	FPS Faces Challenges in Many Areas, Raising Concerns about Vulnerabilities

		Risk Management Approach Is Inadequate and Has Limitations

FPS assesses risk and recommends countermeasures to GSA and tenant  agencies; however, FPS’s ability to influence the allocation of resources  using risk management is limited because resource allocation decisions  are the responsibility of GSA and tenant agencies, which may be unwilling  to fund the countermeasures FPS recommends. Finally, FPS continues to struggle with funding challenges that impede its  ability to allocate resources to more effectively manage risk. Improvements Needed in Human Capital Planning and Contract Guard Management

FPS does not have a strategic human capital plan to guide its current and  future workforce planning efforts, including effective processes for  training, retention, and staff development. In  the absence of a strategic human capital plan, it is difficult to discern how  effective an inspector-based workforce approach will be. Because guards were not properly trained and did not comply with post  orders, our investigators—with the components for an improvised  explosive device (IED) concealed on their persons—passed undetected  through access points controlled by FPS guards at 10 of 10 level IV  facilities in four major cities where GAO conducted covert tests. As a result, GSA and tenant agencies have limited  assurance that the investments in technologies and other countermeasures  that FPS inspectors recommend are cost-effective, consistent across  buildings, and the best available alternatives. In 2006, FPS had  recommended, based on the results of its risk analysis, the use of this dog  and an X-ray machine, although at the time of our visit only the dog was  being used. We recently recommended that FPS reach consensus with GSA on what  information contained in the BSA is needed for GSA to fulfill its  responsibilities related to the protection of federal buildings and  occupants, and accordingly, establish internal controls to ensure that  shared information is adequately safeguarded; guidance for employees to  use in deciding what information to protect with sensitive but unclassified  designations; provisions for training on making designations, controlling,  and sharing such information with GSA and other entities; and a review  process to evaluate how well this information sharing process is working,  with results reported to the Secretary of Homeland Security. Some of these measures are also included in FPS’s federal facilities  security index, which is used to assess its performance. Without  such a system, it is difficult for FPS to evaluate and improve the  effectiveness of its efforts to protect federal employees and facilities,  allocate its limited resources, or make informed risk management  decisions. FPS Is Taking Steps to Better Protect GSA Buildings, but Has Not Fully Implemented Actions and Faces Significant Challenges

FPS is taking some steps in each of the key practice areas to improve its  ability to better protect GSA buildings. Additionally, GAO has  recommended that FPS implement specific actions to promote greater  usage of key protection practices and otherwise improve security. However, FPS has not completed many related corrective actions and FPS  faces implementation challenges as well. Having tools and guidance to determine which  technologies most cost-effectively address identified vulnerabilities is a  central component of the leveraging technology key practice. For  example, we have examined how DHS and the Smithsonian Institution  secure their assets and identified challenges. Without greater attention to key protection practices, FPS will be ill  equipped to efficiently and effectively fulfill its responsibilities of  assessing risk, strategically managing its workforce and contract guard  program, recommending countermeasures, sharing information and  coordinating with GSA and tenant agencies to secure GSA buildings, and  measuring and testing its performance as the security landscape changes  and new threats emerge. Overall, following  this framework—adhering to key practices and implementing  recommendations in specific areas—would enhance FPS’s chances for  future success and could position FPS to become a leader and benchmark  agency for facility protection in the federal government.
Why GAO Did This Study

The Federal Protective Service (FPS) within the Department of Homeland Security (DHS) is responsible for providing law enforcement and related security services for nearly 9,000 federal facilities under the control and custody of the General Services Administration (GSA). In 2004 GAO identified a set of key protection practices from the collective practices of federal agencies and the private sector, which included allocation of resources using risk management, strategic management of human capital, leveraging of technology, information sharing and coordination, and performance measurement and testing. This testimony is based on past reports and testimonies and discusses (1) limitations FPS faces in protecting GSA buildings and resulting vulnerabilities; and (2) actions FPS is taking. To perform this work, GAO used its key practices as criteria, visited a number of GSA buildings, surveyed tenant agencies, analyzed pertinent laws and DHS and GSA documents, conducted covert testing at 10 judgmentally selected high-security buildings in four cities, and interviewed officials from DHS, GSA, and tenant agencies, and contractors and guards.

What GAO Found

FPS's approach to securing GSA buildings reflects some aspects of key protection practices; however, GAO found limitations in each area and identified vulnerabilities. More specifically: (1) FPS faces obstacles in allocating resources using risk management. FPS uses an outdated risk assessment tool and a subjective, time-consuming process to assess risk. In addition, resource allocation decisions are the responsibility of GSA and tenant agencies. This leads to uncertainty about whether risks are being mitigated. Also, FPS continues to struggle with funding challenges that impede its ability to allocate resources effectively. (2) FPS does not have a strategic human capital management plan to guide its current and future workforce planning efforts, making it difficult to discern how effective its transition to an inspector-based workforce will be. Furthermore, because contract guards were not properly trained and did not comply with post orders, GAO investigators concealing components for an improvised explosive device passed undetected by FPS guards at 10 of 10 high-security facilities in four major cities. (3) FPS lacks a systematic approach for leveraging technology, and inspectors do not provide tenant agencies with an analysis of alternative technologies, their cost, and the associated reduction in risk. As a result, there is limited assurance that the recommendations inspectors make are the best available alternatives, and tenant agencies must make resource allocation decisions without key information. (4) FPS has developed information sharing and coordination mechanisms with GSA and tenant agencies, but there is inconsistency in the type of information shared and the frequency of coordination. (5) FPS lacks a reliable data management system for accurately tracking performance measurement and testing. Without such a system, it is difficult for FPS to evaluate and improve the effectiveness of its efforts, allocate resources, or make informed risk management decisions. FPS is taking actions to better protect GSA buildings, in part as a result of GAO's recommendations. For example, FPS is developing a new risk assessment program and has recently focused on improving oversight of its contract guard program. Additionally, GAO has recommended that FPS implement specific actions to make greater use of key practices and otherwise improve security. However, FPS has not completed many related corrective actions and FPS faces implementation challenges as well. Nonetheless, adhering to key practices and implementing GAO's recommendations in specific areas would enhance FPS's chances for future success, and could position FPS to become a leader and benchmark agency for facility protection in the federal government.