Federal Protective Service: More Effective Management Needed in Delegating Security Authority to Agencies

FPS's primary mission is to protect the almost 9,000 federal facilities that are held or leased by the General Services Administration. FPS also manages the Department of Homeland Security's (DHS) delegations of authority (delegations) program, which involves, among other things, reviewing requests by agencies to protect their own facilities instead of FPS and making recommendations to DHS about whether to grant, renew, or rescind such delegations. In response to direction in the conference report accompanying the Consolidated Appropriations Act, 2012, FPS prepared its Interim Plan that outlines FPS's process for reviewing existing and newly requested delegations.

GAO was asked to review FPS's management of this program. This report covers (1) the extent to which FPS's delegations program meets select federal standards and (2) whether FPS has followed its Interim Plan in reviewing delegations. GAO reviewed FPS's 2012 Interim Plan and data on delegations; compared FPS's Interim Plan to federal standards; and analyzed the six requests for new or renewed delegations FPS reviewed from June 2012 through March 2014.

The Federal Protective Service's (FPS) delegations of authority program does not fully meet applicable federal standards GAO identified for effective program management.

FPS lacks reliable data, as called for by federal Standards for Internal Control, to accurately identify all the delegations FPS is responsible for managing and overseeing to ensure the protection of federal facilities. Specifically, of the 62 delegations of authority that FPS officials said were verified as active, GAO found that 12 had either expired or been rescinded. Standards for Internal Control state that federal agencies should have relevant, reliable, and timely information for decision-making and external- reporting purposes. FPS officials stated that poor recordkeeping contributed to the data's unreliability, but FPS has not established procedures to ensure data reliability. Without reliable data on delegations of authority, FPS will face challenges effectively managing this program.

FPS's model for estimating the costs associated with a delegation—set forth in its 2012 Interim Plan —does not fully align with the relevant leading practices outlined in GAO's Cost Estimating and Assessment Guide . These leading practices help ensure reliable cost estimates that are comprehensive, well documented, accurate, and credible. GAO found that FPS's cost estimation model partially aligned with practices for producing comprehensive estimates and minimally aligned with those for producing well-documented and accurate estimates. Furthermore, the model does not align with practices for producing credible cost estimates because, among other things, it does not include a sensitivity analysis, which identifies a range of possible costs based on varying assumptions. Without fully aligning the cost model with leading practices, FPS faces limitations developing reliable cost estimates that support its delegations of authority recommendations.

For five of the six agency requests for new or renewed delegations of authority that GAO analyzed, FPS did not conduct the required cost and security- capabilities analyses before making its recommendation to grant, renew, or rescind the delegation. The Interim Plan calls for these analyses to form the basis of FPS's recommendations. Specifically, FPS conducted the required analyses for only the delegation involving the Social Security Administration and did not conduct these analyses for the other five delegations involving facilities of the Departments of Commerce, Interior, and State; the Nuclear Regulatory Commission; and the Federal Trade Commission. According to FPS officials, they were not always able to obtain, from the agency requesting a delegation, comparable cost data to complete the cost model. FPS officials also acknowledged that FPS has yet to establish management controls to ensure that required analyses are conducted. Without these analyses, FPS does not have a sound basis to determine whether cost or security considerations support its delegations of authority recommendations.

GAO recommends that the Secretary of DHS direct FPS (1) to improve the accuracy of its delegation data, (2) update its cost estimation model to align with leading practices, and (3) establish management controls to ensure that its staff conducts the required cost and capability analyses. DHS concurred with the recommendations.

Federal facilities and the millions of employees and the public who work  in and visit these facilities remain targets of potential terrorist attacks or  other acts of violence. In addition, concern about the Federal Protective  Service’s (FPS) ability to effectively protect federal facilities is one of the  main reasons why we have designated federal real property management  as a high-risk area. FPS, which was transferred from the General  Services Administration (GSA) to the Department of Homeland Security  (DHS) in 2003, is responsible for protecting the almost 9,000 federal  facilities that are held or leased by GSA. To protect these facilities, FPS is  primarily responsible for hiring security guard contractors and overseeing contract guards  deployed at federal facilities, and conducting facility security assessments.

In addition to protecting federal facilities, FPS is responsible for managing  DHS’s delegations of authority program, including determining—based on  cost and capabilities analyses—whether another federal department or  agency should be authorized to provide its own law enforcement or to  manage its own security services at its facilities instead of FPS. After  completing its analyses, FPS makes a recommendation to DHS officials,  who decide whether to issue a delegation of authority—a legal document  that stipulates the requirements for another federal department or agency  to provide law enforcement or security services.

A delegation of authority may be granted by DHS to another federal  department or agency typically for 2 to 5 years and may include more  than one federal facility, according to FPS officials. During this time, FPS  is responsible for overseeing the delegations to ensure that the delegated  facilities are protected in a manner consistent with its contract  requirements and federal physical security standards.

In 2010, DHS’s Secretary raised concerns about whether it is in the best  interest of the government to grant delegations of authority to multiple  federal departments and agencies and directed FPS to provide an update  on the status of the delegations of authority that had been granted to  date. Moreover, in the conference report accompanying the Consolidated  Appropriations Act of 2012, the conferees raised questions about the  costs and benefits of FPS’s delegations of authority program and directed  FPS to submit a proposed plan for reviewing all delegations of authority.  In response, in November 2012, FPS submitted to Congress an Interim  Delegation Assessment Plan (Interim Plan), which includes FPS’s current  methodology for reviewing all delegations of authority. In the Interim Plan,  FPS also reported that it was responsible for reviewing more than 300  delegations of authority that were granted to 30 federal departments and  agencies authorizing them to provide law enforcement and/or guard  services to their respective facilities instead of FPS.

You asked us to review how prepared FPS is to manage its delegations  of authority program. This report examines (1) the extent to which FPS’s  delegations of authority program meets select federal standards and  leading practices for effective program management and (2) whether FPS  has followed its 2012 Interim Plan in reviewing select delegations of  authority.

To determine the extent to which FPS’s delegations of authority program  meets select federal standards for effective program management, we  analyzed FPS’s 2012 Interim Plan and the 2014 draft delegation of  authority directive against leading practices identified in applicable federal  standards. We analyzed FPS’s efforts to ensure the reliability of its  delegations of authority data against internal controls specified in federal  Standards for Internal Control in the Federal Government,followed provides reasonable assurance that an agency is operating  efficiently and effectively. We also reviewed FPS’s data on delegations of  authority as of October 30, 2014, to determine the federal departments  and agencies with delegated authority; the type of delegation received  (e.g., law enforcement or security services); the number of facilities  specified in the delegation; and the status of FPS’s review. We assessed  the reliability of FPS’s data by comparing them to source documents  provided by FPS and interviewing FPS officials about the controls in place  to ensure the reliability of FPS’s delegation data, and found some of the  data to not be reliable as discussed in more detail later in the report.

We also examined FPS’s cost estimating model—which it is currently  using to analyze and compare the cost of providing law enforcement  and/or contract guard services for FPS and the agency requesting or  granted a delegation—against the leading practices identified in GAO’s   The Cost Guide  Cost Estimating and Assessment Guide (Cost Guide). contains leading practices that can be used to assess both cost  estimating models and cost estimates themselves. For a cost estimating  model to be considered reliable, it needs to substantially or fully meet  each of the following four characteristics: comprehensive, well- documented, accurate, and credible. The extent to which the  characteristics are met is determined by the extent to which the  underlying leading practices for each characteristic are incorporated. For  developing a cost estimate, the Cost Guide identifies 20 leading practices  that include underlying tasks associated with each of the four  characteristics of reliable cost estimates. Although FPS does not directly  implement or oversee implementation of capital projects at federal  facilities, the agency develops cost estimates as part of its delegation of  authority review process (through its cost estimation model) and needs  reliable cost estimates to inform DHS’s decisions about whether to grant,  renew, or rescind a delegation. As a result, the leading practices are  applicable to the assessment of FPS’s cost estimation model.

To determine whether FPS followed its Interim Plan in reviewing select  delegations, we conducted case studies of the six requests for new or  renewed delegations of authority FPS reviewed from June 2012 through  March 2014. These delegations involved the Department of the Interior’s  (Interior) Hoover Dam; the Department of State’s (State) Enterprise  Service Operations Center; the Department of Commerce’s National  Institute of Standards and Technology (NIST); the Federal Trade  Commission (FTC); the Nuclear Regulatory Commission (NRC); and the  Social Security Administration (SSA). For each of our six case studies, to  the extent available, we reviewed the delegations of authority, cost and  capabilities analyses, and interviewed officials from FPS’s headquarters  and 4 of its 11 regions. We selected these regions because the facilities  covered by the delegations of authority are located in these regions. We  also interviewed officials from the departments and agencies that had  received delegations of authorities to obtain information on the overall  impact of FPS’s delegation program on the protection of their facilities.  Our case studies are not generalizable but provide insights into FPS’s  ability to follow its 2012 Interim Plan in reviewing delegations of authority.

We conducted this performance audit from January 2014 to March 2015  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

History of FPS and Delegations of Authority Program

Since FPS was created in 1971, as part of GSA, it has been responsible  for providing law enforcement and related security services to all federal  facilities held or leased by GSA. Specifically, FPS is responsible for,  among other things, (1) hiring security guard contractors and overseeing  contract guards deployed at federal facilities, (2) controlling access to  federal facilities, (3) responding to incidents, (4) enforcing property rules  and regulations, and (5) conducting criminal investigations and facility  security assessments (FSA). To accomplish this facility protection  mission and other responsibilities, as of October 2014, FPS has about  1,200 full-time employees located in its headquarters and 11 regional  offices around the country. FPS also has about 13,500 contract security  guards deployed at approximately 5,650 of the almost 9,000 federal  facilities it protects. To fund its operations, FPS charges fees for its  security services to federal tenant agencies in GSA-controlled facilities.  For fiscal year 2014, FPS expected to receive $1.3 billion in fees.

In the 1980s, some federal departments and agencies raised concerns  that GSA was not providing quality building services, including the  physical security provided by FPS, in a timely manner. In response,  GSA’s Administrator decided to establish a delegation of authority  program that would primarily decentralize building services such as  security and lease management. A 1985 Executive Order also directed  GSA to delegate its building operations authority to tenant agencies when  it was feasible and economical. To make this determination, GSA required agencies to maintain program and financial data, which GSA  reviewed to determine whether to grant a delegation.

When FPS transferred from GSA to DHS in 2002, this delegation of  authority program also transferred. Under the program, FPS is  responsible for reviewing delegations for law enforcement and security  services and determining ─based on cost and capabilities analysis─ if it is  in the best interest of the government to authorize another department or  agency to protect a federal facility instead of FPS. FPS also is  responsible for ensuring that these delegated facilities are protected in a  manner consistent with the Interagency Security Committee’s (ISC)  standards.

A law enforcement delegation of authority authorizes an agency to  enforce federal laws and regulations aimed at protecting the agency’s  federal facilities identified in the delegation and the employees and public  who work in and visit those facilities; conduct investigations related to  offenses against the property and persons on the property, and arrest and  detain persons suspected of federal crimes. A delegation of authority for  security services typically authorizes an agency to manage its own  contract guard program at the specified federal facilities, including  awarding and administering contracts, and ensuring that guards are  properly trained and certified to protect those facilities. An agency may  also receive a delegation of authority for both law enforcement and  contract guard services. Delegations of authority are generally granted for  about 2 to 5 years, but the expiration dates for some existing delegations  are not specified or the delegation indicates that it will continue until  terminated by FPS, according to FPS officials.

FPS’s 2012 Interim Delegation Assessment Plan

In response to congressional direction, in November 2012, FPS issued its  Interim Plan, which outlines its current process for reviewing delegations  of authority. This process, which is managed primarily by FPS  headquarters staff (one full-time employee and three part-time  employees) in coordination with its 11 regional offices, includes four  phases.

Phase 1: Identifying Delegations of Authority

During this phase, which began in 2010 and is still ongoing, FPS has  focused on identifying delegations of authority that were primarily granted  when FPS was part of GSA because FPS at that time did not have a  centralized recordkeeping system. As part of this identification process,  FPS contacted its 11 regions and GSA to determine if they had copies of  delegations. In addition, in some instances, FPS obtained information  about an existing delegation from agencies that were granted such  authority. FPS uploaded the information it collected from these  delegations into an electronic database.

Phase 2: Conducting Cost and Capabilities Analyses

During this phase, the Interim Plan calls for FPS to conduct cost and  capabilities analyses to determine whether to renew or rescind an existing  delegation or grant a new one. To perform the cost analysis, FPS  developed a cost estimation model, which establishes a standardized  process for assessing the financial impact of each delegation of authority.  As part of this cost analysis, FPS compares its and the delegated  agency’s costs of providing law enforcement or security services. For  example, to estimate the current resources expended by the delegated  agency and to determine the cost that FPS would be expected to incur if  the delegation were rescinded, FPS reviews data on the amount it would  spend and the amount the agency currently spends on various cost  elements, such as salaries and benefits; guards’ training and certification;  law enforcement equipment (e.g., computers, uniforms, and mobile  radios); and mega-center (dispatch center) services. In addition,  information about the FSA; countermeasures (i.e., contract security  guards, K-9 officers); training, services; and equipment (i.e., ammunition,  cell phones, and office supplies) are also required to be entered into the  cost estimation model.

To conduct a capability analysis, FPS determines  if services—such as acquisition of guard services, training, criminal  investigations, guard oversight, and a mega center—are in place at  the delegated facility; how those services are provided and resourced; and whether FPS can provide those services on a reimbursable basis and,  if so, how much it would cost.

According to the Interim Plan, after completing the cost and capabilities  analyses, FPS recommends to DHS’s Under Secretary for the National  Protection and Programs Directorate (NPPD) whether a delegation  should be granted, renewed, or rescinded. The Under Secretary then  makes the final decision and notifies the agency requesting a delegation  of authority.

For delegations that are rescinded, FPS’s Interim Plan requires an orderly  transition of law enforcement or guard services so that there is no lapse in  protection of the facility. For delegations that are granted or renewed,  FPS has responsibility for overseeing the delegations and will conduct  periodic inspections to ensure that the delegated facilities are protected in  a manner consistent with its contract requirements and federal physical  security standards.

FPS’s Draft Directive on Delegations of Authority

In September 2014, FPS drafted a directive that establishes its policy and  procedures and assigns responsibilities for law enforcement and contract  security guard delegations of authority. Among other things, the draft  directive provides further detail on the roles and responsibilities of FPS  headquarters and regional staff in reviewing delegations of authority and  how FPS plans to verify that existing delegations are active, have not  expired, or the facility is vacant. The draft directive also requires any  agency requesting a delegation to complete a self-assessment of its  security services and provide FPS with a copy of the most recent facility  security assessment. As of January 2015, FPS had not set a timeframe  for finalizing and implementing the draft directive.

FPS’s Delegations of Authority Program Does Not Fully Meet Select Federal Standards for Effective Program Management

FPS’s delegations of authority program does not fully meet applicable  federal standards we identified for effective program management. FPS  lacks reliable data, as called for by federal Standards for Internal Control  in the Federal Government, for accurately identifying the total delegations  it is responsible for managing. In addition, FPS’s model for estimating the  costs associated with a delegation does not fully align with the relevant  leading practices outlined in GAO’s Cost Guide. Without fully meeting  these standards and leading practices, FPS cannot ensure that its  decisions to grant, renew, or rescind delegations of authority are based  on sound data and that security resources are efficiently allocated and in  a manner that leads to effective protection of federal facilities.

FPS Lacks Reliable Data on Delegations of Authority Granted

FPS lacks reliable data for identifying the total number of delegations of  authority it has granted. Specifically, FPS has not established a reliable  baseline for the number of delegations of authority that have been  granted since the 1980s and remain active and thus, does not know how  many it needs to review and oversee to ensure that law enforcement and  security services are provided at these federal facilities. The federal  Standards for Internal Control state that federal agencies should have  relevant, reliable, and timely information for decision-making and  external-reporting purposes. As previously discussed, in its Interim Plan,  FPS reported that it granted over 300 delegations to approximately 30  federal departments and agencies. During the course of our engagement,  FPS began verifying these data in accordance with criteria it outlined in its  September 2014 draft directive. According to the draft directive, FPS  should exclude from the list of 300 delegations of authority identified in  the Interim Plan, those delegations that had expired or where the  delegated agency no longer occupies the facility. FPS officials also told  us that rescinded delegations of authority should also be excluded. Based  on its verification process, FPS officials stated that only 62 of the 300  delegations of authority identified in the Interim Plan were active  delegations, as of October 2014. However, we reviewed the 62  delegations of authority FPS verified and─ based on FPS’s criteria for  excluding delegations─ found that 12 were improperly included.

Although FPS’s verification process was to exclude expired  delegations, we found that 11 of the 62 delegations of authority it  identified as active had expired, including 3 that had expired almost  20 years ago when the delegated agency was still responsible for  protecting its own facilities. These 11 delegations of authority were  granted to 6 departments and agencies (Departments of Commerce,  Health and Human Services, Defense, State, and Treasury, and the  Social Security Administration) to protect 81 facilities.

Although rescinded delegations are to be excluded, we found that  FPS’s validated data included a delegation that was granted to NRC  but was rescinded in October 2013. That delegation also should have  been excluded from FPS’s validated data because it related to four  facilities that NRC officials explained they had not occupied in about  20 years.

Our analysis demonstrates that while FPS continues to gather information  on all existing delegations of authority, it has not established effective  internal controls, such as procedures to ensure that the data on its  delegations are reliable. FPS officials stated that FPS lacks reliable data  on its delegations of authority, in part, due to poor recordkeeping with  existing delegations. FPS officials also said that they have worked with  GSA and FPS regional offices to identify documentation of existing  delegations of authority, but acknowledged that this approach may not  have resulted in an accurate accounting of existing delegations of  authority. Without reliable data on existing delegations of authority, FPS  will face challenges effectively managing its delegations of authority  program. In addition, the lack of reliable delegation data makes it difficult  for FPS to ensure that delegated facilities are protected in a manner  consistent with federal physical security standards and to provide its  stakeholders with accurate and timely information for decision-making  and external-reporting purposes.

FPS’s Cost Model for Estimating Cost of Security Services Does Not Fully Align with Leading Practices

FPS’s cost estimation model that it is using to analyze the costs of  providing law enforcement or security services does not fully align with  leading practice identified in GAO’s Cost Guide. These leading practices  are the basis for developing high-quality reliable cost estimates and help  ensure that the cost estimates are comprehensive, well-documented,  accurate, and credible. For example, following these practices should  result in cost estimates that can, among other things, be replicated and  updated. According to the Cost Guide, these leading practices can guide  government managers as they assess the credibility of a cost estimate for  decision-making purposes for a range of programs. We have previously  reported that while the Cost Guide focuses on developing cost estimates  for government acquisition programs, the leading practices are generally  applicable to cost estimation in a variety of circumstances, including  assessing an agency’s cost estimating model. Accordingly, we applied  the Cost Guide’s leading practices to FPS’s cost estimation model.  Given that FPS’s Interim Plan discusses the cost estimates developed  with its cost model as one of the major criteria FPS uses to determine  whether a delegation of authority should be granted, renewed or  rescinded, and the importance of that decision for providing efficient and  effective law enforcement and security services at federal facilities, we  believe that ensuring the reliability of the cost model’s estimate is  paramount.

We found that FPS’s cost estimation model partially aligned with practices  for producing comprehensive estimates and minimally aligned with those  for producing well- documented and accurate estimates. Furthermore, the  model does not align with practices for producing credible cost estimates.  Table 1 shows our overall assessment of FPS’s cost estimation model  compared to the four characteristics. Appendix II provides greater detail  on our comparison of FPS’s model with the leading practices identified in  GAO’s Cost Guide.

A model for developing cost estimates is considered comprehensive if,  among other things, it accounts for all possible costs over an appropriate  period of time and is based on documentation that defines the program  and is technically reasonable, as shown in table 1. FPS’s model partially  aligns with these leading practices for developing comprehensive cost  estimates. For example, FPS’s model examined the costs associated with  a delegation of authority over a 5-year period, which we found to be  sufficient for the purposes of FPS making a decision on a delegation. In  addition, an FPS official told us that the technical inputs for estimating  security costs in the model are based on an FSA. However, FPS’s Interim  Plan does not require that an FSA be conducted prior to or as part of the  delegation review process. We found that FPS also did not conduct or  require the agency to obtain an FSA for the six requests for new or  renewed delegations we analyzed involving the Departments of  Commerce, the Interior, and State; the FTC; and NRC before determining  whether those departments and agencies should be authorized to protect  their facilities. During the course of this engagement, FPS included such  a requirement in its draft directive, but FPS officials did not know when  the draft directive would be completed and finalized. As a result, FPS’s  cost estimation model may not have a solid technical basis for estimating  security costs, a limitation that can compromise the quality of the cost  estimate and affect FPS’s ability to make sound decisions on whether to  grant, renew, or rescind a delegation. Appendix II provides greater detail  on our comparison of FPS’s model with the leading practices of a  comprehensive cost estimate identified in GAO’s Cost Guide.

A model produces a well-documented cost estimate when, among other  things, it includes (1) documentation on the source data, (2) clearly details  the model’s calculations and results so the results can be replicated, and  (3) provides explanations for choosing a particular methodology, as  shown in table 1. FPS’s model minimally aligns with these leading  practices for producing well-documented cost estimates. For example,  FPS provided documentation on some of the sources of data that are  programmed into the model, such as the sources for cost data on K-9  services and vehicles. The model also provides some steps that allow an  estimate to be replicated, such as including mathematically logical  formulas for its calculations. However, FPS’s model did not include  documentation on the sources of other cost data, such as those related to  training programs or career development, how it assessed data reliability,  or how the data were normalized.documentation did not describe the methodology it uses to develop a cost  estimate, including a description of the methods or the costs used in its  summary of the estimate. Without providing clear documentation of the  data and methodology used by a model, it is difficult for a cost analyst to  replicate the results and ensure that FPS’s model and process are  producing reliable cost estimates based on quality data and methods.  Appendix II provides greater detail on our comparison of FPS’s model  with the leading practices of a well-documented cost estimate identified in  GAO’s Cost Guide.

A cost estimation model should, among other things, include an  uncertainty analysis (a way to assess variability in an estimate to reflect  unknown information that could affect cost), be updated regularly to  reflect changes to the current status, and be based on a historical record  of costs and actual cost data, as shown in table 1. FPS’s model minimally  aligns with these leading practices for producing accurate cost estimates.  For example, the model’s calculations were based on a formula—that  allowed any changes—such as those related to the security requirements  or the security costs of the agency requesting the delegation—to be  quickly updated. However, FPS’s model and process do not include an  uncertainty analysis to determine where a cost estimate falls within the  range of possible costs. A model that does not assess the level of  confidence associated with an estimate may not have adequate  contingency funding available if the actual costs exceed the estimate. In  addition, the model does not document any historical use of costs.  Historical data can provide insight into actual costs, such as security  costs associated with protecting similar facilities. Without including these  elements of the leading practices for accuracy, the model may produce  cost estimates with biased results, impeding management’s ability to  make sound decisions when reviewing a delegation. Appendix II provides  greater detail on our comparison of FPS’s model with the leading  practices of an accurate cost estimate identified in GAO’s Cost Guide.

A credible model, among other things, provides a process for cross- checking its results with independent cost estimates, quantifies the levels  of risk and uncertainty, and includes a sensitivity analysis—that is, it  examines the effect of changing one assumption related to each project  activity while holding all other variables constant in order to identify which  variable most affects the cost estimate, as shown in table 1. FPS’s model  does not align with these leading practices for producing credible cost  estimates. For example, the model does not include an analysis to  quantify the potential risks and identify the uncertainty around key  assumptions, which can undermine the credibility of an estimate. In  addition, the model did not include a sensitivity analysis that identifies a  range of possible costs based on varying major assumptions. FPS  officials stated that the model identifies key cost drivers and examines the  effect of changes to these key costs, but this analysis was not included in  the model, and FPS did not provide any supporting documentation of the  analysis being part of the process. Without conducting analyses on the  sensitivity, risk, and uncertainty associated with an estimate and  validating the methods for producing the cost estimate, FPS may not  have an understanding of the limitations associated with the cost  estimate, and could make a delegation of authority recommendation  without understanding the credibility of the cost estimate. Appendix II  provides greater detail on our comparison of FPS’s model with the  leading practices of a credible cost estimate identified in GAO’s Cost  Guide.

An FPS official told us that the cost estimation model was not necessarily  in line with GAO’s cost estimation leading practices because the agency  did not think a more rigorous model was warranted given the size and  scope of the delegation program. However, Office of Management and  Budget officials told us that FPS faced difficulties when comparing its  security costs to that of an agency requesting a delegation and in  discussions with FPS officials pointed out that FPS needs to establish a  transparent process, when working with an agency to estimate these  costs. As such, a reliable cost model is instrumental to establishing sound  cost information for making decisions on delegations of authority. As  previously discussed, the leading practices in the Cost Guide are  applicable to a range of programs, such as FPS’s assessment of  delegations of authority, but the extent to which the leading practices  apply may vary, depending on the scope and complexity of an individual  delegation. For example, conducting a sensitivity analysis may involve  varying the key security requirements, such as the recommended  countermeasures like the number of contract guards protecting a facility,  to determine how the changes affect the overall cost estimate. We  recognize that the application of all of these cost estimating leading  practices to FPS’s cost estimating model would take time and financial  resources. However, applying these leading practices would enable FPS  to better identify and address issues with developing cost estimates, and  provide its management and that of the agency requesting a delegation  with reliable cost information on the financial impact of granting,  renewing, or rescinding a delegation of authority.

FPS Has Not Fully Followed Its Interim Plan in Reviewing Select Delegations of Authority

We analyzed the six requests for new or renewed delegations of authority  FPS reviewed from June 2012 through May 2014, and found that FPS did  not fully follow its Interim Plan when it reviewed five of the requests.  According to FPS’s Interim Plan, FPS should conduct cost and  capabilities analyses before making a decision to grant, renew, or rescind  a delegation of authority. However, as shown in table 2, FPS conducted  these required analyses for only the delegation involving SSA and did not  conduct them for the other five delegations involving NRC, Commerce’s  NIST, Interior, State, and FTC. Without conducting these analyses, FPS  does not have a sound basis to determine whether cost or security  considerations support its delegation of authority recommendations. In  addition, FPS faces limitations ensuring that its contract requirements and  ISC’s physical security standards are being met at delegated facilities.

FPS Followed Its Interim Plan When It Renewed SSA’s Delegation of Authority

FPS conducted cost and capabilities analyses in reviewing the SSA’s  request to renew a delegation of authority for contract guard services at a  level II and a level IV facility in Durham, North Carolina. According to  FPS’s cost analysis, in fiscal year 2013, it would have cost SSA about  $3.6 million and FPS about $4.7 million to provide the contract guard  services at these facilities. According to FPS officials, FPS would need an  additional $1.1 million to train its contract guards to operate SSA’s  technically complex security systems. FPS also completed a capabilities  analysis, which showed that FPS could provide more of the required  security services than SSA. According to SSA officials, the agency did  not agree with FPS’s capabilities assessment because SSA did not  believe that FPS had sufficient resources to meet SSA’s security needs.  In January 2014, the Acting Under Secretary for NPPD renewed this  delegation for 3 years based on FPS’s analyses and recommendation.

FPS Did Not Fully Follow its Interim Plan When It Rescinded NRC’s Delegation of Authority

FPS did not fully follow its Interim Plan when it reviewed NRC’s 2012  request to have the delegation renewed. Specifically, FPS conducted  the required cost analysis but did not conduct the required capabilities  analysis. FPS’s cost analysis showed that in fiscal year 2013 it would  have cost NRC $6.5 million and FPS about $8 million to provide the  contract guard services at those facilities. According to FPS officials, it  would need an additional $1.5 million more to hire, train, and certify  contract guards. Conducting the required capabilities analysis could have  provided information on FPS’s capabilities versus NRC’s in overseeing a  security guard contract, according to FPS’s Interim Plan. Such an  analysis is to include ensuring that guards have the required training and  certifications, and conducting inspections of guards’ duty stations. During  the review process, NRC officials raised questions about FPS’s ability to  oversee its contract guards, in part, because of our previous reports on  challenges FPS faces with overseeing contract security guards at other  federal facilities. Nonetheless, in 2013, based on FPS’s  recommendation the Secretary of DHS rescinded this delegation, stating  it was in the best interest of the government, but provided no additional  justification. Since then, among other things, FPS has been responsible  for awarding the guard contract and overseeing the guards deployed at  NRC facilities in Rockville and Bethesda, Maryland.

In addition, FPS did not ensure that there was not a lapse in the  protection of NRC’s facilities as required by its Interim Plan. FPS and  NRC officials told us that, since the contract was awarded in 2013, the  guard contractor has not fully been meeting the terms of the contract. For  example, 41 of the approximately 100 guards (41 percent) deployed to  NRC facilities do not have the required L (equivalent to secret) or Q  (equivalent to top secret) security clearances, as of February 13, 2015,  according to NRC officials. In addition, according to FPS and NRC  officials, the guard contractor had over 3,000 hours of open (unfilled)  posts in NRC’s facilities, in part, due to challenges the contractor faced  with hiring and retaining guards. Based on these open posts, an NRC  official estimated that the agency was due a refund of about $100,000. To  address the open post issue, the guard contractor deployed guard  supervisors to these posts. According to FPS officials, this type of  deployment prevents the supervisors from completing their other  responsibilities including conducting post inspections to ensure that  guards are at their respective posts. Moreover, FPS officials told us that  although the contractor deducted the costs associated with the open  posts, NRC is not getting the level of security services for which it is  paying and this has negatively affected NRC. For example, if there were a  potential threat at any of the open posts, there would not have been a  guard to counteract the threat. In January 2015, after completing the  contractor’s performance assessment report, FPS’s Contracting Officer  decided that although the contractor’s overall performance has been less  than satisfactory, the problem with open posts has not yet risen to the  level of allowing the contract to expire or terminating the contract.  However, FPS’s Contracting Officer is not recommending the contractor  for similar contract guard services in the future. The Acquisition Division  Director of FPS concurred with this recommendation.

FPS Did Not Fully Follow Its Interim Plan When It Renewed and Granted Delegations of Authority to Commerce, the Interior, State, and FTC

Regarding the other 4 requests for new or renewed delegations of  authority we reviewed, based on FPS’s recommendations, the Secretary  of DHS and the Under Secretary of NPPD renewed the delegations of  authority for the Department of Commerce’s NIST facilities for 5 years,  the Department of the Interior’s Hoover Dam for 2 years, and the State  Department’s Enterprise Service Operations Center facility for 2 years,  and granted FTC a new contract guard delegation for 3 years; but FPS  did not conduct cost or capabilities analyses prior to making these  recommendations as required by the Interim Plan. FPS officials explained  that FPS did not conduct these analyses, in part, because it was not able  to obtain comparable cost data or limited staff prevented it from  conducting the analyses before the delegations expired. FPS officials also  told us that the program is evolving and that it has yet to establish  management controls to ensure that the analyses are conducted.

Officials from Commerce, the Interior, State, and FTC expressed some  concerns to us about the quality of FPS’s security services, the amount of  time it takes FPS to review a delegation of authority, and the lack of  transparency associated with FPS’s review process. Nonetheless, they  told us that they agreed with FPS’s decision to renew or grant their  delegations because they believed FPS faces resource and capability  challenges. However, FPS remains responsible for ensuring that these  facilities are protected in a manner that is consistent with ISC’s physical  security standards.

Several FPS Regions Were Not Fully Involved in Reviewing Some Delegations of Authority

FPS’s Interim Plan identifies its 11 regional offices as stakeholders in its  delegation review process. However, in some instances, the FPS regional  offices where the delegated facility is located were not involved in the  agency’s delegation review process. For example, officials from three of  the four regions we interviewed were not aware of FPS’s Interim Plan or  its decisions to renew delegations to Interior and State; grant FTC a  delegation, and to rescind NRC’s delegation. FPS officials stated that the  delegations program was being managed from FPS headquarters.  Moreover, officials in one FPS region said that omitting the regions from  the delegations review process could result in the region’s not meeting  the requirements specified in a delegation, for example, overseeing the  delegation to ensure that the delegated agency is meeting ISC standards.  FPS headquarters officials explained that this program is evolving and  that ongoing efforts such as its draft delegation directive (which was  developed subsequent to the six delegations we analyzed) clarifies FPS  regions’ roles and responsibilities related to the delegation review process  and oversight of delegations. However, as of January 2015, FPS officials  did not provide a timeframe for finalizing the draft directive.

Given that federal facilities remain targets of potential terrorist attacks or  other acts of violence, it is important that FPS manages its delegations of  authority program effectively. However, FPS has not effectively managed  its delegations of authority program. For example, FPS does not have  reliable data to identify the number of delegations of authority it is  responsible for reviewing and overseeing. Developing and implementing  procedures to improve the accuracy of its delegation of authority data  would enable FPS to ensure that delegated facilities are protected in a  manner consistent with federal physical security standards and would  provide its stakeholders with accurate and timely information for decision- making. FPS has developed a process for reviewing delegations that  includes a cost and capabilities analyses. However, FPS could enhance  its ability to produce reliable cost estimates by aligning its cost estimation  model with leading practices to ensure its estimates are comprehensive,  well documented, accurate, and credible. Such an approach, would give  FPS a solid technical basis for making its delegation of authority  recommendations to DHS management.

Cost and capability analyses play a major role in helping FPS determine  whether to grant another agency the authority to protect federal facilities,  but for five of the six delegations we examined, FPS did not consistently  conduct these analyses before making a recommendation to DHS’s  management. It is important that FPS ensure that these analyses are  consistently done. Without these analyses, FPS and DHS management  faces limitations in making informed decisions about how best to protect  delegated federal facilities from potential terrorist attacks or other acts of  violence, protection that is FPS’s responsibility. Finally, given that FPS is  still in the process of finalizing its draft directive, it has an opportunity to  ensure that its delegations of authority program fully aligns with federal  standards for effective program management.

To improve the management of FPS’s delegations of authority program,  we recommend that the Secretary of Homeland Security direct the  Director of FPS take the following three actions: develop and implement procedures to improve the accuracy of its  delegation of authority data; update FPS’s cost estimation model to align with leading practices to  ensure it produces comprehensive, well-documented, accurate, and  credible cost estimates; and establish management controls to ensure that FPS’s headquarters  and regional office staff conduct required cost and capability analyses  before FPS grants, renews, or rescinds a delegation of authority to a  federal agency.

We provided a copy of a draft of this report to DHS for review and  comment.  DHS provided written comments, reprinted in appendix III,  agreeing with the report’s recommendations.  DHS also provided  technical comments, which we incorporated as appropriate.

We are sending copies of this report to the Secretary of Homeland  Security, the Director of the Federal Protective Service, the Administrator  the General Services Administration, the Director of the Office of  Management and Budget, and other interested parties. The report will  also be available on the GAO website at no charge at http://www.gao.gov  If you or your staff have any questions about this report, please contact  Mark Goldstein at (202) 512-2834 or goldsteinm@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this report. GAO staff who made major  contributions to this report are listed in appendix IV.

Appendix I: Objective, Scope, and Methodology

Our report examines (1) the extent to which FPS’s delegations of  authority program meets select federal standards and leading practices  for effective program management and (2) whether FPS has followed its  2012 Interim Plan in reviewing select delegations of authority.

To determine the extent to which FPS’s delegations of authority program  meets select federal standards for effective program management, we  analyzed FPS’s 2012 Interim Plan and 2014 draft delegations of authority  directive—which outline the processes FPS is currently using to identify  delegations of authority granted when FPS was part of GSA and how  FPS is supposed to review delegations of authority to determine if they  should be granted, renewed or rescinded—against leading practices  identified in applicable federal standards. We analyzed FPS’s efforts to  ensure the reliability of its delegations of authority data against internal  controls specified in federal Standards for Internal Control in the Federal  Government that provide reasonable assurance that an agency is  operating efficiently and effectively. We also reviewed FPS’s delegations  of authority data as of October 30, 2014 to determine the federal  departments and agencies with delegated authority, the type of  delegation received (e.g., law enforcement or contract guard), the number  of facilities specified in the delegation, and the status of FPS’s review. We  assessed the reliability of FPS’s data by comparing it to source  documents provided by FPS and interviewing FPS officials about the  controls in place to ensure its reliability of FPS’s delegation data, and,  found the data to not be reliable as discussed in this report.

GAO, GAO Cost Estimating and Assessment Guide: Best Practices for Developing and  Managing Capital Program Costs, GAO-09-3SP (Washington, D.C.: March 2009). documented, accurate, and credible. The extent to which the  characteristics are met is determined by the extent to which the  underlying leading practices for each characteristic are incorporated. The  Cost Guide identifies 20 leading practices for developing a cost estimate  that include underlying tasks associated with each of the four  characteristics of reliable cost estimates. GAO developed the Cost Guide  to assist government agencies as they develop, manage, and evaluate  the costs of capital projects.

Although FPS does not directly implement or oversee implementation of  capital projects at federal facilities, the agency develops cost estimates as  part of its delegation of authority review process (through its cost  estimation model) and needs reliable cost estimates to inform DHS’s  decisions about whether to grant, renew, or rescind a delegation. As a  result, most of the leading practices are applicable to the assessment of  FPS’s cost estimation model. However, we found that three leading  practices and one of the underlying tasks associated with the leading  practices were not applicable, in part, because we were assessing a cost  model rather than a cost estimate for an acquisition. Specifically, since we  did not evaluate a cost estimate, we did not assess (1) the consistency of  the technical baseline with the data cost estimate, (2) any mistakes in the  costs estimate, or (3) if the estimating technique was used appropriately  in the cost estimate. In addition, we did not assess earned-value- management reporting as it was not applicable to FPS’s delegation  assessment process. For one leading practice, including all lifecycle  costs, we adjusted the time period to reflect a shorter period that was  sufficient for FPS’s decision-making needs for a delegation of authority.  We also interviewed officials from FPS and the Office of Management  and Budget about FPS’s process for reviewing delegations of authority.

To determine whether FPS followed its Interim Plan in reviewing select  delegations, we conducted case studies of the six requests for new or  renewed delegations FPS reviewed from June 2012 through May 2014.  These delegations involved the Department of the Interior’s Hoover Dam,  the Department of State’s Enterprise Service Operations Center, the  Department of Commerce’s National Institute of Standards and  Technology, the Federal Trade Commission, the Nuclear Regulatory  Commission, and the Social Security Administration. For each of our six  case studies, to the extent available, we reviewed the delegation of  authority, cost and capabilities analyses, and interviewed officials from  FPS’s headquarters and 4 of its 11 regions. We selected these regions  because the delegated facilities are located in these regions. We also  interviewed officials from the delegated departments and agencies to  obtain information on FPS’s review of their delegations and how FPS’s  recommendations may have affected the protection of their facilities. Our  case studies are not generalizable but provide insights into FPS’s ability  to follow its 2012 Interim Plan in delegations of authority.

Appendix II: GAO’s Assessment of FPS’s Cost Estimation Model Compared to Leading Practices

We assessed FPS’s Cost Estimation Model using the GAO Cost Guide’s  framework of the four characteristics—comprehensive, well-documented,  accurate, and credible—associated with high-quality, reliable cost  estimates. Specifically, we assessed FPS’s cost model based on most of   Table 3  the leading practices associated with these four characteristics.provides greater detail on our comparison of the model with the leading  practices that are aligned with the four cost estimating characteristics.

Appendix III: Comments from the Department of Homeland Security

Appendix IV: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Tammy Conquest, Assistant  Director; Karen Richey, Assistant Director; Jennifer DuBord; Sharon Dyer;  Geoff Hamilton; Delwen Jones; Abishek Krupanand; Steve Martinez; and  Kelly Rubin made key contributions to this report.

Question: How reliable is the FPS's data?

Answer: FPS lacks reliable data, as called for by federal Standards for Internal Control, to accurately identify all the delegations FPS is responsible for managing and overseeing to ensure the protection of federal facilities. Specifically, of the 62 delegations of authority that FPS officials said were verified as active, GAO found that 12 had either expired or been rescinded.

Question: How does the current state of the FPS compare to Standards for Internal Control?

Answer: Standards for Internal Control state that federal agencies should have relevant, reliable, and timely information for decision-making and external- reporting purposes.

Question: How has the FPS approached the issue of unreliable data?

Answer: FPS officials stated that poor recordkeeping contributed to the data's unreliability, but FPS has not established procedures to ensure data reliability.

Question: How will unreliable data affect the FPS's program?

Answer: Without reliable data on delegations of authority, FPS will face challenges effectively managing this program.

FPS Lacks Reliable Data on Delegations of Authority Granted

Question: To what extent does FPS's model for cost estimates align with GAO's standards?

Answer: FPS's model for estimating the costs associated with a delegation—set forth in its 2012 Interim Plan —does not fully align with the relevant leading practices outlined in GAO's Cost Estimating and Assessment Guide .

Question: What is the purpose of GAO's cost estimating standards?

Answer: These leading practices help ensure reliable cost estimates that are comprehensive, well documented, accurate, and credible.

Question: Why doesn't the FPS's model align with practices for credible cost estimates?

Answer: Furthermore, the model does not align with practices for producing credible cost estimates because, among other things, it does not include a sensitivity analysis, which identifies a range of possible costs based on varying assumptions.

Question: Why is aligning their model with leading practices important for the FPS?

Answer: Without fully aligning the cost model with leading practices, FPS faces limitations developing reliable cost estimates that support its delegations of authority recommendations.

FPS’s Cost Model for Estimating Cost of Security Services Does Not Fully Align with Leading Practices

Appendix I: Objective, Scope, and Methodology

Question: To what extent did the FPS conduct analyses before making recommendations about the delegations of authority?

Answer: For five of the six agency requests for new or renewed delegations of authority that GAO analyzed, FPS did not conduct the required cost and security- capabilities analyses before making its recommendation to grant, renew, or rescind the delegation. Specifically, FPS conducted the required analyses for only the delegation involving the Social Security Administration and did not conduct these analyses for the other five delegations involving facilities of the Departments of Commerce, Interior, and State; the Nuclear Regulatory Commission; and the Federal Trade Commission.

Question: What role are these analyses supposed to have according to the Interim Plan?

Answer: The Interim Plan calls for these analyses to form the basis of FPS's recommendations.

Question: Why didn't the FPS conduct analyses for five of the six agency requests reviewed?

Answer: According to FPS officials, they were not always able to obtain, from the agency requesting a delegation, comparable cost data to complete the cost model. FPS officials also acknowledged that FPS has yet to establish management controls to ensure that required analyses are conducted.

Question: Why are these analyses important for FPS decision-making regarding delegations of authority?

Answer: Without these analyses, FPS does not have a sound basis to determine whether cost or security considerations support its delegations of authority recommendations.

FPS’s 2012 Interim Delegation Assessment Plan

Phase 2: Conducting Cost and Capabilities Analyses

FPS Has Not Fully Followed Its Interim Plan in Reviewing Select Delegations of Authority

Question: What is the FPS's primary mission?

Answer: FPS's primary mission is to protect the almost 9,000 federal facilities that are held or leased by the General Services Administration.

Question: What role does the FPS have within the DHS?

Answer: FPS also manages the Department of Homeland Security's (DHS) delegations of authority (delegations) program, which involves, among other things, reviewing requests by agencies to protect their own facilities instead of FPS and making recommendations to DHS about whether to grant, renew, or rescind such delegations.

Question: What did FPS' Interim Plan accomplish?

Answer: In response to direction in the conference report accompanying the Consolidated Appropriations Act, 2012, FPS prepared its Interim Plan that outlines FPS's process for reviewing existing and newly requested delegations.

History of FPS and Delegations of Authority Program

Question: What was GAO asked to review?

Answer: GAO was asked to review FPS's management of this program.

Question: What does this report cover?

Answer: This report covers (1) the extent to which FPS's delegations program meets select federal standards and (2) whether FPS has followed its Interim Plan in reviewing delegations.

Question: What data did GAO review?

Answer: GAO reviewed FPS's 2012 Interim Plan and data on delegations; compared FPS's Interim Plan to federal standards; and analyzed the six requests for new or renewed delegations FPS reviewed from June 2012 through March 2014.