	NTSB Has Made Progress in Improving Many Management Practices, But Further Improvements are Needed in Training and Financial Management

Overall, NTSB has made progress in following leading management  practices in the eight areas in which we made recommendations in 2006. Among the areas that NTSB has made the most progress is improving  communication from staff to management, which should help staff and  management build more constructive relationships, identify operational  and work-life improvements, and enable management to better understand  and respond to issues faced by investigators and other staff. For  example, NTSB has revised its strategic plan to follow some performance- based requirements, and it has developed strategic human capital and IT  plans. Although these plans still offer room for improvement, they  establish a solid foundation for NTSB to move forward, both broadly as an  agency and specifically with respect to IT efforts. NTSB Has Made Improvements Related to Accident Investigation, But Its Safety Impact Could be Greater with More Safety Studies

NTSB has improved the efficiency of activities related to investigating  accidents, such as selecting accidents to investigate and tracking the  status of recommendations, but it has not increased its use of safety  studies (see fig. NTSB has improved its process for selecting  accidents to investigate by developing transparent, risk-based criteria for  selecting which rail, pipeline, and hazardous materials accidents to  investigate and which aviation accidents to investigate at the scene, or  remotely, in a limited manner. The completion of its effort to develop  similar criteria for marine accidents will help provide assurance and  transparency that the agency is managing investigative resources in a  manner that ensures a maximum safety benefit. NTSB Has Made Progress in Increasing the Utilization of the Training Center, But the Facility Remains Underutilized

While NTSB has taken steps to increase the utilization of the training  center and to decrease the center’s overall deficit, the classroom space  remains significantly underutilized. The agency increased utilization of  classroom space in the training center from 10 percent in fiscal year 2006  to 13 percent in fiscal year 2007. The agency’s actions to increase utilization also helped increase training  center revenues from about $630,000 in fiscal year 2005 to about $820,000  in fiscal year 2007. In addition, for fiscal year 2008, NTSB’s March 2008 business plan  for the  training center estimates that revenues will increase by about $570,000 to  about $1.4 million and expenses will be $2.6 million, leaving a deficit of  about $1.2 million. Going forward, however, the agency’s business plan for the training center  lacks specific strategies to explain how further increases in utilization and  revenue enhancement can be achieved. In addition to the weaknesses addressed in these recommendations, our  limited review of NTSB’s information security controls identified two new  weaknesses regarding unencrypted laptop computers and excessive  access privileges on users’ workstations. Recommendations for Executive Action

To assist NTSB in continuing to strengthen its overall management of the  agency as well as information security, we are making three  recommendations to the Chairman of the National Transportation Safety  Board. For example,  the Chief Information Officer has documented prior recommendations and newly  identified vulnerabilities in a plan of action and milestones and is monitoring corrective  actions to implement the recommendations and mitigate the vulnerabilities. NTSB has completed a risk  assessment of its general support system in February 2008. What an Independent Auditor Found  The independent auditor identified several weaknesses in NTSB’s access controls. 3. The  agency has procured and in some cases begun to implement automated software tools  to help implement recommendations related to granting, removing, and recertifying  users’ access permissions. In addition,  agency officials have recently taken action to develop a formal privacy program;  however, work remains before it is fully compliant with the requirements of the Privacy  Act. The agency expects this training to be available in June  2008.
Why GAO Did This Study

The National Transportation Safety Board (NTSB) plays a vital role in advancing transportation safety by investigating accidents, determining their causes, issuing safety recommendations, and conducting safety studies. To support its mission, NTSB's training center provides training to NTSB investigators and others. It is important that NTSB use its resources efficiently to carry out its mission. In 2006, GAO made recommendations to NTSB in most of these areas. In 2007, an independent auditor made information security recommendations. This testimony addresses NTSB's progress in following leading practices in selected management areas, increasing the efficiency of aspects of investigating accidents and conducting safety studies, increasing the utilization of its training center, and improving information security. This testimony is based on GAO's assessment of agency plans and procedures developed to address these recommendations.

What GAO Found

NTSB has made progress in following leading management practices in the eight areas in which GAO made prior recommendations. For example, the agency has improved communication from staff to management by conducting periodic employee surveys, which should help build more constructive relationships within NTSB. Similarly, the agency has made significant progress in improving strategic planning, human capital management, and IT management. It has issued new strategic plans in each area. Although the plans still leave room for improvement, they establish a solid foundation for NTSB to move forward. However, until the agency has developed a full cost accounting system and a strategic training plan, it will miss other opportunities to strengthen the management of the agency. NTSB has improved the efficiency of activities related to investigating accidents and tracking the status of recommendations. For example, it has developed transparent, risk-based criteria for selecting which rail, pipeline, hazardous materials, and aviation accidents to investigate at the scene. The completion of similar criteria for marine accidents will help provide assurance that NTSB is managing its resources in a manner to ensure a maximum safety benefit. Also, it is in the process of automating its lengthy, paper-based process for closing-out recommendations. Although NTSB has increased the utilization of its training center--from 10 percent in fiscal year 2006 to a projected 24 percent fiscal year 2008--the classroom space remains significantly underutilized. The increased utilization has helped increase revenues and reduce the center's overall deficit, which declined from about $3.9 million in fiscal year 2005 to about $2.3 million in fiscal year 2007. For fiscal year 2008, NTSB expects the deficit to decline further to about $1.2 million due, in part, to increased revenues from subleasing some classrooms starting July 2008. However the agency's business plan for the training center lacks specific strategies to achieve further increases in utilization and revenue. NTSB has made progress toward correcting previously reported information security weaknesses. For example, in an effort to implement an effective information security program, the agency's Chief Information Officer is monitoring corrective actions and has procured and, in some cases, begun to implement automated processes and tools to help strengthen its information security controls. While improvements have been made, work remains before the agency is fully compliant with federal policies, requirements, and standards pertaining to information security, access controls, and data privacy. In addition, GAO identified new weaknesses related to unencrypted laptops and excessive user access privileges. Agency officials attributed these weaknesses to incompatible encryption software and a mission need for certain users. Until the agency addresses these weaknesses, the confidentiality, integrity, and availability of NTSB's information and information systems continue to be at risk.