Contrary to its plans, EPA upgraded some less critical facilities prior to its most important facilities (including EPA headquarters). EPA stated it was more efficient to upgrade facilities based on geographic location rather than importance, but provided no quantitative data to support that position. In addition, EPA indicated it did not want to make mistakes upgrading headquarters buildings so it upgraded others first. As a result, some lower valued facilities required a higher level of authentication for access than EPA headquarters facilities. The processes used to gain access are inconsistent and not yet inter-operable (can be used by all federal employees including those outside EPA) or intra-operable (can be used by any EPA employee). This occurred because EPA had not developed national physical access procedures to foster consistency. As a result, EPA is not realizing potential benefits associated with a standardized process. EPA did not document assurance of cost reasonableness for some of the physical access control system contracts. EPA had spent over $12.8 million upgrading physical access control systems and could not assure that $3.8 million of that amount (30 percent) was spent in the most efficient and effective manner. EPA planned to award an additional $10.6 million to upgrade its systems.