United States Government Accountability Office GAO Report to Congressional Requesters PRODUCT SAFETY December 2012 LABORATORIES OSHA’s Accreditation Process Needs Reexamination GAO-13-88 December 2012 PRODUCT SAFETY LABORATORIES OSHA’s Accreditation Process Needs Reexamination Highlights of GAO-13-88, a report to congressional requesters Why GAO Did This Study What GAO Found American workers interact with many The Department of Labor’s (Labor) Occupational Safety and Health Administration’s types of products that could pose risks (OSHA) process for accrediting Nationally Recognized Testing Laboratories (NRTL) to their safety. The NRTL program, is lengthy due to the scope of staff members’ responsibilities and unclear application administered by OSHA, works to procedures for accreditation. Among the 13 recently approved applications, OSHA support employers and workers by took between 1 and 5 years to make accreditation decisions. All of these applications establishing a process for safety- took much longer to approve than OSHA’s desired time frames, and in some cases, testing certain equipment and other years longer. In addition, 12 of the 29 applications that were awaiting final decisions products for use in the U.S. workplace. by OSHA as of June 2012 had been under review longer than the 5-year period for Under this program, which is supported which the accreditation decision would be valid. This lengthy process has potentially by user fees, OSHA accredits third- negative economic consequences for laboratories and requires OSHA staff to divert party labs as NRTLs, which then their time from other oversight activities. Two key factors led to the long time frames: determine whether certain types of products meet safety standards. • Imbalance between staffing levels and scope of responsibilities: The way Because the availability of NRTLs is that OSHA has designed the NRTL program requires its four staff members to essential to ensuring that employers balance many wide-ranging responsibilities. These responsibilities include: have timely access to products that reviewing all aspects of accreditation, auditing existing laboratories, and meet safety standards, GAO was responding to information requests from other federal agencies. Consequently, asked to examine (1) how long it takes accreditation applications were sometimes set aside for significant amounts of to make accreditation decisions and time while OSHA personnel attended to their other responsibilities. the key factors that affect timeliness, • Unclear application requirements: OSHA’s requirements for the content and and (2) the extent to which OSHA has level of detail to be provided in accreditation applications—such as detailed adopted commonly used strategies for information to assess independence—differ in important ways from international improving timeliness. GAO reviewed standards used for accrediting safety labs. Lack of clarity in guidance about relevant documents and data from these and other requirements create confusion among applicants and extend OSHA; interviewed OSHA officials, both the amount of time applicants spend preparing the applications and the time other NRTL stakeholders, and officials OSHA officials spend reviewing them. OSHA said its additional requirements are from four federal agencies that important to the agency’s mission, but it has not formally compared them to administer accreditation programs for current international standards or recently assessed the risks, costs, and benefits other purposes; and reviewed of any procedures that deviate from international standards. information on strategies for improving timeliness from past GAO reports and While OSHA plans to take some steps to improve timeliness, it has not taken other sources. advantage of a range of promising strategies, including some that might address its resource constraints and improve efficiency. GAO identified three key strategies for improving timeliness: (1) aligning program design with program mission and resources; (2) providing clear guidance and timely communication to stakeholders; What GAO Recommends and (3) developing performance measures and using data to identify inefficiencies. GAO recommends that Labor review GAO found that OSHA has not evaluated the NRTL accreditation process to assess its current structure and procedures for whether its current structure is the most efficient for processing and approving accrediting NRTLs and implement applications in a timely manner and meeting the program’s goals. Consequently, alternatives that would maintain OSHA’s processes may be slower than necessary and planned hiring may not effectiveness while improving adequately address timeliness issues. Since the NRTL program was created in 1988, timeliness. Labor agreed with the several new approaches to accreditation have been developed. For example, some recommendations and described its federal agencies have collaborated with outside entities to complete select tasks in plans to address them. the accreditation process while continuing to make key oversight decisions in-house. The NRTL staff’s current workload has made it difficult for them to implement other timeliness strategies, such as providing timely communication to stakeholders. In addition, OSHA recently stopped using its NRTL performance measures because View GAO-13-88. For more information, officials believed that meeting them was impractical. contact Revae Moran at (202) 512-7215 or firstname.lastname@example.org. United States Government Accountability Office Contents Letter 1 Background 2 Scope of Staff Responsibilities and Unclear Application Procedures Lengthen the Accreditation Process 10 Strategies for Improving Timeliness Exist, but OSHA has Taken Limited Steps to Implement Them 22 Conclusions 31 Recommendation for Executive Action 31 Appendix I Objectives, Scope, and Methodology 34 Appendix II Comments from the Department of Labor 38 Appendix III GAO Contact and Staff Acknowledgments 40 Tables Table 1: Accreditation Processes Used by Selected Federal Agencies, for Various Purposes 8 Table 2: Actual vs. Desirable Processing Time Frames for Applications Approved from June 11, 2007 to June 11, 2012 12 Figures Figure 1: Summary of OSHA’s Process for Initial, Expansion, and Renewal NRTL Accreditation Decisions 4 Figure 2: Examples of NRTL Certification Marks 6 Figure 3: Duration of Application Processing Times for Applications Approved from June 11, 2007 to June 11, 2012 11 Figure 4: Length of Time Pending Applications Had Been under Review, as of June 11, 2012 13 Page i GAO-13-88 Product Testing Laboratories Abbreviations CPSC Consumer Product Safety Commission FCC Federal Communications Commission HHS Department of Health and Human Services ISO International Organization for Standardization NIST National Institute of Standards and Technology NRTL Nationally Recognized Testing Laboratory ONC Office of the National Coordinator for Health Information Technology OSHA Occupational Safety and Health Administration SNAP Satellite Notification and Acceptance Program This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Page ii GAO-13-88 Product Testing Laboratories United States Government Accountability Office Washington, DC 20548 December 11, 2012 The Honorable Darrell Issa Chairman Committee on Oversight and Government Reform House of Representatives The Honorable John Kline Chairman Committee on Education and the Workforce House of Representatives American workers interact with many types of products that may pose risks to their safety on the job. Accordingly, the Department of Labor’s Occupational Safety and Health Administration (OSHA) requires that certain types of safety equipment and other products be safety-tested and approved by a Nationally Recognized Testing Laboratory (NRTL) before employers may use them in the workplace. Currently, there are 15 NRTLs. OSHA recognizes, or accredits, laboratories as NRTLs that have met the necessary qualifications and requirements specified in program regulations and agency guidance. In turn, NRTLs determine whether certain types of products—ranging from fire extinguishers to coffee makers to power transformers—meet appropriate safety standards. If approved by an NRTL, the products are accepted by OSHA for use in the workplace. Because the availability of such labs for product safety testing is essential to ensuring employers have timely access to products that meet safety standards, you asked that, within the context of OSHA meeting its mission, we examine (1) how long it takes to make accreditation decisions and the key factors that affect timeliness and (2) the extent to which OSHA has adopted commonly used strategies for improving timeliness. To address both research questions, we reviewed relevant federal laws, regulations, and OSHA publications on the NRTL program. We also interviewed key program stakeholders such as OSHA officials, eight NRTL program applicants, and select public and private organizations, including non-profits, that accredit safety labs for other programs or purposes. To determine how long it took OSHA to approve accreditation applications, we reviewed data from OSHA and analyzed time frames for applications approved between June 2007 and June 2012. We also Page 1 GAO-13-88 Product Testing Laboratories analyzed the length of time that applications for which OSHA had not made a final determination as of June 11, 2012, had been pending. After comparing the data to Federal Register notices, which identified key application dates, and through interviews with OSHA officials, we determined that the data provided by OSHA were sufficiently reliable for our purposes. To identify promising strategies for improving timeliness, we reviewed and synthesized findings from various sources, including GAO reports, international standards, guidance on accreditation, and materials from other organizations and federal agencies. We also interviewed officials from public and private accreditation programs and organizations, including consortiums of accreditation organizations, about their processes and practices to identify examples of promising strategies and learn how they have been implemented by others. We selected other accreditation programs and organizations to review based on recommendations from NRTL program stakeholders and gave priority to those accreditation programs that are similar to OSHA’s accreditation program in terms of mission or scope. While no other accreditation process is completely comparable to OSHA’s, the experiences of others provide illustrative examples of actions that federal agencies have taken to adapt the accreditation process to their own unique missions and circumstances. For more information about our sources and methods for identifying promising strategies for improving timeliness, see appendix I. We conducted this performance audit from April 2012 to December 2012 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Background NRTL Program As authorized by the Occupational Safety and Health Act of 1970, OSHA issues and enforces workplace safety and health standards (OSHA standards). 1 Some OSHA standards require that certain products used in 1 Pub. L. No. 91-596, 84 Stat. 1590, codified as amended at 29 U.S.C. §§ 553, 651-78. Page 2 GAO-13-88 Product Testing Laboratories the workplace, such as a variety of electrical equipment, be safety-tested and approved by OSHA-accredited laboratories. 2 To serve this purpose, OSHA established the NRTL program by regulation in 1988. The program is currently administered by four staff members and a director who was hired in August 2012. The NRTL accreditation process is designed to determine whether an organization has the capability and independence to test and certify (“approve”) that products meet consensus-based safety standards (test standards). 3 The main purpose of the NRTL accreditation process is to ensure that these organizations are and remain qualified to test and certify products used in the workplace. 4 OSHA makes three types of accreditation decisions, which are generally valid for 5 years: 1. Initial: Determinations about whether to accredit an organization as an NRTL for the first time. 2. Expansion: Determinations about whether to expand the purview of an accredited NRTL to include other categories of products to be tested or to allow an accredited NRTL to conduct testing activities at additional sites. For example, an NRTL that is already accredited by OSHA to test electric clothes washing machines may apply to add additional test standards to its NRTL scope, such as standards for testing heat detectors for fire. The duration of expansion accreditations may be shorter than 5 years because 2 In this report, we use the term “accredit” to mean the same as “recognize.” OSHA officials told us that, while the program formally uses the term “recognize,” it is appropriate to describe its process for recognizing third-party laboratories as an accreditation process. In addition, we use the term “approved” to include a number of terms used in OSHA’s standards, including “approved,” “certified,” “listed,” “labeled,” and “accepted.” 3 29 C.F.R. § 1910.7 and app. A. OSHA standards that require NRTL approval do not specify the particular safety requirements that the products must meet; NRTLs generally test products against consensus-based safety standards developed by standards- developing organizations. The process for developing these consensus-based safety standards involves soliciting input from various stakeholders. Only certain equipment and materials are required by OSHA standards to be approved by an NRTL. OSHA categorizes these products into 38 broad categories. The largest of these categories, according to OSHA, is electrical products and equipment. Other categories include portable fire extinguishers, employee alarm systems, and different types of scaffolding. 4 OSHA’s regulations specify the criteria that NRTLs must meet, which include testing capability, implementation of certain internal controls, independence from employers or manufacturers, and maintenance of effective procedures for reporting and handling complaints. See 29 C.F.R. § 1910.7(b). Page 3 GAO-13-88 Product Testing Laboratories expansion decisions expire at the end of the current accreditation period. 3. Renewal: Determinations about whether to continue accrediting a lab as an NRTL once its previous accreditation has expired. An NRTL that submits a sufficient renewal application 9 months to 1 year before its existing accreditation expires retains its NRTL accreditation until the final renewal decision is made. OSHA also conducts regular onsite audits of accredited NRTLs. The NRTL accreditation process generally includes the steps outlined in figure 1. Figure 1: Summary of OSHA’s Process for Initial, Expansion, and Renewal NRTL Accreditation Decisions Page 4 GAO-13-88 Product Testing Laboratories OSHA collects fees from applicants and accredited NRTLs, and uses the fees for program expenses. 5 OSHA first instituted fees in 2000 and calculated them with the intention of covering core application processing costs and audits of accredited labs. 6 In 2011, OSHA revised its calculation of these fees to cover additional program costs, with the intent that the NRTL program would be almost entirely funded through fees paid by the labs. 7 Under the revised fee structure, the fee for application review will be $17,750 for an initial NRTL application, $8,280 for applications to expand to additional sites, and $300 for renewals and other expansion applications, in addition to fees for other stages of the process. Once fully implemented, OSHA expects that the fees will cover approximately 95 percent of program costs, but revenues from fees and the percentage of program costs they cover will vary from year to year based on the number of applications submitted and audits performed. Fifteen labs are currently accredited by OSHA as NRTLs. Combined, these labs approve hundreds of types of products for use in the workplace. All NRTL-approved products are labeled with the lab’s certification mark, so that employers and other consumers can identify them in the marketplace (see fig. 2). 8 To maintain its accreditation, an NRTL is required to protect its certification mark by implementing control procedures and conducting inspections to monitor its proper use. NRTLs are also required to inspect manufacturers to ensure that products 5 29 C.F.R. § 1910.7(f). 6 65 Fed. Reg. 46,798 (July 31, 2000). 7 76 Fed. Reg. 10,500 (Feb. 25, 2011). Prior to adjusting the fees, OSHA recovered about half of the allowable reimbursable costs of the NRTL program. The 2011 revision to the fee structure, which will be phased in over 3 years, allows OSHA to recoup additional program costs, including personnel costs for leave and ancillary activities that support the NRTL program. Ancillary activities include program administration, training, interagency and international coordination, responding to information requests, handling complaints, website maintenance, and meeting with stakeholders and interest groups. 8 According to OSHA, the presence of the lab’s mark on a product does not necessarily mean that it meets OSHA requirements because NRTLs sometimes use the same or similar marks to denote testing or certification performed in accordance with other accreditations. OSHA accepts only products that contain the NRTL's mark and that the NRTL has certified within its scope of accreditation, which includes the test standards and testing sites that OSHA has recognized for the NRTL. For information on each NRTL's scope of recognition, consumers and employers may visit the OSHA website. http://www.osha.gov/dts/otpca/nrtl/#nrtls Page 5 GAO-13-88 Product Testing Laboratories conform to the test standards. 9 NRTLs carry out these responsibilities during follow-up inspections at the manufacturing facilities, where staff ensure that the mark is being controlled properly and that products are consistently being manufactured to meet safety standards. Figure 2: Examples of NRTL Certification Marks Note: The certification marks listed above reflect marks that were in use as of October 2012. Certification marks are generally registered by the NRTL with the U.S. Patent and Trademark Office or an equivalent national or international body. While 15 labs are currently accredited by OSHA as NRTLs, only 13 marks are shown because two labs share the same certification mark with other labs. Accreditation Processes at In addition to OSHA, many other federal agencies administer programs Other Selected Federal that require laboratories to receive accreditation to approve products. Agencies Under these programs, labs are accredited for specialized purposes, such as to approve children’s products or ensure that electronic systems for records are consistent with federal standards. 10 Labs accredited by OSHA are sometimes also accredited to participate in other federal agencies’ programs to perform product approval activities for different types of products or purposes. While the specific purposes of these accreditation programs differ, the various activities performed during the accreditation process are similar. Whether a particular activity is performed by federal agency staff in- house, or by external entities, varies by agency. First, regulatory agencies 9 29 C.F.R. § 1910.7(b)(2) (i)-(iii). 10 While similar accreditation processes may exist at the state or local government level, such processes are beyond the scope of this report. Page 6 GAO-13-88 Product Testing Laboratories establish the requirements that a lab must meet to determine whether manufacturers are making products that meet the program’s standards. 11 Agencies may require that labs approve products by “testing” a sample of a product onsite within the lab’s facilities, “certifying” that products meet specific standards based on testing or activities such as inspecting the manufacturers’ facilities, or both. 12 An NRTL accreditation by OSHA signifies that the lab is approved by the agency to both (1) conduct product safety tests and (2) certify that products meet relevant consensus-based safety standards. After the regulatory agency establishes its requirements, accreditation organizations then review the operations of specific labs to determine whether they are meeting the requirements of the regulatory agency. A federal agency may act as the accreditation organization, or an agency may designate outside entities to perform the accreditation function. Once accredited, the lab follows these requirements to test and certify whether products meet program standards. In some cases, the regulatory agency will require that separate entities perform the testing and certification functions, which is intended to increase the transparency and rigor of the process. Regulatory agencies may exercise various types of oversight or ongoing monitoring of the other actors in the accreditation process to ensure that each of the actors in the process is meeting the program’s requirements. Federal agencies and offices may take on different roles in accrediting labs depending on a variety of factors, including resource constraints, statutory requirements, and decisions on how to manage risks associated with non-compliance. In the case of the NRTL program, OSHA acts as both the regulatory agency and the accreditation organization, with support from fees paid to OSHA by applicants and participating NRTLs. In contrast, some other agencies establish the requirements that labs must meet, but designate one or more outside entities—such as private organizations or other government entities—to perform the accreditation function. Officials at selected agencies we interviewed explained that, 11 Some requirements may be established by statute, depending on the structure of the program. 12 Entities that certify products but do not conduct testing may be called “certification bodies” instead of labs. In this report, we use the term lab to mean entities that test, certify, or both. Page 7 GAO-13-88 Product Testing Laboratories under this model, the outside accreditation organizations, rather than the regulatory agency, are responsible for charging and collecting fees from labs in order to cover the cost of accreditation application processing and approval. The agencies we interviewed do not pay the external organizations for performing accreditation duties. See table 1 below for a brief description of selected agencies’ accreditation processes. Table 1: Accreditation Processes Used by Selected Federal Agencies, for Various Purposes U.S. Department of U.S. Consumer Federal Communications Health and Human Product Safety Commission Services Commission Federal agency OSHA (FCC) (HHS) (CPSC) Program name NRTL Program Equipment Authorization Health Information Conformity Assessment Program Technology Certification Body Recognition Program Program Brief description of Labs are accredited to Labs are accredited to test or Labs are accredited to Labs are accredited to program test and certify that certify that certain devices using test or certify that health test children’s products products used in the the radio frequency spectrum information technology for compliance with U.S. workplace meet meet FCC’s technical standards systems meet HHS’s CPSC’s safety rules. appropriate consensus- to prevent harmful interference. relevant standards and based safety standards. certification criteria. a b c Designates an No Yes Yes Yes external entity or entities to assist with accrediting labs for product approval activities Source: GAO review of OSHA, FCC, HHS, and CPSC documents and interviews with officials. a FCC regulations may require a given piece of equipment to meet one of three levels of review before it can be imported or sold. According to officials, whether a given product requires testing or certification depends on FCC’s assessment of its risk. The agency has designated the National Voluntary Laboratory Accreditation Program, administered by the National Institute of Standards and Technology (NIST) of the U.S. Department of Commerce and two private organizations to accredit testing laboratories. NIST has currently designated two private organizations to accredit certification organizations for FCC’s purposes. For both testing and certification, FCC must agree with the accreditation recommendation made by the external organization before the decision is finalized. See 47 U.S.C. § 302a, 47 C.F.R. §§ 0.241(f)-(g), 2.960, 2.962, 2.948(d). b HHS’s Office of the National Coordinator for Health Information Technology (ONC) has designated two different accrediting organizations to accredit labs to perform different types of activities. First, NIST’s National Voluntary Laboratory Accreditation Program accredits laboratories to test products. Second, for product certification activities, one accreditation organization is approved by ONC through a competitive process held every 3 years. Currently, the approved accreditation organization is a private organization. See generally 42 U.S.C. § 300jj-11(c)(5), 45 C.F.R. §§ 170.500-170.599. c Accreditation organizations must be a signatory to the International Laboratory Accreditation Cooperation-Mutual Recognition Arrangement.16 C.F.R. § 1112.3. Signatories have been peer- reviewed and determined to meet the International Laboratory Accreditation Cooperation’s criteria for competence. Once a testing lab has been accredited, the accreditation must be registered with, and accepted by, CPSC. All regulated children’s products are required to be tested by third-party laboratories, but the manufacturers and private labelers certify the products. See 15 U.S.C. § Page 8 GAO-13-88 Product Testing Laboratories 2063(a)(2). CPSC’s requirements for accreditation and testing were published in separate notices specific to particular safety rules. In May 2012, CPSC published a notice of proposed rulemaking that would establish general requirements consistent with these notices. 77 Fed. Reg. 31,086 (May 24, 2012). Guidance issued by the National Institute of Standards and Technology (NIST), in accordance with the National Technology Transfer and Advancement Act of 1995, encourages federal agencies to conduct their accreditation processes in a manner that promotes collaboration, reduces duplication, and harnesses the private sector, as appropriate. 13 Many agencies, including OSHA, have incorporated aspects of these principles into their program design, such as by requiring the use of consensus- based standards developed by the private sector for product safety testing. Unlike OSHA, however, some accreditation programs explicitly require that labs meet international standards and guidelines developed by the International Organization for Standardization (ISO) as a condition of accreditation. 14 This can reduce duplication and promote consistency among accreditation processes within and across countries. In addition to developing and disseminating guidance, NIST provides technical assistance services to federal agencies upon request to assist with designing and implementing accreditation processes. 15 This technical assistance often takes the form of one-on-one consulting, and NIST may help agencies start new accreditation programs or tailor an agency’s existing program to meet the agency’s specific needs. NIST’s National Voluntary Laboratory Accreditation Program also assists other federal agencies by performing testing lab accreditation. HHS and FCC, for example, utilize NIST’s National Voluntary Laboratory Accreditation Program to accredit testing laboratories. 13 See Pub. L. No. 104-113, § 12(b), 110 Stat. 775, 783 (1996), codified at 15 U.S.C. § 272(b)(13) and NIST’s Guidance on Federal Conformity Assessment Activities, 65 Fed. Reg. 48,894 (Aug. 10, 2000), codified at 15 C.F.R. pt. 287. The Act and guidance refer to conformity assessment, which NIST defines as any activity concerned with determining directly or indirectly that requirements are fulfilled. Conformity assessment includes accreditation and testing. 14 ISO is the world’s largest developer of voluntary international standards, including standards on testing and certification. 15 Congress established NIST (formerly the National Bureau of Standards) in 1901 to support industry, commerce, scientific institutions, and all branches of the government. It works with industry to develop and apply technology, measurements, and standards, among other activities. Page 9 GAO-13-88 Product Testing Laboratories Scope of Staff Responsibilities and Unclear Application Procedures Lengthen the Accreditation Process Application Processing None of the accreditation applications approved in the last 5 years were and Approval Times Are processed and approved within the time frames that OSHA officials Lengthy Compared to consider desirable, and the time frames for some applications were significantly longer. In the 5-year period from June 2007 to June 2012, OSHA’s Desired Time OSHA approved 13 applications. Processing and approval times ranged Frames and Other from 1.2 to 5 years (see fig. 3). 16 Benchmarks 16 Our analysis focused on applications with final approval decisions published in the Federal Register. The information above does not include cases in which OSHA denied accreditation or the application was closed before a final decision was made. Since 2007, one renewal application was formally denied by OSHA and it took OSHA over 8 years to complete its review of that application. In addition, OSHA closed some applications without publishing a final decision on them in the Federal Register. An application may be closed in this manner for reasons such as an applicant submitting a new application that supersedes the first; an applicant choosing to withdraw an application; or an applicant discontinuing communication with OSHA. In at least one case, OSHA suggested that an applicant withdraw an application partway through the review process because the agency deemed the application unlikely to ultimately receive approval. Seven applications submitted since June 11, 2007, were closed without OSHA issuing a final decision. Page 10 GAO-13-88 Product Testing Laboratories Figure 3: Duration of Application Processing Times for Applications Approved from June 11, 2007 to June 11, 2012 Note: These time frames include the time that the applications were with OSHA for review as well as any time that the applicants were addressing deficiencies identified by OSHA. OSHA officials told us that the desirable time frame for processing and approving applications is 12 to 18 months for initial applications, 6 to 8 months for expansion applications, and 3 to 4 months for renewal applications. OSHA officials said they expect an application to fall within this range if there are no major delays or application deficiencies. For all 13 applications processed during the 5-year period we reviewed, it took much longer to process and approve the application than the desirable time frames, and in some cases, years longer (see table 2). Page 11 GAO-13-88 Product Testing Laboratories Table 2: Actual vs. Desirable Processing Time Frames for Applications Approved from June 11, 2007 to June 11, 2012 Number of applications Type and number of Range of processing times for Desirable processing times approved within the desirable approved applications approved applications identified by OSHA processing time frames Initial (2) 2.6 years and 5 years 12 to18 months 0 Expansion (10) 1.2 years to 3.2 years 6 to 8 months 0 Renewal (1) 4.4 years 3 to 4 months 0 Source: GAO analysis of OSHA data. The NRTL accreditation process is also lengthy in relation to the amount of time that NRTL accreditations are valid. Our analysis of the processing time frames for these initial, expansion, and renewal applications showed that it took OSHA 2.5 years or more to complete about half of them. These time frames signify a relatively long application period for an accreditation term of 5 years and, for some renewal applications, a lengthy period in which an existing lab is operating under an extension of its existing accreditation. In addition to these lengthy time frames for approving applications, many application decisions have been under review by OSHA for substantial lengths of time and remain pending. Of the 29 applications pending approval as of June 2012, 12 had been pending for between 5 and 10 years. Therefore, they had been under review by OSHA for at least as long as the term of the 5-year accreditation (see fig. 4). Almost all of the applications pending for this long were renewal applications. Further, the number of pending applications may underestimate the total number of accreditation cases that are awaiting review. At least two of the eight laboratories we interviewed had chosen not to submit new expansion applications until their earlier expansions were approved because they said that it is not productive to have multiple expansion applications going through OSHA’s process at once. Officials from one lab noted that they decided not to submit a second application to OSHA while the first was under review because they did not want OSHA to divide its time between the two applications. Page 12 GAO-13-88 Product Testing Laboratories Figure 4: Length of Time Pending Applications Had Been under Review, as of June 11, 2012 Note: This figure includes all applications for which OSHA had not made a final decision as of June 11, 2012. For each application, it shows the elapsed time between the date it was submitted and June 11, 2012. Page 13 GAO-13-88 Product Testing Laboratories The lengthy NRTL accreditation process results in negative economic consequences for applying labs, according to most of the applicants with whom we spoke. Lab officials said that NRTL accreditation processing times make it difficult to attract or retain customers or hire and retain technical experts. For example, an official with a lab that had a pending NRTL expansion application told us that his lab had already been accredited by another organization to test and certify the same products for use outside the workplace. However, OSHA had not approved the lab’s application to test and certify these same products for use in the workplace although the lab’s application had been under review for several years. He said OSHA’s lengthy NRTL accreditation process hurt the lab’s relationship with clients because many manufacturers do not want to work with a laboratory unless it can approve products for use within the workplace. An official from another laboratory said that the company had lost staff members who were hired specifically to support the lab’s application for an expanded scope of work. Given the length of time that the lab’s expansion application has been under review, it could not retain these specialized staff members while it waited for NRTL approval. The laboratory will ultimately need to rehire individuals with this type of expertise if the application is approved. Imbalance between The way the NRTL program is designed requires its four staff members to Program Staffing Levels balance many wide-ranging responsibilities and can lead to delays in and Scope of approving accreditation applications. Two senior engineers and two junior staff members share responsibility for all aspects of the NRTL program. 17 Responsibilities Led to Labor attorneys also assist the NRTL program. The program is structured Long Time Frames and so that these staff members are responsible for the following: Delayed Approval of Applications • All aspects of approving accreditation applications. This includes reviewing all aspects of the accreditation applications; communicating with applicants regarding questions and application status; conducting site visits; making preliminary accreditation decisions; and preparing the Federal Register notices that formalize accreditation decisions. 17 OSHA hired an NRTL program director in August 2012. According to OSHA staff, the director’s responsibilities focus on providing direction and leadership for the office. According to OSHA officials, the individual is not involved in making specific accreditation or audit determinations. Page 14 GAO-13-88 Product Testing Laboratories • Oversight activities for existing labs. According to NRTL program policy documents, accredited labs and satellite offices 18 should be audited by OSHA personnel. 19 In total, this includes auditing approximately 120 sites worldwide. The staff are also responsible for investigating any complaints OSHA receives about accredited labs. • Updating program guidance and procedures. This includes making revisions to program documents including the NRTL program directive on program policies, procedures, and guidelines, as well as other guidance on the application review process. Staff must also update OSHA’s NRTL website to provide information such as the names and approved products for each NRTL. • Responding to requests from other federal agencies. OSHA staff told us that federal entities such as the Office of Management and Budget and the Office of the United States Trade Representative frequently request NRTL program staff input on questions related to international trade and product safety. OSHA officials told us that balancing these responsibilities can be challenging and leads to difficult decisions about how to prioritize their tasks. They said that their workloads are often affected by tasks that originate outside the NRTL program office. For example, staff reported having to postpone accreditation work when urgent requests came in from the Office of the United States Trade Representative or other federal agencies. Given these wide-ranging duties, NRTL program staff sometimes set aside applications for significant amounts of time while they attend to their other responsibilities. OSHA often cited these competing demands when 18 In May 2009, OSHA implemented a new segment of the NRTL program called the Satellite Notification and Acceptance Program (SNAP), which increased the number of sites that can be operated by NRTLs. SNAP allows NRTLs to use facilities referred to as “SNAP sites,” which the NRTLs control and audit, in order to perform particular functions necessary in the NRTL’s testing and certification operations. Participation in SNAP is voluntary, and NRTLs must apply to OSHA for approval to participate in the program. 74 Fed. Reg. 923 (Jan. 9, 2009). 19 Policy documents direct OSHA staff to conduct a combination of onsite and office audits of accredited labs. Onsite audits should be performed for each NRTL either annually or on another frequency as determined by the NRTL program director. OSHA may perform an office audit of each NRTL not scheduled for an annual onsite audit. According to OSHA documents, OSHA officials select SNAP sites to audit, in part based on previous audit results. The number of SNAP sites that OSHA audits in any year will not usually exceed 50 percent of the total number of SNAP sites. Page 15 GAO-13-88 Product Testing Laboratories explaining to applicants its slow process for approving their applications. For example, one applicant said that when he asked for a status update on his organization’s application several months after submitting it to OSHA, an agency official told him it had not yet been opened because no one had had time to start processing the application. OSHA officials also told us that more complex applications, which may take a lot of time to process, are sometimes set aside in order to process applications that are more straight-forward, but there is no formal method of prioritizing applications for review. While OSHA does not systematically collect data on the proportion of time an application is being actively processed versus the time it is waiting for review, available information supports applicants’ concerns that OSHA may not be actively reviewing applications for a significant amount of the time they are at the agency. OSHA processing, applicant revisions, and public comment periods accounted for some, but not all, of the total duration of recent application reviews. The estimated time frames for each of these steps are described below, but the full duration of application processing and approval times for most applications approved between June 2007 and June 2012 took months or years longer than the estimated time frames for each of these steps combined. This suggests that a given application may be set aside for significant amounts of time while OSHA personnel attend to their other responsibilities. • OSHA’s average processing times: OSHA documents show that, on average, staff actively work on initial applications for the equivalent of about 2.5 months and expansion or renewal applications for the equivalent of about 1 month. 20 • Applicant revisions: OSHA officials noted that labs often have to revise their applications after deficiencies are identified, which extends the duration of the time frames for approving applications. This may involve two rounds of OSHA comments on written applications and two rounds of related applicant revisions. OSHA officials said they have sometimes allowed up to 1 year and 2 months 20 OSHA calculated these estimates of the average time it takes the agency to approve applications in the course of establishing its new fees. See 76 Fed. Reg. 10,500, 10,505- 07 (Feb. 25, 2011). For initial applications, these estimates assume that two OSHA staff conducted an onsite review of one site for 3 days each. For expansion applications that do not involve expanding the number of testing sites, these estimates assume that two OSHA staff conducted an onsite review of one site for 1 day each. The estimate for renewal applications includes one onsite visit of 3 days by one person. Page 16 GAO-13-88 Product Testing Laboratories for applicants to complete such revisions. Applicants may also correct deficiencies identified by OSHA during site visits, and OSHA allowed approximately 1 month for one recent initial applicant to do so. In our analysis of the application processing files for three recent initial applications, we found that all three applicants revised their applications at least once and the total revisions for each application took from 6 to 11 months. 21 • Public comment period: For all types of applications, OSHA provides a public comment period that begins when it publishes its preliminary accreditation decision in the Federal Register. According to OSHA’s regulations, the minimum period for public comment on initial applications is 30 days, while the minimum period for public comment on renewal or expansion applications is 15 days. In addition to extending the time it takes OSHA to approve applications, staff workload also leads to delays in responding to applicants’ questions about the status of their applications. Almost all of the applicants we interviewed expressed frustration about the amount of time it took to receive responses from OSHA and often said that OSHA officials attributed slow response times to their workload. Officials at one laboratory stated that there was about a 50/50 chance of ever receiving a response from OSHA when they contacted program staff. Officials of another laboratory described the OSHA accreditation process as a “black box” because applicants were uncertain about when their applications would reach the next milestone. Several applicants said that this uncertainty made the long application processing time frames even more difficult for their businesses because they could not plan for budgetary needs or update their clients on when they would offer new services. Several labs also noted that other accreditation programs respond to questions within a few days, so the delays in receiving responses from OSHA staff make the program an outlier. OSHA officials told us they used to provide applicants with quarterly updates that included projected target 21 We reviewed files of three initial applications approved or closed between June 2007 and June 2012; one of these was not included in our analysis of approval times because it was withdrawn before a final decision was made. This applicant only provided one round of revisions prior to withdrawing its application. We calculated these estimates by identifying the date that OSHA provided letters of deficiency to applicants and the dates that applicants submitted revised applications. In cases where OSHA provided two letters of deficiency and applicants provided two revised applications, we included both revision time periods in our calculation. This calculation does not account for any other time periods when OSHA may have been waiting on more informal email responses from applicants, etc. Page 17 GAO-13-88 Product Testing Laboratories dates for the various stages of the application approval process, but they stopped providing these quarterly updates because the agency could not meet its projected target dates. Decisions about how to prioritize staff workload also affect the amount of internal review that accreditation decisions receive before they are finalized and can have negative impacts on applicants’ trust of program operations. GAO guidance on internal controls highlights the importance of separating key duties such as initial decisions and reviews of those decisions. 22 International accreditation standards also require that final accreditation decisions be made by competent individuals or committees different from those who carried out the assessment. 23 However, OSHA’s accreditation decisions for NRTLs are not consistently reviewed by a second technical reviewer before being finalized. OSHA officials said that the decisions are reviewed for legal accuracy, and are approved by upper management, but given the small size of the NRTL staff and their heavy workload, the person who conducts the initial reviews of applications is often the same person who makes the final recommendation about whether a lab should be accredited. While this might decrease the processing time for some applications or be the most feasible approach given program staffing levels, it can create a greater potential for error or bias. Two applicants we spoke with expressed concern about the absence of a second technical reviewer. Further, staffing roles and responsibilities affect the level of oversight OSHA provides once an accreditation application is approved. For example, to reduce the number of pending applications, OSHA staff reprioritized their duties so that a senior engineer could spend the majority of his time processing and approving applications. While this provided more resources for the application process, officials said it reduced the time they can spend auditing existing NRTLs, and several labs we interviewed confirmed that they had been audited less frequently in recent years. Auditing the NRTLs less frequently increases the likelihood that any problems with an accredited lab will go unnoticed. The 22 GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 (Washington, D.C.: Nov.1999). 23 See ISO, Conformity Assessment—General Requirements for Accreditation Bodies Accrediting Conformity Assessment Bodies, ISO/IEC 17011:2004, 4.3.5 and 7.8-7.9 (Geneva, Switzerland, February 2005). Page 18 GAO-13-88 Product Testing Laboratories extensive time it takes OSHA to approve renewal applications also means that labs are sometimes operating under previous accreditations for much longer than the 5 years for which they are valid because OSHA regulations generally allow labs to retain their accreditation and continue approving products while they wait for OSHA’s decisions on their applications for renewal. This can minimize the impact that processing delays have on a lab’s business operations, but it also means that a lab with performance problems could operate for an extended period of time after its 5-year accreditation period, even if the lab’s renewal is ultimately rejected. For example, one lab’s recent renewal application was pending for 8 years before OSHA ultimately rejected it. Unclear Application Most of the applicants we spoke with told us that OSHA’s guidance does Requirements Further not always provide adequate information about the program’s application Increase the Length of requirements, which creates confusion and adds time to the review process. Applicants found the guidance particularly confusing because Accreditation Reviews OSHA’s requirements for the content and level of detail labs must provide in their accreditation applications differ in important ways from those of many other organizations that accredit safety labs by using current international standards for accreditation. 24 For example, several NRTLs noted that the types of product approval activities they conduct or are applying to conduct for the NRTL program are similar to the work that they do under other accreditation programs. Some of the information OSHA requires during its application process to test those products differs from what other programs require in ways that applicants believe are not clearly articulated in NRTL guidance. When the program last updated its application policies in 1999, OSHA developed these deviations from international standards in order to ensure that NRTLs were qualified to meet all aspects of the program’s mission and requirements. At the time they completed their applications for the NRTL program, most applicants said they were unclear about how and why the NRTL requirements differed from international accreditation standards, which led to confusion and affected the timeliness of the process. For 24 The key international standards for conducting safety lab accreditation were developed by the International Organization for Standardization (ISO). ISO/IEC 17011:2004 provides standards for how accreditation organizations conduct their work, ISO/IEC 17025:2005 provides standards for how testing laboratories should be assessed for accreditation, and ISO/IEC 17065:2012 provides guidance on how certification organizations should be assessed for accreditation. Page 19 GAO-13-88 Product Testing Laboratories example, officials at a lab that recently submitted an initial application to OSHA said the agency required them to provide additional detail about the work procedures they planned to use when conducting tests of equipment. This information was not required when they submitted similar applications to other accreditation organizations and lab officials were unaware of this difference when they initially prepared and submitted their accreditation application to OSHA. The lab ultimately had to revise its application to meet OSHA’s requirements, extending both the amount of time lab staff spent preparing the application and the time OSHA officials spent reviewing it. OHSA officials told us that such detail is key to ensuring that lab staff have the knowledge to perform the required safety tests. Officials stated that the agency intends to revise its policies and guidance to better convey its application expectations, but has not yet done so due to workload issues. Confusion resulting from OSHA’s unclear guidance is compounded in cases where OSHA’s requirements are evolving. For example, OSHA has been revising its process for verifying the independence of labs since 2008, but it has not updated the independence policies in its policy directive or other application guidance. 25 OSHA officials said that the agency continues to process renewal applications while it revises its independence policies, but they have delayed making final decisions until the requirements are finalized. They noted that this process is time- consuming. There were 13 renewal applications pending in June 2012, 10 of which were pending for 5 years or more. Officials from several labs said that they have not received clear guidance from OSHA on the level of information required to illustrate independence and, therefore, they have had to provide several rounds of information to OSHA in their applications. One lab said that gathering this additional information is time consuming because it often involves obtaining information about 25 OSHA’s regulations require that an NRTL be “completely independent of employers subject to the tested equipment requirements, and of any manufacturers or vendors of equipment or materials being tested for these purposes.” 29 C.F.R. § 1910.7(b)(3). A 2005 report by the Department of Labor’s Office of the Inspector General was the impetus for the change to NRTL program procedures for verifying independence. Department of Labor Office of the Inspector General, OSHA Correctly Denied ED&D’s Incomplete NRTL Application, 05-05-002-10-001, (March 31, 2005: Washington, D.C.). This report had three recommendations related to independence: (1) make independence reviews a mandatory part of application reviews and periodic audits; (2) modify current policy to ensure that all areas related to an NRTL’s recognition, including independence, are reviewed at least once during each 5-year recognition period; and (3) review two NRTLs’ current business practices to ensure conformance with the independence requirement. Page 20 GAO-13-88 Product Testing Laboratories individuals and companies with a minority financial interest in the labs, some of whom are located in different countries. Several applicants with pending expansion or renewal applications also said that some of OSHA’s requirements seem to have evolved over time and OSHA has not revised its guidance to include these new requirements. Representatives from these labs said OSHA identified deficiencies in their most recent expansion applications although they provided similar types of information in previous years on applications accepted by OSHA. While OSHA’s application requirements may differ from international standards in order to meet the agency’s safety mission, OSHA has not compared its requirements to current international standards to identify differences and assess their costs and benefits in order to ensure that the time devoted to assessing applicants against additional requirements is well-spent. OSHA officials told us the additional information about work procedures and independence they require of applicants is necessary to ensure the quality of the product approval process and that applicants follow program requirements. For example, OSHA officials said that the requirement in OSHA regulations that labs be “completely independent” of manufacturers presents a high bar for application review, and international standards on accreditation do not include such extensive requirements. When OSHA developed its NRTL policy directive in 1999 detailing the specific requirements for accreditation applications, it modified the international standards that were available at that time to fit NRTL program needs and requirements. 26 However, subsequently, the agency has not formally reviewed the NRTL procedures against the current versions of international standards on accreditation or recently assessed the risks, costs, and benefits of having procedures that deviate from these standards. NIST guidance recommends that agencies establish ongoing processes for reviewing their accreditation activities and, to the extent possible, coordinate with federal, private, and international organizations. Officials told us that they would like to evaluate their procedures against current international standards, but have not had time to do so. Without OSHA conducting a risk assessment of its current requirements, the extent of any value added from the 26 The NRTL program application requirements are described in OSHA Directive CPL 01- 00-003: NRTL Program Policies, Procedures, and Guidelines. OSHA’s regulations state that an applicant shall “provide sufficient information and detail” demonstrating that it meets NRTL program requirements, and identify the scope of recognition it is seeking, including the testing methods it will use. 29 C.F.R. § 1910.7, app. A. Page 21 GAO-13-88 Product Testing Laboratories program’s additional application requirements is unknown, as are any trade-offs the agency makes by devoting more resources to the application review. In addition, the rationale for these requirements may be unclear to applicants. Perhaps as a consequence, about half of the NRTL applicants we spoke with questioned whether all of OSHA’s application procedures were necessary. For example, two applicants questioned whether it was necessary for OSHA’s independence review to cover individuals sitting on the boards of companies only marginally affiliated with the testing lab. On the other hand, representatives from two of the eight labs we interviewed said that certain OSHA requirements enhanced the quality of the program by, for example, providing detailed information about work procedures that was helpful in training new staff. While additional requirements imposed by OSHA may have value, where their purpose has not been articulated or their actual value has not been assessed, applicants may be more likely to question whether the requirements are justified and OSHA may not be expending its resources to optimum benefit. While a range of promising strategies for improving timeliness exist, Strategies for including some that might help address resource constraints, mitigate Improving Timeliness confusion over application procedures, and improve efficiency, OSHA has taken limited steps to implement such strategies in its accreditation Exist, but OSHA has process. Based on our review of various sources, including GAO reports, Taken Limited Steps we identified three promising strategies for improving timeliness: (1) aligning program design with program mission and resources; (2) to Implement Them providing clear guidance and timely communication to program stakeholders; and (3) developing performance measures and using data to track progress in meeting them to identify inefficiencies. For more information on how we arrived at these three strategies and the sources we reviewed, see appendix I. OSHA’s Program Design is Past GAO work on program management has found that agencies can Not Aligned with Program improve efficiency, including timeliness, by aligning program design with Resources resources through various actions. 27 For example, in some instances, streamlining procedures can save resources, improve productivity, and 27 See GAO, Streamlining Government: Key Practices from Select Efficiency Initiatives Should be Shared Governmentwide, GAO-11-908 (Washington, D.C.: Sept. 30, 2011). Page 22 GAO-13-88 Product Testing Laboratories help staff focus more time on performing essential program activities. In other instances, a fundamental reexamination of program structure may be appropriate and can provide insight into whether government operations are outmoded and need to be restructured. According to guidance from the Office of Management and Budget and previous GAO reports on risk management, agencies can also benefit from evaluating program procedures by analyzing the associated risks, benefits, and costs of changes to program operations. 28 Conducting such analyses helps agencies effectively decide how to prioritize their work, consistent with their mission and resources. Furthermore, collaborating with other government agencies and similar industry organizations is another step that agencies can take to improve program design and align program structure with resources. Collaboration allows programs to capitalize on the expertise of others, coordinate activities, and avoid unnecessary duplication and complexity. We found that OSHA has not formally revisited its structure for accrediting testing laboratories since the NRTL program started over 20 years ago. Because the NRTL program was established by regulation and not by statute, OSHA has flexibility to define its requirements for accreditation. When the NRTL program was established in the 1980s and OSHA’s current approach to accreditation was determined, OSHA said that it intended to monitor the program and look for alternatives to its accreditation approach, including investigating the possibility of using other entities to carry out NRTL accreditation activities. 29 However, we found that OSHA has taken limited steps to think strategically about the future of the NRTL program and how alternatives to its current accreditation process may allow the program to fulfill its mission in a more efficient way. An NRTL official said there have been informal discussions at the staff level about working with an external organization to conduct aspects of the accreditation review process, but the agency has not formally assessed such approaches internally or in collaboration with 28 See Office of Management and Budget, Updated Principles for Risk Analysis, M-07-24 (Washington, D.C.: Sept. 19, 2007), and GAO, Strategic Budgeting: Risk Management Principles Can Help DHS Allocate Resources to Highest Priorities, GAO-05-824T (Washington, D.C.: June 29, 2005). 29 53 Fed. Reg. 12,102, 12,114 (Apr. 12, 1988). Page 23 GAO-13-88 Product Testing Laboratories other agencies such as NIST. 30 Several NRTL applicants we interviewed thought that OSHA should reevaluate its approach to accreditation. For example, a few of the NRTL applicants we interviewed said there has been a shift in accreditation approaches since the NRTL program started in the late 1980s and OSHA has not always kept pace with these changes. Although OSHA has not recently revisited its overall approach to accreditation, it has begun implementing some steps to better align NRTL program design with its resources; the outcome of these actions, including how they will improve timeliness, remains unclear. For example, OSHA is in the process of phasing in increased fees for the NRTL program, which are intended to allow OSHA to recoup a larger percentage of the cost of administering the program, and OSHA plans to use that revenue to hire additional staff. However, even with these increased fees, OSHA estimates NRTL program expenditures for fiscal year 2012 to be almost $800,000 greater than the fees collected: revenues are estimated to be about $100,000 and expenditures to be $870,000. 31 An NRTL program official said that the estimated revenues for fiscal year 2012 are relatively low mainly because staff were not able to perform many audits due to their workload. 32 The revenues from increased fees are intended to be used to hire additional staff to improve the timeliness of its application review process and to perform other necessary program functions. However, OSHA has encountered difficulties trying to find senior level staff with engineering experience and has been unable to fill the positions to date. Therefore, OSHA plans to revisit its hiring strategy and seeks to hire four additional staff members in 30 While NIST provides technical assistance services to federal agencies upon request to assist with designing and implementing accreditation processes, the Performance Management Center, which is housed within the U.S. Department of Labor’s Office of the Assistant Secretary for Administration and Management, strives to improve Labor’s program performance efforts through data-driven analysis and sharing best practices. Among its other activities, the Performance Management Center provides advisory services to those Labor programs seeking to improve performance, but only upon request. We found that OSHA has not consulted with the Performance Management Center. 31 The expenditure figure is based on the existing four NRTL program staff and includes estimates of salary and benefits for the program staff and for one Labor attorney who assists the program; travel expenses, mainly for performing audits; and general office expenses. 32 OSHA charges labs fees for the audits, which increases the agency’s revenues for that year. Page 24 GAO-13-88 Product Testing Laboratories 2013. If the agency is successful in its hiring efforts, officials anticipate holding extensive training sessions for new staff members to prepare them for their responsibilities. While using higher fees to increase staffing is promising in theory as a means of improving timeliness, GAO has found in the past that, in practice, there may be problems associated with this approach. For example, it can be difficult to hire and train people quickly enough or retain them long enough to affect timeliness. Furthermore, if fewer accreditation applications are submitted than expected, fees may fall short of estimates, making it difficult to plan and budget for the program. 33 Due to the unpredictability of the volume of applications received, OSHA cannot be certain that increased fees will lead to higher revenues, as projected, and the outcome of OSHA’s efforts to hire and retain additional staff remains unclear. Unlike OSHA’s NRTL accreditation process, other federal agencies we interviewed relied in part on other public or private organizations to carry out the accreditation process and maximize their resources. The outside accreditation organizations often charge and collect fees from the labs in order to cover the cost of accreditation application processing and approval, but according to the federal agencies we interviewed, these organizations do not charge fees to the federal agencies. The federal agencies we interviewed also worked with NIST to plan, design, and develop their accreditation programs. Although each federal agency has a unique mission and a distinct process for accrediting labs, the examples below illustrate varied actions that agencies have taken in their efforts to adapt their processes to maximize resources and meet their own unique missions and circumstances. 34 33 See GAO, Food and Drug Administration: Effect of User Fees on Drug Approval Times, Withdrawals, and Other Agency Activities, GAO-02-958 (Washington, D.C.: September 2002). 34 GAO did not evaluate the effectiveness of the selected agencies’ accreditation programs and processes, but we analyzed them for variations in structure. For more information on how we selected federal agencies for review, see appendix I. Page 25 GAO-13-88 Product Testing Laboratories • FCC’s Equipment Authorization Program 35 - FCC officials told us the agency originally required labs to submit accreditation applications directly to FCC, but then restructured its approach to address resource constraints in the agency by collaborating with outside accreditation organizations. In order to satisfy FCC’s requirements, labs accredited through these outside accrediting organizations must meet both international standards and additional program-specific requirements. While the outside organizations evaluate labs and make recommendations about whether a lab meets FCC’s criteria and procedural requirements, FCC makes the final decision about whether to accept the lab into its programs. An FCC official said that working with outside accrediting organizations means that FCC has to constantly educate these organizations about program changes and new technology. However, the official said that using this structure allows FCC to use its limited resources to focus on critical compliance issues and the more technical aspects of the program while capitalizing on the expertise of organizations that have specialized backgrounds in accreditation. • HHS’s Health Information Technology Certification Program - Like FCC, HHS officials decided to collaborate with external organizations in order to maximize program resources and harness the expertise of others. HHS officials said that because health information technology systems are complex, have important implications for patient safety, and present a high risk for potential fraud and abuse, it was important for HHS to be involved in developing policies and to tailor HHS’s accreditation processes to fit the unique needs of the program. 36 For example, according to agency officials, HHS worked with NIST to develop sector-specific requirements for accrediting certification organizations in addition to using international accreditation standards. HHS officials said that by designating outside organizations to make accreditation decisions, 35 The Communications Act of 1934, as amended, authorizes FCC to regulate devices that may cause radio interference, 47 U.S.C. § 302a. FCC has developed two separate accreditation programs to support its equipment authorization activities, one focused on testing and one focused on certification. Information included in this section largely refers to FCC’s certification program. For more information about FCC’s equipment authorization activities, please see table 1 of this report. 36 The Health Information Technology for Economic and Clinical Health Act authorized certain Medicare and Medicaid incentive payments for the adoption and meaningful use of certified electronic health record technology, and required HHS to develop a voluntary certification program for health information technology. Pub. L. No. 111-5, div. A, tit. XIII, div. B, tit. IV, 123 Stat. 115, 226-79, 467-96 (2009). Page 26 GAO-13-88 Product Testing Laboratories they are better able to focus on the program’s goals and strategic planning, and are less focused on administrative tasks, such as collecting and tracking fees. They also said that using this structure has allowed them to make decisions about how to design their accreditation approach based on what will best fulfill their mission, rather than what resources are available in-house. • CPSC’s Conformity Assessment Body Recognition Program - Officials at CPSC recognized that their relatively small staff was not prepared to perform accreditations themselves and that there were not enough time, resources, and expertise within the CPSC to run a large-scale international accreditation program. 37 After consulting with NIST and weighing its options, CPSC ultimately decided to leverage the expertise and experience of an international organization whose member accreditation organizations meet international standards for accreditation and have been deemed competent through a peer- review process. CPSC officials believe this approach provides additional transparency in the process. Although CPSC does not accredit labs itself, it maintains a list of approved labs by requiring labs to apply directly to CPSC and by verifying that different types of labs have been appropriately accredited. Another approach that may help a program align its design with its resources is to use contractors to supplement limited in-house staff. For example, representatives from some of the private accreditation organizations we interviewed, including some that conduct accreditation activities for the federal agencies discussed above, said they use individual contractors on an as-needed basis. This reduces the need for full-time staff and helps to ensure that those individuals performing accreditation activities possess the necessary expertise. These organizations said that using contractors provides organizations with the flexibility to quickly adjust staffing levels based on the amount of work, and the particular accreditation work that needs to be performed. It also allows them to retain appropriately skilled people to perform the accreditation work. However, federal agencies’ use of private contractors is subject to various requirements, which limit the type of functions that 37 Among other requirements, the Consumer Product Safety Improvement Act of 2008 established a third-party safety testing requirement for children’s products (defined as consumer products designed or intended primarily for children 12 years of age or younger) and set deadlines for implementation. Pub. L. No. 110-341, § 102, 122 Stat. 3016, 3022. Prior to the passage of this act, CPSC had never participated in lab accreditation activities, according to officials. Page 27 GAO-13-88 Product Testing Laboratories may be performed by contractors and entail a commitment of time and resources to meet. 38 In addition, an OSHA official told us that if the agency were to rely on outside individuals, it would need to ensure their competency and independence. OSHA Lacks Clear Clear guidance and communication with applicants can also serve to Guidance and Timely improve the timeliness of the accreditation process. Guidance that does Communication with not give applicants the information they need to submit an acceptable application can delay approval. GAO’s internal control guidance states Applicants that program managers should ensure there are adequate means of communicating with, and obtaining information and feedback from, external stakeholders who may have a significant impact on the program achieving its goals. 39 Not only do clear guidance and communication contribute to timely processes, but they also serve to enhance the transparency of programs and policies by explaining program criteria and may increase trust and confidence among stakeholders. 40 OSHA’s current structure and workload have made it difficult to provide clear guidance and timely communication to applicants. Most of the NRTL applicants we interviewed stated that OSHA could enhance its guidance and communication in order to improve the timeliness of the accreditation process and to help make the accreditation process more transparent. The directive on NRTL program policies and procedures has not been revised since 1999, and OSHA has not updated its NRTL application guidelines since 2000. A new director assumed responsibility for the NRTL program in August 2012, and plans to focus on improving the consistency and clarity of program procedures and guidance, but it is too early to determine the timing and scope of such revisions. OSHA plans to issue interim program guidance in the short-term while later updating NRTL application guidelines and the directive on NRTL program policies and procedures. 38 For example, federal agencies generally must follow the procedures delineated in the Federal Acquisition Regulation. See, e.g., 48 C.F.R. § 7.5. 39 See GAO, Standards for Internal Control in the Federal Government, AIMD-00-21.3.1 (Washington, D.C.: November 1999). 40 See GAO, Certification Requirements: New Guidance Should Encourage Transparency in Agency Decisionmaking, GAO/GGD-99-170 (Washington, D.C.: September 1999). Page 28 GAO-13-88 Product Testing Laboratories We also found that OSHA had not adopted some of the measures to disseminate information used by other accreditation organizations we interviewed. For example, one of the accreditation organizations we interviewed holds an annual meeting specifically to hear from clients, and FCC hosts workshops twice a year where it shares program updates and explains program requirements to stakeholders. OSHA, on the other hand, occasionally speaks at trade association conferences and participates in workshops sponsored by NIST, but it does not hold regular meetings to update stakeholders and solicit feedback. An OSHA official did say that about 2 years ago, he started to initiate phone calls with labs interested in applying to the NRTL program to clarify the requirements for applications, with the intention of minimizing the back and forth that takes place during the application process. In his opinion, applicants have found these calls useful. Other accreditation organizations we interviewed have taken steps to enhance guidance and communication with applicants, such as developing systems to provide applicants with status updates and information in “real time.” For example, two accreditation organizations we interviewed maintain online portals that allow applicants to check on the status of their applications throughout the various stages of the application process. Furthermore, FCC manages a database for providing information to stakeholders. This database provides answers to frequently asked questions submitted by stakeholders and helps to ensure that FCC is giving consistent advice and answers to questions. FCC officials also said that input from stakeholders helps inform their guidance publications. OSHA Does Not Currently Our research on program management underscores the importance of Track the Quality and developing performance goals and measures to track progress and Timeliness of Its evaluate program performance. Developing a range of related performance measures and balancing these measures to address quality, Accreditation Process timeliness, efficiency, cost of service, and outcomes also allows a Using Performance program to balance priorities among other demands and gives managers Measures crucial information on which to base their organizational and management decisions. 41 In addition, using data to understand time frames offers an 41 See GAO, Tax Administration: IRS Needs to Further Refine Its Tax Filing Season Performance Measures, GAO-03-143 (Washington, D.C.: Nov. 22, 2002). Page 29 GAO-13-88 Product Testing Laboratories opportunity to identify potential inefficiencies and strategies for improving timeliness. OSHA developed performance measures for the NRTL program, including measures for timeliness of the approval process. However, it recently discontinued using these measures, because staff members’ workload increased to the point that it was impractical to achieve the metrics established. Through informal monitoring of the time it takes to approve accreditation applications, OSHA recognizes that its accreditation process has been taking longer than expected, especially for those applications with no major deficiencies or issues. OSHA officials are hoping that their plans to hire additional staff will bring the NRTL program closer to achieving their timeliness goals. It remains unclear, however, whether planned hiring efforts will adequately address timeliness issues or how OSHA plans to reinstitute its performance measures. OSHA also collects some program data, but it does not currently use the data to track timeliness or analyze trends. For example, in response to one of the recommendations included in a 2005 report by Labor’s Office of Inspector General, OSHA developed a contact log so that the NRTL program could maintain a log of calls, e-mails, and related details. 42 However, the contact log was developed primarily to document that OSHA had responded to inquiries from NRTLs, not necessarily to track the amount of time it took OSHA to respond. In the fall of 2012, OSHA officials told us they began developing a more robust system to track timeliness data and to address inefficiencies identified through the data, but this initiative is in the early stages. OSHA does not have performance measures to assess the quality and timeliness of its accreditation process, although such measures have been adopted by most of the accreditation organizations we contacted. For example, one accreditation organization had target dates in place for each phase of its application process and tracked its performance in relation to the targets. Another accreditation organization with performance measures in place also had a corrective action system in place to review troubling data, identify the root cause of any problems, and implement solutions. This accreditation organization also measured customer satisfaction. 42 U.S. Department of Labor, Office of Inspector General, Office of Audit. Occupational Safety and Health Administration: OSHA Correctly Denied ED&D’s Incomplete NRTL Application, March 31, 2005. Report Number: 05-05-002-10-001. Page 30 GAO-13-88 Product Testing Laboratories The NRTL program provides an important mechanism for protecting Conclusions workers’ safety. However, if not addressed, the lengthy accreditation application processing and approval times resulting from the current scope of staff responsibilities and unclear guidance about the process will continue to have negative impacts on labs’ business operations and OSHA’s ability to conduct other oversight activities. Much has changed in the world of laboratory accreditation since the NRTL process was designed in 1988; for example, NIST issued guidance intended to reduce duplication and improve efficiency, in accordance with the National Technology Transfer and Advancement Act of 1995, and some federal agencies have used new approaches to accreditation to administer lab accreditation programs. This includes increasing use of new approaches for efficiently and effectively using resources and harnessing the expertise of other organizations, while retaining key oversight responsibilities within the federal government. While OSHA plans to take some actions to improve timeliness, it is too early to determine the extent of these actions and it is uncertain whether any incremental changes will be sufficient to fully address the program’s challenges. Without thinking strategically about the program as a whole, the agency may be missing opportunities to implement more comprehensive strategies for improving timeliness, such as modifying its program structure in a manner that better serves its mission and capitalizes on the expertise of agency staff and external resources. Even if some of these strategies require initial time investments, thinking strategically about the program’s structure can ultimately reap time savings and ensure that procedures and staff responsibilities are targeted in a way that optimizes the program’s effectiveness in addressing workplace safety. To improve the timeliness of the NRTL accreditation process, we Recommendation for recommend that the Secretary of Labor direct the Assistant Secretary for Executive Action Occupational Safety and Health to: Review the NRTL program’s structure and accreditation application procedures to identify and implement any alternatives that better align program design with resource levels and improve program timeliness while remaining consistent with the agency’s mission. This review should draw upon the expertise of NIST or other organizations that provide guidance on developing effective and efficient accreditation schemes. It should include: 1. Identifying and evaluating the risks, costs, and benefits of various structural approaches for making accreditation decisions in terms of Page 31 GAO-13-88 Product Testing Laboratories both timeliness and effectiveness in achieving OSHA’s mission. Approaches could include using an external accrediting organization to implement some or all of the lab accreditation duties, using contractors to support in-house portions of the accreditation process, or separating testing from certification accreditation activities. 2. Reviewing OSHA’s current regulations and procedures to identify areas where increased alignment with international standards on accreditation may result in time savings without impairing the agency’s mission to protect workers’ safety and health. This could include analyzing the risks, costs, and benefits to effectiveness involved in making any program modifications or changes to existing regulations. 3. Ensuring that all lab accreditation decisions are reviewed by an independent technical reviewer in order to better align the accreditation decision process with internal controls principles for separating key duties and international standards on making accreditation decisions. OSHA should evaluate options for achieving independent review based in part on their effects on process duration. 4. Improving overall program guidance and transparency to help prevent delays in the approval process. 5. Establishing program goals and performance measures, including timeliness goals for the approval of accreditation applications, and analyzing resulting performance measurement data to identify potential inefficiencies in the application process. We provided a draft of this report to Labor for its review and comment. Agency Comments Labor’s Assistant Secretary for OSHA provided written comments, which are reproduced in appendix II. Labor agreed with our recommendations and described its plans to implement them, citing a commitment to use the most efficient and effective strategies in the NRTL program. For example, Labor states that it is assessing the NRTL program against alternative approaches used by other testing laboratory accrediting organizations and that it is coordinating with outside agencies, including the National Institute of Standards and Technology, to seek ways in which the NRTL program can improve its processes. In response to our recommendation to improve program guidance and transparency, Labor stated that it plans to develop and issue policy guidance on NRTL program requirements to ensure the program is administered consistently, and it plans to actively engage NRTL stakeholders in the policy-development process. In addition, Labor intends to use performance measures for processing Page 32 GAO-13-88 Product Testing Laboratories applications and to explore the development of a web-based customer service site where NRTLs could check the status of their applications throughout the review process. We are sending copies of this report to the appropriate congressional committees and the Secretary of Labor. In addition, the report is available at no charge on GAO’s website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7215 or email@example.com. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III. Revae Moran Director, Education, Workforce, and Income Security Issues Page 33 GAO-13-88 Product Testing Laboratories Appendix I: Objectives, Scope, and Appendix I: Objectives, Scope, and Methodology Methodology This study’s objective was to answer the following questions about the Occupational Safety and Health Administration’s (OSHA) Nationally Recognized Testing Laboratory (NRTL) program: (1) How long does it take to make accreditation decisions and what are the key factors that affect timeliness? and (2) To what extent has OSHA adopted commonly used strategies for improving timeliness? To address these research questions, we used a variety of methods including: analysis of OSHA’s data on recently processed accreditation applications; reviews of relevant federal laws, regulations, and OSHA publications on the NRTL program; interviews with key program stakeholders including OSHA officials, eight NRTL program applicants, and other public and private organizations, including non-profits, that accredit safety labs for other programs or purposes; a review and synthesis of findings from various sources, including GAO reports, international standards, guidance on accreditation, and materials from other federal agencies to identify promising strategies for improving the timeliness of accreditation decisions; and interviews with officials from selected federal agencies about their accreditation processes and practices. To determine how long it took OSHA to approve accreditation applications between June 2007 and June 2012—as well as how many applications were pending during that time— we analyzed Federal Register notices and information from an internal OSHA database that included key application dates, such as application submission and final accreditation decision dates. We analyzed timing data on all initial, expansion, and renewal decisions that were approved between June 11, 2007 and June 11, 2012. We also reviewed timing information for all applications that are currently pending. We selected this date range to ensure that our analysis included decisions for each of the three types of applications, reflected OSHA’s most recent time frames and processes, and included decisions made under two administrations. After interviewing OSHA officials and comparing Federal Register notices that identify key application dates for approved applications to separately generated data from OSHA’s internal database, we determined that the data on application submission dates and final decision dates were sufficiently reliable for our purposes. Our analysis focused primarily on application submission dates and final decision dates because the available data in OSHA’s database for intermediary stages of the review process were less reliable. Page 34 GAO-13-88 Product Testing Laboratories Appendix I: Objectives, Scope, and Methodology We used the following criteria to assess the length of OSHA’s accreditation process: • for completed applications, duration of the accreditation application and approval process relative to duration of the accreditation itself (5 years); • for pending applications, existence and duration of application backlogs; • stakeholders’ views; and • OSHA’s view on desirable time frames for accreditation reviews. To gather more information about the amount of time that initial applications were with applicants for revisions versus with OSHA during the accreditation review, we also reviewed the application files for the three initial applications processed by OSHA between June 2007 and June 2012. Two of these applications were approved by OSHA and one was withdrawn by the applicant after the initial review and revision stages of the process. To further understand the accreditation process and factors that might affect its timing, we interviewed OSHA officials and reviewed relevant federal laws, regulations, and NRTL program documents. We also interviewed eight NRTL applicants who represented a mix of initial, expansion, and/or renewal accreditation applications that have been pending, approved, or otherwise closed since June 2007. We selected labs so that our review would include the perspectives of applicants at different points in the decision-making process and with a variety of initial, expansion, and renewal applications. We also chose labs that represented a variety of sizes, as measured by the number of approved NRTL testing sites. In addition, we interviewed other stakeholders including a manufacturing organization and an employer organization to obtain information about any effects the duration of the NRTL accreditation process may have had on these sectors. To identify promising practices for improving timeliness, we reviewed and synthesized findings from relevant GAO reports, 1 international standards 1 See, for example, GAO, Streamlining Government: Opportunities Exist to Strengthen OMB’s Approach to Improving Efficiency, GAO-10-394 (Washington, D.C.: May 7, 2010) and GAO, Strategic Budgeting: Risk Management Principles Can Help DHS Allocate Resources to Highest Priorities, GAO-05-824T (Washington, D.C.: June 29, 2005). Page 35 GAO-13-88 Product Testing Laboratories Appendix I: Objectives, Scope, and Methodology and guidance on accreditation, 2 and materials from federal organizations such as the Office of Management and Budget, 3 the National Institute of Standards and Technology (NIST), 4 and the National Research Council. 5 We identified these sources through literature searches and discussions with stakeholders and individuals who are knowledgeable about management practices that could improve timeliness. We compared the strategies we identified with OSHA’s current and planned actions to improve timeliness, as identified through interviews and relevant documentation. We also identified promising practices for improving the timeliness of the NRTL accreditation process by soliciting suggestions from the eight NRTL applicants that we interviewed. We also interviewed officials and reviewed relevant documents from seven public and private accreditation programs and organizations, including non-profit organizations, as well as two consortiums of accreditation organizations, to identify promising timeliness practices used by others. No other accreditation process is completely comparable to OSHA’s given differences in scope or mission. However, the experiences of other programs and organizations provide illustrative examples of actions that agencies have taken to adapt to their own unique missions and circumstances. After compiling an extensive list of accreditation programs and organizations, we ultimately selected organizations to review in more detail based on the following: recommendations from NRTL program stakeholders, those programs we identified as using one or more of the promising strategies for improving timeliness included in our report, or those programs that are similar to OSHA’s program in terms of mission or scope. We interviewed officials from four federal agencies with lab accreditation programs: the Consumer Product Safety Commission Conformity Assessment Body Recognition 2 See, for example, International Standard, ISO/IEC 17011: Conformity assessment – General requirements for accreditation organizations accrediting conformity assessment organizations, ISO 2004. 3 Office of Management and Budget Circular A-119: Federal Participation in the Development and Use of Voluntary Consensus Standards and in Conformity Assessment Activities, 63 Fed. Reg. 8546 (Feb. 19, 1998). 4 NIST’s Guidance on Federal Conformity Assessment Activities, 65 Fed. Reg. 48,894 (Aug. 10, 2000), codified at 15 C.F.R. pt. 287. 5 st See, for example, Standards, Conformity Assessment, and Trade: Into the 21 Century, National Research Council, National Academy Press (Washington, D.C.: 1995). Page 36 GAO-13-88 Product Testing Laboratories Appendix I: Objectives, Scope, and Methodology Program; the Federal Communications Commission Equipment Authorization Program; the Department of Health and Human Services Health Information Technology Certification Program; and the NIST National Voluntary Laboratory Accreditation Program. In addition to speaking with officials from these four federal accreditation programs, we also interviewed representatives from three accreditation organizations outside the U.S. federal government: the American Association for Laboratory Accreditation, Standards Council of Canada, and the American National Standards Institute. Finally, we spoke with representatives from two consortiums of accreditation organizations: the International Laboratory Accreditation Cooperation and the National Cooperation for Laboratory Accreditation. Page 37 GAO-13-88 Product Testing Laboratories Appendix II: Comments from the Department Appendix II: Comments from the Department of Labor of Labor Page 38 GAO-13-88 Product Testing Laboratories Appendix II: Comments from the Department of Labor Page 39 GAO-13-88 Product Testing Laboratories Appendix III: GAO Contact and Staff Appendix III: GAO Contact and Staff Acknowledgments Acknowledgments Revae Moran, Director, (202) 512-7215 or firstname.lastname@example.org GAO Contact In addition to the contact named above, Betty Ward-Zukerman, Assistant Staff Director; Elizabeth Dobrenz, Meredith Moore, Maria Stattel, and Barbara Acknowledgments Steel-Lowney made significant contributions to all phases of the work. Also contributing to this report were James Bennett, Sarah Cornetto, Elizabeth Curda, Debra Johnson, Kathy Leslie, Jean McSween, Cathy Roark, Daren Sweeney, and Kate van Gelder. (131167) Page 40 GAO-13-88 Product Testing Laboratories The Government Accountability Office, the audit, evaluation, and GAO’s Mission investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no Obtaining Copies of cost is through GAO’s website (http://www.gao.gov). Each weekday GAO Reports and afternoon, GAO posts on its website newly released reports, testimony, and correspondence. To have GAO e-mail you a list of newly posted Testimony products, go to http://www.gao.gov and select “E-mail Updates.” Order by Phone The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, http://www.gao.gov/ordering.htm. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. Connect with GAO on Facebook, Flickr, Twitter, and YouTube. Connect with GAO Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. Visit GAO on the web at www.gao.gov. Contact: To Report Fraud, Website: http://www.gao.gov/fraudnet/fraudnet.htm Waste, and Abuse in E-mail: email@example.com Federal Programs Automated answering system: (800) 424-5454 or (202) 512-7470 Katherine Siggerud, Managing Director, firstname.lastname@example.org, (202) 512- Congressional 4400, U.S. Government Accountability Office, 441 G Street NW, Room Relations 7125, Washington, DC 20548 Chuck Young, Managing Director, email@example.com, (202) 512-4800 Public Affairs U.S. Government Accountability Office, 441 G Street NW, Room 7149 Washington, DC 20548 Please Print on Recycled Paper.
Product Safety Laboratories: OSHA's Accreditation Process Needs Reexamination
Published by the Government Accountability Office on 2012-12-11.
Below is a raw (and likely hideous) rendition of the original report. (PDF)