Good customer experience isn’t just good. For federal agencies, it’s the law

Tom Temin I guess you are statutorily required to check on agencies and how they’re doing in this digital experience, correct?

Carol Harris That’s correct. So the Idea Act was passed in 2018. And as you mentioned, I mean that the purpose of the act is to improve government websites and its related services to enhance that customer experience. So the Act itself includes eight modernization requirements for these websites and services that agencies must follow. And so those include websites being searchable, encrypted. They also want these websites to be designed around user needs, using data, and also be mobile friendly, for example. And so as part of the act, agencies must submit five annual reports to both Congress and [the Office of Management and Budget]. So that’s one report per year between 2019 and 2023. And in those reports, agencies are required to report on their progress towards implementing those eight requirements for modernization. And so that’s the purpose of the report that we put out just recently in how agencies are doing relative to implementing the Act.

Tom Temin And how did they do relative to, say, the year before?

Carol Harris Well, the thing is, the reports varied in both content and in detail. And also, there were a lot of missing reports. So we were unable to give an assessment overall, unfortunately. But I’ll give you some details of what we did find. So the 24 CFO Act agencies submitted about 70% of the 120 total required annual reports. So those were about 84 in total. And when you break it down by agency, ten submitted all five reports. And then on the other side of the spectrum, you had four agencies submitting one or less. And then, as I mentioned, reports had varying levels of content and detail. So, for example, 18 agencies that submitted a report in 2023, only seven addressed all eight requirements. [Environmental Protection Agency and Department of Homeland Security] reports, for example, were definitely the best in show, both in terms of being comprehensive and very detailed across all eight requirements. But I will say that, for the other reports that either were missing content or just were very thin on content, that does not necessarily translate into a lack of compliance with the law.

Tom Temin Right. That’s the big question. Reporting is one thing; actually fixing your website so that they are compliant with what the law requires, that’s something else. So it’s possible to have great reports, but crummy websites and vice versa.

Carol Harris That’s exactly right. So [the General Services Administration], for instance, they didn’t mention meeting the encryption requirement in its reports because it had actually already met that requirement before [the IDEA Act] was even passed in 2018. And then [the Agriculture Department] didn’t submit any of its annual reports yet. The department did tell us that it had met or is working to meet the eight requirements through its internal web modernization initiative, which they started in April of 2020. And so, we had to dig into why is that the case? Well, agencies were lacking instruction from OMB. And also the IDEA Act itself is silent on what should be contained in these reports, as well as how agencies should be complying with these modernization requirements. So 50% of the agencies that did not submit reports in 2023, they told us that they needed more instruction from OMB.

Tom Temin That sounds a little bit like a cop out, though. ‘We need instructions from OMB before we can tell you our progress on these eight criteria which are in the law.’ Or am I being a little cynical?

Carol Harris I mean, that’s certainly the case. But the goal is to get an assessment across the government. So there is information that needs to be standardized in terms of the collection as well as the other report format and the level of detail so that as GAO or even OMB, we can weigh in in terms of taking the pulse of how the agencies collectively are doing. And so OMB did issue since the passage of the Idea Act a memo back in 2023 that came with some clarifying instructions. But unfortunately, that memo was issued in September and it had minimal effect on the annual report, which was due in December, only three months. Now, that’s probably why the agencies didn’t have a bump in terms of their 2023 report as far as the improvement in the quality and the content.

Tom Temin We’re speaking with Carol Harris. She’s director of Information Technology Acquisition Management at the GAO. And then one little detail I caught here in the report, and I’ll just quote it: “The Department of Treasury was the agency that discussed progress against the consistent requirements at the component level.” And that seems kind of crucial since, for any large department, it is the component, the major component website, where the action really happens very often.

Carol Harris That’s right. That’s right. And so having that clarity in the level of reporting and also whether it’s at the enterprise level, the department or at the component level is really important so that we get that sense of what’s going on. Because certainly you have these agencies like Department of Commerce that have critical components within them, like [the National Oceanographic and Atmospheric Administration and] the Census Bureau, for example. And we want to know how those agencies are doing or those components are doing, for sure.

Tom Temin I’m thinking of DHS, where if you want to get a trusted traveler type of card, you either have to go to [the Transportation Security Administration], or for global entry, you have to go to [Customs and Border Protection].  And that’s where people actually transact and not at dhs.gov, necessarily.

Carol Harris That’s right. Exactly. And the same can be said with the Department of State’s Bureau of Consular Affairs when you want to get a passport, or the Fish and Wildlife Service under [the Interior Department] when you’re going to these national parks. So absolutely we want to get that level of detail within the components. So OMB’s guidance that was issued in September of 2023, it is pretty good in terms of clarifying the compliance with these modernization requirements. It describes a number of actions that agencies should be performing. And so this is one of the reasons why we didn’t issue any recommendations because, number one, the sunset on these reports have already come to pass. But I think continued oversight over this guidance that OMB has issued will likely enable us as well as OMB the ability to assess the extent of progress towards delivering better digital services to the public.

Tom Temin And would it also be fair to say, and this is not strictly what you reported on, but at this stage in history, any large organization that is deploying a website is likely to have the kind of expertise behind it such that it’s trying to get best practices for any website, commercial or government?

Carol Harris Yes, for sure. OMB has its own customer experience team, which is part of a broad network of teams across the government. And so just as an example, with all of the things happening in the Carolinas and in Florida right now with the hurricanes, FEMA worked closely with OMB’s team, for example, to ensure that its delivery of the disaster assistance registration information was in line with government best practices. And FEMA also, they use Login.gov as part of that disaster assistance website to provide that secure multifactor authentication. So that’s an example of where you see that collaboration across government, to ensure that the public has a good experience online.