IGs Met Some Timeliness and Many Quality Goals, but More Actions Could Improve Performance against Unmet Goals

		DODIG Met Some, but Not All, Fiscal Year 2018 Timeliness Goals

DODIG met some but not all internal timeliness goals for fiscal year 2018  related to the intake and referral of whistleblower allegations, as well as  the oversight of DOD component investigations. Overall, about 85 percent of all investigations  did not meet the timeliness goal. The military service IGs did not meet statutory or internal timeliness goals  for senior official misconduct and whistleblower reprisal investigations,  with exception of the Marine Corps IG—which met its goal for senior  official misconduct investigations (see figure 6). Further, additional initiatives could provide  greater assurance to potential whistleblowers that their cases will be  handled expeditiously. IGs Have Processes to Protect Whistleblower Confidentiality, but Some Gaps Exist

		DODIG Has Policies and Procedures to Protect DOD Whistleblower Confidentiality

DODIG has established policies and procedures to implement key  statutory requirements and CIGIE standards for protecting the  confidentiality of whistleblowers from the receipt of a whistleblower  complaint through its investigation. DODIG Guidance for Protecting the Confidentiality of Whistleblowers Who Report Internal DODIG Misconduct Lacks Sufficient Detail

The DODIG Office of Professional Responsibility’s investigations  manual on handling misconduct complaints against internal DODIG  employees requires that complainant information be strictly controlled in  order to protect the integrity of the investigative process and to avoid  potential harm to the privacy and reputation of the employee. However, the Office of Professional Responsibility  guidance does not include several key steps and procedures that some  DODIG officials reported taking to protect whistleblower confidentiality,  such as excluding complainant information from notifications sent to  subjects and not identifying complainants during interviews with case  subjects. Without updated policies and procedures that fully implement  confidentiality standards for complaint handling and investigation, the Air  Force IG, the Naval IG, and the Marine Corps IG may not be able to  ensure the consistent implementation of confidentiality protections within  their offices. However, it is taking steps to do so. DODIG Does Not Fully Restrict Employee Access to Sensitive Whistleblower Information

			DODIG’s Case Management System Does Not Include Some Controls to Restrict Internal Employee Access

As previously discussed, DODIG has taken steps to restrict employee  access to whistleblower information, such as by restricting access to  cases in which a complainant has not consented to releasing his or her  identity. Table 6 shows examples of recent instances in which DODIG determined  that sensitive whistleblower records were accessible to DODIG personnel  without a need to know. Without steps to address these  ongoing IT access issues, the potential for additional violations of  whistleblower confidentiality will persist. DODIG Generally Met Documentation Requirements in Senior Official Cases that GAO Reviewed and Reported Most Credible Allegations

		DODIG Dismissed Most Cases Involving Civilian DOD Presidential Appointees with Senate Confirmation and Generally Included Required Data and Documentation

DODIG closed 129 misconduct and reprisal cases in fiscal years 2013  through 2017 with complaints involving a civilian DOD Presidential  appointee with Senate confirmation (PAS)  subject. Important  components of a credible whistleblower program are timeliness of case  processing and safeguarding confidentiality to the maximum extent  possible. In addition, DODIG generally met key documentation and  data requirements for the 125 cases dismissed by DODIG involving  civilian DOD PAS officials, and reported most credible allegations, as  required. The IGs have existing controls for  safeguarding whistleblower information, but additional efforts are  warranted. Similarly, without considering actions to further restrict IG  employee access in existing IT, the Air Force, Army, and Naval IGs may  be unable to mitigate ongoing risks to whistleblower confidentiality. All of the military service IGs concurred with the recommendations  directed to them. As stated in our report,  DODIG’s 2018 quality assurance review of the Army IG found that the  Army IG’s application did not restrict personnel without a need to know  from accessing allegations involving Army IG personnel, contrasting with  NIST guidelines, which predicate user access on the need to accomplish  assigned tasks. Appendix I: Scope and Methodology

To determine the extent to which the Department of Defense Office of  Inspector General (DODIG) and the military service offices of inspector  general (IG) met and took steps to achieve key fiscal year 2018  timeliness and quality goals related to the handling of whistleblower  complaints, we reviewed performance documentation and interviewed  officials on DODIG and military service IG timeliness and quality goals,  performance measures, and associated performance data for fiscal year  2018, along with ongoing and planned efforts to improve performance. We also reviewed fiscal year 2017 performance data for comparison  purposes. To determine the extent to which DODIG and the military service IGs are  able to access and safeguard classified and sensitive information  necessary to handle whistleblower complaints, we reviewed  documentation and interviewed officials on the extent to which DODIG  and the military service IGs have developed, implemented, and assessed  key information technology (IT) security controls, and authorized the  systems and applications used to process, store, and transmit sensitive  whistleblower information per requirements and standards prescribed by  DOD, the Office of Management and Budget,  and the National Institute  of Standards and Technology. 1. 4. Which DODIG directorate’s records have you or other DODIG  employees been able to access without a need to know? 2. 12. GAO-17-227. Whistleblower Protection: Actions Needed to Improve DOD’s Military  Whistleblower Reprisal Program. GAO-12-362.
Why GAO Did This Study

Safeguarding confidentiality to the maximum extent possible is essential for encouraging whistleblowers to report wrongdoing without fear of reprisal. In fiscal year 2018, DODIG received over 12,000 contacts from potential whistleblowers related to fraud, waste, abuse, employee misconduct, or other violations. The National Defense Authorization Act for Fiscal Year 2017 included a provision for GAO to review the integrity of DOD's whistleblower program. This report assesses the extent to which DODIG and the military service IGs (1) met and took steps to achieve key fiscal year 2018 timeliness and quality goals, (2) established processes to protect whistleblower confidentiality, and (3) are able to safeguard sensitive information necessary to handle whistleblower complaints. It also evaluates (4) the extent to which select cases involving certain senior DOD civilian officials met key requirements.
GAO assessed fiscal year 2018 IG performance data, surveyed all 108 DODIG employees who directly handle whistleblower complaints, reviewed IT security controls, and analyzed all 125 cases involving civilian DOD Presidential appointees with Senate confirmation dismissed by DODIG in fiscal years 2013-2017.

What GAO Found

The Department of Defense Office of Inspector General (DODIG) and military service offices of inspector general (IG) met some but not all fiscal year 2018 timeliness and quality goals for handling whistleblower complaints. For example, DODIG met its goals related to referring complaints to the appropriate agency within a certain number of days. All IGs also generally met goals related to the quality of investigations. However, about 85 percent of DODIG reprisal and senior official misconduct investigations exceeded statutory and internal timeliness goals. Further, military service IGs did not meet most goals for handling cases within prescribed timeframes. For example, the service IGs averaged between 17 and 84 days to notify DODIG of their receipt of whistleblower reprisal allegations, exceeding the 10-day goal. The IGs have various initiatives underway to improve timeliness, such as a Naval IG program to reduce timeframes for initial credibility determinations. However, additional actions could provide a more targeted approach to improving performance against unmet timeliness goals—such as for senior official misconduct investigations—and better assure whistleblowers that their cases will be handled expeditiously.
DODIG and the military service IGs have policies to protect whistleblower confidentiality, but some gaps exist. For example, DODIG guidance for protecting whistleblowers who report internal DODIG misconduct does not specify key steps investigators should take to protect confidentiality, such as not identifying complainants during interviews with case subjects. Also, Air Force, Naval, and Marine Corps IG guidance does not specify when whistleblower identities can be disclosed without consent. Without updated guidance, the IGs cannot ensure the consistent implementation of confidentiality protections.
The IGs have taken steps to safeguard whistleblower information in their information technology (IT) systems and applications, such as by restricting access to case information through unique user permissions and by taking actions to follow DOD's IT risk management process. However, between 2016 and 2018, employees in all of the IGs have been able to access sensitive whistleblower information without a need to know. For example, DODIG determined that numerous restricted whistleblower records in its document repository were accessible to DODIG personnel without a need to know. Similarly, the Air Force IG's application did not restrict users from other DOD components from viewing Air Force IG case descriptions and complainant identities, while the Army IG's application and the Naval IG's system did not restrict personnel within those IGs from viewing allegations or investigations involving other personnel within those IGs. Additionally, employees in Marine Corps IG offices were able to see whistleblower cases assigned to other IG offices without a need to know. While some actions have been taken to address these issues, additional steps are needed to restrict access to case information in order to mitigate ongoing risks to whistleblower confidentiality.
DODIG generally met key documentation requirements for the 125 cases it dismissed without investigation involving civilian DOD Presidential appointees with Senate confirmation.

What GAO Recommends

GAO is making 12 recommendations, including that the IGs take additional actions to improve timeliness, develop additional procedures to protect whistleblower confidentiality, and take steps to further limit IG employee access to sensitive whistleblower information. DOD concurred with all of the recommendations.