Whistleblower Protection: Actions Needed to Strengthen Selected Intelligence Community Offices of Inspector General Programs
Fast Facts
Whistleblowers help safeguard the U.S. government from waste, fraud, and abuse. The offices of inspectors general oversee whistleblower complaint investigations and protection from reprisal. We reviewed investigation timeframes, quality assurance, and more at 6 Intelligence Community OIGs.
All have some quality assurance standards—including codes of conduct and ethical and professional standards. But they could better ensure complaints are properly handled and whistleblowers are protected from retaliation by further implementing quality assurance reviews and investigation planning.
Our 23 recommendations address these and other issues we found.
Highlights
What GAO Found
The six Intelligence Community (IC)-element Offices of Inspectors General (OIG) that GAO reviewed collectively received 5,794 complaints from October 1, 2016, through September 30, 2018, and opened 960 investigations based on those complaints. Of the 960 investigations, IC-element OIGs had closed 873 (about 91 percent) as of August 2019, with an average case time ranging from 113 to 410 days to complete. Eighty-seven cases remained open as of August 2019, with the average open case time being 589 days. The number of investigations at each IC-element OIG varied widely based on factors such as the number of complaints received and each OIG's determination on when to convert a complaint into an investigation. An OIG may decide not to convert a complaint into an investigation if the complaint lacks credibility or sufficient detail, or may refer the complainant to IC-element management or to another OIG if the complaint involves matters that are outside the OIG's authority to investigate.
Four of the IC-element OIGs—the Central Intelligence Agency (CIA) OIG, the Defense Intelligence Agency (DIA) OIG, the National Reconnaissance Office (NRO) OIG, and the National Security Agency (NSA) OIG—have a 180-days or fewer timeliness objective for their investigations. The procedures for the remaining two OIGs—the Inspector General of the Intelligence Community (ICIG) and the National Geospatial-Intelligence Agency (NGA) OIG—state that investigations should be conducted and reported in a timely manner. Other than those prescribed by statute, the ICIG and NGA OIG have not established timeliness objectives for their investigations. Establishing timeliness objectives could improve the OIGs' ability to efficiently manage investigation time frames and to inform potential whistleblowers of these time frames.
All of the selected IC-element OIG investigations units have implemented some quality assurance standards and processes, such as including codes of conduct and ethical and professional standards in their guidance. However, the extent to which they have implemented processes to maintain guidance, conduct routine quality assurance reviews, and plan investigations varies (see table).
Implementation of Quality Assurance Standards and Practices by Selected IC-element OIG Investigations Units
|
|
ICIG |
CIA OIG |
DIA OIG |
NGA OIG |
NRO OIG |
NSA OIG |
|
Regular updates of investigation guidance or procedures |
— |
— |
— |
✓ |
— |
✓ |
|
Internal quality assurance review routinely conducted |
— |
— |
✓ |
— |
— |
— |
|
External quality assurance review routinely conducted |
— |
✓ |
— |
— |
— |
— |
|
Required use of documented investigative plans |
✓ |
✓ |
✓ |
✓ |
— |
✓ |
Legend: ✓ = standard or practice implemented; — = standard or practice not implemented.
Source: GAO analysis of IC-element OIG investigative policies and procedures. | GAO-20-699
- The Council of Inspectors General on Integrity and Efficiency's (CIGIE) Quality Standards for Investigations states that organizations should facilitate due professional care by establishing written investigative policies and procedures via handbooks, manuals, or similar mechanisms that are revised regularly according to evolving laws, regulations, and executive orders. By establishing processes to regularly update their procedures, the ICIG, CIA OIG, DIA OIG, and NRO OIG could better ensure that their policies and procedures will remain consistent with evolving laws, regulations, Executive Orders, and CIGIE standards.
- Additionally, CIGIE's Quality Standards for Federal Offices of Inspector General requires OIGs to establish and maintain a quality assurance program.
- The standards further state that internal and external quality assurance reviews are the two components of an OIG's quality assurance program, which is an evaluative effort conducted by reviewers independent of the unit being reviewed to ensure that the overall work of the OIG meets appropriate standards. Developing quality assurance programs that incorporate both types of reviews, as appropriate, could help ensure that the IC-element OIGs adhere to OIG procedures and prescribed standards, regulations, and legislation, as well as identify any areas in need of improvement.
- Further, CIGIE Quality Standards for Investigations states that case-specific priorities must be established and objectives developed to ensure that tasks are performed efficiently and effectively. CIGIE's standards state that this may best be achieved, in part, by preparing case-specific plans and strategies. Establishing a requirement that investigators use documented investigative plans for all investigations could facilitate NRO OIG management's oversight of investigations and help ensure that investigative steps are prioritized and performed efficiently and effectively.
CIA OIG, DIA OIG, and NGA OIG have training plans or approaches that are consistent with CIGIE's quality standards for investigator training. However, while ICIG, NRO OIG, and NSA OIG have basic training requirements and tools to manage training, those OIGs have not established training requirements for their investigators that are linked to the requisite knowledge, skills, and abilities, appropriate to their career progression, and part of a documented training plan. Doing so would help the ICIG, NRO OIG, and NSA OIG ensure that their investigators collectively possess a consistent set of professional proficiencies aligned with CIGIE's quality standards throughout their entire career progression.
Most of the IC-element OIGs GAO reviewed consistently met congressional reporting requirements for the investigations and semiannual reports GAO reviewed. The ICIG did not fully meet one reporting requirement in seven of the eight semiannual reports that GAO reviewed. However, its most recent report, which covers April through September 2019, met this reporting requirement by including statistics on the total number and type of investigations it conducted. Further, three of the six selected IC-element OIGs—the DIA, NGA, and NRO OIGs—did not consistently document notifications to complainants in the reprisal investigation case files GAO reviewed. Taking steps to ensure that notifications to complainants in such cases occur and are documented in the case files would provide these OIGs with greater assurance that they consistently inform complainants of the status of their investigations and their rights as whistleblowers.
Why GAO Did This Study
Whistleblowers play an important role in safeguarding the federal government against waste, fraud, and abuse. The OIGs across the government oversee investigations of whistleblower complaints, which can include protecting whistleblowers from reprisal. Whistleblowers in the IC face unique challenges due to the sensitive and classified nature of their work.
GAO was asked to review whistleblower protection programs managed by selected IC-element OIGs. This report examines (1) the number and time frames of investigations into complaints that selected IC-element OIGs received in fiscal years 2017 and 2018, and the extent to which selected IC-element OIGs have established timeliness objectives for these investigations; (2) the extent to which selected IC-element OIGs have implemented quality standards and processes for their investigation programs; (3) the extent to which selected IC-element OIGs have established training requirements for investigators; and (4) the extent to which selected IC-element OIGs have met notification and reporting requirements for investigative activities. This is a public version of a sensitive report that GAO issued in June 2020. Information that the IC elements deemed sensitive has been omitted.
GAO selected the ICIG and the OIGs of five of the largest IC elements for review. GAO analyzed time frames for all closed investigations of complaints received in fiscal years 2017 and 2018; reviewed OIG policies, procedures, training requirements, and semiannual reports to Congress; conducted interviews with 39 OIG investigators; and reviewed a selection of case files for senior leaders and reprisal cases from October 1, 2016, through March 31, 2018.
Recommendations
GAO is making 23 recommendations, including that selected IC-element OIGs establish timeliness objectives for investigations, implement or enhance quality assurance programs, establish training plans, and take steps to ensure that notifications to complainants in reprisal cases occur. The selected IC-element OIGs concurred with the recommendations and discussed steps they planned to take to implement them.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Office of the Inspector General of the Intelligence Community | The Inspector General of the IC should establish specific timeliness objectives for completing investigations conducted by the OIG of the IC. (Recommendation 1) |
The ICIG concurred with this recommendation. In March 2021, ICIG stated that it will establish and incorporate timeliness objectives for completing investigations in its revised investigations manual. As of July 2022, ICIG stated that work on its investigations manual is underway, and they anticipate its completion by the end of calendar year 2022. As of March 2024, ICIG told us that they are finalizing its work on the ICIG Investigations Manual and anticipates that it will issue the revised manual in the third quarter of Fiscal Year 2024. Once we confirm this action has been taken, we will update the status of this recommendation.
|
| Office of the Inspector General of the Intelligence Community | The Inspector General of the IC should establish a time frame to finalize revisions to the OIG's investigations manual. (Recommendation 2) |
The ICIG concurred with this recommendation and issued its revised investigations manual in June 2024.
|
| Office of the Inspector General of the Intelligence Community | The Inspector General of the IC should establish a process to regularly review and update the OIG's investigative procedures. (Recommendation 3) |
The ICIG concurred with this recommendation. In March 2021, the ICIG stated that it will document a new annual review process of its investigative procedures in its revised investigations manual. The ICIG issued its revised investigations manual in June 2024. The manual states that it will be reviewed for applicability and accuracy on an annual basis and that the Assistant Inspector General for Investigations (AlGI) or their designee will approve updates to this manual, as circumstances warrant.
|
| Office of the Inspector General of the Intelligence Community | The Inspector General of the IC should develop and implement a quality assurance program for the OIG's investigations division. This program should consist of routine internal and external quality assurance reviews consistent with CIGIE standards and guidance. (Recommendation 4) |
The ICIG concurred with this recommendation. In July 2022, ICIG stated that its investigations program is scheduled to be reviewed in fiscal year 2024; however, ICIG did not state whether they have implemented an internal quality assurance review program. We will continue to monitor ICIG's actions to implement this recommendation. As of March 2024, ICIG reiterated that its investigations division is scheduled to be externally reviewed later this year. However, we are still awaiting a response regarding its internal review program.
|
| Office of the Inspector General of the Intelligence Community | The Inspector General of the IC should develop a process to facilitate external quality assurance reviews of other IC-element OIGs' investigations divisions. (Recommendation 5) |
The ICIG concurred with this recommendation. In July 2022, ICIG stated that in March and June 2021, ICIG's Assistant Inspector General for Investigations (AIGI), as the Chair of the ICIG Forum's Investigations Committee, and in collaboration with Committee members, implemented a "team approach" concept for conducting external quality assurance (peer) reviews. These reviews are performed consistent with Council of the Inspectors General on Integrity and Efficiency (CIGIE) Quality Standards for Investigations. This approach allows for an investigator from each Intelligence Community (IC) Office of Inspector General (OIG) to participate in the scheduled reviews. ICIG conducted its first peer review in March 2022 of NSA OIG's investigations program. As of March 2024, we are still awaiting confirmation of these actions by ICIG. Once we obtain documentation of this new process, we will update this recommendation.
|
| Office of the Inspector General of the Intelligence Community | The Inspector General of the IC should ensure that as the ICIG finalizes its draft investigations procedures and investigator training plan, these documents provide an approach that systematically links the requisite knowledge, skills, and abilities and training requirements throughout an investigator's career progression. (Recommendation 6) |
The ICIG concurred with this recommendation. In March 2021, the ICIG stated that it planned to incorporate the career path for investigators and a training plan into its new investigations manual. The ICIG issued its revised investigations manual in June 2024, which includes the relevant career path and training plan information.
|
| Office of the Inspector General of the Defense Intelligence Agency | The Inspector General of DIA should establish a process to regularly review and update the OIG's investigative procedures. (Recommendation 10) |
The DIA OIG concurred with this recommendation. As of March 2024, we have not received any updates on the status of this recommendation.
|
| Office of the Inspector General of the Defense Intelligence Agency | The Inspector General of DIA should implement routine external quality assurance reviews in the quality assurance program for the OIG's investigations division consistent with CIGIE standards. (Recommendation 11) |
The DIA OIG concurred with this recommendation. As of March 2024, we have not received any updates on the status of this recommendation.
|
| Office of the Inspector General of the Defense Intelligence Agency | The Inspector General of DIA should take steps to ensure that notifications to complainants in reprisal cases occur and are documented in the investigative case file, as required by OIG policy. (Recommendation 12) |
The DIA OIG concurred with this recommendation. As of March 2024, we have not received any updates on the status of this recommendation.
|
| Office of the Inspector General of the National Geospatial-Intelligence Agency | The Inspector General of NGA should establish specific timeliness objectives for completing investigations conducted by the OIG of NGA. (Recommendation 13) |
The NGA OIG concurred with this recommendation. NGA OIG established timeframes for the completion of both whistleblower reprisal and other types of investigations, which are documented in its Investigations Handbook as of November 2022.
|
| Office of the Inspector General of the National Geospatial-Intelligence Agency | The Inspector General of NGA should develop and implement a quality assurance program for the OIG's investigations division. This program should consist of routine internal and external quality assurance reviews consistent with CIGIE standards and guidance. (Recommendation 14) |
The NGA OIG concurred with this recommendation. As of July 2022, the NGA OIG has an external quality assurance review scheduled for its Investigations Division with an Intelligence Community partner OIG for fiscal year 2023. In September 2021, the NGA OIG also completed an internal quality assurance review of its Investigations Division consistent with CIGIE standards and guidance. As of November 2022, NGA OIG also established a schedule for regular external and internal reviews, not to exceed more than three years between reviews.
|
| Office of the Inspector General of the National Geospatial-Intelligence Agency | The Inspector General of NGA should take steps to ensure that notifications to complainants in reprisal cases occur and are documented in the investigative case file, as required by OIG policy. (Recommendation 15) |
The NGA OIG concurred with this recommendation. As of November 2022, the NSA OIG provided a screenshot confirmed that it has updated its electronic case management system to require documentation that notifications to complainants in whistleblower reprisal investigations has occurred prior to case closure.
|
| National Reconnaissance Office: Office of the Inspector General | The Inspector General of NRO should establish a time frame to finalize the OIG's draft investigations manual. (Recommendation 16) |
The NRO OIG concurred with this recommendation and issued its revised investigations manual on February 14, 2022.
|
| National Reconnaissance Office: Office of the Inspector General | The Inspector General of NRO should establish a process to regularly review and update the OIG's investigative procedures. (Recommendation 17) |
The NRO OIG concurred with this recommendation. In its revised investigation manual, issued on February 14, 2022, NRO OIG includes requirements for a complete review of the manual to be conducted every three years and an evaluation of certain investigative procedures and policies to be conducted annually.
|
| National Reconnaissance Office: Office of the Inspector General | The Inspector General of NRO should continue to develop and implement a quality assurance program for the OIG's investigations division, which should incorporate routine internal and external quality assurance reviews consistent with CIGIE standards and guidance. (Recommendation 18) |
The NRO OIG concurred with this recommendation. NRO OIG completed an internal quality assurance review in November 2021 and began an external quality assurance review in 2022, though that had not been completed as of August 2022. We will continue to monitor NRO OIG to determine if the internal and external quality assurance reviews are conducted as planned. As of March 2024, we are still awaiting a response from NRO OIG.
|
| National Reconnaissance Office: Office of the Inspector General | The Inspector General of NRO should consider making the use of documented investigative plans a requirement for all investigations. (Recommendation 19) |
The NRO OIG concurred with this recommendation. In its revised investigation manual, issued on February 14, 2022, NRO OIG includes a requirement for investigators to use written case plans for all new investigations.
|
| National Reconnaissance Office: Office of the Inspector General | The Inspector General of NRO should revise its training plan to provide an approach that systematically links the requisite knowledge, skills, and abilities to training requirements throughout an investigator's career progression. (Recommendation 20) |
The NRO OIG concurred with this recommendation and in its 180-day letter, stated that it has developed a matrix associating career progression to requisite knowledge, skills, abilities, and formal training. It submitted the matrix for approval to the agency's Office of Human Resources for review and approval. As of February 2022, OHR had not completed its review process. We will continue to monitor NRO OIG to determine when the matrix has been officially approved for use, and will close out this recommendation once we have obtained and evaluated corroborative evidence. As of March 2024, we are still awaiting a response from NRO OIG.
|
| National Reconnaissance Office: Office of the Inspector General | The Inspector General of NRO should take steps to ensure that notifications to complainants in reprisal cases occur and are documented in the investigative case files, as required by OIG policy. (Recommendation 21) |
The NRO OIG concurred with this recommendation and stated in its 180-day letter that it amended its investigations manual in November 2019 to reflect this requirement of OIG policy. NRO OIG provided us a copy of the revised investigation manual that includes this requirement. We also asked NRO OIG for examples of notifications to complainants since the inclusion of this requirement in the investigations manual. As of March 2024, we are still awaiting this documentation from NRO OIG.
|
| Office of the Inspector General of the NSA/CSS | The Inspector General of NSA should develop and implement a quality assurance program for the OIG's investigations division. This program should consist of routine internal and external quality assurance reviews consistent with CIGIE standards and guidance. (Recommendation 22) |
The NSA OIG concurred with this recommendation. The NSA OIG has an external quality assurance review scheduled for its Investigations Division with an Intelligence Community partner OIG for fiscal year 2024. In April 2022, NSA OIG told us that it has developed a Quality Assurance Program with purview across the OIG, including its Investigations Division. According to the NSA OIG, this Program is independent from the Investigations Division and samples and reviews completed investigation cases to ensure compliance with CIGIE guidelines. However, the NSA OIG did not provide documentation regarding the structure, criteria, or timeframes for this new QA Program. As of March 2024, we are still awaiting further information from the NSA OIG. We will continue to follow up with the NSA OIG to determine if the new internal quality assurance program satisfies our recommendation and if the external quality assurance review is conducted as planned.
|
| Office of the Inspector General of the NSA/CSS | The Inspector General of NSA should develop an investigator training plan that provides an approach that systematically links the requisite knowledge, skills, and abilities to training requirements to an investigator's career progression. (Recommendation 23) |
The NSA OIG concurred with this recommendation. In April 2022, NSA OIG provided us a career progression training plan to support and fulfill Individual Development Plans (IDP) of assigned investigators for its Investigations Division. However, as of July 2022, the training plan had not yet been formally incorporated into the NSA OIG's Investigations Manual. NSA OIG told us that the Investigations Manual is currently being revised and the new training plan will be incorporated into its new version. As of March 2024, we have not received further information from the NSA OIG. We will continue to follow up on this recommendation.
|