Project Bioshield
HHS Can Improve Agency Internal Controls for Its New Contracting Authorities Gao ID: GAO-09-820 July 21, 2009The Project BioShield Act of 2004 (BioShield Act) increased the federal government's ability to procure needed countermeasures to address threats from chemical, biological, radiological, and nuclear agents. Under the BioShield Act, the Department of Health and Human Services (HHS) was provided with new contracting authorities (increased simplified acquisition and micropurchase thresholds, and expanded abilities to use procedures other than full and open competition and personal services contracts) and was authorized to use about $5.6 billion in a Special Reserve Fund to procure countermeasures. Based on the BioShield Act's mandate, GAO reviewed (1) how HHS has used its purchasing and contracting authorities, and (2) the extent to which HHS has internal controls in place to manage and help ensure the appropriate use of its new authorities. To do this work, GAO reviewed contract files and other HHS documents, including internal control guidance, which GAO compared with federal statutes and federal internal control standards.
Since 2004, HHS has awarded nine contracts using its Special Reserve Fund (Fund) purchasing authority under the BioShield Act to procure countermeasures that address anthrax, botulism, smallpox, and radiation poisoning. HHS may procure countermeasures that are approved by the Food and Drug Administration and ones that are unapproved, but are within 8 years of approval. Of the nine contracts, one was terminated for convenience and the remaining eight are valued at almost $2 billion. HHS officials told GAO that additional contracts are likely to be awarded in the near future as the Fund provides funding through fiscal year 2013. In addition, HHS has used one of its new contracting authorities, simplified acquisition procedures, although it has not used this authority since 2005. HHS has established internal controls on its new purchasing and contracting authorities. In addition to the language in the BioShield Act, which sets up a broad framework of controls over the use of the Special Reserve Fund, the internal controls for this purchasing authority are documented in a variety of internal policy and procedure documents and interagency agreements, which provide guidance on roles and responsibilities for how the controls are to be implemented. In response to BioShield Act requirements, HHS also established internal controls for three of the contracting authorities: the increased simplified acquisition threshold and its use with Special Reserve Funds, the increased micropurchase threshold, and the use of personal services contracts. Federal internal control standards state that, among other things, management needs to comprehensively identify risks, analyze them for possible effect, and determine how risks should be managed. Although some of the risk statements in a memo HHS issued identify some risks and one mentions possible negative consequences that could occur without proper controls in place, the risk statements for using the increased micropurchase threshold and increased simplified acquisition procedures lack analysis of specific risks. In particular, the memo does not discuss a key risk associated with using simplified acquisition procedures--namely, that an agency is prohibited from obtaining cost or pricing data for acquisitions at or below the simplified acquisition threshold. Without this data, the agency may not be able to determine if the price of a contract is fair and reasonable. Moreover, not having adequately documented and appropriately communicated risk assessments potentially results in future employees not knowing or understanding the risks or trade-offs involved in using the authorities. With employee turnover, HHS' reliance on the knowledge of current personnel to appropriately implement key controls will not enable future employees to make sound, informed, and consistent decisions.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-09-820, Project Bioshield: HHS Can Improve Agency Internal Controls for Its New Contracting Authorities
This is the accessible text file for GAO report number GAO-09-820
entitled 'Project Bioshield: HHS Can Improve Agency Internal Controls
for Its New Contracting Authorities' which was released on July 21,
2009.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Report to Congressional Committees:
United States Government Accountability Office:
GAO:
July 2009:
Project Bioshield:
HHS Can Improve Agency Internal Controls for Its New Contracting
Authorities:
GAO-09-820:
GAO Highlights:
Highlights of GAO-09-820, a report to congressional committees.
Why GAO Did This Study:
The Project BioShield Act of 2004 (BioShield Act) increased the federal
government‘s ability to procure needed countermeasures to address
threats from chemical, biological, radiological, and nuclear agents.
Under the BioShield Act, the Department of Health and Human Services
(HHS) was provided with new contracting authorities (increased
simplified acquisition and micropurchase thresholds, and expanded
abilities to use procedures other than full and open competition and
personal services contracts) and was authorized to use about $5.6
billion in a Special Reserve Fund to procure countermeasures. Based on
the BioShield Act‘s mandate, GAO reviewed (1) how HHS has used its
purchasing and contracting authorities, and (2) the extent to which HHS
has internal controls in place to manage and help ensure the
appropriate use of its new authorities. To do this work, GAO reviewed
contract files and other HHS documents, including internal control
guidance, which GAO compared with federal statutes and federal internal
control standards.
What GAO Found:
Since 2004, HHS has awarded nine contracts using its Special Reserve
Fund (Fund) purchasing authority under the BioShield Act to procure
countermeasures that address anthrax, botulism, smallpox, and radiation
poisoning. HHS may procure countermeasures that are approved by the
Food and Drug Administration and ones that are unapproved, but are
within 8 years of approval. Of the nine contracts, one was terminated
for convenience and the remaining eight are valued at almost $2
billion. HHS officials told GAO that additional contracts are likely to
be awarded in the near future as the Fund provides funding through
fiscal year 2013. In addition, HHS has used one of its new contracting
authorities, simplified acquisition procedures, although it has not
used this authority since 2005.
HHS has established internal controls on its new purchasing and
contracting authorities. In addition to the language in the BioShield
Act, which sets up a broad framework of controls over the use of the
Special Reserve Fund, the internal controls for this purchasing
authority are documented in a variety of internal policy and procedure
documents and interagency agreements, which provide guidance on roles
and responsibilities for how the controls are to be implemented. In
response to BioShield Act requirements, HHS also established internal
controls for three of the contracting authorities: the increased
simplified acquisition threshold and its use with Special Reserve
Funds, the increased micropurchase threshold, and the use of personal
services contracts. Federal internal control standards state that,
among other things, management needs to comprehensively identify risks,
analyze them for possible effect, and determine how risks should be
managed. Although some of the risk statements in a memo HHS issued
identify some risks and one mentions possible negative consequences
that could occur without proper controls in place, the risk statements
for using the increased micropurchase threshold and increased
simplified acquisition procedures lack analysis of specific risks. In
particular, the memo does not discuss a key risk associated with using
simplified acquisition procedures”namely, that an agency is prohibited
from obtaining cost or pricing data for acquisitions at or below the
simplified acquisition threshold. Without this data, the agency may not
be able to determine if the price of a contract is fair and reasonable.
Moreover, not having adequately documented and appropriately
communicated risk assessments potentially results in future employees
not knowing or understanding the risks or trade-offs involved in using
the authorities. With employee turnover, HHS‘ reliance on the knowledge
of current personnel to appropriately implement key controls will not
enable future employees to make sound, informed, and consistent
decisions.
What GAO Recommends:
GAO recommends that HHS include comprehensive risk assessment
statements in its written guidance on the internal controls for the
BioShield contracting authorities for which the agency was required to
establish controls. HHS agreed with the recommendation and said it
would provide additional guidance.
View [hyperlink, http://www.gao.gov/products/GAO-09-820] or key
components. For more information, contact John Needham, 202-512-4841,
NeedhamJK1@gao.gov.
[End of section]
Contents:
Letter:
Background:
HHS Has Used New Authorities to Procure Countermeasures:
HHS Has Established Internal Controls for Its New Authorities, but
Lacks Adequate Documentation of the Risks of Using the Contracting
Authorities:
Conclusions:
Recommendation for Executive Action:
Agency Comments and Our Evaluation:
Appendix I: Comments from the Department of Health & Human Services:
Appendix II: GAO Contacts and Acknowledgments:
Tables:
Table 1: Contracts Awarded by HHS Using the Special Reserve Fund:
Table 2: Contracts Awarded by HHS Using Simplified Acquisition
Procedures:
Abbreviations:
BARDA: Biomedical Advanced Research and Development Authority:
BioShield Act: Project BioShield Act of 2004:
CBRN: Chemical, biological, radiological, and nuclear agents:
FAR: Federal Acquisition Regulation:
FDA: Food and Drug Administration:
MMFIA: Federal Managers' Financial Integrity Act of 1982:
HHS: Department of Health and Human Services:
HHSAR: HHS Acquisition Regulation:
NIH: National Institutes of Health:
OMB: Office of Management and Budget:
PAHPA: Pandemic and All-Hazards Preparedness Act:
[End of section]
United States Government Accountability Office:
Washington, DC 20548:
July 21, 2009:
Congressional Committees:
Following the attacks using anthrax-laced letters in the United States
in 2001 and other biological attacks, such as the Sarin gas attack in
Japan, some members of Congress were concerned that the United States
was vulnerable to threats from chemical, biological, radiological, and
nuclear (CBRN) agents and did not have sufficient medical
countermeasures to adequately protect the public from such threats or
provide post-exposure treatment. To address this gap in national
defense capability, the Project BioShield Act of 2004 (BioShield Act
[Footnote 1]) provided the Department of Health and Human Services
(HHS) with the ability to accelerate the research, development,
acquisition, and availability of effective countermeasures (such as,
vaccines, pharmaceuticals, and diagnostics) that are necessary to
respond to an attack involving CBRN agents.
The BioShield Act provided HHS with a number of new authorities,
including four new contracting authorities:
* an increased simplified acquisition threshold,
* an increased ability to use procedures other than full and open
competition,
* an increased micropurchase threshold, and:
* the ability to use personal services contracts.[Footnote 2]
HHS was also authorized to use funds from a Special Reserve Fund to
procure countermeasures to be added to the inventory of medical
supplies and countermeasures currently stored in the Strategic National
Stockpile.[Footnote 3] At the time of its establishment, the Fund
provided HHS about $5.6 billion to use over a 10-year period (fiscal
years 2004 to 2013), with a spending cap of $3.4 billion during fiscal
years 2004 to 2008.[Footnote 4] This purchasing authority expanded the
types of medical countermeasures that HHS could obtain to address
threats from CBRN agents to include not only those that are approved by
the Food and Drug Administration (FDA),[Footnote 5] but also those that
are determined to be within 8 years of approval or which have been
authorized for use under an emergency use authorization.[Footnote 6]
Prior to the BioShield Act, HHS officials told us that the agency was,
in general, only able to purchase medical countermeasures that were FDA
approved.
Based on the GAO reporting requirements in the BioShield Act, this
report examines: (1) how HHS has used its BioShield Act purchasing and
contracting authorities to procure medical countermeasures, and (2) the
extent to which HHS has designed internal controls to manage and help
ensure the appropriate use of its BioShield contracting and purchasing
authorities.[Footnote 7]
To review HHS's use of the BioShield contracting and purchasing
authorities, we reviewed legislation and HHS documentation, including
annual reports to the Congress on BioShield and contract files. In
reviewing contract files, we relied on HHS annual reports to the
Congress and statements from officials to identify the contracts
awarded by HHS using the BioShield contracting authorities. We also met
with HHS officials responsible for managing procurement under the
BioShield Act. To assess the internal controls related to the
contracting and purchasing authorities, we reviewed HHS regulations,
policies, and other forms of written guidance and met with HHS
officials responsible for internal controls. We also compared HHS's
internal controls with the Act's requirements and other federal
internal control requirements and standards. Because HHS established
controls for its new contracting authorities after it awarded contracts
using one of those authorities, and it has not used the contracting
authorities since that time, we limited our review of the controls to
their design.
We conducted this performance audit from February 2009 to July 2009 in
accordance with generally accepted government auditing standards. Those
standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our
findings and conclusions based on our audit objectives. We believe that
the evidence obtained provides a reasonable basis for our findings and
conclusions based on our audit objectives.
Background:
HHS' ability to use the Special Reserve Fund for the procurement of
countermeasures is predicated on a six-step process involving
coordination with DHS and approval by the Director of the Office of
Management and Budget (OMB).[Footnote 8] As provided in the BioShield
Act, the process requires:
1. the DHS Secretary, in consultation with the HHS Secretary and the
heads of other agencies as appropriate, to determine that a material
threat exists and issue a "material threat determination;"
2. the HHS Secretary to determine countermeasures that are necessary to
protect the public health;
3. the HHS Secretary to determine that a particular countermeasure is
appropriate for procurement for the Strategic National Stockpile using
the Special Reserve Fund and the quantities to be procured;[Footnote 9]
4. the DHS and HHS Secretaries to jointly recommend to the Director of
OMB that the Special Reserve Fund should be used for the designated
countermeasure acquisitions;
5. the director of OMB to approve the use of the Special Reserve Fund;
and:
6. both Secretaries to notify designated congressional committees of
the procurement.
The BioShield Act also provides HHS the ability to use four new
contracting authorities for the acquisition of countermeasures. In
general, these authorities expanded upon existing provisions in the
Federal Acquisition Regulation (FAR). The four authorities are:
* Simplified acquisition procedures which, in general, increased HHS
contract threshold amounts from $100,000 to $25 million.[Footnote 10]
However, the BioShield Act does not place a threshold limit on
countermeasures that are procured using the Special Reserve Fund if the
HHS Secretary determines there is a pressing need for the specific
countermeasure.
* Procedures other than full and open competition can be used to award
contracts when the requirement is only available from one responsible
source or a limited number of responsible sources. In addition, in
order to conduct procurements on a basis other than full and open
competition using simplified acquisition procedures, the HHS Secretary
must determine that the mission of the BioShield Program under the Act
would be seriously impaired without such a limitation.
* Increased micropurchase threshold from $2,500 to $15,000.[Footnote
11]
* Personal services contracts may be used for experts or consultants
who have scientific or other professional qualifications when the HHS
Secretary determines such contracts are necessary to respond to
pressing countermeasure research and development needs.
In 2006, the Pandemic and All-Hazards Preparedness Act[Footnote 12]
(PAHPA), among other things, established the Biomedical Advanced
Research and Development Authority (BARDA), within HHS, to provide a
coordinated, systematic approach to the development and purchases of
countermeasures, including vaccines, drugs, therapies, and diagnostic
tools. Later, in 2009, Congress transferred the following amounts from
the Special Reserve Fund to HHS accounts: $275 million to be used for
the advanced research and development of countermeasures and $137
million for influenza pandemic preparation.[Footnote 13]
HHS Has Used New Authorities to Procure Countermeasures:
HHS has used its Special Reserve Fund (purchasing) authority and one of
its contracting authorities to procure countermeasures for the
Strategic National Stockpile. Since 2004, HHS awarded nine contracts
using Special Reserve Fund monies to procure various countermeasures,
such as anthrax and botulism antitoxins, vaccines for anthrax and
smallpox, and post-exposure treatments for radiation poisoning in
children and adults. Of the nine contracts awarded using monies from
the Fund, HHS terminated one contract, in 2006, because the contractor
was unable to meet a major contractual milestone. To date, the
remaining eight contracts are valued at almost $2 billion. See table 1.
In addition, HHS officials told us there are currently two requests for
proposal solicitations for an anthrax vaccine and a smallpox
therapeutic.
Table 1: Contracts Awarded by HHS Using the Special Reserve Fund:
Countermeasure: Anthrax therapeutics (antitoxins): Raxibacumab;
Company awarded contract: Human Genome Sciences;
Date of contract award: September 2005;
Date of contract completion: September 2010;
Total doses: 20,000;
Maximum persons treatable: 20,000;
Total contract price[A]: $176,211,724[B].
Countermeasure: Anthrax therapeutics (antitoxins): Anthrax immune
globulin;
Company awarded contract: Cangene Corporation;
Date of contract award: September 2005;
Date of contract completion: September 2011;
Total doses: 10,000;
Maximum persons treatable: 10,000;
Total contract price[A]: $144,256,599[C].
Countermeasure: Anthrax Vaccines: AVA anthrax vaccine;
Company awarded contract: BioPort/Emergent BioDefense Operations
Lansing, Inc;
Date of contract award: May 2005;
Date of contract completion: September 2007;
Total doses: 10,000,000;
Maximum persons treatable: 3,333,000;
Total contract price[A]: $242,737,000.
Countermeasure: Anthrax Vaccines: AVA anthrax vaccine;
Company awarded contract: Emergent BioDefense Operations Lansing, Inc;
Date of contract award: September 2007;
Date of contract completion: September 2010;
Total doses: 18,750,000;
Maximum persons treatable: 6,250,000;
Total contract price[A]: $447,650,001.
Countermeasure: Anthrax Vaccines: Recombinant protective antigen;
Company awarded contract: VaxGen;
Date of contract award: November 2004;
Date of contract completion: Contract Terminated December 2006;
Total doses: N/A;
Maximum persons treatable: N/A;
Total contract price[A]: $1,534,253[D].
Countermeasure: Botulism therapeutic: Heptavalent botulinum antitoxin;
Company awarded contract: Cangene Corporation;
Date of contract award: September 2006;
Date of contract completion: May 2011;
Total doses: 200,000;
Maximum persons treatable: 200,000;
Total contract price[A]: $366,384,724.
Countermeasure: Smallpox vaccines: MVA smallpox vaccine;
Company awarded contract: Bavarian Nordic A/S;
Date of contract award: June 2007;
Date of contract completion: June 2012;
Total doses: 20,000,000;
Maximum persons treatable: 10,000,000;
Total contract price[A]: $504,765,464.
Countermeasure: Radiological/Nuclear: Liquid potassium iodide;
Company awarded contract: Fleming and Company Pharmaceuticals;
Date of contract award: March 2005;
Date of contract completion: March 2010;
Total doses: 4,800,000;
Maximum persons treatable: 144,000,000;
Total contract price[A]: $17,629,003.
Countermeasure: Radiological/Nuclear: IV Calcium (Ca) DTPA; IV Zinc
(Zn) DTPA;
Company awarded contract: Akorn, Inc;
Date of contract award: December 2005;
Date of contract completion: December 2015;
Total doses: Ca DTPA = 394,350; Zn DTPA = 79,460;
Maximum persons treatable: Ca DTPA = 394,350; Zn DTPA = 79,460;
Total contract price[A]: $21,962,448.
Countermeasure: Total;
Total contract price[A]: $1,923,131,216.
Source: GAO analysis of HHS contracts and other documents.
[A] Unless otherwise noted, the contract price includes all options and
modifications to the price of the contract.
[B] This figure contains $1,797,372 in funds that did not come from the
Special Reserve Fund.
[C] This figure contains $422,880 in funds that did not come from the
Special Reserve Fund.
[D] This figure is less than the original awarded contract price and is
the total amount of money HHS paid to the contractor on the terminated
contract.
[End of table]
Of the four contracting authorities provided under the BioShield Act,
HHS has only used the simplified acquisition procedure authority. From
2004 through 2005, HHS's National Institutes of Health (NIH) used this
authority to award five other contracts, including ones for research to
develop a botulism antitoxin and improved treatments for radiation
poisoning. Awarded with NIH funding, these contracts have a total value
of almost $30 million when options and other later modifications are
included. See table 2.
Table 2: Contracts Awarded by HHS Using Simplified Acquisition
Procedures:
Countermeasure: Antitoxin for botulinum neurotoxin;
Company awarded contract: XOMA (US) LLC;
Date of contract award: March 2005;
Date of completed delivery: September 2006;
Total contract price[A]: $15,000,000.
Countermeasure: Antitoxin for botulinum neurotoxin;
Company awarded contract: DynPort Vaccine Company, LLC;
Date of contract award: May 2005;
Date of completed delivery: March 2008;
Total contract price[A]: $3,026,999.
Countermeasure: Improved DTPA for radionuclide chelation;
Company awarded contract: University of Kentucky;
Date of contract award: September 2005;
Date of completed delivery: September 2009;
Total contract price[A]: $5,160,995.
Countermeasure: Improved DTPA for radionuclide chelation;
Company awarded contract: Nanotherapeutics, Inc.;
Date of contract award: September 2005;
Date of completed delivery: September 2009;
Total contract price[A]: $3,044,549.
Countermeasure: Improved DTPA for radionuclide chelation;
Company awarded contract: SRI International;
Date of contract award: September 2005;
Date of completed delivery: September 2009;
Total contract price[A]: $3,714,882.
Total price of contracts: $29,947,425.
Source: GAO analysis of HHS contracts and other documents.
[A] The contract price includes all options and modifications to the
price of the contract.
[End of table]
HHS officials told us that they have not used this authority since
2005. HHS officials also told us that no other BioShield contracting
authorities have been used to date, although the officials noted that
these authorities may be needed for use in the future.
HHS Has Established Internal Controls for Its New Authorities, but
Lacks Adequate Documentation of the Risks of Using the Contracting
Authorities:
In response to BioShield requirements, HHS has established internal
controls on its Special Reserve Fund (purchasing) and contracting
authorities, but lacks adequate documentation of the risks of using the
new contracting authorities.[Footnote 14] Language in the BioShield Act
sets up a broad framework of controls over the procurement of
countermeasures, including those with Special Reserve Funds, by
requiring HHS to coordinate with DHS and obtain approval by OMB before
the Fund may be used. In addition to the language in the Act, HHS
officials told us that the internal controls for procuring
countermeasures using the Fund are documented in a variety of internal
policy and procedure documents and interagency agreements, which
provide guidance on roles and responsibilities for how the controls are
to be implemented. These documents include:
* an HHS policy document that establishes an enterprise governance
board to oversee requirements and priority-setting regarding emergency
medical countermeasures for the civilian population. The document also
outlines the authorities, organizational structure, and guidelines for
the board;
* an HHS budget execution document that delineates responsibilities and
describes the processes for requesting contract actions, purchases, and
interagency agreements;
* a BARDA standard operating procedure document that provides
contracting and other BARDA officials with guidance on source selection
procedures and outlines specific responsibilities in carrying out those
procedures;
* a BARDA acquisition plan which details the pre-and post-award
approval processes for procurements using the Fund;
* an interagency agreement between HHS and DHS dated September 25,
2006, that outlines the terms and conditions for when the Fund can be
used; and:
* an OMB Circular on transferring budget authority from one agency to
another.[Footnote 15]
HHS has also established internal controls for the contracting
authorities that were specified in the BioShield Act. On October 18,
2005,[Footnote 16] HHS issued a memorandum that provided guidance on
the use of the following contracting authorities:
* the increased simplified acquisition threshold and its use with the
Special Reserve Fund,
* the increased micropurchase threshold, and:
* the use of personal services contracts.[Footnote 17]
HHS's memo is structured around the five elements of internal control:
the control environment, risk assessment, control activities,
information and communications, and monitoring.[Footnote 18] Federal
internal control standards state that management needs to
comprehensively identify risks, analyze them for possible effect, and
determine how risks should be managed. Federal internal control
standards also state that controls need to be clearly documented,
readily available for examination, and distributed in a form and time
frame that permits people to perform their duties efficiently.
Risk assessment statements we reviewed in the memo are generally not
assessments of the risks involved in using particular authorities. Some
of the risk statements identify some risks and one mentions possible
negative consequences that could occur without proper controls in
place, but the statements lack an analysis of those risks. For example,
the risk assessment statement for using the increased micropurchase
threshold states that "control procedures are necessary to prevent
noncompliance with specific requirements of the Act, including
exceeding statutory limitation on number of contracts and selections
based on improper criteria." And, the risk assessment statement on
increased simplified acquisition procedures does not mention or assess
risk. It simply states that "control procedures are necessary to
prevent noncompliance with specific requirements of the Act." In
particular, the risk statement on simplified acquisition procedures in
the memo does not discuss a key risk associated with using simplified
acquisition procedures--namely, that an agency is prohibited from
obtaining cost or pricing data for acquisitions at or below the
simplified acquisition threshold. [Footnote 19]
According to a senior BARDA procurement official, while using
simplified acquisition procedures can expedite the procurement process,
the agency will not have cost and pricing data, which may be needed to
determine that the price of a contract--especially those valued in the
tens of millions or hundreds of millions--is fair and reasonable. In a
subsequent meeting, he stated that he is aware of these trade-offs
based on his own experience and knowledge of the FAR. He also confirmed
that an explanation assessing the trade-offs and risks involved when
using the new contracting authorities is not contained in other HHS
documents. Instead, this official acknowledged that HHS's written
guidance on the controls for the contracting authorities does not
document known risks and trade-offs of using the authorities. As a
result, implementation of these controls depends on the experience and
knowledge of current personnel. Moreover, the consistent application of
these controls is not likely to be sustained over time as employees
leave their positions and new ones take their place. Not having
adequately documented and appropriately communicated risk assessments,
which institutionalize agency policies, may potentially result in
future employees not knowing or understanding the risks or tradeoffs
involved in using the various contracting authorities.
Conclusions:
Since the enactment of the BioShield Act in 2004, HHS has awarded
almost $2 billion in contracts to either procure medical
countermeasures or to facilitate their development. Although HHS has
established internal controls for its new purchasing and contracting
authorities, the risk assessment statements related to the agency's
internal controls for the contracting authorities are not sufficiently
specific. In particular, the failure to mention and lack of analysis of
specific risks in the risk statements associated with using the
increased micropurchase threshold and increased simplified acquisition
procedures is not consistent with requirements under federal internal
control standards.
With employee turnover, the lack of adequately documented risk
assessment statements could create a situation in which employees do
not know the risks or trade-offs involved in using the various
authorities. The effectiveness of the internal controls now in place is
dependent on the knowledge of individuals currently working at the
agency. Without appropriately documented risk assessments that
institutionalize agency policies, HHS will be unable to ensure that
sound, informed, and consistent decisions will be made in the face of
employee turnover.
Recommendation for Executive Action:
We recommend that the Secretary of Health and Human Services include
comprehensive risk assessment statements in written guidance on the
internal controls for the BioShield contracting authorities for which
the agency was required to establish controls.
Agency Comments and Our Evaluation:
HHS provided us with written comments on a draft of this report. The
comments appear in appendix I.
HHS agreed with our recommendation and said that it will revise its
internal control guidance on risk assessments for using BioShield
contracting authorities. We believe that this is a positive step toward
helping ensure that sound, informed, and consistent risk assessments
will be made in BioShield acquisitions. HHS also provided observations
on the Special Reserve Fund and risk assessments, which appear in
appendix I.
We are sending copies of this report to the Secretary of Health and
Human Services. The report is also available at no charge on the GAO
Web site at [hyperlink, http://www.gao.gov].
If you or your staff have any questions about this report, please
contact me at (202) 512-4841 or NeedhamJK1@gao.gov. Contact points for
our Offices of Congressional Relations and Public Affairs may be found
on the last page of this report. GAO staff who made major contributions
to this report are listed in appendix II.
Signed by:
John K. Needham:
Director, Acquisition and Sourcing Management:
List of Congressional Committees:
The Honorable Edward M. Kennedy:
Chairman:
The Honorable Michael B. Enzi:
Ranking Member:
Committee on Health, Education, Labor, and Pensions:
United States Senate:
The Honorable Joseph I. Lieberman:
Chairman:
The Honorable Susan M. Collins:
Ranking Member:
Committee on Homeland Security and Governmental Affairs:
United States Senate:
The Honorable Robert C. Byrd:
Chairman:
The Honorable George V. Voinovich:
Ranking Member:
Subcommittee on Homeland Security:
Committee on Appropriations:
United States Senate:
The Honorable Tom Harkin:
Chairman:
The Honorable Thad Cochran:
Ranking Member:
Subcommittee on Labor, Health and Human Services, Education, and
Related Agencies:
Committee on Appropriations:
United States Senate:
The Honorable Henry A. Waxman:
Chairman:
The Honorable Joe Barton:
Ranking Member:
Committee on Energy and Commerce:
House of Representatives:
The Honorable Bennie G. Thompson:
Chairman:
The Honorable Peter T. King:
Ranking Member:
Committee on Homeland Security:
House of Representatives:
The Honorable Edolphus Towns:
Chairman:
The Honorable Darrell Issa:
Ranking Member:
Committee on Oversight and Government Reform:
House of Representatives:
The Honorable David E. Price:
Chairman:
The Honorable Harold Rogers:
Ranking Member:
Subcommittee on Homeland Security:
Committee on Appropriations:
House of Representatives:
The Honorable David R. Obey:
Chairman:
The Honorable Todd Tiahrt:
Ranking Member:
Subcommittee on Labor, Health and Human Services, Education, and
Related Agencies:
Committee on Appropriations:
House of Representatives:
[End of section]
Appendix I: Comments from the Department of Health & Human Services:
Department Of Health At Human Services:
Office Of The Secretary:
Assistant Secretary for Legislation:
Washington, DC 20201:
July 14, 2009:
John K. Needham:
Director, Acquisition and Sourcing Management:
U.S. Government Accountability Office:
441 G Street, NW:
Washington, DC 20548:
Dear Mr. Needham:
Enclosed are the Department's comments on the U.S. Government
Accountability Office's draft report entitled, "Project BioShield: HHS
Can Improve Agency Internal Controls for Its New Contracting
Authorities" (GAO-09-820).
The Department appreciates the opportunity to review and comment on
this draft report before its publication.
Sincerely,
Signed by:
Barbara Pisaro Clark:
Acting Assistant Secretary for Legislation:
Enclosure:
[End of letter]
General Comments Of The Department Of Health And Human Services (HHS)
On The Government Accountability Office's (GAO) Draft Report Entitled:
Project Bioshield: HHS Can Improve Agency Internal Controls For Its New
Contracting Authorities (GAO 09-820):
HHS agrees with the recommendation and will revise the internal
controls dated October 18, 2005, to provide more guidance on risk
assessments for using BioShield contracting authorities.
Additional Comments:
GAO says (page 5) that HHS used "Special Reserve Fund monies to procure
various countermeasures, such as anthrax and botulism antitoxins,
vaccines for anthrax and smallpox, and post-exposure treatments for
radiation poisoning in children and adults." We note that the fund
authorized under the Project BioShield Act of 2004 made possible the
variety of medical countermeasures and quantity of doses procured by
HHS during the first five years of the ten-year authorization period.
Page 10 discusses the assessment of trade-offs and risks of using
simplified acquisition procedures, one of the BioShield contracting
authorities. The example given of a risk is the prohibition on
obtaining cost or pricing data that a contracting officer may need for
determining whether or not the proposed price of a multi-million dollar
contract is fair and reasonable. The concern about this risk is held
more widely in BARDA than solely being the opinion of the individual
interviewed.
[End of section]
Appendix II: GAO Contacts and Acknowledgments:
GAO Contact:
John K. Needham, (202) 512-4841 or NeedhamJK1@gao.gov:
Acknowledgments:
In addition to the contact named above, Carol Dawn Petersen, Assistant
Director; Angela D. Thomas, Kelly Bradley, Robert S. Swierczek, Marie
P. Ahearn, and Kenneth E. Patton made key contributions to this report.
[End of section]
Footnotes:
[1] Pub. L. No. 108-276 (2004).
[2] Under the BioShield Act, HHS is authorized to obtain by contract
personal services without the limitations on period of service and pay
within 5 U.S.C. § 3109.
[3] The Strategic National Stockpile is the federal supply of
pharmaceuticals, vaccines, medical supplies, equipment, and other items
meant to provide for the emergency health security of the United
States, including the emergency health security of children and other
vulnerable populations, in the event of a bioterrorist attack or other
public health emergency. 42 U.S.C. § 247d-6b.
[4] Funding for the Special Reserve Fund was appropriated in the
Department of Homeland Security Appropriations Act, 2004 (Pub. L. No.
108-90 (2003)).
[5] According to HHS, to be administered to the public, the FDA must
approve a drug, license a biological product (such as a vaccine), or
clear a medical product (including diagnostics). For purposes of this
report, we will use the term approved to cover approved, licensed, or
cleared products.
[6] The BioShield Act also established an emergency use authorization
that allows the emergency use of countermeasures that are unapproved by
the FDA, or those that are approved but not for the intended use,
following a declaration by the Secretary of HHS of an emergency
justifying authorization for a product on the basis of a determination
(by the Secretary of DOD, DHS, or HHS) of an emergency or a significant
potential for an emergency.
[7] Based on additional reporting requirements in the BioShield Act, we
will also review other issues related to the Act. These issues will be
covered in a separate GAO product.
[8] The BioShield Act required recommendation to the President (by the
Secretaries of HHS and Homeland Security, in coordination with the
Director of OMB) that the Special Reserve Fund be made available for
procurement of a countermeasure and Presidential approval of the
recommendation. The President delegated these functions (recommendation
and approval of recommendation) to the Director of OMB. Presidential
Memorandum, 69 Fed. Reg. 70,349 (Oct. 21, 2004), reprinted in 42 U.S.C.
§ 247d-6b (2006).
[9] In determining if a particular countermeasure is appropriate for
procurement using the Special Reserve Fund, the HHS Secretary must also
consider the "feasibility of production and delivery within 8 years of
sufficient quantities—[and] whether there is a lack of a significant
commercial market for the product at the time of procurement..."
[10] The use of simplified acquisition procedures allows an agency to
acquire goods and services using more streamlined approaches than
ordinarily would be required. For example, under simplified acquisition
procedures, an agency would be required to promote competition to the
maximum extent practicable, although it would not be required to use
full and open competition. Additionally, an agency could use an oral
solicitation to seek competitive price quotations and would not have to
follow the more formal evaluation procedures applicable to acquisitions
above the threshold. See, FAR §§ 13.000, 13.104, 13.106-1, and 13.106-
2(b).
[11] Purchases that do not exceed the micropurchase threshold may be
made without seeking competitive price quotations if the contracting
officer considers the price to be reasonable. See FAR §13.202(a)(2).
[12] Pub. L. No. 109-417 (2006).
[13] Omnibus Appropriations Act, 2009, Pub. L. No. 111-8 (2009).
[14] In addition to existing requirements for HHS to establish
effective internal controls, the BioShield Act required the Secretary
to establish certain additional internal controls over the use of its
BioShield purchasing and contracting authorities. For information on
requirements apart from the BioShield Act, see 31 U.S.C. § 3512(c) and
(d), commonly known as the Federal Managers' Financial Integrity Act of
1982 (FMFIA). FMFIA was repealed as part of the general revisions to
title 31 U.S. Code. However, the key provisions of FMFIA were codified
at 31 U.S.C. § 3512(c) and (d).
[15] See OMB Circular No. A-136, Section II.4.2.5.
[16] The HHS memo was issued after HHS used its increased simplified
acquisition threshold to award the five contracts discussed previously.
[17] Although the BioShield Act did not direct HHS to establish
internal controls for using procedures other than full and open
competition, agency officials told us the internal controls on this
authority are in the Federal Acquisition Regulation (subpart 6.3) and
in the HHS Acquisition Regulation (HHSAR). See HHSAR §§ 306.302 through
306.304 on circumstances permitting other than full and open
competition.
[18] See GAO, Standards for Internal Control in the Federal Government,
[hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]
(Washington, D.C.: November 1999).
[19] FAR 15.403-1(a) prohibits obtaining cost or pricing data for
acquisitions at or below the simplified acquisition threshold.
[End of section]
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
weekday, GAO posts newly released reports, testimony, and
correspondence on its Web site. To have GAO e-mail you a list of newly
posted products every afternoon, go to [hyperlink, http://www.gao.gov]
and select "E-mail Updates."
Order by Phone:
The price of each GAO publication reflects GAO‘s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO‘s Web site,
[hyperlink, http://www.gao.gov/ordering.htm].
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional
information.
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Ralph Dawn, Managing Director, dawnr@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, D.C. 20548:
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548:
