Background DOD Personnel  Misconduct The Inspector General Act of 1978, as amended, provides that the IG  may receive and investigate complaints or information from an employee  concerning the possible existence of an activity constituting a violation of  law, rules or regulations; gross mismanagement; gross waste of funds;  abuse of authority; or a substantial and specific danger to public health or  safety. Violation of the law may also include a violation of a provision of  criminal law, including the Uniform Code of Military Justice, which is  codified in Title 10 of the United States Code. Whistleblower Protections  for DOD Personnel Whistleblowers are protected from reprisal as a result of making a  protected disclosure through various statutes, regulations, and  presidential policy covering different DOD personnel groups. Table 1  summarizes the statutory and policy authorities covering DOD personnel,  along with selected protected disclosures and prohibited personnel  actions—which are two required elements of the test for determining  whether there was reprisal against a complainant for whistleblowing. A  protected disclosure is a disclosure of wrongdoing by a whistleblower to a  party that is an eligible recipient of that disclosure, while prohibited  personnel actions include those actions that are taken or threatened in  response to a protected disclosure, such as termination, reassignment, or  a significant change in duties, responsibilities, or working conditions. DODIG and Military  Service IG Roles and  Responsibilities for  Investigating  Whistleblower Reprisal  Complaints DODIG and the military service IGs share responsibility for investigating  misconduct and whistleblower reprisal complaints. Allegations of  misconduct and other whistleblower complaints, including those involving  senior officials, may be investigated by DODIG or a military service IG  depending on the nature of the allegation or the DOD employees  involved. Responsibilities for investigating whistleblower reprisal  complaints differ according to DOD personnel type. Specifically, DODIG  is responsible for investigating and overseeing DOD component  investigations of complaints alleging reprisal against certain DOD  civilian employees, and for investigating complaints alleging reprisal  against DOD contractor, subcontractor, grantee, and subgrantee  employees. For complaints alleging reprisal against a military  servicemember, DODIG has the authority to either investigate the  complaint or refer it to a military service IG for action.  Most reprisal  cases involving military servicemembers are investigated by the military  services IGs, with DODIG oversight. In order to carry out its responsibilities, DODIG has established several  directorates to facilitate the handling and investigation of misconduct and  reprisal complaints. Figure 1 provides a high-level depiction of the DODIG  and military service IG processes for handling reprisal, senior official  misconduct, and internal DODIG employee complaints, along with the  basic roles of the DODIG directorates. Protecting Whistleblower  Confidentiality Whistleblowers confidentiality protections are codified in federal law. The  Inspector General Act of 1978, as amended, restricts DODIG and military  service IGs from disclosing a whistleblower’s identity without the consent  of the whistleblower unless the IG determines that such disclosure is  unavoidable during the course of the investigation. For example, if a  complaint includes information that poses a personal or public safety  concern, disclosing the identity of the complainant may be unavoidable.  Additionally, the Privacy Act of 1974 prohibits the disclosure of records on  any person to another agency without the consent of the person the  record relates to, but allows for the disclosure of an employee’s identity if  the purpose is for routine use—that is, a use that is disclosed for a  purpose compatible with the purpose for which it was collected.  For  example, referring an allegation from an IG hotline to an appropriate  investigative unit would be considered routine use. Federal Law and  Standards Establish  Information Security  Requirements to Protect  Federal Systems The Federal Information Security Modernization Act of 2014 is intended to  provide a comprehensive framework for ensuring the effectiveness of  information security controls over information resources that support  federal operations. The law requires each agency to develop,  document, and implement an agency-wide information security program  to provide risk-based protections for the information and information  systems that support the operations and assets of the agency. The law  also requires agencies to comply with NIST standards and the Office of  Management and Budget requires agencies to comply with NIST  guidelines for protecting federal IT systems. Among other things, NIST defines how agencies should determine the  security category of their information and information systems based on  the potential impact or magnitude of harm that could occur should there  be a loss in the confidentiality, integrity, or availability of the information or information system. NIST also prescribes an array of activities associated  with the selection, implementation, and assessment of IT security  controls—and the authorization to operate federal IT systems and other  products. DOD Instruction 8510.01, Risk Management Framework for DOD  Information Technology, established a risk management framework for  DOD information technology that is consistent with the principles  established in NIST Special Publication 800-37. This framework includes  requirements and procedures for identifying, implementing, assessing,  and managing security controls. Council of the Inspectors  General on Integrity and  Efficiency (CIGIE)  Standards CIGIE’s Quality Standards for Investigations and Quality Standards for  Federal Offices of Inspectors General collectively provide a set of  overarching principles that IGs should adhere to in conducting their  operations. They also provide a framework for conducting high-quality  investigations through the definition of general and qualitative  standards. General standards, among other things, address the  qualifications of investigators, independence, and the concept of due  professional care and confidentiality protections throughout the course of  an investigation. Qualitative standards focus on the establishment of  policies, procedures, and instructions for confidentially handling and  processing complaints, along with investigative planning, execution,  reporting, and information management. The CIGIE Integrity Committee receives, reviews, and refers for  investigation allegations of wrongdoing made against Inspectors General,  designated staff members of an IG, and the Special Counsel and Deputy  Special Counsel of the Office of Special Counsel.  Each Inspector  General, including the DODIG, is required to submit a list of designated  staff members to the CIGIE Integrity Committee Chairperson annually. IGs Met Some  Timeliness  and Many  Quality Goals, but  More Actions Could  Improve Performance  against Unmet  Goals DODIG Met Some, but Not  All, Fiscal Year 2018  Timeliness Goals DODIG met some but not all internal timeliness goals for fiscal year 2018  related to the intake and referral of whistleblower allegations, as well as  the oversight of DOD component investigations. DODIG also did not meet  internal goals related to the timeliness of senior official misconduct  investigations or internal and statutory goals related to the timeliness of  reprisal investigations. Intake is the initial process to determine whether a  complaint contains a prima facie allegation  of whistleblower reprisal or a  credible allegation of misconduct by senior officials. Oversight reviews  are conducted by the DODIG whistleblower reprisal and senior official  investigations directorates to ensure the quality of DOD component  investigations. DODIG officials cited several reasons for not meeting timeliness goals,  including a backlog of cases and a lengthy report review process. Further,  DODIG officials noted that the number of whistleblower reprisal cases  increased from 1,013 to 2,002 (98 percent) over the past 5 years, while  an internal DODIG fiscal year 2018 performance report cited other  reasons for not meeting timeliness goals, including the assumption of  responsibility for all sexual assault victim reprisal cases by the  whistleblower reprisal investigations unit, the number of high-priority  senior official cases concurrently open, and the increasing scope and  complexity of investigations. Timeliness of DODIG Intake  and Oversight Reviews DODIG met its fiscal year 2018 timeliness goals for civilian and contractor  case intakes and senior official misconduct oversight reviews goals, but  did not meet goals related to the average days of senior official  misconduct and military reprisal intakes, and the average days for reprisal  oversight reviews (see figure 2). In fiscal year 2018, DODIG resolved and  closed 631 senior official misconduct cases during the intake review  process and it performed intake reviews for 1,032 whistleblower reprisal  cases. It also conducted oversight reviews for 157 senior official  misconduct cases and 995 reprisal cases. By comparison, DODIG met its fiscal year 2017 targets related to the  percentage of intakes and oversight reviews meeting timeliness goals, but  it did not meet its goals for the average days of reprisal and senior official  misconduct intakes. Timeliness of DODIG Senior  Official Misconduct and  Reprisal Investigations DODIG did not meet internal or statutory timeliness goals related to the  percentage or average days for senior official or reprisal investigations  (see figure 3). DODIG closed 73 investigations in fiscal year 2018,  including 13 senior official misconduct cases and 60 military, contractor,  and civilian reprisal cases. Overall, about 85 percent of all investigations  did not meet the timeliness goal. DODIG similarly did not meet its investigation timeliness goals for senior  official misconduct and reprisal investigations in fiscal year 2017.  However, DODIG officials noted that the record closure of 60 reprisal  investigations in fiscal year 2018 was a significant improvement over the  37 closed in fiscal year 2017, and DODIG data showed that the average  age of closed and open investigations peaked in April 2018 and June  2018, respectively, and that both were lower as of January 1, 2019.  Additionally, DODIG officials stated that they expected to eliminate the  case backlog and reach a sustainable state of timeliness during fiscal  year 2019. Timeliness of DOD Hotline  Referrals and Completion  Report Reviews In fiscal year 2018, the DOD Hotline referred 3,872 cases to other  entities for inquiry, and it performed oversight of 945 completion reports  from DOD components. As shown in figure 4, the DOD Hotline met its  timeliness goals, except for the percentage of referrals meeting the goal  for priority 1 complaints. Comparatively, in fiscal year 2017, the DOD Hotline did not meet  timeliness goals for the average days or percentage of referrals, but did  meet its goal for completion reports. DODIG Generally Met  Fiscal Year 2018 Internal  Quality Goals Quality goals can enhance the ability of organizations to provide  reasonable assurance that they are exercising appropriate safeguards for  federal programs, as demonstrated by our prior work.  DODIG generally  met its fiscal year 2018 internal quality goals related to the thoroughness  and completeness of senior official misconduct and whistleblower reprisal  investigations, as well as the completeness and accuracy of information  in DOD Hotline referrals. DODIG’s internal quality goals for senior  official misconduct and reprisal investigations pertain to the thoroughness  of required case-file documentation and the integrity and completeness of  data in its case management system. Criteria for assessing these goals  include whether or not key documentation of the investigation—such as  the incoming complaints and required notifications—are present in the  proper folders in the case file, and whether start, end, or milestone dates  have been recorded in the case management system. Criteria for  assessing the completeness and accuracy of information in DOD Hotline  referrals include checks on whether whistleblower consent is accurately  documented and whether correspondence is addressed to the correct  recipient. According to DOD Hotline officials, a weighted checklist was  created in June 2018 that has greater focus on those criteria associated  with protecting confidentiality. In fiscal year 2018, DODIG reported that it conducted quality reviews for  59 whistleblower reprisal cases and 13 senior official misconduct cases.  DODIG further reported conducting reviews related to the quality of DOD  component investigations for 80 whistleblower reprisal cases and 80  senior official misconduct cases, while the Hotline reviewed the  thoroughness of 1,954 referrals. As shown in table 2, DODIG either met  or partially met its quality goals except for the data integrity and  completeness goal for senior official investigations and the documentation  goal for senior official oversight reviews. While we have reported DODIG’s performance against its quality  measures, we recommended in September 2017 that DODIG develop  quality performance measures and enhance then-existing timeliness  measures to reflect key attributes of successful performance measures,  and DODIG concurred. In November 2018, DODIG officials stated that  DODIG is currently using the quality measures it had in place prior to  fiscal year 2017, and noted that DODIG had developed DOD-wide quality  performance measures for 2018 that measure the thoroughness of  military service investigations. As a result, we continue to believe that our  2017 recommendation is valid in that DODIG’s performance measures  should reflect key attributes of successful performance measures. Military Service IGs  Generally Did Not Meet  Fiscal Year 2018  Timeliness Goals Military service IGs generally did not meet internal and statutory  timeliness goals related to the notification of receipt of allegations of  reprisal and misconduct, intake reviews, or senior official misconduct and  reprisal investigations. Military service IG officials provided several reasons for not meeting the  internal and statutory timeliness goals for notifications, intake reviews,  and investigations. Specifically, officials cited an increasing number of  complaints; the increasing complexity of complaints, such as those that  include multiple allegations and subjects; staffing challenges, such as  training related to the rotation of military staff; and the use of reservists,  who only work part-time. In addition, a senior official from one military  service IG noted that service IGs should be provided greater latitude in  dismissing complaints without DODIG review and approval, such as for  reprisal complaints where there is no protected communication or  personnel action. Timeliness of Military  Service  IG Notifications  and Intake  Reviews The military service IGs did not meet fiscal year 2018 timeliness goals for  notifying DODIG of allegation receipts, or conducting intake reviews for  reprisal cases (see figure 5). In fiscal year 2018, the military service IGs  sent 141 senior official misconduct notifications and 876 reprisal  notifications to DODIG, and performed 618 reprisal intake reviews. The military service IGs did not meet statutory or internal timeliness goals  for senior official misconduct and whistleblower reprisal investigations,  with exception of the Marine Corps IG—which met its goal for senior  official misconduct investigations (see figure 6). In fiscal year 2018, the  military service IGs closed 424 investigations, including 347 reprisal  investigations, and 77 senior official misconduct investigations. Military Service IGs Met  DODIG and Internal  Quality Goals for  Investigations Military service IGs met fiscal year 2018 quality goals established by  DODIG related to the thoroughness of investigations conducted by the  service IGs. Specifically, 89 percent of DODIG’s thoroughness criteria  were met in the 93 senior official misconduct investigations conducted by  the military service IGs and other DOD components, exceeding the 81  percent goal established by DODIG.  Similarly, 85 percent of DODIG’s  thoroughness criteria were met in the 310 whistleblower reprisal  investigations conducted by the military service IGs and other DOD  components, exceeding the 81 percent goal established by DODIG.  DODIG has established six criteria for assessing the thoroughness of  senior official investigations, including whether all allegations were  addressed, whether the complainant and subject were interviewed, and  whether relevant documents were obtained. DODIG has seven criteria for  assessing the thoroughness of reprisal investigations, including whether  protected communications and personnel actions were identified, and  whether the report of investigation was approved. The Army, the Air Force, and the Marine Corps IGs also met internal  quality goals for fiscal year 2018 related to the percentage of cases  returned by DODIG for rework due to quality issues. Specifically, Army IG  officials stated that they met their goal of having no more than 5 percent  of the investigations they submitted to DODIG for review returned by  DODIG due to quality issues, and Air Force IG officials stated that they  met their goals of obtaining DODIG concurrence on all of the senior  official investigations they submitted for review, and having no more than  5 percent of reprisal investigations returned for rework. Similarly, the  Marine Corps IG achieved its goal of having no investigations returned for  rework, according to a senior Marine Corps IG official. The Naval IG did  not provide us with any internal quality goals. Aside from the quality goals, DODIG also conducted quality assurance  reviews for the Air Force (2017), Army (2018), and Naval (2016) IGs, in  which the quality of a sample of case files was examined. The reviews  concluded that the military service IGs reviewed were generally  complying with internal regulations and CIGIE standards for quality. In  addition, in accordance with recommendations made in the quality  assurance reviews, each of the service IGs reviewed by DODIG has  developed or plans to develop checklists to help ensure that all required  documentation is present in their case files, according to service IG  officials and documentation. IGs Have Implemented  and Planned Initiatives to  Improve Timeliness, but  Initiatives Do Not Target All  Aspects of Timeliness DODIG and the military service IGs have implemented and planned  various initiatives to improve the timeliness of their processing of senior  official misconduct and reprisal complaints. Table 3 shows examples of  recent DODIG and military service IG initiatives. While these initiatives are positive steps, given that the performance of  some measures is far below the goals, additional efforts could be made to  improve performance against unmet timeliness goals—including those  pertaining to senior official misconduct investigations conducted by the  military service IGs, military service IG notifications made to DODIG, and  military service IG intake reviews for reprisal cases. Additionally, DODIG  and some of the military service IGs do not agree on the timeframes  prescribed by DOD policy for military service IGs to notify DODIG of the  receipt of a complaint, thereby complicating achievement of these goals.  For example, officials from the Air Force IG stated that they notify DODIG  of the receipt of misconduct allegations only after making a credibility  determination, instead of within the five working days of receipt  prescribed by DOD policy for senior official allegations.  Similarly, Marine  Corps IG officials stated that senior official allegations should be reported  to DODIG within five days of a credibility determination. Standards for Internal Control in the Federal Government state that  management should complete and document corrective actions to  remediate internal control deficiencies in a timely manner.  Expanding  initiatives to target unmet goals related to military service senior official  investigations, notifications, and intakes could provide DODIG and the  military service IGs a more comprehensive approach to improving  timeliness and better position the IGs to improve upon the timeliness  goals prescribed by DOD policy. In addition, resolving disagreements  related to notification timeliness could improve the military service IGs’  ability to achieve those goals. Further, additional initiatives could provide  greater assurance to potential whistleblowers that their cases will be  handled expeditiously. IGs Have Processes  to Protect  Whistleblower  Confidentiality, but  Some Gaps Exist DODIG Has Policies and  Procedures to Protect  DOD Whistleblower  Confidentiality DODIG has established policies and procedures to implement key  statutory requirements and CIGIE standards for protecting the  confidentiality of whistleblowers from the receipt of a whistleblower  complaint through its investigation. The Inspector General Act of 1978, as  amended, states that the Inspectors General shall not, without consent  from the employee, disclose the identity of an employee who reports  misconduct or provides information, unless the Inspector General  determines that such disclosure is unavoidable during the course of the  investigation. Further, CIGIE’s Quality Standards for Investigations states  that policies, procedures and instructions for handling and processing  complaints should be in place to ensure that basic information is  recorded, held confidential, and tracked to final resolution. Table 4 shows  examples of key confidentiality protections included in DOD Hotline and  senior official misconduct and whistleblower reprisal investigation policies. DODIG officials stated that they routinely emphasize the importance of  protecting whistleblower confidentiality and that confidentiality policies  and procedures are addressed through internal training, staff meetings,  and on-the-job instruction. Further, 69 of 86 (80 percent) DODIG  respondents to our survey reported believing that the guidance they  received on protecting confidentiality is sufficient to maintain the  confidentiality of individuals involved in IG investigations, citing many of  the processes identified in table 4 above as examples of guidance they  have received. DODIG Guidance for  Protecting the  Confidentiality of  Whistleblowers Who  Report Internal DODIG  Misconduct Lacks  Sufficient Detail The DODIG Office of Professional Responsibility’s investigations  manual on handling misconduct complaints against internal DODIG  employees requires that complainant information be strictly controlled in  order to protect the integrity of the investigative process and to avoid  potential harm to the privacy and reputation of the employee. This  guidance also includes some steps to protect whistleblower information  such as redacting substantiated reports of investigation to be provided to  investigation subjects. As previously noted, DOD Hotline guidance also  includes steps to protect the confidentiality of internal DODIG  whistleblowers. However, the Office of Professional Responsibility  guidance does not include several key steps and procedures that some  DODIG officials reported taking to protect whistleblower confidentiality,  such as excluding complainant information from notifications sent to  subjects and not identifying complainants during interviews with case  subjects. In addition, DODIG’s Office of General Counsel does not have  documented procedures for controlling access to cases involving  designated DODIG staff members subject to review by the CIGIE Integrity  Committee. DODIG designated staff members include the Principal  Deputy Inspector General, Deputy Inspectors General, General Counsel,  and Senior Advisor to the Inspector General, among other staff members. Guidance on handling complaints alleging internal DODIG misconduct is  also outdated and does not reflect recent organizational changes. In  particular, the Office of Professional Responsibility’s investigations  manual does not reflect its updated roles and responsibilities since  splitting from the Quality Assurance and Standards directorate in October  2016, and certain chapters do not recognize that it now reports directly to  the Inspector General. Further, sections of the manual have been  revised at different points in time and do not align with the office’s current  functions. For example, the section covering the office’s organization,  mission, and authorities has not been updated since July 2009. Similarly,  the section detailing investigation policies and procedures has not been  updated since November 2012. Some of the DODIG employees we surveyed reported concern that  DODIG’s process for reporting employee misconduct and resolving  internal complaints may not protect whistleblower confidentiality. For  example, 14 (16 percent) survey respondents reported believing that  DODIG’s internal process for reporting misconduct did not protect DODIG  employee confidentiality or only protected it slightly. Also, 36 (42 percent)  survey respondents reported not knowing whether or not DODIG’s  internal process for reporting misconduct protects confidentiality, and 36  (42 percent) reported believing that it protects confidentiality somewhat or  very well. Additionally, 14 of 86 (16 percent) and 9 of 86 (10 percent)   employees surveyed reported having considered but ultimately choosing  not to resolve an issue through the Office of the Ombuds—which may  receive some internal misconduct complaints—or report misconduct  through DODIG’s internal process on or after October 1, 2016,  respectively, because they feared that their confidentiality could be  compromised. Table 5 shows the distribution of these responses. Survey respondents identified some concerns related to the  confidentiality, objectivity, and independence of DODIG’s internal process  for reporting misconduct and suggested some related improvements.  For example, although it has separated from the Quality Assurance and  Standards directorate, the Office of Professional Responsibility continues  to share office space with the directorate and hold complainant and  witness interviews in the shared space.  Also, it was suggested that an  online form could be used so that internal complaints are routed directly  to the Office of Professional Responsibility instead of through the DOD  Hotline. DODIG officials told us that there are record-keeping and  performance measure-related bases for continuing to use the DOD  Hotline to receive complaints of internal misconduct, but that they would  carefully evaluate the suggestion. CIGIE Quality Standards for Federal Offices of Inspector General state  that IGs should establish and follow policies and procedures for receiving  and reviewing allegations and ensure that whistleblower identities are not  disclosed without consent, unless the IG determines that such disclosure  is unavoidable during the course of the investigation. CIGIE Quality  Standards for Investigations also state that policies and procedures  should be revised regularly to align with current laws and regulations.  DODIG officials told us in November 2018 that the Office of Professional  Responsibility investigations manual is in the process of being updated  but were unable to provide a timetable for the completion of these  updates, and stated that all of the provisions—including the confidentiality  protections—are subject to changes and updates. In addition, in January  2019 DODIG officials noted, after discussion with GAO, that they  intended to implement guidance for making referrals to the CIGIE Integrity  Committee. Until DODIG develops guidance that incorporates procedures  to protect confidentiality and documents how to maintain whistleblower  confidentiality throughout the CIGIE referral process, it will lack  reasonable assurance that its process for investigating internal  misconduct allegations can fully protect the confidentiality of  whistleblowers. Military Service IGs Have  Guidance for Protecting  Whistleblower  Confidentiality, but It is Not  Comprehensive Military service IG guidance identifies confidentiality as a core tenet of  handling and investigating whistleblower complaints. For example,  military service IG guidance states that consent should generally be  obtained from complainants before each military service IG can share a  complainant’s identity with officials who will investigate the allegations,  and provides that complaints may be redacted or summarized to omit  personally identifiable information—such as when consent is not given or  for other purposes. In addition, military service IG guidance state that a  complainant’s identity may only be disclosed without consent when an  authorized official has determined that such disclosure is unavoidable in  order to investigate an allegation. Aside from these shared provisions, each of the military service IGs’  guidance includes additional precautions aimed at protecting  whistleblower confidentiality. For example, Air Force Instruction 90-301  instructs Hotline personnel to coordinate communication between the  complainant and investigator if a complainant does not give consent to  disclose his or her identity. In addition, Army and Marine Corps IG  guidance stipulate that whistleblowers will be notified if it becomes  necessary to disclose their identity without their consent, and Naval IG  guidance requires investigators to inform complainants that although the  use of their testimony may be necessary under administrative action  procedures, their identity will be released as a witness, not a complainant,  to safeguard their identity. While all military service IGs acknowledge the need to preserve  confidentiality, we found gaps in confidentiality protections in Air Force,  Naval, and Marine Corps IG guidance, but not Army IG guidance. For  example, we found that Air Force, Naval, and Marine Corps IG guidance  did not include requirements outlined in DOD Instruction 7050.01 related  to the specific conditions under which information disclosures may be  made without complainant consent. According to DOD Instruction  7050.01, these include circumstances when a complainant has made it  known outside IG channels that he or she submitted the complaint, there  is an emergency situation or health or safety issue, or the allegation is  being transferred outside of DOD to another IG. Air Force, Naval, and  Marine Corps IG guidance predate DOD Instruction 7050.01, updated in  October 2017, and reference an older instruction that omits this  disclosure guidance. Additionally, DODIG’s 2016 and 2017 quality assurance reviews of the  Naval IG and Air Force IG concluded that confidentiality protections could  be improved. Specifically, DODIG found that the Air Force IG did not have  written procedures for handling and restricting IG employee access to  complaints against individuals with access to the Air Force IG’s  whistleblower database, including both IG employees and contractors that  support the database. In addition, DODIG found that the Naval IG Hotline  program instruction needed to be updated and that it did not have a  hotline standard operating procedure with guidance to redact complainant  identities before releasing investigation reports to installation  commanders or other military officials. Air Force, Naval, and Marine Corps IG officials stated that they are  currently in the process of updating their guidance to better incorporate  confidentiality protections. For example, Naval IG officials told us that the  Naval IG is updating its Hotline instruction, which will provide guidance to  obtain consent from complainants prior to releasing investigation reports  to installation commanders or other military officials, or redact the  complainant’s name. According to Naval IG officials, the updated  instruction should be finalized in the first quarter of fiscal year 2019. CIGIE Quality Standards for Federal Offices of Inspector General state  that IGs should establish and follow policies and procedures for receiving  and reviewing allegations and ensure that whistleblower identities are not  disclosed without consent, unless the IG determines that such disclosure  is unavoidable during the course of the investigation. Further, CIGIE  Quality Standards for Investigations state that policies and procedures should be revised regularly to align with current laws and regulations, and  that confidentiality should be considered throughout an investigation, to  include drafting reports, validating contents, and submitting the final  report. Without updated policies and procedures that fully implement  confidentiality standards for complaint handling and investigation, the Air  Force IG, the Naval IG, and the Marine Corps IG may not be able to  ensure the consistent implementation of confidentiality protections within  their offices. IGs Are Able to  Access Whistleblower  Information to  Perform Their Duties  and Have Taken  Some, but Not All,  Required Steps to  Safeguard It IGs Are Able to Access  Information Needed to  Handle Whistleblower  Complaints, and Have  Taken Steps to Safeguard  Classified Information DODIG and military service IGs do not experience significant challenges  in accessing sensitive or classified information necessary to handle  whistleblower complaints, according to cognizant IG officials. Such  information includes documentary evidence or witness statements.  Similarly, 79 of 86 (92 percent) DODIG respondents to our survey  reported that they are generally able to access all types of unclassified  information necessary to perform the duties of their position, while 82 of  86 (95 percent) respondents stated that they are either able to access  classified information as necessary or do not require access to classified  information. DODIG and the military service IGs have also taken steps to safeguard  physical and electronic classified whistleblower information in accordance  with DOD policy, which requires that DOD components establish a  system of technical, physical, and personnel controls to ensure access to  classified information is limited to authorized persons. Cases including classified information constituted a small percentage of cases closed by  DODIG and the military service IGs in fiscal year 2017, with the  percentage of those closed by DODIG directorates—including the DOD  Hotline and the whistleblower reprisal and senior official investigations— ranging from 0.2 percent to 0.5 percent, according to DODIG officials.   Officials from each of the military service IGs reported closing no  classified cases in fiscal year 2017. In addition, DODIG and military  service IG officials reported having an adequate number of staff with  clearances at the requisite levels (e.g., SECRET) to handle classified  case information, along with processes for physically and electronically  storing and accessing information at different classification levels. Most IGs are Following  DOD’s IT Risk  Management Process DODIG and most military service IGs are following DOD’s IT risk  management process, which involves the assessment of and  authorization to operate IT used to manage DOD information—including  sensitive but unclassified whistleblower information.  The Naval IG has  not authorized its case management system in accordance with DOD  policy, which implements NIST  and Office of Management and Budget  federal IT security guidelines related to IT systems and applications,  including those used by the IGs.  However, it is taking steps to do so.  DODIG and the Naval IG use IT systems to manage sensitive  whistleblower information, while the Air Force, Army, and Marine Corps  IGs use IT applications—which are not subject to the full IT risk  management authorization process, as discussed below. DODIG and Naval IG IT  Systems DODIG has followed the DOD IT risk management process by authorizing  the Defense Case Activity Tracking System (D-CATS)—its whistleblower  case management system—to operate in accordance with DOD policy  and federal IT security guidelines. DOD’s risk management process  requires that IT systems be authorized to operate using a multistep  process that entails the identification, implementation, and assessment of  system security controls, along with the corresponding development and  approval of a system security plan, security assessment report, and plan  of action and milestones. The process requires systems to be  reassessed and reauthorized every 3 years in order to ensure the  continued effectiveness of security controls, and allows for ongoing  authorizations through a system-level strategy for the continuous  monitoring of security controls employed within or inherited by the  system. The strategy should include a plan for annually assessing a  subset of system security controls. DOD policy states that component  heads may only operate systems with a current authorization to operate,  and that authorization termination dates must be enforced. DODIG last authorized D-CATS to operate in May 2017, determining that  overall system security risk was acceptable based on a review of the  system security plan, security assessment report, and plan of action and  milestones. Our review of DODIG’s system authorization documents also  found that they addressed key, required content elements. For example,  the system security plan specified the security controls intended to be in  place based on the system’s risk classification, and the security  assessment report documented findings of compliance and the methods  used by the assessor to evaluate security controls when implementing  DODIG’s continuous monitoring strategy. Additionally, the plan of action  and milestones identified tasks needed to mitigate identified  vulnerabilities along with resources and milestones to accomplish the  tasks. However, as of December 2018, the Naval IG had not authorized its case  management system in accordance with the DOD risk management  process, and the system remained in operation. The Naval IG was  issued an interim authorization to operate its case management system in  March 2017 by the Commander, U.S. Fleet Cyber Command. The interim  authorization—which expired in January 2018—required the Naval IG to  transition from the department’s prior IT risk management process to the  current process by the time of its expiration, noting that the overall risk of  the system was high due to incomplete testing.  Subsequently, in June  2018, the Naval IG requested and was eventually granted, in September  2018, a conditional authorization to continue operating the case  management system through October 2018. In early December 2018, the Naval IG requested another conditional  authorization to operate the case management system until September  2019. According to Naval IG officials, the conditional authorization is  needed because the whistleblower case management system’s host  environment is not expected to attain its authorization until September  2019. As a result, the Naval IG was taking steps beyond the conditional  authorization request to manage IT security risks as it works towards  compliance with the new DOD risk management process. For example,  Naval IG officials stated that new leadership was put in place to oversee  the case management system; that a senior system administrator would  be hired to help maintain IT security; and that the case management  system was undergoing regular scans to assess security risks, with any  resultant issues being remediated. NIST guidelines state that organizations should design and prioritize  activities to mitigate security risks, and that alternative strategies may be  needed when an organization cannot apply controls to adequately reduce  or mitigate risk. As noted, the Naval IG’s case management system was  not authorized as of December 2018 and it was not yet able to transition  to the current DOD risk management process. However, if completed, the  actions planned and underway—including the conditional authorization  and security scans—should help to mitigate system security risks and  provide greater assurance that existing system security controls  safeguard sensitive whistleblower information. Air Force, Army, and Marine  Corps IG IT Applications The IGs of the Air Force, the Army, and the Marine Corps are following  DOD’s IT risk management procedures for their primary case  management applications, which are not subject to the full IT risk  management authorization process. According to DOD Instruction  8510.01, Risk Management Framework (RMF) for DOD Information  Technology (IT), DOD IT such as applications must be securely  configured in accordance with applicable DOD policies, and application  security controls must undergo special assessment of their functional and  security-related capabilities and deficiencies. The results of such  assessments are to be documented within an application-level security  assessment report and reviewed by a security manager to ensure that the  product does not introduce vulnerabilities into its host system. We found that while the Army, Air Force, and Marine Corps IGs have not  produced the required application-level security assessment reports for  their primary applications, they have met the intent of these requirements  through other actions. Specifically, we noted that the Air Force and Army  IGs’ primary case management applications reside in host systems that  were authorized to operate under the risk management process within the  last 3 years, and that the assessments associated with the host system  authorizations included a review of application-level security controls,  according to IG officials. Similarly, the Marine Corps IG’s case  management application was exempted from assessment by its  authorizing official because it was determined that the application did not  introduce additional risk into its authorized host system. DODIG Does Not Fully  Restrict Employee Access  to Sensitive Whistleblower  Information DODIG’s Case Management  System Does Not Include  Some Controls to Restrict  Internal  Employee Access As previously discussed, DODIG has taken steps to restrict employee  access to whistleblower information, such as by restricting access to  cases in which a complainant has not consented to releasing his or her  identity. DOD Hotline also applies additional restrictions to all cases  involving internal misconduct referrals to the Office of Professional  Responsibility and CIGIE Integrity Committee, and it has the capability to  further restrict records, according to DODIG officials. Beyond restricting  records, the case management system also includes user roles, which  govern users’ view of information. However, employees at the three  DODIG directorates that are principally responsible for handling  whistleblower information are generally able to access sensitive  whistleblower information belonging to other directorates in both the  Defense Case Activity Tracking System (D-CATS)–DODIG’s  whistleblower case management system—and an associated document  repository, that is not necessary to accomplish assigned tasks. NIST  Special Publication 800-53, Security and Privacy Controls for Federal  Information Systems and Organizations, states that organizations should  employ the core security principle of least privilege, which allows only  authorized access for users that is necessary to accomplish assigned  tasks in accordance with organizational missions and business  functions. DODIG employees in the DOD Hotline, senior official investigations  directorate, and whistleblower reprisal investigations directorate are able  to access whistleblower information belonging to other DODIG  directorates in both D-CATS and its associated document management  repository because DODIG has not developed sufficient system controls  needed to restrict access across the three directorates. For example, a  DODIG employee in either the senior officials or reprisal investigations  directorates can access Hotline records in D-CATS that the employee  does not have a need to access, with the exception of cases specifically  restricted by the DOD Hotline to prevent unauthorized access. According  to an August 2018 internal DODIG memo, the lack of controls to restrict  access to information across the three directorates has been known since  the system was established in 2012. DODIG plans to establish controls to restrict access among the DODIG  directorates in a new enterprise system (D-CATSe), which will eventually  replace D-CATS and the case management systems used by the military  service IGs. D-CATSe is intended to provide a common case activity  tracking system capable of supporting mandatory reporting requirements  and collecting, storing, and exchanging IG records related to complaints  and administrative investigations throughout a complaint’s lifecycle.  According to DODIG officials, D-CATSe will restrict access both within  and among user IGs, including the DODIG directorates and military  service IGs, each of which may have unique access requirements based  on their different types of user groups. According to DODIG officials, this  will be accomplished through the establishment of unique business units  at different organizational levels, teams, and user roles, which will  collectively determine what information a user can access. However, as  shown in figure 7 below, the incremental release schedule for D-CATSe  has been delayed, and the IGs are not expected to fully transition to the  new system until fiscal year 2021. NIST guidelines state that organizations should design and prioritize  activities to mitigate security risks, and that alternative strategies (such as  plans) may be needed when an organization cannot apply controls to  adequately reduce or mitigate risk.  Further, NIST guidelines state that  addressing assurance-related controls during system development can  help organizations obtain sufficiently trustworthy information systems and  components that are more reliable and less likely to fail.  However,  DODIG does not plan to take other actions to address the lack of cross- directorate controls before the advent of the enterprise system.  Additionally, while DODIG is designing such controls and plans for each  system release to provide a requirements basis for subsequent releases,  it has not developed an assurance plan for testing controls, according to  DODIG officials, or fully defined the system requirements needed to  implement these controls and ensure it has achieved least privilege both  within and across the user IGs. Without considering interim actions to  address the lack of D-CATS cross-directorate access controls, DODIG  may be unable to sufficiently mitigate security risks while D-CATSe is  developed. Also, without developing a plan with assurance controls for  achieving least privilege in D-CATSe, DODIG may be unable to ensure the confidentiality and integrity of sensitive whistleblower information  during its implementation. DODIG Has Identified  Instances Involving  Improper  Employee IT Access Rights to  Whistleblower Information Separate from the lack of cross-directorate controls, DODIG has identified  multiple instances in which sensitive but unclassified whistleblower  information in the DODIG Administrative Investigations directorate  whistleblower case management system and document repository was  accessible to DODIG personnel who did not have a need to know this  information. These instances involve DOD Hotline records that are  specifically restricted to protect complainants requesting confidentiality,  along with records belonging to DODIG’s Office of Professional  Responsibility—which handles internal DODIG misconduct complaints. Table 6 shows examples of recent instances in which DODIG determined  that sensitive whistleblower records were accessible to DODIG personnel  without a need to know. According to DODIG officials, as of January  2019, there were no known instances of anyone without a need to know  actually accessing these records. These officials also stated that  corrective action had been taken for each instance in table 6, including by  blocking access to information while the underlying issues were resolved;  that at no time was information available to the public; and that the  instances did not result in any disclosure outside of DODIG. NIST guidelines state that the need for certain user privileges may  change over time, necessitating the periodic review of assigned user  privileges in order to determine if the rationale for assigning such  privileges remains valid. DODIG has determined that its user access  issues are broadly attributable to system administration and application  problems, including permission changes resulting from system updates.  To address such issues, DODIG has taken several remedial actions and  identified additional recommended steps, including:  reconciling user accounts and validating permissions related to  restricted records;  reviewing policies related to protecting complainant confidentiality and  conducting awareness training with personnel, as appropriate; and developing enhanced user management procedures and internal  controls related to establishing user accounts, reconciling current user  permissions, and controlling access to restricted records. In addition, in October 2018, DODIG instituted a process whereby user  privileges associated with its case management system and document  repository will be reviewed, validated, and corrected, if necessary, on a  quarterly basis. If fully implemented, this process, along with the  proposed actions, should help ensure that assigned user privileges are  periodically validated and aligned with business needs. However,  DODIG’s process does not include steps to test document repository  permissions after case management system updates, which were  determined by DODIG to be the cause of some permission issues.   Without including such steps in its process, DODIG lacks assurance that  system permissions will align with business needs on an ongoing basis,  and therefore may not be able to appropriately control user accounts to  prevent unauthorized access by system users. Sensitive Whistleblower  Information Has Been  Accessible to Military  Service IG Employees  without a Need to Know The military service IGs’ case management systems and applications  incorporate IT controls, such as authenticated user accounts and unique  permissions, to protect certain whistleblower information. However,  service IG systems and applications do not fully restrict employee access  to sensitive whistleblower information only to information that is  necessary to accomplish assigned tasks. As previously discussed, NIST  guidelines state that organizations should only provide authorized access  to users which is necessary to accomplish assigned tasks in accordance  with organizational missions and business functions. As shown in Table  7, DODIG’s quality assurance reviews and our work identified issues  related to IG employee access restrictions. At the time of our review, the military service IGs had not taken steps to  fully address the identified access issues. Specifically, Air Force officials  stated that they did not plan to address the application access issues  because they did not have funding to continue developing their existing  application prior to transitioning to D-CATSe, although they would explore  whether solutions were possible within current fiscal constraints during  the next system maintenance evaluation. Similarly, Army IG officials  stated that while the Army IG had resources to further develop its existing  case management application, they had elected to not use those  resources to remedy the identified access issue in light of the future  arrival of D-CATSe. In addition, Naval IG officials reported taking action to  restrict senor official investigations, but did not provide information to us  on actions taken to address DODIG’s recommendation to restrict cases  involving internal Naval IG personnel. Finally, Marine Corps IG officials  stated that access restrictions would be implemented as part of an  application redesign scheduled to be complete by the end of 2018.  However, these officials also noted that they have not identified the root  of the access problem or developed a plan to ensure that needed access  restrictions are implemented and functioning properly, raising questions  as to whether the redesign will fully restrict access on a continuing basis.  As mentioned previously, the Marine Corps’ case management  application is also exempt from testing under the DOD IT risk  management process, and therefore is not subject to routine security  assurance testing. Federal Standards for Internal Control state that management should  analyze and respond to risks, and evaluate and remediate internal control  deficiencies on a timely basis, including those related to audit findings.   Further, NIST guidelines state that organizations should design and  prioritize activities to mitigate security risks, and that alternative  strategies, such as plans, may be needed when an organization cannot  apply controls to adequately reduce or mitigate risk. These guidelines  also encourage organizations to obtain assurance-related evidence on an  ongoing basis in order to maintain the trustworthiness of information  systems. As previously discussed, D-CATSe is being implemented  incrementally, with releases for the Naval IG and the Air Force and Army  IGs not scheduled to occur until fiscal years 2020 and 2021, respectively.  By considering actions prior to the advent of D-CATSe, the Air Force,  Army, and Naval IGs could mitigate existing risks to whistleblower  confidentiality by reducing the potential for unauthorized employee  access of whistleblower records. Also, by developing a plan to ensure  that access restrictions function properly, the Marine Corps IG could  better ensure the confidentiality and integrity of sensitive whistleblower  information in its redesigned case management application on a  continuing basis. IGs Report Few Instances  of Confidentiality  Violations but IT Access  Issues Create This  Potential Potential violations of whistleblower confidentiality may be reported to  DODIG, the service IGs, the Office of Special Counsel, or CIGIE. IGs  identified some substantiated violations of whistleblower confidentiality  between fiscal years 2013 and 2018. Specifically, DODIG identified 8  substantiated violations of whistleblower confidentiality between fiscal  years 2013 and 2018, representing approximately .01 percent of the  95,613 contacts handled by DODIG during that timeframe, according to  DODIG officials. Army IG identified 6 substantiated violations of  whistleblower confidentiality between these years. These violations  include the improper release of IG information, disclosures made to  individuals who do not have a need to know, and unauthorized access to  whistleblower records by IG personnel. DODIG officials noted that in  some instances, violations were determined not to result from employee  misconduct because the complainant’s identify was disclosed unwittingly.  According to DODIG and Army IG officials, disciplinary or corrective  action was taken in all but one of the 14 substantiated violations because  the DODIG employee involved resigned prior to action being taken.  Officials from the Air Force, Naval, and Marine Corps IGs stated that they  were unaware of any substantiated incidences of confidentiality violations  between fiscal years 2013 and 2018 and that they were unable to  specifically track such incidents in their case management systems.   Similarly, CIGIE Integrity Committee and Office of Special Counsel  officials stated that they were unaware of and do not specifically track  confidentiality violations, and we did not identify any confidentiality  violations in the fiscal year 2013-2018 data they provided to us that  involved DODIG employees. Respondents to our survey of DODIG employees separately reported  potential violations of whistleblower confidentiality. Specifically, 15 of the  86 respondents (about 17 percent) reported being aware of at least one  instance since June 1, 2017, where the identity of a complainant or  source was avoidably disclosed by a DODIG employee to an organization  or individual without a need to know, and nine of these 15 were aware of  more than one instance. These responses are not intended to be a count  of separate instances because respondents may have recalled the same  instance(s), including one or more of the 8 substantiated violations  reported to us by DODIG. The most common avoidable disclosure  described by survey respondents involved distributing whistleblower  materials to the wrong official or agency. Survey respondents reported  that in such instances corrective action included recalling the complaint  and deleting the erroneously sent record, or, in some cases, sending a  complaint to DODIG’s Office of Professional Responsibility for the  investigation of possible misconduct. While the number of known violations is small, IT access issues related to  the case management systems and applications used by DODIG and the  military service IGs create the potential for additional violations of  whistleblower confidentiality. As previously discussed, issues such as  the absence of cross-directorate access controls within DODIG’s case  management system and the ability for non-Air Force IG users of the Air  Force IG case management system to view IG case information allow for  the improper access of sensitive whistleblower information. Recognizing  this potential, a senior DODIG official noted concern regarding the  possible extent of confidentiality violations stemming from these and the  other access issues previously discussed in this report. Additionally,  DODIG requested that the Defense Criminal Investigative Service  investigate the April 2018 incident involving 946 case folders to determine  who accessed the identified records. Without steps to address these  ongoing IT access issues, the potential for additional violations of  whistleblower confidentiality will persist. DODIG Generally Met  Documentation  Requirements  in  Senior Official Cases  that GAO Reviewed  and Reported Most  Credible Allegations DODIG Dismissed Most  Cases Involving Civilian  DOD Presidential  Appointees with Senate  Confirmation and  Generally Included  Required Data and  Documentation DODIG closed 129 misconduct and reprisal cases in fiscal years 2013  through 2017 with complaints involving a civilian DOD Presidential  appointee with Senate confirmation (PAS)  subject. Of the 129 cases  closed, DODIG dismissed without investigation 125 cases and  investigated the remaining four. Figure 8 shows the number of cases  closed in each fiscal year, by case disposition. Our review of the 125 case files for dismissed misconduct and reprisal  cases found that key documentation and data needed to demonstrate  compliance with significant aspects of the case-handling process were  generally present. Key documentation and data for dismissed cases  include the case open and close dates, the incoming complaint,  disposition of the case, and the dismissal approval and rationale. CIGIE  standards state that the degree to which an organization efficiently  achieves its goals is affected by the quality and relevance of information  that is collected, stored, retrieved, and analyzed, and that the results of  investigative activities should be accurately and completely documented  in the case file. Examples of data and documentation consistently present. Our  review of 125 case files for dismissed cases closed in fiscal years 2013  through 2017 found that key documentation and data were generally  present. For example: 100 percent of the cases we reviewed included the incoming  complaint. Approximately 99 percent of the dismissed misconduct cases included  a dismissal rationale that aligned with dismissal criteria in DODIG  policy. 100 percent of the dismissed reprisal cases that involved a closure  letter informing the complainant of case dismissal listed a rationale for  dismissal in the closure letter. 100 percent of the dismissed reprisal cases that did not involve a  closure letter to the complainant had a rationale for dismissal  elsewhere in the case file. Approximately 99 percent of dismissed misconduct cases included a  required entry recording the intake disposition. Documents or data that were not material. Our review of case files for  dismissed cases closed in fiscal years 2013 through 2017 found that  some other documentation or data that are needed to demonstrate  compliance with DODIG policy were missing. The deficiencies we found  were not material to case outcomes. For example, approximately 77  percent of dismissed misconduct cases did not include a recording of  case dismissal approval by IG supervisory staff. However, DODIG  officials told us that the presence of the required entry recording the  intake disposition indicated that the case dismissal had been approved by  the appropriate authority. Similarly, approximately 55 percent of  dismissed misconduct cases did not include a notification letter to the  appropriate military service IG in the case file. DODIG officials stated that  while there is guidance to send these letters, it is not a required  practice. DODIG Has Reported  Most Credible Misconduct  Allegations to the  Secretary of Defense and  Some Investigation  Results to Congress DODIG reported most credible allegations concerning civilian DOD PAS  officials to the Secretary of Defense as required. DODIG also reported  some investigation results involving these officials to Congress prior to  the enactment of the Inspector General Empowerment Act of 2016, which  required the reporting of results of substantiated investigations involving  DOD senior officials. DODIG investigated four of the 129 cases closed  in fiscal years 2013 through 2017, with two of those investigations leading  to substantiated allegations of misconduct. DODIG generally met DOD requirements to report credible allegations of  misconduct against civilian DOD PAS officials to the Secretary of  Defense. DOD Directive 5505.06 requires that DODIG notify the  Secretary of Defense of all credible allegations or investigations involving  presidential appointees and others of significance, including Senate- confirmed civilian officials. We found documentary evidence that  DODIG notified the Secretary of credible allegations in three of the four  misconduct and reprisal investigations closed from fiscal years 2013  through 2017, and the secretary of a military service was notified in the  fourth case. In addition, DODIG officials stated that the Principal Deputy  IG provides the Secretary of Defense periodic updates on current  investigations and other periodic updates of incoming allegations, as  necessary and appropriate. Separately, the Inspector General Empowerment Act of 2016 requires  that DODIG report in its semiannual reports to Congress on all  substantiated allegations of misconduct involving senior officials. Prior to  2016, there was no requirement to notify Congress of substantiated  allegations of misconduct involving senior officials. We found evidence  that DODIG communicated investigation results to Congress in two of the  four civilian DOD PAS official investigations closed between fiscal years  2013 and 2017, but not in the other two because it was not required.   For one investigated case, a report of investigation was provided to  Congress upon request, and for another investigation, which had a  substantiated allegation, the results of the investigation were published in  narrative detail in a semi-annual report to Congress. DODIG now reports  in its semi-annual reports to Congress summary results of substantiated  and unsubstantiated cases closed during the corresponding period, but it  has not closed any civilian DOD PAS official allegations since the  statutory requirement to report to Congress on all substantiated cases  was established. Conclusions Maintaining a program that instills trust and confidence for potential  whistleblowers to come forward is critical to minimizing fraud, waste,  abuse, and personnel misconduct in the federal government. Important  components of a credible whistleblower program are timeliness of case  processing and safeguarding confidentiality to the maximum extent  possible. It is encouraging that DODIG and the service IGs have met  some key goals and have policies that address whistleblower  confidentiality. In addition, DODIG generally met key documentation and  data requirements for the 125 cases dismissed by DODIG involving  civilian DOD PAS officials, and reported most credible allegations, as  required. However, the IGs face challenges in addressing unmet timeliness goals  and updating guidance to ensure full alignment with current confidentiality  requirements. By pursuing more targeted, collective efforts with additional  initiatives aimed at improving performance against unmet timeliness  goals, the IGs can better assure current and potential whistleblowers that  their complaints will be processed expeditiously. Additionally, without  formal guidance documenting procedures for protecting the confidentiality  of whistleblowers reporting potential internal DODIG employee  misconduct, those employees lack assurance that DODIG can fully  protect their identities. Similarly, without updated policies and procedures, the Air Force, Naval, and Marine Corps IGs may not be able to fully  ensure whistleblower confidentiality in their organizations. The integrity of a whistleblower program also extends to ensuring that  sensitive information in IT systems remains secure and inaccessible by  employees without a need to know. The IGs have existing controls for  safeguarding whistleblower information, but additional efforts are  warranted. Specifically, without further steps—such as considering interim  actions to mitigate the lack of cross-directorate access controls,  developing a plan, along with the military service IGs for achieving least  privilege in the future enterprise case management system, and  enhancing the process for periodically validating user privileges—DODIG  may not be able to ensure that access controls in its existing and future  case management systems align with business needs on an ongoing  basis. Similarly, without considering actions to further restrict IG  employee access in existing IT, the Air Force, Army, and Naval IGs may  be unable to mitigate ongoing risks to whistleblower confidentiality.  Finally, without a plan for ensuring that access restrictions in its  redesigned case management system function properly, the Marine  Corps IG may be unable to fully ensure whistleblower confidentiality. Recommendations  for  Executive Action We are making a total of 12 recommendations to DOD. Specifically:  The DOD Inspector General should coordinate with the IGs of the  military services to take additional actions to improve performance  against unmet timeliness goals. This includes steps to improve  performance of senior official misconduct investigations and military  service reprisal intakes, and to resolve disagreement on notifications.  (Recommendation 1) The DOD Inspector General should issue formal guidance  documenting procedures for protecting the confidentiality of  whistleblowers throughout its internal misconduct investigation  process. (Recommendation 2) The Air Force Inspector General should establish procedures to fully  reflect and implement DOD policy on the protection of whistleblower  confidentiality. (Recommendation 3) The Marine Corps Inspector General should establish procedures to  fully reflect and implement DOD policy on the protection of  whistleblower confidentiality. (Recommendation 4) The Naval Inspector General should establish procedures to fully  reflect and implement DOD policy on the protection of whistleblower  confidentiality. (Recommendation 5) The DOD Inspector General should consider interim actions as the  whistleblower enterprise case management system is being  developed to help ensure that access to sensitive whistleblower  information in the current case management system and associated  document repository is limited to information that is necessary to  accomplish assigned tasks. (Recommendation 6) The DOD Inspector General should coordinate with the IGs of the  military services to develop a plan to fully restrict case access in the  future whistleblower enterprise case management system so that user  access is limited to information necessary to accomplish assigned  tasks in accordance with organizational missions and business  functions. (Recommendation 7) The DOD Inspector General should enhance its process for  periodically reviewing whistleblower case management system and  document repository user privileges by including steps to ensure that  such privileges remain valid after system updates, as appropriate.  (Recommendation 8) The Air Force Inspector General should consider interim actions as  the whistleblower enterprise case management system is being  developed to help ensure that access for users of existing applications  is limited to information that is necessary to accomplish assigned  tasks in accordance with organizational missions and business  functions. (Recommendation 9) The Army Inspector General should consider interim actions as the  whistleblower enterprise case management system is being  developed to help ensure that access for users of existing applications  is limited to information that is necessary to accomplish assigned  tasks in accordance with organizational missions and business  functions. (Recommendation 10) The Marine Corps Inspector General should develop a plan to ensure  that its redesigned whistleblower case management application  restricts user access to information based on what is needed to  accomplish assigned tasks in accordance with organizational  missions and business functions. (Recommendation 11) The Naval Inspector General should consider interim actions as the  whistleblower enterprise case management system is being  developed to help ensure that access for users of existing applications  is limited to information that is necessary to accomplish assigned  tasks in accordance with organizational missions and business  functions. (Recommendation 12) Agency Comments  and Our Evaluation We provided a draft of this report to DODIG and the military service IGs  for review and comment. In written comments, DODIG and the military  service IGs concurred with each of our 12 recommendations. Comments  from DODIG and the Air Force, Army, and Marine Corps IGs are  reproduced in appendix V; the Naval IG concurred in an email. These IGs  also provided technical comments, which we have incorporated as  appropriate. In its comments, DODIG stated that it will seek to implement the  recommendations. In addition to highlighting recent and planned  improvements, DODIG provided additional comments on some of the  report’s findings and statements. In particular, DODIG noted that the  report understated its improvements in timeliness, such as by stating that  DODIG did not meet timeliness goals related to average days of senior  official and military reprisal intakes, and average days for reprisal  oversight reviews. Citing figure 2, DODIG further stated that it met its  timeliness goals in more than 60 percent of all senior official and reprisal  intake cases, including 87 percent of senior official oversight review  cases, and that it met its 15-day goal in more than 70 percent of senior  official intakes. We agree that DODIG achieved these percentages and  present the associated data in figure 2. However, as described in the  report, and shown in figure 2, DODIG did not meet its goals for the  average days of senior official misconduct and military reprisal intakes,  and the average days for reprisal oversight reviews. Nonetheless, it is  encouraging that DODIG has taken and planned actions to improve  timeliness as its caseload has increased, including by increasing its staff  by about 29 percent since fiscal year 2016, during which time it reported  that its caseload similarly increased by about 26 percent. DODIG also noted that the report presented some information in a  manner that could create an incomplete impression of the agency’s  commitment to protecting whistleblower confidentiality. Specifically, DOD  stated that the report’s presentation of survey data related to DODIG  employee concerns about internal DODIG processes may give a  misleading impression because of the focus on the small number of  respondents who had a negative impression. In particular, DODIG noted  that more than 80 percent of respondents either believed that DODIG’s  internal process for reporting misconduct protected confidentiality  somewhat or very well, or did not know if it did so. However, a positive  perspective cannot be inferred from the respondents that reported not  knowing whether or not DODIG’s internal process protects confidentiality  (42 percent). Also, it should be recognized that the respondents that held  negative views on DODIG’s process for reporting internal misconduct (16  percent) accounted for a substantial proportion of respondents (28  percent) that held either positive or negative views on this issue.  Importantly, these and other survey information presented in the report  also provide valuable information on the degree to which DODIG  employees have confidence in the integrity of these important internal  processes, and, as mentioned, align with other information obtained  during our review. As such, this information may help to inform DODIG’s  efforts in addressing our recommendation to issue formal guidance  documenting procedures for protecting the confidentiality of  whistleblowers throughout its internal misconduct process, along with any  future efforts to instill employee confidence in internal misconduct  reporting mechanisms. DODIG also noted that portions of the report addressing restrictions on  DODIG employee access to sensitive whistleblower records need further  context, stating specifically that no DODIG employees outside of the  Administrative Investigations directorate, Office of Professional  Responsibility, and Office of General Counsel had access to any of the  records, and that there was no evidence that any person without a need  to know accessed any such records. However, information provided to us  by DODIG does not show that accessibility was limited in all instances to  employees within one of those DODIG offices. Also, the ability of any  employee to access records that were specifically restricted to protect  complainant identities or internal records belonging to the Office of  Professional Responsibility is problematic given the increased sensitivity  of such records. Further, while DODIG did not identify instances in which  anyone without a need to know accessed the records, DODIG did not  provide evidence that all cases of improper access were thoroughly  investigated, as we state in our report, and the instances included in the  report are examples and not inclusive of all instances of improper access  identified by the DODIG. Nevertheless, it is positive that DODIG has  reported taking corrective action to address instances of improper  accessibility. It is also encouraging that DODIG plans to implement our  recommendations, as the potential for unauthorized access will persist  until it establishes cross-directorate controls in the case management  system and enhances its processes for periodically reviewing user  privileges for its whistleblower case management system and document  repository. All of the military service IGs concurred with the recommendations  directed to them. The Air Force and the Army IGs also provided  comments on some of the report findings. In particular, the Air Force IG  noted in relation to our third recommendation that language in Air Force  Instruction 90-301, updated in December 2018, is essentially the same as  5 U.S.C. Appendix § 7, and that this language precludes Air Force  officials at any level from waiving the requirement to inform complainants  and employees of the requirement to not disclose their identities without  their consent, unless the Inspector General determines such disclosure to  be unavoidable. However, as stated in our report, Air Force guidance did  not include requirements outlined in DOD Instruction 7050.01 related to  the specific conditions under which information disclosures may be made  without complainant consent. These include circumstances wherein a  complainant has made it known outside IG channels that he or she  submitted the complaint, there is an emergency situation or health or  safety issue, or the allegation is being transferred outside of DOD to  another IG. As a result, we continue to believe that without updated  policies and procedures that fully implement confidentiality standards, the  Air Force IG may not be able to ensure the consistent implementation of  confidentiality protections. Separately, in relation to IG employee access of information, the Army IG  stated that the processes it has in place provide judicious access and  control of whistleblower information to achieve an appropriate balance  between efficient operations and minimized risk. As stated in our report,  DODIG’s 2018 quality assurance review of the Army IG found that the  Army IG’s application did not restrict personnel without a need to know  from accessing allegations involving Army IG personnel, contrasting with  NIST guidelines, which predicate user access on the need to accomplish  assigned tasks. Army IG officials acknowledged this issue, but stated that  the Army IG had elected to not use existing resources to further develop  its case management application in light of the enterprise system being  developed by DODIG. As a result, we continue to believe that by  considering actions prior to the advent of the enterprise system—which is  not expected to be released to the Army IG until fiscal year 2021—the  Army IG could mitigate risks to whistleblower confidentiality by reducing  the potential for unauthorized IG employee access of whistleblower  records. We are sending copies of this report to congressional committees; the  Acting Secretary of Defense; the Department of Defense Principal Deputy  Inspector General performing the duties of the Inspector General; the  Inspectors General of the Air Force, the Army, the Navy, and the Marine  Corps; the Office of Special Counsel; and other interested parties. In  addition, the report is available at no charge on the GAO website at  http://www.gao.gov. If you or your staff have any questions about this report, please contact  me at (202) 512-3604 or farrellb@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made key contributions to this report  are listed in appendix VI. Appendix I: Scope and Methodology To determine the extent to which the Department of Defense Office of  Inspector General (DODIG) and the military service offices of inspector  general (IG) met and took steps to achieve key fiscal year 2018  timeliness and quality goals related to the handling of whistleblower  complaints, we reviewed performance documentation and interviewed  officials on DODIG and military service IG timeliness and quality goals,  performance measures, and associated performance data for fiscal year  2018, along with ongoing and planned efforts to improve performance.  We also reviewed fiscal year 2017 performance data for comparison  purposes. We selected data from this period because they constituted the  most complete and recent performance data available. Using the data, we  assessed the extent to which DODIG and the military service IGs met  timeliness and quality goals defined by statute and internal IG policy.  Specifically, we assessed the timeliness of DOD Hotline referrals and  completion reports against its internal goals, along with DODIG senior  official misconduct and whistleblower reprisal intakes, investigations, and  oversight reviews against internal and statutory goals. We also assessed  the timeliness of military service IG senior official and reprisal  notifications, intakes, and investigations against DOD and statutory goals,  and reviewed the results of DODIG quality assessments for DOD Hotline  referrals, military service investigations, and DODIG senior official and  whistleblower reprisal investigations. We assessed the reliability of DODIG and military service IG data by  administering questionnaires, interviewing cognizant officials, and  reviewing case management system documentation and quality  assurance procedures. We also compared select electronic data to fiscal  years 2013 through 2017 case file documentation associated with our  review of case files to determine whether dates had been properly  recorded in the system. We determined that these data were sufficiently  reliable for our purposes. To identify factors affecting timeliness and quality, we interviewed IG  officials and reviewed relevant documentation including strategic plans,  briefing materials, and semiannual reports to Congress. We also  compared DODIG and military service IG completed and planned efforts  to improve timeliness and quality against Council of the Inspectors  General on Integrity and Efficiency (CIGIE) standards for federal IGs  related to establishing performance plans with goals and performance  measures, and Standards for Internal Control in the Federal Government  related to assessing performance and improving performance. To determine the extent to which DODIG and the military service IGs  have established processes to protect the confidentiality of  whistleblowers, we assessed DOD and military service IG policies and  procedures for handling whistleblower allegations against DOD policy,  CIGIE standards for federal IGs, and statutory protections related to  safeguarding whistleblower confidentiality. We also reviewed the results  of DODIG’s quality assurance reviews of the Air Force (2017), Army  (2018), and Naval (2016) IGs. We performed a web-based survey of the  entire population of 108 DODIG Administrative Investigations directorate  employees directly involved with the handling of whistleblower cases to  ascertain whether, in their view, confidentiality processes are being  implemented in accordance with guidance and standards, identify  potential confidentiality violations, and to gather perceptions on the  integrity of the internal process for reporting misconduct, among other  things. We removed four employees from our initial population of 112  employees because two employees left DODIG prior to the initiation of  our survey and two employees were new to the organization and  therefore likely not familiar with the issues covered by the survey. To conduct the survey, we developed 27 questions covering (1) access to  and protection of sensitive and classified whistleblower information; (2)  confidentiality guidance, safeguards and identity disclosures; (3) resolving  internal conflict through DODIG’s Office of the Ombuds; and (4) reporting  misconduct through the internal DODIG process for DODIG employees to  report misconduct. A survey specialist helped to develop these questions,  and another survey specialist provided independent feedback on the  questions to ensure that content necessary to understand the questions  was included and that the questions could be answered accurately and  completely. To minimize errors that might occur from respondents  interpreting our questions differently than we intended, we pretested our  survey with seven DODIG employees to ensure the clarity and  reasonableness of the questions. During the pretests, conducted in  person and by phone, DODIG employees read the instructions and each  question out loud and told us whether (1) the instructions and questions  were clear and unambiguous, (2) the terms we used were accurate, and  (3) they could offer a potential solution to any problems identified. We  also asked them for a mock answer to ensure that the questions were  understood as intended. We noted any potential problems identified by  the reviewers and through the pretests and modified the questionnaire  based on the feedback received. A full listing of survey questions is  provided in appendix IV. We conducted the survey between June 14, 2018, and July 6, 2018. To  maximize  our response rate, we sent reminder emails and contacted non- respondents by telephone to encourage them to complete the survey. In  total, we received responses from 86 DODIG employees, achieving a  response rate of 80 percent. Although not required, we assessed the  potential for non-response bias by analyzing differences in the percent of  DODIG employees per directorate and job position (e.g., investigator) that  responded to our survey and the percent of potential DODIG respondents  in each directorate and position. We found no meaningful differences  between respondents and our population of potential respondents,  indicating no evidence for non-response bias. Also, we took steps in the  development of the survey, data collection, and data analysis to minimize  nonsampling errors and help ensure the accuracy of the answers that  were obtained. For example, a social-science survey specialist helped to design the questionnaire, in collaboration with analysts having subject- matter expertise. Then, as noted earlier, the draft questionnaire was  pretested to ensure that questions were relevant, clearly stated, and easy  to comprehend, and it was also reviewed by another specialist with  expertise in survey development. We calculated the frequency of responses to our closed-ended survey  questions and performed content analysis on the open-ended questions  to identify common themes from across the responses and to determine  their frequencies. The quantitative analysis was performed by one analyst  and independently reviewed by another analyst. For the qualitative  analysis, a standard coding scheme was developed to identify common  themes and determine their frequencies. We also used professional  judgment to identify other themes that were determined to be important  based on our review of case files, discussions with DODIG management,  and review of guidance and relevant standards. To determine the extent to which DODIG and the military service IGs are  able to access and safeguard classified and sensitive information  necessary to handle whistleblower complaints, we reviewed  documentation and interviewed officials on the extent to which DODIG  and the military service IGs have developed, implemented, and assessed  key information technology (IT) security controls, and authorized the  systems and applications used to process, store, and transmit sensitive  whistleblower information per requirements and standards prescribed by  DOD, the Office of Management and Budget,  and the National Institute  of Standards and Technology. Collectively, these documents delineate  an array of documentary and procedural requirements related to the  assessment of IT security controls and the authorization to operate IT  systems and applications. We also reviewed plans and interviewed  cognizant officials on the development and implementation of the  Defense Case Activity Tracking System enterprise (D-CATSe)—DOD’s  future system for managing whistleblower information across DODIG and  the military service IGs, and reviewed DODIG’s quality assurance reviews  of the Air Force (2017), Army (2018), and Naval IGs (2016). Separately,  we reviewed data and information on the number and percentage of  DODIG and military service IG classified cases closed in fiscal year  2017, the number and allocation of DODIG and military service IG staff  possessing security clearances, and the processes and procedures for  storing and accessing classified information within DODIG and the  military service IGs against DOD policy related to establishing controls to  ensure access to classified information is limited to authorized persons.  We assessed the reliability of classified case data by administering  questionnaires to cognizant officials, and determined the data were  sufficiently reliable for the purpose of reporting the number of classified  cases closed in fiscal year 2017. To determine the extent of substantiated and potential confidentiality  violations and retaliatory investigations involving DODIG employees, we  obtained and analyzed available fiscal year 2013 through 2018 data on  known or perceived violations of confidentiality standards and retaliatory  investigations from DODIG and the military service IGs. We selected data  covering this period of time because they constituted the most recent and  reliable data available, and because DODIG officials told us that data  prior to fiscal year 2013 were unreliable. We also reviewed fiscal year  2013–2018 complaint data from the Office of Special Counsel and the  CIGIE Integrity Committee in order to identify possible violations of  confidentiality standards or retaliatory investigations. We assessed the  reliability of DODIG and service IG data by administering questionnaires,  interviewing cognizant officials, and reviewing the methods used to query IG case management systems for this information. We determined the  data to be sufficiently reliable for the limited purpose of identifying  potential confidentiality violations and retaliatory investigations. To evaluate the extent to which select misconduct and reprisal cases  involving civilian DOD Presidential appointee with Senate confirmation  (PAS) officials met key documentation and reporting requirements, we  reviewed all 125 administrative misconduct and reprisal cases involving  Senate-confirmed civilian official subjects that were dismissed by DODIG  in fiscal years 2013 through 2017. We chose to review cases from this  period because they constituted the most recent and complete data in  DODIG’s case management system and would therefore most accurately  reflect the extent to which the majority of DODIG’s cases included  required documentation. Also, DODIG officials informed us that  information on cases prior to the implementation of the current case  management system in fiscal year 2013 were both incomplete and  unreliable. During the course of our review, we removed five out-of-scope  cases from the original population of 130 cases, reducing the number of  cases in our population from 130 to 125. Four cases were removed  because the related allegations were investigated, and one case was  removed because it was a record used to track an investigation occurring  at a military service IG. Table 8 shows the distribution per fiscal year of  closed misconduct and reprisal cases involving civilian DOD PAS  subjects by the result of the case. To conduct the case-file review, we developed and used a data collection  instrument to guide our review regarding general case characteristics and  the presence of information and documentation required by DOD  policies and CIGIE best practices. Core elements of this instrument were shared with DODIG officials to ensure the instrument aligned with  the policies and practices in place when the cases were dismissed. These  core elements represented individual documents and data elements. We  incorporated DODIG’s feedback into our instrument before commencing  the file review. Examples of elements in our review that represent key  data in DODIG’s database or constitute documentation of key steps of the  case-handling process include the following: case open date, case close date, disposition of the matter at intake, dismissal rationale. To validate the data collection instrument and ensure consistency in its  application, we developed and followed standard procedures to review a  test sample of 11 case files that were selected from each stratum of  cases (e.g., misconduct) to ensure that each case type was tested at  least once. In reviewing the sample, we adjusted the relevant case file  elements for each case based on its type and circumstances and  captured responses in our data collection instrument accordingly. To help  ensure the accuracy of the information we collected, one analyst  reviewed each casefile and coded for the presence of required  information using the data collection instrument, and another analyst  reviewed the first analyst’s work. In the event that disagreement between  the two analysts occurred, the analysts discussed and resolved the  disagreement by identifying and reviewing supporting database  information or documentation, and obtaining the input of a third analyst, if  necessary, until a final resolution was made. We reviewed all cases  dismissed during this period; for this reason, the results of this analysis do  not have a sampling error. To identify other characteristics of DODIG cases involving civilian DOD  PAS officials, we also analyzed fiscal years 2013-2017 case data to  determine the number of cases closed by fiscal year, case types, case  dispositions, source organizations, and the frequency and type of alleged  misconduct. Separately, we also reviewed documentation from DODIG on  civilian DOD PAS official allegations and investigation results reported to  the Secretary of Defense and Congress since fiscal year 2013. In addressing our objectives, we met with officials from the organizations  identified in table 9. We conducted this performance audit from October 2016 to March 2019  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives. While this audit was initiated in October 2016, work was suspended from  December 2016 until September 2017 due to other engagement work. Appendix II: Additional Examples  of DODIG  Initiatives to Improve Timeliness This appendix provides additional examples of Department of Defense  Office of Inspector General (DODIG) timeliness improvement initiatives.  According to DODIG officials, recent steps to improve the timeliness of  whistleblower reprisal and senior official misconduct intakes,  investigations, and oversight reviews include: Transferring the intake of most military reprisal complaints to the  DODIG oversight branch for increased consistency. Changing the intake metric from 30 to 45 days for non-military reprisal  cases to allow for more robust intakes. Not requiring a clarification interview when a written reprisal complaint  is clear. Requesting documents from the employer at the intake stage in  contractor reprisal cases. Interviewing subjects early in the investigation, when appropriate. Conducting investigative travel only when doing so would save time or  for other compelling reasons. Otherwise, most interviews are  conducted by phone or video teleconference and information is  requested in opening letters for investigations to facilitate early receipt  of documentary evidence. Using summary reports of investigation to facilitate timelier report- writing and review. DODIG issued 24 summary reports in fiscal year  2018, starting in May, for simple, non-substantiated investigations. Eliminating the requirement to conduct peer reviews of the reprisal  reports of investigation, except at supervisors’ discretion. Using standardized complaint notification and determination forms  across DOD to formalize the processing of complaints received by  component and service IGs. Implementing a more robust intake process for senior official  misconduct investigations, which includes complaint clarifications and  more investigative work. According to DODIG officials, most of the  complaints reviewed during this new process would have otherwise  been investigated by DODIG or the military service IGs, with a  negative impact on the overall timeliness of investigations. Authorizing the military service IGs to close and simultaneously notify  the DODIG reprisal investigations directorate of actions taken for  complaints relating to uncooperative complainants, untimely  complaints, and withdrawn complaints. This has increased notification  rates and decreased processing time, according to DODIG officials. Appendix III: Characteristics of Closed  Misconduct and Reprisal Cases Involving  Civilian DOD Presidential Appointees  with  Senate Confirmation This appendix provides information on the characteristics of closed and  dismissed misconduct and reprisal cases involving civilian DOD  Presidential appointee with Senate confirmation (PAS) officials based on  our analysis of fiscal year 2013 through fiscal year 2017 case data from  the Department of Defense Office of Inspector General (DODIG) case- management system and our review of dismissed cases. DODIG closed  129 cases from October 1, 2012, through September 30, 2017, of which  125 were dismissed. Of the 125 dismissed cases, 117 were misconduct  cases and eight were reprisal cases. Organizational Source of  Complaints Dismissed in  Fiscal Years 2013-2017 DODIG dismissed 125 civilian DOD PAS official misconduct and reprisal  cases. The largest number of cases—40 (32 percent)—were submitted  by defense agency employees. Employees from the Navy submitted the  next highest number of complaints, with 31 (25 percent), followed by the  Army, which accounted for 26 (21 percent) of the complaints. Figure 9  shows the percentage of dismissed cases closed from fiscal years 2013  through 2017, by organizational source. DODIG Number of Days to  Close Dismissed Cases,  Fiscal Years 2013-2017 Our review of the 125 dismissed civilian DOD PAS official cases closed  by DODIG from fiscal years 2013 through 2017 showed that the majority  of cases were closed in 30 days or less. Specifically, approximately 81  percent of the cases were closed in 30 days or less, and 58 percent of the  cases were closed in 10 days or less. Table 10 groups the cases  dismissed in each fiscal year from fiscal years 2013 through 2017 by the  number of days to close. DODIG Closed  Misconduct Case  Allegations, Fiscal Years  2013-2017 We reviewed data on the number and type of allegations made against  civilian DOD PAS officials in the 117 closed misconduct cases from fiscal  years 2013 through 2017. In total, there were 152 allegations across the  117 closed cases. Allegations are grouped into 13 broad categories and  38 sub-allegation categories. From fiscal years 2013 through 2017, we  found that the greatest proportion of allegations, at 47 percent, were  personal misconduct and ethical violations. Personnel matters—at 14  percent—and “other”—an indeterminate category at 12 percent—were  the next two largest in proportion of allegations. Figure 10 provides the  percentages of allegations in closed misconduct cases from fiscal years  2013 through 2017. Appendix IV: Survey of Select DODIG  Employees GAO administered the survey questions shown in this appendix to learn  more about DODIG processes related to the access and protection of  whistleblower records, and the avenues available to DODIG employees to  resolve conflict and report alleged misconduct themselves. The survey  was divided into four sections: information access and protection,  confidentiality, resolving internal conflict, and reporting misconduct.  Survey questions without response options were open-ended. This  appendix accurately shows the content of the web-based survey but the  format of the questions and responses options have been changed for  readability in this report. For more information about our methodology for  designing and administering the survey, see appendix I.  1.  How long have you worked in Administrative Investigations (AI)? Please consider your full tenure across all AI directorates (DOD  Hotline, Investigations of Senior Officials, and Whistleblower Reprisal  Investigations) if you have worked in more than one directorate.  (Response options provided: radio buttons labeled “Less than 1 year,”  “1 year or more but less than 5 years,” “5 years or more but less than  10 years,” and “10 years or more.”) SECTION I: Information Access and Protection  2. Formal  training  (in-person/w eb-based) Informal  training  (staff meetings/briefings) Please  describe any other guidance  you have received . ii.  Do you believe the guidance identified above is sufficient or  insufficient in specifying requirements for properly securing  whistleblower records in your directorate? Select only one    Sufficient  SKIP to Question 4  Insufficient  Continue to 1 below    Not sure  SKIP to Question 4  1.  Why do you believe the guidance is insufficient? SKIP to  iii.  Would guidance that specifies access restrictions and security  controls for handling whistleblower records be helpful?  (Response options provided: radio button labeled “yes” and  “no.”)  1.  Please explain why guidance would or would not be  helpful.  4.  Are you aware of any controls in place to restrict access to D-CATS  records to only DODIG employees (either within or outside your  directorate) with a need to know? Select only one    Yes  Continue to i    No  SKIP to Question 5  I’m not sure  SKIP to Question 5  i. Please describe the control(s) in place to restrict access to D- CATS records.  5.  During your tenure at DODIG, have you or other DODIG employees  (either within or outside your directorate) been able to access records  in D-CATS without a need to know? This applies to potential access  to records, regardless of whether anyone actually accessed records  or not.    Yes  Continue to i    No  SKIP to Question 6  I don’t know  SKIP to Question 6  i.  Which DODIG directorate’s records have you or other DODIG  employees been able to access without a need to know?  (Response options provided: checkboxes labeled “DOD  Hotline,” “Investigations of Senior Officials,” “Whistleblower  Reprisal Investigations,” and “Office of Professional  Responsibility.”) ii. Are you aware of any actions taken to address the ability of  DODIG employees to access records without a need to know?  Examples of actions taken include a policy or procedure  change, additional guidance, or other actions taken.    Yes  Continue to 1 below    No  SKIP to 2 below  1.  Please describe the action(s) taken.  2.  What improvements, if any, could be made to address the  ability of DODIG employees to access records without a  need to know?  6.  Do you believe protections are sufficient or insufficient to ensure only  DODIG employees with a need to know can access records in D- CATS? Select only one    Sufficient  Continue to i    Not sure  SKIP to Question 7  i.  Why do you believe the protections are sufficient or  insufficient?  7.  Are you able to access classified information when needed to perform  the duties required of your position? Select only one    Yes  SKIP to Question 8    No  Continue to i  I do not require access to classified information to perform the  duties of my position  SKIP to Question 8  i. Formal  training  (in-person/w eb- based) Informal  training  (staff  meetings/briefings) Please  describe any other guidance  you have received. Formal  training  (in-person/w eb- based) Informal  training  (staff  meetings/briefings) Please  describe any other guidance  you have received. ii.  Do you believe the guidance identified above is sufficient or  insufficient in specifying how to determine whether disclosing  the identity of a complainant or source (e.g., witness) is  unavoidable?    Sufficient  SKIP to 2 below  Insufficient  Continue to 1 below    Not sure  SKIP to 2 below  1.  Why do you believe the guidance is insufficient?  2.  What improvements, if any, do you think could be  made to guidance specifying how to determine whether  disclosing the identity of a complainant or source (e.g.,  witness) is unavoidable? (After answering, SKIP to  Question 12)  iii.  Would guidance that specifies how to determine whether  disclosing the identity of a complainant or source (e.g.,  witness) is unavoidable be helpful? (Response options  provided: radio buttons labeled “yes” and “no.”)  1.  Please explain why guidance would or would not be  helpful.  12. To your knowledge, is there one or more official(s) who is  responsible for determining whether disclosing the identity of a  complainant or source (e.g., witness) is unavoidable?    Yes  Continue to i    No  SKIP to Question 13  I don’t know  SKIP to Question 13  i.  Who is responsible for determining whether disclosing the identity  of a complainant or source (e.g., witness) is unavoidable?  13. While working in AI, have you ever encountered a situation where  disclosing the identity of a complainant or source (e.g., witness) was  unavoidable?    Yes  Continue to i    No  SKIP to Question 14  i.  Please describe the general circumstance(s) and the steps you  took to verify that the circumstance(s) required disclosing the  identity of a complainant or source (e.g., witness). Please do not  provide individual names related to the actors involved.  14. Between June 1, 2017, and today, are you aware — either by  experiencing firsthand or directly observing actions of another person  – of an instance where the identity of a complainant or source (e.g.,  witness) was disclosed by a DODIG employee to an organization or  individual without a need to know (i.e., an avoidable disclosure)?  Please check only one below.    No, I am not aware of any avoidable disclosures  SKIP to    Yes, I am aware of one or more avoidable disclosure(s)   Continue to i  i.  How many avoidable disclosures are you aware of between  June 1, 2017, and today? For example, if the identity of a  complainant was revealed to one person who did not have a  need to know, please consider that event as one instance.  Similarly, if the identity of a source was revealed separately to  two different people who did not have a need to know, please  consider those events as two instances.  ii.  Please describe any actions taken in response to the  avoidable disclosure(s) you are aware of between June 1,  2017, and today. Examples of actions taken include but may  not be limited to retracting/recalling a referred complaint, a  change to policy, procedure or guidance, and notifying the  complainant or source, among other actions.  15. What improvements, if any, could be made to prevent avoidable  disclosures from happening in the future?  16. Please describe any best practices that you follow to help prevent  avoidable disclosures. SECTION III: Resolving Internal Conflict  17. Have you ever contacted the DODIG Office of the Ombuds or  participated in a DODIG Office of the Ombuds activity in order to  address conflict among DODIG employees? Examples of DODIG  Office of the Ombuds activities include but are not limited to providing  confidential advice for resolving conflict among peers and supervisors  and participating in an Ombuds-led mediation among DODIG  employees.    Yes  Continue to i    No, but I know about the DODIG Office of the Ombuds   I do not know about the DODIG Office of the Ombuds  SKIP  to the next section  i.  Do you believe the DODIG Office of the Ombuds provided or is  providing sufficient or insufficient assistance to address the  conflict(s) for which you contacted the Ombuds or participated in  an Ombuds activity?    Sufficient  Continue to 1  Insufficient  Continue to 1    Too soon to tell  Continue to 1  1.  Please describe, in general terms, your latest experience  working with the DODIG Office of the Ombuds. Please do  not provide the names of individuals involved with your  experience.  18. Have you ever considered reaching out to the DODIG Office of the  Ombuds, but ultimately chose not to?    Yes  Continue to i    No  SKIP to the next section  i.  How much, if at all, did each of the following contribute to  your decision not to utilize DODIG Office of the Ombuds  services? Select one in each row. Resolved  the issue  through another  avenue  Not  sure how  to initiate  contact w ith the Ombuds  Concern  about length  of  process  Concern  about objectivity  or conflict of interest  w ithin the Office of the  Ombuds  Fear that confidentiality  w ould be compromised  Fear of retaliation  or  reprisal from w ithin  DODIG  Please  describe any other factor(s) that contributed  to your decision not to utilize  DODIG  Office of the Ombuds  services. SECTION IV: Reporting Misconduct  19. As a DODIG employee, have you ever personally reported  misconduct against another DODIG employee through DODIG’s  internal process for investigating alleged misconduct? For the  purposes of this survey, “misconduct” refers to (1) a violation of a  provision of criminal law, (2) a violation of a recognized standard,  such as a federal or DOD regulation, or (3) a matter of concern  involving DOD leadership that could reasonably be expected to be of  significance to DODIG.    Yes  Continue to i    No  SKIP to iii  i.  Did you report misconduct on or before September 30, 2016?    Yes  Continue to 1 below    No  SKIP to ii  1.  Do you believe your report(s) of misconduct on or before  September 30, 2016 were investigated in a fair and objective  manner? (Response options provided: radio buttons labeled  “yes” and “no.”)  a.  Please describe your general experience(s) in reporting  misconduct against a DODIG employee on or before  September 30, 2016, including why you do or do not  believe your report(s) of misconduct were investigated in a  fair and objective manner. Please do not provide the  names of individuals related to the misconduct you  reported.  ii.  Did you report misconduct on or after October 1, 2016?    Yes  Continue to 1 below    No  SKIP to Question 20  1.  Do you believe your report(s) of misconduct on or after  October 1, 2016 were investigated in a fair and objective  manner? (Response options provided: radio buttons  labeled “yes,” “no,” and “too early to have an opinion”)  a.  Please describe your general experience(s) in  reporting misconduct against a DODIG employee on or  after October 1, 2016, including why you do or do not  believe your report(s) of misconduct were investigated  in a fair and objective manner. Please do not provide  the names of individuals related to the misconduct you  reported.  iii.  Do you know how to report misconduct against another DODIG  employee through DODIG’s internal process? (Response options  provided: radio buttons labeled “yes” and “no.”)  20. Thinking about the time period on or before September 30, 2016, did  you ever consider reporting misconduct against a DODIG employee  through DODIG’s internal process, but ultimately choose not to?    Yes  Continue to i    No  SKIP to Question 21  i.  How much, if at all, did each of the following contribute to your  decision not to report incident(s) of misconduct on or before  September 30, 2016? Select one in each row. Resolved  the issue through  another avenue  Not  sure how  to report  misconduct  Concern  about length  of  process  Concern  about objectivity or  conflict of interest w ithin  DODIG’s  internal  process to  report misconduct    Fear that confidentiality  w ould  be compromised  Fear of retaliation  or reprisal  from w ithin DODIG  Please  describe any other factor(s) that contributed  to your decision not to report  incidents  of misconduct  on or before September  30, 2016. 21. Thinking about the time period on or after October 1, 2016, did you  ever consider reporting misconduct against a DODIG employee  through DODIG’s internal process, but ultimately choose not to?    Yes  Continue to i below    No  SKIP to Question 22  i.  How much, if at all, did each of the following contribute to your  decision not to report incident(s) of misconduct on or after October  1, 2016? Select one in each row. Resolved  the issue through  another avenue  Not  sure how  to report  misconduct  Concern  about length  of  process  Concern  about objectivity or  conflict of interest w ithin  DODIG’s  internal  process to  report misconduct    Fear that confidentiality  w ould  be compromised  Fear of retaliation  or reprisal  from w ithin DODIG  Please  describe any other factor(s) that contributed  to your decision not to report  incidents  of misconduct  on or after October  1, 2016. 22. How well, if at all, do you believe DODIG’s internal process for  reporting misconduct protects the confidentiality of DODIG  employees? (Response options provided: radio buttons labeled “Not  at all,” “Slightly,” “Somewhat,” “Very well,” and “I don’t know.”)  23. What improvements, if any, do you think could be made to DODIG’s  internal process for reporting misconduct to protect the confidentiality  of DODIG employees?  24. How well, if at all, do you believe DODIG’s internal process handles  misconduct allegations against DODIG employees? This includes  activities associated with both assessing incoming complaints and  subsequently investigating them, as appropriate. (Response options  provided: radio buttons labeled “Not at all,” “Slightly,” “Somewhat,”  “Very well,” and “I don’t know.”)  25. What factors contribute to your opinion about DODIG’s internal  process for handling misconduct allegations against DODIG  employees?  26. What improvements, if any, do you think could be made to DODIG’s  internal process to improve the handling of misconduct allegations?  27. If you would like to comment on any of the topics covered by this  survey, or anything else that you feel might be relevant to our review  on the DOD whistleblower program, please do so below. Appendix V: Comments from the Department  of Defense Appendix VI: GAO Contact and Staff  Acknowledgments GAO Contact Staff  Acknowledgments In addition to the contact named above, Alissa Czyz (Assistant  Director),Tracy Barnes, Amy Bush, Nicole Collier, Ryan D’Amore, Chad  Hinsch, Linda Keefer, Kevin Keith, Amie Lesser, Serena Lo, Michael  Silver, and Lillian Yob made key contributions to this report. Related GAO Products Office of Special Counsel: Actions Needed to Improve Processing of  Prohibited Personnel Practice and Whistleblower Disclosure Cases.  GAO-18-400. Washington, D.C.: June 14, 2018. NASA Contractor Whistleblowers: Steps Taken to Implement Program but  Improvements to Timeliness and Guidance Needed. GAO-18-262.  Washington, D.C.: March 8, 2018. Whistleblower Protection: Opportunities Exist for DOD to Improve the  Timeliness and Quality of Civilian and Contractor Reprisal Investigations.  GAO-17-506. Washington, D.C.: September 29, 2017. Contractor Whistleblower Protections Pilot Program: Improvements  Needed to Ensure Effective Implementation. GAO-17-227. Washington,  D.C.: March 2, 2017. Whistleblower Protection: Additional Actions Would Improve Recording  and Reporting of Appeals Data. GAO-17-110. Washington, D.C.:  November 28, 2016. Whistleblower Protection: DOD Has Improved Oversight for Reprisal  Investigations but Can Take Additional Actions to Standardize Process  and Reporting. GAO-16-860T. Washington, D.C.: September 7, 2016. Department of Energy: Whistleblower Protections Need Strengthening.  GAO-16-618. Washington, D.C.: July 11, 2016. Whistleblower Protection: DOD Needs to Enhance Oversight of Military  Whistleblower Reprisal Investigations. GAO-15-477. Washington, D.C.:  May 7, 2015. Whistleblower Protection: Additional Actions Needed to Improve DOJ’s  Handling of FBI Retaliation Complaints. GAO-15-112. Washington, D.C.:  January 23, 2015. Whistleblower Protection Program: Opportunities Exist for OSHA and  DOT to Strengthen Collaborative Mechanisms. GAO-14-286.  Washington, D.C.: March 19, 2014. Whistleblower Protection: Actions Needed to Improve DOD’s Military  Whistleblower Reprisal Program. GAO-12-362. Washington, D.C.:  February 22, 2012.
Safeguarding confidentiality to the maximum extent possible is essential for encouraging whistleblowers to report wrongdoing without fear of reprisal. In fiscal year 2018, DODIG received over 12,000 contacts from potential whistleblowers related to fraud, waste, abuse, employee misconduct, or other violations. The National Defense Authorization Act for Fiscal Year 2017 included a provision for GAO to review the integrity of DOD's whistleblower program. This report assesses the extent to which DODIG and the military service IGs (1) met and took steps to achieve key fiscal year 2018 timeliness and quality goals, (2) established processes to protect whistleblower confidentiality, and (3) are able to safeguard sensitive information necessary to handle whistleblower complaints. It also evaluates (4) the extent to which select cases involving certain senior DOD civilian officials met key requirements. GAO assessed fiscal year 2018 IG performance data, surveyed all 108 DODIG employees who directly handle whistleblower complaints, reviewed IT security controls, and analyzed all 125 cases involving civilian DOD Presidential appointees with Senate confirmation dismissed by DODIG in fiscal years 2013-2017. The Department of Defense Office of Inspector General (DODIG) and military service offices of inspector general (IG) met some but not all fiscal year 2018 timeliness and quality goals for handling whistleblower complaints. For example, DODIG met its goals related to referring complaints to the appropriate agency within a certain number of days. All IGs also generally met goals related to the quality of investigations. However, about 85 percent of DODIG reprisal and senior official misconduct investigations exceeded statutory and internal timeliness goals. Further, military service IGs did not meet most goals for handling cases within prescribed timeframes. For example, the service IGs averaged between 17 and 84 days to notify DODIG of their receipt of whistleblower reprisal allegations, exceeding the 10-day goal. The IGs have various initiatives underway to improve timeliness, such as a Naval IG program to reduce timeframes for initial credibility determinations. However, additional actions could provide a more targeted approach to improving performance against unmet timeliness goals—such as for senior official misconduct investigations—and better assure whistleblowers that their cases will be handled expeditiously. DODIG and the military service IGs have policies to protect whistleblower confidentiality, but some gaps exist. For example, DODIG guidance for protecting whistleblowers who report internal DODIG misconduct does not specify key steps investigators should take to protect confidentiality, such as not identifying complainants during interviews with case subjects. Also, Air Force, Naval, and Marine Corps IG guidance does not specify when whistleblower identities can be disclosed without consent. Without updated guidance, the IGs cannot ensure the consistent implementation of confidentiality protections. The IGs have taken steps to safeguard whistleblower information in their information technology (IT) systems and applications, such as by restricting access to case information through unique user permissions and by taking actions to follow DOD's IT risk management process. However, between 2016 and 2018, employees in all of the IGs have been able to access sensitive whistleblower information without a need to know. For example, DODIG determined that numerous restricted whistleblower records in its document repository were accessible to DODIG personnel without a need to know. Similarly, the Air Force IG's application did not restrict users from other DOD components from viewing Air Force IG case descriptions and complainant identities, while the Army IG's application and the Naval IG's system did not restrict personnel within those IGs from viewing allegations or investigations involving other personnel within those IGs. Additionally, employees in Marine Corps IG offices were able to see whistleblower cases assigned to other IG offices without a need to know. While some actions have been taken to address these issues, additional steps are needed to restrict access to case information in order to mitigate ongoing risks to whistleblower confidentiality. DODIG generally met key documentation requirements for the 125 cases it dismissed without investigation involving civilian DOD Presidential appointees with Senate confirmation.