This is the accessible text file for GAO report number GAO-13-857T entitled '2020 Census: Progress Report on the Census Bureau's Efforts to Contain Enumeration Costs' which was released on September 11, 2013. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. United States Government Accountability Office: GAO: Testimony: Before the Subcommittee on Federal Workforce, U.S. Postal Service, and the Census, Committee on Oversight and Government Reform, House of Representatives: For Release on Delivery: Expected at 9:30 a.m. EDT: Wednesday, September 11, 2013: 2020 Census: Progress Report on the Census Bureau's Efforts to Contain Enumeration Costs: Statement of Robert Goldenkoff: Director, Strategic Issues: Carol R. Cha, Director: Information Technology Acquisition Management Issues: GAO-13-857T: GAO Highlights: Highlights of GAO-13-857T, a testimony before the Subcommittee on Federal Workforce, U.S. Postal Service and the Census, Committee on Oversight and Government Reform, House of Representatives. Why GAO Did This Study: the costliest in U.S. history. Thus, over the next few years, the fundamental challenge facing Bureau leadership will be designing and implementing a census that controls the cost of the enumeration while maintaining its accuracy. This testimony focuses on progress the Bureau is making in three areas key to a more cost-effective enumeration: (1) transforming the Bureau into a higher-performing organization; (2) improving the cost- effectiveness of census-taking operations; and (3) strengthening IT management and security practices. This testimony is based on completed work that included an analysis of Bureau documents, interviews with Bureau officials, and field observations of census operations in urban and rural locations across the country. What GAO Found: In preparing for the 2020 Census, the U.S. Census Bureau (Bureau) has launched several initiatives aimed at organizational transformation, some of which show particular promise. For example, the Bureau is attempting to develop Bureau-wide, or “enterprise,” standards, guidance, or tools in areas such as risk management and information technology (IT) investment management to reduce duplicative efforts across the Bureau. Although the Bureau has made progress in these and other areas, if the Bureau is to transform itself to better control costs and deliver an accurate national headcount in 2020, several areas will require continued oversight: cost estimation, integrated long-term planning, and stakeholder involvement. For example, while the Bureau has made progress with long-term planning by implementing some elements of GAO’s recommendation that it develop a road map for 2020 planning, it still needs to pull together remaining planning elements, such as milestones for decisions and estimates of cost, into its roadmap. The Bureau is researching several key operational initiatives that may yield significant cost savings. However, while these initiatives have the potential to reduce costs, the Bureau will be employing them in ways that are new for 2020 and thus entail some operational risk. Key among these are using the Internet as a self-response option, targeting only certain addresses for field verification as the Bureau builds its national list of addresses, and replacing enumerator- collected data with administrative records under certain circumstances. Bureau tests conducted in 2011 showed that adding an Internet response option to the census could increase its overall response rate, which could save money, since Bureau field staff would need to visit fewer households, which is its largest and most costly census field operation. In addition, the Bureau has estimated that it could save up to $2 billion if it uses administrative records in 2020 to reduce the need for related costly and labor-intensive door-to-door visits by Bureau employees. Additionally, the Bureau is exploring technology options for census operations that collectively represent a dramatic leap from 2010. These options include the possible use of a “bring your own device” model to enable enumerators to use their own mobile devices for field data collection. Given the role of information technology in conducting the census, while controlling cost and protecting privacy, it is essential that the Bureau strengthen its ability to manage these investments, as well as its practices for securing the information it collects and disseminates. The Bureau faces several long-standing IT challenges that, if effectively addressed, will significantly enhance its ability to acquire these solutions within cost, schedule, and performance targets. For example, effective workforce planning is essential to ensuring organizations have the proper skills, abilities, and capacity for effective IT management; however, the Bureau has not yet finalized its IT workforce plans. Additionally, in January 2013, GAO reported that controls over access to the Bureau’s IT systems contained deficiencies. Without adequate system access controls, the Bureau cannot be sure that its information and systems are protected from intrusion. What GAO Recommends: GAO is not making new recommendations in this testimony but reports on the status of past recommendations that the Bureau strengthen its IT management, develop policies and procedures for its cost estimates, and integrate its 2020 Census planning. The Bureau generally agreed with GAO’s findings and recommendations and is taking steps to implement them. View [hyperlink, http://www.gao.gov/products/GAO-13-857T]. For more information, contact Robert Goldenkoff, 202-512-2757, goldenkoffr@gao.gov or Carol R. Cha at 202-512-4456 or chac@gao.gov. [End of section] Chairman Farenthold, Ranking Member Lynch, and Members of the Subcommittee: We are pleased to participate in today's hearing to discuss the U.S. Census Bureau's (Bureau) preparations for the next enumeration. Although Census Day 2020 is still more than 6 years away, research and testing activities for the decennial have been progressing for some time, and the Bureau will be making key design decisions in 2014 and 2015. Our reviews of the 1990, 2000, and 2010 enumerations underscore the importance of early planning and strong and continuing congressional oversight to reduce the costs and risks of the national headcount as well as to keep the entire enterprise on track. At $13 billion, 2010's headcount was the costliest in U.S. history. Thus, over the next few years, the fundamental challenge facing Bureau leadership will be designing and implementing a census that simultaneously controls the cost of the enumeration while maintaining its accuracy. The basic design of the enumeration--mail out and mail back of the census questionnaire with in-person follow-up for nonrespondents--has been in use since 1970. A key lesson learned from 2010 and earlier enumerations is that this design is no longer capable of cost- effectively counting a population that is growing steadily larger, more diverse, increasingly difficult to find, and reluctant to participate in the census. The Bureau is well aware that reforms are needed, and plans to significantly change the methods and technologies it uses to enumerate the population. However, the Bureau has never before employed many of these methods at the scale being considered for 2020, if at all, which adds a large degree of risk. Moreover, the Bureau's past efforts to implement new approaches and systems have not always gone well. As one example, during the 2010 Census the Bureau planned to use handheld mobile devices to support field data collection for the census, including following up with nonrespondents. However, due to significant problems identified during testing of the devices, cost overruns, and schedule slippages, the Bureau decided not to use the handheld devices for non-response follow-up and reverted to paper-based processing, which increased the cost of the 2010 Census by up to $3 billion and significantly added to its risk as it had to switch its operations to paper-based operations as its backup. As the Bureau launched its preparations for 2020 earlier this decade, we noted that controlling census costs while maintaining accuracy hinged on the Bureau addressing challenges in three key areas: (1) transforming the Bureau into a high-performing organization; (2) improving the cost-effectiveness of census-taking operations; and (3) strengthening information technology (IT) management and security practices. With this as backdrop, our remarks this morning will focus on the Bureau's plans for 2020, paying particular attention to the status of cost-containment initiatives within each of these three areas. In particular we will discuss where the Bureau has made progress, and management challenges and open questions that the Bureau will need to resolve going forward. In summary, we found that the Bureau is progressing along a number of fronts to secure a more cost-effective enumeration. For example, the Bureau's organizational transformation efforts, which includes efforts to improve its workforce in order to help the Bureau become more results oriented. At the same time, innovative enumeration methods such as the use of administrative records to assist with enumerating people, use of the Internet to collect data, and targeted address canvassing might help to control costs, but a number of operational uncertainties remain, such as ensuring privacy and information security with some of the new approaches. Likewise, the Bureau's ability to effectively and efficiently acquire the technological solutions supporting 2020 will be largely dependent on having established, mature IT management controls, an area of long-standing concern to us. The information in our testimony is based on our previous reports on the 2010 Census, as well as the Bureau's planning efforts for 2020. [Footnote 1] For this work, among other things we analyzed key documents such as budgets, plans, procedures, and guidance for selected activities; and interviewed cognizant Bureau officials at headquarters and local census offices. In addition, for the work on the 2010 Census, we made on-site observations of key enumeration activities across the country including both urban and less populated areas. To obtain information on various management and organizational reforms that could help the Bureau become more accountable and results oriented, we reviewed our prior work on government-wide reexamination, as well as leading practices and attributes in the areas of IT management, organizational performance, collaboration, stewardship, and human capital.[Footnote 2] More detail on our scope and methodology is provided in each published report that this testimony is based on. We provided the Bureau with a summary of the information included in this statement, and Bureau officials provided technical comments, which we included as appropriate. We conducted the work that this testimony is based on in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Background: The decennial census is mandated by the U.S. Constitution and provides data that are vital to the nation. This information is used to apportion the seats of the U.S. House of Representatives; realign the boundaries of the legislative districts of each state; allocate billions of dollars in federal financial assistance; and provide social, demographic, and economic profiles of the nation's people to guide policy decisions at each level of government. Although the complexity, cost, and importance of the census necessitate robust planning, recent enumerations were not planned well. Our prior work has found shortcomings with managing, planning, and implementing IT solutions in the 2000 and 2010 enumerations that led to acquisition problems, cost overruns, and other issues. As a result, we placed both enumerations on our list of high-risk programs. [Footnote 3] For example, leading up to the 2010 Census, we found that the lack of skilled cost estimators for the 2010 Census led to unreliable life-cycle cost estimates, and some key operations were not tested under census-like conditions. As shown in figure 1, the cost of enumerating each housing unit has escalated from around $16 in 1970 to around $98 in 2010, in constant 2010 dollars (an increase of over 500 percent). At the same time, the mail response rate--a key indicator of a cost-effective enumeration-- has declined from 78 percent in 1970 to 63 percent in 2010. In many ways, the Bureau has had to invest substantially more resources each decade just to try and match the results of prior enumerations. Figure 1: The Average Cost of Counting Each Housing Unit (in Constant 2010 Dollars) Has Escalated Each Decade while Mail Response Rates Have Declined: [Refer to PDF for image: combined vertical bar and line graph] Year: 1970; Average cost per housing unit: $16; Mail response rate: 78%. Year: 1980; Average cost per housing unit: $30; Mail response rate: 75%. Year: 1990; Average cost per housing unit: $39; Mail response rate: 66%. Year: 2000; Average cost per housing unit: $70; Mail response rate: 66%. Year: 2010; Average cost per housing unit: $98; Mail response rate: 63%. Source: GAO analysis of Census Bureau data. Note: In the 2010 Census the Bureau used only a short-form questionnaire. For this statement, we use the 1990 and 2000 Census short-form mail response rate when comparing 1990, 2000, and 2010 mail- back response rates. Census short-form mail response rates are unavailable for 1970 and 1980, so we use the overall response rate. [End of figure] Beginning in 1990, we reported that rising costs, difficulties in securing public participation, and other long-standing challenges required a revised census methodology--a view that was shared by other stakeholders.[Footnote 4] Since then, we and other organizations-- including the Bureau itself--have stated that fundamental changes to the design, implementation, and management of the census must be made in order to address operational and organizational challenges. [Footnote 5] In response, the Bureau has stated that containing costs and maintaining quality will require bold innovations in the planning and design of the 2020 Census. The Bureau has also stated its goal is to conduct the 2020 Census at a lower cost per housing unit than the approximately $98 per housing unit cost of the 2010 Census (in constant 2010 dollars) while still maintaining high quality. The Bureau's Plans for Controlling Enumeration Costs Show Promise, but Key Challenges Need to Be Addressed: Transforming the Bureau into a High-Performing Organization: The Bureau's experience with the 2010 and prior enumerations has shown that lack of proper planning and not following leading practices in key management areas can increase the costs and risks of later downstream operations. For example, in a self-assessment in October 2008, the Bureau found that its organizational structure made overseeing a large program difficult and hampered accountability, succession planning, and staff development. Moreover, leading up to the 2010 Census, we reported that internal organizational, planning, funding, and human capital challenges jeopardized the Bureau's overall readiness. In preparing for 2020, the Bureau has launched several initiatives aimed at organizational transformation, some of which show particular promise if successfully implemented. * Organizational restructuring. The Bureau's organizational transformation took a significant step forward in July 2011 when it created a 2020 Census Directorate that included the office responsible for the American Community Survey, supporting the Bureau's objective to rely on that nation-wide survey as a "test bed" for cost saving innovations for the 2020 Census. The Bureau is undertaking an organizational transformation of its entire decennial directorate in order to improve collaboration and communication across its divisions, improve operational efficiencies, and instill a culture that, according to the Bureau, encourages risk-taking and innovation without fear of reprisal. The Bureau believes such change is necessary so that it can more effectively control costs and enumerate the population for 2020. * Enterprise solutions. The Bureau is attempting to develop Bureau- wide, or "enterprise," standards, guidance, or tools in areas such as risk management, project management, systems engineering, and IT investment management in order to reduce duplicative efforts across the Bureau. * Better workforce planning. As the Bureau reexamines how it will plan the 2020 Census, it is also reviewing the employee skills and competencies needed to make that happen, in part by a formal analysis comparing its needs to its in-house capabilities. The Bureau has made progress in these areas and others. However, they will require continued oversight if the Bureau is to transform itself to better control costs and deliver an accurate national headcount in 2020. Cost Estimation: Our prior work has highlighted the need for the Bureau to develop more accurate and rigorous cost estimates for census operations.[Footnote 6] The Bureau uses the life-cycle cost estimate as the starting point for the annual budget formulation process and, according to our Cost Estimating and Assessment Guide, a reliable cost-estimating process is necessary to ensure that cost estimates--particularly for large, complex projects like the 2020 Census--are comprehensive, well documented, accurate, and credible.[Footnote 7] In January 2012, among other actions, we recommended that the Bureau finalize guidance, policies, and procedures for cost estimation in accordance with best practices prior to developing the initial 2020 life-cycle cost estimate.[Footnote 8] In response to our recommendation, the Bureau has created a cost estimation team reporting to the Director. The team intended, among other things, to standardize guidance and training in cost estimation throughout the Bureau. The Bureau recently took the important step of hiring an individual to lead that group. However, until the Bureau finalizes its cost-estimating policies, procedures, and guidance, as we recommended, it runs the risks of developing unreliable cost estimates for 2020. Integrated Long-term Planning: The Bureau's progress thus far with early planning is noteworthy given its long-standing challenges in this area. In December 2010,[Footnote 9] we recommended that the Bureau develop a roadmap for 2020 that integrates performance, budget, methodological, schedule, and other information that would be updated as needed and posted on the Bureau's website and other social media outlets. We also recommended that the Bureau develop a mechanism that allows for and harnesses input from census stakeholders and individuals. The Bureau agreed with our recommendations and brought together some of these elements in an annual fiscal year update of its "business plan," which it issued to Congress in concert with its budget submissions for each of the past 2 years. However, as the approach for 2020 takes shape, the Bureau needs to fully implement our recommendation to pull together remaining planning elements, such as milestones for decisions and estimates of cost into its tactical plan or roadmap. In addition, we recommended in November 2009 that the Bureau improve its use of a master activity schedule for 2020 to include levels of resources and take other steps that would support systematic analyses of the risk to the schedule.[Footnote 10] The Department of Commerce did not comment on that recommendation in its response to that report, but the Bureau has since developed an integrated schedule covering its early research and testing activity that we are reviewing as part of ongoing work. Implementing additional steps such as those we have recommended will help ensure the Bureau's reform initiatives stay on track, do not lose momentum, and coalesce into a viable path toward a more cost-effective 2020 Census. Stakeholder Involvement: Ensuring active stakeholder involvement and buy-in is critical to high- performing organizations. For example, over the past decade we have reported on the importance of congressional outreach to secure early agreement between the Bureau and Congress on the Bureau's fundamental approach for its next decennial.[Footnote 11] In response to these reports and recommendations that we made, the Bureau has taken several steps forward. For example, in July 2012, the Bureau issued a plan for 2020 Census communications and stakeholder engagement, describing roles and responsibilities, among other elements. In December 2012, the Bureau began quarterly reviews intended to provide internal and external census program stakeholders, including congressional staff, officials from the Office of Management and Budget, and the Department of Commerce and its Office of Inspector General, with a broad and timely status of planning and development projects thereby facilitating strategic guidance and information sharing.[Footnote 12] These are important strides by the Bureau to ensure its research and planning are transparent. However, the challenge remains for the Bureau to identify tradeoffs among cost, quality, privacy, and security that may arise in the Bureau's proposed approaches, and raise these tradeoffs with stakeholders. Improving the Cost-Effectiveness of Census-Taking Operations: The Bureau's current research and testing phase represents a critical stage in preparing for a cost-effective 2020 Census. Bureau management will use the results of ongoing research and testing to shape the next decennial census as it determines what new operations will be a part of the 2020 Census design, which operations need to be revised, and how to mitigate remaining risks. The Bureau may be able to use its research initiatives during the next couple of years to attain significant cost savings. Key among these are three new operational changes being considered--using the Internet as a self-response option, targeting only certain addresses for field verification as the Bureau builds its national list of addresses, and replacing enumerator-collected data with administrative records under certain circumstances. All three initiatives have the potential to reduce costs. However, the Bureau will be employing them in ways that are new for 2020, and they thus entail some operational risk. Going forward, the Bureau needs to ensure they will (1) produce needed cost savings, (2) function in concert with other census operations, and (3) work at the scale needed for the national headcount. Using the Internet to Collect Responses: Tests conducted by the Bureau in 2011 showed that adding an Internet response option could increase the overall response rate for the census. The 2011 test results, coupled with the increased prevalence and accessibility of the Internet, led Bureau officials to commit to providing an Internet response option for the 2020 Census. If this option can help achieve an overall increase in the response rate, it can save money, since Bureau field staff would need to visit fewer households during nonresponse follow-up (NRFU), which is the largest and most costly census field operation.[Footnote 13] Furthermore, testing has shown that the cost of an Internet survey is low compared to a mail survey, which incurs printing and postage costs. Moreover, web survey responses are generally available more quickly and are of better quality than responses from a mail survey because there is no lag time, as the responses are captured in real time, and there are reminders to prompt the respondent if a question is unanswered. Quicker and more complete responses can also help reduce the amount of time and money spent on following up on late or incomplete census forms. Targeting Address Canvassing: In the 2010 and earlier censuses, the Bureau mounted a full address canvassing operation, where field staff traveled virtually every road in the country to update the Master Address File (MAF) and the associated mapping database called TIGER (Topologically Integrated Geographic Encoding and Referencing). This labor-intensive effort was one of the more expensive components of the 2010 Census. It required 140,000 temporary workers to verify 145 million addresses (by going door-to-door) at a cost of $444 million, or 3 percent of the $13 billion total cost of the 2010 Census. For the 2020 Census the Bureau would like to reduce workload and cost by targeting the address canvassing operation to areas most in need of updating. Administrative Records: Administrative records are a growing source of information on individuals and households. The Bureau has estimated that it could save up to $2 billion if it uses administrative records to reduce the need in 2020 for certain costly and labor-intensive door-to-door visits by Bureau employees, such as collecting data in person from nonrespondents, supporting quality control, or helping to evaluate the quality of the census.[Footnote 14] For purposes of the decennial census, the Bureau is considering administrative records from government agencies, including tax data and Medicare records,[Footnote 15] as well as commercial sources to identify persons associated with a particular household address. During the 2010 Census, the Bureau made limited use of administrative records. For example, the Bureau used U.S. Postal Service files to update its address list, and it used federal agency records (such as those from the Department of Defense) to count military and federal civilian employees stationed outside of the United States. Depending on the results of ongoing research, Bureau officials plan to build a composite of quality administrative records from various sources (i.e., federal agencies, state and local governments, and commercial sources) that it can use to reduce or replace costly field work. Successful use of such a database presents challenges the Bureau will need to address. For example, as we reported in 2012, while the Bureau has access to some federally collected data, it does not have access to all of the federally collected administrative data that could potentially help it reduce the cost of the 2020 Census.[Footnote 16] Further increasing the Bureau's access to records may involve negotiations with states or other federal agencies, potential statutory changes, and discussions of personal privacy protections, and most likely it would be a time-consuming process. In addition, the use of administrative records may present difficult decisions about tradeoffs between cost and quality, which the Bureau is actively researching to inform. Strengthening IT Management and Security Practices: Additionally, the Bureau is exploring technology options for census operations that collectively represent a dramatic leap from 2010. These options include the possible use of a "bring your own device" model to enable enumerators to use their own mobile devices for field data collection. Given the role of information technology in conducting the census, while controlling costs and protecting privacy, it is essential that the Bureau strengthen its ability to manage these investments, as well as its practices for securing the information it collects and disseminates. The following represent long-standing IT challenges that, if effectively addressed, will significantly enhance the Bureau's ability to acquire these solutions within cost, schedule, and performance targets. IT Governance: The Bureau lacks a sufficiently mature IT governance process to ensure that its investments are properly controlled and monitored. Implementing a governance framework and system development methodology are challenging tasks that can be aided by having robust implementation plans. Such a plan is instrumental in helping agencies coordinate and guide improvement efforts. In September 2012,[Footnote 17] we reported that while the Bureau developed the Enterprise Investment Management Plan, which was to be applied to all investments, the plan was still a draft document and had key gaps. Specifically, the plan did not contain guidelines for the membership of investment review boards or the frequency of board meetings, and it omitted cost and schedule performance thresholds for escalating issues to higher-level boards. Accordingly, we made recommendations to address these weaknesses. The Bureau agreed, and in response to our recommendations, in June 2013, program officials provided us with an updated plan, which was finalized on September 28, 2012. However, while the plan now states that investment review boards should meet at least monthly, the plan does not specify thresholds for escalating cost, risk, or impact issues. The Bureau needs to take action in this key area as we previously recommended to ensure that its senior executives have adequate insight into project health to make timely decisions. Requirements Management: Proper requirements management remains a long-standing challenge for the Bureau. The Software Engineering Institute states that a disciplined process for developing and managing requirements can help reduce the risks of developing or acquiring a system. Unfortunately, the Bureau has had difficulties with this in the past, as illustrated by the problems it had in managing requirements during the 2010 census, which were largely responsible for the Bureau's abandonment of its handheld enumeration devices and increased the cost of the census by up to $3 billion. In September 2012,[Footnote 18] we reported that the IT and 2020 Census directorates had independently drafted new requirements, instead of developing a Bureau-wide requirements management plan, despite our prior recommendation. To address the Bureau's recurring weaknesses in requirements management, we therefore recommended that it establish and implement a consistent requirements development and management process across the Bureau. Bureau officials agreed with the recommendation and in response, in August 2013, program officials stated that they began using a new life-cycle management tool to manage requirements Bureau-wide. While this is a good start, it remains to be seen whether the Bureau will fully implement the new tool and institutionalize the requirements management process. Until the Bureau fully implements our recommendation to establish a consistent requirements development and management process across the Bureau that has clear guidance for developing requirements at the strategic mission, business, and project levels and is integrated with its new system development methodology, it will not have assurance that the IT systems delivered for 2020 will actually meet user needs. IT Workforce Planning: As discussed earlier in this statement, effective workforce planning is essential to ensure organizations have the proper skills, abilities, and capacity for effective management. The Bureau has not yet finalized its IT workforce plans. In 2012, we reported that the Bureau had taken limited steps to develop IT human capital practices, such as inventorying critical competencies among its IT staff.[Footnote 19] Yet many key steps remained to be implemented. In particular, the Bureau had not developed a Bureau-wide IT workforce plan, identified gaps in mission-critical IT occupations, skills, and competencies, or developed strategies to address gaps. Accordingly, we recommended that the Bureau establish a repeatable process for performing IT skills assessments and gap analyses that can be implemented in a timely manner. The Bureau agreed with the recommendation, and in response, in June 2013, Bureau officials stated that they plan to complete a skills and needs assessment for the Bureau's IT workforce by the end of this month. Officials also reported that they have a workforce planning team that has developed a strategic workforce planning process and implementation plan. While the Bureau has taken certain steps to improve its IT workforce planning processes, going forward it will be important for it to fully establish a repeatable process for performing skills assessments and gap analyses, as we recommended, that can be implemented in a timely manner and better enable managers to address any skills gaps in preparation for the 2020 Census. IT System Security: Critical to the Bureau's ability to perform its data collection and analysis duties are its information systems and the protection of the information they contain. A data breach could result in the public's loss of confidence in the Bureau, thus affecting its ability to collect census data. Access controls are designed and implemented to ensure the reliability of an agency's computerized information. [Footnote 20] Access controls that are intended to prevent, limit, and detect unauthorized access to computing resources, programs, information, and facilities, are referred to as logical and physical access controls. Inadequate design or implementation of access controls increases the risk of unauthorized disclosure, modification, and destruction of sensitive information and disruption of service. In January 2013, we reported that the Bureau's IT systems' access controls contained certain deficiencies.[Footnote 21] For example, the Bureau did not adequately control connectivity to key network devices and servers, identify and authenticate users, or limit user access rights and permissions to only those necessary to perform official duties. An underlying reason for those weaknesses was that the Bureau had not fully implemented a comprehensive information security program to ensure that controls were effectively established and maintained. Accordingly, we recommended that the Bureau take several actions, such as clearly documenting its assessment of common controls for information systems before granting an authorization to operate and fully developing an incident response plan. In response to the report, the Bureau indicated it would work to identify the best way to address our recommendations. The Bureau reported that it has efforts under way to address our recommendations; however, more work remains. For example, according to Bureau officials they have been working to better track assessments of their common controls as part of a new risk management process. They expect to complete the transition to the new process by the end of this month. While the Bureau has recently taken key steps to address its IT security weaknesses, certain steps remain. Having adequate controls over access to its systems, as we recommended, would help the Bureau to better ensure that its information and systems are protected from intrusion. Concluding Observations: The Bureau is moving forward along a number of fronts to secure a more cost-effective 2020 enumeration. Significant research is already under way, and the Bureau is responding to our past recommendations. A little more than 6 years remains until Census Day 2020. While this might seem like an ample amount of time to finalize the Bureau's planning process and take steps to control costs, past experience has shown that the chain of interrelated preparations that need to occur at specific times and in the right sequence leave little room for delay or missteps. Thus, as the Bureau's 2020 planning and reform efforts gather momentum, the effectiveness of those efforts will be determined in large measure by the extent to which they enhance the Bureau's ability to control costs, ensure quality, and adapt to future technological and societal changes. Likewise, Congress can hold the Bureau accountable for results, weigh in on key design decisions, provide the Bureau with resources the Congress believes are appropriate to support that design, and help ensure that the gains made to date stay on track. The Bureau's initial preparations for 2020 are making progress. Nonetheless, continuing congressional oversight remains vital. Chairman Farenthold, Ranking Member Lynch, and Members of the Subcommittee, this concludes our statement today. We would be pleased to respond to any questions that you may have. Contacts and Acknowledgments: If you have any questions concerning this statement, please contact Robert Goldenkoff, Director, Strategic Issues, at (202) 512-2757 or goldenkoffg@gao.gov; or Carol R. Cha, Director, Information Technology Acquisition Management Issues, at (202) 512-4456 or chac@gao.gov. Other individuals who made key contributions include Ty Mitchell and Shannin G. O'Neill, Assistant Directors; Robert Gebhart; Nancy Glover; Lisa Hardman; Vernetta Marquis; Aku Pappoe; Dan Webb; and Timothy Wexler. [End of section] Related GAO Products: Information Security: Actions Needed by Census Bureau to Address Weaknesses. [hyperlink, http://www.gao.gov/products/GAO-13-63]. Washington, D.C.: January 22, 2013. 2020 Census: Initial Research Milestones Generally Met but Plans Needed to Mitigate Highest Risks. [hyperlink, http://www.gao.gov/products/GAO-13-53]. Washington, D.C.: November 7, 2012. Information Technology: Census Bureau Needs to Implement Key Management Practices. [hyperlink, http://www.gao.gov/products/GAO-12-915]. Washington, D.C.: September 18, 2012. 2020 Census: Sustaining Current Reform Efforts Will Be Key to a More Cost-Effective Enumeration. [hyperlink, http://www.gao.gov/products/GAO-12-905T]. Washington, D.C.: July 18, 2012. 2020 Census: Additional Steps Are Needed to Build on Early Planning.[hyperlink, http://www.gao.gov/products/GAO-12-626]. Washington, D.C.: May 17, 2012. Decennial Census: Additional Actions Could Improve the Census Bureau's Ability to Control Costs for the 2020 Census. [hyperlink, http://www.gao.gov/products/GAO-12-80]. Washington, D.C.: January 24, 2012. 2010 Census: Preliminary Lessons Learned Highlight the Need for Fundamental Reforms. [hyperlink, http://www.gao.gov/products/GAO-11-496T]. Washington, D.C.: April 6, 2011. 2010 Census: Data Collection Operations Were Generally Completed as Planned, but Long-standing Challenges Suggest Need for Fundamental Reforms. [hyperlink, http://www.gao.gov/products/GAO-11-193]. Washington, D.C.: December 14, 2010. 2010 Census: Follow-up Should Reduce Coverage Errors, but Effects on Demographic Groups Need to Be Determined. [hyperlink, http://www.gao.gov/products/GAO-11-154]. Washington, D.C.: December 14, 2010. 2010 Census: Key Efforts to Include Hard-to-Count Populations Went Generally as Planned; Improvements Could Make the Efforts More Effective for Next Census. [hyperlink, http://www.gao.gov/products/GAO-11-45]. Washington, D.C.: December 14, 2010. 2010 Census: Plans for Census Coverage Measurement Are on Track, but Additional Steps Will Improve Its Usefulness. [hyperlink, http://www.gao.gov/products/GAO-10-324]. Washington, D.C.: April 23, 2010. 2010 Census: Data Collection Is Under Way, but Reliability of Key Information Technology Systems Remains a Risk. [hyperlink, http://www.gao.gov/products/GAO-10-567T]. Washington, D.C.: March 25, 2010. 2010 Census: Key Enumeration Activities Are Moving Forward, but Information Technology Systems Remain a Concern. [hyperlink, http://www.gao.gov/products/GAO-10-430T]. Washington, D.C.: February 23, 2010. 2010 Census: Census Bureau Continues to Make Progress in Mitigating Risks to a Successful Enumeration, but Still Faces Various Challenges. [hyperlink, http://www.gao.gov/products/GAO-10-132T]. Washington, D.C.: October 7, 2009. 2010 Census: Census Bureau Should Take Action to Improve the Credibility and Accuracy of Its Cost Estimate for the Decennial Census. [hyperlink, http://www.gao.gov/products/GAO-08-554]. Washington, D.C.: June 16, 2008. Information Technology: Significant Problems of Critical Automation Program Contribute to Risks Facing 2010 Census. [hyperlink, http://www.gao.gov/products/GAO-08-550T]. Washington, D.C.: March 5, 2008. Information Technology: Census Bureau Needs to Improve Its Risk Management of Decennial Systems. [hyperlink, http://www.gao.gov/products/GAO-08-259T]. Washington, D.C.: December 11, 2007. 2010 Census: Census Bureau Has Improved the Local Update of Census Addresses Program, but Challenges Remain. [hyperlink, http://www.gao.gov/products/GAO-07-736]. Washington, D.C.: June 14, 2007. Information Technology Management: Census Bureau Has Implemented Many Key Practices, but Additional Actions Are Needed. [hyperlink, http://www.gao.gov/products/GAO-05-661]. Washington, D.C.: June 16, 2005. 2010 Census: Cost and Design Issues Need to Be Addressed Soon. [hyperlink, http://www.gao.gov/products/GAO-04-37]. Washington, D.C.: January 15, 2004. Human Capital: Key Principles for Effective Strategic Workforce Planning. [hyperlink, http://www.gao.gov/products/GAO-04-39]. Washington, D.C.: December 11, 2003. 2000 Census: Lessons Learned for Planning a More Cost-Effective 2010 Census. [hyperlink, http://www.gao.gov/products/GAO-03-40]. Washington, D.C.: October 31, 2002. [End of section] Footnotes: [1] See related GAO products at the end of this statement. [2] See for example: GAO, Results-Oriented Government: Practices That Can Help Enhance and Sustain Collaboration among Federal Agencies, [hyperlink, http://www.gao.gov/products/GAO-06-15] (Washington, D.C.: Oct. 21, 2005); 21st Century Challenges: Reexamining the Base of the Federal Government, [hyperlink, http://www.gao.gov/products/GAO-05-325SP] (Washington, D.C.: February 2005); Information Technology Investment Management: A Framework for Assessing and Improving Process Maturity, [hyperlink, http://www.gao.gov/products/GAO-04-394G] (Washington, D.C.: March 2004); Comptroller General's Forum, High-Performing Organizations: Metrics, Means, and Mechanisms for Achieving High Performance in the 21st Century Public Management Environment, [hyperlink, http://www.gao.gov/products/GAO-04-343SP] (Washington, D.C.: Feb. 13, 2004; and Human Capital: Key Principles for Effective Strategic Workforce Planning, [hyperlink, http://www.gao.gov/products/GAO-04-39] (Washington, D.C.: Dec. 11, 2003). [3] GAO, Information Technology: Significant Problems of Critical Automation Program Contribute to Risks Facing 2010 Census, [hyperlink, http://www.gao.gov/products/GAO-08-550T] (Washington, D.C.: Mar. 5, 2008) and High-Risk Series: Quick Reference Guide, [hyperlink, http://www.gao.gov/products/GAO/HR-97-2] (Washington, D.C.: February 1997). [4] See for example, GAO, 2000 Census: Progress Made on Design, but Risks Remain, [hyperlink, http://www.gao.gov/products/GAO/GGD-97-142] (Washington, D.C.: July 14, 1997), and Decennial Census: Preliminary 1990 Lessons Learned Indicate Need to Rethink Census Approach, [hyperlink, http://www.gao.gov/products/GAO/T-GGD-90-18] (Washington, D.C.: Aug. 8, 1990). [5] GAO, 2020 Census: Sustaining Current Reform Efforts Will Be Key to a More Cost-Effective Enumeration, [hyperlink, http://www.gao.gov/products/GAO-12-905T] (Washington, D.C.: July 18, 2012). [6] GAO, 2010 Census: Census Bureau Should Take Acton to Improve the Credibility and Accuracy of Its Cost Estimate for the Decennial Census, [hyperlink, http://www.gao.gov/products/GAO-08-554] (Washington, D.C.: June 16, 2008). [7] GAO, GAO Cost Estimating and Assessment Guide: Best Practices for Developing and Managing Capital Program Costs, [hyperlink, http://www.gao.gov/products/GAO-09-3SP] (Washington, D.C.: March 2009). [8] GAO, Decennial Census: Additional Actions Could Improve the Census Bureau's Ability to Control Costs for the 2020 Census, [hyperlink, http://www.gao.gov/products/GAO-12-80] (Washington, D.C.: Jan. 24, 2012). [9] GAO, 2010 Census: Data Collection Operations Were Generally Completed as Planned, but Long-standing Challenges Suggest Need for Fundamental Reforms, [hyperlink, http://www.gao.gov/products/GAO-11-193] (Washington, D.C.: Dec. 14, 2010). [10] See GAO, 2010 Census: Census Bureau Has Made Progress on Schedule and Operational Control Tools, but Needs to Prioritize Remaining System Requirements, [hyperlink, http://www.gao.gov/products/GAO-10-59] (Washington, D.C.: Nov. 13, 2009). [11] See GAO, 2020 Census: Additional Steps Are Needed to Build on Early Planning, [hyperlink, http://www.gao.gov/products/GAO-12-626] (Washington, D.C.: May 17, 2012), and 2010 Census: Cost and Design Issues Need to be Addressed Soon, [hyperlink, http://www.gao.gov/products/GAO-04-37] (Washington, D.C.: Jan. 15, 2004). [12] We also attend these reviews as observers at the Bureau's invitation. [13] During NRFU the Bureau sends enumerators to collect data from households that did not mail back their census forms. NRFU procedures instruct enumerators to make up to six attempts to contact a household. The 2010 Census NRFU operation cost $1.6 billion. [14] The amount of and quality of administrative records the Bureau is able to collect will affect the amount of cost savings it is able to realize. [15] The Bureau's access to and use of administrative records is governed by agency-specific statutes. For example, the Bureau has access to tax data under 26 U.S.C. § 6103(j)(1) "for the purpose of, but only to the extent necessary in, the structuring of censuses... and conducting related statistical activities." [16] GAO, 2020 Census: Initial Research Milestones Generally Met but Plans Needed to Mitigate Highest Risks, [hyperlink, http://www.gao.gov/products/GAO-13-53] (Washington, D.C.: Nov. 7, 2012). [17] GAO, Information Technology: Census Bureau Needs to Implement Key Management Practices, [hyperlink, http://www.gao.gov/products/GAO-12-915] (Washington, D.C.: Sept. 18, 2012). [18] [hyperlink, http://www.gao.gov/products/GAO-12-915]. [19] [hyperlink, http://www.gao.gov/products/GAO-12-915]. [20] Access controls include those related to (1) protection of system boundaries, (2) identification and authentication, (3) authorization, (4) cryptography, (5) audit and monitoring, and (6) physical security. [21] GAO, Information Security: Actions Needed by Census Bureau to Address Weaknesses, [hyperlink, http://www.gao.gov/products/GAO-13-63] (Washington, D.C.: Jan. 22, 2013). [End of section] GAO’s Mission: The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO’s website [hyperlink, http://www.gao.gov]. Each weekday afternoon, GAO posts on its website newly released reports, testimony, and correspondence. To have GAO e-mail you a list of newly posted products, go to [hyperlink, http://www.gao.gov] and select “E-mail Updates.” Order by Phone: The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, [hyperlink, http://www.gao.gov/ordering.htm]. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. Connect with GAO: Connect with GAO on facebook, flickr, twitter, and YouTube. Subscribe to our RSS Feeds or E mail Updates. Listen to our Podcasts. Visit GAO on the web at [hyperlink, http://www.gao.gov]. To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Website: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]; E-mail: fraudnet@gao.gov; Automated answering system: (800) 424-5454 or (202) 512-7470. Congressional Relations: Katherine Siggerud, Managing Director, siggerudk@gao.gov: (202) 512-4400: U.S. Government Accountability Office: 441 G Street NW, Room 7125: Washington, DC 20548. Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov: (202) 512-4800: U.S. Government Accountability Office: 441 G Street NW, Room 7149: Washington, DC 20548. [End of document]