guidance for agencies' implementation of the FISMA 2014 requirements to ensure that (1) senior agency officials carry out information security responsibilities and (2) agency personnel are held accountable for complying with the agency-wide information security program. This guidance should clarify the role of the agency CISO with respect to these requirements, as well as implementing the other elements of an agency-wide information security program, taking into account the challenges identified in this report.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget (OMB) partially concurred with this recommendation, but does not intend to directly issue guidance as recommended. As of June 2020, OMB has not provided sufficient evidence that it has implemented this recommendation. We will continue to monitor OMB's implementation of this recommendation.

Recommendation: To ensure that the role of the SISO is defined in department policy in accordance with FISMA 2014, the Secretary of Defense should define the SISO's role in department policy for ensuring that the department has procedures for incident detection, response, and reporting.

Agency: Department of Defense
Status: Open

Comments: In response to our report, DOD partially concurred with our recommendation; however, DOD subsequently concurred with the recommendation and is taking steps to implement it. The department stated that the issuance of an updated Cyber Incident Handling guidance is on track to be completed and coordinated in the third quarter of fiscal year 2018. As of June 2020, it has not yet provided sufficient evidence that it has implemented the recommendation. When we confirm what actions DOD has taken, we will provide updated information.

Recommendation: To ensure that the role of the CISO is defined in department policy in accordance with FISMA 2014, the Secretary of State should define the CISO's role in department policy for ensuring that the department has procedures for incident detection, response, and reporting.

Agency: Department of State
Status: Open

Comments: The Department of State (State) concurred with this recommendation. However, as of June 2020, the department has not yet provided sufficient evidence that it has implemented the recommendation. When we receive additional evidence from State, we will review it to determine whether the department has addressed the recommendation.

Recommendation: To ensure that the role of the CISO is defined in department policy in accordance with FISMA 2014, the Secretary of Transportation should define the CISO's role in department policy for ensuring that subordinate security plans are documented for the department's information systems.

Agency: Department of Transportation
Status: Open

Comments: The Department of Transportation (DOT) concurred with the recommendation and is currently updating its Cybersecurity Policy. The Department plans to be complete by June 29, 2019. As of June 2020, the department has not yet provided sufficient evidence that it has implemented the recommendation. Upon receiving additional evidence from DOT, we will review it to determine whether the department has addressed the recommendation.

Recommendation: To ensure that the role of the CISO is defined in department policy in accordance with FISMA 2014, the Secretary of Transportation should define the CISO's role in department policy for ensuring that security controls are tested periodically.

Agency: Department of Transportation
Status: Open

Comments: The Department of Transportation (DOT) concurred with the recommendation and is currently updating its Cybersecurity Policy. The Department plans to be complete by June 29, 2019. As of June 2020, the department has not yet provided sufficient evidence that it has implemented the recommendation. Upon receiving additional evidence from DOT, we will review it to determine whether the department has addressed the recommendation.

Recommendation: To ensure that the role of the SAISO is defined in agency policy in accordance with FISMA 2014, the Administrator of the National Aeronautics and Space Administration should define the SAISO's role in agency policy for oversight of security for information systems that are operated by contractors on the agency's behalf.

Agency: National Aeronautics and Space Administration
Status: Open

Comments: The National Aeronautics and Space Administration (NASA) concurred with our recommendation. As of June 2020, NASA stated that the agency is working to update the relevant policy to address this recommendation, but the update is taking longer than expected; NASA expects the policy to be updated and the review process to be completed by November 30, 2020. We will examine the evidence when NASA provides it.

Recommendation: To strengthen management of the Direct Loan Program and ensure good customer service for borrowers, the Secretary of Education should direct the Office of Federal Student Aid's Chief Operating Officer to review its methods of providing instructions and guidance to servicers, identifying areas to improve clarity and sufficiency, and ensure consistent delivery of instructions and guidance to ensure program integrity and improve service to borrowers. For example, the Department could consider implementing a detailed, common servicing manual for the Direct Loan program.

Agency: Department of Education
Status: Open
Priority recommendation

Comments: The Department of Education agreed with this recommendation and reviewed its process for providing guidance to servicers. It has issued a few clarifications to servicers to help with consistency and reported that it intends to incorporate this recommendation into its acquisition plan for a new loan servicing system. To fully implement this recommendation, the agency needs to demonstrate that the new Direct Loan servicing system will provide clear and consistent instructions and guidance to servicers to ensure program integrity and improve service to borrowers. As of February 2020, Education officials said implementation of this recommendation was still in progress, pending completion in October 2021. At that time, the agency expects the re-design of its student loan financial services environment, which will include additional guidance to servicers, to be fully operational.

Recommendation: To ensure consistent implementation of the Buy Indian Act procurement authority across the agencies and to enhance oversight of implementation of the Act at regional offices, the Secretaries of the Interior and Health and Human Services should direct the Bureau of Indian Affairs and Indian Health Service respectively, to clarify and codify their policies related to the priority for use of the Buy Indian Act, including whether the Buy Indian Act should be used before other set-aside programs.

Agency: Department of Health and Human Services
Status: Open

Comments: The Department of Health and Human Services concurred with this recommendation. The Indian Health Service (IHS) informed GAO that in order to clarify and codify the policies related to priority for use of the Buy Indian Act, formal rulemaking was required. IHS published the intent to promulgate the regulation in the Fall 2019 and Spring 2020 Unified Agendas. According to IHS officials, the timeline for completion of the new regulation is December 31, 2020.

Recommendation: To ensure consistent implementation of the Buy Indian Act procurement authority across the agencies and to enhance oversight of implementation of the Act at regional offices, the Secretaries of the Interior and Health and Human Services should direct the Bureau of Indian Affairs and Indian Health Service respectively, to collect data on regional offices' implementation of key requirements, such as challenges to self-certification.

Agency: Department of Health and Human Services
Status: Open

Comments: The Department of Health and Human Services concurred with this recommendation. The Indian Health Service (IHS) informed GAO that in order to clarify and codify policies related to priority for use of the Buy Indian Act, formal rulemaking was required. IHS published the intent to promulgate the regulation in the Fall 2019 and Spring 2020 Unified Agendas. Further, the officials stated that once the new Buy Indian regulation is promulgated, IHS plans to identify a plan to collect data on area office implementation of key policy requirements, including monitoring authentication of contractor credentials. According to IHS officials, due to limitations within the Federal Procurement Data System- Next Generation IHS is unable to collect the necessary data until the rule is promulgated.

Recommendation: To help agencies decide whether to use ESPCs to consolidate federal data centers, the Director of the Office of Management and Budget should document, for the purposes of scoring ESPCs, (1) what qualifies as energy-related savings and (2) the allowable proportion of energy and energy-related cost savings.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: In July 2020, GAO requested information on the status of the recommendation. We will update the recommendation's status when information is received from OMB.

Recommendation: To help ensure contracting officers carry out the requirements of Section 802, the Secretary of Defense, Secretary of State, and Administrator of USAID should revise the processes and guidance governing management reviews of procurements to ensure that such reviews assess whether contracting officers are complying with the provisions of Section 802.

Agency: Department of Defense
Status: Open

Comments: DOD concurred with GAO's recommendation. Following a May 2015 Federal Acquisition Regulation update to reflect the requirements of Section 802 of the National Defense Authorization Act for Fiscal Year 2013, the Office of Defense Procurement and Acquisition Policy drafted supplementary information for an update of the agency's Procedures, Guidance, and Information (PGI) that was considered and rejected by Defense Acquisition Regulation Council. In July 2019, the Office of Defense Pricing and Contracting reported that new PGI guidance would be drafted that will require management reviews to consider compliance with Section 802 requirements included in the Federal Acquisition Regulation. As of August 2020, we have been unable to determine the status of this guidance.