Efforts Made to Achieve Progress Need to Be Maintained and Expanded to Fully Address All Areas (GAO-23-106674)
Summary
GAO testimony, GAO-23-106674, before the Senate Committee on Homeland Security and Governmental Affairs on April 20, 2023, the statement of Comptroller General Gene L. Dodaro on the High-Risk Series. It states that Congress and executive agencies have made substantial progress on high-risk issues since the 2021 update, with sixteen of 34 areas improving. It notes that the federal government is one of the world's largest and most complex entities, with about $6.3 trillion in outlays. The title states that the efforts made need to be maintained and expanded to fully address all areas.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Full text
United States Government Accountability Office
Testimony
Before the Committee on Homeland
Security and Governmental Affairs,
U.S. Senate
For Release on Delivery
Expected at 10:00 a.m. ET
April 20, 2023 HIGHRISK SERIES
Efforts Made to Achieve
Progress Need to Be
Maintained and Expanded
to Fully Address All Areas
Statement of Gene L. Dodaro
Comptroller General of the United States
Accessible Version
GAO-23-106674
April 2023
GAO Highlights HIGH-RISK SERIES
Highlights of GAO-23-106674, a testimony Efforts Made to Achieve Progress Need to Be
before the Committee on Homeland Security
and Governmental Affairs, U.S. Senate Maintained and Expanded to Fully Address All Areas
Why GAO Did This Study What GAO Found
The federal government is one of the Congress and executive agencies have made substantial progress addressing
world’s largest and most complex high-risk issues since the previous High-Risk List update in 2021. Sixteen of 34
entities. About $6.3 trillion in outlays in high-risk areas improved since 2021. This is the most progress in the 8 years
fiscal year 2022 funded a broad array since GAO started rating high-risk areas. Two of the 16 areas are being removed
of programs and operations. GAO’s from the list: Pension Benefit Guaranty Corporation (PBGC) Insurance Programs
High-Risk Series identifies government and the 2020 Decennial Census. Since our last update, there were approximately
operations with vulnerabilities to fraud,
$100 billion in financial benefits due to improvements in high-risk areas.
waste, abuse, and mismanagement, or
in need of transformation.
Changes to the High-Risk List Since 2021
This biennial update describes the
status of high-risk areas, outlines
actions that are needed to ensure
further progress, and identifies new
high-risk areas needing attention by
the executive branch and Congress.
Lasting solutions to high-risk problems
save billions of dollars, improve service
to the public, and strengthen
government performance and
accountability. In the past 17 years,
financial benefits totaled $675 billion.
GAO uses five criteria to assess
progress in addressing high-risk areas: Text of Changes to the High-Risk List Since 2021
(1) leadership commitment; (2) agency · 2 areas removed
capacity; (3) an action plan; (4)
monitoring efforts; and (5) · Pension Benefit Guaranty Corporation (PBGC) Insurance
demonstrated progress. Programs
What GAO Recommends · 2020 Decennial Census
Executive branch agencies need to · 3 areas added since 2021
address hundreds of open GAO
recommendations to bring about · Strengthening Management of the Federal Prison System (2023)
lasting solutions to the 37 remaining
high-risk areas. Continued · Health and Human Services Leadership and Coordination of
congressional oversight is essential to Public Health Emergencies (2022)
achieve greater progress and
legislation is needed in some cases. · Unemployment Insurance System (2022)
Source: GAO analysis of the High-Risk List areas. I GAO-23-106674
The PBGC Insurance Programs area is being removed because Congress
provided funding to troubled multiemployer pension plans, which has led to an
improved financial position for the PBGC multiemployer insurance program.
Additionally, the financial position of the PBGC single-employer insurance
program has improved gradually in recent years. PBGC now projects a very low
risk of insolvency over the next 15 years for both programs. GAO will continue to
View GAO-23-106674. For more information, monitor the funds.
contact Michelle Sager at (202) 512-6806 or
sagerm@gao.gov. The 2020 Decennial Census is being removed because the Census Bureau
made progress in addressing data quality concerns, chartered a high-level
United States Government Accountability Office
governance group, and implemented priority recommendations. GAO will monitor
2030 Census planning—already underway—for emerging risks and challenges.
GAO is adding one new area to the 2023 High-Risk List: Strengthening
Management of the Federal Prison System. This area is being added, in part,
due to the Bureau of Prisons’ long-standing challenges managing staff and
resources, and planning and evaluation programs that help incarcerated people
have a successful return to the community.
In 2022, GAO added two other areas to the High-Risk List. The Department of
Health and Human Services’ (HHS) Leadership and Coordination of Public
Health Emergencies was added because, for more than a decade, GAO has
found persistent deficiencies in HHS’s leadership role preparing for and
responding to public health emergencies, including those that result from
extreme weather events. GAO added the Unemployment Insurance System area
because administrative and program integrity challenges in the joint federal-state
program have affected the system’s ability to meet the needs of unemployed
workers. These challenges also expose the system to significant financial losses.
GAO’s 2023 High-Risk List
High-risk area Change since 2021
Strengthening the Strategic Human Capital Management ↑ indicates area progressed on one
or more criteria since 2021
Foundation for Efficiency
and Effectiveness Managing Federal Real Property ● indicates no change
Funding the Nation’s Surface Transportation Systema, b n/a
Modernizing the U.S. Financial Regulatory Systema ● indicates no change
Resolving the Federal Role in Housing Financea ● indicates no change
USPS Financial Viabilitya ↑ indicates area progressed on one
or more criteria since 2021
Management of Federal Oil and Gas Resources ● indicates no change
Limiting the Federal Government’s Fiscal Exposure by ↑ indicates area progressed on one
or more criteria since 2021
Better Managing Climate Change Risksa
Improving the Management of IT Acquisitions and ● indicates no change
Operations
Improving Federal Management of Programs that Serve ↑ indicates area progressed on one
or more criteria since 2021
Tribes and Their Members
U.S. Government’s Environmental Liabilitya ↑ indicates area progressed on one
or more criteria since 2021
Emergency Loans for Small Businessesc n/a
Strengthening Management of the Federal Prison System n/a
(new)b
Transforming DOD Program DOD Weapon Systems Acquisition ● indicates no change
Management DOD Financial Management ● indicates no change
DOD Business Systems Modernization ↓ indicates area declined on one or
more criteria
DOD Approach to Business Transformation ↑ indicates area progressed on one
or more criteria since 2021
Ensuring Public Safety and Ensuring the Cybersecurity of the Nationa ↑ indicates area progressed on one
or more criteria since 2021
Security
Strengthening Department of Homeland Security IT and ● indicates no change
Financial Management Functions
Ensuring the Effective Protection of Technologies Critical to ↑ indicates area progressed on one
or more criteria since 2021
U.S. National Security Interests
Improving Federal Oversight of Food Safetya ● indicates no change
High-risk area Change since 2021
Protecting Public Health through Enhanced Oversight of ● indicates no change
Medical Products
Transforming EPA’s Process for Assessing and Controlling ↑ indicates area progressed on one
or more criteria since 2021
Toxic Chemicals
Government-wide Personnel Security Clearance Process ● indicates no change
National Efforts to Prevent, Respond to, and Recover from n/a
Drug Misusec
HHS Leadership and Coordination of Public Health n/a
Emergencies (new in 2022)b
Managing Federal Acquisition and Program Management for DOE’s National ↑ indicates area progressed on one
or more criteria since 2021
Contracting More Effectively Nuclear Security Administration and Office of
Environmental Management
NASA Acquisition Management ↑ indicates area progressed on one
or more criteria since 2021
DOD Contract Management ● indicates no change
VA Acquisition Management ↑ indicates area progressed on one
or more criteria since 2021
Assessing the Efficiency Enforcement of Tax Lawsa ● indicates no change
and Effectiveness of Tax
Law Administration
Modernizing and Medicare Program and Improper Payments ● indicates no change
Safeguarding Insurance and Strengthening Medicaid Program Integritya ● indicates no change
Benefit Programs Improving and Modernizing Federal Disability Programs ● indicates no change
National Flood Insurance Programa ↑ indicates area progressed on one
or more criteria since 2021
Managing Risks and Improving VA Health Care ↑ indicates area progressed on one
or more criteria since 2021
Unemployment Insurance System (new in 2022)b n/a
Legend: h indicates area progressed on one or more criteria since 2021; i indicates area declined on one or more criteria; ● indicates no change
indicates no change indicates no changeindicates no change; n/a = not applicable
Source: GAO. | GAO-23-106674
a
Legislation is likely to be necessary to effectively address this high-risk area.
b
Not rated because this high-risk area is newly added or primarily involves congressional action.
c
Rated for the first time because this high-risk area was newly added in 2021.
Letter
Letter
Chairman Peters, Ranking Member Paul, and Members of the
Committee:
Since the early 1990s, our high-risk program has focused attention on
government operations with greater vulnerabilities to fraud, waste, abuse,
and mismanagement, or that are in need of transformation to address
economy, efficiency, or effectiveness challenges. This effort, supported
by this committee and the House Committee on Oversight and
Accountability, has brought much needed attention to problems impeding
effective government and costing billions of dollars each year.
Our 2023 High-Risk List, which is being released today, includes 37
areas.1 Since our last update in 2021, 16 areas improved with two
showing sufficient progress to be removed from the High-Risk List. This is
the most progress in the 8 years since GAO started rating high-risk areas.
Where we have seen progress on high-risk issues, it has typically
involved three essential elements: congressional action or oversight,
commitment from top leaders at agencies, and active involvement by the
Office of Management and Budget (OMB).2 Such practices have
contributed to hundreds of billions of dollars saved since the High-Risk
List was established. Further progress to address the 37 areas remaining
on the High-Risk List can contribute to saving additional billions of dollars,
improving services to the public, and enhancing trust in the government.
Congressional attention and oversight to improve the management and
accountability of government are at the core of the high-risk program.
Congressional action, such as passing laws and holding hearings, plays a
critical role in making meaningful progress on high-risk areas.
Dedicated agency leadership is essential to progress in high-risk areas.
Sustained leadership commitment is the critical element for initiating and
enhancing progress and making the types of management and
operational improvements required for addressing high-risk areas.
OMB’s leadership role is especially important because many high-risk
areas are government-wide or involve multiple agencies. Also, there are
resource investments associated with correcting a number of the high-risk
1GAO, High-Risk Series: Efforts Made to Achieve Progress Need to Be Maintained and
Expanded to Fully Address All Areas, GAO-23-106203 (Washington, D.C.: Apr. 20, 2023).
2GAO, High-Risk Series: Key Practices to Successfully Address High-Risk Areas and
Remove Them from the List, GAO-22-105184 (Washington, D.C.: Mar. 3, 2022).
Page 1 GAO-23-106674
Letter
problems. The OMB Deputy Director for Management, top agency
leaders, and GAO have met regularly to discuss plans and actions to
address individual high-risk areas. These meetings have been critical to
achieving progress. OMB accelerated the pace of these meetings over
the past 2 years. Since the last high-risk update, OMB has convened 10
meetings on 12 high-risk areas. These trilateral meetings led to positive
results, as noted by the progress in 16 high-risk areas since our last
update in 2021. We expect OMB to continue to hold these meetings with
a goal of meeting on all high-risk areas before our next update in 2025.
Significant financial savings have resulted from efforts to address high-
risk areas. For example, over the past 17 years (fiscal years 2006 through
2022), financial benefits totaled nearly $675 billion—an average of about
$40 billion per year. Since our last update in 2021, we recorded
approximately $100 billion in financial benefits.3
Significant progress to address high-risk areas is possible with sustained
effort and attention. As shown in figure 1, most high-risk areas identified
over the years (roughly 53 percent) have either been removed from the
list or narrowed in scope as portions of the high-risk issues were
addressed. Many others have shown significant progress in other ways,
having met or partially met all five criteria that are essential to address
high-risk areas.
3Financial benefits are based on actions taken in response to our work, such as reducing
government expenditures, increasing revenues, or reallocating funds to other areas.
Page 2 GAO-23-106674
Letter
Figure 1: Progress in High-Risk Areas, 1990 to 2023
Data table for Figure 1: Progress in High-Risk Areas, 1990 to 2023
High-Risk area Number of Percentage
areas
Removed from list 29 42.6%
Narrowed in scope 7 10.3%
Significant progress 20 29.4%
Moderate progress 6 8.8%
Newly added, consolidated, requiring 6 8.8%
congressional action
Note: Some high-risk areas were narrowed in scope more than once and may have been removed
after they were narrowed. They are only counted once. Significant progress means the high-risk area
was rated as met or partially met on all criteria. Moderate progress means the high-risk area had at
least one criterion with a not met rating. Some areas were not rated because they were very recently
added.
Source: GAO. | GAO-23-106674
We rate agencies’ progress in addressing high-risk areas using our high-
risk criteria, summarized in figure 2.
Page 3 GAO-23-106674
Letter
Figure 2: Criteria Essential to Addressing High-Risk Areas
Text of Figure 2: Criteria Essential to Addressing High-Risk Areas
· LEADERSHIP COMMITMENT: Demonstrated strong commitment and
top leadership support.
· CAPACITY: Agency has the capacity (i.e., people and resources) to
resolve the risk(s).
· ACTION PLAN: A corrective action plan exists that defines the root
cause and solutions and provides an approach for substantially
completing corrective measures, including steps necessary to
implement solutions we recommended.
· MONITORING: A program has been instituted to monitor and
independently validate the effectiveness and sustainability of
corrective measures.
Page 4 GAO-23-106674
Letter
· DEMONSTRATED PROGRESS: Ability to demonstrate progress in
implementing corrective measures and in resolving the high-risk area.
Source: GAO analysis and icons. | GAO-23-106674
These criteria align with practices we identified as key to solving high-risk
challenges.4
Congressional action, such as passing laws and holding hearings, also
plays a critical role in making meaningful progress on high-risk areas. For
two high-risk areas, including Pension Benefit Guaranty Corporation
(PBGC) insurance programs, it is the primary action needed to address
the high-risk issue.
PBGC Insurance Programs Removed from the
HighRisk List
We are removing the PBGC Insurance Programs from the High-Risk List
because the financial position for the single-employer and multiemployer
programs has improved and the risk of near-term financial insolvency has
decreased significantly. PBGC now projects a very low risk of insolvency
over the next 15 years for both programs. PBGC insures the pension
benefits of more than 33 million American workers and retirees who
participate in about 25,200 private-sector defined benefit plans with about
$128 billion in assets.
Provisions in the American Rescue Plan Act of 2021 provided special
financial assistance for certain struggling multiemployer plans.5 This
assistance has significantly delayed projected dates of potential
insolvency for the multiemployer insurance program. PBGC projects that
the mean projected date of multiemployer program insolvency is now
fiscal year 2055, compared to fiscal year 2026 in the projections prior to
the law’s enactment. Additionally, the financial position of PBGC’s single-
employer program has improved gradually in recent years. The single-
employer program has maintained a surplus since the end of fiscal year
2018 and has a projected surplus through at least 2031.
4GAO, High-Risk Series: Key Practices to Successfully Address High-Risk Areas and
Remove Them from the List, GAO-22-105184 (Washington, D.C.: Mar. 3, 2022).
5Pub. L. No. 117-2, §§ 9701–9708, 135 Stat.4, 186–207 (2021).
Page 5 GAO-23-106674
Letter
While we are removing this area from the High-Risk List, we will continue
to monitor the insurance programs’ finances and other issues. Although
congressional action led to significantly delaying the projected insolvency
date, important issues remain. These include inadequate plan funding
rules, premiums that do not fully cover the cost of insurance, and
underfunded plans sponsored by companies with credit ratings below
investment grade. Therefore, we will continue to monitor the financial
position of both programs.
2020 Decennial Census Removed from the
HighRisk List
We are removing the 2020 Decennial Census area because the Census
Bureau (Bureau) made progress addressing data quality concerns,
chartered a high-level governance group, and implemented priority GAO
recommendations. These actions contributed to significant progress in all
five of our high-risk criteria for removal. For example, in October 2022,
the Bureau launched an effort led by agency leaders to transform and
update operations to address challenges such as declining census
response rates. The Bureau has also committed to developing a plan to
improve coordination between its field office staff and community
organizations to encourage census participation.
The Bureau took significant steps to implement corrective actions for
high-risk cybersecurity weaknesses within prescribed time frames. In
addition, in March and July 2020, the Bureau updated its decennial risk
management plans to include mitigation and contingency plans and key
information needed to manage the risks. The Bureau also improved its
budget and progress monitoring by implementing a new system to track
its cost variances in 2019. The Bureau curbed the past decades’ trend of
steadily increasing census cost while implementing the decennial census
during the COVID-19 pandemic. In addition, in the spring of 2022, the
Bureau began piloting new procedures for aligning costs of exploring its
innovations for 2030 within its overall cost framework.
While we are removing the 2020 Decennial Census from the High-Risk
List, we will monitor the Bureau’s planning for the 2030 Census–already
underway–for emerging risks and challenges. It remains important that
leaders continue to manage cybersecurity risks, improve resiliency of
research and testing in the face of budget uncertainty, and make timely
IT-related decisions.
Page 6 GAO-23-106674
Letter
Strengthening Management of the Federal
Prison System Added to the HighRisk List
We are adding a new area—Strengthening Management of the Federal
Prison System—to the 2023 High-Risk List.6 This area is being added, in
part, due to the Bureau of Prisons’ (BOP) long-standing challenges
managing staff and resources, and planning and evaluation of programs
that help incarcerated people have a successful return to the community.
BOP has consistently experienced several leadership changes and long-
standing staffing challenges that represent a serious threat to inmate and
staff safety. Additionally, BOP has not always demonstrated sound
resource stewardship and lacks the necessary data collection and
analytic capacity to prepare for disasters that affect security of its property
and grounds.
BOP’s plans to manage some of its key inmate rehabilitation programs
are limited. In addition, BOP has not evaluated many of its programs for
inmates in decades. Effective planning and ongoing evaluations of
programs will be essential as BOP continues to implement requirements
of the First Step Act of 2018.7 These include delivering programs that
lower inmates’ risk of recidivism and offer opportunities for certain
inmates to earn First Step Act time credits that may reduce the amount of
time an inmate is in a BOP facility.
The BOP Director expressed her commitment in addressing these issues.
In addition to sustaining leadership commitment, BOP needs to address
the four other criteria related to capacity, action plan, monitoring, and
demonstrating progress. Moving forward, GAO and BOP will agree upon
metrics in order to gauge progress.
Two Areas Added to the HighRisk List in 2022
In 2022, we added two areas to our High-Risk List due to significant and
long-standing challenges:
6To determine which federal programs and functions should be designated as high-risk,
we use our guidance document, GAO, Determining Performance and Accountability
Challenges and High Risks, GAO-01-159SP (Washington, D.C.: November 2000).
7Pub. L. No. 115-391, §§ 101, 102, 132 Stat. 5194, 5195-5216 (2018).
Page 7 GAO-23-106674
Letter
· Department of Health and Human Services’ Leadership and
Coordination of Public Health Emergencies. In January 2022, our
ninth comprehensive CARES Act report identified this area as high
risk. For more than a decade, we have found significant and long-
standing issues in the Department of Health and Human Services’
(HHS) leadership role preparing for and responding to public health
emergencies, including COVID-19 and other infectious diseases, and
extreme weather events, such as hurricanes.
· Unemployment Insurance System. In June 2022, we designated
this area as high risk because administrative and program integrity
challenges in the joint federal-state program have affected the
system’s ability to meet the needs of unemployed workers. These
challenges also expose the system to significant financial losses,
which worsened during the COVID-19 pandemic. Current program
design and variations in how states administer unemployment
insurance have contributed to declining worker access and disparities
in benefit distribution.
Sixteen HighRisk Areas Have Made Progress
Since 2021
Sixteen high-risk areas improved since our last update in 2021. One of
the areas—PBGC Insurance Programs—improved primarily due to
congressional action and an improved financial position. Another area—
2020 Decennial Census—improved by meeting all of our high-risk criteria.
Both are being removed from the list. Fourteen more high-risk areas
improved but remain on our list because additional progress is needed.
Some of the areas that improved are:
National Flood Insurance Program. Since 2021, the Federal
Emergency Management Agency (FEMA) revised the National Flood
Insurance Program’s (NFIP) rate-setting methodology and updated its
data system. These actions increased the program’s capacity for
addressing challenges and completing major projects. FEMA has also
completed two action-planning efforts directed at improving NFIP’s
financial resilience, including completing a comprehensive legislative
proposal that identifies actions Congress can take to address NFIP’s
financial resilience. In addition, as part of FEMA’s updated rate-setting
methodology, the agency continually evaluates the accuracy of the risk
Page 8 GAO-23-106674
Letter
models produced by contractors. This is key to monitoring NFIP’s fiscal
exposure.
To make further progress, FEMA should continue to monitor its new rate-
setting methodology and Congress should consider enacting
comprehensive reforms to address NFIP’s financial resilience.
NASA Acquisition Management. National Aeronautics and Space
Administration’s (NASA) rating for capacity in this area increased from
partially met to met. NASA has increased its capacity by completing
initiatives in its action plan intended to strengthen its cost and schedule
estimating workforce, including training. NASA senior leaders have
committed to or implemented several of our recommendations related to
how the agency oversees and manages missions.
NASA continues to improve acquisition management in other areas as
well. For example, NASA elevated its Chief Acquisition Officer position to
the NASA Deputy Administrator. This brings acquisition planning and
oversight to the attention of one of the agency’s most senior officials.
NASA also established a Chief Program Management Officer, who is
responsible for strengthening enterprise-wide oversight and management
of projects. The agency, however, continues to face challenges in its
ability to manage and oversee its most expensive and complex projects.
Specifically, NASA has experienced cost growth and schedule delays for
projects that exceed $2 billion in life-cycle costs, such as those needed to
conduct Artemis missions. These missions will return astronauts to the
moon, build a sustainable lunar presence, and ultimately bring humans to
Mars. To make further progress, NASA needs to continue implementing
its action plan with a focus on reducing acquisition risk and improving
project cost and schedule performance for its most expensive and
complex projects.
USPS Financial Viability. U.S. Postal Service (USPS) ratings for three of
the five criteria increased since 2021 due, in part, to the enactment of the
Postal Service Reform Act of 2022, which significantly reduced USPS’s
long-term unfunded liabilities.8 For example, the act repealed a
requirement to prepay future retiree health benefits on an annual basis
and canceled billions in unpaid past due payments for such prefunding.
USPS also paid $500 million toward its required $1.6 billion fiscal year
2022 Federal Employees Retirement System pension payment—the first
8Pub. L. No. 117-108, 136 Stat. 1127.
Page 9 GAO-23-106674
Letter
such payment in 11 years. Additionally, under its new 10-year strategic
plan, USPS introduced and initiated actions intended to achieve financial
viability.
To make further progress, Congress needs to determine the level of
universal postal services the nation requires and how to enable USPS to
achieve long-term financial viability. USPS is also continuing to implement
and report on its strategic plan.
VA Acquisition Management. The Department of Veterans Affairs (VA)
relies upon its acquisition programs to provide many capabilities and
services that are essential to provide health care to veterans and their
families, such as the purchase of medical supplies for VA medical
centers, and VA’s Electronic Health Record Modernization program. Over
the past 10 years, VA’s total contract obligations for goods and services
increased substantially, rising 147 percent from about $23 billion in fiscal
year 2013 to about $56 billion in fiscal year 2022.
In March 2021, VA issued its initial action plan to address acquisition
management challenges, such as managing contracting officer workload
and addressing the lack of reliable contracting and financial data systems.
VA identified root causes of these challenges and most recently updated
the plan in September 2022. VA improved in the monitoring criteria
because, in that same plan, it identified corrective actions, goals and
performance metrics that it will use to measure progress in improving
acquisition management. Since our last update, VA improved in the
demonstrated progress criterion by implementing 15 GAO
recommendations related to acquisition management.
To make further progress, VA needs sustained leadership attention to
drive change across the department and to address acquisition
management challenges, including implementing 22 open
recommendations.
HighRisk Areas Needing Significant Attention
All high-risk areas need attention to make progress and resolve risk.
However, highlighted below are several areas that require significant
attention because of emerging issues requiring government responses,
large and rapidly growing costs, or a failure to make any progress in the
past several years.
Page 10 GAO-23-106674
Letter
Ensuring the Cybersecurity of the Nation. Cyberattacks on our
information systems and infrastructure continue to grow even as the
nation makes advances to try to stay ahead of them. Federal agencies
and our nation’s critical infrastructures—such as energy, transportation
systems, communications, and financial services—are dependent on
technology systems to carry out operations and to process, maintain, and
report essential information. The security of these systems and data is
vital to protecting individual privacy and national security, prosperity, and
well-being.
Although the rating for leadership commitment has improved since 2021,
agencies need to urgently address the 10 critical actions associated with
four major cybersecurity challenges we have identified (see figure 3).9
Since 2010, we have made more than 4,000 recommendations to
agencies aimed at addressing cybersecurity challenges facing the
government. More than 670 of these recommendations were made since
the last high-risk update in 2021. As of February 2023, more than 850 of
these recommendations had not been fully implemented.
9For our most recent reports on these four challenge areas, see GAO, Cybersecurity
High-Risk Series: Challenges in Protecting Privacy and Sensitive Data, GAO-23-106443
(Washington, D.C.: Feb. 14, 2023); Cybersecurity High-Risk Series: Challenges in
Protecting Cyber Critical Infrastructure, GAO-23-106441 (Washington, D.C.: Feb. 7,
2023); Cybersecurity High-Risk Series: Challenges in Securing Federal Systems and
Information GAO-23-106428 (Washington, D.C.: Jan. 31, 2023); and Cybersecurity High-
Risk Series: Challenges in Establishing a Comprehensive Cybersecurity Strategy and
Performing Effective Oversight, GAO-23-106415 (Washington, D.C.: Jan. 19, 2023).
Page 11 GAO-23-106674
Letter
Figure 3: Ten Critical Actions Needed to Address Four Major Cybersecurity Challenges
Text of Figure 3: Ten Critical Actions Needed to Address Four Major Cybersecurity
Challenges
1) Establishing a comprehensive cybersecurity strategy and performing
effective oversight
Page 12 GAO-23-106674
Letter
a) Develop and execute a more comprehensive federal strategy for
national cybersecurity and global cyberspace.
b) Mitigate global supply chain risks (e.g., installation of malicious
software or hardware).
c) Address cybersecurity workforce management challenges.
d) Ensure the security of emerging technologies (e.g., artificial
intelligence and Internet of Things).
2) Securing federal systems and information
a) Improve implementation of government-wide cybersecurity
initiatives.
b) Address weaknesses in federal agency information security
programs.
c) Enhance the federal response to cyber incidents.\
3) Protecting cyber critical infrastructure
a) Strengthen the federal role in protecting the cybersecurity of
critical infrastructure (e.g., electricity grid and telecommunications
networks).
4) Protecting privacy and sensitive data
a) Improve federal efforts to protect privacy and sensitive data.
b) Appropriately limit the collection and use of personal information
and ensure that it is obtained with appropriate knowledge or
consent.
Source: GAO; images: peshkov/stock.adobe.com; Gorodenkoff/stock.adobe.com; metamorworks/stock.adobe.com; Monster
Ztudio/stock.adobe.com. | GAO-23-106674
On March 2, 2023, the White House issued the National Cybersecurity
Strategy. The strategy provides a good foundation for addressing the
nation’s cyber risks and challenges but does not address all of the
desirable characteristics of national strategies. The strategy lacks
milestones, performance measures, resources needed to carry out goals
and objectives, and fully defined roles and responsibilities. According to
the strategy, the Office of the National Cyber Director will work with
federal agencies to develop an implementation plan to articulate the lines
of effort needed to execute this strategy. Until the implementation plan is
Page 13 GAO-23-106674
Letter
developed and contains the missing characteristics of a robust national
strategy, overall progress in strengthening cybersecurity will remain
limited.
In addition, the Cybersecurity and Infrastructure Security Agency (CISA)
can take actions to fulfill its mission as the operational lead for securing
federal information systems, and as the national coordinator for critical
infrastructure security. In particular, CISA needs to
· complete its organizational transformation to ensure that sufficient
resources are properly allocated to the agency’s cybersecurity
services;
· improve interagency coordination to better assist tribal, state, local,
and territorial government organizations in preventing and responding
to ransomware attacks; and
· establish timelines for its efforts to provide guidance that would help
agencies tasked with protecting critical infrastructure implement their
statutory responsibilities.
Further actions needed in this area include establishing and effectively
implementing a government-wide cyber workforce plan and fully
developing agency cyber risk management and privacy programs. Until
our recommendations are implemented and actions are taken to address
long-standing challenges in this area, the federal government’s
information systems and the nation’s critical infrastructure will be
increasingly susceptible to the multitude of cyber-related threats that
exist.
National Efforts to Prevent, Respond to, and Recover from Drug
Misuse. Drug misuse—the use of illicit drugs and the misuse of
prescription drugs—has been a persistent and long-standing public health
issue. Drug misuse has resulted in significant loss of life and harm to
society and the economy. In recent years, the federal government has
spent billions of dollars and enlisted more than a dozen federal agencies
to address drug misuse and its effects. In December 2022, HHS
announced the renewal of a 2017 determination that marked the opioid
crisis as a public health emergency. This coincides with one of the
highest numbers of drug overdose deaths reported in a 12-month period
(nearly 107,000, see figure 4).
Page 14 GAO-23-106674
Letter
Figure 4: Number of Drug Overdoses in the United States, April 2015 through September 2022
Data table for Figure 4: Number of Drug Overdoses in the United States, April 2015
through September 2022
Predicted number of drug overdose
Date
deaths (in thousands)
Jan-15 48.126
Feb-15 48.348
Mar-15 48.821
Apr-15 49.387
May-15 49.937
Jun-15 50.348
Jul-15 50.969
Aug-15 51.514
Sep-15 52.278
Oct-15 52.838
Nov-15 53.11
Dec-15 53.356
Jan-16 53.622
Feb-16 54.547
Mar-16 55.513
Page 15 GAO-23-106674
Letter
Predicted number of drug overdose
Date
deaths (in thousands)
Apr-16 56.517
May-16 57.252
Jun-16 58.238
Jul-16 59.372
Aug-16 60.304
Sep-16 61.058
Oct-16 62.004
Nov-16 63.305
Dec-16 64.932
Jan-17 66.577
Feb-17 67.195
Mar-17 67.867
Apr-17 68.495
May-17 69.362
Jun-17 70.153
Jul-17 70.494
Aug-17 70.972
Sep-17 71.575
Oct-17 71.646
Nov-17 71.653
Dec-17 71.595
Jan-18 71.006
Feb-18 70.631
Mar-18 70.255
Apr-18 69.928
May-18 69.68
Jun-18 69.592
Jul-18 69.604
Aug-18 69.574
Sep-18 69.277
Oct-18 69.254
Nov-18 68.968
Dec-18 68.699
Jan-19 68.573
Feb-19 68.516
Page 16 GAO-23-106674
Letter
Predicted number of drug overdose
Date
deaths (in thousands)
Mar-19 68.622
Apr-19 68.647
May-19 68.709
Jun-19 68.711
Jul-19 68.953
Aug-19 69.326
Sep-19 69.72
Oct-19 70.35
Nov-19 71.348
Dec-19 72.151
Jan-20 73.149
Feb-20 74.375
Mar-20 75.702
Apr-20 78.021
May-20 81.622
Jun-20 83.992
Jul-20 86.348
Aug-20 88.415
Sep-20 90.009
Oct-20 91.248
Nov-20 92.366
Dec-20 93.655
Jan-21 95.955
Feb-21 97.291
Mar-21 99.434
Apr-21 101.078
May-21 100.997
Jun-21 101.936
Jul-21 102.871
Aug-21 104.038
Sep-21 107.014
Oct-21 108.076
Nov-21 109.179
Dec-21 105.562
Jan-22 108.816
Page 17 GAO-23-106674
Letter
Predicted number of drug overdose
Date
deaths (in thousands)
Feb-22 110.021
Mar-22 110.317
Apr-22 109.361
May-22 108.982
Jun-22 108.606
Jul-22 108.613
Aug-22 107.937
Sep-22 106.84
Source: GAO Analysis of Centers for Disease Control and Prevention (CDC) National Center for Health Statistics data. | GAO-23-
106674
Federal agencies must effectively coordinate and implement a strategic
national response to drug misuse and make progress toward reducing
rates of drug misuse, overdose deaths, and the resulting harmful effects
to society. It is important for the federal government to coordinate across
additional levels of government and the private sector. The 2022 National
Drug Control Strategy highlights the need to strengthen such
coordination.
In addition, the availability of treatment for substance use disorders
remains a long-standing challenge, particularly for low-income individuals
and in rural areas. The COVID-19 pandemic exacerbated concerns about
access to treatment and workers affected by opioid misuse. The 2022
Strategy highlights the need for the federal government to expand
resources for the prevention, treatment, and recovery from drug misuse.
Protecting Public Health through Enhanced Oversight of Medical
Products. The Food and Drug Administration (FDA) has the vital mission
of protecting the public health by overseeing the safety and effectiveness
of medical products—drugs, biologics, and medical devices—marketed in
the U.S. and used daily at home and in health care settings. FDA faces
multiple challenges in this role, including (1) rapid changes in science and
technology; (2) globalization; (3) unpredictable public health crises, such
as the COVID-19 pandemic; and (4) an extensive workload.
FDA needs to take steps to ensure drug availability and oversee the
quality of global medical product supply chains. For example, because of
delays during the COVID-19 pandemic, FDA faces a backlog in its
inspections of drug manufacturers, including in foreign countries. We
recommended that FDA must consider this backlog when developing and
implementing future inspection plans. FDA has also faced persistent
vacancies among staff who conduct these inspections; we recommended
Page 18 GAO-23-106674
Letter
that it fully develop tailored strategies to recruit and retain staff who
specialize in conducting these inspections.
Further, while FDA has an important role in preventing and mitigating
drug shortages, we found that gaps persist in the drug manufacturing
information the agency needs to help identify and mitigate supply chain
vulnerabilities. For example, FDA reported that as of November 2021, 77
percent of establishments registered to manufacture active ingredients,
and 52 percent of establishments registered to manufacture finished
drugs for the U.S. market were located overseas. However, the agency
did not have information on the volume of drugs these establishments
manufacture for the U.S. market. FDA is in the process of implementing a
CARES Act requirement that companies report the amount of drugs they
manufacture.10 However, implementation of this reporting requirement
has been delayed. In addition, FDA has indicated that the requirement will
not fully address the gaps we identified, as it does not expressly require
manufacturers to provide detailed information about their respective
supply chains. FDA has also sought additional authority from Congress to
collect more complete drug manufacturing information.
U.S. Government’s Environmental Liability. Even as the federal
government spends billions each year on cleanup efforts, its
environmental liability will likely continue to grow. For example, the
federal government's estimated environmental liability nearly tripled from
$212 billion in fiscal year 1997 to $626 billion in fiscal year 2022,
according to the most recent data available (see figure 5). In addition,
some environmental cleanup costs remain unreported to Congress,
preventing a more transparent assessment of total fiscal exposure.
As of March 2023, 50 of our recommendations to federal agencies and 14
matters for congressional consideration have not yet been implemented.
The federal government needs to take action to get ahead of growing
environmental cleanup costs.
10Pub. L. No. 116-136, § 3112, 134 Stat. 281, 362–363 (2020).
Page 19 GAO-23-106674
Letter
Figure 5: U.S. Government’s Environmental Liabilities, Fiscal Years 2015-2022
Data table for Figure 5: U.S. Government’s Environmental Liabilities, Fiscal Years 2015-2022
Fiscal year 2015 2016 2017 2018 2019 2020 2021 2022
Department of Energy 340 372 384 494 505 512 516 520
Department of Defense 60 63 68 70 76 75 82 91
Other Federal Agencies 12 12 12 13 14 15 16 16
Total - Dollars (in billions) 412 447 464 577 595 603 613 626
Source: GAO analysis of Department of Treasury data. | GAO-23-106674The Departments of Energy (DOE) and Defense (DOD),
which bear the bulk of this liability, and other agencies need to identify and address environmental risks as well as better monitor and
more transparently report on this liability. Specifically,
· DOE should revise cleanup policies and develop a program
management plan that incorporates the essential elements of a risk-
informed decision-making framework.
· DOE should continue its efforts to engage the public and finalize its
draft consent-based siting process for managing commercial spent
nuclear fuel. The federal liability for litigation related to storing
commercial spent nuclear fuel is estimated to amount to $39.2 billion,
as of 2021.
Page 20 GAO-23-106674
Letter
· DOD should establish a cleanup goal for Formerly Used Defense
Sites contaminated by military munitions. Environmental liability for
Formerly Used Defense Sites was estimated at more than $13 billion,
as of 2022.
Our high-risk program continues to be a top priority at GAO. We will
maintain our emphasis on identifying high-risk issues across government
and on providing recommendations and sustained attention to help
address them. We will also continue working collaboratively with
Congress, agency leaders, and the Office of Management and Budget to
address these issues.
Thank you, Chairman Peters, Ranking Member Paul, and Members of the
Committee. This concludes my testimony. I would be pleased to answer
any questions.
For further information on this testimony, please contact Michelle Sager at
(202) 512-6806 or SagerM@gao.gov. Contact points for the individual
high-risk areas are listed in the report and on our high-risk website.
Contact points for our Offices of Congressional Relations and Public
Affairs may be found on the last page of this statement.
Page 21 GAO-23-106674
This is a work of the U.S. government and is not subject to copyright protection in the
United States. The published product may be reproduced and distributed in its entirety
without further permission from GAO. However, because this work may contain
copyrighted images or other material, permission from the copyright holder may be
necessary if you wish to reproduce this material separately.
GAO’s Mission
The Government Accountability Office, the audit, evaluation, and investigative
arm of Congress, exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability of the
federal government for the American people. GAO examines the use of public
funds; evaluates federal programs and policies; and provides analyses,
recommendations, and other assistance to help Congress make informed
oversight, policy, and funding decisions. GAO’s commitment to good government
is reflected in its core values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony
The fastest and easiest way to obtain copies of GAO documents at no cost is
through our website. Each weekday afternoon, GAO posts on its website newly
released reports, testimony, and correspondence. You can also subscribe to
GAO’s email updates to receive notification of newly posted products.
Order by Phone
The price of each GAO publication reflects GAO’s actual cost of production and
distribution and depends on the number of pages in the publication and whether
the publication is printed in color or black and white. Pricing and ordering
information is posted on GAO’s website, https://www.gao.gov/ordering.htm.
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card, MasterCard,
Visa, check, or money order. Call for additional information.
Connect with GAO
Connect with GAO on Facebook, Flickr, Twitter, and YouTube.
Subscribe to our RSS Feeds or Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.
To Report Fraud, Waste, and Abuse in Federal
Programs
Contact FraudNet:
Website: https://www.gao.gov/about/what-gao-does/fraudnet
Automated answering system: (800) 424-5454 or (202) 512-7700
Congressional Relations
A. Nicole Clowers, Managing Director, ClowersA@gao.gov, (202) 512-4400, U.S.
Government Accountability Office, 441 G Street NW, Room 7125, Washington,
DC 20548
Public Affairs
Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800
U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, DC 20548
Strategic Planning and External Liaison
Stephen J. Sanford, Managing Director, spel@gao.gov, (202) 512-4707
U.S. Government Accountability Office, 441 G Street NW, Room 7814,
Washington, DC 20548
File and source
- File
- gao-23-106674.pdf
- Size
- 3,754,378 bytes
- SHA-256
- 16c2a2852d1808d4ee5903d140f7d95e953b6f50f67cc8e836c23c655ec5f3c9
- Our copy
- gao-23-106674.pdf
- Original
- www.gao.gov