In 2004, an estimated 23 billion pounds of cargo was shipped within the  United States by air. A  risk management approach entails a continuous process of managing risk  through a series of actions, including setting strategic goals and objectives,  assessing risk, evaluating alternatives, selecting initiatives to undertake,  and implementing and monitoring those initiatives. TSA Has Developed a Risk-Based Strategic Plan but Has Not Completed Assessments of the Risks Posed by Terrorists to the Air Cargo System

TSA has taken initial steps toward applying a risk-based management  approach to address air cargo security but not yet completed risk  assessments for air cargo security. However, TSA officials stated that they decided not to fund this effort  because of its cost. TSA Has Implemented Actions Intended to Strengthen Air Cargo Security, but Factors Exist That May Limit Their Effectiveness

TSA has implemented a variety of actions intended to strengthen the  security of air cargo as it works to fully implement a risk management  approach for securing air cargo. More recently, TSA has focused on increasing the  number of air cargo inspections. Specifically, TSA is developing a system to target elevated risk air  cargo for inspection that would minimize the agency's reliance on random  inspections. However, as we have previously noted, there are problems with  the information contained in the TSA Known Shipper database and how  TSA uses this information to identify shippers who may pose a risk. Table 3 describes TSA's proposed  measures. Recommendations for Executive Action

To help ensure that the Transportation Security Administration has a  comprehensive risk-based approach for securing the domestic air cargo  transportation system, we recommend that the Secretary of Homeland  Security direct the Assistant Secretary of Homeland Security for the  Transportation Security Administration to take the following six actions:  (1) develop a methodology and schedule for completing assessments of air  cargo vulnerabilities and critical assets, as well as defining, gathering, and  analyzing information on air cargo security breaches, and use the  information resulting from these assessments as a basis for prioritizing the  steps necessary to enhance the security of the nation's air cargo  transportation system;  (2) reexamine the rationale for existing air cargo inspection exemptions,  determine whether such exemptions leave the air cargo system  unacceptably vulnerable to terrorist attack, and make any needed  adjustments to the exemptions;  (3) develop measures to gauge air carrier and indirect air carrier  compliance with air cargo security requirements to assess and address  potential security weaknesses and vulnerabilities;  (4) develop a plan for systematically analyzing the results of air cargo  compliance inspections and use the results to target future inspections and  identify systemwide corrective actions;  (5) assess the effectiveness of enforcement actions, including the use of  civil penalties, in ensuring air carrier and indirect air carrier compliance  with air cargo security requirements; and  (6) ensure that the data to be used in the Freight Assessment System to  identify elevated risk cargo are complete, accurate, and current. (2) What  actions has TSA taken to ensure the security of air cargo, and what factors  may limit their effectiveness? To determine the extent to which TSA has used a risk management  approach to guide decisions on securing air cargo, we compared a  synthesis of government requirements and best practices that represents  GAO's risk management approach with TSA's efforts to implement such an  approach. To identify TSA's plans for enhancing air cargo security and the financial,  operational, and other challenges TSA and industry stakeholders face in  implementing air cargo security plans, we interviewed TSA and air cargo  industry stakeholders. Last, the  Department of Transportation has responsibility for, among other things,  ensuring the security of hazardous materials being transported on air  carriers.
Why GAO Did This Study

In 2004, an estimated 23 billion pounds of air cargo was transported within the United States, about a quarter of which was transported on passenger aircraft. Within the Department of Homeland Security (DHS), the Transportation Security Administration (TSA) is responsible for ensuring the security of commercial aviation, including the transportation of cargo by air. To evaluate the status of TSA's efforts to secure domestic air cargo, GAO examined (1) the extent to which TSA used a risk management approach to guide decisions on securing air cargo, (2) the actions TSA has taken to ensure the security of air cargo and the factors that may limit their effectiveness, and (3) TSA's plans for enhancing air cargo security and the challenges TSA and industry stakeholders face in implementing these plans.

What GAO Found

TSA has taken initial steps toward applying a risk-based management approach to address air cargo security. A risk-based management approach entails a continuous process of managing risk through a series of actions, including setting strategic goals and objectives and assessing risk through the identification and evaluation of threats, vulnerabilities, and critical assets. In November 2003, TSA completed an air cargo strategic plan that outlined a threat-based, risk management approach to secure the air cargo system by, among other things, targeting elevated risk cargo for inspection. TSA also completed an updated threat assessment in April 2005. However, TSA has not yet established a methodology and schedule for completing assessments of air cargo vulnerabilities and critical assets--two crucial elements of a risk-based management approach without which TSA may not be able to appropriately focus its resources on the most critical security needs. TSA has taken a number of actions intended to strengthen air cargo security, but factors exist that may limit their effectiveness. For example, TSA established a centralized database on people and businesses that routinely ship air cargo to improve information on known shippers. However, we identified problems with the reliability of the information in the database, and how TSA is using the information to identify shippers who may pose a risk. TSA has also established requirements for air carriers to randomly inspect air cargo, but has exempted some cargo from inspection, potentially creating security weaknesses. Further, TSA conducts audits of air carriers and indirect air carriers to ensure that they are complying with existing air cargo security requirements. However, TSA has not developed measures to assess the adequacy of air carrier and indirect air carrier compliance, systematically analyzed these audit results to target future inspections, or assessed the effectiveness of its enforcement actions to ensure compliance with air cargo security requirements. TSA's plans for enhancing air cargo security focus on implementing a system for targeting and inspecting elevated risk cargo, and requiring air carriers to conduct security threat assessments on thousands of cargo workers, among other efforts. However, these plans may pose financial, operational, and technological challenges to the agency and air cargo industry stakeholders. For example, stakeholders are concerned, and our analysis identified, that TSA may have underestimated the cost of its proposed measures.