GAO says federal building standards have evolved, risk management has not