As provided in the BioShield Act, the  process requires:  1.  the DHS Secretary, in consultation with the HHS Secretary and the  heads of other agencies as appropriate, to determine that a material  threat exists and issue a “material threat determination;”  2.  the HHS Secretary to determine countermeasures that are necessary to  protect the public health;  3.  the HHS Secretary to determine that a particular countermeasure is  appropriate for procurement for the Strategic National Stockpile using  the Special Reserve Fund and the quantities to be procured;  4.  the DHS and HHS Secretaries to jointly recommend to the Director of  OMB that the Special Reserve Fund should be used for the designated  countermeasure acquisitions;  5.  the director of OMB to approve the use of the Special Reserve Fund;  6.  both Secretaries to notify designated congressional committees of the  procurement. HHS Has Used New Authorities to Procure Countermeasures

HHS has used its Special Reserve Fund (purchasing) authority and one of  its contracting authorities to procure countermeasures for the Strategic  National Stockpile. To date, the remaining eight contracts  are valued at almost $2 billion. HHS Has Established Internal Controls for Its New Authorities, but Lacks Adequate Documentation of the Risks of Using the Contracting Authorities

In response to BioShield requirements, HHS has established internal  controls on its Special Reserve Fund (purchasing) and contracting  authorities, but lacks adequate documentation of the risks of using the  new contracting authorities. Language in the BioShield Act sets up a  broad framework of controls over the procurement of countermeasures,  including those with Special Reserve Funds, by requiring HHS to  coordinate with DHS and obtain approval by OMB before the Fund may be  used. In addition to the language in the Act, HHS officials told us that the  internal controls for procuring countermeasures using the Fund are  documented in a variety of internal policy and procedure documents and  interagency agreements, which provide guidance on roles and  responsibilities for how the controls are to be implemented. On October 18, 2005, HHS issued  a memorandum that provided guidance on the use of the following  contracting authorities:   the increased simplified acquisition threshold and its use with the Special  Reserve Fund,  the increased micropurchase threshold, and  the use of personal services contracts. Federal internal control standards  state that management needs to comprehensively identify risks, analyze  them for possible effect, and determine how risks should be managed. Some of  the risk statements identify some risks and one mentions possible negative  consequences that could occur without proper controls in place, but the  statements lack an analysis of those risks. It simply states  that “control procedures are necessary to prevent noncompliance with  specific requirements of the Act.” In particular, the risk statement on  simplified acquisition procedures in the memo does not discuss a key risk  associated with using simplified acquisition procedures—namely, that an  agency is prohibited from obtaining cost or pricing data for acquisitions at  or below the simplified acquisition threshold. Not having adequately documented and appropriately  communicated risk assessments, which institutionalize agency policies,  may potentially result in future employees not knowing or understanding  the risks or tradeoffs involved in using the various contracting authorities. Although HHS has established internal  controls for its new purchasing and contracting authorities, the risk  assessment statements related to the agency’s internal controls for the  contracting authorities are not sufficiently specific. In particular, the  failure to mention and lack of analysis of specific risks in the risk  statements associated with using the increased micropurchase threshold  and increased simplified acquisition procedures is not consistent with  requirements under federal internal control standards.
Why GAO Did This Study

The Project BioShield Act of 2004 (BioShield Act) increased the federal government's ability to procure needed countermeasures to address threats from chemical, biological, radiological, and nuclear agents. Under the BioShield Act, the Department of Health and Human Services (HHS) was provided with new contracting authorities (increased simplified acquisition and micropurchase thresholds, and expanded abilities to use procedures other than full and open competition and personal services contracts) and was authorized to use about $5.6 billion in a Special Reserve Fund to procure countermeasures. Based on the BioShield Act's mandate, GAO reviewed (1) how HHS has used its purchasing and contracting authorities, and (2) the extent to which HHS has internal controls in place to manage and help ensure the appropriate use of its new authorities. To do this work, GAO reviewed contract files and other HHS documents, including internal control guidance, which GAO compared with federal statutes and federal internal control standards.

What GAO Found

Since 2004, HHS has awarded nine contracts using its Special Reserve Fund (Fund) purchasing authority under the BioShield Act to procure countermeasures that address anthrax, botulism, smallpox, and radiation poisoning. HHS may procure countermeasures that are approved by the Food and Drug Administration and ones that are unapproved, but are within 8 years of approval. Of the nine contracts, one was terminated for convenience and the remaining eight are valued at almost $2 billion. HHS officials told GAO that additional contracts are likely to be awarded in the near future as the Fund provides funding through fiscal year 2013. In addition, HHS has used one of its new contracting authorities, simplified acquisition procedures, although it has not used this authority since 2005. HHS has established internal controls on its new purchasing and contracting authorities. In addition to the language in the BioShield Act, which sets up a broad framework of controls over the use of the Special Reserve Fund, the internal controls for this purchasing authority are documented in a variety of internal policy and procedure documents and interagency agreements, which provide guidance on roles and responsibilities for how the controls are to be implemented. In response to BioShield Act requirements, HHS also established internal controls for three of the contracting authorities: the increased simplified acquisition threshold and its use with Special Reserve Funds, the increased micropurchase threshold, and the use of personal services contracts. Federal internal control standards state that, among other things, management needs to comprehensively identify risks, analyze them for possible effect, and determine how risks should be managed. Although some of the risk statements in a memo HHS issued identify some risks and one mentions possible negative consequences that could occur without proper controls in place, the risk statements for using the increased micropurchase threshold and increased simplified acquisition procedures lack analysis of specific risks. In particular, the memo does not discuss a key risk associated with using simplified acquisition procedures--namely, that an agency is prohibited from obtaining cost or pricing data for acquisitions at or below the simplified acquisition threshold. Without this data, the agency may not be able to determine if the price of a contract is fair and reasonable. Moreover, not having adequately documented and appropriately communicated risk assessments potentially results in future employees not knowing or understanding the risks or trade-offs involved in using the authorities. With employee turnover, HHS' reliance on the knowledge of current personnel to appropriately implement key controls will not enable future employees to make sound, informed, and consistent decisions.