Companies have already turned the corner with their third year of “conflict minerals” filings to the Securities and Exchange Commission, but a newly released review of last year’s efforts by the Government Accountability Office may still be illuminating.

The GAO’s conclusion: the second-year filings show increases in companies’ information about their supply chains, but uncertainties remain regarding most of their sources of conflict minerals.

The SEC conflict minerals disclosure rule—a Dodd-Frank Act mandate intended to stem the trade of certain minerals that, mined in the Democratic Republic of the Congo and adjoining nations, support violent militia groups —details a process for companies to follow.

Companies are required to determine whether it manufactures (or contracts to have manufactured) products with “necessary” conflict minerals; conduct a reasonable country-of-origin inquiry (RCOI) concerning the origin of conflict minerals used; and exercise due diligence, if appropriate, to determine the source and chain of custody of conflict minerals used. Companies that disclose that their products are “DRC Conflict Free” are required to include documentation of an Independent Private Sector Audit (IPSA) in their disclosure.

The number of companies that filed conflict minerals disclosures in 2015 —the source of the GAO study—is about the same as in the first year, with a majority being domestic companies.

A higher estimated percentage of companies in 2015, compared to 2014, disclosed that they knew, or had reason to believe they knew, the source of the conflict minerals in their products as a result of performing an RCOI, which indicates that they have more information about their supply chains, the GAO says. However, after performing due diligence, a majority of the companies ultimately reported that they were unable to determine the country of origin of the conflict minerals in their products and whether or not such minerals benefited or financed armed groups in the covered countries.

The number of companies that filed conflict minerals disclosures in 2015 is 1,283, slightly lower than the 1,321 that filed in 2014. The GAO says that while not all companies reported the conflict minerals they used, of those that did, an estimated 55 percent reported using tin, 40 percent reported using tantalum, 37 percent reported using tungsten, and 48 percent reported using gold.

“Some filings and representatives of some companies we interviewed reported difficulties in getting sufficient information from all suppliers to enable them to determine the country of origin of all conflict minerals in their products,” the report says. “Some companies reported in their filings that they could not determine the country of origin of some of their conflict minerals because some suppliers did not respond to requests for information.” One company reported that it did not receive survey responses from 23 of its 38 suppliers. Others disclosed that they received information from suppliers that was incomplete, limiting their ability to determine the source and chain of custody of the covered minerals in their products.

“Despite some improvement in companies learning about the source of their conflict minerals by performing an RCOI, the difficulty expressed by companies in obtaining information from suppliers to facilitate a country-of-origin determination seems to reflect the dynamics of the conflict minerals supply chain,” the GAP wrote. “A company’s supply chain can involve multiple tiers of suppliers, potentially delaying a company’s request for information about upstream companies.”

For example, companies required to report under the rule could submit the inquiries to their first-tier suppliers. Those suppliers could either provide the reporting company with sufficient information or initiate the inquiry process up the supply chain by distributing the requests to suppliers at the next level, tier 2 suppliers. Tier 2 suppliers might then inquire up the supply chain to their suppliers (tier 3), and so on, with each tier adding time to the process.

Although a higher percentage of companies reported that they were able to make a determination about the country of origin based on their RCOI than in 2014, after conducting due diligence the majority were unable to confirm the origin of conflict minerals in their products or whether they financed or benefited armed groups, the report adds. Only an estimated 3 percent of companies that performed due diligence reported in 2015 that they were able to determine whether conflict minerals in some of their products financed or benefited armed groups.

The GAO report details actions companies have taken, or plan to take, to build upon or improve due diligence efforts. Among them:

Shifting operations or encouraging those in their supply chain to shift from current suppliers to suppliers who are certified as conflict-free;

Including language in new supplier contracts regarding the company’s expectations relating to conflict minerals;

Continuing follow-up with suppliers that have not replied to survey requests for information or when there are questions regarding supplier responses;

Providing training to suppliers on conflict minerals due diligence.

As it has done in the past, the GAO noted that the government, in particular the Department of Commerce, has struggled to meet its own responsibilities. That agency, it said, has produced lists of conflict minerals processing facilities, but has not developed plans to assess or advise audits of conflict minerals filings.

The Dodd-Frank Act required Commerce to submit an annual report starting in January 2013 that includes, among other things, its assessment of the accuracy of the IPSAs and other due diligence processes, and recommendations for the processes used to carry out such audits, including ways to improve the accuracy of the audits and establish standards of best practices.

“As of July 2016, Commerce had not submitted to Congress a report that includes an assessment of the accuracy of IPSAs and other due diligence efforts described by the Dodd-Frank Act conflict minerals provisions as well as recommendations for improving the accuracy of the IPSAs, as required by the [the legislation]—nor had it developed a plan for doing so,” the GAO wrote.