Strategic Budgeting
Risk Management Principles Can Help DHS Allocate Resources to Highest Priorities Gao ID: GAO-05-824T June 29, 2005Previous GAO work has outlined the nation's growing fiscal imbalance and called for a fundamental reexamination of the base of the federal government. The significant resources directed to the Department of Homeland Security (DHS) indicate that a robust homeland security program is viewed as critical to the protection and prosperity of Americans. This testimony addresses the need for a fundamental reexamination of the base of government, the role that performance budgeting tools can play in helping inform agency activities, and DHS's use of performance budgeting and risk management concepts. It also includes examples from GAO work on homeland security issues that highlight DHS attempts to define an acceptable and achievable level of risk.
The nation faces a long-term fiscal imbalance, and the role of the federal government is being reshaped by many forces, such as evolving defense and homeland security policies and new organizational and institutional arrangements for carrying out public activities. Given these circumstances, there is a critical need for the federal government to reexamine the base of its programs, policies, functions, and activities. A periodic reexamination of major federal spending and tax policies offers the prospect for the American government to eliminate outmoded operations and better align its operations with the demands of a changing world. The management and performance reforms enacted by Congress in the past 15 years have provided new tools to support this kind of reexamination. However, these new tools must be implemented by agencies and used by the Congress in its decision making in order to be effective. Performance budgeting can help policymakers address important questions about whether and how programs contribute to their stated goals. It can help enhance the government's capacity to assess competing claims for federal dollars by arming decision makers with better information on the results of individual programs, as well as on various federal policies and programs addressing common goals. Performance budgeting, however, cannot provide answers to every resource question--particularly where allocation is a function of competing values and interests that depend on factors other than program performance. Congress and the President have agreed on DHS's mission, and DHS has established strategic objectives for achieving its mission. However, DHS's strategic plan does not detail the associated resources necessary to carry out its mission and achieve its strategic goals. DHS has called for using risk-based approaches to prioritize its resource investments regarding critical infrastructure, and for developing plans and allocating resources in a way that balance security and freedom. It must carefully weigh the benefit of homeland security endeavors and allocate resources where the benefit of reducing risk is worth the additional cost. A comprehensive risk management framework--which includes an assessment of risk through threat, vulnerability, and criticality assessments--should be applied to guide these decisions. DHS has not completed a comprehensive national threat and risk assessment. However, some components of DHS have taken initial steps to apply elements of risk management to its operations and decision making. For example, the Coast Guard has taken actions to assess and mitigate vulnerabilities in order to enhance maritime security, and the Transportation Security Administration has conducted vulnerability assessments at selected general aviation airports. Congress and agencies have a shared responsibility for ensuring that performance budgeting and risk management approaches are both useful and used.
GAO-05-824T, Strategic Budgeting: Risk Management Principles Can Help DHS Allocate Resources to Highest Priorities
This is the accessible text file for GAO report number GAO-05-824T
entitled 'Strategic Budgeting: Risk Management Principles Can Help DHS
Allocate Resources To Highest Priorities' which was released on June
30, 2005.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility.
Every attempt has been made to maintain the structural and data
integrity of the original printed product. Accessibility features, such
as text descriptions of tables, consecutively numbered footnotes placed
at the end of the file, and the text of agency comment letters, are
provided but may not exactly duplicate the presentation or format of
the printed version. The portable document format (PDF) file is an
exact electronic replica of the printed version. We welcome your
feedback. Please E-mail your comments regarding the contents or
accessibility features of this document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Testimony:
Before the Subcommittee on Management, Integration, and Oversight,
Committee on Homeland Security, House of Representatives:
United States Government Accountability Office:
GAO:
For Release on Delivery Expected at 3:00 p.m. EST:
Wednesday, June 29, 2005:
Strategic Budgeting:
Risk Management Principles Can Help DHS Allocate Resources To Highest
Priorities:
Statement of David M. Walker:
Comptroller General of the United States:
GAO-05-824T:
GAO Highlights:
Highlights of GAO-05-824T, a testimony before the Subcommittee on
Management, Integration, and Oversight, House Committee on Homeland
Security:
Why GAO Did This Study:
Previous GAO work has outlined the nation‘s growing fiscal imbalance
and called for a fundamental reexamination of the base of the federal
government. The significant resources directed to the Department of
Homeland Security (DHS) indicate that a robust homeland security
program is viewed as critical to the protection and prosperity of
Americans. This testimony addresses the need for a fundamental
reexamination of the base of government, the role that performance
budgeting tools can play in helping inform agency activities, and DHS‘s
use of performance budgeting and risk management concepts. It also
includes examples from GAO work on homeland security issues that
highlight DHS attempts to define an acceptable and achievable level of
risk.
What GAO Found:
The nation faces a long-term fiscal imbalance, and the role of the
federal government is being reshaped by many forces, such as evolving
defense and homeland security policies and new organizational and
institutional arrangements for carrying out public activities. Given
these circumstances, there is a critical need for the federal
government to reexamine the base of its programs, policies, functions,
and activities. A periodic reexamination of major federal spending and
tax policies offers the prospect for the American government to
eliminate outmoded operations and better align its operations with the
demands of a changing world. The management and performance reforms
enacted by Congress in the past 15 years have provided new tools to
support this kind of reexamination. However, these new tools must be
implemented by agencies and used by the Congress in its decision making
in order to be effective.
Performance budgeting can help policymakers address important questions
about whether and how programs contribute to their stated goals. It can
help enhance the government‘s capacity to assess competing claims for
federal dollars by arming decision makers with better information on
the results of individual programs, as well as on various federal
policies and programs addressing common goals. Performance budgeting,
however, cannot provide answers to every resource question”particularly
where allocation is a function of competing values and interests that
depend on factors other than program performance.
Congress and the President have agreed on DHS‘s mission, and DHS has
established strategic objectives for achieving its mission. However,
DHS‘s strategic plan does not detail the associated resources necessary
to carry out its mission and achieve its strategic goals. DHS has
called for using risk-based approaches to prioritize its resource
investments regarding critical infrastructure, and for developing plans
and allocating resources in a way that balance security and freedom. It
must carefully weigh the benefit of homeland security endeavors and
allocate resources where the benefit of reducing risk is worth the
additional cost. A comprehensive risk management framework”which
includes an assessment of risk through threat, vulnerability, and
criticality assessments”should be applied to guide these decisions. DHS
has not completed a comprehensive national threat and risk assessment.
However, some components of DHS have taken initial steps to apply
elements of risk management to its operations and decision making. For
example, the Coast Guard has taken actions to assess and mitigate
vulnerabilities in order to enhance maritime security, and the
Transportation Security Administration has conducted vulnerability
assessments at selected general aviation airports. Congress and
agencies have a shared responsibility for ensuring that performance
budgeting and risk management approaches are both useful and used.
www.gao.gov/cgi-bin/getrpt?GAO-05-824T.
To view the full product, including the scope and methodology, click on
the link above. For more information, contact Norman Rabkin at (202)
512-8777 or rabkinn@gao.gov.
[End of section]
Mr. Chairman and Members of the Subcommittee:
I am pleased to be here today to discuss how the Department of Homeland
Security (DHS) can use performance budgeting and risk management
principles to maximize program performance in an environment of
increasing fiscal constraints.[Footnote 1]
Today I will touch on the need for a fundamental reexamination of the
base of government, given our current, imprudent, and unsustainable
fiscal path. Then I will turn to and discuss the important role that
performance budgeting and risk management principles can play in
setting priorities for the department's homeland security activities.
Finally, I will draw upon our work in DHS on homeland security issues
to highlight examples of where the department has attempted to define
an acceptable and achievable level of risk.
The significant resources directed to homeland security and to DHS in
particular indicate that a robust homeland security program is viewed
as critical to the nation's protection and prosperity. It is clear that
before the events of September 11, 2001, it was difficult to anticipate
the array of new and challenging demands on federal programs, and to
envision the claims on future budgets for homeland security concerns.
Given current trends and challenges facing the nation--including the
long-term fiscal imbalance--it is critical that the federal government
reexamine the base of federal spending and tax programs, at the same
time holding all programs accountable for spending wisely and achieving
real results.
By using performance budgeting tools and the priorities outlined in the
National Strategy for Homeland Security, the department will be in a
better position to respond to changing circumstances. The Government
Performance and Results Act of 1993 (GPRA)[Footnote 2] and various
assessment efforts, such as the Administration's Program Assessment
Rating Tool (PART), can provide a foundation for a baseline review of
existing policies, programs, functions, and activities in the
department. In addition, they have the potential to help decision
makers assess competing claims by providing better information on the
results of individual programs, and on policies and programs designed
to address common goals.
Just as we know that the threat of terrorism will persist well into the
21st century, we also know it is unrealistic to expect future funding
increases for homeland security efforts to occur at the same rate as in
the recent past. Given the reality that no amount of money can make us
completely safe from a terrorist attack, the National Strategy for
Homeland Security provides guidance for considering how to make the
best use of available funds to mitigate the most serious risks, while
also assuring that the reduction in risk is worth the amount of
additional cost. Since we cannot afford to protect everything against
all threats, GAO has advocated that DHS make clear the link between the
choices made about protection priorities and the allocation of
available resources. Proposals to reduce risk must be evaluated on
numerous dimensions - their dollar cost and their impact on other goals
and values. Decisions on the level of resources, the allocation of
those resources, and how to balance security against other societal
goals and values also need to be considered.
Our recent work at DHS suggests that developing and using a risk-based
approach for making resource investment decisions will not be easy.
Decision makers may not have complete or current information on
threats, vulnerabilities, consequences, alternatives, and costs.
Nevertheless, we see benefits in continuing to develop the approach,
and are prepared to work with the department and others in the
Administration to make it happen.
This testimony is based on our wide-ranging work on GPRA, federal
budget and performance integration, and 21st century challenges; as
well as our work on homeland security and risk management. We conducted
our work in accordance with generally accepted government auditing
standards.
The Long-Term Fiscal Challenge Drives the Fiscal Future and the Need
for Reexamination:
Known demographic trends, rising health care costs, and lower federal
revenues as a percentage of the economy are the major drivers of the
nation's large and growing structural deficits. The nation cannot
ignore this fiscal large and growing fiscal imbalance--it is not a
matter of whether the nation deals with the fiscal gap, but how and
when. GAO's long-term budget simulations illustrate the magnitude of
this fiscal challenge. Figures 1 and 2 show these simulations under two
different sets of assumptions. Figure 1 uses the Congressional Budget
Office's (CBO) January 2005 baseline through 2015. As required by law,
that baseline assumes no changes in current law, that discretionary
spending grows with inflation through 2015, and that all tax cuts
currently scheduled to expire actually do expire. In Figure 2, two
assumptions about that first 10 years are changed: (1) discretionary
spending grows with the economy rather than with inflation, and (2) all
tax cuts currently scheduled to expire are made permanent. In both
simulations discretionary spending is assumed to grow with the economy
after 2015 and revenue is held constant as a share of gross domestic
product (GDP) at the 2015 level. Also in both simulations, long-term
Social Security and Medicare spending are based on the 2005 trustees'
intermediate projections, and we assume that benefits continue to be
paid in full after the trust funds are exhausted. Long-term Medicaid
spending is based on CBO's December 2003 long-term projections under
their midrange assumptions.
Figure 1: Composition of Spending as a Share of GDP Under Baseline
Extended:
[See PDF for image]
[End of figure]
Figure 2: Composition of Spending as a Share of GDP Assuming
Discretionary Spending Grows with GDP After 2005 and All Expiring Tax
Provisions are Extended:
[See PDF for image]
[End of figure]
As these simulations illustrate, absent policy changes on the spending
and/or revenue side of the budget, the growth in spending on federal
retirement and health entitlements will encumber an escalating share of
the government's resources. Indeed, when we assume that recent tax
reductions are made permanent and discretionary spending keeps pace
with the economy, our long-term simulations suggest that by 2040
federal revenues may be adequate to pay little more than interest on
the federal debt. Neither slowing the growth in discretionary spending
nor allowing the tax provisions to expire--nor both together--would
eliminate the imbalance. Although federal tax policies will likely be
part of any debate about our fiscal future, making no changes to Social
Security, Medicare, Medicaid, and other drivers of the long-term fiscal
gap would require at least a doubling of federal taxes in the future--
and that seems both unrealistic and inappropriate.
Demographic shifts and rising health care costs are not the only forces
at work that require the federal government to rethink its entire
approach to program performance, policy design, public priorities, and
management practices. Other important forces are working to reshape
American society, our place in the world, and the role of the federal
government. These include evolving defense and homeland security
policies, increasing global interdependence, and advances in science
and technology. In addition, the federal government increasingly relies
on new networks and partnerships to develop public policy and achieve
positive results, often including multiple federal agencies, domestic
and international non-or quasi-government organizations, for-profit and
not-for-profit contractors, and state and local governments.
If government is effectively to address these trends, it cannot treat
all of its existing programs, policies, and activities as givens.
Outmoded commitments and operations constitute an encumbrance on the
future that can and does erode the capacity of the nation to better
align its government with the needs and demands of a changing world and
society. Accordingly, reexamining the base of all major existing
federal spending and tax programs, policies, and activities by
reviewing their results and testing their continued relevance and
relative priority for our changing society is an important step in the
process of assuring fiscal responsibility and facilitating national
renewal.[Footnote 3]
A periodic reexamination offers the prospect of addressing emerging
needs by weeding out programs and policies that are redundant,
outdated, or ineffective. Those programs and policies that remain
relevant could be updated and modernized by improving their targeting
and efficiency through such actions as redesigning allocation and cost-
sharing provisions, consolidating facilities and programs, and
streamlining and reengineering operations and processes. The tax
policies and programs financing the federal budget can also be reviewed
with an eye toward both the overall level of revenues that should be
raised as well as the mix of taxes that are used.
Reexamining the base offers compelling opportunities to both redress
our current and projected fiscal imbalance while better positioning
government to meet the new challenges and opportunities of the 21st
century. In this regard, the management and performance reforms enacted
by Congress in the past 15 years have provided new tools to gain
insight into the financial, program, and management performance of
federal agencies and activities. The information being produced as a
result can provide a strong basis to support the much needed and long
overdue review, reassessment, and reprioritization process.
Performance Budgeting Holds Promise for Reassessment and Priority
Setting:
With GPRA as their centerpiece, these reforms also laid the foundation
for performance budgeting by establishing infrastructures in the
agencies to improve the supply of information on planning, performance
and costs. GPRA is designed to inform congressional and executive
decision making by providing objective performance and cost information
on the effectiveness and efficiency of federal programs and spending. A
key purpose of GPRA is to create closer and clearer links between the
process of allocating scarce resources and the expected results to be
achieved with those resources.[Footnote 4] Importantly, GPRA requires
both a connection to the structures used in congressional budget
presentations and consultation between the executive and legislative
branches on agency strategic plans.[Footnote 5] Because these
requirements are grounded in statute, Congress has an oversight stake
in GPRA's success. Over a decade after its enactment, GPRA has
succeeded in expanding the supply of performance information and
institutionalizing a culture of performance as well as providing a
solid foundation for more recent budget and performance
initiatives.[Footnote 6]
Building on GPRA, the current administration has made the integration
of performance and budget information one of five top governmentwide
management priorities. Under the President's Management Agenda (PMA),
agencies are expected to implement integrated financial and performance
management systems that routinely produce information that is (1)
timely--to measure and affect performance, (2) useful--to make more
informed operational and investing decisions, and (3) reliable--to
ensure consistent and comparable trend analysis over time and to
facilitate better performance measurement and decision making. It is
critical that budgetary investments in this area be viewed as part of a
broader initiative to improve the accountability and management
capacity of federal agencies and programs. Over the longer term,
failing to discover and correct performance problems will be much more
costly.
The Program Assessment and Rating Tool (PART) is a questionnaire that
is designed to provide a systematic approach to assessing the strengths
and weaknesses of a program. PART asks, for example, whether a
program's long-term goals are specific, ambitious, and focused on
outcomes, and whether annual goals demonstrate progress toward
achieving the long-term goals. It is intended to be evidence-based,
drawing on a wide array of information, including authorizing
legislation, GPRA strategic plans and performance plans and reports,
financial statements, inspector general and GAO reports, and
independent program evaluations.[Footnote 7] Importantly, PART can be
used to identify gaps in information. The fact that a program's PART
score suffers from the absence of information provides added impetus
for agencies to enhance their evaluation and information-gathering
capabilities.[Footnote 8]
PART's program-by-program approach fits with OMB's agency-by-agency
budget reviews, but it is not well suited to addressing crosscutting
issues or to looking at broad program areas in which several programs
address a common goal. It is often critical to understand how each
program fits with a broader portfolio of tools and strategies--such as
regulations, direct loans, and tax expenditures--to accomplish federal
missions and performance goals.
The credibility of performance information, including related cost
data, and the ability of federal agencies to produce credible
evaluations of their programs' effectiveness are key to the success of
performance budgeting. As I have testified before, this type of
information is critical for effective performance measurement to
support decisions in areas ranging from program efficiency and
effectiveness to sourcing and contract management.[Footnote 9] To be
effective, this information must be not only timely and reliable, but
also both useful and used.
Federal performance and accountability reforms have given much
attention to increasing the supply of performance information over the
past several decades. However, improving the supply of performance
information is in and of itself insufficient to achieve and sustain
results-based performance budgeting and management approaches. Rather,
it needs to be accompanied by a demand for and use of that information
by congressional decision makers and executive managers alike. The
history of performance budgeting suggests that congressional support
and use of this information is critical to sustain reforms over time.
Congress has a number of opportunities to provide its perspective on
performance issues and performance goals, such as when it establishes
or reauthorizes a new program, during the annual appropriations
process, and in its oversight of federal policies and programs.
Performance budgeting can do a great deal to help policy makers address
important questions, such as whether programs are contributing to their
stated goals, are well-coordinated with related initiatives at the
federal level or elsewhere, and are targeted to the intended
beneficiaries. However, it should not be expected to provide the
answers to all resource allocation questions in some automatic or
formula-driven process. Performance problems may well prompt budget
cuts, program consolidations, or eliminations. Alternatively, as in the
case of homeland security, programs that existed before September 11
may now be deemed to be of sufficiently high priority to the nation
that they inspire enhanced investments and reforms in program design
and management. Conversely, even a program that is found to be
exceeding its performance expectations can be a candidate for budgetary
cuts if it is a lower priority than other competing claims in the
process. The determination of priorities is a function of competing
values and interests that may be informed by performance information
but also reflects other factors, such as the overall budget situation,
the state of the economy, security needs, equity considerations, unmet
societal needs, and the appropriate role of the federal government in
addressing any such needs.
Planning and Risk Management Key to Overall Approach for Allocating
Homeland Security Resources:
As reflected in the Homeland Security Act of 2002[Footnote 10] (enacted
in November 2002) and the National Strategy for Homeland Security
(issued in July 2002), both Congress and the President have agreed that
DHS should be focused on preventing terrorist attacks, reducing the
country's vulnerability to terrorism, and minimizing the damage and
recovering from any attacks that may occur. The President's national
strategy also notes that the United States "must carefully weigh the
benefit of each homeland security endeavor and only allocate resources
where the benefit of reducing risk is worth the amount of additional
cost." It recognizes that the need for homeland security is not tied
solely to the current terrorist threat but to enduring vulnerability
from a range of potential threats that could include weapons of mass
destruction and bioterrorism.
Using the national strategy and the act as foundations, the department
issued its first departmentwide strategic plan in February 2004. The
strategic plan sets out the following strategic objectives for
achieving DHS's mission:
* Awareness--Identify and understand threats, assess vulnerabilities,
determine potential impacts, and disseminate timely information to our
homeland security partners and the American public.
* Prevention--Detect, deter, and mitigate threats to our homeland.
* Protection--Safeguard our people and their freedoms, and critical
infrastructure, property and the economy of our nation from acts of
terrorism, natural disasters, or other emergencies.
* Response--Lead, manage, and coordinate the national response to acts
of terrorism, natural disasters, or other emergencies.
* Recovery--Lead national, state, local, and private sector efforts to
restore services and rebuild communities after acts of terrorism,
natural disasters, or other emergencies.
* Service--Serve the public effectively by facilitating lawful trade,
travel and immigration.
* Organizational excellence--Value our most important resource, our
people. Create a culture that promotes a common identity, innovation,
mutual respect, accountability and teamwork to achieve efficiencies,
effectiveness, and operational synergies.
In a report earlier this year to the House Government Reform
Subcommittee on National Security, Emerging Threats and International
Relations, we pointed out that while DHS has made considerable progress
in its planning efforts, its strategic plan did not address the
relationship between annual and long-term goals.[Footnote 11] This
linkage is critical for determining whether DHS has a clear sense of
how it will assess progress toward achieving the intended results for
its long-term goals. In addition, the plan does not include specific
budgetary, human capital, or other resources needed to achieve the long-
term goals.
Although the strategic plan did not detail the resources DHS believes
it needs to carry out its mission and achieve its strategic goals, DHS
has presented some of this information as part of its annual budget
materials. Congress has required OMB to present a crosscutting
perspective on homeland security spending as part of the President's
Budget. The discussion of homeland security spending by strategic goal
across all federal agencies is an example of the impact that
congressional oversight can have on budget presentations and analysis.
As we have previously noted, the structure of appropriations accounts
and congressional justifications also reflects choices about how
resource allocation choices are framed and the types of controls and
incentives considered most important. Given Congress's role in setting
national priorities and allocating resources to achieve them,
Congressional comfort with the structure of and analyses in budget
justifications is critical. The department should work with its
congressional committees to assure that the information it provides is
useful to Congress in achieving its legislative, oversight,
appropriations, and control objectives.
Risk Management:
The national strategy and DHS's strategic plan called for the use of
risk-based decisions to prioritize DHS's resource investments regarding
homeland security related programs. In addition, Homeland Security
Presidential Directive/HSPD-7, issued in December 2003, charged DHS
with integrating the use of risk management into homeland security
activities related to the protection of critical infrastructure. The
directive called on the department to develop policies, guidelines,
criteria, and metrics for this effort. The new DHS Secretary testified
on June 9, 2005, to the need for managing risk at the homeland security
level by developing plans and allocating resources in a way that
balance security and freedom. He noted the importance of assessing the
full spectrum of threats and vulnerabilities, conducting risk
management, and setting realistic priorities in guiding decisions about
how to best organize to prevent, respond to, and recover from an
attack.
Armed with better planning and performance information, the department
needs to develop a more formal and disciplined approach to risk
management. Answering questions such as "What is an acceptable level of
risk to guide homeland security strategies and investments?" and "What
criteria should be used to target federal funding for homeland security
to maximize results and mitigate risk within available resource
levels?" will not be easy. Yet these kinds of questions may also
provide a window of opportunity to rethink approaches to long-standing
problems and concerns.
A risk management framework for making homeland security and
counterterrorism investment decisions consists of a number of
components. Assessing risk is a critical component of a risk management
approach, and it should be reflective of current and future likely
threats, which should be informed but not driven by past actions.
Assessing risk involves three key elements--threats, vulnerabilities,
and criticality (or consequences)--that provide input into the decision-
making process. A threat assessment identifies and evaluates potential
threats on the basis of factors such as capabilities, intentions, and
past activities. Threats might be present at the global, national, or
local level, and their sources include terrorists and criminal
enterprises. Threat information emanates from "open" sources and
intelligence (both strategic and tactical). However, we will never know
if we have identified every threat or event and may not have complete
information about the threats we have identified. Consequently, two
other elements of the approach, vulnerability and criticality
assessments, are essential to better prepare against threats. A
vulnerability assessment identifies weaknesses that may be exploited by
identified threats and suggests options to address those weaknesses. A
criticality assessment evaluates and prioritizes assets and functions
in terms of specific criteria, such as their importance to public
safety and the economy, as a basis for identifying which structures or
processes are relatively more important to protect from attack.
Information from these three assessments can lead to a risk
characterization, such as high, medium, or low, and provides input for
prioritizing security initiatives.[Footnote 12]
For example, an airport that is determined to be a critical asset,
vulnerable to attack, and a likely target would be at high risk and,
therefore, would be a higher priority for funding than an airport that
is less vulnerable to an attack. In this vein, aviation security
measures shown to reduce the risk to the most critical assets would
provide the greatest protection for the cost.
Figure 3 depicts a risk management cycle representing a series of
analytical and managerial steps, basically sequential, that can be used
to assess risk, assess alternatives for reducing risks, choose among
those alternatives, implement the alternatives, monitor their
implementation, and continually use new information to adjust and
revise the assessments and actions, as needed. Adoption of a risk
management framework such as this can aid in assessing risk by
determining which vulnerabilities should be addressed in what ways
within available resources.[Footnote 13]
Figure 3: Risk Management Framework:
[See PDF for image]
[End of figure]
In addition to being dynamic, the approach may be applied at various
organizational levels, from multiagency or sectoral down to individual
investments or projects. Some adaptation of the framework may be
expected--for instance, risk management choices available to site
managers may entail departmental or statutory constraints.
In our latest high-risk series, released in January 2005, we noted that
an area of increasing concern involves the need for the completion of
comprehensive national threat and risk assessments in a variety of
areas, including homeland security.[Footnote 14] As GAO reported in its
review of DHS's first strategic plan, stakeholder involvement was
limited. Stakeholder involvement in the planning process is important
to ensure that DHS's efforts and resources are aligned with other
federal and nonfederal partners with shared responsibilities for
homeland security and that they are targeted at the highest priorities.
At the same time, this threat/risk assessment concept can be applied to
a broad range of existing federal government programs, functions, and
activities.
A viable risk management approach would also affect outcomes beyond the
federal sector. The choice and design of policy tools, such as grants,
regulations, and tax incentives, can enhance the capacity of all levels
of government to target areas of highest risk and greatest need,
promote shared responsibilities by all parties, and track and assess
progress toward achieving national preparedness goals. For example, in
order to promote a stronger federal, state, local, and regional
partnership to improve homeland security, Congress needs to determine
how to concentrate federal grant funds in the places with the highest
risks. Given the significant needs and limited federal resources, it
will be important to target areas of greatest need. Congressional
proposals to alter the formula for allocating homeland security funds
to states reflect attention to this issue. We have noted that the
formula for federal grant distribution should be based on several
considerations, including relative threats and vulnerabilities faced by
states and communities as well as the state or local government's
capacity to respond to a disaster.[Footnote 15]
Some Elements of Risk Management Being Used at DHS:
Several DHS component agencies have taken some initial steps toward
risk management. For example, agencies such as the Coast Guard and
Customs and Border Protection (CBP) have taken actions to try to
mitigate vulnerabilities and enhance maritime security. Security plans
for seaports, facilities, and vessels have been developed based on
assessments that identify their vulnerabilities. In addition, the Coast
Guard is using a Port Security Risk Assessment Tool, which is designed
to prioritize risk according to a combination of possible threat,
consequence, and vulnerability. Under this approach, seaport
infrastructure that is determined to be both a critical asset and a
likely and vulnerable target would be a high priority for security
enhancements or funding. By comparison, infrastructure that is
vulnerable to attack but not as critical or infrastructure that is very
critical but already well protected would be lower in priority. We are
currently conducting a detailed review of the use of risk management
for maritime security.
In the transportation area, the Transportation Security Administration
(TSA) has conducted limited vulnerability assessments at selected
general aviation airports based on specific security concerns or
requests by airport officials. Agency officials told us that conducting
assessments was costly and, therefore, impractical to do for the 19,000
general aviation airports nationwide, or even the approximately 4,800
public-use general aviation airports. TSA intended to implement a risk
management approach to better assess threats and vulnerabilities of
general aviation aircraft and airports and, as part of this approach,
was developing an online vulnerability self-assessment tool to be
completed by individual airport managers. However, we noted limitations
to the use of the self-assessment tool, and TSA had not developed a
plan with specific milestones to implement the assessment, thereby
making it difficult to monitor the progress of its efforts. Also, TSA
had not conducted an overall systematic assessment of threats to, or
vulnerabilities of, general aviation to determine how to better prepare
against terrorist threats.
Immigration and Customs Enforcement's Office of Investigations (OI) has
taken some initial steps to base future budget requests on threat
assessments. To develop its budget request and workforce plans for
fiscal year 2007 and beyond, OI field offices conducted baseline threat
assessments on a regional basis using scenarios such as the presence of
a business that transports biological materials and may employ
terrorists. Related performance measures have been developed, but are
not yet in use.
CBP had taken some steps to address the risks posed by terrorist
smuggling of weapons in oceangoing cargo containers. Although CBP's
strategy incorporated some elements of risk management, we reported
that CBP had not performed a comprehensive set of threat, criticality,
vulnerability, and risk assessments that experts said are vital for
determining levels of risk for each container.[Footnote 16]
With respect to the allocation of homeland security funds to states,
approximately 40 percent of the $5.1 billion in statewide grant funds
awarded in fiscal years 2002 through 2005 were shared equally among the
50 states, the District of Columbia, the Commonwealth of Puerto Rico,
and U.S. territories. The remaining amount was distributed according to
state population. Therefore, this formula for allocating money is not
risk-based. Several congressional proposals have been advanced to alter
the statewide funding formula to base it more directly on risk
considerations. This seems to be both appropriate and necessary given
current and projected deficits. One proposal would largely maintain the
portion of funds shared equally by the states but would base the
distribution of the remaining funds on a risk-based formula similar to
the one currently used for urban area grants. Another proposal (from
this committee) would reduce the minimum amount of funding shared
equally by states to approximately 14 percent of total funding and
establish a board to allocate the remaining funds through an evaluation
of threat, vulnerability, and the potential consequences of a terrorist
attack.
Concluding observations:
As the nation faces a long-term fiscal imbalance, and the role of the
federal government is being reshaped, there is a critical need for the
federal government to reexamine the base of its programs, policies,
functions, and activities. Performance budgeting can help enhance the
government's capacity to assess competing claims for federal dollars by
providing decision makers with better information on the results of
individual programs, as well as on various federal policies and
programs addressing common goals.
In this context, the importance of DHS' mission cannot be overstated.
While absolute security for the U.S. homeland is impossible, seeking to
minimize vulnerability must remain a goal. Much is at stake when
decisions are made about how to allocate limited resources across a
large number of programs in multiple DHS agencies. GAO has consistently
advocated implementation of a risk management approach for prioritizing
efforts and focusing resources. This kind of approach is especially
important since we seek to address threats that are seemingly limitless
with resources that are limited. It is necessary to prioritize both
risks and the actions taken to reduce risks. Where can resources do the
most good? How should they be allocated across risks and across risk-
reducing activities? Risk-based, priority-driven decisions can help
inform decision makers in allocating finite resources to the areas of
greatest need. Congress and agencies have a shared responsibility for
ensuring that performance budgeting and risk management approaches are
both useful and used. Congress can play an important role by using the
resulting information in the authorization, appropriations, and
oversight process. Further, to the extent that Congress wants to
instill a risk-based approach, it is important to recognize that
agencies need to have some flexibility in implementing it.
As the Congress and DHS move to rebalance resource priorities to
address the relative risks facing the nation, it is important to
reexamine major existing programs and activities based on their
relative contribution to reducing the areas of greatest vulnerability.
This will require making tough choices to identify those activities
with the greatest potential net benefit for the nation as a whole,
while reassessing the need for other programs with more limited or less
nationwide scale and importance. Going forward, we need to rethink
certain traditional funding strategies, such as per capita based
formulas and earmarks to determine whether they are consistent with a
risk based approach.
We should not expect this effort to be easy or the path forward to be
smooth. Risk assessment is difficult in many government areas. It is
especially so in the area of homeland security in which initial
probabilities and consequences and the effectiveness of countermeasures
are unusually difficult to determine. Getting relevant, reliable, and
timely information for risk assessment is also quite difficult.
Nevertheless, the effort should be made. A comprehensive approach
should be developed and maintained. The state of the art for risk
management will take time to mature. This will require sustained
management commitment--and continued involvement, support, and
oversight by Congress. Going forward, we need to rethink certain
traditional funding strategies, such as per capita based formulas and
earmarks to determine whether they are consistent with a risk based
approach.
This completes my prepared statement. I would be pleased to respond to
any questions you or other members of the subcommittee may have.
For future information on this testimony, please contact Norman J.
Rabkin at 202-512-8777. Other key contributors included Denise Fantone,
Kimberly Gianopoulos, Susan Irving, Jacqueline Nowicki, Evi Rezmovic,
and Jonathan Tumin.
FOOTNOTES
[1] In this testimony, the term performance budgeting refers to any
linkage between budgeting and expected or actual evidence-based
performance and results-based information.
[2] Pub. L. No. 103-62, 107 Stat. 285 (1993).
[3] For more information on reexamination of federal programs, see GAO,
21st Century Challenges: Reexamining the Base of the Federal
Government, GAO-05-325SP (Washington, D.C.: February 2005).
[4] See Pub. L. No. 103-62, Sec. 2, 107 Stat. at 285 (1993).
[5] 5 U.S.C. Sec. 306 and 31 U.S.C. Secs. 1115-1116.
[6] GAO, Results-Oriented Government: GPRA Has Established a Solid
Foundation for Achieving Greater Results, GAO-04-38 (Washington, D.C.:
March 10, 2004).
[7] The Office of Management and Budget (OMB) has used PART to assess
the performance of 32 programs in DHS reported in the President's
budgets for fiscal years 2004-2006. The assessment consisted of
programs operated by the Coast Guard, Transportation and Security
Administration, Immigration and Customs Enforcement, Customs and Border
Protection, Office for Domestic Preparedness, Science and Technology,
and the Federal Emergency Management Agency, among others. On the basis
of answers to 25 questions relating to a program's purpose, planning,
management, results and accountability, OMB concluded performance was
effective for 4 programs, moderately effective for 6 programs, and
adequate for 6 programs. OMB found that results were not demonstrated
for the remaining 16 programs.
[8] For a detailed examination of PART, see GAO, Performance Budgeting:
Observations on the Use of OMB's Program Assessment Rating Tool for the
Fiscal Year 2004 Budget, GAO-04-174 (Washington, D.C.: January 30,
2004).
[9] GAO, Management Reform: Assessing the President's Management
Agenda, GAO-05-574T (Washington, D.C.: April 21, 2005).
[10] Pub. L. No. 107-296, 116 Stat. 2135 (2002).
[11] GAO, Results-Oriented Government: Improvements to DHS' Planning
Process Would Enhance Usefulness and Accountability, GAO-05-300
(Washington, D.C.: March 31, 2005).
[12] GAO, Transportation Security: Systematic Planning Needed to
Optimize Resources, GAO-05-357T (Washington, D.C.: February 15, 2005).
[13] GAO, Protection of Chemical and Water Infrastructure: Federal
Requirements, Actions of Sected Facilities, and Remaining Challenges,
GAO-05-327 (Washington, D.C.: March 28, 2005).
[14] GAO, High-Risk Series: An Update, GAO-05-207 (Washington, D.C.:
January 2005).
[15] GAO, Homeland Security: Reforming Federal Grants to Better Meet
Outstanding Needs, GAO-03-1146T (Washington, D.C.: September 3, 2003).
[16] GAO, Homeland Security: Summary of Challenges Faced in Targeting
Ocean Going Cargo Containers for Inspection, GAO-04-557T (Washington,
D.C.: March 31, 2004).
