GAO sets three-goal oversight plan for cyber, infrastructure and AI through 2032

Acting U.S. Comptroller General Orice Williams Brown wrote GAO’s Strategic Plan 2027-2032, a roadmap that sets congressional oversight priorities for federal cyber defenses, critical infrastructure and emerging technology risks through 2032.

Brown said the old plan organized work into four goals, but the new plan uses three. The plan is titled ‘Strategic Plan 2027-2032’. The three goals consist of delivering independent analysis to Congress, improving government performance and accountability, and building GAO’s institutional capacity. The first two address oversight and foresight for congressional clients, while the third addresses internal operations, efficiency, skills, technology, human capital and resources.

The plan organizes GAO work under three goals instead of four, and annual progress will be tracked through the Performance and Accountability Report.

Goal 1 reviews whether federal programs and policies accomplish their intended purposes, spanning health and safety, science and technology, AI and cybersecurity. Within that goal, GAO will examine federal cybersecurity efforts such as creating a national strategy, securing federal systems, protecting critical infrastructure and preserving privacy of sensitive data. It will also review federal information technology acquisition, management and strategic planning, covering portfolio oversight, development practices, emerging technology adoption and technical workforce capacity. The goal extends to civilian space program management and execution, homeland protection including border security, terrorism prevention, transportation security, critical infrastructure protection, emergency preparedness and disaster assistance, military readiness including workforce, weapons acquisitions, logistics, the defense industrial base and nuclear forces, intelligence community oversight covering management, workforce and support for military, diplomatic and national security operations, and readiness for emerging domains such as space and cyber operations.

GAO will review risks related to artificial intelligence, such as adversarial use, autonomous systems and the integrity of AI-enabled decision-making. It will evaluate the national security implications of AI, including those same risk areas, and review how AI is used and overseen, including risks, international competitiveness and the effectiveness of AI policy and regulatory frameworks. GAO pointed to persistent cybersecurity threats, evolving national security risks and AI advances as challenges that shape federal policy and operations.

GAO oversight will assist Congress in evaluating federal cybersecurity efforts, securing government systems, protecting critical infrastructure and safeguarding sensitive data. The plan highlights rising cybersecurity challenges for energy and water systems, citing evolving threats, aging infrastructure and growing demand. GAO intends to evaluate federal protection of critical infrastructure, emergency preparedness and resilience, plus the effectiveness of government science, technology and cybersecurity programs. It will evaluate federal cybersecurity efforts and examine federal information technology acquisitions, and GAO wants Congress to monitor federal efforts to protect national security against cyber attacks and other threats.

GAO will continue conducting in-depth audits, program evaluations and policy analyses while modernizing products, services and processes to provide Congress with timely, actionable analysis. It will expand its use of data analytics, artificial intelligence and emerging technologies to strengthen oversight and give Congress timely, evidence-based analysis. GAO will encourage government-wide adoption of technology and analytics, including artificial intelligence, to bolster support for Congress. The Innovation Lab will securely develop and test new methods to improve audit and business processes.

Goal 2 centers on protecting taxpayer dollars and improving government performance by tackling fraud, waste and abuse. Old management structures, fragmentation, skills gaps and inconsistent technology use make government less efficient. Improper payments, high-risk program weaknesses and gaps in internal controls cost taxpayers tens of billions annually. GAO will identify high-risk programs and opportunities to reduce fragmentation, overlap and duplication across federal operations.

GAO’s FraudNet, an online reporting channel, will accept and process allegations of fraud, waste and abuse from the public, government employees and contractors. GAO will update and release Yellow Book government audit standards along with Green Book federal internal control standards, both sets of guidelines for financial accountability. It will manage federal bid protests and issue legal decisions on appropriations matters.

Goal 3 focuses on building GAO capacity to be nimble, innovative and effective through workforce strengthening, operational modernization and use of emerging technology. GAO will accelerate hiring for technical positions such as data science, AI, cybersecurity and emerging technologies. It will provide enterprise-wide training to build analytical, cybersecurity and artificial intelligence skills. GAO says it must remain agile as congressional needs and priorities change and federal agencies reimagine how they deliver missions using emerging technology.

Jennifer Franks, who leads GAO’s Center for Enhanced Cybersecurity, said the office needs to build skills and flexibility to respond to artificial intelligence-related threats. She said ongoing investment in staff and resources will allow GAO to sustain its oversight mission and safeguard audit evidence. GAO has seen heavy departures from its IT unit, a development Franks acknowledged at a March event.

Brown said that over the next five years GAO will assist Congress in addressing national debt, fraud, waste and abuse, cyber attack security and rising health care costs, and she said GAO will also look ahead to emerging science and technology trends, opportunities and risks including AI. GAO also wants Congress to anticipate emerging science and technology trends, opportunities and risks including AI. Brown said Congress requires answers promptly and that the plan positions GAO to provide them. GAO predicts that new technology will reshape jobs and employment.

Digital systems create and use enormous volumes of data, raising policy questions about responsible use, privacy and security. Advances in technology and science, increasingly driven by AI, will keep affecting every policy area. GAO will monitor emerging technology adoption and the results of federal science and technology investment.

The plan calls attention to how federal agencies are adjusting to AI, quantum computing and other emerging technologies. The emphasis on AI, cybersecurity and federal IT acquisition lines up with civilian modernization efforts including the General Services Administration’s OneGov strategy, a unified digital portal initiative.

GAO sent 17 recommendations to nine agencies about major IT investment risk ratings posted on the Federal IT Dashboard. GAO determined that 24 of 53 investments reviewed posed greater risk than their chief information officer ratings suggested.

GAO determined in September 2025 that the Department of Homeland Security would probably not achieve all $10.5 billion in expected savings from contract terminations in 2025. The Department of Homeland Security terminated 438 contracts and recorded roughly $92 million in net deobligations by March 2026. GAO provided 12 recommendations to the State Department, Veterans Affairs and the Small Business Administration in June to improve cloud security practices such as continuous monitoring and incident response.

GAO called on the Department of War to establish a Responsible AI Working Council. GAO pressed for staffing fixes in the Responsible AI Division of the Chief Digital and AI Office, where only three of 10 authorized positions were filled as of February 2026.