A federal employee who reports fraud is protected by statute from being demoted or fired for it. The protection is only as real as the process that enforces it, and the process has a clock.
The finding
OIG took over 3 years to investigate the majority (39 of 73) of the cases it opened and closed in fiscal years 2018 through 2025.
Then, after an investigation substantiates a complaint, the decision about what to do belongs to the Secretary of Homeland Security — expected within 30 days. In GAO's Fast Facts: "cases awaited decisions for another 4 months to over 2 years."
So the outer bound on a substantiated case is roughly five years of investigation plus two more waiting for a decision.
What DHS said, and what GAO answered
OIG officials told GAO "that case complexity and limited staff affected some case time frames, and that they have focused more on investigation quality and thoroughness than timeliness."
That is a real trade-off, and GAO does not dispute it. Its finding is about something else — whether anyone has ever defined the trade:
While OIG policy requires timely review of whistleblower retaliation complaints, OIG has not defined this objective in specific, measurable terms; evaluated timeliness; or implemented other mechanisms to help enhance accountability and ensure more timely investigations.
A policy that requires timeliness without saying what timely is cannot be complied with or breached. It is not a standard; it is a sentiment.
Why it matters beyond the 73
GAO names the second-order cost directly: retaliation "can damage careers and have a chilling effect on others' willingness to report wrongdoing."
The people counted in this report already filed. The ones who matter most to the finding are the ones who watched a colleague wait three years and decided not to.

