Federal Protective Service: More Effective Management Needed in Delegating Security Authority to Agencies
Highlights
What GAO Found
The Federal Protective Service's (FPS) delegations of authority program does not fully meet applicable federal standards GAO identified for effective program management.
FPS lacks reliable data, as called for by federal Standards for Internal Control, to accurately identify all the delegations FPS is responsible for managing and overseeing to ensure the protection of federal facilities. Specifically, of the 62 delegations of authority that FPS officials said were verified as active, GAO found that 12 had either expired or been rescinded. Standards for Internal Control state that federal agencies should have relevant, reliable, and timely information for decision-making and external- reporting purposes. FPS officials stated that poor recordkeeping contributed to the data's unreliability, but FPS has not established procedures to ensure data reliability. Without reliable data on delegations of authority, FPS will face challenges effectively managing this program.
FPS's model for estimating the costs associated with a delegation—set forth in its 2012 Interim Plan —does not fully align with the relevant leading practices outlined in GAO's Cost Estimating and Assessment Guide . These leading practices help ensure reliable cost estimates that are comprehensive, well documented, accurate, and credible. GAO found that FPS's cost estimation model partially aligned with practices for producing comprehensive estimates and minimally aligned with those for producing well-documented and accurate estimates. Furthermore, the model does not align with practices for producing credible cost estimates because, among other things, it does not include a sensitivity analysis, which identifies a range of possible costs based on varying assumptions. Without fully aligning the cost model with leading practices, FPS faces limitations developing reliable cost estimates that support its delegations of authority recommendations.
For five of the six agency requests for new or renewed delegations of authority that GAO analyzed, FPS did not conduct the required cost and security- capabilities analyses before making its recommendation to grant, renew, or rescind the delegation. The Interim Plan calls for these analyses to form the basis of FPS's recommendations. Specifically, FPS conducted the required analyses for only the delegation involving the Social Security Administration and did not conduct these analyses for the other five delegations involving facilities of the Departments of Commerce, Interior, and State; the Nuclear Regulatory Commission; and the Federal Trade Commission. According to FPS officials, they were not always able to obtain, from the agency requesting a delegation, comparable cost data to complete the cost model. FPS officials also acknowledged that FPS has yet to establish management controls to ensure that required analyses are conducted. Without these analyses, FPS does not have a sound basis to determine whether cost or security considerations support its delegations of authority recommendations.
Why GAO Did This Study
FPS's primary mission is to protect the almost 9,000 federal facilities that are held or leased by the General Services Administration. FPS also manages the Department of Homeland Security's (DHS) delegations of authority (delegations) program, which involves, among other things, reviewing requests by agencies to protect their own facilities instead of FPS and making recommendations to DHS about whether to grant, renew, or rescind such delegations. In response to direction in the conference report accompanying the Consolidated Appropriations Act, 2012, FPS prepared its Interim Plan that outlines FPS's process for reviewing existing and newly requested delegations.
GAO was asked to review FPS's management of this program. This report covers (1) the extent to which FPS's delegations program meets select federal standards and (2) whether FPS has followed its Interim Plan in reviewing delegations. GAO reviewed FPS's 2012 Interim Plan and data on delegations; compared FPS's Interim Plan to federal standards; and analyzed the six requests for new or renewed delegations FPS reviewed from June 2012 through March 2014.
Recommendations
GAO recommends that the Secretary of DHS direct FPS (1) to improve the accuracy of its delegation data, (2) update its cost estimation model to align with leading practices, and (3) establish management controls to ensure that its staff conducts the required cost and capability analyses. DHS concurred with the recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Department of Homeland Security | To improve the management of FPS's delegations of authority program, the Secretary of Homeland Security should direct the Director of FPS to develop and implement procedures to improve the accuracy of its delegation of authority data. |
The Federal Protective Service (FPS) manages, among other things, the Department of Homeland Security's delegations of authority (delegations) program, which includes reviewing requests by agencies to protect their own facilities instead of FPS and making recommendations to the Department about whether to grant, renew, or rescind such delegations. In 2015, GAO reported that FPS lacked reliable data, as called for by federal Standards for Internal Control, to accurately identify all the delegations it is responsible for managing and overseeing to ensure the protection of federal facilities. Specifically, of the 62 delegations of authority that FPS officials said were verified as active, GAO found that 12 had either expired or been rescinded. Standards for Internal Control state that federal agencies should have relevant, reliable, and timely information for decision-making and external- reporting purposes. FPS officials stated that poor recordkeeping contributed to the data's unreliability, but FPS has not established procedures to ensure data reliability. Without reliable data on delegations of authority, FPS will face challenges effectively managing this program. Therefore, GAO recommended that FPS develop and implement procedures to improve the accuracy of its delegation of authority data. In 2017, GAO confirmed that FPS has taken actions to develop and implement procedures to improve the accuracy of its delegation of authority data. First, FPS developed and issued a policy directive in November 2015 requiring an accurate inventory of delegations. The directive requires that the Delegations of Authority Program Manager to review the delegation inventory on an annual basis to ensure that all documentation is complete and current. Further, each delegation must have a unique tracking number, list all associated facilities, be signed and dated by the appropriate authority, and include an expiration date or timeframe of five years, unless individual circumstances indicated a longer or shorter timeframe. Second, FPS hired a Delegation of Authority Program Manager in late 2015 dedicated to perform the responsibilities specified in the policy directive. In 2016, the program manager worked with various federal agencies as well as FPS regional offices to document all active delegations, resulting in a reduction of delegations. Officials explained that the reduction was due to agencies moving or consolidating multiple delegations into one--actions that made delegations obsolete. In February 2017, FPS kicked off its first, annual review of the delegation inventory, as required by the directive. By taking these actions to improve the reliability of data on delegations of authority, FPS can help ensure that delegated facilities are protected in a manner consistent with federal physical security standards and would provide its stakeholders with accurate and timely information for decision-making.
|
| Department of Homeland Security | To improve the management of FPS's delegations of authority program, the Secretary of Homeland Security should direct the Director of FPS to update FPS's cost estimation model to align with leading practices to ensure it produces comprehensive, well-documented, accurate, and credible cost estimates. |
The Federal Protective Service (FPS) manages, among other things, the Department of Homeland Security's delegations of authority (delegations) program, which includes reviewing requests by agencies to protect their own facilities instead of FPS and making recommendations to the Department about whether to grant, renew, or rescind such delegations. In response to direction in the conference report accompanying the Consolidated Appropriations Act, 2012, FPS prepared its Interim Plan that outlines FPS's process for reviewing existing and newly requested delegations. In 2015, GAO reported that FPS's model for estimating the costs associated with a delegation-set forth in its 2012 Interim Plan-did not fully align with relevant leading practices outlined in GAO's Cost Estimating and Assessment Guide. These leading practices help ensure reliable cost estimates that are comprehensive, well documented, accurate, and credible. GAO found that FPS's cost estimation model partially aligned with practices for producing comprehensive estimates and minimally aligned with those for producing well-documented and accurate estimates. Furthermore, the model did not align with practices for producing credible cost estimates because, among other things, it did not include a sensitivity analysis, which identifies a range of possible costs based on varying assumptions. Without fully aligning the cost model with leading practices, FPS faced limitations developing reliable cost estimates that support its delegations of authority recommendations. Therefore, GAO recommended that FPS update its cost estimation model to align with leading practices to ensure it produces comprehensive, well-documented, accurate, and credible cost estimates. In 2016, FPS took various actions to enhance these four characteristics where its model did not align with leading practices. First, FPS updated its model by adding the capability to insert technical measurements and document any assumptions used by the estimator, which will enhance the model to produce comprehensive estimates. Second, FPS added the capability to identify the sources of data and document the calculations and estimating methodology used for each cost element, which will enhance the model to produce well-documented estimates. Third, FPS incorporated uncertainty analysis through the use of commercial software, adjusted cost data for inflation, and enabled documentation of historical cost variances, which will enhance the model to produce accurate estimates. Finally, FPS updated its model to consider the results of sensitivity and uncertainty analyses developed from commercial software and cross-checks major cost elements, which will enhance the model to produce credible cost estimates. As a result of these actions to align its model with leading practices, FPS will have a solid technical basis for making its delegation of authority recommendations to Department of Homeland Security management.
|
| Department of Homeland Security | To improve the management of FPS's delegations of authority program, the Secretary of Homeland Security should direct the Director of FPS to establish management controls to ensure that FPS's headquarters and regional office staff conduct required cost and capability analyses before FPS grants, renews, or rescinds a delegation of authority to a federal agency. |
In addition to protecting federal facilities, the Federal Protective Service (FPS) manages the Department of Homeland Security's (DHS) delegations of authority (delegations) program, which allows agencies to protect their own facilities instead of FPS. In order to carry out this program, FPS is responsible for reviewing agencies' requests for delegations and making recommendations to DHS about whether to grant, renew, or rescind such delegations. In 2015, GAO reported that FPS was not taking appropriate actions before making delegation recommendations, thereby raising concerns about whether FPS and DHS were making sound decisions about whether to authorize a federal department or agency to provide its own security. Specifically, for the six agency requests FPS had for new or renewed delegations of authority GAO found that FPS did not conduct the required cost and security-capabilities analyses for five of them before making its recommendation to grant, renew, or rescind the delegation. FPS officials explained that FPS did not conduct these analyses, in part, because it was not able to obtain comparable cost data or had limited staff, which prevented it from conducting these analyses before the delegations expired. FPS officials said that they had not yet established management controls to ensure that these analyses were conducted. During GAO's review, FPS drafted a directive that established policies and procedures for assessing delegations. FPS officials stated that, when completed, the directive would serve as the mechanism by which FPS would establish and communicate the management controls needed to support the delegations process. However, because the draft had no timeframe for completion and it was not clear that FPS staff were adhering to this directive, FPS lacked the assurance that it had a sound basis to determine whether cost or security considerations supported its delegation of authority recommendations. Therefore, GAO recommended that FPS establish management controls to ensure that FPS's headquarters and regional office staff conduct required cost and capability analyses before FPS grants, renews, or rescinds a delegation of authority to a federal agency. In 2017, GAO confirmed that FPS had established appropriate management controls to help ensure its delegation recommendations are based on cost and capabilities analyses. For example, FPS hired a Delegation of Authority Program Manager, who is responsible for coordinating and supporting delegation activities. Additionally, FPS' Delegations of Authority Directive, finalized in November 2015, establishes various management controls that are key to ensuring a more effective delegations process. For example, the directive (1) establishes an organizational structure consisting of FPS headquarters and regional office staff and assigns various delegation responsibilities to several directors for coordinating and supporting analyses of delegation requests, (2) mandates that review teams follow a standard process, such as using established tools when conducting the cost and capabilities data in determining whether issuance of delegations are in the best interest of the government, and (3) requires justification for the delegation recommendation based on the review of cost and capabilities analyses. FPS provided documentation to show that these management controls were used in 2017 for a delegation request from the Social Security Administration. Because of the management controls in this directive and FPS' documented actions to adhere to these controls, FPS and DHS are in a better position to make informed decisions about whether to authorize a federal department or agency to provide its own law enforcement or to manage its own security services at its facilities instead of FPS.
|