This is the accessible text file for GAO report number GAO-09-820 
entitled 'Project Bioshield: HHS Can Improve Agency Internal Controls 
for Its New Contracting Authorities' which was released on July 21, 
2009. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Report to Congressional Committees: 

United States Government Accountability Office: 
GAO: 

July 2009: 

Project Bioshield: 

HHS Can Improve Agency Internal Controls for Its New Contracting 
Authorities: 

GAO-09-820: 

GAO Highlights: 

Highlights of GAO-09-820, a report to congressional committees. 

Why GAO Did This Study: 

The Project BioShield Act of 2004 (BioShield Act) increased the federal 
government’s ability to procure needed countermeasures to address 
threats from chemical, biological, radiological, and nuclear agents. 
Under the BioShield Act, the Department of Health and Human Services 
(HHS) was provided with new contracting authorities (increased 
simplified acquisition and micropurchase thresholds, and expanded 
abilities to use procedures other than full and open competition and 
personal services contracts) and was authorized to use about $5.6 
billion in a Special Reserve Fund to procure countermeasures. Based on 
the BioShield Act’s mandate, GAO reviewed (1) how HHS has used its 
purchasing and contracting authorities, and (2) the extent to which HHS 
has internal controls in place to manage and help ensure the 
appropriate use of its new authorities. To do this work, GAO reviewed 
contract files and other HHS documents, including internal control 
guidance, which GAO compared with federal statutes and federal internal 
control standards. 

What GAO Found: 

Since 2004, HHS has awarded nine contracts using its Special Reserve 
Fund (Fund) purchasing authority under the BioShield Act to procure 
countermeasures that address anthrax, botulism, smallpox, and radiation 
poisoning. HHS may procure countermeasures that are approved by the 
Food and Drug Administration and ones that are unapproved, but are 
within 8 years of approval. Of the nine contracts, one was terminated 
for convenience and the remaining eight are valued at almost $2 
billion. HHS officials told GAO that additional contracts are likely to 
be awarded in the near future as the Fund provides funding through 
fiscal year 2013. In addition, HHS has used one of its new contracting 
authorities, simplified acquisition procedures, although it has not 
used this authority since 2005. 

HHS has established internal controls on its new purchasing and 
contracting authorities. In addition to the language in the BioShield 
Act, which sets up a broad framework of controls over the use of the 
Special Reserve Fund, the internal controls for this purchasing 
authority are documented in a variety of internal policy and procedure 
documents and interagency agreements, which provide guidance on roles 
and responsibilities for how the controls are to be implemented. In 
response to BioShield Act requirements, HHS also established internal 
controls for three of the contracting authorities: the increased 
simplified acquisition threshold and its use with Special Reserve 
Funds, the increased micropurchase threshold, and the use of personal 
services contracts. Federal internal control standards state that, 
among other things, management needs to comprehensively identify risks, 
analyze them for possible effect, and determine how risks should be 
managed. Although some of the risk statements in a memo HHS issued 
identify some risks and one mentions possible negative consequences 
that could occur without proper controls in place, the risk statements 
for using the increased micropurchase threshold and increased 
simplified acquisition procedures lack analysis of specific risks. In 
particular, the memo does not discuss a key risk associated with using 
simplified acquisition procedures—namely, that an agency is prohibited 
from obtaining cost or pricing data for acquisitions at or below the 
simplified acquisition threshold. Without this data, the agency may not 
be able to determine if the price of a contract is fair and reasonable. 
Moreover, not having adequately documented and appropriately 
communicated risk assessments potentially results in future employees 
not knowing or understanding the risks or trade-offs involved in using 
the authorities. With employee turnover, HHS’ reliance on the knowledge 
of current personnel to appropriately implement key controls will not 
enable future employees to make sound, informed, and consistent 
decisions. 

What GAO Recommends: 

GAO recommends that HHS include comprehensive risk assessment 
statements in its written guidance on the internal controls for the 
BioShield contracting authorities for which the agency was required to 
establish controls. HHS agreed with the recommendation and said it 
would provide additional guidance. 

View [hyperlink, http://www.gao.gov/products/GAO-09-820] or key 
components. For more information, contact John Needham, 202-512-4841, 
NeedhamJK1@gao.gov. 

[End of section] 

Contents: 

Letter: 

Background: 

HHS Has Used New Authorities to Procure Countermeasures: 

HHS Has Established Internal Controls for Its New Authorities, but 
Lacks Adequate Documentation of the Risks of Using the Contracting 
Authorities: 

Conclusions: 

Recommendation for Executive Action: 

Agency Comments and Our Evaluation: 

Appendix I: Comments from the Department of Health & Human Services: 

Appendix II: GAO Contacts and Acknowledgments: 

Tables: 

Table 1: Contracts Awarded by HHS Using the Special Reserve Fund: 

Table 2: Contracts Awarded by HHS Using Simplified Acquisition 
Procedures: 

Abbreviations: 

BARDA: Biomedical Advanced Research and Development Authority: 

BioShield Act: Project BioShield Act of 2004: 

CBRN: Chemical, biological, radiological, and nuclear agents: 

FAR: Federal Acquisition Regulation: 

FDA: Food and Drug Administration: 

MMFIA: Federal Managers' Financial Integrity Act of 1982: 

HHS: Department of Health and Human Services: 

HHSAR: HHS Acquisition Regulation: 

NIH: National Institutes of Health: 

OMB: Office of Management and Budget: 

PAHPA: Pandemic and All-Hazards Preparedness Act: 

[End of section] 

United States Government Accountability Office:
Washington, DC 20548: 

July 21, 2009: 

Congressional Committees: 

Following the attacks using anthrax-laced letters in the United States 
in 2001 and other biological attacks, such as the Sarin gas attack in 
Japan, some members of Congress were concerned that the United States 
was vulnerable to threats from chemical, biological, radiological, and 
nuclear (CBRN) agents and did not have sufficient medical 
countermeasures to adequately protect the public from such threats or 
provide post-exposure treatment. To address this gap in national 
defense capability, the Project BioShield Act of 2004 (BioShield Act 
[Footnote 1]) provided the Department of Health and Human Services 
(HHS) with the ability to accelerate the research, development, 
acquisition, and availability of effective countermeasures (such as, 
vaccines, pharmaceuticals, and diagnostics) that are necessary to 
respond to an attack involving CBRN agents. 

The BioShield Act provided HHS with a number of new authorities, 
including four new contracting authorities: 

* an increased simplified acquisition threshold, 

* an increased ability to use procedures other than full and open 
competition, 

* an increased micropurchase threshold, and: 

* the ability to use personal services contracts.[Footnote 2] 

HHS was also authorized to use funds from a Special Reserve Fund to 
procure countermeasures to be added to the inventory of medical 
supplies and countermeasures currently stored in the Strategic National 
Stockpile.[Footnote 3] At the time of its establishment, the Fund 
provided HHS about $5.6 billion to use over a 10-year period (fiscal 
years 2004 to 2013), with a spending cap of $3.4 billion during fiscal 
years 2004 to 2008.[Footnote 4] This purchasing authority expanded the 
types of medical countermeasures that HHS could obtain to address 
threats from CBRN agents to include not only those that are approved by 
the Food and Drug Administration (FDA),[Footnote 5] but also those that 
are determined to be within 8 years of approval or which have been 
authorized for use under an emergency use authorization.[Footnote 6] 
Prior to the BioShield Act, HHS officials told us that the agency was, 
in general, only able to purchase medical countermeasures that were FDA 
approved. 

Based on the GAO reporting requirements in the BioShield Act, this 
report examines: (1) how HHS has used its BioShield Act purchasing and 
contracting authorities to procure medical countermeasures, and (2) the 
extent to which HHS has designed internal controls to manage and help 
ensure the appropriate use of its BioShield contracting and purchasing 
authorities.[Footnote 7] 

To review HHS's use of the BioShield contracting and purchasing 
authorities, we reviewed legislation and HHS documentation, including 
annual reports to the Congress on BioShield and contract files. In 
reviewing contract files, we relied on HHS annual reports to the 
Congress and statements from officials to identify the contracts 
awarded by HHS using the BioShield contracting authorities. We also met 
with HHS officials responsible for managing procurement under the 
BioShield Act. To assess the internal controls related to the 
contracting and purchasing authorities, we reviewed HHS regulations, 
policies, and other forms of written guidance and met with HHS 
officials responsible for internal controls. We also compared HHS's 
internal controls with the Act's requirements and other federal 
internal control requirements and standards. Because HHS established 
controls for its new contracting authorities after it awarded contracts 
using one of those authorities, and it has not used the contracting 
authorities since that time, we limited our review of the controls to 
their design. 

We conducted this performance audit from February 2009 to July 2009 in 
accordance with generally accepted government auditing standards. Those 
standards require that we plan and perform the audit to obtain 
sufficient, appropriate evidence to provide a reasonable basis for our 
findings and conclusions based on our audit objectives. We believe that 
the evidence obtained provides a reasonable basis for our findings and 
conclusions based on our audit objectives. 

Background: 

HHS' ability to use the Special Reserve Fund for the procurement of 
countermeasures is predicated on a six-step process involving 
coordination with DHS and approval by the Director of the Office of 
Management and Budget (OMB).[Footnote 8] As provided in the BioShield 
Act, the process requires: 

1. the DHS Secretary, in consultation with the HHS Secretary and the 
heads of other agencies as appropriate, to determine that a material 
threat exists and issue a "material threat determination;" 

2. the HHS Secretary to determine countermeasures that are necessary to 
protect the public health; 

3. the HHS Secretary to determine that a particular countermeasure is 
appropriate for procurement for the Strategic National Stockpile using 
the Special Reserve Fund and the quantities to be procured;[Footnote 9] 

4. the DHS and HHS Secretaries to jointly recommend to the Director of 
OMB that the Special Reserve Fund should be used for the designated 
countermeasure acquisitions; 

5. the director of OMB to approve the use of the Special Reserve Fund; 
and: 

6. both Secretaries to notify designated congressional committees of 
the procurement. 

The BioShield Act also provides HHS the ability to use four new 
contracting authorities for the acquisition of countermeasures. In 
general, these authorities expanded upon existing provisions in the 
Federal Acquisition Regulation (FAR). The four authorities are: 

* Simplified acquisition procedures which, in general, increased HHS 
contract threshold amounts from $100,000 to $25 million.[Footnote 10] 
However, the BioShield Act does not place a threshold limit on 
countermeasures that are procured using the Special Reserve Fund if the 
HHS Secretary determines there is a pressing need for the specific 
countermeasure. 

* Procedures other than full and open competition can be used to award 
contracts when the requirement is only available from one responsible 
source or a limited number of responsible sources. In addition, in 
order to conduct procurements on a basis other than full and open 
competition using simplified acquisition procedures, the HHS Secretary 
must determine that the mission of the BioShield Program under the Act 
would be seriously impaired without such a limitation. 

* Increased micropurchase threshold from $2,500 to $15,000.[Footnote 
11] 

* Personal services contracts may be used for experts or consultants 
who have scientific or other professional qualifications when the HHS 
Secretary determines such contracts are necessary to respond to 
pressing countermeasure research and development needs. 

In 2006, the Pandemic and All-Hazards Preparedness Act[Footnote 12] 
(PAHPA), among other things, established the Biomedical Advanced 
Research and Development Authority (BARDA), within HHS, to provide a 
coordinated, systematic approach to the development and purchases of 
countermeasures, including vaccines, drugs, therapies, and diagnostic 
tools. Later, in 2009, Congress transferred the following amounts from 
the Special Reserve Fund to HHS accounts: $275 million to be used for 
the advanced research and development of countermeasures and $137 
million for influenza pandemic preparation.[Footnote 13] 

HHS Has Used New Authorities to Procure Countermeasures: 

HHS has used its Special Reserve Fund (purchasing) authority and one of 
its contracting authorities to procure countermeasures for the 
Strategic National Stockpile. Since 2004, HHS awarded nine contracts 
using Special Reserve Fund monies to procure various countermeasures, 
such as anthrax and botulism antitoxins, vaccines for anthrax and 
smallpox, and post-exposure treatments for radiation poisoning in 
children and adults. Of the nine contracts awarded using monies from 
the Fund, HHS terminated one contract, in 2006, because the contractor 
was unable to meet a major contractual milestone. To date, the 
remaining eight contracts are valued at almost $2 billion. See table 1. 
In addition, HHS officials told us there are currently two requests for 
proposal solicitations for an anthrax vaccine and a smallpox 
therapeutic. 

Table 1: Contracts Awarded by HHS Using the Special Reserve Fund: 

Countermeasure: Anthrax therapeutics (antitoxins): Raxibacumab; 
Company awarded contract: Human Genome Sciences; 
Date of contract award: September 2005; 
Date of contract completion: September 2010; 
Total doses: 20,000; 
Maximum persons treatable: 20,000; 
Total contract price[A]: $176,211,724[B]. 

Countermeasure: Anthrax therapeutics (antitoxins): Anthrax immune 
globulin; 
Company awarded contract: Cangene Corporation; 
Date of contract award: September 2005; 
Date of contract completion: September 2011; 
Total doses: 10,000; 
Maximum persons treatable: 10,000; 
Total contract price[A]: $144,256,599[C]. 

Countermeasure: Anthrax Vaccines: AVA anthrax vaccine; 
Company awarded contract: BioPort/Emergent BioDefense Operations 
Lansing, Inc; 
Date of contract award: May 2005; 
Date of contract completion: September 2007; 
Total doses: 10,000,000; 
Maximum persons treatable: 3,333,000; 
Total contract price[A]: $242,737,000. 

Countermeasure: Anthrax Vaccines: AVA anthrax vaccine; 
Company awarded contract: Emergent BioDefense Operations Lansing, Inc; 
Date of contract award: September 2007; 
Date of contract completion: September 2010; 
Total doses: 18,750,000; 
Maximum persons treatable: 6,250,000; 
Total contract price[A]: $447,650,001. 

Countermeasure: Anthrax Vaccines: Recombinant protective antigen; 
Company awarded contract: VaxGen; 
Date of contract award: November 2004; 
Date of contract completion: Contract Terminated December 2006; 
Total doses: N/A; 
Maximum persons treatable: N/A; 
Total contract price[A]: $1,534,253[D]. 

Countermeasure: Botulism therapeutic: Heptavalent botulinum antitoxin; 
Company awarded contract: Cangene Corporation; 
Date of contract award: September 2006; 
Date of contract completion: May 2011; 
Total doses: 200,000; 
Maximum persons treatable: 200,000; 
Total contract price[A]: $366,384,724. 

Countermeasure: Smallpox vaccines: MVA smallpox vaccine; 
Company awarded contract: Bavarian Nordic A/S; 
Date of contract award: June 2007; 
Date of contract completion: June 2012; 
Total doses: 20,000,000; 
Maximum persons treatable: 10,000,000; 
Total contract price[A]: $504,765,464. 

Countermeasure: Radiological/Nuclear: Liquid potassium iodide; 
Company awarded contract: Fleming and Company Pharmaceuticals; 
Date of contract award: March 2005; 
Date of contract completion: March 2010; 
Total doses: 4,800,000; 
Maximum persons treatable: 144,000,000; 
Total contract price[A]: $17,629,003. 

Countermeasure: Radiological/Nuclear: IV Calcium (Ca) DTPA; IV Zinc 
(Zn) DTPA; 
Company awarded contract: Akorn, Inc; 
Date of contract award: December 2005; 
Date of contract completion: December 2015; 
Total doses: Ca DTPA = 394,350; Zn DTPA = 79,460; 
Maximum persons treatable: Ca DTPA = 394,350; Zn DTPA = 79,460; 
Total contract price[A]: $21,962,448. 

Countermeasure: Total; 
Total contract price[A]: $1,923,131,216. 

Source: GAO analysis of HHS contracts and other documents. 

[A] Unless otherwise noted, the contract price includes all options and 
modifications to the price of the contract. 

[B] This figure contains $1,797,372 in funds that did not come from the 
Special Reserve Fund. 

[C] This figure contains $422,880 in funds that did not come from the 
Special Reserve Fund. 

[D] This figure is less than the original awarded contract price and is 
the total amount of money HHS paid to the contractor on the terminated 
contract. 

[End of table] 

Of the four contracting authorities provided under the BioShield Act, 
HHS has only used the simplified acquisition procedure authority. From 
2004 through 2005, HHS's National Institutes of Health (NIH) used this 
authority to award five other contracts, including ones for research to 
develop a botulism antitoxin and improved treatments for radiation 
poisoning. Awarded with NIH funding, these contracts have a total value 
of almost $30 million when options and other later modifications are 
included. See table 2. 

Table 2: Contracts Awarded by HHS Using Simplified Acquisition 
Procedures: 

Countermeasure: Antitoxin for botulinum neurotoxin; 
Company awarded contract: XOMA (US) LLC; 
Date of contract award: March 2005; 
Date of completed delivery: September 2006; 
Total contract price[A]: $15,000,000. 

Countermeasure: Antitoxin for botulinum neurotoxin; 
Company awarded contract: DynPort Vaccine Company, LLC; 
Date of contract award: May 2005; 
Date of completed delivery: March 2008; 
Total contract price[A]: $3,026,999. 

Countermeasure: Improved DTPA for radionuclide chelation; 
Company awarded contract: University of Kentucky; 
Date of contract award: September 2005; 
Date of completed delivery: September 2009; 
Total contract price[A]: $5,160,995. 

Countermeasure: Improved DTPA for radionuclide chelation; 
Company awarded contract: Nanotherapeutics, Inc.; 
Date of contract award: September 2005; 
Date of completed delivery: September 2009; 
Total contract price[A]: $3,044,549. 

Countermeasure: Improved DTPA for radionuclide chelation; 
Company awarded contract: SRI International; 
Date of contract award: September 2005; 
Date of completed delivery: September 2009; 
Total contract price[A]: $3,714,882. 

Total price of contracts: $29,947,425. 

Source: GAO analysis of HHS contracts and other documents. 

[A] The contract price includes all options and modifications to the 
price of the contract. 

[End of table] 

HHS officials told us that they have not used this authority since 
2005. HHS officials also told us that no other BioShield contracting 
authorities have been used to date, although the officials noted that 
these authorities may be needed for use in the future. 

HHS Has Established Internal Controls for Its New Authorities, but 
Lacks Adequate Documentation of the Risks of Using the Contracting 
Authorities: 

In response to BioShield requirements, HHS has established internal 
controls on its Special Reserve Fund (purchasing) and contracting 
authorities, but lacks adequate documentation of the risks of using the 
new contracting authorities.[Footnote 14] Language in the BioShield Act 
sets up a broad framework of controls over the procurement of 
countermeasures, including those with Special Reserve Funds, by 
requiring HHS to coordinate with DHS and obtain approval by OMB before 
the Fund may be used. In addition to the language in the Act, HHS 
officials told us that the internal controls for procuring 
countermeasures using the Fund are documented in a variety of internal 
policy and procedure documents and interagency agreements, which 
provide guidance on roles and responsibilities for how the controls are 
to be implemented. These documents include: 

* an HHS policy document that establishes an enterprise governance 
board to oversee requirements and priority-setting regarding emergency 
medical countermeasures for the civilian population. The document also 
outlines the authorities, organizational structure, and guidelines for 
the board; 

* an HHS budget execution document that delineates responsibilities and 
describes the processes for requesting contract actions, purchases, and 
interagency agreements; 

* a BARDA standard operating procedure document that provides 
contracting and other BARDA officials with guidance on source selection 
procedures and outlines specific responsibilities in carrying out those 
procedures; 

* a BARDA acquisition plan which details the pre-and post-award 
approval processes for procurements using the Fund; 

* an interagency agreement between HHS and DHS dated September 25, 
2006, that outlines the terms and conditions for when the Fund can be 
used; and: 

* an OMB Circular on transferring budget authority from one agency to 
another.[Footnote 15] 

HHS has also established internal controls for the contracting 
authorities that were specified in the BioShield Act. On October 18, 
2005,[Footnote 16] HHS issued a memorandum that provided guidance on 
the use of the following contracting authorities: 

* the increased simplified acquisition threshold and its use with the 
Special Reserve Fund, 

* the increased micropurchase threshold, and: 

* the use of personal services contracts.[Footnote 17] 

HHS's memo is structured around the five elements of internal control: 
the control environment, risk assessment, control activities, 
information and communications, and monitoring.[Footnote 18] Federal 
internal control standards state that management needs to 
comprehensively identify risks, analyze them for possible effect, and 
determine how risks should be managed. Federal internal control 
standards also state that controls need to be clearly documented, 
readily available for examination, and distributed in a form and time 
frame that permits people to perform their duties efficiently. 

Risk assessment statements we reviewed in the memo are generally not 
assessments of the risks involved in using particular authorities. Some 
of the risk statements identify some risks and one mentions possible 
negative consequences that could occur without proper controls in 
place, but the statements lack an analysis of those risks. For example, 
the risk assessment statement for using the increased micropurchase 
threshold states that "control procedures are necessary to prevent 
noncompliance with specific requirements of the Act, including 
exceeding statutory limitation on number of contracts and selections 
based on improper criteria." And, the risk assessment statement on 
increased simplified acquisition procedures does not mention or assess 
risk. It simply states that "control procedures are necessary to 
prevent noncompliance with specific requirements of the Act." In 
particular, the risk statement on simplified acquisition procedures in 
the memo does not discuss a key risk associated with using simplified 
acquisition procedures--namely, that an agency is prohibited from 
obtaining cost or pricing data for acquisitions at or below the 
simplified acquisition threshold. [Footnote 19] 

According to a senior BARDA procurement official, while using 
simplified acquisition procedures can expedite the procurement process, 
the agency will not have cost and pricing data, which may be needed to 
determine that the price of a contract--especially those valued in the 
tens of millions or hundreds of millions--is fair and reasonable. In a 
subsequent meeting, he stated that he is aware of these trade-offs 
based on his own experience and knowledge of the FAR. He also confirmed 
that an explanation assessing the trade-offs and risks involved when 
using the new contracting authorities is not contained in other HHS 
documents. Instead, this official acknowledged that HHS's written 
guidance on the controls for the contracting authorities does not 
document known risks and trade-offs of using the authorities. As a 
result, implementation of these controls depends on the experience and 
knowledge of current personnel. Moreover, the consistent application of 
these controls is not likely to be sustained over time as employees 
leave their positions and new ones take their place. Not having 
adequately documented and appropriately communicated risk assessments, 
which institutionalize agency policies, may potentially result in 
future employees not knowing or understanding the risks or tradeoffs 
involved in using the various contracting authorities. 

Conclusions: 

Since the enactment of the BioShield Act in 2004, HHS has awarded 
almost $2 billion in contracts to either procure medical 
countermeasures or to facilitate their development. Although HHS has 
established internal controls for its new purchasing and contracting 
authorities, the risk assessment statements related to the agency's 
internal controls for the contracting authorities are not sufficiently 
specific. In particular, the failure to mention and lack of analysis of 
specific risks in the risk statements associated with using the 
increased micropurchase threshold and increased simplified acquisition 
procedures is not consistent with requirements under federal internal 
control standards. 

With employee turnover, the lack of adequately documented risk 
assessment statements could create a situation in which employees do 
not know the risks or trade-offs involved in using the various 
authorities. The effectiveness of the internal controls now in place is 
dependent on the knowledge of individuals currently working at the 
agency. Without appropriately documented risk assessments that 
institutionalize agency policies, HHS will be unable to ensure that 
sound, informed, and consistent decisions will be made in the face of 
employee turnover. 

Recommendation for Executive Action: 

We recommend that the Secretary of Health and Human Services include 
comprehensive risk assessment statements in written guidance on the 
internal controls for the BioShield contracting authorities for which 
the agency was required to establish controls. 

Agency Comments and Our Evaluation: 

HHS provided us with written comments on a draft of this report. The 
comments appear in appendix I. 

HHS agreed with our recommendation and said that it will revise its 
internal control guidance on risk assessments for using BioShield 
contracting authorities. We believe that this is a positive step toward 
helping ensure that sound, informed, and consistent risk assessments 
will be made in BioShield acquisitions. HHS also provided observations 
on the Special Reserve Fund and risk assessments, which appear in 
appendix I. 

We are sending copies of this report to the Secretary of Health and 
Human Services. The report is also available at no charge on the GAO 
Web site at [hyperlink, http://www.gao.gov]. 

If you or your staff have any questions about this report, please 
contact me at (202) 512-4841 or NeedhamJK1@gao.gov. Contact points for 
our Offices of Congressional Relations and Public Affairs may be found 
on the last page of this report. GAO staff who made major contributions 
to this report are listed in appendix II. 

Signed by: 

John K. Needham: 
Director, Acquisition and Sourcing Management: 

List of Congressional Committees: 

The Honorable Edward M. Kennedy: 
Chairman: 
The Honorable Michael B. Enzi: 
Ranking Member: 
Committee on Health, Education, Labor, and Pensions: 
United States Senate: 

The Honorable Joseph I. Lieberman: 
Chairman: 
The Honorable Susan M. Collins: 
Ranking Member: 
Committee on Homeland Security and Governmental Affairs: 
United States Senate: 

The Honorable Robert C. Byrd: 
Chairman: 
The Honorable George V. Voinovich: 
Ranking Member: 
Subcommittee on Homeland Security: 
Committee on Appropriations: 
United States Senate: 

The Honorable Tom Harkin: 
Chairman: 
The Honorable Thad Cochran: 
Ranking Member: 
Subcommittee on Labor, Health and Human Services, Education, and 
Related Agencies: 
Committee on Appropriations: 
United States Senate: 

The Honorable Henry A. Waxman: 
Chairman: 
The Honorable Joe Barton: 
Ranking Member: 
Committee on Energy and Commerce: 
House of Representatives: 

The Honorable Bennie G. Thompson: 
Chairman: 
The Honorable Peter T. King: 
Ranking Member: 
Committee on Homeland Security: 
House of Representatives: 

The Honorable Edolphus Towns: 
Chairman: 
The Honorable Darrell Issa: 
Ranking Member: 
Committee on Oversight and Government Reform: 
House of Representatives: 

The Honorable David E. Price: 
Chairman: 
The Honorable Harold Rogers: 
Ranking Member: 
Subcommittee on Homeland Security: 
Committee on Appropriations: 
House of Representatives: 

The Honorable David R. Obey: 
Chairman: 
The Honorable Todd Tiahrt: 
Ranking Member: 
Subcommittee on Labor, Health and Human Services, Education, and 
Related Agencies: 
Committee on Appropriations: 
House of Representatives: 

[End of section] 

Appendix I: Comments from the Department of Health & Human Services: 

Department Of Health At Human Services: 
Office Of The Secretary: 
Assistant Secretary for Legislation: 
Washington, DC 20201: 

July 14, 2009: 

John K. Needham: 
Director, Acquisition and Sourcing Management: 
U.S. Government Accountability Office: 
441 G Street, NW: 
Washington, DC 20548: 

Dear Mr. Needham: 

Enclosed are the Department's comments on the U.S. Government 
Accountability Office's draft report entitled, "Project BioShield: HHS 
Can Improve Agency Internal Controls for Its New Contracting 
Authorities" (GAO-09-820). 

The Department appreciates the opportunity to review and comment on 
this draft report before its publication. 

Sincerely, 

Signed by: 

Barbara Pisaro Clark: 
Acting Assistant Secretary for Legislation: 

Enclosure: 

[End of letter] 

General Comments Of The Department Of Health And Human Services (HHS) 
On The Government Accountability Office's (GAO) Draft Report Entitled: 
Project Bioshield: HHS Can Improve Agency Internal Controls For Its New 
Contracting Authorities (GAO 09-820): 

HHS agrees with the recommendation and will revise the internal 
controls dated October 18, 2005, to provide more guidance on risk 
assessments for using BioShield contracting authorities. 

Additional Comments: 

GAO says (page 5) that HHS used "Special Reserve Fund monies to procure 
various countermeasures, such as anthrax and botulism antitoxins, 
vaccines for anthrax and smallpox, and post-exposure treatments for 
radiation poisoning in children and adults." We note that the fund 
authorized under the Project BioShield Act of 2004 made possible the 
variety of medical countermeasures and quantity of doses procured by 
HHS during the first five years of the ten-year authorization period. 

Page 10 discusses the assessment of trade-offs and risks of using 
simplified acquisition procedures, one of the BioShield contracting 
authorities. The example given of a risk is the prohibition on 
obtaining cost or pricing data that a contracting officer may need for 
determining whether or not the proposed price of a multi-million dollar 
contract is fair and reasonable. The concern about this risk is held 
more widely in BARDA than solely being the opinion of the individual 
interviewed. 

[End of section] 

Appendix II: GAO Contacts and Acknowledgments: 

GAO Contact: 

John K. Needham, (202) 512-4841 or NeedhamJK1@gao.gov: 

Acknowledgments: 

In addition to the contact named above, Carol Dawn Petersen, Assistant 
Director; Angela D. Thomas, Kelly Bradley, Robert S. Swierczek, Marie 
P. Ahearn, and Kenneth E. Patton made key contributions to this report. 

[End of section] 

Footnotes: 

[1] Pub. L. No. 108-276 (2004). 

[2] Under the BioShield Act, HHS is authorized to obtain by contract 
personal services without the limitations on period of service and pay 
within 5 U.S.C. § 3109. 

[3] The Strategic National Stockpile is the federal supply of 
pharmaceuticals, vaccines, medical supplies, equipment, and other items 
meant to provide for the emergency health security of the United 
States, including the emergency health security of children and other 
vulnerable populations, in the event of a bioterrorist attack or other 
public health emergency. 42 U.S.C. § 247d-6b. 

[4] Funding for the Special Reserve Fund was appropriated in the 
Department of Homeland Security Appropriations Act, 2004 (Pub. L. No. 
108-90 (2003)). 

[5] According to HHS, to be administered to the public, the FDA must 
approve a drug, license a biological product (such as a vaccine), or 
clear a medical product (including diagnostics). For purposes of this 
report, we will use the term approved to cover approved, licensed, or 
cleared products. 

[6] The BioShield Act also established an emergency use authorization 
that allows the emergency use of countermeasures that are unapproved by 
the FDA, or those that are approved but not for the intended use, 
following a declaration by the Secretary of HHS of an emergency 
justifying authorization for a product on the basis of a determination 
(by the Secretary of DOD, DHS, or HHS) of an emergency or a significant 
potential for an emergency. 

[7] Based on additional reporting requirements in the BioShield Act, we 
will also review other issues related to the Act. These issues will be 
covered in a separate GAO product. 

[8] The BioShield Act required recommendation to the President (by the 
Secretaries of HHS and Homeland Security, in coordination with the 
Director of OMB) that the Special Reserve Fund be made available for 
procurement of a countermeasure and Presidential approval of the 
recommendation. The President delegated these functions (recommendation 
and approval of recommendation) to the Director of OMB. Presidential 
Memorandum, 69 Fed. Reg. 70,349 (Oct. 21, 2004), reprinted in 42 U.S.C. 
§ 247d-6b (2006). 

[9] In determining if a particular countermeasure is appropriate for 
procurement using the Special Reserve Fund, the HHS Secretary must also 
consider the "feasibility of production and delivery within 8 years of 
sufficient quantities…[and] whether there is a lack of a significant 
commercial market for the product at the time of procurement..." 

[10] The use of simplified acquisition procedures allows an agency to 
acquire goods and services using more streamlined approaches than 
ordinarily would be required. For example, under simplified acquisition 
procedures, an agency would be required to promote competition to the 
maximum extent practicable, although it would not be required to use 
full and open competition. Additionally, an agency could use an oral 
solicitation to seek competitive price quotations and would not have to 
follow the more formal evaluation procedures applicable to acquisitions 
above the threshold. See, FAR §§ 13.000, 13.104, 13.106-1, and 13.106- 
2(b). 

[11] Purchases that do not exceed the micropurchase threshold may be 
made without seeking competitive price quotations if the contracting 
officer considers the price to be reasonable. See FAR §13.202(a)(2). 

[12] Pub. L. No. 109-417 (2006). 

[13] Omnibus Appropriations Act, 2009, Pub. L. No. 111-8 (2009). 

[14] In addition to existing requirements for HHS to establish 
effective internal controls, the BioShield Act required the Secretary 
to establish certain additional internal controls over the use of its 
BioShield purchasing and contracting authorities. For information on 
requirements apart from the BioShield Act, see 31 U.S.C. § 3512(c) and 
(d), commonly known as the Federal Managers' Financial Integrity Act of 
1982 (FMFIA). FMFIA was repealed as part of the general revisions to 
title 31 U.S. Code. However, the key provisions of FMFIA were codified 
at 31 U.S.C. § 3512(c) and (d). 

[15] See OMB Circular No. A-136, Section II.4.2.5. 

[16] The HHS memo was issued after HHS used its increased simplified 
acquisition threshold to award the five contracts discussed previously. 

[17] Although the BioShield Act did not direct HHS to establish 
internal controls for using procedures other than full and open 
competition, agency officials told us the internal controls on this 
authority are in the Federal Acquisition Regulation (subpart 6.3) and 
in the HHS Acquisition Regulation (HHSAR). See HHSAR §§ 306.302 through 
306.304 on circumstances permitting other than full and open 
competition. 

[18] See GAO, Standards for Internal Control in the Federal Government, 
[hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1] 
(Washington, D.C.: November 1999). 

[19] FAR 15.403-1(a) prohibits obtaining cost or pricing data for 
acquisitions at or below the simplified acquisition threshold. 

[End of section] 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink, http://www.gao.gov] 
and select "E-mail Updates." 

Order by Phone: 

The price of each GAO publication reflects GAO’s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO’s Web site, 
[hyperlink, http://www.gao.gov/ordering.htm]. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional 
information. 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 
E-mail: fraudnet@gao.gov: 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Ralph Dawn, Managing Director, dawnr@gao.gov: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, D.C. 20548: 

Public Affairs: 

Chuck Young, Managing Director, youngc1@gao.gov: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, D.C. 20548: