What GAO Found The Rural Health Transformation program provides funding for states to conduct rural health activities, such as recruiting clinicians to rural areas and providing training and technology to improve care delivery in rural hospitals. In the latter half of 2025, the Centers for Medicare & Medicaid Services (CMS) completed a number of early key actions to implement the Rural Health Transformation program. These actions included the release of the notice of funding opportunity—which provided details on program goals and requirements—and initial funding awards to all 50 states totaling $10 billion. The initial allotment of state funding ranged from $147 million for New Jersey to $281 million for Texas. CMS and merit reviewers assessed state applications based on a variety of factors—such as rural characteristics (e.g., total area in square miles and percent of population in rural areas) and the strength of states’ proposed initiatives. As a result, funding amounts variedacross states. Rural Health Transformation Program Funding, by State, Budget Period 1 (December 29, 2025, Through October 30, 2026) CMS plans on conducting a range of activities to monitor states’ activities and use of program funding. These monitoring activities include communicating with states to discuss progress and challenges, reviewing information states submit, and conducting audits and site visits. GAO found that its planned activities are generally consistent with selected requirements related to monitoring of federal awards. For example, CMS plans to measure awardee performance to show achievement of program goals and objectives, and hold webinars to share lessons learned, improve program outcomes, and foster the adoption of promising practices. CMS plans to allot up to $40 billion of the remaining program funds to states over the next 4 years based on their demonstration of satisfactory progress toward approved initiatives (e.g., progress toward planned milestones), among other activities. If states do not comply with the terms and conditions of their notices of award, CMS may withhold, reduce, or recover a portion of states’ program funding. The authorizing legislation of the Rural Health Transformation program limits states’ ability to appeal or challenge any funding changes made by CMS. However, officials said issues related to appeals or challenges of funding changes may depend on the specific facts and circumstances, and they are in the process of determining how the agency will handle any such disputes or challenges. Why GAO Did This Study In July 2025, the One Big Beautiful Bill Act established the Rural Health Transformation program to provide funding allotments to states for specified rural health activities. It will fund up to $50 billion to states over 5 years. The program is administered by CMS as cooperative agreements with states. Federal law provided CMS with broad discretion to determine funding allotments to states. Among other topics, this report describes CMS’s initial steps to establish the program, examines CMS’s plans to monitor states’ activities, and describes CMS’s approach for determining states’ future funding allotments. To conduct this work, GAO reviewed CMS documentation on Rural Health Transformation program implementation and monitoring. GAO also interviewed CMS officials and representatives from two rural health stakeholder groups and one state government stakeholder group selected among those with national membership. For more information, contact Leslie V. Gordon at GordonLV@gao.gov.

What GAO Found When homebuyers apply for a mortgage, lenders request their credit reports from credit reporting agencies. These agencies may then sell the homebuyers’ contact and credit information to other lenders and brokers, which use it to send competing loan offers. Before recent legislation, credit reporting agencies could, without the homebuyer’s consent, provide this information to those that did not have an existing relationship with the homebuyer (see figure). Thus, homebuyers could receive dozens of mortgage solicitations by phone or text in a short period. Example of the Mortgage Trigger Lead Marketing Process According to industry stakeholders, the primary benefit of trigger leads is that they can encourage homebuyers to comparison shop for loans and potentially save money. But this benefit may be limited: Recent federal survey results suggest that no more than 3.5 percent of homebuyers may have obtained a loan through competing offers based on trigger leads. One lender said homebuyers have ways to compare lenders before applying for a mortgage, so offers based on trigger leads generated later in the homebuying process may be less useful. Trigger leads resulted in a high volume of unwanted marketing solicitations and posed other drawbacks for some homebuyers, according to consumer advocates and industry stakeholders: A high volume of solicitations can overwhelm and confuse homebuyers, and aggressive tactics can annoy them. Broad dissemination of homebuyers’ information could expose them to misleading or deceptive practices. Homebuyers may view the sale of their personal information and resulting marketing solicitations as an invasion of privacy. In 2025, the Homebuyers Privacy Protection Act restricted credit reporting agencies’ ability to provide residential mortgage trigger leads to parties that have an existing relationship with or consent from the homebuyer. Because these restrictions took effect in March 2026, not enough time has passed to determine their effects on homebuyers. If effectively implemented, these restrictions could limit access to trigger leads and reduce the volume of solicitations homebuyers receive while preserving opportunities to comparison shop. Why GAO Did This Study Each year, millions of homebuyers apply for a mortgage, and some receive marketing calls and texts from other lenders and brokers with competing offers based on trigger leads. The volume of these mortgage solicitations prompted the enactment of the Homebuyers Privacy Protection Act in 2025. The act includes a provision for GAO to assess the value of trigger leads for homebuyers. This report examines (1) the potential benefits of trigger leads, (2) drawbacks associated with them, and (3) how the act’s restrictions may affect those benefits and drawbacks.  GAO reviewed federal and state laws, searched for and reviewed relevant literature, and analyzed 2022–2024 responses to the National Survey of Mortgage Originations. In addition, GAO obtained information from or interviewed officials of credit reporting agencies, consumer groups, mortgage lenders (banks, credit unions, and nonbanks), industry associations, the association for state banking regulators, and a state regulatory agency. GAO also analyzed the Consumer Financial Protection Bureau’s (CFPB) consumer complaints database and used artificial intelligence to identify complaints related to mortgage solicitations, and interviewed officials from CFPB and the Federal Trade Commission. For more information, contact William W. Colvin at colvinw@gao.gov.

What GAO Found Quantum computers leverage qubits (the quantum equivalent of classical computer bits) to solve specific problems significantly faster than classical computers. However, the emergence of quantum computers could undermine the cryptography (e.g., encryption) that federal agencies use to secure their systems. Today’s quantum computers cannot yet break this cryptography. But a future quantum computer of sufficient size and sophistication—referred to as a cryptographically relevant quantum computer (CRQC)—could potentially do so for certain cryptography. Most industry experts believe that a CRQC will be developed, possibly as soon as the 2030s. However, development estimates vary widely due to several factors, such as uncertainty in the rate of growth for qubits and how many qubits will be needed. Once a CRQC is developed, its use could have devastating impacts to federal systems reliant on vulnerable cryptography. For example, a malicious actor could use a CRQC tocompromise systems that ensure the authenticity of system users—thus allowing the actor to gain access to sensitive information; and decrypt (or unlock and view) data that the actor acquires and stores prior to the development of such a computer. To address the threat posed by a CRQC, it is important that agencies transition existing systems to more secure cryptography (referred to as post-quantum cryptography). Using Office of Management and Budget guidance, GAO created an evaluation framework of three practices that agencies should address to prepare for this transition. However, none of the 24 selected agencies fully addressed these practices (see figure). Extent to Which the 24 Chief Financial Officer Act Agencies Addressed Preparatory Practices for Migrating to Quantum Computing The incomplete implementation of these practices is due in part to a lack of (1) cryptography expertise, (2) processes for developing cryptography inventories and identifying funding needed to transition to post-quantum cryptography, and (3) plans to guide post-quantum cryptography testing. Until the selected agencies address these weaknesses, they will not be well-positioned to address the threat of CRQCs to cryptography that agencies rely on to protect sensitive information. Why GAO Did This Study Federal agencies rely on cryptography to protect sensitive data and systems. However, some experts predict that a quantum computer capable of breaking certain cryptography may be developed within the next 10 to 20 years. GAO was asked to review the threat of quantum computing to federal agency cryptography. This report describes (1) the threats quantum computers pose to cryptography on federal agencies’ information systems and (2) the extent to which federal agencies have begun preparing for this threat consistent with federal guidance. GAO also evaluated cryptography inventories, funding assessments, and other planning documentation at each of the 24 Chief Financial Officer Act agencies to determine the extent to which they had addressed transition preparatory practices consistent with federal guidance. This is a public version of a sensitive report that GAO issued in September 2025. We worked with the Office of the National Cyber Director from September 2025 through September 2026 to prepare this version.

What GAO Found Section 503 of the Rehabilitation Act of 1973 (Section 503) requires certain federal contractors to take proactive steps to employ people with disabilities. The Office of Federal Contract Compliance Programs (OFCCP) within the Department of Labor (DOL) oversees contractors’ compliance with Section 503. Since January 2025, DOL has reduced its oversight activities. For example, DOL has suspended audits of selected contractors, which were a key tool for monitoring compliance. From fiscal years 2017 through 2025, 532 audits found Section 503 violations. Without resuming audits, DOL has less assurance that contractors are supporting employment of people with disabilities. Further, DOL has reduced OFCCP’s workforce in response to changes in its activities (see fig.). However, these changes were not informed by strategic workforce planning consistent with key principles for such efforts. DOL has made changes to Section 503 regulations that could further impact OFCCP’s activities. Engaging in strategic workforce planning would help DOL ensure that OFCCP’s workforce composition meets its needs. Office of Federal Contract Compliance Programs Workforce, FY 2017–2026 Federal contractors face a range of challenges complying with Section 503. Selected stakeholders identified challenges in three key areas: conducting outreach to and recruiting people with disabilities, retaining and advancing people with disabilities, and demonstrating compliance with Section 503. Stakeholders also said that DOL could provide additional guidance to help contactors comply with the law. For example, information on how to provide reasonable accommodations and a list of best practices for Section 503 compliance could help contractors better understand how to support employees with disabilities. Why GAO Did This Study In fiscal year 2025, the federal government spent about $793 billion on contracts with federal contractors—which employ over 1 million U.S. workers. Section 503 prohibits federal contractors from discriminating in employment against people with disabilities. It also requires certain contractors to take proactive steps to employ and advance in employment people with disabilities. GAO was asked to review the implementation and oversight of Section 503. This report addresses (1) the extent to which DOL monitors Section 503 compliance and plans for its workforce needs, and (2) what challenges, if any, contractors face in complying with Section 503 and the extent to which DOL has provided resources to assist contractors. GAO analyzed OFCCP enforcement data and DOL human resources data, and reviewed DOL documents. GAO conducted interviews and discussion groups with DOL officials as well as representatives of contractors, consultants who assist contractors with compliance, academic researchers, and other stakeholders who were familiar with Section 503 compliance or supporting employment of people with disabilities. GAO also conducted a nongeneralizable survey of representatives of contractors.

What GAO Found The insurance plan sponsors that provide Medicare Part D drug coverage have increasingly become vertically integrated—that is, under common ownership—with pharmacy benefit managers and pharmacies. GAO found that, for four large Part D plan sponsors, the pharmacies they owned accounted for about 24 percent of the Part D drugs they provided to their enrollees (drug utilization) and about 28 percent of the total payments to pharmacies in 2023 (see figure). Payments included both reimbursement from plan sponsors and cost sharing paid by or on behalf of beneficiaries. When these vertically integrated plan sponsors’ own pharmacies provided drugs to their enrollees, they primarily did so through mail-order pharmacies. In contrast, other (non-owned) pharmacies primarily provided drugs through retail pharmacies. Percentage of Drug Utilization and Payments at Owned and Non-Owned Pharmacies for Four Selected Medicare Part D Plan Sponsors, 2023 When these plan sponsors paid pharmacies for a 30-day supply of the 100 most commonly used prescription drugs, payments and cost sharing for at least 94 percent of these drugs were lower for owned pharmacies than for non-owned pharmacies. These 100 drugs with the highest total utilization in 2023 were primarily generic drugs, and average payments to owned and non-owned pharmacies for a 30-day supply of most were $10 or less. Lower cost sharing at plan sponsors’ own (primarily mail-order) pharmacies gives beneficiaries a financial incentive to use these pharmacies instead of non-owned (primarily retail) pharmacies, though beneficiaries may consider other factors when choosing a pharmacy to fill a prescription. Payments to pharmacies and cost sharing were also generally lower at owned pharmacies for the 100 drugs with the highest total payments in 2023, which were primarily brand-name drugs. For some of these drugs, however, payments or cost sharing were higher at owned pharmacies. For example, cost sharing across the four selected plan sponsors was up to about $340 higher at owned pharmacies for about half of the 20 drugs with the highest payments per 30-day supply. Why GAO Did This Study Medicare Part D spent $150 billion on prescription drug coverage for 54 million beneficiaries in 2025. Vertically integrated plan sponsors may encourage beneficiaries to fill prescriptions at—or utilize—their own pharmacies, a practice known as steering. GAO was asked to review vertical integration among Part D plan sponsors, pharmacy benefit managers, and pharmacies. This report describes drug utilization at and payments to selected vertically integrated Part D plan sponsors’ own pharmacies compared to non-owned pharmacies, among other issues. GAO selected four vertically integrated Part D plan sponsors from among the 15 plan sponsors with the largest Part D enrollment in 2023. These four large, vertically integrated plan sponsors accounted for over 40 percent of total Part D enrollment in 2023. GAO analyzed the Centers for Medicare & Medicaid Services Part D utilization and payments data for 2023 (the data most recently available at the time of GAO’s analysis). Our results for the four selected plan sponsors for 2023 are not generalizable to other plan sponsors or years. For example, Part D benefit changes since 2023 could have affected plan sponsors’ Part D drug utilization and payments at owned and non-owned pharmacies. For more information, contact John Dicken at dickenj@gao.gov.

What GAO Found The Concrete Masonry Checkoff (CMC) program is a federally authorized, industry-funded program that supports research, education, and promotion projects intended to strengthen the concrete masonry industry and expand markets for its products. The term checkoff refers to the way similar programs are funded—that is, through assessments. The CMC Board administers the program, which is funded through mandatory assessments on specified concrete masonry units sold. From 2023 through 2025, the board collected over $27 million in assessments and spent nearly $15 million of the funds, primarily on 17 national projects and 69 regional projects. CMC Program Assessments and Projects, 2023–2025   2023 2024 2025 Total Assessments collected $5.4 million $11.3 million $10.5 million $27.2 million Expenses $1.1 million $3.5 million $10.4 million $15.0 million National projects approved 0 8 9 17 Regional projects approved 0 27 42 69 Source: Concrete Masonry Checkoff (CMC) Board information. | GAO-27-108692 The CMC Board uses key performance indicators to track progress toward the program’s objectives. Projects fall within six focus areas, including marketing, research, and education. For each area, the board established output-oriented indicators and corresponding 5-year goals. For example, one research indicator is the number of new engineering courses focused on concrete masonry and has a 5-year goal of 50 courses. As of year-end 2025, the board reported meeting or exceeding five of its 27 goals and achieving at least 20 percent of the target for 10 additional goals in its first year. The board plans to issue its required independent evaluation of the program’s effectiveness in the first quarter of 2027. The U.S. Department of Commerce is statutorily required to oversee the CMC Board’s compliance with applicable law and the accompanying order primarily through reviews, approvals, and monitoring. To set up its oversight structure, Commerce consulted with the U.S. Department of Agriculture (USDA) because of its experience overseeing agricultural checkoff programs. Commerce reviews and approves the CMC Board’s projects, contracts, annual budgets, objectives, and performance metrics. It also monitors program and contract execution, reviews projects and marketing materials for prohibited activities (e.g., false or misleading advertising), and may investigate violations and assess civil penalties. However, Commerce has not developed written procedures for approving the CMC Board’s annual program objectives and performance metrics. Commerce could do so using its current resources and thereby take advantage of a relatively low-effort opportunity to enhance its existing oversight controls. For example, such procedures could reduce the risk of inconsistent approvals and preserve organizational knowledge. Why GAO Did This Study The Concrete Masonry Products Research, Education, and Promotion Act of 2018 (the Act) directed Commerce to create the CMC program. After industry members approved the referendum to establish the program, Commerce put into effect a final order in 2021. The concrete masonry industry consists largely of small producers, and the checkoff program allows them to pool assessments for industry-wide research, education, and promotion. In 2023, the CMC Board estimated that about 260 concrete masonry producers operated in the United States. The Act includes a provision for GAO to review the CMC program. This report addresses (1) assessments the CMC Board collected and spent from 2023 through 2025, (2) the extent to which the board has evaluated the program’s effectiveness, and (3) how Commerce has overseen the board’s compliance with the Act and accompanying order. GAO reviewed CMC Board documents, including audited financial statements, policies and procedures, the strategic plan, and annual reports, including the results reported for key performance indicators. GAO compared Commerce’s oversight procedures and related documents against the Act, accompanying order, and federal internal control standards. GAO also interviewed Commerce, USDA, and CMC Board officials.

What GAO Found The U.S. Interagency Council on Homelessness (USICH) is an independent establishment in the executive branch that coordinates the federal response to homelessness. It consists of representatives from designated federal agencies (the Council) and a staff that has ranged from 10 to 18 full-time employees over the past decade. USICH’s enabling legislation—the McKinney-Vento Homeless Assistance Act—requires it to maintain certain personnel and perform specified duties. These include providing technical assistance to state and local governments through five to 10 regional coordinators employed by the Council, reporting annually to the President and Congress on federal efforts to address homelessness, and developing a national strategic plan to end homelessness. The act also established a termination date for USICH, which Congress has extended several times, most recently to October 1, 2028. The President’s most recent budget proposes to terminate USICH in fiscal year 2027. USICH began making changes to its staffing and operations in early 2025, including in response to Executive Order 14238, Continuing the Reduction of the Federal Bureaucracy. In April 2025, 11 of USICH’s 13 employees were placed on paid administrative leave. In the same month, the General Services Administration terminated USICH’s office lease and recovered its equipment. In November 2025, a federal district court found that USICH’s implementation of the executive order was unlawful. The court noted that the personnel reduction made it impossible for USICH to perform its statutory duties, among other things. The court set aside USICH’s prior actions to implement the order and barred it from doing so in the future. USICH has appealed the decision. Selected Developments Affecting the U.S. Interagency Council on Homelessness (USICH), January 2025–September 2026 Eight of 11 USICH employees returned from paid administrative leave in mid-February 2026. The other three left USICH prior to employees’ return to active status. As of May 2026, USICH had 10 full-time employees and a part-time executive director. USICH staff told GAO that, since their return, they had not received direction from the Council or the executive director on homelessness policies or priorities to guide their work or help them perform USICH’s statutory duties and functions. The executive director stated that the Council should provide guidance before USICH drafts a strategic plan or undertakes policy initiatives. Why GAO Did This Study Several federal agencies administer programs to address homelessness, and USICH was created in 1987 to coordinate these efforts and reduce homelessness. In early 2025, the President issued a series of directives to downsize the federal workforce and reorganize federal agencies. Among these, Executive Order 14238, issued in March 2025, directed seven federal entities—including USICH—to eliminate nonstatutory functions and to reduce statutory functions and associated personnel to the minimum required by law. GAO was asked to review USICH’s statutory responsibilities and recent changes to its staffing and operations. This report describes (1) USICH’s responsibilities under the McKinney-Vento Homeless Assistance Act and (2) the status of its staffing and operations. GAO reviewed the McKinney-Vento Homeless Assistance Act, relevant executive orders, court documents, and appropriations acts. GAO also reviewed USICH documentation, interviewed USICH’s executive director and staff, and requested information from three Council member agencies. For more information, contact Alicia Puente Cackley at CackleyA@gao.gov.

This Scroll-Driven Narrative tells the story of how the federal government is trying to strengthen U.S. manufacturing through Manufacturing USA—a national network of institutes that are partnerships between federal agencies, companies, universities, and others. It is a companion to a series of reports GAO has issued examining the Manufacturing USA program—for example, Advanced Manufacturing: Aligning Strategies and Improving Agency Reviews Could Help Institutes Achieve National Goals, GAO-25-107369. This product highlights key themes and recommendations from GAO’s prior work, such as recommendations to better measure performance across the Manufacturing USA network, as well as agency efforts to implement them. For more information, contact Hilary M. Benedict at benedicth@gao.gov.

What GAO Found In 2016, the Food and Drug Administration (FDA) expanded its authority to oversee all tobacco products, including millions of e-cigarettes that were already on the market. In response, it received a surge of applications from manufacturers in 2020 for products seeking authorization to remain on the market legally. Specifically, it received over 25 million applications in 2020 and 2021, compared to just over 1 thousand applications in 2018 and 2019. This led to a backlog of applications. While FDA has since reviewed most of the applications submitted during this period, almost 132 thousand remained without a completed review as of December 31, 2025. (See figure.) Figure: FDA Tobacco Product Application Reviews, Calendar Year (CY) 2018-2025 From CY2018 to CY2025, FDA took an average of 507 days to complete its review of tobacco product applications. FDA has goals for each phase of the review process, ranging from 7 to 180 days. For the screening phase, FDA did not meet its goals, although it has made progress toward them. FDA also has goals for the last phase of review, when it must review an application’s scientific information. However, FDA’s data system was not designed to track steps in this part of the review process. Thus, it does not collect the data necessary to monitor whether it is meeting these goals. According to practices identified in prior GAO work, collecting performance information and using it to monitor performance are needed to assess if programs and activities are achieving intended goals. Meeting these goals will help FDA ensure a more predictably timed application process, and more completed reviews will help clarify which products are legally marketed, thus allowing FDA to take action against unauthorized products. FDA has taken steps to improve review timeliness. For example, since the surge of applications, it issued multiple guidance documents for manufacturers to improve application quality, as it found that poor quality applications slowed the review process. In September 2025, the agency also created a pilot program aimed at streamlining the review process for nicotine pouches and plans to apply lessons learned from that pilot to other product types. However, the changes are too recent to know whether they will increase the timeliness of reviews. Why GAO Did This Study FDA has regulated certain tobacco products, such as cigarettes, since 2009. A surge of new product applications soon after led to an application backlog and significant delays, as GAO reported in 2013. FDA took steps to address these challenges and implemented performance measures for review timeliness. However, the 2016 expansion of FDA’s authority to oversee all tobacco products once again raised questions about timeliness. GAO was asked to provide an update on FDA’s efforts to review applications and provide timely responses. This report examines (1) the status of FDA’s reviews of tobacco product applications submitted 2018 through 2025, (2) the extent to which it met its timeliness goals for reviewing these applications, and (3) the steps FDA took to improve the timeliness of these reviews, among other topics. GAO analyzed FDA tobacco product application data for submissions FDA received in 2018 through 2025, reviewed agency documents, and interviewed FDA officials and tobacco representatives.

What GAO Found The Department of Health and Human Services (HHS) and the U.S. Department of Agriculture (USDA) sold 1,316 pieces of unneeded laboratory equipment in fiscal years 2022 through 2025. Of that 1,316, GAO identified nine pieces of equipment–freeze dryers and mass spectrometers–that were on the Commerce Control List and sold to individuals and companies in the U.S. and Canada, some of which appeared to be resellers. These items are subject to export controls because they could be used by certain countries of concern to develop biological weapons or to gain a military advantage. Examples of Laboratory Equipment on the Commerce Control List GAO found that HHS and USDA, in selling the nine pieces of equipment, did not report to the General Services Administration (GSA) that the items were on the Commerce Control List, as required by federal regulations. GAO identified two reasons: HHS’s policy is silent on this requirement and GSA’s property management system does not have a standard approach, such as a specific field, for agencies to report this information. Until HHS revises its policy and GSA creates a standard approach, GSA and potential recipients may not know when items are subject to export controls, risking harm to national security. GAO also found that HHS and USDA have not assessed the biosecurity risks associated with the disposal of its laboratory equipment. These risks include nefarious actors acquiring such items to create a biological weapon or obtain sensitive information from the equipment. This is because agency efforts have focused on decontamination of laboratory equipment, among other reasons. Regularly assessing the biosecurity risks and taking steps, as needed, to mitigate risks as part of HHS’s and USDA’s overall risk management efforts, could better position the agencies to prevent nefarious actors from procuring federal equipment. To illustrate risks, GAO used fictitious identities, including that of a nonprofit organization, to successfully acquire four pieces of HHS and USDA laboratory equipment that experts said could pose a biosecurity risk. Why GAO Did This Study Each year, HHS and USDA dispose of hundreds of pieces of unneeded laboratory equipment. Some of this equipment could potentially be used for malicious purposes. GSA handles the disposal process, which includes transferring it to other federal agencies or auctioning it to the general public, among other options. Certain high-risk items are identified on the Commerce Control List and require a license to be exported to certain countries to protect national security and public health. GAO was asked to review sales of equipment that pose a risk. This report, among other things, examines the extent to which the selected agencies (1) sold controlled laboratory equipment and did so in accordance with federal requirements, and (2) have assessed the risks associated with the sale of federal laboratory equipment. GAO reviewed GSA data for fiscal years 2022-2025 on sales of HHS and USDA laboratory equipment. GAO also used fictitious identities to attempt to acquire federal laboratory equipment, reviewed relevant regulations, and interviewed agency officials. GAO also visited a federal laboratory being decommissioned to review how the equipment will be disposed of.

What GAO Found The Fly America Act requires that, except under certain circumstances, all air travel funded by the U.S. government use a U.S.-flag air carrier service—which is generally provided by a U.S. airline or under a code share agreement with a foreign air carrier. GAO found that the Act increases State Department travel costs by an estimated $0.7 million to $1.5 million annually—about 1 to 2 percent of the $69 million State spent on air travel in fiscal year (FY) 2025. To derive this estimate, GAO analyzed a generalizable sample of simulated international travel itineraries for FY 2026. This sample consisted of 1,000 ticket pairs, each containing the least expensive unrestricted fare and most direct flight available for an Act-compliant ticket and -noncompliant ticket. For 5 percent of ticket pairs, GAO estimated that the Act increases State’s costs (reflecting both fare and travel time) by an average of $455 per ticket. For an additional 12 percent of ticket pairs, GAO estimated that the Act does not affect State’s costs. For the remaining 83 percent of ticket pairs, the Act’s effects on cost are uncertain because they are subject to assumptions about airline pricing strategies, among other factors. Some State travelers experience challenges during urgent and routine travel as a result of the Acts, according to State documents, data, and officials. For urgent travel—for example, authorized or ordered departures from foreign posts and emergency travel for personal circumstances, such as for a funeral—Act-compliant flights can be difficult to find on short notice and approvals for exceptions may take time to process, according to officials. For routine travel, implementation of the Act poses challenges in three main categories: (1) compliant flight availability, (2) travel with pets, and (3) State’s administrative process to apply for an exception to the Act. In FY 2025, State approved employees’ applications for an exception to the Act, allowing them to use a foreign air carrier, for approximately 6 percent of itineraries between U.S. and foreign destinations. State most often approved requests claiming an exception to reduce trip duration, to reduce layovers abroad, to ensure timely arrival to accomplish State’s mission, and to travel with pets for new post assignments and evacuation travel. State rejected approximately 14 percent of waiver requests in FY 2025. Ukraine Evacuation Flights Prior to Russian Invasion, Including Foreign Service Family Members Why GAO Did This Study The Act and its regulations allow travel on foreign carriers under certain circumstances, including when a U.S. air carrier is not available for medical reasons or traveler safety. However, a lower-price ticket on a foreign air carrier does not constitute an exception to the Act. The Act’s travel requirements may particularly affect State personnel, who represent 69 percent of all U.S. government personnel at U.S. posts abroad. Congress included a provision in law for GAO to review the Act’s effects on U.S. government costs and State personnel. This report examines the Act’s effects on (1) State’s estimated travel costs and (2) State personnel’s experience with urgent and routine travel. To examine the Act’s effects on State’s estimated travel costs, GAO developed a random, generalizable sample of 600 itineraries from the full universe of State’s 26,906 authorized itineraries for travel between a U.S. and a foreign destination in FY 2025. For each itinerary in this sample, GAO asked State to search for a pair of tickets—one ticket that complied with the Act and one that did not—for each route on specific dates in FY 2026. GAO analyzed any cost differences in the 1,000 resulting ticket pairs and extrapolated the results to derive a total cost estimate. To examine the Act’s effects on State personnel’s travel experience, GAO reviewed documentation, analyzed travel data, and interviewed State officials. For more information, contact Chelsa Kenney at kenneyc@gao.gov.

What GAO Found Most U.S. property owners are unprotected from flood risk. As of April 2026, 86 percent of high-risk properties did not have National Flood Insurance Program (NFIP) coverage. The number of NFIP policies declined from 5.5 million in 2010 to 4.5 million in 2026. Growth in the private market offset this decline, and private policies accounted for 14 percent of all policies in 2025. Federal law requires property owners with federally backed mortgages to purchase flood insurance if their property is in a special flood hazard area (SFHA) designated by the Federal Emergency Management Agency (FEMA). This mandatory purchase requirement is the primary reason consumers purchase flood insurance: an estimated 43 percent of properties in SFHAs had flood insurance, compared with 2 percent outside those areas. However, the requirement does not effectively ensure coverage for many at-risk properties. In particular, the FEMA maps used to determine the requirement do not capture all flood risks, especially heavy rainfall. GAO’s analysis of First Street data indicates that about 13 million high-risk properties are outside FEMA SFHAs. The Mandatory Purchase Requirement Does Not Reach Most At-Risk Properties Consumer misperceptions also can discourage flood insurance purchase. Consumers may underestimate their flood risk, overestimate the amount of federal disaster assistance after a flood, or believe that homeowners insurance covers flood damage when most policies specifically exclude it. GAO identified four actions that could help increase NFIP and private flood insurance coverage. Each would require statutory authority from Congress. Incorporating all sources of flood risk into purchase requirement determinations could help ensure that more at-risk properties have coverage. Making property-level flood risk information publicly available could increase awareness of flood risk. Requiring lenders to provide flood insurance quotes for federally backed mortgages could better signal the need for coverage. Increasing NFIP coverage limits could allow property owners to obtain coverage better aligned with potential flood losses. GAO previously recommended that any affordability assistance be means-based and reflected in the federal budget and that barriers to private flood insurance be removed. These actions could help ensure that more property owners are protected from flood risk. Why GAO Did This Study Flooding is the most common, costly, and destructive natural disaster in the United States, and its frequency and severity have increased in recent years. Flood insurance helps protect property owners from financial losses and supports recovery after floods. This report examines (1) the extent to which consumers purchase flood insurance, (2) the effectiveness of the mandatory purchase requirement, (3) factors affecting consumers’ decisions to purchase flood insurance, and (4) potential actions to increase consumer purchase of flood insurance. GAO analyzed 2008–2026 FEMA data on NFIP policies, 2018–2025 National Association of Insurance Commissioners data on private flood insurance policies, and property-level flood risk data from First Street—a risk modeling company. GAO also reviewed relevant reports and interviewed FEMA officials. In addition, GAO conducted three discussion sessions with 15 flood insurance stakeholders and reviewed its prior work and public research to identify potential actions to increase flood insurance purchase. GAO visited four flood-prone communities that reflected different flood types and income levels, and interviewed property owners, insurance agents, local officials, and other stakeholders.

What GAO Found According to a 2023 RAND report, an average of 1.4 million veterans faced food insecurity each year from 2015 to 2020, meaning their households did not have enough food for an active and healthy life. The Supplemental Nutrition Assistance Program (SNAP) provides benefits to low-income households to buy food. The U.S. Department of Agriculture (USDA) administers SNAP in partnership with states. The share of veterans receiving benefits varies by state, according to GAO’s analysis of Census Bureau data. Estimated Percentage of Veterans Who Lived in Households Receiving Supplemental Nutrition Assistance Program Benefits by State in 2024 States have the option to conduct outreach to increase awareness of SNAP and may target outreach to certain groups, such as veterans. States must have a USDA-approved outreach plan to receive partial federal reimbursement for their outreach expenses. Most states with outreach plans in fiscal year 2026 (39 of 47) identified veterans as a target group. However, stakeholders GAO interviewed reported that veterans' misconceptions about SNAP hinder outreach efforts. USDA has not developed outreach materials tailored to veterans in the past 5 years, despite recent program changes for veterans. Several stakeholders said that outreach materials, such as talking points dispelling myths about SNAP, would help them communicate more effectively with veterans. By developing and disseminating such materials, USDA could help ensure that trusted messengers, like veterans’ organizations, share accurate and up-to-date information on the program with food-insecure veterans. The Department of Veterans Affairs (VA) and USDA established a memorandum of agreement (MOA) to address veteran food insecurity in September 2023. However, the agencies’ collaborative efforts have slowed since April 2025 following the loss of key staff at USDA, according to VA officials. Agency officials told GAO they consider the MOA to still be in place; however, the agencies have not reviewed the MOA as specified in the agreement, making the current status of the MOA unclear. By ensuring a formal mechanism is in place to guide their collaboration, VA and USDA can enhance their efforts to ensure low-income veterans and their families have access to the food they need through programs like SNAP. Why GAO Did This Study Research has shown that food-insecure veterans are less likely than their nonveteran peers to participate in SNAP. GAO was asked to review states’ efforts to target SNAP outreach to veterans and work with veterans’ organizations to help connect veterans to the program. This report examines state and federal efforts to conduct SNAP outreach to veterans. GAO reviewed relevant federal laws, regulations, and agency documentation. GAO also analyzed survey data on veteran households’ receipt of SNAP benefits and reviewed states’ most recent SNAP outreach plans and reports. In addition, GAO interviewed VA and USDA officials and representatives of 16 stakeholder organizations, including national organizations with expertise on food assistance or veterans issues, as well as state SNAP agencies, outreach partners, and VA medical centers from three states. GAO selected states that were actively conducting SNAP outreach to veterans and varied by geographic region and the share of veterans receiving SNAP benefits. GAO selected other stakeholder organizations for their national perspectives on veteran food security issues.

What GAO Found Illicit actors hide their beneficial ownership in multiple ways to fraudulently access federal awards, such as contracts, grants, and Medicare payments, and to evade payment on taxes. GAO’s review of federal cases highlights tactics illicit actors have used, such as using stolen identities, shell companies, professional enablers, and pass-through billing schemes to hide ownership. For example, from July 2019 through January 2023, three purported hospice owners stole identities to register shell companies and defrauded Medicare for nearly $16 million. In another example, from June 2018 through September 2018, a foreign-based scam ring, with U.S. based conspirators, directed legitimate federal contractors to a fake government website. This pass-through billing scam caused the government to misdirect $23.5 million to the fraudsters. Pass-Through Billing Scam The federal award process requires recipients to disclose some information on company owners and relationships, but it generally does not require disclosure of beneficial owner information. For example, names of corporate officers and directors may be collected, but these individuals may not be the beneficial owners or exercise substantial control over the entity. Beneficial ownership information is available to a limited extent in data sources such as the Department of the Treasury’s Financial Crimes Enforcement Network’s (FinCEN) company registry, the General Services Administration’s (GSA) System for Award Management, and state incorporation registries. Changes in the scope of reporting requirements now exempt domestic entities from reporting beneficial ownership information in the FinCEN registry. This exemption removed about 99 percent of entities previously required to report. The National Defense Authorization Act for Fiscal Year 2021 includes a provision for the GSA to maintain a database that contains beneficial ownership information for federal contractors. A Federal Acquisition Regulation (FAR) case was opened in 2021 to implement this and other related provisions, but the FAR Council deadline to draft a proposed rule has been extended until at least September 2026. GSA had considered using FinCEN’s beneficial ownership registry to develop the database, but that source is now of limited use. GAO will continue to monitor progress on GSA’s efforts to implement the statutory provision. GAO’s analysis of federal award data highlights the hundreds of billions of dollars vulnerable to beneficial ownership-related fraud risks. Awards, such as contracts awarded to foreign businesses, are among those categories that are vulnerable to beneficial ownership fraud risks. Why GAO Did This Study Beneficial ownership information identifies the individuals who ultimately benefit or control a company. While individuals listed as company owners in state incorporation records may indeed be the beneficial owner, this is not always the case. GAO was asked to provide insights on what information is available from various federal, state, and commercial data sources to identify beneficial owners, and the related fraud risks to federal awards. GAO reviewed relevant fraud cases from various sources such as Department of Justice press releases; reviewed federal regulations on beneficial ownership reporting requirements; analyzed federal award data to assess potential financial impacts of beneficial ownership fraud in federal awards; and examined the nature of company ownership information collected in relevant federal datasets and state corporate registries. For more information, contact Rebecca Shea at SheaR@gao.gov.

This is a supplement to GAO’s 2025 revision of the Standards for Internal Control in the Federal Government, known as the Green Book, GAO-25-107721. The 2025 revision contained changes from, and supersedes, the 2014 revision of the Green Book, GAO-14-704G. The purpose of this supplement is to present the key changes to the 2025 revision of the Green Book. Resources For more information or for technical assistance regarding the Green Book, please call (202) 512-9535 or e-mail greenbook@gao.gov. Visit GAO’s Green Book website for more information on applicable updates and alerts. To receive updates and information related to standards, send an email with the subject “Subscribe” to TheStandardsTeam@gao.gov.

What GAO Found GAO has made 139 recommendations to the Director of National Intelligence (DNI) from July 2011 through September 15, 2026. These recommendations address issues with intelligence enterprise management, infrastructure and facilities, workforce management, and personnel vetting. As of September 15, 2026, the Office of the DNI (ODNI) has implemented 76 recommendations, or 55 percent. GAO closed six additional recommendations for various other reasons, such as a program having terminated or changed. By fully implementing the 57 remaining open recommendations, ODNI could improve the efficiency and effectiveness of its intelligence management and oversight. In July 2026, GAO identified six of these 57 as recommendations that ODNI should prioritize to improve intelligence operations and address high-risk issues. Why GAO Did This Study The James M. Inhofe National Defense Authorization Act for Fiscal Year 2023 includes a provision for the Comptroller General to submit a list to the Congressional Intelligence Committees and to the DNI of all GAO recommendations made to the DNI as of September 30, 2023, that had not been fully implemented, and annually thereafter through 2028. This letter and its enclosures is GAO’s fourth submission, which formally transmits and communicates the results of its work. For more information, contact Alissa Czyz at czyza@gao.gov.

What GAO Found The Department of Veterans Affairs (VA) has a policy to end harassment-related behaviors—including harassment of a non-sexual nature, sexual harassment, and sexual assault—at its VA medical centers. The policy gives certain VA medical center staff responsibility for managing reported incidents of these behaviors involving veterans. GAO’s analysis of VA data found there were over 31,000 reported incidents from fiscal years 2020 through 2025. Most involved veterans (or other patients) who engaged in these behaviors against staff. Number of Reported Incidents of Harassment-Related Behaviors Involving Veterans at VA Medical Centers, Fiscal Years 2020-2025 However, the data on reported incidents likely do not capture all incidents of harassment-related behaviors. According to reports by stakeholders, most individuals who experience such behaviors do not notify the institutions at which the incidents occur. For example, several studies found that just 2 to 7 percent of individuals formally notify someone about experiencing sexual harassment. Individuals’ unwillingness to report is attributed to causes such as fear of retaliation. As a result, stakeholders have indicated the importance of identifying the prevalence of these behaviors, or their occurrence regardless of whether individuals notify someone, to better understand their potential within organizations. This can be done through anonymous or confidential surveys. VA officials said they collect information on veteran experiences with certain harassment-related behaviors at a subset of VA medical centers to inform policies and practices. However, VA has not implemented any effort to identify the systemwide prevalence of these behaviors. Implementing a means to do so, such as through a survey, would better allow VA to know whether increases in reported incidents reflect greater willingness to notify staff or an actual increase in these behaviors. It also would help VA more effectively direct resources toward prevention and mitigation efforts to reach those most at risk. Why GAO Did This Study Harassment-related behaviors within the VA health care system may put veterans at risk and compromise care. For example, researchers have found that veterans who experience these behaviors may avoid needed care. Further, staff who experience such behaviors may rush care in response. In 2022, VA established a policy aimed at ending harassment-related behaviors, but reported incidents of these behaviors have since generally increased. GAO was asked to review VA processes for responding to harassment-related behaviors. This report describes data on reported incidents of these behaviors involving veterans at VA medical centers and examines VA’s efforts to identify the prevalence of these behaviors. GAO analyzed available VA data on reported incidents of harassment-related behaviors from fiscal year 2020 through fiscal year 2025; reviewed relevant VA policies; interviewed VA officials responsible for harassment-related matters; reviewed reports by and interviewed stakeholders, including officials from the National Academies of Sciences, Engineering, and Medicine and RAND, on their published work related to identifying the prevalence of these behaviors; and reviewed relevant publications from VA researchers.

What GAO Found The nation’s infrastructure relies on information systems to support its varied functions. This includes the networked Internet of Things (IoT) and operational technology (OT) devices that interact with the physical world, including in building maintenance systems and specialized equipment in hospitals and laboratories. Responsible federal agencies have issued guidance, best practices, and requirements to help agencies securely procure such devices. For example, the Office of Management and Budget (OMB) has issued requirements to ensure that agencies establish and maintain inventories of their networked devices and process IoT cybersecurity waivers. However, most agencies have not fully addressed OMB’s networked device requirements, which were established in December 2023 and updated in January 2025. Specifically, agencies’ initial inventories were required to be completed by September 2024. However, as of September 2026, of the 22 civilian Chief Financial Officer (CFO) Act agencies in GAO’s review, 15 had established an inventory, 11 were maintaining their inventories, and 10 had included all required information (such as asset description and software version) for each device. Overall, only seven agencies had fully addressed all three of OMB’s requirements. Further, no agencies had reported an IoT cybersecurity waiver. Status of 22 Agency Networked Device Inventories, as of September 2026 Agencies cited a variety of reasons for not having completed or maintained inventories with required information, including technical and resource constraints and competing priorities. However, OMB has yet to issue updated guidance to agencies that covers fiscal year 2026, leaving agencies without a clear imperative to prioritize implementation of the requirements and a timeline for doing so. Until OMB issues this guidance, agencies will lack appropriate direction on how and when to complete their device inventories. In the absence of inventories, agencies may lack awareness of the number and type of connected devices in their systems and be at risk of not protecting those systems from cyberattacks. Further, without updated guidance and oversight of agencies’ implementation of inventory requirements, agencies may continue to struggle to apply appropriate security controls to vulnerable systems—potentially compromising highly sensitive data and systems. Why GAO Did This Study Networked technologies and devices are facing increasing cyber threats from around the globe. For example, in July 2026, cyber threat actors disrupted operations in the water sector by modifying passwords to disconnect networked programmable logic controllers, which are a type of OT. Moreover, emerging technologies such as artificial intelligence can compound risks faced by these technologies and devices. The IoT Cybersecurity Improvement Act of 2020 includes provisions for OMB and civilian CFO Act agencies to identify and protect networked devices. The act also includes provisions for GAO to report every 2 years on IoT guidance and the waiver process through 2026. This final report in a series of three (1) describes guidance and best practices for procuring secure networked devices; and (2) evaluates agencies’ progress in addressing networked device cybersecurity. GAO identified federal agencies with cybersecurity or acquisition responsibilities and described guidance and best practices developed by those agencies for procuring secure networked devices. GAO compared 22 civilian CFO Act agencies’ inventory implementation efforts to OMB’s requirements. GAO also interviewed relevant agency officials to obtain their views and verify the information provided.

What GAO Found In response to multiple executive orders issued beginning in January 2025, selected agencies have made changes, some significant, to their foreign assistance programming and staffing. Eight of the nine agencies included in GAO’s review decreased funding (e.g., obligations) for foreign assistance awards. One agency did not decrease the number of awards but has been unable to disburse funds to awardees since January 2025. Most notably, the U.S. Agency for International Development (USAID) terminated approximately 6,780 of 7,510 awards between January 2025 and March 2026, according to State data. The value of obligations of the terminated awards from their beginning until March 2026 was $79.1 billion. The remaining active awards, now managed by State, represented about $52.1 billion as of March 2026. The Europe and Eurasia region had the highest dollar value of terminated awards but still has the highest dollar value of remaining active USAID awards. (see figure) State announced that USAID ceased administering foreign assistance awards as of July 1, 2025. Value of USAID Terminated and Active Awards by Region, March 2026 Note: Funding represents cumulative obligations from 2015 through March 2026 or the award termination date. All nine agencies decreased staff, including both headquarters and overseas personnel, from January 2025 up to May 2026. The most significant change occurred at USAID which decreased from about 13,600 staff worldwide in January 2025 to 241 staff in April 2026, according to USAID and government-wide data. State is now the primary provider of foreign assistance, but the full range of its workforce reductions is unknown because State was unable to produce data on its staffing levels during the eleven months that GAO requested it. Without readily available staffing data, State cannot effectively plan for operational requirements, respond to risks posed by its staffing changes, or address oversight needs. State also could not provide evidence of its guidance to staff including standards for making foreign assistance changes. Without documented guidance, officials responsible for foreign assistance programming may make inconsistent, ad hoc, or inefficient decisions that could waste taxpayer money. For example, State officials may make incorrect assumptions about desired program changes that could lead to legal dispute or the retraction of terminated awards. Why GAO Did This Study The U.S. government uses foreign assistance to aid strategically important countries, countries in conflict, and populations in need. In January 2025, the President issued an executive order pausing U.S. foreign development assistance programs to assess them for programmatic efficiencies and consistency with U.S. foreign policy. Subsequent orders led to decreases in staff and reorganizations at agencies that carry out foreign assistance programming. GAO examined changes to foreign assistance programming and staffing in nine selected agencies from January 2025 up to May 2026, and the extent to which these agencies developed and documented processes to inform their foreign assistance reviews. GAO selected nine agencies, including State and USAID, based on agencies identified within appropriations legislation for the Department of State, foreign operations, and related programs, as well as agencies impacted by certain executive orders. GAO reviewed data, documents, and guidance from agencies and interviewed agency officials regarding their foreign assistance programming, funding, and staffing, as well as processes for decision-making.

What GAO Found The Federal Emergency Management Agency (FEMA) has made guidance, grants, and specialized staff available to state and local governments and other organizations that support disaster survivors, including people with disabilities. FEMA has some guidance for state and local partners on incorporating the needs of people with disabilities into disaster planning and response. FEMA has also offered training for its partners on including people with disabilities in disaster operations but removed this training from its curriculum in 2025 to ensure compliance with various Executive Orders, according to officials. It has now been over a year since the training was offered. Without this training, FEMA’s state and local partners risk not being able to effectively assist people with disabilities. FEMA also has regional staff who can coordinate with state and local partners to support people with disabilities, which state and local officials said was beneficial. However, this coordination has been inconsistent across regions, and this role is not standardized. Clearly documenting a responsibility for disability specialists to coordinate with state and local partners would help ensure equitable access to assistance for people with disabilities when a disaster happens. FEMA also makes information, grants, and staff support directly available to survivors with disabilities. For example: FEMA publishes disaster planning and recovery guidance for people with disabilities and caregivers on its website. FEMA’s individual assistance grants can provide financial assistance to replace assistive devices and medically required equipment, among other things. FEMA provides specialized services to help people with disabilities apply for grants, such as providing sign language interpretation via video. It also has staff who investigate complaints of discrimination based on disability. However, some people with disabilities may face obstacles when applying for grant assistance, according to stakeholders GAO interviewed. These obstacles include unclear application questions and eligibility letters written at a grade 12 reading level. FEMA has not solicited feedback from people with disabilities on its overall grant application process, limiting its ability to ensure accessibility. Being able to more easily navigate the application process could help ensure people with disabilities receive assistance after a disaster. GAO’s analysis shows that 4 percentage points fewer applicants with disabilities were approved than those without disabilities from 2022 through 2025. FEMA Disaster Assistance Applications Received and Approved in 2022–2025 Why GAO Did This Study People with disabilities are far more likely than people without disabilities to face hardship due to a major disaster, according to the National Council on Disability. FEMA plays a role in helping state and local governments, nonprofits, and others support survivors after a disaster. It also provides grants to states to help rebuild infrastructure and financial assistance to disaster survivors. The Think Differently About Emergencies Act included a provision for GAO to review the assistance FEMA provides to help people with disabilities. This report examines the extent to which FEMA (1) works with state and local governments and others to support people with disabilities in disasters and (2) directly helps people with disabilities and their families. GAO analyzed data from 2022 through 2025 on FEMA’s grants to disaster survivors and reviewed relevant federal laws and agency policy. GAO also interviewed FEMA officials; officials at organizations that support people with disabilities; and state and local officials and organizations in Hawaii, Louisiana, and Kentucky, which experienced different types of disasters in separate FEMA regions from 2023 through 2025.