Examples, in chronological order, of the problems on which we have  reported and where ineffective oversight was identified as a cause include  the following:    2004: a suspension—or stand-down—of operations at one NNSA  laboratory to address systemic safety and security concerns identified  after an undergraduate student was partially blinded in a laser  accident and two classified computer disks were reported missing;    2006: the discovery of a large number of classified documents and  electronic files that had been unlawfully removed from an NNSA  laboratory as a result of a drug raid on a private residence;    2007: nearly 60 serious accidents or near misses including worker  exposure to radiation, inhalation of toxic vapors, and electrical shocks  at three nuclear weapons laboratories from 2000 through 2007;    2008: the identification of significant protective force weaknesses (i.e.,  13 specific deficiencies) during an independent physical security  evaluation of an NNSA laboratory that included a force-on-force  exercise to simulate an attack on a sensitive facility;    2012: 11 public hearings held since 2002 to address concerns about  DOE’s safety practices by the Defense Nuclear Facilities Safety  Board—an independent executive branch agency created by  Congress to independently assess safety conditions and operations at  defense nuclear facilities at DOE’s sites, including NNSA and EM;    2012: a serious security breach at an NNSA production plant—the Y- 12 National Security Complex (Y-12) near Oak Ridge, Tennessee—in  which three trespassers gained access to the protected area directly  adjacent to one of the nation’s most critically important nuclear  weapon-related facilities before being interrupted by the security  measures in place, resulting in the identification of multiple and  unprecedented security system failures; and    2014: operations were shut down at WIPP following an underground  fire involving a vehicle and, 9 days later, an unrelated radiological  event occurred when a nuclear waste container breached  underground at WIPP, contaminating a portion of the WIPP facility  and releasing a small amount of contamination into the environment. The focus of this  DOE policy and order was to drive continuous improvement through  contractor self-assurance and effective federal oversight. While the  previous DOE oversight policy and order were focused on driving  continuous improvement, the 2011 versions—which are still in use—focus  on improving the efficiency and effectiveness of DOE oversight programs  by leveraging the processes and outcomes of CAS to reduce direct,  hands-on oversight, when appropriate. NAP-21, which similarly focuses on the oversight efficiencies that can be  gained by appropriately leveraging information from CAS, specifically  applies to NNSA and its M&O contractors and elaborates on the more  general DOE oversight policy and order by (1) developing an approach  for federal officials to use in determining the appropriate mix of oversight  activities for different contractor-performed functions and (2) by  establishing a process by which NNSA would affirm the effectiveness of  both CAS implementation by the contractor and the federal oversight  approach at each site in the nuclear security enterprise. On the other side of the  spectrum is “systems-based oversight,” where federal overseers rely on  contractors’ processes and information from their CAS. NNSA Has Not Fully Established Policy or Guidance for Using Information from CAS to Conduct Contractor Oversight

In our May 2015 report, we found that NNSA has not fully established  policy or guidance to support determining appropriate approaches to  overseeing its M&O contractors, including for using information from CAS. We did not, however, identify any headquarters-level policy or guidance  for assessing CAS maturity, for assessing contractors’ past performance  to inform an oversight approach, or for assessing risk in other areas. Without such policy or guidance, NNSA officials responsible for  conducting assessments may do so inconsistently, and thus treat similar  risks differently. As a result of our findings, we recommended that NNSA establish  comprehensive oversight polices including for using information from CAS  to conduct oversight of M&O contractors and describing how to conduct  assessment of risk, CAS maturity, and the level of the contractor’s past  performance in determining an appropriate oversight approach. NNSA’s Field Offices Developed Procedures for Determining Appropriate Oversight Approaches, but the Procedures Are Not Always Complete and Differ

In the absence of sufficiently detailed and comprehensive guidance from  NNSA headquarters for determining an appropriate mix of oversight  approaches, NNSA field offices responsible for day-to-day oversight of  M&O contractors reported developing their own procedures for this  purpose. For example, the five field offices  that reported having complete procedures for assessing CAS maturity  used different processes and scales for rating maturity. While each of  these procedures may be effective for each field office’s purposes, these  differences could affect the consistency with which NNSA’s field offices  are determining an appropriate mix of oversight approaches across the  nuclear security enterprise. NNSA concurred with our  recommendation and stated that field offices will develop new or modify  existing procedures, as appropriate, to support the new requirements and  estimated the completion date for these activities is September 2016. We recommended that NNSA reestablish a process for reviewing the  effectiveness of field offices’ oversight approaches, including their  determinations for how and when to use information from CAS. Preliminary Observations from Ongoing Work on DOE’s Processes for Oversight of WIPP

Our preliminary observations on NNSA’s oversight of waste packaging  activities at LANL parallel two of the findings from our recently released  May 2015 report. According to the accident investigation board report,  the NNSA field office’s overreliance on the contractor-generated  information in CAS was not consistent with a 2011 NNSA review that  observed CAS was still maturing and that a strong NNSA field office  oversight presence should continue. This is because NNSA does not have complete policy  or guidance to implement the oversight framework and has discontinued  its reviews intended to evaluate the effectiveness of field offices’ oversight  approaches; also, in the absence of headquarters policy or guidance, its  field offices have developed procedures that are not fully complete and  differ.
Why GAO Did This Study

A 2005 DOE policy required the department's M&O contractors to implement assurance systems to drive continuous improvement through contractor self-assessment and effective federal oversight. A policy change in 2011 sought to improve the efficiency and effectiveness of DOE oversight programs by leveraging the contractor-generated information from CAS to reduce hands-on oversight, when appropriate. Also, in 2011, NNSA developed a framework for overseeing its M&O contractors, including a three-pronged evaluation for determining how and when to use information from CAS by evaluating the risk of contractors' activities, contractor's past performance, and the maturity of their CAS. Recent security and safety incidents at DOE and NNSA sites, including a 2014 nuclear waste accident, have caused some to question the extent to which information from CAS can be relied on for overseeing M&O contractors.
This testimony discusses NNSA's policy and procedures for implementing the framework, including its use of information from CAS and its process for evaluating oversight effectiveness. Based mainly on GAO's May 2015 report ( GAO-15-216 ), it also discusses preliminary observations from ongoing work related to the 2014 accident for which GAO is analyzing NNSA and DOE policies and guidance on oversight and accident investigation reports completed by DOE and others

What GAO Found

In May 2015, GAO found that the Department of Energy's (DOE) National Nuclear Security Administration (NNSA) had not fully established policy or guidance for using information from contractor assurance systems (CAS) to conduct oversight of management and operating (M&O) contractors. NNSA did not provide comprehensive guidance to agency officials on how to conduct assessments required by its oversight framework. In particular, NNSA did not provide guidance for assessing the maturity of contractors' CAS to determine whether information from these systems is sufficiently reliable for oversight purposes. As a result, NNSA cannot ensure that it is appropriately relying on information from CAS in overseeing these contractors. NNSA agreed with GAO's recommendation to establish a comprehensive oversight policy, including for assessments to determine how to use information from CAS for oversight.
In the absence of headquarters level policy or guidance, GAO found in May 2015 that NNSA field offices established their own procedures for determining appropriate oversight approaches, but these procedures were not always complete, and they differed. For example, five of NNSA's seven field offices reported having complete procedures for assessing CAS maturity, but these procedures described different processes and rating scales for conducting such assessments, which could affect the consistency of how field offices determine oversight approaches. NNSA agreed with GAO's recommendation for field offices to develop new or modify existing procedures consistent with new headquarters policy.
NNSA's 2011 policy included a process for validating the effectiveness of field offices' oversight approaches, including the extent to which their approaches appropriately used information from CAS, but GAO found in May 2015 that NNSA discontinued this process after determining that it had not been effective. Discontinuing this process without replacing it eliminated NNSA's internal control for ensuring the effectiveness and consistency of oversight approaches. NNSA agreed with GAO's recommendation to reestablish such a process.
Preliminary observations from GAO's ongoing work to evaluate the 2014 nuclear waste accident at DOE's Waste Isolation Pilot Plant in New Mexico parallel GAO's findings on NNSA's framework for contractor oversight. For example, DOE's accident investigation board reported that the NNSA field office responsible for overseeing waste packaging and processing overrelied on contractor-generated information from CAS instead of directly conducting assessments and that the decision to do so was inconsistent with a 2011 NNSA review, which concluded the contractor's CAS was still maturing.

What GAO Recommends

GAO made several recommendations in its May 2015 report with which NNSA concurred and for which it plans to take action.