Homeland Security: CDC's Oversight of the Select Agent Program
(22-NOV-02, GAO-03-315R).
In the wake of anthrax incidents and mounting concerns about the
potential for another bioterrorism attack, we assessed the
Centers for Disease Control and Prevention's (CDC) oversight of
the Department of Health and Human Services' (HHS) Laboratory
Registration/ Select Agent Transfer Program. We brought program
weaknesses we identified to the immediate attention of CDL and
HHS officials, who agreed that improvements were warranted. The
purpose of this report is to summarize our findings.
-------------------------Indexing Terms-------------------------
REPORTNUM: GAO-03-315R
ACCNO: A05605
TITLE: Homeland Security: CDC's Oversight of the Select Agent
Program
DATE: 11/22/2002
SUBJECT: Biological warfare
Internal controls
Program evaluation
Regulatory agencies
National preparedness
HHS Laboratory Registration/Select Agent
Transfer Program
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO Product. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
******************************************************************
GAO-03-315R
GAO- 03- 315R CDC*s Select Agent Program United States General Accounting
Office
Washington, DC 20548
November 22, 2002 The Honorable Tommy G. Thompson Secretary of Health and
Human Services
Subject: Homeland Security: CDC*s Oversight of the Select Agent Program
Dear Mr. Secretary: The intentional dissemination of anthrax in the U. S.
mail last fall demonstrates the devastating effect a biological agent can
have if it falls into the wrong hands. Exposures to anthrax- tainted mail
resulted in five deaths and 17 other infections, as well as significant
disruption to postal service and other government operations. The sources
from which terrorists can potentially obtain biological agents include
public and private research laboratories located in the United States, and
there is concern that the anthrax used in these incidents may have been
obtained from federal or other domestic laboratories.
In the Antiterrorism and Effective Death Penalty Act of 1996, 1 the
Congress included provisions to regulate the transfer between laboratories
of certain biological agents and toxins* called select agents* and
required the Secretary of Health and Human Services (HHS) to issue
regulations to implement these provisions. In response, HHS established in
1997 the Laboratory Registration/ Select Agent Transfer Program at the
Centers for Disease Control and Prevention (CDC), which developed the
current list of 42 select agents covered by the program. The Select Agent
Program is responsible for regulating the transfer of select agents to
limit their distribution to only those laboratories that have the
appropriate safety and security controls for handling biologic agents. 2
Facilities interested in transferring* sending or receiving* select agents
must be registered with CDC. 3 To register, facilities must demonstrate in
their applications that they meet the conditions for safety and security
and have legitimate research needs for the agents, and CDC may inspect
facilities before and after registration to ensure compliance.
Laboratories possessing but not transferring select agents are not subject
to the act.
In the wake of the anthrax incidents and mounting concerns about the
potential for another bioterrorism attack, we have assessed CDC*s
oversight of the Select Agent
1 Pub. L. No. 104- 132, S: 511, 110 Stat. 1214, 1284- 1285 (1996). 2 CDC
oversees the domestic transfer and possession of select agents. The
Commerce Department*s
Bureau of Export Administration oversees a separate select agent export
program for transfers outside the United States. 3 CDC*s own laboratories
that transfer select agents must also register with the program and are
subject to its requirements.
GAO- 03- 315R CDC*s Select Agent Program 2 Program. We brought program
weaknesses we identified to the immediate attention
of CDC and HHS officials, who agreed that improvements were warranted. The
purpose of this report is to summarize our findings and confirm your
agreement to take prompt corrective action.
In conducting our work, we evaluated the Select Agent Program*s operations
by applying the criteria in the Office of Management and Budget*s (OMB)
Circular A- 123,
Management Accountability and Control 4 and in our Internal Control:
Standards for Internal Control in the Federal Government, 5 which lays out
five standards of internal control. These five standards* control
environment, risk assessment, control activities, information and
communication, and monitoring 6 *define the minimum level of quality
acceptable for internal control in government. We also reviewed the
registration applications for a nongeneralizable 10 percent random sample
of Select Agent Program registrants and those registrants* transfer forms,
which are required for transferring select agents; all CDC laboratory
inspection reports; information in CDC*s database on registered facilities
and select agent transfers; and Select Agent Program policies and
procedures. We interviewed program and management staff in CDC*s Select
Agent Program in Atlanta, Ga., and in HHS. Additionally, we reviewed the
Public Health Security and Bioterrorism Preparedness and Response Act of
2002. Our review was limited to CDC*s management of the Select Agent
Program and does not include the actual shipments of select agents or the
safety and security of registered facilities. In addition, consistent with
the scope of the Select Agent Program, we did not assess the merits of the
research conducted by program registrants. We conducted our review from
November 2001 through September 2002 in accordance with generally accepted
government auditing standards.
Results in Brief
As the agency responsible for identifying and controlling biological
agents that have the potential to pose a severe threat to public health
and safety, CDC can improve its management of the Select Agent Program to
reduce the likelihood of unauthorized access to biological agents. During
the course of our review, we identified and brought to the immediate
attention of CDC and HHS officials areas in which program oversight could
be strengthened, including inspection and approval of facilities and
monitoring of the transfer and shipment of select agents. To better
position CDC to reasonably ensure that appropriate security and safety
protections are in place for select agents, we made recommendations aimed
at establishing proper internal
4 Office of Management and Budget, OMB Circular A- 123, Management
Accountability and Control,
(Washington, D. C.: 1995). This document provides the specific
requirements for assessing and reporting on controls. 5 U. S. General
Accounting Office, Internal Control: Standards for Internal Control in the
Federal
Government, GAO/ AIMD- 00- 21. 3. 1 (Washington, D. C.: November 1999).
The Federal Managers* Financial Integrity Act of 1982 (FMFIA) requires us
to issue standards for internal control in government. Among other things,
the standards provide the overall framework for establishing and
maintaining internal control. 6 See the enclosure of this report for a
more detailed discussion of internal controls.
GAO- 03- 315R CDC*s Select Agent Program 3 control in accordance with OMB
Circular A- 123 over the Select Agent Program. In
discussing these recommendations with CDC officials, they concurred and
noted improvements planned or already in progress.
Background
Biological agents pose a severe public health threat in our country if
individuals or groups intent on harming the United States are able to
obtain them. To better ensure the safe transfer of select agents, the
Antiterrorism and Effective Death Penalty Act of 1996 required the
Secretary of HHS to
provide for safeguards to prevent access to such agents for use in
domestic or international terrorism or for other criminal purposes;
provide for the establishment and enforcement of safety procedures for the
transfer of the listed biological agents, including measures to ensure
proper training and appropriate skills to handle agents and proper
laboratory facilities to contain and dispose of agents;
establish and maintain a list of biological agents that have the potential
to pose a severe threat to public health and safety; and
provide for the establishment of procedures to protect the public safety
in the event of an actual or potential illegal transfer of a biological
agent.
HHS established the Select Agent Program within the Office of External
Activities under the Office of Health and Safety at CDC. Program funding
has increased substantially since the program was established in 1997.
Funding for fiscal year 2002 was originally $1 million. As a result of
Public Law 107- 117, enacted on January 10, 2002, an additional $3.6
million was made available to the program for fiscal year 2002. The
program was authorized to fund 21 staff in fiscal year 2002* up from 9 in
fiscal year 2001.
The regulations governing the Select Agent Program became effective on
April 15, 1997. 7 The regulations include six primary components: (1) a
list of select agents that have the potential to pose a severe threat to
public health and safety, 8 (2) registration of facilities prior to the
domestic transfer of select agents, (3) a process to document successful
transfer of agents, (4) audit, quality control, and accountability
mechanisms, (5) agent disposal requirements, and (6) research and clinical
exemptions. 9 To limit the distribution of select agents to laboratories
with appropriate safety and
security controls for handling biologic agents and a legitimate need for
such agents, 7 The regulations are set forth at 42 C. F. R. Part 72
(2002). 8 CDC*s select agent list consists of 42 viruses, bacteria,
rickettsiae, fungi, and toxins. CDC worked with representatives of several
countries, U. S. intelligence officials, and safety professionals to
establish its list based on a list of biological agents for export control
developed by the Australia
Group* an informal network of 33 countries that aims to minimize the
proliferation of chemical and biological weapons. 9 For example, vaccines
at certain stages of clinical research and clinical specimens are exempt.
GAO- 03- 315R CDC*s Select Agent Program 4 CDC requires U. S.- based
research institutions, government agencies, universities,
manufacturers, and other entities interested in transferring select agents
to be registered. 10 Registration is for 3 years. As part of the
registration process, facilities must demonstrate in their applications
that they meet the requirements delineated in
Biosafety in Microbiological and Biomedical Laboratories (BMBL) 11 for
working with particular select agents. Such requirements include having
proper laboratory and personal protective equipment, precautionary
signage, and ventilation; controlled access; and biosafety operations
manuals. Facilities must also describe the laboratory procedures that will
be used, provide a laboratory floor plan where the select agent will be
handled and stored, and describe how access will be limited to authorized
personnel. In addition, facilities must describe the objectives of the
work that requires the select agent. Each facility must identify a
responsible facility official who is authorized to transfer and receive
select agents on behalf of the facility. Individuals making false,
fictitious, or fraudulent statements or representations on registration
forms may be punished by a fine of up to $250,000, imprisonment up to 5
years, or both. Violations by organizations are punishable by a fine of up
to $500,000 per violation. 12 To ensure compliance with these
requirements, the program established a goal of inspecting these
facilities once during the 3- year registration period. Facilities may be
inspected before and after registration, but there is no requirement that
inspections be performed.
In June 2002, the President signed into law the Public Health Security and
Bioterrorism Preparedness and Response Act of 2002, which revises and
expands the Select Agent Program. 13 Among other requirements, the new law
requires all facilities possessing select agents to register with the
Secretary of HHS, not just those facilities sending or receiving select
agents; 14 restricts access to biological agents and toxins by persons who
do not have
a legitimate need and who are considered a risk by federal law enforcement
and intelligence officials;
10 There are a number of circumstances under which a facility might want
to send or receive a select agent. For example, some facilities have
select agents that other facilities would need to conduct research, such
as vaccine development. 11 U. S. Department of Health and Human Services,
Public Health Service, Centers for Disease Control and Prevention and
National Institutes of Health, Biosafety in Microbiological and Biomedical
Laboratories, Fourth Edition (Washington, D. C.: May 1999).
12 42 C. F. R. S: 72. 7. 13 Pub. L. No. 107- 188, 116 Stat. 594, 637- 647.
14 The law required all persons possessing select agents to register with
HHS by September 10, 2002,
and HHS issued guidance for how the notification of possession should be
made in July 2002. 67 Fed. Reg. 46,363 (2002). The department must
promulgate regulations for the select agent program by December 9, 2002,
to implement other requirements of the law.
GAO- 03- 315R CDC*s Select Agent Program 5
requires transfer registrations to include information regarding the
characterization of agents and toxins to facilitate their identification,
including their source; 15 requires the creation of a national database
with information on all
facilities and persons possessing, using, or transferring select agents;
directs the Secretary of HHS to review and publish the select agent list
biennially, making revisions as appropriate to protect the public; and
requires the Secretary to impose more detailed and different levels of
security for different select agents based on their assessed level of
threat to the public.
Select Agent Program staff estimate that this new law could result in a
tenfold expansion of their responsibilities because many more facilities
possess select agents than those registered to transfer them so far.
CDC Needs to Improve Internal Control Weaknesses to Better Manage the
Select Agent Program
We found significant management weaknesses in CDC*s facility registration
and transfer monitoring processes that impede effective program oversight.
As discussed with CDC officials, we recommended that CDC establish proper
internal control in accordance with OMB Circular A- 123. This would
include improvements in the following areas:
inspection and approval of facilities registering to transfer select
agents,
monitoring of the transfer and shipment of select agents,
accuracy of CDC databases of registered facilities and select agent
transfers, and
CDC organizational structure to improve oversight. HHS agreed with the
need for these corrective actions and stated that improvements were
already underway in some areas. Correcting these internal control
weaknesses is essential to CDC*s ability to effectively oversee both the
original and the expanded program required by the Public Health Security
and Bioterrorism Preparedness and Response Act of 2002. Because of the
urgent and potentially serious public health
15 According to the Conference Report accompanying the law, one purpose of
the registration and database requirements is to collect sufficiently
detailed information on the registered select agents so that the database
can differentiate between and within strains of a given agent or toxin.
Such information should be in a format that public health and law
enforcement officials can use to identify
the origin or source of an agent that is used to cause harm to the public.
H. R. Conf. Rep. No. 107- 481, at 121 (2002).
GAO- 03- 315R CDC*s Select Agent Program 6 threat in our country if
corrective action is not taken expeditiously, we will be
conducting periodic work to follow up on your progress in implementing our
recommendations.
- - - - - We are sending copies of this report to the Senate Committees on
Appropriations; Governmental Affairs; and Health, Education, Labor, and
Pensions; and the House Committees on Appropriations; Energy and Commerce;
and Government Reform. We will also make copies available to others on
request. In addition, the report will be available at no charge on GAO*s
Web site at http:// www. gao. gov. If you or your staff have any
questions, please contact me at (202) 512- 7101.
Sincerely yours, Cynthia A. Bascetta Director, Health Care
Enclosure
Enclosure Enclosure 7 GAO- 03- 315R CDC*s Select Agent Program
INTERNAL CONTROLS Our Internal Control: Standards for Internal Control in
the Federal Government 16 lays out the standards for internal control.
Internal control is an integral part of a government organization's
management that provides reasonable assurance that the following four
objectives are being achieved:
operations are effective and efficient;
financial and other reporting is reliable;
applicable laws and regulations are complied with; and
unauthorized acquisition, use, or disposition of an agency's assets is
prevented or detected.
To achieve these four objectives, agencies should meet five standards for
internal control in the federal government. Agencies should
have an effective control environment,
conduct risk assessments,
implement control activities,
properly record information and communicate to management, and
ensure monitoring. A brief explanation of each of the five standards for
internal control follows. Control Environment Management and employees
should establish and maintain an environment
throughout the organization that sets a positive and supportive attitude
toward internal control and conscientious management.
Risk Assessments Agencies should provide for an assessment of risk the
agency faces from both internal and external sources in accomplishing its
mission. Control Activities Agencies should establish and carry out
specific control activities* policies,
procedures, techniques, and mechanisms* that enforce management's
directives to help ensure that actions are taken to address risks and to
document critical events and transactions. 16 U. S. General Accounting
Office, GAO/ AIMD- 00- 21. 3. 1 (Washington, D. C.: November 1999).
Enclosure Enclosure
GAO- 03- 315R CDC*s Select Agent Program 8 Information and Communication
Channels Information should be recorded and communicated to management and
others within
the entity who need it and in a form and within a time frame that enable
them to carry out their internal control and other responsibilities.
Monitoring Internal control monitoring should assess the quality of
performance over time and ensure that the findings of audits and other
reviews are promptly resolved.
(290250)
*** End of document. ***