What GAO Found
The Department of State (State) conducts a range of activities to assess risks to residences overseas. For instance, State tracks information on overseas residences in its property database, establishes threat levels at overseas posts, develops security standards for different types of residences and threat levels, and requires posts to periodically conduct residential security surveys. However, 17 of the 68 surveys for residences GAO reviewed were untimely or missing. Without up-to-date security surveys of all its overseas residences, State's ability to identify and address vulnerabilities or make informed decisions about where to allocate resources for security upgrades is limited.

State has taken steps to update its residential security standards; however, these updates have not been timely, and the standards are difficult to use. According to State officials, updating residential security standards should take about 75 days, but all three updates since 2005 took more than 3 years each. State is making efforts to improve the timeliness of such updates in response to a prior GAO recommendation. In addition, while federal internal control standards state that policy standards should be clear and consistent to support good decision making, State's standards and other security-related guidance for residences have gaps and inconsistencies, complicating posts' efforts to determine and apply the appropriate security measures and potentially leaving some residences at risk.

State addresses security vulnerabilities at residences by installing various upgrades intended to help residences meet security standards, but 38 of the 68 residences GAO reviewed did not meet all applicable standards. For example, 8 residences did not meet the standards for perimeter barriers. When residences do not and cannot meet all applicable security standards, posts are required to request exceptions, which identify steps the posts will take to mitigate vulnerabilities. However, State had an exception on file for only 1 of the 38 residences that did not meet all applicable standards. As a result, State lacks key information that could provide it with a clearer picture of security vulnerabilities at residences and enable it to make better risk management decisions.

State manages risks to schools and other soft targets overseas in several ways, but its efforts may be constrained by limited awareness of relevant guidance and tools. In fiscal years 2010 through 2015, State awarded almost 400 grants in total for security upgrades at schools and other soft targets. While federal internal control standards call for timely communication of relevant information to staff responsible for program objectives, officials at most of the posts GAO visited were unaware of some guidance and tools for securing schools and other soft targets. As a result, State may not be fully leveraging existing programs and resources for addressing security needs at these facilities.

Why GAO Did This Study
Since the 1998 East Africa bombings, U.S. diplomatic personnel working overseas have faced increasing threats to their safety and security. State has built many new embassies and consulates since 1998 and enhanced security measures at others. Increased security at such facilities has raised concerns that residences, schools, and other places where U.S. diplomatic personnel and their families congregate may be viewed by terrorists as more attractive “soft targets.” GAO was asked to review the security of residences and other soft targets overseas. GAO evaluated (1) how State assesses risks to U.S. diplomatic residences overseas; (2) the timeliness, clarity, and consistency of residential security standards; (3) how State addresses security vulnerabilities at residences; and (4) how State manages risks to other soft targets. GAO reviewed agency documents; met with officials in Washington, D.C.; and conducted fieldwork at a judgmental sample of seven higher-threat, higher-risk posts in four of State's six geographic regions. This is the public version of a sensitive but unclassified report issued in June 2015.

What GAO Recommends
GAO recommends that State, among other things, institute procedures to ensure residential security surveys are completed as required, clarify its standards and security-related guidance for residences, develop procedures to ensure residences either meet standards or have exceptions on file, and take steps to ensure posts are aware of existing guidance and tools regarding the security of schools and other soft targets. State concurred with all of GAO's recommendations.