WASHINGTON — Three years after discovering that a military laboratory had shipped live anthrax to facilities around the world, the Department of Defense still has not developed a plan to evaluate its biological security practices, the federal Government Accountability Office reported on Thursday.

The department has implemented about half of the procedural changes that had been recommended, the G.A.O. said. But the Pentagon still has not established a way to measure the effectiveness of these reforms, making it difficult for experts to determine whether safety has improved.

“When it comes to reforming procedures, this is not a one-off thing that you can do once and take a vacation,” said Gigi Gronvall, a biosecurity expert at the Johns Hopkins Center for Health Security.

“We must be careful that the evaluations and procedures intended to increase safety actually do that,” she added.