Recommendation: The Executive Director should ensure the development and implementation of policies and procedures for incorporating key cybersecurity activities into IT project planning, including scheduling, requirements management, and risk management. (Recommendation 1)

Agency: Office of Congressional Workplace Rights
Status: Open

Comments: In January 2020, OCWR noted that it was in the process of revising its IT systems project planning to ensure the development and implementation of policies and procedure incorporating key cybersecurity activities. The agency also stated that it plans to hire an IT Security Project Manager in order to acquire the necessary cybersecurity expertise needed to implement this recommendation and to ensure that sufficient time and resources can be dedicated to the development and implementation of these policies and procedures. We will continue to monitor OCWR's progress in addressing this recommendation.

Recommendation: The Executive Director should ensure the development and implementation of oversight procedures for each externally-operated system that include (1) establishing security and privacy requirements, (2) planning the assessment of security controls, (3) conducting the assessment, and, (4) reviewing the assessment. (Recommendation 2)

Agency: Office of Congressional Workplace Rights
Status: Open

Comments: In January 2020, OCWR noted that it was beginning to plan for developing and implementing oversight procedures for each externally-operated system. We will continue to monitor OCWR's progress in addressing this recommendation.

Recommendation: The Executive Director should ensure the establishment of roles and responsibilities for a risk executive function. (Recommendation 3)

Agency: Office of Congressional Workplace Rights
Status: Open

Comments: In January 2020, OCWR noted that it had expanded the office's IT Director's role to formally include the functions of an IT Risk Executive and was in the process of establishing the roles and responsibilities. We will continue to monitor OCWR's progress in addressing this recommendation.

Recommendation: The Executive Director should ensure the development and implementation of a cybersecurity risk management strategy. (Recommendation 4)

Agency: Office of Congressional Workplace Rights
Status: Open

Comments: In January 2020, OCWR noted that it was beginning to plan for developing and implementing a cybersecurity risk management strategy. We will continue to monitor OCWR's progress in addressing this recommendation.

Recommendation: The Executive Director should ensure commitment to a time frame for developing and implementing policies and procedures for managing cybersecurity risk. (Recommendation 5)

Agency: Office of Congressional Workplace Rights
Status: Open

Comments: In January 2020, OCWR noted that, once the position of IT Security Project Manager is filled and the IT Risk Executive functions are formalized, the agency is planning to commit to a time frame for developing and implementing policies and procedures for managing cybersecurity risk. We will continue to monitor OCWR's progress in addressing this recommendation

Recommendation: The Executive Director of OCWR, in collaboration with relevant managers, should establish a policy that requires a schedule of tasks to be developed, documented, and updated throughout the lifetime of IT system projects. (Recommendation 1)

Agency: Office of Congressional Workplace Rights
Status: Open

Comments: The agency agreed with the recommendation. OCWR officials stated that they will be implementing a policy to ensure that project planning steps, including a schedule of tasks, will be included and documented for future IT projects.

Recommendation: The Executive Director of OCWR should identify and assess risks in establishing and maintaining a permanent records retention program, and develop policies and procedures to ensure that risks are properly addressed. (Recommendation 2)

Agency: Office of Congressional Workplace Rights
Status: Open

Comments: The agency agreed with the recommendation. OCWR officials stated that they have hired a contractor to assist with various risk management activities related to OCWR's permanent records retention program, including identifying and assessing risks and developing policies and procedures to address any risks.

Recommendation: The Executive Director of OCWR should identify desired performance results, develop performance measures that demonstrate the degree to which the desired results were achieved, and report progress toward those results in OCWR's annual reports. (Recommendation 3)

Agency: Office of Congressional Workplace Rights
Status: Open

Comments: The agency agreed with the recommendation. OCWR officials stated that they are reassessing desired performance results, developing new performance measures to monitor progress towards those results, and will clearly report OCWR's progress in future annual reports.

Recommendation: The Executive Director of OCWR should collect relevant data through a survey or other mechanisms, and use the information to evaluate the effectiveness of education and outreach efforts and the extent to which they are reaching all covered legislative branch populations. (Recommendation 4)

Agency: Office of Congressional Workplace Rights
Status: Open

Comments: The agency agreed with the recommendation. According to OCWR officials, they are working with congressional oversight committees and covered legislative branch offices to obtain data through surveys or other methods that will enable them to evaluate the effectiveness and coverage of OCWR's education and outreach efforts.

Recommendation: The Executive Director of OCWR should integrate IT planning and implementation into the agency's strategic planning process. (Recommendation 5)

Agency: Office of Congressional Workplace Rights
Status: Open

Comments: The agency agreed with the recommendation. OCWR officials stated that they intend to revise the agency's strategic plan, including integrating IT planning and implementation into the strategic planning process, after they gain more experience with the new procedures required by the Congressional Accountability Act (CAA) Reform Act of 2018.

Recommendation: The Executive Director of OCWR should incorporate key strategic human capital management practices, such as developing strategies to recruit and retain staff with mission-critical skills, into the strategic planning process. (Recommendation 6)

Agency: Office of Congressional Workplace Rights
Status: Open

Comments: The agency agreed with the recommendation. OCWR officials reported that they hired a contractor to better incorporate key management practices, such as developing strategies for recruiting and retaining staff with mission-critical skills, into OCWR's human capital plan and strategic planning process.

Recommendation: The Assistant Secretary of Labor for Occupational Safety and Health should explore the feasibility of requiring a corporate identification number in its inspection database and enabling its website to be searched by that number. This should include exploring the following issues: (1) which corporate identification number would be most appropriate to require; (2) options for obtaining this number from employers; and (3) options for entering this number in its database that would prevent or minimize delays in closing inspection records. (Recommendation 1)

Agency: Department of Labor: Occupational Safety and Health Administration
Status: Open

Comments: OSHA did not state whether it agreed with this recommendation. The agency acknowledged the potential utility of obtaining a unique identifier from each employer and said it will continue to promote the collection of Employer Identification Numbers (EIN) or Tax Identification Numbers (TIN) whenever possible by issuing a revised memorandum to field staff to reinforce the importance of collecting this information. OSHA stated that it does not view EINs as confidential or protected from disclosure. However, it expressed concerns about protecting TINs and Social Security Numbers from disclosure, and noted that it would not be able to make a data field available for public search if it contained either of these numbers. OSHA also raised concerns about the financial cost associated with redesigning the agency's data system. We encourage OSHA to explore options for addressing these concerns as it further considers how to implement this recommendation.

Recommendation: The Secretary of Defense should provide information to contracting officials to advise them that the OSHA website is a resource for information about contractors' workplace safety and health records. (Recommendation 2)

Agency: Department of Defense
Status: Open

Comments: DOD agreed with this recommendation and identified implementation timelines. We will monitor the agency's progress.

Recommendation: The Secretary of Defense should explore the feasibility of requiring a safety performance rating for contracts in industries that have relatively high rates of occupational injuries, such as manufacturing, construction, and ship building and repairing. (Recommendation 3)

Agency: Department of Defense
Status: Open

Comments: DOD agreed with this recommendation and identified implementation timelines. We will monitor the agency's progress.

Recommendation: The Administrator of GSA should remedy the asbestos-related data shortcomings in IRIS, either by approving the proposed update to IRIS and its associated funding or by implementing an alternative plan to enter asbestos data via the existing interface. This alternative plan could include, for example, training more individuals to use the current database functions. (Recommendation 1)

Agency: General Services Administration
Status: Open

Comments: In March 2019, GSA indicated it will address this recommendation by updating and enhancing the asbestos module in IRIS to address the issues identified in our report. GSA intends to allocate available funding and complete the changes to IRIS by the end of fiscal year 2019. We will continue to follow-up with GSA about the status of this recommendation.

Recommendation: The Acting Commissioner of the Bureau of Labor Statistics should, upon completion of the pilot Household Survey of Occupational Injuries and Illnesses, evaluate the feasibility of measuring injuries and illnesses to certain worker populations--specifically, children aged 17 and under, child household workers, and those employed on farms with 10 or fewer workers--in any final survey scope, or determine a way to gather information on these populations. (Recommendation 1)

Agency: Department of Labor
Status: Open

Comments: BLS noted that it had completed the pilot Household Survey of Occupational Injuries and Illnesses (HSOII) in December of 2018 and stated that BLS will be analyzing the quality of the data in the second and third quarters of 2019 and publishing a report at the end of 2019. To evaluate the feasibility of measuring injuries and illnesses to workers under 18, BLS stated it will conduct a literature review on questionnaire design for respondents under age 18, and reviewing the evidence on the quality of data collected through proxy reporting, e.g. adults reporting on injuries/illnesses for their children. The agency also reported that it will issue an assessment of the suitability of the existing HSOII instrument to gather data on working children at the end of fiscal year 2019. We will consider closing this recommendation after receipt and review of this final assessment report.

Recommendation: The Administrator of the Wage and Hour Division should establish specific metrics and associated targets for child labor-related outreach in agriculture. (Recommendation 2)

Agency: Department of Labor
Status: Open

Comments: The agency agreed with this recommendation. The agency noted that it has existing performance measures that separately track the number of employer outreach events and the number of events involving child labor. The agency stated that, in response to GAO's recommendation, it will introduce a new measure in FY2020 that is specific to child labor-related outreach in the agricultural industry. The agency said that for the remainder of FY2019, the agency will develop the new measure, establish a baseline, and set an appropriate target for child labor-related outreach in the agricultural industry. The agency also said staff would be trained on the new measure in early 2020. We will close this recommendation once the agency institutes this new metric.

Recommendation: The Administrator of the Wage and Hour Division should develop performance metrics or other measures specific to its child labor enforcement approach, such as whether WHD investigations are conducted at establishments where children are likely to be working. (Recommendation 3)

Agency: Department of Labor
Status: Open

Comments: WHD agreed that it could develop either an internal performance metric or new planning guidance and reporting requirements to ensure that WHD's child labor enforcement efforts focus on industries, establishments, and time periods in which children are likely to be working or injured. Although planning guidance and reporting requirements can encourage field office staff to focus more on child labor, we believe it is important to include a measurement of WHD's overall child labor enforcement approach as part of any new planning guidance and reporting requirements. We will consider closing this recommendation when WHD develops such performance metrics.

Recommendation: The Administrator of the Wage and Hour Division and the Assistant Secretary of the Occupational Safety and Health Administration should update and routinely monitor the 1990 WHD and Occupational Safety and Health Administration memorandum of understanding and establish documented procedures for monitoring the exchange of and actions taken on referrals. (Recommendation 4)

Agency: Department of Labor
Status: Open

Comments: To implement this recommendation, WHD and OSHA have agreed to establish a working group by the second quarter of FY2019, which will aim to maximize efficient information sharing between the two agencies. Specifically, this working group will update the existing WHD-OSHA Memorandum of Understanding, assess the results of referrals between WHD and OSHA, and make recommendations regarding the need for data collection and review. We will close this recommendation when these efforts are complete and supporting documentation has been provided.

Recommendation: To help determine whether current efforts are effective or if additional action may be needed, such as development of a workplace violence prevention standard for health care employers, the Secretary of Labor should direct the Assistant Secretary for Occupational Safety and Health to develop and implement cost-effective ways to assess the results of the agency's efforts to address workplace violence.

Agency: Department of Labor
Status: Open
Priority recommendation

Comments: According to OSHA officials, the agency had a study underway to review OSHA's workplace violence enforcement cases in health care to better understand the obstacles OSHA compliance officers encountered during these investigations and identify factors which led to citations. The study was intended to help compliance officers develop citations in workplace violence cases. In addition, in December 2016, OSHA published a Request for Information on Preventing Workplace Violence in Healthcare and Social Assistance (RFI) to help identify workplace violence prevention requirements that could be effective and economical if a regulation were to be developed. OSHA reported in June 2018 that it is evaluating the information it received in response to the RFI and is gathering information on best practices in certain industries. As of April 2020, OSHA completed its review of the submissions in response to the RFI, is developing regulatory options, and will obtain additional input from potentially affected small businesses. The agency anticipates completing this process by the end of 2020. To fully implement this recommendation, the agency should complete its process of obtaining input on the regulatory options the agency is developing, and finalize its determination on whether regulatory action is needed.