Homeland Security
CDC's Oversight of the Select Agent Program Gao ID: GAO-03-315R November 22, 2002In the wake of anthrax incidents and mounting concerns about the potential for another bioterrorism attack, we assessed the Centers for Disease Control and Prevention's (CDC) oversight of the Department of Health and Human Services' (HHS) Laboratory Registration/ Select Agent Transfer Program. We brought program weaknesses we identified to the immediate attention of CDL and HHS officials, who agreed that improvements were warranted. The purpose of this report is to summarize our findings.
As the agency responsible for identifying and controlling biological agents that have the potential to pose a severe threat to public health and safety, CDC can improve its management of the Select Agent Program to reduce the likelihood of unauthorized access to biological agents. During the course of our review, we identified and brought to the immediate attention of CDC and HHS officials areas in which program oversight could be strengthened, including inspection and approval of facilities and monitoring of the transfer and shipment of select agents. To better position CDC to reasonably ensure that appropriate security and safety protections are in place for select agents, we made recommendations aimed at establishing proper internal control in accordance with OMB Circular A-123 over the Select Agent Program.
GAO-03-315R, Homeland Security: CDC's Oversight of the Select Agent Program
This is the accessible text file for GAO report number GAO-03-315R
entitled 'Homeland Security: CDC‘s Oversight of the Select Agent
Program' which was released on November 22, 2002.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
GAO-03-315R:
United States General Accounting Office:
Washington, DC 20548:
November 22, 2002:
The Honorable Tommy G. Thompson:
Secretary of Health and Human Services:
Subject: Homeland Security: CDC‘s Oversight of the Select Agent
Program:
Dear Mr. Secretary:
The intentional dissemination of anthrax in the U.S. mail last fall
demonstrates the devastating effect a biological agent can have if it
falls into the wrong hands. Exposures to anthrax-tainted mail resulted
in five deaths and 17 other infections, as well as significant
disruption to postal service and other government operations. The
sources from which terrorists can potentially obtain biological agents
include public and private research laboratories located in the United
States, and there is concern that the anthrax used in these incidents
may have been obtained from federal or other domestic laboratories.
In the Antiterrorism and Effective Death Penalty Act of 1996,[Footnote
1] the Congress included provisions to regulate the transfer between
laboratories of certain biological agents and toxins”called select
agents”and required the Secretary of Health and Human Services (HHS) to
issue regulations to implement these provisions. In response, HHS
established in 1997 the Laboratory Registration/Select Agent Transfer
Program at the Centers for Disease Control and Prevention (CDC), which
developed the current list of 42 select agents covered by the program.
The Select Agent Program is responsible for regulating the transfer of
select agents to limit their distribution to only those laboratories
that have the appropriate safety and security controls for handling
biologic agents.[Footnote 2] Facilities interested in
transferring”sending or receiving”select agents must be registered with
CDC.[Footnote 3] To register, facilities must demonstrate in their
applications that they meet the conditions for safety and security and
have legitimate research needs for the agents, and CDC may inspect
facilities before and after registration to ensure compliance.
Laboratories possessing but not transferring select agents are not
subject to the act.
In the wake of the anthrax incidents and mounting concerns about the
potential for another bioterrorism attack, we have assessed CDC‘s
oversight of the Select Agent Program. We brought program weaknesses we
identified to the immediate attention of CDC and HHS officials, who
agreed that improvements were warranted. The purpose of this report is
to summarize our findings and confirm your agreement to take prompt
corrective action.
In conducting our work, we evaluated the Select Agent Program‘s
operations by applying the criteria in the Office of Management and
Budget‘s (OMB) Circular A-123, Management Accountability and Control
[Footnote 4] and in our Internal Control: Standards for Internal
Control in the Federal Government,[Footnote 5] which lays out five
standards of internal control. These five standards”control
environment, risk assessment, control activities, information and
communication, and monitoring[Footnote 6]”define the minimum level of
quality acceptable for internal control in government. We also
reviewed the registration applications for a nongeneralizable 10
percent random sample of Select Agent Program registrants and those
registrants‘ transfer forms, which are required for transferring select
agents; all CDC laboratory inspection reports; information in CDC‘s
database on registered facilities and select agent transfers; and
Select Agent Program policies and procedures. We interviewed program
and management staff in CDC‘s Select Agent Program in Atlanta, Ga., and
in HHS. Additionally, we reviewed the Public Health Security and
Bioterrorism Preparedness and Response Act of 2002. Our review was
limited to CDC‘s management of the Select Agent Program and does not
include the actual shipments of select agents or the safety and
security of registered facilities. In addition, consistent with the
scope of the Select Agent Program, we did not assess the merits of the
research conducted by program registrants. We conducted our review from
November 2001 through September 2002 in accordance with generally
accepted government auditing standards.
Results in Brief:
As the agency responsible for identifying and controlling biological
agents that have the potential to pose a severe threat to public health
and safety, CDC can improve its management of the Select Agent Program
to reduce the likelihood of unauthorized access to biological agents.
During the course of our review, we identified and brought to the
immediate attention of CDC and HHS officials areas in which program
oversight could be strengthened, including inspection and approval of
facilities and monitoring of the transfer and shipment of select
agents. To better position CDC to reasonably ensure that appropriate
security and safety protections are in place for select agents, we made
recommendations aimed at establishing proper internal control in
accordance with OMB Circular A-123 over the Select Agent Program. In
discussing these recommendations with CDC officials, they concurred and
noted improvements planned or already in progress.
Background:
Biological agents pose a severe public health threat in our country if
individuals or groups intent on harming the United States are able to
obtain them. To better ensure the safe transfer of select agents, the
Antiterrorism and Effective Death Penalty Act of 1996 required the
Secretary of HHS to:
* provide for safeguards to prevent access to such agents for use in
domestic or international terrorism or for other criminal purposes;
* provide for the establishment and enforcement of safety procedures
for the transfer of the listed biological agents, including measures to
ensure proper training and appropriate skills to handle agents and
proper laboratory facilities to contain and dispose of agents;
* establish and maintain a list of biological agents that have the
potential to pose a severe threat to public health and safety; and;
* provide for the establishment of procedures to protect the public
safety in the event of an actual or potential illegal transfer of a
biological agent.
HHS established the Select Agent Program within the Office of External
Activities under the Office of Health and Safety at CDC. Program
funding has increased substantially since the program was established
in 1997. Funding for fiscal year 2002 was originally $1 million. As a
result of Public Law 107-117, enacted on January 10, 2002, an
additional $3.6 million was made available to the program for fiscal
year 2002. The program was authorized to fund 21 staff in fiscal year
2002”up from 9 in fiscal year 2001.
The regulations governing the Select Agent Program became effective on
April 15, 1997.[Footnote 7] The regulations include six primary
components: (1) a list of select agents that have the potential to pose
a severe threat to public health and safety,[Footnote 8] (2)
registration of facilities prior to the domestic transfer of select
agents, (3) a process to document successful transfer of agents, (4)
audit, quality control, and accountability mechanisms, (5) agent
disposal requirements, and (6) research and clinical exemptions.
[Footnote 9]
To limit the distribution of select agents to laboratories with
appropriate safety and security controls for handling biologic agents
and a legitimate need for such agents, CDC requires U.S.-based research
institutions, government agencies, universities, manufacturers, and
other entities interested in transferring select agents to be
registered.[Footnote 10] Registration is for 3 years. As part of the
registration process, facilities must demonstrate in their applications
that they meet the requirements delineated in Biosafety in
Microbiological and Biomedical Laboratories (BMBL)[Footnote 11] for
working with particular select agents. Such requirements include having
proper laboratory and personal protective equipment, precautionary
signage, and ventilation; controlled access; and biosafety operations
manuals. Facilities must also describe the laboratory procedures that
will be used, provide a laboratory floor plan where the select agent
will be handled and stored, and describe how access will be limited to
authorized personnel. In addition, facilities must describe the
objectives of the work that requires the select agent. Each facility
must identify a responsible facility official who is authorized to
transfer and receive select agents on behalf of the facility.
Individuals making false, fictitious, or fraudulent statements or
representations on registration forms may be punished by a fine of up
to $250,000, imprisonment up to 5 years, or both. Violations by
organizations are punishable by a fine of up to $500,000 per
violation.[Footnote 12] To ensure compliance with these requirements,
the program established a goal of inspecting these facilities once
during the 3-year registration period. Facilities may be inspected
before and after registration, but there is no requirement that
inspections be performed.
In June 2002, the President signed into law the Public Health Security
and Bioterrorism Preparedness and Response Act of 2002, which revises
and expands the Select Agent Program.[Footnote 13] Among other
requirements, the new law:
* requires all facilities possessing select agents to register with the
Secretary of HHS, not just those facilities sending or receiving select
agents;[Footnote 14]
* restricts access to biological agents and toxins by persons who do
not have a legitimate need and who are considered a risk by federal law
enforcement and intelligence officials;
* requires transfer registrations to include information regarding the
characterization of agents and toxins to facilitate their
identification, including their source;[Footnote 15]
* requires the creation of a national database with information on all
facilities and persons possessing, using, or transferring select
agents;
* directs the Secretary of HHS to review and publish the select agent
list biennially, making revisions as appropriate to protect the public;
and;
* requires the Secretary to impose more detailed and different levels of
security for different select agents based on their assessed level of
threat to the public.
Select Agent Program staff estimate that this new law could result in a
tenfold expansion of their responsibilities because many more
facilities possess select agents than those registered to transfer them
so far.
CDC Needs to Improve Internal Control Weaknesses to Better Manage the
Select Agent Program:
We found significant management weaknesses in CDC‘s facility
registration and transfer monitoring processes that impede effective
program oversight. As discussed with CDC officials, we recommended that
CDC establish proper internal control in accordance with OMB Circular A-
123. This would include improvements in the following areas:
* inspection and approval of facilities registering to transfer select
agents;
* monitoring of the transfer and shipment of select agents;
* accuracy of CDC databases of registered facilities and select agent
transfers, and;
* CDC organizational structure to improve oversight.
HHS agreed with the need for these corrective actions and stated that
improvements were already underway in some areas. Correcting these
internal control weaknesses is essential to CDC‘s ability to
effectively oversee both the original and the expanded program required
by the Public Health Security and Bioterrorism Preparedness and
Response Act of 2002. Because of the urgent and potentially serious
public health threat in our country if corrective action is not taken
expeditiously, we will be conducting periodic work to follow up on your
progress in implementing our recommendations.
We are sending copies of this report to the Senate Committees on
Appropriations; Governmental Affairs; and Health, Education, Labor, and
Pensions; and the House Committees on Appropriations; Energy and
Commerce; and Government Reform. We will also make copies available to
others on request. In addition, the report will be available at no
charge on GAO‘s Web site at [hyperlink, http://www.gao.gov]. If you or
your staff have any questions, please contact me at (202) 512-7101.
Sincerely yours,
Singed by:
Cynthia A. Bascetta:
Director, Health Care:
Enclosure:
[End of section]
Enclosure:
Internal Controls:
Our Internal Control: Standards for Internal Control in the Federal
Government[Footnote 16] lays out the standards for internal control.
Internal control is an integral part of a government organization's
management that provides reasonable assurance that the following four
objectives are being achieved:
* operations are effective and efficient;
* financial and other reporting is reliable;
* applicable laws and regulations are complied with; and;
* unauthorized acquisition, use, or disposition of an agency's assets is
prevented or detected.
To achieve these four objectives, agencies should meet five standards
for internal control in the federal government. Agencies should:
* have an effective control environment;
* conduct risk assessments;
* implement control activities;
* properly record information and communicate to management, and;
* ensure monitoring.
A brief explanation of each of the five standards for internal control
follows.
Control Environment:
Management and employees should establish and maintain an environment
throughout the organization that sets a positive and supportive
attitude toward internal control and conscientious management.
Risk Assessments:
Agencies should provide for an assessment of risk the agency faces from
both internal and external sources in accomplishing its mission.
Control Activities:
Agencies should establish and carry out specific control
activities”policies, procedures, techniques, and mechanisms”that
enforce management's directives to help ensure that actions are taken
to address risks and to document critical events and transactions.
Information and Communication Channels:
Information should be recorded and communicated to management and
others within the entity who need it and in a form and within a time
frame that enable them to carry out their internal control and other
responsibilities.
Monitoring:
Internal control monitoring should assess the quality of performance
over time and ensure that the findings of audits and other reviews are
promptly resolved.
[End of section]
Footnotes:
[1] Pub. L. No. 104-132, § 511, 110 Stat. 1214, 1284-1285 (1996).
[2] CDC oversees the domestic transfer and possession of select agents.
The Commerce Department‘s Bureau of Export Administration oversees a
separate select agent export program for transfers outside the United
States.
[3] CDC‘s own laboratories that transfer select agents must also
register with the program and are subject to its requirements.
[4] Office of Management and Budget, OMB Circular A-123, Management
Accountability and Control, (Washington, D.C.: 1995). This document
provides the specific requirements for assessing and reporting on
controls.
[5] U.S. General Accounting Office, Internal Control: Standards for
Internal Control in the Federal Government, GAO/AIMD-00-21.3.1
(Washington, D.C.: November 1999). The Federal Managers‘ Financial
Integrity Act of 1982 (FMFIA) requires us to issue standards for
internal control in government. Among other things, the standards
provide the overall framework for establishing and maintaining internal
control.
[6] See the enclosure of this report for a more detailed discussion of
internal controls.
[7] The regulations are set forth at 42 C.F.R. Part 72 (2002).
[8] CDC‘s select agent list consists of 42 viruses, bacteria,
rickettsiae, fungi, and toxins. CDC worked with representatives of
several countries, U.S. intelligence officials, and safety
professionals to establish its list based on a list of biological
agents for export control developed by the Australia Group”an informal
network of 33 countries that aims to minimize the proliferation of
chemical and biological weapons.
[9] For example, vaccines at certain stages of clinical research and
clinical specimens are exempt.
[10] There are a number of circumstances under which a facility might
want to send or receive a select agent. For example, some facilities
have select agents that other facilities would need to conduct
research, such as vaccine development.
[11] U.S. Department of Health and Human Services, Public Health
Service, Centers for Disease Control and Prevention and National
Institutes of Health, Biosafety in Microbiological and Biomedical
Laboratories, Fourth Edition (Washington, D.C.: May 1999).
[12] 42 C.F.R. § 72.7.
[13] Pub. L. No. 107-188, 116 Stat. 594, 637-647.
[14] The law required all persons possessing select agents to register
with HHS by September 10, 2002, and HHS issued guidance for how the
notification of possession should be made in July 2002. 67 Fed.
Reg. 46,363 (2002). The department must promulgate regulations for the
select agent program by December 9, 2002, to implement other
requirements of the law.
[15] According to the Conference Report accompanying the law, one
purpose of the registration and database requirements is to collect
sufficiently detailed information on the registered select agents so
that the database can differentiate between and within strains of a
given agent or toxin. Such information should be in a format that
public health and law enforcement officials can use to identify
the origin or source of an agent that is used to cause harm to the
public. H.R. Conf. Rep. No. 107-481, at 121 (2002).
[16] U.S. General Accounting Office, GAO/AIMD-00-21.3.1 (Washington,
D.C.: November 1999).
[End of section]
GAO's Mission:
The General Accounting Office, the investigative arm of Congress,
exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability
of the federal government for the American people. GAO examines the use
of public funds; evaluates federal programs and policies; and provides
analyses, recommendations, and other assistance to help Congress make
informed oversight, policy, and funding decisions. GAO's commitment to
good government is reflected in its core values of accountability,
integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through the Internet. GAO's Web site [hyperlink,
http://www.gao.gov] contains abstracts and full-text files of current
reports and testimony and an expanding archive of older products. The
Web site features a search engine to help you locate documents using
key words and phrases. You can print these documents in their entirety,
including charts and other graphics.
Each day, GAO issues a list of newly released reports, testimony, and
correspondence. GAO posts this list, known as "Today's Reports," on its
Web site daily. The list contains links to the full-text document
files. To have GAO e-mail this list to you every afternoon, go to
[hyperlink, http://www.gao.gov] and select "Subscribe to e-mail alerts"
under the "Order GAO Products" heading.
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. General Accounting Office:
441 G Street NW:
Room LM:
Washington D.C. 20548:
To order by Phone:
Voice: (202) 512-6000:
TDD: (202) 512-2537:
Fax: (202) 512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Public Affairs:
Jeff Nelligan, managing director, NelliganJ@gao.gov:
(202) 512-4800:
U.S. General Accounting Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548:
