Input:
	Background

According to the President’s budget, the federal government planned to  invest more than $96 billion for IT in fiscal year 2018—the largest amount  ever budgeted. Despite such large IT expenditures, we have previously  reported that investments in federal IT too often resulted in failed projects  that incurred cost overruns and schedule slippages, while contributing  little to the desired mission-related outcomes. For example:
The tri-agency National Polar-orbiting Operational Environmental  Satellite System was disbanded in February 2010 at the direction of the White House’s Office of Science and Technology Policy after the  program spent 16 years and almost $5 billion.
The Department of Homeland Security’s (DHS) Secure Border Initiative  Network program was ended in January 2011, after the department  obligated more than $1 billion for the program.
The Department of Veterans Affairs’ Financial and Logistics Integrated  Technology Enterprise program was intended to be delivered by 2014 at  a total estimated cost of $609 million, but was terminated in October  2011.
The Department of Defense’s Expeditionary Combat Support System  was canceled in December 2012 after spending more than a billion  dollars and failing to deploy within 5 years of initially obligating funds.
The United States Coast Guard (Coast Guard) decided to terminate its  Integrated Health Information System project in 2015. As reported by the  agency in August 2017, the Coast Guard spent approximately $60 million  over 7 years on this project, which resulted in no equipment or software  that could be used for future efforts.
Our past work has found that these and other failed IT projects often  suffered from a lack of disciplined and effective management, such as  project planning, requirements definition, and program oversight and  governance. In many instances, agencies had not consistently applied  best practices that are critical to successfully acquiring IT.
Such projects have also failed due to a lack of oversight and governance.  Executive-level governance and oversight across the government has  often been ineffective, specifically from CIOs. For example, we have  reported that some CIOs’ roles were limited because they did not have  the authority to review and approve the entire agency IT portfolio.
In addition to failures when acquiring IT, security deficiencies can  threaten systems. As we previously reported, in order to counter security  threats, the 23 civilian Chief Financial Officers (CFO) Act agencies spent  a combined total of approximately $4 billion on IT security-related  activities in fiscal year 2016. Even so, our cybersecurity work at federal  agencies continues to highlight information security deficiencies. The  following examples describe the types of risks we have found at federal  agencies.
In September 2018, we reported that the Department of Education’s  Office of Federal Student Aid exercises minimal oversight of lenders’  protection of student data and lacks assurance that appropriate risk- based safeguards are being effectively implemented, tested, and  monitored.
In August 2017, we reported that, since the 2015 data breaches, the  Office of Personnel Management (OPM) had taken actions to prevent,  mitigate, and respond to data breaches involving sensitive personal and  background investigation information. However, we noted that the  agency had not fully implemented recommendations made to OPM by  DHS’s United States Computer Emergency Readiness Team to help the  agency improve its overall security posture and improve its ability to  protect its systems and information from security breaches.
In July 2017, we reported that information security at the Internal  Revenue Service had weaknesses that limited its effectiveness in  protecting the confidentiality, integrity, and availability of financial and  sensitive taxpayer data. An underlying reason for these weaknesses was  that the Internal Revenue Service had not effectively implemented  elements of its information security program.
In May 2016, we reported that the National Aeronautics and Space  Administration, the Nuclear Regulatory Commission, OPM, and the  Department of Veteran Affairs did not always control access to selected  high-impact systems, patch known software vulnerabilities, and plan for  contingencies. An underlying reason for these weaknesses was that the  agencies had not fully implemented key elements of their information  security programs.
In August 2016, we reported that the information security of the Food and  Drug Administration had significant weaknesses that jeopardized the  confidentiality, integrity, and availability of its information systems and  industry and public health data.

		FITARA Increases CIO Authorities and Responsibilities for Managing IT

Congress and the President have enacted various key pieces of reform  legislation to address IT management issues. These include the federal  IT acquisition reform legislation commonly referred to as the Federal  Information Technology Acquisition Reform Act (FITARA). This  legislation was intended to improve covered agencies’ acquisitions of IT  and enable Congress to monitor agencies’ progress and hold them  accountable for reducing duplication and achieving cost savings. The  law includes specific requirements related to seven areas:
Agency CIO authority enhancements. CIOs at covered agencies have  the authority to, among other things, (1) approve the IT budget requests  of their respective agencies and (2) review and approve IT contracts.
Federal data center consolidation initiative (FDCCI). Agencies  covered by FITARA are required, among other things, to provide a  strategy for consolidating and optimizing their data centers and issue  quarterly updates on the progress made.
Enhanced transparency and improved risk management. The Office  of Management and Budget (OMB) and covered agencies are to make  detailed information on federal IT investments publicly available, and  agency CIOs are to categorize their investments by level of risk.
Portfolio review. Covered agencies are to annually review IT investment  portfolios in order to, among other things, increase efficiency and  effectiveness and identify potential waste and duplication.
Expansion of training and use of IT acquisition cadres. Covered  agencies are to update their acquisition human capital plans to support  timely and effective IT acquisitions. In doing so, the law calls for agencies  to consider, among other things, establishing IT acquisition cadres (i.e.,  multi-functional groups of professionals to acquire and manage complex programs), or developing agreements with other agencies that have such  cadres.
Government-wide software purchasing program. The General  Services Administration is to develop a strategic sourcing initiative to  enhance government-wide acquisition and management of software. In  doing so, the law requires that, to the maximum extent practicable, the  General Services Administration should allow for the purchase of a  software license agreement that is available for use by all executive  branch agencies as a single user.
Maximizing the benefit of the Federal Strategic Sourcing Initiative.
Federal agencies are required to compare their purchases of services  and supplies to what is offered under the Federal Strategic Sourcing  Initiative.
In June 2015, OMB released guidance describing how agencies are to  implement FITARA. This guidance is intended to, among other things: assist agencies in aligning their IT resources with statutory requirements; establish government-wide IT management controls to meet the law’s  requirements, while providing agencies with flexibility to adapt to unique  agency processes and requirements;  strengthen the relationship between agency CIOs and bureau CIOs; and  strengthen CIO accountability for IT costs, schedules, performance, and  security.
The guidance identifies a number of actions that agencies are to take to  establish a basic set of roles and responsibilities (referred to as the  common baseline) for CIOs and other senior agency officials and, thus, to  implement the authorities described in the law. For example, agencies are  to conduct a self-assessment and submit a plan describing the changes  they intend to make to ensure that common baseline responsibilities are  implemented.
In addition, in August 2016, OMB released guidance intended to, among  other things, define a framework for achieving the data center  consolidation and optimization requirements of FITARA. The guidance  directed agencies to develop a data center consolidation and optimization  strategic plan that defined the agency’s data center strategy for fiscal  years 2016, 2017, and 2018. This strategy was to include, among other  things, a statement from the agency CIO indicating whether the agency  had complied with all data center reporting requirements in FITARA.  Further, the guidance states that OMB is to maintain a public dashboard  to display consolidation-related costs savings and optimization  performance information for the agencies.

		Congress Has Undertaken Efforts to Continue Selected FITARA Provisions and Modernize Federal IT

Congress has recognized the importance of agencies’ continued  implementation of FITARA provisions, and has taken legislative action to  extend selected provisions beyond their original dates of expiration.  Specifically, Congress and the President enacted laws to:  remove the expiration dates for the enhanced transparency and improved  risk management provisions, which were set to expire in 2019;  remove the expiration date for portfolio review, which was set to expire in  2019; and extend the expiration date for FDCCI from 2018 to 2020.
In addition, Congress and the President enacted a law to authorize the  availability of funding mechanisms to help further agencies’ efforts to  modernize IT. The law, known as the Modernizing Government  Technology (MGT) Act, authorizes agencies to establish working capital  funds for use in transitioning from legacy IT systems, as well as for  addressing evolving threats to information security. The law also creates  the Technology Modernization Fund, within the Department of the  Treasury, from which agencies can “borrow” money to retire and replace  legacy systems, as well as acquire or develop systems.
Further, in February 2018, OMB issued guidance for agencies on  implementing the MGT Act. The guidance was intended to provide  agencies additional information regarding the Technology Modernization  Fund, and the administration and funding of the related IT working capital  funds. Specifically, the guidance encouraged agencies to begin  submitting initial project proposals for modernization on February 27,  2018. In addition, in accordance with the MGT Act, the guidance provides  details regarding a Technology Modernization Board, which is to consist  of (1) the Federal CIO; (2) a senior IT official from the General Services  Administration; (3) a member of DHS’s National Protection and Program  Directorate; and (4) four federal employees with technical expertise in IT  development, financial management, cybersecurity and privacy, and  acquisition, appointed by the Director of OMB.

		FISMA Establishes Responsibilities for Agencies to Address Federal Cybersecurity

Congress and the President enacted the Federal Information Security  Modernization Act of 2014 (FISMA) to improve federal cybersecurity and  clarify government-wide responsibilities. The act addresses the  increasing sophistication of cybersecurity attacks, promotes the use of  automated security tools with the ability to continuously monitor and  diagnose the security posture of federal agencies, and provides for  improved oversight of federal agencies’ information security programs.  Toward this end, the act clarifies and assigns specific responsibilities to  entities such as OMB, DHS, and the federal agencies. Table 1 describes  a selection of the OMB, DHS, and agency responsibilities.

		The Administration Has Undertaken Efforts to Improve, Modernize, and Strengthen the Security of Federal IT

Beyond the implementation of FITARA, FISMA, and related actions, the  administration has also initiated other efforts intended to improve federal  IT. Specifically, in March 2017, the administration established the Office  of American Innovation, which has a mission to, among other things,  make recommendations to the President on policies and plans aimed at  improving federal government operations and services. In doing so, the  office is to consult with both OMB and the Office of Science and  Technology Policy on policies and plans intended to improve government  operations and services, improve the quality of life for Americans, and  spur job creation.
In May 2017, the Administration also established the American  Technology Council, which has a goal of helping to transform and  modernize federal agency IT and how the federal government uses and  delivers digital services. The President is the chairman of this council,  and the Federal CIO and the United States Digital Service Administrator  are among the members.
In addition, on May 11, 2017, the President signed Executive Order  13800, Strengthening the Cybersecurity of Federal Networks and Critical  Infrastructure. This executive order outlined actions to enhance  cybersecurity across federal agencies and critical infrastructure to  improve the nation’s cyber posture and capabilities against cybersecurity  threats. Among other things, the order tasked the Director of the  American Technology Council to coordinate a report to the President  from the Secretary of DHS, the Director of OMB, and the Administrator of  the General Services Administration, in consultation with the Secretary of  Commerce, regarding the modernization of federal IT.
As a result, the Report to the President on Federal IT Modernization was  issued on December 13, 2017, and outlined the current and envisioned  state of federal IT. The report focused on modernization efforts to improve  the security posture of federal IT and recognized that agencies have  attempted to modernize systems but have been stymied by a variety of  factors, including resource prioritization, ability to procure services  quickly, and technical issues. The report provided multiple  recommendations intended to address these issues through the  modernization and consolidation of networks and the use of shared  services to enable future network architectures.
Further, in March 2018, the Administration issued the President’s  Management Agenda, which lays out a long-term vision for modernizing  the federal government. The agenda identifies three related drivers of  transformation—IT modernization; data, accountability, and transparency;  and the workforce of the future—that are intended to push change across  the federal government.
The Administration also established 14 related Cross-Agency Priority  goals, many of which have elements that involve IT. In particular, the  Cross-Agency Priority goal on IT modernization states that modern IT  must function as the backbone of how government serves the public in  the digital age. This goal establishes three priorities that are to guide the  Administration’s efforts to modernize federal IT: (1) enhancing mission  effectiveness by improving the quality and efficiency of critical services,  including the increased utilization of cloud-based solutions; (2) reducing  cybersecurity risks to the federal mission by leveraging current  commercial capabilities and implementing cutting edge cybersecurity  capabilities; and (3) building a modern IT workforce by recruiting,  reskilling, and retaining professionals able to help drive modernization  with up-to-date technology.
More recently, on May 15, 2018, the President signed Executive Order  13833, Enhancing the Effectiveness of Agency Chief Information Officers.  Among other things, this executive order is intended to better position  agencies to modernize their IT systems, execute IT programs more  efficiently, and reduce cybersecurity risks. The order pertains to 22 of  the 24 CFO Act agencies: the Department of Defense and the Nuclear  Regulatory Commission are exempt.
For the covered agencies, the executive order strengthens the role of  agency CIOs by, among other things, requiring them to report directly to  their agency head; serve as their agency head’s primary IT strategic  advisor; and have a significant role in all management, governance, and  oversight processes related to IT. In addition, one of the cybersecurity  requirements directs agencies to ensure that the CIO works closely with  an integrated team of senior executives, including those with expertise in  IT, security, and privacy, to implement appropriate risk management  measures.

	Agencies Have Not Fully Addressed the IT Acquisitions and Operations High-Risk Area

In the February 2017 update to our high-risk series, we reported that  agencies still needed to complete significant work related to the  management of IT acquisitions and operations. We stressed that OMB  and federal agencies should continue to expeditiously implement FITARA  and OMB’s related guidance, which includes enhancing CIO authority,  consolidating data centers, and acquiring and managing software  licenses.
Our update to this high-risk area also stressed that OMB and agencies  needed to continue to implement our prior recommendations in order to  improve their ability to effectively and efficiently invest in IT. Specifically,  since fiscal year 2010, we have made 1,242 recommendations to OMB  and federal agencies to address shortcomings in IT acquisitions and  operations.
As stated in the update, OMB and agencies should demonstrate  government-wide progress in the management of IT investments by,  among other things, implementing at least 80 percent of our  recommendations related to managing IT acquisitions and operations. As  of November 2018, OMB and agencies had fully implemented 732 (or  about 59 percent) of the 1,242 recommendations. Figure 1 summarizes  the progress that OMB and agencies have made in addressing our  recommendations compared to the 80 percent target.
Overall, federal agencies would be better positioned to realize billions in  cost savings and additional management improvements if they address  these recommendations, including those aimed at implementing CIO  responsibilities, reviewing IT acquisitions; improving data center  consolidation; and managing software licenses.

		Agencies Need to Address Shortcomings and Challenges in Implementing CIO Responsibilities

In all, the various laws, such as FITARA, and related guidance assign  35 IT management responsibilities to CIOs in six key areas. These areas  are: leadership and accountability, budgeting, information security,  investment management, workforce, and strategic planning.
In August 2018, we reported that none of the 24 agencies we reviewed  had policies that fully addressed the role of their CIO, as called for by  federal laws and guidance. In this regard, a majority of the agencies had  fully or substantially addressed the role of their CIOs for the area of  leadership and accountability. In addition, a majority of the agencies had  substantially or partially addressed the role of their CIOs for two areas:  information security and IT budgeting.
However, most agencies partially or minimally addressed the role of their  CIOs for two areas: investment management and strategic planning.  Further, the majority of the agencies minimally addressed or did not  address the role of their CIOs for the remaining area: IT workforce. Figure  2 depicts the extent to which the 24 agencies addressed the role of their  CIOs for the six areas.
Despite the shortfalls in agencies’ policies addressing the roles of their  CIOs, most agency officials stated that their CIOs are implementing the  responsibilities even if the agencies do not have policies requiring  implementation.
Nevertheless, the CIOs of the 24 selected agencies acknowledged in  responses to a survey that we administered that they were not always  very effective in implementing the six IT management areas. Specifically,  at least 10 of the CIOs indicated that they were less than very effective for  each of the six areas of responsibility. We believe that until agencies fully  address the role of CIOs in their policies, agencies will be limited in  addressing longstanding IT management challenges.
Figure 3 depicts the extent to which the CIOs reported their effectiveness  in implementing the six areas of responsibility.
Beyond the actions of the agencies, however, shortcomings in agencies’  policies also are partially attributable to two weaknesses in OMB’s  guidance. First, the guidance does not comprehensively address all CIO  responsibilities, such as those related to assessing the extent to which  personnel meet IT management knowledge and skill requirements, and  ensuring that personnel are held accountable for complying with the  information security program. Correspondingly, the majority of the  agencies’ policies did not fully address nearly all of the responsibilities  that were not included in OMB’s guidance.
Second, OMB’s guidance does not ensure that CIOs have a significant  role in (1) IT planning, programming, and budgeting decisions; and (2)  execution decisions and the management, governance, and oversight  processes related to IT, as required by federal law and guidance. In the  absence of comprehensive guidance, CIOs will not be positioned to  effectively acquire, maintain, and secure their IT systems.
In response to the survey conducted for our August 2018 report, the 24  agency CIOs also identified a number of factors that enabled and  challenged their ability to effectively manage IT. Specifically, most agency  CIOs cited five factors as being enablers to effectively carry out their  responsibilities: (1) NIST guidance, (2) the CIO’s position in the agency  hierarchy, (3) OMB guidance, (4) coordination with the Chief Acquisition  Officer (CAO), and (5) legal authority. Further, three factors were cited by  CIOs as major factors that have challenged their ability to effectively carry  out responsibilities: (1) processes for hiring, recruiting, and retaining IT  personnel; (2) financial resources; and (3) the availability of  personnel/staff resources.
As shown in figure 4, the five enabling factors were identified by at least  half of the 24 CIOs and the three factors cited as major challenges were  identified by at least half of the CIOs.
Although OMB has issued guidance aimed at addressing the three factors  that were identified by at least half of the CIOs as major challenges, the  guidance does not fully address those challenges. Further, regarding the  financial resources challenge, OMB recently required agencies to provide  data on CIO authority over IT spending; however, its guidance does not  provide a complete definition of the authority. In the absence of such  guidance, agencies have created varying definitions of CIO authority.  Until OMB updates its guidance to include a complete definition of the  authority that CIOs are to have over IT spending, it will be difficult for  OMB to identify any deficiencies in this area and to help agencies make  any needed improvements.
In order to address challenges in implementing CIO responsibilities, we  made three recommendations to OMB and one recommendation to each  of the selected 24 federal agencies to improve the effectiveness of CIOs’  implementation of their responsibilities for each of the six IT management  areas. Most agencies agreed with or had no comments on the  recommendations. As of November 2018, all 27 of the recommendations  had not been implemented. We will continue to monitor the  implementation of these recommendations.

		Agencies Need to Ensure That IT Acquisitions Are Reviewed and Approved by CIOs

FITARA includes a provision to enhance covered agency CIOs’ authority  through, among other things, requiring agency heads to ensure that CIOs  review and approve IT contracts. OMB’s FITARA implementation  guidance expanded upon this aspect of the legislation in a number of  ways. Specifically, according to the guidance:
CIOs may review and approve IT acquisition strategies and plans, rather  than individual IT contracts;
CIOs can designate other agency officials to act as their representatives,  but the CIOs must retain accountability;
CAOs are responsible for ensuring that all IT contract actions are  consistent with CIO-approved acquisition strategies and plans; and
CAOs are to indicate to the CIOs when planned acquisition strategies  and acquisition plans include IT.
In January 2018, we reported that most of the CIOs at 22 selected  agencies were not adequately involved in reviewing billions of dollars of  IT acquisitions. For instance, most of the 22 agencies did not identify all  of their IT contracts. In this regard, the agencies identified 78,249 IT- related contracts, to which they obligated $14.7 billion in fiscal year 2016.
However, we identified 31,493 additional contracts with $4.5 billion  obligated, raising the total amount obligated to IT contracts by these  agencies in fiscal year 2016 to at least $19.2 billion. Figure 5 reflects the  obligations that the 22 selected agencies reported to us relative to the  obligations we identified.
The percentage of additional IT contract obligations we identified varied  among the selected agencies. For example, the Department of State did  not identify 1 percent of its IT contract obligations. Conversely, eight  agencies did not identify over 40 percent of their IT contract obligations.
Many of the selected agencies that did not identify these IT contract  obligations also did not follow OMB guidance. Specifically, 14 of the 22  agencies did not involve the acquisition office in their process to identify  IT acquisitions for CIO review, as required by OMB. In addition, 7  agencies did not establish guidance to aid officials in recognizing IT. We  concluded that until these agencies involve the acquisitions office in their  IT acquisition identification processes and establish supporting guidance,  they cannot ensure that they will identify all such acquisitions. Without  proper identification of IT acquisitions, these agencies and CIOs cannot  effectively provide oversight of these acquisitions.
In addition to not identifying all IT contracts, 14 of the 22 selected  agencies did not fully satisfy OMB’s requirement that the CIO review and  approve IT acquisition plans or strategies. Further, only 11 of 96 randomly  selected IT contracts at 10 agencies that we evaluated were CIO- reviewed and approved as required by OMB’s guidance. The 85 contracts  not reviewed had a total possible value of approximately $23.8 billion.
Until agencies ensure that CIOs are able to review and approve all IT  acquisitions, CIOs will continue to have limited visibility and input into  their agencies’ planned IT expenditures and will not be able to effectively  use the increased authority that FITARA’s contract approval provision is  intended to provide. Further, agencies will likely miss an opportunity to  strengthen their CIOs’ authority and the oversight of acquisitions. As a  result, agencies may award IT contracts that are duplicative, wasteful, or  poorly conceived.
As a result of these findings, we made 39 recommendations in our  January 2018 report. Among these, we recommended that agencies  ensure that their acquisition offices are involved in identifying IT  acquisitions and issuing related guidance, and that IT acquisitions are  reviewed in accordance with OMB guidance. OMB and the majority of the  agencies generally agreed with or did not comment on the  recommendations. As of November 2018, 27 of the recommendations  had not been implemented.

		Agencies Have Made Progress in Consolidating Data Centers, but Need to Take Action to Achieve Planned Cost Savings

In our February 2017 high-risk update, we stressed that OMB and  agencies needed to demonstrate additional progress on achieving data  center consolidation savings in order to improve the management of IT  acquisitions and operations. Further, data center consolidation efforts are  key to implementing FITARA. Specifically, OMB established the FDCCI in  February 2010 to improve the efficiency, performance, and environmental  footprint of federal data center activities. The enactment of FITARA in  2014 codified and expanded the initiative.
In addition, in August 2016, OMB issued a memorandum which  established the Data Center Optimization Initiative (DCOI) and included  guidance on how to implement the data center consolidation and  optimization provisions of FITARA. Among other things, the guidance  required agencies to consolidate inefficient infrastructure, optimize  existing facilities, improve their security posture, and achieve cost  savings.
According to agencies, data center consolidation and optimization efforts  have resulted in approximately $4.5 billion in cost savings through 2018.   However, additional work remains to fully carry out the initiative.  Specifically, in a series of reports that we issued from July 2011 through  May 2018, we noted that, while data center consolidation could potentially  save the federal government billions of dollars, weaknesses existed in  several areas, including agencies’ data center consolidation plans, data  center optimization, and OMB’s tracking and reporting on related cost  savings. In these reports, we made a total of 160 recommendations to  OMB and 24 agencies to improve the execution and oversight of the  initiative. Most agencies and OMB agreed with our recommendations or  had no comments. As of November 2018, 47 of these 160  recommendations remained unimplemented.
In addition, in a draft report on data center optimization that we have  provided to the agencies for comment and plan to issue in early 2019, our  preliminary results indicate that agencies continued to report mixed  progress toward achieving OMB’s goals for closing data centers and  realizing the associated savings by September 2018. Specifically, as of  August 2018, over half of the agencies reported that they had met, or  planned to meet, all of their OMB-assigned closure goals for tiered data  centers by the deadline. However, 6 agencies reported that they did not  plan to meet their goals for tiered data centers. In addition, as of August  2018, 11 agencies reported that they had already met the goal for closing  60 percent of their non-tiered centers, 3 agencies reported that they  planned to meet the goal by the end of fiscal year 2018, and 9 agencies  reported that they did not plan to meet the goal by the end of fiscal year  2018.
In all, the 24 agencies reported a total of 6,250 data center closures as of  August 2018, which represented about half of the total reported number  of federal data centers. In addition, the agencies reported 1,009 planned  closures by the end of fiscal year 2018, with an additional 191 closures  planned through fiscal year 2023, for a total of 1,200 further closures.
Further, in August 2018, 22 agencies reported that they had achieved  $1.94 billion in cost savings for fiscal years 2016 through 2018, while 2  agencies reported that they had not achieved any savings. In addition to  that amount, 21 agencies identified a further $0.42 billion in planned  savings through fiscal year 2018—for a total of $2.36 billion in planned  cost savings from fiscal years 2016 through 2018. Nevertheless, this total  is about $0.38 billion less than OMB’s goal of $2.74 billion for overall  DCOI savings.

		Agencies Need to Better Manage Software Licenses to Achieve Savings

In our 2015 high-risk report’s discussion of IT acquisitions and operations,  we identified the management of software licenses as an area of concern,  in part because of the potential for cost savings. Federal agencies  engage in thousands of software licensing agreements annually. The  objective of software license management is to manage, control, and  protect an organization’s software assets. Effective management of these  licenses can help avoid purchasing too many licenses, which can result in  unused software, as well as too few licenses, which can result in  noncompliance with license terms and cause the imposition of additional  fees.
As part of its PortfolioStat initiative, OMB has developed a policy that  addresses software licenses. This policy requires agencies to conduct an  annual, agency-wide IT portfolio review to, among other things, reduce  commodity IT spending. Such areas of spending could include software  licenses.
In May 2014, we reported on federal agencies’ management of software  licenses and determined that better management was needed to achieve  significant savings government-wide. Of the 24 selected agencies we  reviewed, only 2 had comprehensive policies that included the  establishment of clear roles and central oversight authority for managing  enterprise software license agreements, among other things. Of the  remaining 22 agencies, 18 had policies that were not comprehensive, and  4 had not developed any policies.
Further, we found that only 2 of the 24 selected agencies had established  comprehensive software license inventories, a leading practice that would  help them to adequately manage their software licenses. The inadequate  implementation of this and other leading practices in software license  management was partially due to weaknesses in agencies’ policies. As a  result, we concluded that agencies’ oversight of software license  spending was limited or lacking, thus potentially leading to missed  savings. However, the potential savings could be significant considering  that, in fiscal year 2012, 1 major federal agency reported saving  approximately $181 million by consolidating its enterprise license  agreements, even when its oversight process was ad hoc.
Accordingly, we recommended that OMB issue a directive to help guide  agencies in managing software licenses. We also made 135  recommendations to the 24 agencies to improve their policies and  practices for managing licenses. Among other things, we recommended  that the agencies regularly track and maintain a comprehensive inventory  of software licenses and analyze the inventory to identify opportunities to  reduce costs and better inform investment decision making.
Most agencies generally agreed with the recommendations or had no  comments. As of December 2018, 27 of the 135 recommendations had  not been implemented. Table 2 reflects the extent to which the 24  agencies implemented the recommendations in these two areas.

	Agencies Need to Address Shortcomings in Information Security Area

Since information security was added to the high-risk list in 1997, we  have consistently identified shortcomings in the federal government’s  approach to cybersecurity. In particular, in a September 2018 report, we  identified four major cybersecurity challenges: (1) establishing a  comprehensive cybersecurity strategy and performing effective oversight,  (2) securing federal systems and information, (3) protecting cyber critical  infrastructure, and (4) protecting privacy and sensitive data.
To address these challenges, we identified 10 critical actions that the  federal government and other entities need to take. For example, in order  to address the challenge of securing federal systems and information, we  identified 3 actions that the agencies should take: (1) improve  implementation of government-wide cybersecurity initiatives, (2) address  weaknesses in federal information security programs, and (3) enhance  the federal response to cyber incidents. Figure 6 depicts the 10 critical  actions to address the four major cybersecurity challenges.
As we have previously noted, in order to strengthen the federal  government’s cybersecurity posture, agencies should fully implement the  information security programs required by FISMA. In this regard, FISMA  provides a framework for ensuring the effectiveness of information  security controls for federal information resources. The law requires each  agency to develop, document, and implement an agency-wide information  security program. Such a program should include risk assessments; the  development and implementation of policies and procedures to cost- effectively reduce risks; plans for providing adequate information security  for networks, facilities, and systems; security awareness and specialized  training; the testing and evaluation of the effectiveness of controls; the  planning, implementation, evaluation, and documentation of remedial  actions to address information security deficiencies; procedures for  detecting, reporting, and responding to security incidents; and plans and  procedures to ensure continuity of operations.
Since fiscal year 2010, we have made over 3,000 recommendations to  agencies aimed at addressing the four cybersecurity challenges. These  recommendations have identified actions for agencies to take to  strengthen technical security controls over their computer networks and  systems. They also have included recommendations for agencies to fully  implement aspects of their information security programs, as mandated  by FISMA. Nevertheless, many agencies continue to be challenged in  safeguarding their information systems and information, in part, because  many of these recommendations have not been implemented. Of the  roughly 3,000 recommendations made since 2010, 73 percent had been  implemented as of November 2018; leaving 688 recommendations  unimplemented.

		Agencies’ Inspectors General Are to Identify Information Security Program Weaknesses

In order to determine the effectiveness of the agencies’ information  security programs and practices, FISMA requires federal agencies’  inspectors general to conduct annual independent evaluations. The  agencies are to report the results of these evaluations to OMB, and OMB  is to summarize the results in annual reports to Congress.
In these evaluations, the inspectors general are to frame the scope of  their analyses, identify key findings, and detail recommendations to  address the findings. The evaluations also are to capture maturity model  ratings for their respective agencies. Toward this end, in fiscal year 2017,  the inspector general community, in partnership with OMB and DHS,  finalized a 3-year effort to create a maturity model for FISMA metrics. The  maturity model aligns with the five function areas in the NIST Framework  for Improving Critical Infrastructure Cybersecurity (Cybersecurity  Framework): identify, protect, detect, respond, and recover. This  alignment is intended to help promote consistent and comparable metrics  and criteria and provide agencies with a meaningful independent  assessment of their information security programs.
The maturity model is designed to summarize the status of agencies’  information security programs on a five-level capability maturity scale.  The five maturity levels are defined as follows:
Level 1 Ad-hoc: Policies, procedures, and strategy are not formalized;  activities are performed in an ad-hoc, reactive manner.
Level 2 Defined: Policies, procedures, and strategy are formalized and  documented but not consistently implemented.
Level 3 Consistently Implemented: Policies, procedures, and strategy are  consistently implemented, but quantitative and qualitative effectiveness  measures are lacking.
Level 4 Managed and Measurable: Quantitative and qualitative measures  on the effectiveness of policies, procedures, and strategy are collected  across the organizations and used to assess them and make necessary  changes.
Level 5 Optimized: Policies, procedures, and strategy are fully  institutionalized, repeatable, self-generating, consistently implemented  and regularly updated based on a changing threat and technology  landscape and business/mission needs.
In March 2018, OMB issued its annual FISMA report to Congress, which  showed the combined results of the inspectors general’s fiscal year 2017  evaluations. Based on data from 76 agency inspector general and  independent auditor assessments, OMB determined that the  government-wide median maturity model ratings across the five NIST  Cybersecurity Framework areas did not exceed a level 3 (consistently  implemented). Table 3 shows the inspectors general’s median ratings for  each of the NIST Cybersecurity Framework areas.

		OMB Requires Agencies to Meet Targets for Cybersecurity Metrics

In its efforts toward strengthening the federal government’s cybersecurity,  OMB also requires agencies to submit related cybersecurity metrics as  part of its Cross-Agency Priority goals. In particular, OMB developed the  IT modernization goal so that federal agencies will be able to build and  maintain more modern, secure, and resilient IT. A key part of this goal is  to reduce cybersecurity risks to the federal mission through three  strategies: manage asset security, protect networks and data, and limit  personnel access. The key targets supporting each of these strategies  correspond to areas within the FISMA metrics. Table 4 outlines the  strategies, their associated targets, and the 23 civilian CFO Act agencies’  progress in meeting those targets, as of June 2018.
In conclusion, FITARA and FISMA present opportunities for the federal  government to address the high-risk areas on improving the management  of IT acquisitions and operations and ensuring the security of federal IT,  thereby saving billions of dollars. Most agencies have taken steps to  execute key IT management and cybersecurity initiatives, including  implementing CIO responsibilities, requiring CIO reviews of IT  acquisitions, realizing data center consolidation cost savings, managing  software assets, and complying with FISMA requirements. The agencies  have also continued to address the recommendations that we have made  over the past several years. However, further efforts by OMB and federal  agencies to implement our previous recommendations would better  position them to improve the management and security of federal IT. To  help ensure that these efforts succeed, we will continue to monitor  agencies’ efforts toward implementing the recommendations.
Chairmen Meadows and Hurd, Ranking Members Connolly and Kelly,  and Members of the Subcommittees, this completes my prepared  statement. I would be pleased to respond to any questions that you may  have.

	GAO Contacts and Staff Acknowledgments

If you or your staff have any questions about this testimony, please  contact Carol C. Harris, Director, Information Technology, at (202) 512- 4456 or harriscc@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this statement. GAO staff who made key contributions to this testimony  are Kevin Walsh (Assistant Director), Chris Businsky, Rebecca Eyler,  Meredith Raymond, and Jessica Waselkow (Analyst in Charge).
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.


Input:
	Background

		Post-9/11 GI Bill Benefits

VA has been providing veterans educational assistance benefits since  1944. We previously reported that these benefits have been put in place  over time to compensate for compulsory service, encourage voluntary  service, avoid unemployment, provide equitable benefits to all who  served, and promote military retention. The Post-9/11 GI Bill, which took  effect on August 1, 2009, is now VA’s largest educational program. This  program generally provides benefits to veterans who served on active  duty for at least 90 days beginning on or after September 11, 2001. Full  benefits are generally available to those who served on active duty for 36  months, for which VA will pay the net cost for in-state tuition and fees at  public schools and up to an annual maximum amount at nonprofit and for- profit schools ($24,477 in academic year 2019-2020). VA pays schools  directly for tuition and fees and sends additional payments for housing  and books directly to veterans who are eligible for these payments. To  receive education benefits through the Post-9/11 GI Bill, students submit  applications to VA, schools certify enrollments, and VA processes claims  and payments.

		Other Sources of Student Aid

For help covering the costs of their postsecondary education, veterans  may also be eligible for grants and loans available from federal student  aid programs administered by Education, such as Pell Grants and Direct  Loans. According to Education data, an estimated 32 percent of student  veterans had received Pell Grants and 28 percent had taken out Direct  Loans, during school year 2015-16. VA education payments, such as  Post-9/11 GI Bill benefits, are not considered when calculating eligibility  for federal student aid and do not affect the amount of aid a veteran can  receive from Education. Student veterans may also be eligible for state  and institutional aid (scholarships from state governments or schools, for  example).

	Student Veterans Attend a Wide Range of Schools, but a Small Number of Schools Receive a Large Share of Post- 9/11 GI Bill Payments

Nearly 700,000 student veterans received Post-9/11 GI Bill tuition and fee  benefits to attend almost 6,000 schools in fiscal year 2017. VA paid  about 40 percent of the Post-9/11 GI Bill tuition and fee payments to  public schools, 30 percent to nonprofits, and 30 percent to for-profits (see  fig. 1).
Most student veterans used Post-9/11 GI Bill tuition and fee payments to  attend schools that provided 4-year undergraduate programs (see fig. 2).  Veterans may also use Post-9/11 GI Bill benefits for training opportunities  at schools that do not offer college degrees, including training in areas  such as driving, emergency medical training, and barber or beautician  skills. These programs received about $360 million Post-9/11 GI bill  tuition and fee payments in fiscal year 2017.
A relatively small number of schools received a large share of Post-9/11  GI Bill tuition and fee payments. In fiscal year 2017, the 50 schools that  received the highest total amount of Post-9/11 GI Bill tuition and fee  payments accounted for over 30 percent of all such benefits, collectively  receiving $1.4 billion for over 190,000 beneficiaries. These 50 schools  consisted of 14 public, 16 nonprofit, and 20 for-profit schools (see fig. 3).  In fiscal year 2017, the 50 schools received between $11 million and  $191 million each in tuition and fee payments and enrolled between  around 350 and 28,000 Post-9/11 GI Bill beneficiaries. In contrast, among  all schools receiving Post-9/11 GI Bill benefits in fiscal year 2017, the  majority of them enrolled fewer than 15 veterans.

	Student Outcomes Varied Among Schools That Received a Large Share of Post-9/11 GI Bill Payments

Student outcomes at the 50 schools that received the most Post-9/11 GI  Bill tuition and fee payments were, on average, generally comparable to  the national average, but varied more widely across sectors. Since  available data on student veteran outcomes is currently limited, we  analyzed common outcome measures for the broader student populations  at each school:
4-year program graduation rates: the percent of first-time full-time  students who completed a 4-year program within 6 years.
Full- and part-time retention rates: the percent of first-time students  who enrolled in one fall and either successfully completed their  program or re-enrolled in the next fall.
When examined as a whole, the average student outcomes for the 50  schools that received the most Post-9/11 GI Bill tuition and fee payments  were generally comparable to the national average. For example, the  average 4-year program graduation rate at the top 50 schools was 61— the same as the national average. For one of the outcome measures— full-time retention rate—the average was higher for the top 50 schools (83  percent) than the national average (75 percent).
Within the 50 schools that received the most Post-9/11 GI Bill tuition and  fee payments, student outcomes varied across schools in different  sectors (see fig. 4). For-profit schools had lower 4-year program  graduation and retention rates compared to public and nonprofit schools  among these 50 schools, although there was wide variation among  schools in each sector.

	School Closures Affect Thousands of Student Veterans

Although a relatively small number of schools close each year, these  closures can affect thousands of student veterans. In 2017 we reported  that about 95 schools closed in school year 2015-16, according to  Education data, which was higher than in previous years, primarily due to  a rise in for-profit school closures (see fig. 5).
Schools can close in different manners and for a variety of reasons,  including declining enrollments, financial problems, loss of accreditation,  and legal actions. When a school ceases operations in an orderly process  over several months it gives students time to complete the current school  term and make arrangements to transfer and continue their education at  another school. The effect of school closures is often worse when the  closures occur abruptly with little or no advance warning, because these  schools generally do not have time to establish transfer arrangements  that allow students to easily continue their education at another school.
Abrupt closures of large schools, although infrequent, can affect  thousands of student veterans and result in large financial losses for the  federal government and taxpayers. For example, Corinthian Colleges  Inc. (Corinthian) enrolled more than 72,000 students before its closure in  April 2015. The following year, ITT Educational Services Inc. (ITT),  another large for-profit provider of higher education, closed all of its 136  campuses in September 2016, affecting more than 35,000 students. More  than 7,000 Post-9/11 GI Bill students were pursuing educational  programs at schools operated by ITT and Corinthian at the time of their  closures, according to VA. More recently, closures at Education  Corporation of America in 2018 and Dream Center Education Holdings in  2019, which operated schools under multiple brands, including Argosy  University and several campuses of The Art Institutes, affected tens of  thousands of students, including thousands of Post-9/11 GI Bill recipients.
Student veterans attending a school that closes may be eligible to have  some or all of their Post-9/11 GI Bill benefits restored. As a result of the  Harry W. Colmery Veterans Educational Assistance Act of 2017, VA  restores GI Bill entitlements to eligible beneficiaries affected by recent  and future school closures. Student veterans may also be entitled to a  discharge on eligible federal student loans they may have received from  Education or to have their Pell Grant eligibility restored if they are unable  to complete a program because their school closed.
Despite these options for having benefits restored and loans discharged,  school closures can still create hardships for veterans. As we have  previously reported, college students in general can face challenges  transferring credits and continuing their education at a new school under  any circumstances. Students who transferred lost, on average, an  estimated 43 percent of their credits, and credit loss varied depending on  the transfer path, based on data from 2004 to 2009. For example,  students who transferred between public schools—the majority of transfer  students—lost an estimated 37 percent of their credits. In comparison,  students who transferred from for-profit schools to public schools—which  happens less frequently—lost an estimated 94 percent of their credits.  Even if a student’s credits transfer, they may not apply toward fulfilling  degree requirements for their intended major. In these cases, a student  will likely have to take additional courses at their new school, which could  potentially delay graduation and result in additional costs to pay for  repeated courses. Further, some student veterans with credits that do not  transfer may exhaust their Post-9/11 GI Bill benefits before completing  their degree.
School closures can also exacerbate other challenges veterans may face  pursuing their education. As we have previously reported, many student  veterans already cope with challenges transitioning from the military to an  academic environment. For example, they can face challenges  navigating the academic bureaucracy, whether in attempting to receive  transfer credit for previous college courses or in determining what other  sources of financial aid may be available to them. Many student veterans  are also trying to balance school with family and work obligations or  dealing with the effects of combat-related physical and psychological  injuries. When a school closes, the burden of finding and enrolling in a  new school may be especially difficult for these veterans.
Closures can also pose a financial risk for the government and taxpayers  to the extent that Post-9/11 GI benefits are restored and federal student  loans are discharged. For example, in 2017 the Congressional Budget  Office estimated that restoring Post-9/11 GI Bill benefits and other VA  education benefits to student veterans who attend schools that closed will  increase direct spending by $320 million over the 10 year period from  2018 to 2027. School closures can also result in hundreds of millions of  dollars in financial losses for the federal government and taxpayers due to  discharged federal student loans.
In conclusion, the Post-9/11 GI Bill has provided valuable education  benefits to millions of veterans who attend a wide range of schools.  However, when schools abruptly shut their doors, it can leave student  veterans—who already face unique challenges in an academic  environment—without a clear path to continuing their education and can  force taxpayers to cover the cost of restoring their benefits and  discharged student loans. Student veterans who continue their education  at another school may also find that many of the credits they earned will  not ultimately help them after they transfer, delaying their degrees and  resulting in additional costs. As the number of school closures has  increased in recent years, the risks and challenges associated with such  closures are particularly salient for student veterans, their families, and  the federal government.
Chairman Levin, Ranking Member Bilirakis, and Members of the  Subcommittee, this completes my prepared statement. I would be  pleased to respond to any questions that you may have at this time.

	GAO Contact and Staff Acknowledgements

If you or your staff have any questions about this testimony, please  contact Melissa Emrey-Arras, Director, Education, Workforce, and  Income Security Issues at (617) 788-0534 or emreyarrasm@gao.gov.  Contact points for our Offices of Congressional Relations and Public  Affairs may be found on the last page of this statement. GAO staff who  made key contributions to this testimony include Will Colvin (Assistant  Director), Brian Schwartz (Analyst-in-Charge), and Jeffrey G. Miller. In  addition, key support was provided by James Bennett, Deborah Bland,  Benjamin DeYoung, Alex Galuten, Theresa Lo, John Mingus, Corinna  Nicolaou, and Michelle St. Pierre.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.


Input:
	The Coast Guard Did Not Establish a Sound Business Case for the Polar Icebreaker Program

In September 2018, we found the Coast Guard did not have a sound  business case when it established the acquisition baselines for its polar  icebreaker program in March 2018 due to risks in four main areas— design, technology, cost, and schedule. Our prior work has found that  successful acquisition programs start with solid, executable business  cases before setting program baselines and committing resources. A  sound business case requires balance between the concept selected to  satisfy operator requirements and the resources—design knowledge,  technologies, funding, and time—needed to transform the concept into a  product, which in this case is a ship with polar icebreaking capabilities.  Without a sound business case, acquisition programs are at risk of  breaching the cost, schedule, and performance baselines set when the  program was initiated—in other words, experiencing cost growth,  schedule delays, and reduced capabilities.
At the heart of a business case is a knowledge-based approach. We have  found that successful shipbuilding programs build on attaining critical  levels of knowledge at key points in the shipbuilding process before  significant investments are made (see figure 1).
We provide additional information below on each of the four main risks  that affect the soundness of the polar icebreaker program’s business  case.

		The Coast Guard Plans to Have a Stable Design before Starting Construction but Did Not Assess Design Maturity Prior to Setting Program Baselines

The Coast Guard expressed a commitment to having a stable design for  the polar icebreaker program prior to the start of lead ship construction,  but it set the program’s baselines before conducting a preliminary design  review—a systems engineering event that is intended to verify that the  contractor’s design meets the requirement of the ship specifications and  is producible.
Shipbuilding best practices we identified in 2009 found that design  stability on a ship is achieved upon completion of the basic and functional  designs. The basic design includes fixing the ship steel structure; routing  all major distributive systems, including electricity, water, and other  utilities; and ensuring the ship will meet the performance specifications.  The functional design includes further iteration of the basic design, such  as providing information on the exact position of piping and other outfitting  in each block, and completing a 3D product model. At this point of design  stability, the shipbuilder has a clear understanding of the ship structure as  well as how every system is set up and routed throughout the ship.  Consistent with our best practices, prior to the start of construction on the  lead ship, the Coast Guard plans to require the shipbuilder to complete  basic and functional designs, develop a 3D model output, and provide at  least 6 months of production information to support the start of  construction.
Although the Coast Guard plans to have a stable design prior to ship  construction, it set the program’s acquisition program baselines prior to  gaining knowledge on the feasibility of the selected shipbuilder’s design.  Program baselines inform DHS’s and the Coast Guard’s decisions to  commit resources. Our best practices for knowledge-based acquisitions  state that before program baselines are set, programs should hold key  systems engineering events, such as a preliminary design review, to help  ensure that requirements are defined and feasible and that the proposed  design can be met within cost, schedule, and other system constraints.
The Coast Guard has yet to conduct a preliminary design review for the  program because DHS’s current acquisition policy does not require  programs to do so until after setting program baselines. However, in April  2017, we found that DHS’s sequencing of the preliminary design review is  not consistent with our acquisition best practices, which state that  programs should pursue a knowledge-based acquisition approach that  ensures program needs are matched with available resources—such as  technical and engineering knowledge, time, and funding—prior to setting  baselines. As a result, we recommended that DHS update its acquisition  policy to require key technical reviews, including the preliminary design  review, to be conducted prior to approving programs’ baselines. DHS  concurred with this recommendation and stated that it planned to initiate a  study to assess how to better align its processes for technical reviews  and acquisition decisions. Upon completion of the study, DHS plans to  update its acquisition policies, as appropriate. As of June 2018, DHS  indicated that it had completed its study and was in the process of  updating its acquisition policies. GAO will review the policies once  complete to determine if the updates meet the intent of this  recommendation.
By setting the polar icebreaker program’s baselines prior to gaining  knowledge on the shipbuilder’s design, the Coast Guard has established  cost, schedule, and performance baselines without a stable or mature  design. Although completing the preliminary design review after setting  program baselines is consistent with DHS policy, this puts the Coast  Guard at risk of breaching its established baselines and having to revise  them later in the acquisition process, after a contract has been signed  and significant resources have been committed to the program. At that  point, the program will be well underway and it will be too late for decision  makers to make appropriate tradeoff decisions between requirements and  resources without causing disruptions to the program.

		Coast Guard Intends to Use Proven Technologies for the Polar Icebreaker Program but Has Not Assessed Their Maturity

The Coast Guard intends to use what it refers to as “state-of-the-market”  or “proven” technologies for the polar icebreaker program, but it has not  yet conducted a technology readiness assessment to determine the  maturity of key technologies prior to setting program baselines. This  approach is inconsistent with our best practices for technology  readiness. A technology readiness assessment is a systematic,  evidence-based process that evaluates the maturity of critical  technologies—hardware and software technologies critical to the  fulfillment of the key objectives of an acquisition program. According to  our best practices, a technology readiness assessment should be  conducted prior to program initiation.
At the time of our earlier review, Coast Guard officials told us the polar  icebreaker program does not have any critical technologies and thus,  does not need to conduct a technology readiness assessment. From  design studies and industry engagement, Coast Guard officials  determined that the key technologies required for the polar icebreakers,  such as the integrated power plant and azimuthing propulsors, are  available commercially and do not need to be developed. Figure 2  provides additional information on the risks for these key technologies, as  well as design risks for an icebreaker’s hull form.
Coast Guard officials stated that the integrated power plant is the  standard power plant used on domestic and foreign icebreakers. Coast  Guard officials told us that similarly, market survey data on azimuthing  propulsors show that ice-qualified azimuthing propulsors in the power  range required have been used on foreign icebreakers.
However, according to our best practices, critical technologies are not just  technologies that are new or novel. Technologies used on prior systems  can also become critical if they are being used in a different form, fit, or  function. Based on our analysis of available Coast Guard information, we  believe the polar icebreaker program’s planned integrated power plant  and azimuthing propulsors should be considered critical technologies  given their criticality in meeting key performance parameters, how the  technologies are being reapplied to a different operational environment  from prior uses of the technologies, and the extent to which they pose  major cost risks. By not conducting a technology readiness assessment  and identifying, assessing, and maturing its critical technologies prior to  setting the program’s program baselines, the Coast Guard is potentially  underrepresenting technical risk and understating its cost, schedule, and  performance risks.

		Polar Icebreaker Program’s Cost Estimate Substantially Met Best Practices but Is Not Fully Reliable

We found that the Navy’s lifecycle cost estimate used to inform the polar  icebreaker program’s $9.827 billion cost baseline substantially adheres to  most of our cost estimating best practices; however, the estimate is not  fully reliable. The cost estimate is not fully reliable because it only  partially met best practices for being credible. Highlights from our  assessment of the polar icebreaker program’s lifecycle cost estimate are  detailed below:
Comprehensive: substantially met. The estimate includes  government and contractor costs over the full lifecycle of all three  ships and documents detailed ground rules and assumptions, such as  the learning curve used to capture expected labor efficiencies for  follow-on ships. However, the costs for disposal of the three ships  were not at a level of detail to ensure that all costs were considered  and not all assumptions, particularly regarding operating and support  costs, were varied to reflect the impact on cost should these  assumptions change.
Well-documented: substantially met. The estimate’s documentation  mostly captured the source data used as well as the primary methods,  calculations, results, rationales, and assumptions used to generate  each cost element. However, the documentation alone did not provide  enough information for someone unfamiliar with the cost estimate to  replicate what was done and arrive at the same results.
Accurate: substantially met. The estimate was properly adjusted for  inflation, and we did not find any mathematical errors in the estimate  calculations we inspected. Officials stated that labor and material cost  data from recent, analogous programs were used in the estimate.  While the documentation does not discuss the reliability, age, or  relevance of the cost data, Navy officials provided us with additional  information regarding those data characteristics.
Credible: partially met. The Navy only modeled cost variation in the  detail design and construction portion of the program and excluded  from its analyses any risk impacts related to the remainder of the  acquisition, operating and support, and disposal phases, which  altogether comprise about 75 percent of the lifecycle cost. Without  performing a sensitivity analysis on the entire life cycle cost of the  three ships, it is not possible for the Navy to identify key elements  affecting the overall cost estimate. Further, without performing a risk  and uncertainty analysis on the entire life cycle cost of the three ships,  it is not possible for the Navy to determine a level of confidence  associated with the overall cost estimate.
By not quantifying important risks, the Navy may have underestimated the  range of possible costs for about three-quarters of the entire program.  The estimate provides an overly optimistic assessment of the program’s  vulnerability to cost growth should risks be realized or current  assumptions change. This, in turn, may underestimate the lifecycle cost  of the program.

		Polar Icebreaker Program’s Optimistic Schedule Is Driven by Capability Gap and Does Not Reflect Robust Analysis

The Coast Guard’s planned delivery dates of 2023, 2025, and 2026 for  the three ships were not informed by a realistic assessment of  shipbuilding activities, but rather were primarily driven by the potential  gap in icebreaking capabilities once the Polar Star reaches the end of its  service life (see figure 3).
The Polar Star’s service life is estimated to end between fiscal years 2020  and 2023. This creates a potential heavy polar icebreaker capability gap  of about 3 years, if the Polar Star’s service life were to end in 2020 and  the lead polar icebreaker were to be delivered by the end of fiscal year  2023 as planned. If the lead ship is delivered later than planned in this  scenario, the potential gap could be more than 3 years. The Coast Guard  is planning to recapitalize the Polar Star’s key systems starting in 2020 to  extend the service life of the ship until the planned delivery of the second  polar icebreaker (see figure 4).
Further, we compared the program’s planned construction schedule to  the construction schedules of delivered lead ships for major Coast Guard  and Navy shipbuilding programs active in the last 10 years as well as the  Healy, the Coast Guard’s only medium polar icebreaker. We found that  the polar icebreaker’s lead ship construction cycle time of 2.5 to 3 years is  optimistic, as only 3 of the 10 ships in our analysis were constructed in 3  years or less. Further, as another point of comparison, the Healy was  constructed in just under 4.5 years.
An unrealistic schedule puts the Coast Guard at risk of not delivering the  icebreakers when promised and the potential gap in icebreaking  capabilities could widen. Just as importantly, our prior work on  shipbuilding programs has shown that establishing optimistic program  schedules based on insufficient knowledge can create pressure for  programs to make sacrifices elsewhere, which can lead to work being  performed concurrently, costly rework, and further delays.
To address the risks we identified and establish a sound business case,  we made a number of recommendations in our September 2018 report to  DHS, Coast Guard, and the Navy, including:
Conducting a technology readiness assessment in accordance with  best practices, identifying critical technologies, and developing a plan  to mature any technologies not designated to be mature before detail  design of the lead ship begins;
Updating the program’s cost estimate in accordance with best  practices before the contract option for construction of the lead ship is  awarded;
Developing a program schedule in accordance with best practices to  set realistic schedule goals for all three ships before the contract  option for construction of the lead ship is awarded; and
Updating the program’s acquisition program baselines prior to  authorizing lead ship construction, after completion of the preliminary  design review, and after it has gained the requisite knowledge on its  technologies, cost, and schedule.
DHS concurred with all of our recommendations and identified actions it  planned to take to address them. For example, earlier this month, the  Coast Guard indicated that it has identified a preliminary list of potential  critical technologies and is in the process of developing a technology  readiness assessment plan. The Coast Guard also plans to update the  program’s cost estimate within 8 months of the contract award and  update the program schedule within 3 months of the contract award.

	How the Polar Icebreaker Program Will Be Funded Moving Forward is Unclear

Of the $9.827 billion estimated for the lifecycle costs of the polar  icebreaker program, about $3 billion is for acquisition costs. From 2013  through 2018, the polar icebreaker program has received $360 million in  funding—$60 million in Coast Guard appropriations and $300 million in  Navy appropriations. In addition, according to Coast Guard officials, in  fiscal year 2017, Coast Guard reprogrammed $30 million in fiscal year  2016 appropriations for the polar icebreaker program from another  program (see figure 5).
According to Coast Guard and Navy officials, the Navy plans to use the  $300 million in Navy appropriations in fiscal year 2019 to fund the  advanced planning, design, engineering, and long lead time materials for  the first polar icebreaker. As part of the polar icebreaker program’s  acquisition strategy and reflected in the March 2018 request for  proposals, the Navy plans to establish options for the subsequent detail  design and construction of each of the three ships. The request for  proposals specified that the options will be priced as fixed-price incentive  type (see table 1).
The Navy did not request any funding in fiscal year 2019 for the polar  icebreaker program, while Coast Guard requested $30 million.  Subsequently, after discretionary budget caps were relaxed by Congress,  the administration’s fiscal year 2019 budget addendum requested an  additional $720 million in fiscal year 2019 Coast Guard appropriations for  the program. As the program prepares to award a contract in fiscal year  2019 worth billions of dollars if all the options are exercised, it is unclear  to what extent the program will be funded using Coast Guard or Navy  appropriations or how much total funding will be provided.
In conclusion, as the Coast Guard embarks on the acquisition of its new  polar icebreakers to address capability gaps in the Arctic and Antarctic  regions, it faces a number of key acquisition and funding risks. DHS, the  Coast Guard, and the Navy must gain key acquisition knowledge before  committing significant resources to the program while Congress faces key  funding and tradeoff considerations. To put the polar icebreaker program  in a position to succeed, Congress and the agencies must remain  committed to establishing and executing a sound business case for the  program.
Chairman Mast, Ranking Member Garamendi, and Members of the  Subcommittee, this concludes my prepared statement. I would be  pleased to respond to any questions.

	GAO Contact and Staff Acknowledgments

If you or your staff have any questions about this statement, please  contact Marie A. Mak, (202) 512-4841 or makm@gao.gov. In addition,  contact points for our Offices of Congressional Relations and Public  Affairs may be found on the last page of this statement. Individuals who  made key contributions to this testimony include Rick Cederholm,  Assistant Director; Peter Anderson; Kurt Gurka; Claire Li; and Roxanna  Sun.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.


Input:
T he constitutional system of checks and balances and the separation of powers among the legislative, executive, and judicial branches is a cornerstone of the American system of government. By separating and checking powers in this way, the Framers hoped to prevent any person or group from seizing control over the nation's government. For example, the Framers checked congressional legislative power by providing the President the power to veto legislation and, in turn, checked the President's veto power by providing Congress a means to override that veto. Over time, it has become clear that the presidential veto power, even when not formally exercised, provides the President with an important tool to engage in the legislative process.
Most Presidents have exercised their veto power in an effort to block legislation. Of 45 Presidents, 37 have exercised their veto power. As of the end of 2019, Presidents have issued 2,580 vetoes, and Congress has overridden 111. President George W. Bush vetoed 12 bills during his presidency. Congress attempted to override six of them and succeeded four times. President Barack Obama also vetoed 12 bills during his presidency. Congress attempted to override six of them and succeeded once.
Presidents have also attempted to influence the shape of legislation through the use of veto threats. Since the 1980s, formal, written Statements of Administration Policy (SAPs, pronounced "saps") have frequently been used to express the President's support for or opposition to particular pieces of legislation. SAPs sometimes threaten to use the veto power if the legislation reviewed reaches the President's desk in its current form. Among the George W. Bush Administration (2001-2009) and the Obama Administration (2009-2017) SAPs examined later in this report, for example, 24% and 48%, respectively, contained a veto threat.
This report begins with a brief discussion of the veto power and Congress's role in the veto process. It then examines the ways Presidents communicate their intention to veto, oppose, or support a bill. The report then provides and discusses summary data on veto threats and vetoes during the Bush and Obama Administrations.

	The President's Veto Power

As specified by the U.S. Constitution (Article I, Section 7), the President has 10 days, Sundays excepted, to act once he has been presented with legislation that has passed both houses of Congress and either reject or accept the bill into law. Within those 10 days, Administration officials consider various points of view from affected agencies (as is the case throughout the legislative process) and recommend a course of action to the President regarding whether or not to veto the presented bill.
The President has three general courses of action during the 10-day presentment period: The President may sign the legislation into law, take no action and allow the bill to become law without signature after the 10 days, or reject the legislation by exercising the office's veto authority.
The President may reject legislation in two ways. The President may veto the bill and "return it, with his Objections to that House in which it shall have originated." This action is called a "regular" or "return" veto (hereinafter return veto). Congress typically receives the objections to the bill in a written veto message.
If Congress has adjourned during the 10-day period, the President might also reject the legislation through a "pocket veto." This occurs when the President retains, but does not sign, presented legislation during the 10-day period, with the understanding that the President cannot return the bill to a Congress that has adjourned. Under these circumstances, the bill will not become law. A pocket veto is typically marked by a type of written veto message known as a "Memorandum of Disapproval." As discussed in greater detail below, this practice has sometimes been controversial, because arguably it prevents Congress from attempting to override the President's veto.

	Congress's Response

A President's return veto may be overridden, or invalidated, by a process provided for in Article 1, Section 7, of the U.S. Constitution. To override a return veto, Congress may choose to "proceed to reconsider" the bill. Passage by two-thirds of Members in each chamber is required to override a veto before the end of the Congress in which the veto is received. Neither chamber is under any constitutional, legal, or procedural obligation to conduct an override vote. It is not unusual for either chamber of Congress to make no effort to override the veto if congressional leaders do not believe they have sufficient votes to do so.
If a two-thirds vote is successful in both chambers, the President's return veto is overridden, and the bill becomes law. If a two-thirds vote is unsuccessful in one or both chambers, the veto is sustained, and the bill does not become law.
In contrast, Congress cannot override the President's pocket veto. By definition, a pocket veto may occur only when a congressional adjournment prevents the return of the vetoed bill. If a bill is pocket vetoed while Congress is adjourned, the only way for Congress to pass a version of the policy contained in the vetoed bill is to reintroduce the legislation as a new bill, pass it through both chambers, and present it to the President again for signature. Recent Presidents and Congresses have disagreed about what constitutes an adjournment that prevents the return of a bill such that a pocket veto may be used.
For purposes of the sections below concerning the use of veto threats, the unit of analysis is a veto. The analysis does not distinguish between regular and pocket vetoes.

	Veto Threats in the Legislative Process

Because Congress faces a two-thirds majority threshold to override a President's veto, veto threats may deter Congress from passing legislation that the President opposes. The veto override threshold may also prompt Congress to change a bill in response to a veto threat. The Framers of the U.S. Constitution viewed the veto power as a way of reminding Congress that the President also plays an important legislative role and that threatening to use the veto power can influence legislators into creating more amenable bills. Political scientist Richard A. Watson writes that "the veto is available to a President as a general weapon in his conflicts with Congress: Franklin Roosevelt sometimes asked his aides for 'something I can veto' as a lesson and reminder to congressmen that they had to deal with a President."
Veto threats are, therefore, an important component in understanding the use of the President's veto power. In recent presidencies, these threats have generally been expressed either through SAPs or verbally. President Trump has also used social media to communicate his intention to veto, oppose, or support a bill.

		Signaling Policy Intentions Before a Veto

Presidents may signal their intention to support, oppose, or veto a bill early in the legislative process using both verbal and written means. For example, Presidents can mention in a speech that they intend to veto legislation, or they can authorize others (such as a press secretary) to verbally indicate the Administration's position on specific legislation. Presidents can also issue, through the Office of Management and Budget (OMB), formal, written SAPs to communicate their intention to veto, oppose, or support a bill.

			Verbal Veto Threats

Verbal veto threats may include commentary related to the President's strategy for working with Congress along with a threat to veto legislation if the President's policy agenda is not heeded. For example, at a press conference President George W. Bush explained, "I want the Members of Congress to hear that once we set a budget we're going to stick by it. And if not, I'm going to use the veto pen of the President of the United States to keep fiscal sanity in Washington, D.C." In another instance, President Obama said that the House "is trying to pass the most extreme and unworkable versions of a bill that they already know is going nowhere, that can't pass the Senate and that if it were to pass the Senate I would veto. They know it." In these remarks, both President Bush and President Obama used their words to attempt to deter Congress from passing bills that did not match the President's policy agenda and unambiguously remind the public of their veto power.

			Written Veto Threats

Formal, written SAPs are frequently used to express the President's support for or opposition to particular pieces of legislation. The decision to issue a SAP is a means for the President to insert the Administration's views into the legislative debate. While SAPs provide Presidents an opportunity to assert varying levels of support for or against a bill, perhaps the most notable statement in a SAP is whether the Administration intends to veto the bill. Members of Congress may pay particular attention to a SAP when a veto threat is being made. At least one congressional leader has characterized SAPs as forerunner indicators of a veto.
SAPs are often the first public document outlining the Administration's views on pending legislation and allow for the Administration to assert varying levels of support for or opposition to a bill. Because written threats are typically required to be scrutinized by the Administration through the central legislative clearance process in advance of their release, written SAP veto threats are often considered more formal than verbal veto threats.
When a SAP indicates that the Administration may veto a bill, it appears in one of two ways:
1. A statement indicating that the President intends to veto the bill (hereinafter a presidential veto threat) or 2. A statement that agencies or senior advisors would recommend that the President veto the bill (hereinafter a senior advisors veto threat).
These two types of SAPs indicate degrees of veto threat certainty. Generally speaking, a presidential veto threat signals the President's strong opposition to the bill. A senior advisors veto threat, on the other hand, may signal that the President may be more likely to enter into negotiations in order to reach a compromise with Congress on the bill.
By publicly issuing a veto threat, the President may leverage public pressure upon Congress to support the President's agenda. Furthermore, many SAPs propose a compromise to Congress wherein the President would not exercise a veto. In addition, a President or an Administration's senior advisors may not always issue a veto threat prior to a decision to veto passed legislation. As discussed below, both Presidents Bush and Obama vetoed legislation for which they never issued a written veto threat.

	Veto Threats Within Different SAP Types

During both the Obama and Bush Administrations, roughly three-quarters of SAPs issued were on non-appropriations bills, and roughly one-quarter concerned appropriations bills. Each SAP signaled the Administration's intent to veto, oppose, or support a bill. There are fundamental differences between non-appropriations bill SAPs and appropriations bill SAPs.
Non-appropriations bill SAPs typically involve specific policy objections, such as how a program operates or what constituency the program is designed to serve. Appropriations bill SAPs, in contrast, often involve more general budgetary policy objections, such as the perceived need to balance the budget or to reallocate resources for other purposes. Therefore, the President may generally support a particular provision in an appropriations bill on programmatic policy grounds but oppose it for budgetary reasons. Or the President may oppose a particular provision in an appropriations bill for both programmatic and budgetary reasons.
This report focuses on the impact of the President's veto threat in non-appropriations bill SAPs given their more targeted nature.

	Veto Threats During the George W. Bush and Obama Administrations

Data in this report were compiled from SAPs located on the archived White House websites of the Bush and Obama Administrations. Using the classification of SAPs on each website, analysis was conducted with only non-appropriations SAPs for reasons described above. The analysis examined each SAP and individually assessed whether the SAP contained a veto threat, the type of threat (presidential or senior advisor), and whether the veto threat concerned a part of the bill or the whole bill. The analysis considers each SAP to be an individual veto threat. In instances where one bill received veto threats in multiple SAPs, veto threats were counted individually and not combined. To assess the final outcome of bills, the analysis used information on bill statuses located at Congress.gov and does not track whether bills that received a SAP were later combined into other legislative vehicles. The inherent limitations in this methodology make it difficult to determine direct effects of any veto threat on the final outcome of a bill. However, in the aggregate, general trends may be observed.
The proportion of non-appropriation bill SAPs with veto threats steadily increased over the course of each of the two presidencies reviewed. SAPs containing veto threats as a proportion of all SAPs was at its highest at the conclusion of both President Bush's and President Obama's second terms. Figure 1 illustrates this trend by showing SAP veto threats as a percentage of issued SAPs.

		George W. Bush Administration Veto Threats

While the Bush Administration remained relatively consistent in the number of veto threats issued in SAPs during its first six years, the number of threats increased during the final two years of the Administration. The Bush Administration issued a total of 491 SAPs on non-appropriations bills. Just under one-quarter (24%) of the non-appropriations bill SAPs contained a veto threat: 24 presidential veto threats and 94 senior advisors veto threats. Of bills that received a presidential veto threat, one was signed by the President, seven were vetoed, and the remaining 16 did not make it to the President's desk. Of bills that received a senior advisors veto threat, 16 were signed, one was vetoed, and the remaining 77 were not passed by both chambers. Seven of the 12 Bush Administration vetoes were preceded by a SAP containing a veto threat.
While the number of veto threats in SAPs slowly increased during the first three Congresses of the Bush Administration (two in the 107 th Congress, three in the 108 th Congress, and seven in the 109 th Congress), the number of veto threats grew sharply in the 110 th Congressâto 107 veto threatsâcoinciding with Democrats gaining control of both chambers of Congress during the Republican President's final two years in office. This might suggest (and is supported by Obama Administration data) that the partisan constitution of Congress, as well as whether the Administration is in its first or second term, may impact the number of veto threats issued. Below, Figure 2 illustrates this change in the number of veto threats over time across the four Congresses associated with President Bush's two terms in office.
Nevertheless, presidential veto threats in the Bush Administration remained a fraction of overall veto threats and often resulted in an actual veto. The rarity with which the Bush Administration issued presidential veto threats suggests that the Administration viewed them as a message to be used sparingly.
Although the relationship between Congress and a President may change every two years with each new Congress, the relationship between an Administration and its President may also change by presidential term. Compared to a President's first term, in a second term Administration, executive branch officials may become more adept in coordinating the veto power. Additionally, a second-term President cannot be re-elected, which may allow the Administration to take a stronger position on unfavorable legislation. Alternatively, it could be that the President lacks the political influence necessary to advance his legislative agenda and instead relies on veto power to block legislative vehicles more often as his presidency concludes. Figure 3 presents veto threat percentages by presidential term for the Bush Administration, showing an increase in the President's second term.
During President Bush's first term (2001-2005), 98% of SAPs did not contain a veto threat, 1% contained a senior advisors veto threat, and 1% contained a presidential veto threat. During President Bush's second term (2005-2009), 60% did not contain a veto threat, 32% contained a senior advisors veto threat, and 8% contained a presidential veto threat.

		Obama Administration Veto Threats

In comparison to the Bush Administration, the Obama Administration steadily increased its use of veto threats issued in SAPs in every subsequent Congress. The Obama Administration issued 472 SAPs on non-appropriations bills. Just under half (48%) of these contained a veto threat: 43 presidential veto threats and 186 senior advisors veto threats. Of bills that received a presidential veto threat, four were ultimately signed by the President, five were vetoed, and 34 did not make it to the President's desk. Of bills that received a senior advisors veto threat, 17 were signed, two were vetoed, and 167 were not passed by the two chambers. Six of the 12 Obama Administration vetoes were preceded by a SAP containing a veto threat.
President Obama (a Democrat) issued more veto threats in his SAPs with each passing Congress. (Democrats controlled both chambers during the 111 th Congress and the Senate during the 112 th Congress, and Republicans controlled the House during the 113 th Congress and both chambers during the 114 th Congress. ) Below, Figure 4 illustrates this change in the number of veto threats over time by Congress.
Although the number of veto threats increased over the course of the Obama presidency (eight in the 111 th Congress, 54 in the 112 th Congress, 63 in the 113 th Congress, and 104 in the 114 th Congress), the number of presidential veto threats remained small when compared to the total number of veto threats, varying from a low of 14.3% in the 111 th Congress to a high of 28.3% in the 114 th Congress. The increase over time in total number of veto threats may indicate that President Obama was presented with more legislation he was likely to oppose. However, the increase is mostly composed of senior advisors veto threats. This suggests that the Administration nonetheless treated presidential veto threats, compared to senior advisors veto threats, as a tool to be used more rarely.
As with the Bush Administration, President Obama's use of veto threats in the first and second terms differ. Figure 5 presents veto threat percentages by presidential term as opposed to by Congress.
During President Obama's first term (2009-2013), 69% of SAPs did not contain a veto threat, 27% contained a senior advisors veto threat, and 4% contained a presidential veto threat. During President Obama's second term (2013-2017), 39% of SAPs did not contain a veto threat, 49% contained a senior advisors veto threat, and 13% contained a presidential veto threat.

	Congressional Responses to Veto Threats

CRS analyzed all veto threats contained in SAPs on non-appropriations legislation across these two Administrations and determined whether the veto threat was isolated to a provision of the bill (a partial bill veto threat) or if the veto threat was not particularized (a whole bill veto threat).
President Bush issued partial bill veto threats and whole bill veto threats an equal amount of the time. However, the type of threat he used in each category varied. Of partial bill veto threats, 7% were presidential veto threats and the remaining 93% were senior advisors veto threats. Of whole bill veto threats, 34% were presidential veto threats and the remaining 66% were senior advisors veto threats.
In contrast, President Obama issued partial bill veto threats more sparingly (8% versus 92% for whole bill veto threats). Similar to President Bush, however, of partial bill veto threats, 6% were presidential veto threats and the remaining 94% were senior advisors veto threats. Of whole bill veto threats, 20% were presidential veto threats and the remaining 80% were senior advisors veto threats.
The difference in frequency of partial and whole bill veto threats across the Administrations may suggest that the two Presidents viewed the use of veto threats differently: One President may have used partial threats to negotiate more with Congress, whereas another President preferred to threaten a veto only when he viewed an entire bill as unfavorable. Likewise, the increased frequency of partial bill senior advisors veto threats suggests that both Presidents preferred to use presidential veto threats in rejecting an entire bill and leaving senior advisors veto threats for negotiations where only part of a bill is unfavorable.

		Legislative Action Following a Veto Threat

A presidential veto threat in a SAP may be more likely than a senior advisors veto threat to deter passage of a bill because of the President's direct association with the threat. However, an analysis of these two Administrations does not necessarily support this argument. Figure 6 shows that bills appeared less likely to pass when the bill received a senior advisors veto threat versus a presidential veto threat. This may be due to a number of factors, including that senior advisors threats are more frequently issued than presidential veto threats (279 senior advisors threats and 67 presidential veto threats were issued across these two presidencies) or that Congress may perceive it to be beneficial to pass presidentially threatened legislation anyway based on certain political calculations and circumstances.

	Veto Threats and Veto Patterns

During the Bush and Obama Administrations, enrolled bills that passed both chambers and were met with a presidential veto threat SAP were vetoed more often than were those that were met with a senior advisors threat. Figure 7 shows the outcomes of bills receiving veto threats that were passed by Congress and sent to the President. Across both the Bush and Obama Administrations, a bill that received a presidential veto threat and was passed was followed by a veto 70.6% of the time, whereas a bill that received a senior advisors veto threat was later vetoed 8.3% of the time.
When a President vetoes a bill, it marks the end of the President's ability to procedurally affect whether or not a bill becomes law. Whether or not that specific bill becomes law is no longer in the President's hands. Congress may or may not elect to attempt an override.

		George W. Bush Administration Vetoes and Ensuing Congressional Action

President Bush exercised the veto power 12 times. Four of these vetoes were overridden. Six vetoed bills were forewarned with a written veto threat. (Four received a presidential threat, and two received senior advisors threats.) Three additional bills received statements noting the Administration's opposition to the bill but did not include a veto threat. None of the bills that Congress later overrode were preceded by a presidential veto threat.
Three-quarters of President Bush's vetoes (9 of 12) were preceded by a written statement of opposition to the bill. President Bush also issued multiple written veto threats on four bills that would later receive a veto: Three bills received two threats each, and one bill received two statements of opposition.

		Obama Administration Vetoes and Ensuing Congressional Action

President Obama vetoed 12 bills, and Congress overrode his veto once. As was true for President Bush, six of President Obama's vetoes were preceded by a written veto threat (four presidential and two senior advisors threats). Unlike the patterns observed for the Bush presidency, however, all of President Obama's veto threats were whole bill veto threats.
Whereas President Bush also communicated in SAPs his opposition to three bills short of threatening a veto, President Obama either did not issue a SAP at all or issued one that contained a veto threat. One of President Obama's vetoed bills received two veto threats. President Obama's approach of issuing either no statement at all on a bill or a statement containing a veto threat marks a different approach from the one used by President Bush.