Objectives, Scope, and Methodology

Our objectives in this review were to describe (1) the extent and variety of certification activities in the federal government; (2) the extent to which there are policies, procedures, or guidance governing those activities, either governmentwide or within selected agencies; and (3) an agency certification procedure that could serve as an example or “best practice” for other agencies. Agencies Engage in a Wide Variety of Certification-Related Activities

Federal agencies engage in both a large number and a wide variety of certification-related activities. The certifications differ across several dimensions, including the origins of the requirements, their targets, which entity or entities do the certifying, whether the certifications are mandatory or voluntary, and the extent to which there is reciprocity with or recognition of other certifications or other organizations’ requirements. For example, NIST publishes directories that list more than 200 federal procurement and regulatory programs in which agencies provide or require some form of certification. The NIST directories provide only a partial inventory of agencies’ activities, though, because they primarily focus on certification of products and services. Also, the directories do not cover individual procurement opportunities in which agencies require a vendor or contractor to have a particular certification, accreditation, or registration in order to participate. Little Guidance Exists on Agency Certification Requirements

Federal procurement law establishes some legal boundaries on the certification requirements used in federal procurement. NIST has prepared draft guidance for federal agencies on conformity assessment activities, including certification. Related Policies and Procedures Also Affect Certification Requirements

Although there is currently no governmentwide guidance specifically on certification requirements, agency officials noted several related policies and procedures that can affect those requirements. Transparency of Certification Decisionmaking Is a “Best Practice”

As noted previously, agency certification actions are numerous and vary substantially. Transparency of Agency Certification Requirements Varies

The transparency of the agency certification actions that we reviewed varied dramatically. In some instances, the agencies clearly documented the criteria that they used or planned to use to select particular requirements or certifying organizations. However, agency officials were able to provide us with justifications for their actions in these instances during our review. These specific cases involved the selection of particular certification bodies, and organizations that were not selected raised questions about the criteria that the agencies used. To compile this appendix, we relied primarily on examples identified by officials within the agencies that we contacted during this review and information provided in the National Institute of Standards and Technology (NIST) Directory of Federal Government Certification and Related Programs.
Why GAO Did This Study

Pursuant to a congressional request, GAO reviewed federal agencies' certification requirements for goods and services, focusing on: (1) the extent and variety of certification activities in the federal government; (2) the extent to which there are policies, procedures, or guidance governing those activities, either governmentwide or within selected agencies; and (3) an agency certification procedure that could serve as an example or best practice for other agencies.

What GAO Found

GAO noted that: (1) federal agencies engage in a large number and wide variety of certification-related activities; (2) the National Institute of Standards and Technology (NIST) publishes directories listing more than 200 federal government procurement and regulatory programs in which agencies provide or require certification, accreditation, listing, or registration; (3) these directories provide only a partial inventory of agencies' activities because they focus primarily on certifications of products and services and they do not cover individual procurement actions in which agencies require particular certifications; (4) certification activities also vary across multiple dimensions, including the origin of the requirements, their targets, which entities do the certifying, whether the certifications are mandatory or voluntary, and the extent to which there is reciprocity with or recognition of other certifications or requirements; (5) specific guidance regarding the selection of specific requirements or certifying organizations is limited; (6) federal procurement law imposes some limits on agencies' use of certification requirements, restricting the use of certification requirements to instances in which the requirements are specifically imposed by law or the agencies show a particular need and, if possible, allow for alternatives; (7) some agencies have established certification procedures and criteria for individual programs, and agency officials identified some related policies, procedures and guidance that can affect their certification activities; (8) there is no governmentwide guidance, or agencywide guidance in the five agencies that GAO reviewed, regarding all types of certification requirements; (9) NIST has prepared draft guidance on conformity assessment activities, including certification, which it plans to issue for public comment; (10) one best practice that GAO has supported in the regulatory arena, transparency of decisionmaking, also appears applicable to certification requirements, particularly given the complexity and diversity of certification activities and organizations; (11) in the certification actions that GAO examined, the criteria that the agencies used to establish a particular requirement or select a particular certifying organization were very clear in some instances but not clear in others; (12) other agencies' certification actions were not as transparent and certification bodies that were not selected raised questions about the criteria that agencies used; and (13) in each of those cases, agency officials were able to provide the rationale for their actions.