Information Technology
Management Improvements Needed on Immigration and Customs Enforcement's Infrastructure Modernization Program Gao ID: GAO-05-805 September 7, 2005The Department of Homeland Security's (DHS) Atlas program is intended to modernize Immigration and Customs Enforcement's (ICE) information technology (IT) infrastructure. By congressional mandate, DHS is to develop and submit for approval an expenditure plan for Atlas that satisfies certain legislative conditions, including a review by GAO. GAO was asked to determine whether the plan satisfied certain legislative conditions and to provide observations on the plan and management of the program.
DHS's fiscal year 2004 Atlas expenditure plan, related documentation, and program officials' statements satisfied all conditions imposed by Congress, including (1) meeting the capital planning and investment control review requirements established by the Office of Management and Budget (OMB); (2) complying with the DHS enterprise architecture; (3) complying with the acquisition rules, requirements, guidelines, and systems acquisition management practices of the federal government; and (4) being reviewed and approved by ICE's Investment Review Board, DHS, and OMB. However, this satisfaction is based more on plans and commitments that provide for meeting these conditions than on completed actions. As such, much remains to be accomplished for Atlas planning and management efforts to be considered effective and thereby minimize the risks associated with the program's capacity to deliver promised IT infrastructure capabilities and benefits on time and within budget. GAO developed a number of observations about the expenditure plan and DHS's management of the program. The observations address the need for economic justification of Atlas, rigorous and disciplined program management practices, performance measurements that are linked to goals and benefits, and an expenditure plan that provides sufficient information on program commitments for it to be a useful accountability tool. For example, Atlas's existing economic justification does not reflect recent and planned changes in the program's scope and purpose, including plans to expand the program beyond IT infrastructure upgrades. In addition, program management controls and capabilities have yet to be established. While ICE has begun to establish an Atlas program office, this office is not yet operational and is not adequately staffed. For example, while ICE has assigned a program manager and three contracting staff, it has not yet determined how many staff will be needed on the Atlas projects. In addition, while the program manager recently assessed staffing needs for program support positions, and identified several, none have been filled.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-05-805, Information Technology: Management Improvements Needed on Immigration and Customs Enforcement's Infrastructure Modernization Program
This is the accessible text file for GAO report number GAO-05-805
entitled 'Information Technology: Management Improvements Needed on
Immigration and Customs Enforcement's Infrastructure Modernization
Program' which was released on September 7, 2005.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Report to Congressional Committees:
September 2005:
Information Technology:
Management Improvements Needed on Immigration and Customs Enforcement's
Infrastructure Modernization Program:
[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-05-805]:
GAO Highlights:
Highlights of GAO-05-805, a report to congressional committees:
Why GAO Did This Study:
The Department of Homeland Security‘s (DHS) Atlas program is intended
to modernize Immigration and Customs Enforcement‘s (ICE) information
technology (IT) infrastructure. By congressional mandate, DHS is to
develop and submit for approval an expenditure plan for Atlas that
satisfies certain legislative conditions, including a review by GAO.
GAO was asked to determine whether the plan satisfied certain
legislative conditions and to provide observations on the plan and
management of the program.
What GAO Found:
DHS‘s fiscal year 2004 Atlas expenditure plan, related documentation,
and program officials‘ statements satisfied all conditions imposed by
Congress, including (1) meeting the capital planning and investment
control review requirements established by the Office of Management and
Budget (OMB); (2) complying with the DHS enterprise architecture; (3)
complying with the acquisition rules, requirements, guidelines, and
systems acquisition management practices of the federal government; and
(4) being reviewed and approved by ICE‘s Investment Review Board, DHS,
and OMB. However, this satisfaction is based more on plans and
commitments that provide for meeting these conditions than on completed
actions. As such, much remains to be accomplished for Atlas planning
and management efforts to be considered effective and thereby minimize
the risks associated with the program‘s capacity to deliver promised IT
infrastructure capabilities and benefits on time and within budget.
GAO developed a number of observations about the expenditure plan and
DHS‘s management of the program. The observations address the need for
economic justification of Atlas, rigorous and disciplined program
management practices, performance measurements that are linked to goals
and benefits, and an expenditure plan that provides sufficient
information on program commitments for it to be a useful accountability
tool. For example, Atlas‘s existing economic justification does not
reflect recent and planned changes in the program‘s scope and purpose,
including plans to expand the program beyond IT infrastructure
upgrades. In addition, program management controls and capabilities
have yet to be established. While ICE has begun to establish an Atlas
program office, this office is not yet operational and is not
adequately staffed. For example, while ICE has assigned a program
manager and three contracting staff, it has not yet determined how many
staff will be needed on the Atlas projects. In addition, while the
program manager recently assessed staffing needs for program support
positions, and identified several, none have been filled (see graphic).
Proposed Program Management Office:
[See PDF for image]
[End of figure]
What GAO Recommends:
To strengthen Atlas planning and management, GAO recommends that the
Secretary of DHS ensure that ICE follows through on commitments to
implement effective management controls and capabilities by, among
other things, revising and updating the cost-benefit analysis; making
the program office operational; developing and implementing rigorous
performance program management practices; and ensuring that future
expenditure plans fully disclose the system capabilities, schedule,
cost, and benefits to be delivered. In its written comments on this
report, DHS concurred with GAO‘s recommendations and
stated actions that it was taking to implement them.
www.gao.gov/cgi-bin/getrpt?GAO-05-805.
To view the full product, including the scope and methodology, click on
the link above. For more information, contact Randy Hite, (202) 512-
3439, HiteR@gao.gov.
[End of section]
Contents:
Letter:
Compliance with Legislative Conditions:
Other Observations on the Expenditure Plan and Management of Atlas:
Conclusions:
Recommendations for Executive Action:
Agency Comments:
Appendixes:
Appendix I: Briefing to the Staffs of the Subcommittees on Homeland
Security, Senate and House Committees on Appropriations:
Appendix II: Comments from the U.S. Department of Homeland Security:
Appendix III: GAO Contact and Staff Acknowledgments:
Abbreviations:
DHS: Department of Homeland Security:
ICE: Immigration and Customs Enforcement:
IT: information technology:
OMB: Office of Management and Budget:
Letter September 7, 2005:
The Honorable Judd Gregg:
Chairman:
The Honorable Robert C. Byrd:
Ranking Member:
Subcommittee on Homeland Security:
Committee on Appropriations:
United States Senate:
The Honorable Harold Rogers:
Chairman:
The Honorable Martin Olav Sabo:
Ranking Member:
Subcommittee on Homeland Security:
Committee on Appropriations:
House of Representatives:
The 2004 Department of Homeland Security Appropriations Act[Footnote 1]
provided $40 million for Immigration and Customs Enforcement's (ICE)
program to modernize its information technology (IT)
infrastructure.[Footnote 2] The goals of the program--which ICE refers
to as "Atlas"--are to, among other things, improve information sharing,
strengthen information security, and improve workforce productivity.
The act provided that the Department of Homeland Security (DHS) was
prohibited from obligating the $40 million until it developed a plan
for how the funds are to be spent that satisfied certain legislative
conditions, including having the plan reviewed by us. On March 16,
2005, DHS submitted its fiscal year 2004 expenditure plan to the Senate
and House Appropriations Subcommittees on Homeland Security. Pursuant
to the act, we reviewed the plan; our objectives were to (1) determine
whether the plan satisfies legislative conditions specified in the act
and (2) provide any other observations about the plan and management of
the program.
On May 10 and 24, 2005, we briefed the Senate and House Homeland
Security Subcommittee staffs, respectively, on the results of our
review. This report transmits the results of that work. The full
briefing, including our scope and methodology, is reprinted in appendix
I.
Compliance with Legislative Conditions:
DHS satisfied each of the applicable legislative conditions specified
in the act. In particular, the plan, including related program
documentation and program officials' statements, satisfied or provided
for satisfying all key aspects of (1) meeting the capital planning and
investment control review requirements of the Office of Management and
Budget (OMB);[Footnote 3] (2) complying with the DHS enterprise
architecture;[Footnote 4] (3) complying with acquisition rules,
requirements, guidelines, and systems acquisition management practices
of the federal government; and (4) having the plan reviewed and
approved by ICE's Investment Review Board, DHS, and OMB.
However, satisfaction of these legislative conditions is based in large
part on plans and oral commitments by program officials that provide
for meeting the conditions. To illustrate, OMB capital planning
requirements direct agencies planning to make a major IT investment,
like Atlas, to among other things (1) summarize the investment's life-
cycle costs; (2) analyze costs and benefits, including return on
investment; (3) establish performance goals and measures; and (4)
develop security and privacy plans. The Atlas program does not have a
current life-cycle cost estimate nor a current cost-benefit analysis
showing return on investment. It also does not have a complete set of
performance measures. Further, the program does not have an up-to-date
security plan that includes Atlas, and officials have yet to develop a
privacy impact assessment for the program. The program manager
acknowledged these shortfalls and either planned or orally committed to
fully satisfy the requirements when expenditure plan funds become
available.
Other Observations on the Expenditure Plan and Management of Atlas:
Our observations address the need for economic justification of Atlas,
rigorous and disciplined program management practices, performance
measurements that are linked to goals and benefits, and an expenditure
plan that provides sufficient information on program commitments to
make the plan a useful accountability tool. An overview of specific
observations follows:
* Economic justification (i.e., analysis of costs and benefits) does
not reflect recent and planned changes in the program's scope and
purpose. The existing cost-benefit analysis--which was developed in
2002--has not yet been revised to reflect changes in the program's
scope and purpose. Since ICE became responsible for Atlas in 2003
(inherited from the Immigration and Naturalization Service) it has
materially changed the program's scope, purpose, and priorities.
Specifically, Atlas was expanded to (1) support additional law
enforcement units[Footnote 5] (and their business requirements) that
were merged into ICE and (2) provide the flexibility to support new ICE
priorities, such as integrating future antiterrorism programs and
projects and facilitating information sharing with domestic and
international law enforcement organizations. In addition, the program
is also being expanded beyond infrastructure upgrades to include
efforts to streamline and reengineer core business functions with the
application of IT. According to the fiscal year 2004 expenditure plan
and program manager, revising the analysis is a "next step" to be taken
and the goal is to have a contractor complete an updated cost-benefit
analysis on or about September 30, 2005.
* Program management controls and capabilities have yet to be
established. ICE has begun to establish an Atlas program office;
however, the program office is not yet operational. Specifically, the
bureau has drafted a management structure and plan, which includes
staff roles and responsibilities. However, the structure and plan are
currently being reviewed by ICE management and have not been made
final. Moreover, of the $63.52 million that ICE reported was obligated
for Atlas in fiscal years 2002 and 2003, only about $900,000 (or about
1.4 percent of the total amount) was obligated for program management
capabilities. In contrast, our work on other IT modernization programs
(including two in DHS) show that 19 percent was invested in such
management capabilities. In addition, while key acquisition management
processes have been defined in ICE's System Development Life Cycle
methodology, the program office has yet to implement these processes.
Further, the program office is not adequately staffed.[Footnote 6]
Currently, the office has staffed the program manager position, and it
has three contracting staff performing functions such as developing
staffing needs assessments and other program management-related
activities. While the program manager recently assessed staffing needs
for program support positions (e.g., financial management, contracting,
and enterprise architecture), he has not yet performed a needs
assessment to determine the staffing needs for the five of the six
projects that comprise the Atlas program. Moreover, of the seven
program support positions that the program manager has determined are
needed, none have been filled, according to program officials. The
program manager stated that ICE plans to strengthen program management
controls and capabilities once funds provided for in the expenditure
plan are available.
* Program goals, expected benefits, and reported achievements are not
fully aligned. The Atlas expenditure plan and documentation show that
the program has defined goals and expected benefits and has reported
actual achievements accomplished during fiscal years 2002 and 2003.
However, the relationships among goals, benefits, and achievements have
not been defined and are not apparent in all cases. Moreover, the
reported achievements are not expressed in terms of measurable outcomes
or results, but rather as activities completed. The program manager
stated that the 2002 and 2003 achievements were not analyzed and
aligned to program goals and benefits, and that outcome-based measures
were not developed in part because the emphasis at the time was on
buying and deploying long overdue infrastructure upgrades as quickly as
possible. He stated that in the future, the program intends to define,
ensure, and disclose the linkage among program goals, benefits, and
results.
* Fiscal year 2004 expenditure plan does not provide sufficient
information on program commitments to permit effective congressional
oversight. The Atlas expenditure plan does not show the level of detail
and scope of the program needed for Congress to understand its plans
and commitments relative to system capabilities, cost, benefits, and
schedule. Further, it does not sufficiently describe progress made
against program commitments (e.g., expected benefits). According to the
program manager, the state of the plan reflects the program's
uncertainty about the appropriate level of detail in expenditure plans.
He stated that future plans will include missing content.
Conclusions:
The fiscal year 2004 Atlas expenditure plan, in combination with
related program documentation and program officials' statements,
satisfies the legislative conditions set forth by Congress. However,
this satisfaction is based more on plans and commitments that provide
for meeting these conditions than on completed actions. As such, much
remains to be accomplished for Atlas planning and management efforts to
be considered effective and thereby minimize the risks associated with
the program's capacity to deliver promised IT infrastructure
capabilities and benefits on time and within budget.
The current state of planning and management puts the program at risk.
While this is partially due to events beyond the program's control,
such as the department's decision to reprogram Atlas funding and to
redeploy Atlas staff to competing DHS priorities, as well as to change
the program's scope and purpose when it transitioned from the
Immigration and Naturalization Service to ICE, it is also due to the
program's decision not to use fiscal years 2002 and 2003 funds to
invest in program management capabilities.
Given that more than $60 million has reportedly been obligated to date
on the program, resources have been available to strengthen planning
and management capabilities in key areas, but investment in these areas
has been deferred. Deferral of establishing such program planning and
management controls and capabilities--such as having reliable and
current economic justification for the program; a capable program
office; and clearly aligned program goals, benefits, and performance
measures--introduce unnecessary risk to the program.
Moreover, not providing congressional decision makers with the
information that they need about program commitments to be met with the
expenditure plan funds--including the benefits to be produced, the
capabilities to be delivered, and the cost and schedule estimates to be
met--impedes congressional oversight.
Recommendations for Executive Action:
To minimize risks to the Atlas program, we recommend that the Secretary
of Homeland Security, through the Under Secretary for Border and
Transportation Security, direct the Assistant Secretary for Immigration
and Customs Enforcement to ensure that ICE follows through on
commitments to implement effective management controls and capabilities
by taking the following five steps:
* Revising and updating the cost-benefit analysis, to identify current
mission requirements; how they will be met; and an estimate of the
program's incremental and life-cycle costs, benefit, schedule, and
return on investment. This should also include establishing plans,
associated tasks, and milestones for accomplishing this effort.
* Making the Atlas program office operational by (1) developing a
staffing needs assessment to determine the positions and the level of
staffing needed for all projects to adequately manage the program,
including a human capital strategy and timetable for acquiring the
staff and bringing them on board; (2) finalizing the roles and
responsibilities for the positions identified in the staffing
assessment and for the projects; and (3) implementing and
institutionalizing key acquisition management controls, including risk
management processes where relevant responsibilities are assigned and
key risks and their status are reported to an executive body.
* Developing and implementing an updated Atlas security plan and
privacy impact assessment. This should also include establishing plans,
associated tasks, and milestones for accomplishing this effort.
* Developing and implementing rigorous performance management practices
for the Atlas program that include properly aligned goals, benefits,
achievements, and anticipated achievements that are defined in
measurable terms. This should also include establishing plans,
associated tasks, and milestones for accomplishing this effort.
* Ensuring that future expenditure plans fully disclose the system
capabilities, schedule, cost, and benefits to be delivered, as well as
the acquisition strategy for Atlas.
Agency Comments:
In the department's written comments on a draft of this report, which
were contained in a letter signed by the director, DHS Departmental
GAO/Office of Inspector General Liaison, DHS concurred with all of our
recommendations and stated actions it was taking to implement them.
DHS's comments are reprinted in appendix II.
We are sending copies of this report to the Chairmen and Ranking
Members of other Senate and House committees and subcommittees that
have authorization and oversight responsibilities for homeland
security. We are also sending copies to the Secretary of Homeland
Security and the Director of OMB. Copies of this report will also be
available at no charge on our Web site at [Hyperlink,
http://www.gao.gov].
Should you or your offices have any questions on matters discussed in
this report, please contact me at (202) 512-3439 or at [Hyperlink,
hiter@gao.gov]. Contact points for our Offices of Congressional
Relations and Public Affairs may be found on the last page of this
report. Key contributors to this report are listed in appendix III.
Signed by:
Randolph C. Hite:
Director, Information Technology Architecture and Systems Issues:
[End of section]
Appendixes:
Appendix I: Briefing to the Staffs of the Subcommittees on Homeland
Security, Senate and House Committees on Appropriations:
GAO:
Appendix I:
Information Technology: Management Improvements Needed on Immigration
and Customs Enforcement's Infrastructure Modernization Program:
Briefing to the Staffs of the Subcommittees on Homeland Security,
Senate and House Committees on Appropriations:
May 10 and May 24, 2005:
* Introduction;
* Objectives;
* Results in Brief;
* Background;
* Results:
- Legislative Conditions
- Observations:
* Conclusions;
* Recommendations;
* Agency Comments;
* Attachment I: Scope and Methodology.
Introduction:
The Department of Homeland Security's (DHS) Bureau of Immigration and
Customs Enforcement (ICE) [NOTE 1] is responsible for enforcing border
security, trade, and other laws by, for example, investigating and
collecting intelligence on individuals and groups who act to violate
these laws. ICE is also responsible for detecting and deterring hostile
acts on U.S. commercial aviation and protecting federal facilities.
Atlas is an ICE program to modernize the bureau's information
technology (IT) infrastructure. IT infrastructure includes the hardware
(e.g., servers, routers, storage devices, communication lines) and
system software (e.g., database management and operating systems and
network management) that provide an environment for operating and
maintaining software applications.
According to ICE, the goals of Atlas include improving information
sharing, strengthening information security, and improving workforce
productivity.
[NOTE 1] ICE was formed from the former Immigration and Naturalization
Service, U.S. Customs Service, and other entities. Atlas began in 2002
under the former INS.
The fiscal year 2004 Department of Homeland Security Appropriations Act
[NOTE 2] appropriated $40 million for Atlas and provided that DHS was
prohibited from obligating these funds until the department submitted a
plan for how the funds were to be spent that satisfied the following
legislative conditions:
* meets the capital planning and investment control review requirements
established by the Office of Management and Budget (OMB), including OMB
Circular A-11, part 3, [NOTE 3]
* complies with DHS's enterprise architecture,
* complies with the acquisition rules, requirements, guidelines, and
systems acquisition management practices of the federal government,
* is reviewed and approved by ICE's Investment Review Board (IRB),
[NOTE 5] DHS, and OMB, and:
* is reviewed by GAO.
During fiscal year 2004, DHS reprogrammed about $30.2 million of the
Atlas funds to cover other ICE priorities, leaving $9.8 million for the
program.
DHS submitted its fiscal year 2004 expenditure plan for $9.8 million on
March 16, 2005, to its Senate and House Appropriations Subcommittees on
Homeland Security.
[NOTE 2] Pub.L. No. 108-90 (Oct. 1, 2003).
[NOTE 3] OMB Circular A-11 establishes policy for planning, budgeting,
acquisition, and management of federal capital assets. Capital
investment and control requirements are now found in OMB Circular A-11,
part 7, rather than part 3.
[NOTE 4] As agreed with the staffs of the appropriations subcommittees,
we assessed compliance with the DHS enterprise architecture in lieu of
the ICE enterprise architecture.
[NOTE 5] The purpose of the IRB is to integrate capital planning and
investment control, budgeting, and acquisition. It is also to ensure
that spending on investments directly supports and furthers the mission
and that this spending provides optimal benefits and capabilities to
stakeholders and customers.
Objectives:
As agreed, our objectives were to:
1. determine whether the Atlas fiscal year 2004 expenditure plan
satisfies the legislative conditions, and:
2. provide any other observations about the expenditure plan and DHS's
management of the Atlas program.
We conducted our work at DHS and ICE headquarters in Washington, D.C.
from March 2005 through May 2005 in accordance with generally accepted
government auditing standards. Details of our scope and methodology are
provided in attachment I.
Results in Brief:
Objective 1: Satisfaction of Legislative Conditions:
Legislative condition: 1. Meets the capital planning and investment
control review requirements established by OMB, including OMB Circular
A-11, part 7 [NOTE 6];
Status: Satisfied.
Legislative condition: 2. Complies with the DHS enterprise
architecture;
Status: Satisfied.
Legislative condition: 3. Complies with the acquisition rules,
requirements, guidelines, and systems acquisition management practices
of the federal government;
Status: Satisfied.
Legislative condition: 4. Is reviewed and approved by ICE IRB, DHS, and
OMB;
Status: Satisfied.
Legislative condition: 5. Is reviewed by GAO;
Status: Satisfied.
[End of table]
[NOTE 6] Capital investment and control requirements are now found in
OMB Circular A-11, part 7, rather than part 3. [7] Satisfied: Satisfied
or provides for satisfying every aspect of the condition that we
reviewed.
Objective 2: Other Observations:
Economic justification does not reflect recent and planned changes in
the program's scope and purpose.
Program management controls and capabilities have yet to be
established.
Program goals, expected benefits, and reported achievements are not
fully aligned.
Fiscal year 2004 expenditure plan does not provide sufficient
information on program commitments to permit effective congressional
oversight.
Recommendations:
We are making recommendations to the Secretary of DHS to improve Atlas
expenditure planning and program management.
In commenting on a draft of this briefing, ICE's chief information
officer and the Atlas program manager agreed with our findings and
conclusions and stated that our recommendations were reasonable.
Background:
ICE:
ICE was formed as a component agency of DHS in 2003 when the law
enforcement functions of the Justice Department's former Immigration
and Naturalization Service (INS) and the Treasury Department's former
Customs Service, among other agencies, were merged into DHS.
The ICE mission is to ensure the security of the American people and
homeland by investigating violators of, and thereby, enforcing the
nation's immigration and customs laws; protecting U.S. commercial air
carriers, airports, passengers, and crews; policing and securing
federal buildings and other facilities; and collecting, analyzing, and
disseminating intelligence to assist it in these endeavors.
Headed by the Assistant Secretary of Immigration and Customs
Enforcement, ICE has approximately 15,000 employees in over 400 offices
domestically and in other countries.
The Atlas program was started by INS in 2002. Responsibility for the
program was transferred to ICE in 2003 as part of the establishment of
DHS.
The figure on the following page shows ICE and Atlas organizational
placement within the department.
Background:
ICE and Atlas Organizational Placement:
Simplified DHS organizational chart showing ICE and Atlas program:
[See PDF for image]
Source: GAO analysis of DHS data.
[End of figure]
Background:
Impetus for Atlas:
According to ICE officials, Atlas was initiated to address information
sharing and security limitations within the former INS caused by, for
example,
* obsolete hardware/software that needed refreshing;
* incompatible, non-interoperable information systems; and:
* uneven system security capabilities.
These officials stated that these challenges were exacerbated by the
formation of ICE because the organizations that merged into ICE had
different hardware/software environments (e.g., multiple e-mail
systems) and different mission and customer needs.
Background:
Goals of Atlas:
The stated goals of Atlas are, among other things, to:
* enhance workforce productivity,
* strengthen integrity, security, and privacy of information and data
assets, and:
* promote information sharing and collaboration.
Background:
Atlas Projects:
The fiscal year 2004 expenditure plan states that Atlas consists of
seven interrelated projects, which are briefly described below.
Project: Common Computing Environment;
Description:
- Acquire and deploy a common e-mail application (MS Exchange) to
replace multiple and disparate e-mail applications currently in use
across ICE organizations.
- Implement hardware and software (i.e., Active Directory) that enables
the common e-mail application to operate on multiple local area
networks.
- Install new desktop computers.
Project: Integration (Connectivity);
Description:
- Connect new bureau organizations (e.g., Federal Protective Service,
Federal Air Marshal Service) to ICE's communications network to, among
other things, provide investigators and other staff quicker access to
information used to accomplish mission duties.
-Identify a solution for optimizing the integration and performance of
these connections and develop a plan to implement it.
Project: Electronic Access and E-Government;
Description:
- According to the program manager, Electronic Access and E-Government
has recently been merged with the Enterprise Information project, which
is described on the next slide.
Project: Enterprise information;
Description:
- Develop and prototype an approach to integrate systems and
information across ICE, including developing a central data repository
with the capabilities to access, navigate, and search information
across multiple sources (referred to as Enterprise Query) and share
information across existing systems on a real time basis (referred to
as Enterprise Interoperability).
- Establish infrastructure to support implementation of Web-based
applications (i.e., electronic government).
Project: Information Assurance;
Description:
- Strengthen security of ICE's information, network, and systems by
expanding the capabilities of the bureau's Security Operations Center
in the following areas: audit log management, intrusion detection,
firewall management, cryptographic services, computer forensics,
vulnerability scanning, and penetration testing.
Project: Infrastructure Engineering;
Description:
- Provide engineering facilities (e.g., interoperability laboratory)
and automated tools and procedures to manage and operate ICE 's IT
infrastructure and evaluate and test new technologies before deploying
them in the operational environment.
Project: Transformation planning;
Description:
- Implement program management structures, policies, and processes to
stand up the program office.
- Provide adequate program office staffing.
- Centralize and streamline procurement planning and procedures to
enable more efficient purchasing of hardware and software products and
services.
- Manage and oversee Atlas projects and contractors, including
developing tools to help in these endeavors.
- Ensure compliance with DHS's enterprise architecture.
- Monitor adherence to cost, schedule, and performance goals.
Source: DHS data.
[End of table]
Background:
Atlas Funding:
Since fiscal year 2002, Atlas has been provided $143.17 million in
appropriated funds.
* $39.1 million from INS counterterrorism funding in fiscal year 2002.
[NOTE 8]
* $24.47 million from INS investment and operations and maintenance
funding in fiscal year 2003.
* $40 million from DHS appropriations in fiscal year 2004, [NOTE 9] of
which $30.2 million was reprogrammed by DHS to cover other ICE
priorities, leaving $9.8 million.
* $39.6 million from DHS appropriations in fiscal year 2005. [NOTE 10]
[NOTE 8] Counterterrorism funding came from the Department of Defense
and Emergency Supplemental Appropriations for Recovery from and
Response to Terrorist Attacks on the United States Act, 2002. Pub. L.
No. 107-117 (Jan. 10, 2002); H.R. Report 107-350 (Dec. 19, 2001).
[NOTE 9] Pub.L. No. 108-90 (Oct. 1, 2003).
[NOTE 10] Pub.L. No. 108-334 (Oct. 18, 2004).
Background:
Atlas Expenditures:
As shown in the table below, ICE reports that it has obligated $63.5211
million in fiscal years 2002 and 2003 appropriated funds on various
Atlas projects.
[See PDF for image]
Source: DHS data.
[End of table]
[11] According to the program manager, of the $63.57 million that
Congress appropriated in fiscal years 2002 and 2003, $63.52 million was
obligated to Atlas projects and the remainder .05 million was
reprogrammed to other ICE priorities.
Background:
Planned Use of Fiscal Year 2004 Funding:
According to the fiscal year 2004 expenditure plan, the $9.8 million
will be spent on five projects that are immediate needs of the program.
[See PDF for image]
Source: DHS data.
[End of table]
[NOTE 12] According to the program manager, the project Electronic
Access and E-Government was recently merged with Enterprise
Information.
Objective 1 Results:
Legislative Conditions:
The Atlas expenditure plan satisfies each of the legislative
conditions.
Condition 1 Satisfied. The expenditure plan, including related program
documentation and statements from the program manager, either satisfies
or provides for satisfying the capital planning and investment control
review requirements established by OMB, including Circular A-11, part
3, [NOTE 13] which establishes policy for planning, budgeting,
acquisition, and management of federal capital assets.
Examples of our analysis are in the following table. As the table
shows, not all OMB requirements have been satisfied, but oral
commitments have been made for doing so. Given that ICE has reportedly
already invested $63.52 million on Atlas projects and plans to invest
another $9.8 million this year, it is important for ICE to follow
through on these commitments.
Examples of OMB Circular A-11 requirements: Indicate whether the
investment was approved by an investment review committee;
Results of our findings: The plan was approved on November 16, 2004, by
the ICE IRB chair and on January 12, 2005, by the chief information
officer, who chairs the DHS Enterprise Architecture Board.
Examples of OMB Circular A-11 requirements: Provide justification and
describe acquisition strategy;
Results of our findings: The plan and supporting documentation justify
the program on the basis of current capability deficiencies and mission
needs. However, neither includes an analysis of costs and benefits or
return on investment. These documents also provide some aspects of a
high-level acquisition strategy, such as identifying the five contracts
that have been, and are to be used to acquire hardware and software
products and program support services. The program manager stated that
a current cost-benefit analysis and a more detailed acquisition
strategy will be developed once expenditure plan funds become
available.
Examples of OMB Circular A-11 requirements: Summarize life cycle costs
and cost-benefit analysis, including the return on investment;
Results of our findings: The program does not have a current life-cycle
cost estimate nor a current cost-benefit analysis showing return on
investment. Program officials stated they intend to revise and update
by September 2005 Atlas‘s cost-benefit and other analyses (dated 2002).
However, the officials did not have documentation defining how this was
to be accomplished. The program manager stated that a current cost and
benefit analysis will be developed once expenditure plan funds become
available. [NOTE 14]
Examples of OMB Circular A-11 requirements: Provide performance goals
and measures;
Results of our findings: The plan and supporting documentation identify
one preliminary performance metric for each of Atlas‘s planned
projects. According to the program manager, these are the program‘s
initial performance measures and additional measures, linked to program
goals, will be developed once expenditure plan funds become available.
Performance goals and measures were not used to track the $63 million
invested in Atlas during fiscal years 2002 and 2003. [NOTE 14]
Examples of OMB Circular A-11 requirements: Address security and
privacy;
Results of our findings: The plan and supporting documentation state
the importance of security and privacy and provide high-level
information on intended security measures, including one proposed
project”Information Assurance”that is intended to implement a
bureauwide security program. In addition, ICE has a December 2003
bureau-wide security plan. However, plans for the Information Assurance
project have not been developed, and the expenditure plan does not
allocate any fiscal year 2004 funding to the project. Further, ICE‘s
December 2003 bureauwide security plan does not mention Atlas or the
Information Assurance project. Moreover, ICE has not developed an Atlas
privacy impact assessment. According to the program manager, ICE
intends to update the security plan and prepare a privacy impact
assessment, but existing plans do not provide for how and when this
will be accomplished.
Examples of OMB Circular A-11 requirements: Provide risk inventory and
assessment;
Results of our findings: Assessments performed on risks were via ad hoc
meetings. A draft risk management plan was developed from these
meetings and the plan contains an inventory of risks. It does not,
however, identify, among other things, how the risks will be monitored.
The Atlas program manager stated that the program office is in the
process of developing more effective risk management and oversight
processes and intends to add a risk analyst position when Atlas funding
is received.
[End of table]
Condition 2 Satisfied. The plan, including related program
documentation and DHS officials' statements, either satisfies or
provides for satisfying the condition that the department ensure Atlas
is compliant with DHS's enterprise architecture (EA).
An EA provides a clear and comprehensive picture of an organization's
operations and its supporting systems and infrastructure. It is an
essential tool for effectively and efficiently engineering business
processes and for implementing and evolving supporting systems in a
manner that maximizes interoperability, minimizes overlap and
duplication, and optimizes performance. We have worked with the
Congress, OMB, and the federal Chief Information Officers Council to
highlight the importance of architectures for both organizational
transformation and IT management. An important element of EA management
is ensuring that IT investments are compliant with EA, including basing
such assessments on documented analysis.
On August 6, 2004, we reported on version 1.0 of DHS's EA, stating that
DHS's initial EA provides a partial foundation but was missing key
elements expected to be found in a well-defined architecture. [NOTE 15]
DHS has since developed version 2.0 of its EA. We have not reviewed
this version of DHS's EA.
DHS's Enterprise Architecture Board and Enterprise Architecture Center
of Excellence [NOTE 16] are responsible for determining whether
programs comply with the EA. On December 8, 2004, Atlas's program
manager requested the center to assess the program's compliance with
the EA. On January 10, 2005, the center reported the results of its
assessment to the board, stating that Atlas was in compliance. On
January 12, 2005, the board approved this compliance determination.
The center based its determination on documentation submitted by the
program manager and discussions among center staff, including officials
from DHS's Infrastructure Transformation Office and IT Security Office.
However, the determination was not based on documented analysis mapping
Atlas's infrastructure architecture to the EA. Such analysis is
necessary to make informed alignment determinations. According to the
center's chair, who also serves as DHS's chief architect, because Atlas
is in the early stages of its life-cycle and therefore is not very well
defined, such an analysis was not required, and when Atlas is more
defined, a thorough and documented analysis will be performed.
Given the critical role that Atlas is to play in contributing to DHS's
strategic information sharing and interoperability goals, it is
important for ICE and DHS to follow through on the stated provision to
base future Atlas compliance determinations on documented and
verifiable analysis.
Condition 3 Satisfied. The plan, including related program
documentation and statements from the Atlas program manager, either
satisfies or provides for satisfying the condition to comply with the
acquisition rules, requirements, guidelines, and systems acquisition
management practices of the federal government. These practices provide
a management framework based on the use of rigorous and disciplined
processes for planning, managing, and controlling the acquisition of IT
resources, including:
* acquisition planning, which ensures, among other things, that
reasonable plans, milestones, and schedules are developed and that all
aspects of the acquisition effort are included in these plans;
* solicitation, which involves making sure that a request for proposal
that delineates a project's requirements is prepared and, consistent
with relevant solicitation laws and regulations, that a contractor is
selected that can most cost-effectively satisfy these requirements;
* requirements development and management, which includes establishing
and maintaining a common and unambiguous definition of requirements
among the acquisition team, the system users, and the development
contractor;
* project management, provides for management of the activities within
the project office and supporting contractors to ensure a timely,
efficient, and cost-effective acquisition;
* contract tracking and oversight, which ensures that the development
contractor performs according to the terms of the contract; needed
contract changes are identified, negotiated, and incorporated into the
contract; and contractor performance issues are identified early, when
they are easier to address; and:
* evaluation, which determines whether the acquired products and
services satisfy contract requirements before acceptance.
These acquisition management processes are also embodied in published
best practices models, such as the Software Engineering Institute
(SEI)'s Software Acquisition Capability Maturity Model®. [NOTE 17]
Examples of our analysis of ICE performance of these processes and
practices are shown on the following table. They show that not all
aspects of the processes and practices have been implemented, but that
oral commitments have been made for doing so. Given that ICE has
already invested $63.52 million on Atlas projects and plans to invest
another $9.8 million this year, it is important for ICE to follow
through on these commitments.
Examples of practices: Acquisition planning; [NOTE 18]
Ensures that reasonable planning for the acquisition is conducted
including, among other things, developing an acquisition strategy and
plan, determining the cost and schedule, and identifying risks, and
defining requirements.
Results of our analysis:
The expenditure plan and supporting documents (e.g., the fiscal year
2005 Atlas budget submission to OMB known as an Exhibit 300) provide
aspects of a high-level acquisition strategy, such as identifying the
five contracts that have been, and are to be used, to acquire products
and program support services. According to the program manager, a
detailed acquisition strategy will be developed when expenditure plan
funds become available and current program life cycle cost and schedule
estimates will be developed by September 2005. A draft risk management
plan for the program has been developed that contains an inventory of
risks, and according to the fiscal year 2004 expenditure plan and the
Atlas program manager, the program will follow the bureau's 2002 System
Development Life Cycle, which we have previously reported addresses key
system acquisition planning and requirements definition activities.
[NOTE 19]
Examples of practices: Project management; [NOTE 20]
Provides for the management of activities within the project office and
supporting contractors to ensure a timely, efficient, and cost-
effective acquisition.
Results of our analysis:
ICE has begun to establish a program office with responsibility for
managing the acquisition, deployment, operation, and sustainment of
Atlas. However, current staffing consists of a program manager and
three contractor support staff, leaving key program office positions
not staffed (e.g., project managers, EA analyst, business analyst, risk
analyst). The expenditure plan states that the program office will
comply with the bureau's 2002 System Development Life Cycle, which
includes activities to promote a timely, efficient, and cost-effective
acquisition, such as implementing key acquisition management processes
advocated by Software Engineering Institute's acquisition model, and
monitoring progress through monthly reports on project cost, schedule,
and performance.
Condition 4 Satisfied. DHS and OMB satisfied the legislative condition
requiring that the plan be reviewed and approved by the ICE IRB, DHS,
and OMB.
The ICE IRB chair approved the fiscal year 2004 expenditure plan on
November 16, 2004.
The DHS chief information officer, who also chairs the Enterprise
Architecture Board, approved the plan on January 12, 2005.
OMB approved the plan on January 4, 2005.
Condition 5 Satisfied. GAO satisfied the condition that it review the
plan.
Our review was completed on May 5, 2005.
[NOTE 13] Capital investment and control requirements are now found in
OMB Circular A-11, part 7, rather than part 3.
[NOTE 14] These areas are more fully discussed in the observation
sections of the briefing.
[NOTE 15] GAO, Homeland Security. Efforts Under Way to Develop
Enterprise Architecture, but Much Work Remains, GAO-04-777 (Washington,
D.C.: August 6, 2004).
[NOTE 16] A review group made of subject manner experts that recommends
EA compliance to the DHS Enterprise Architecture Board and ultimately
to the DHS IRB.
[NOTE 17] Developed by Carnegie Mellon Software Engineering Institute
(SEI), Software Acquisition Capability Maturity Model (SA-CMM®),
Version 1.03 (March 2002).
[NOTE 18] For example see, Carnegie Mellon Software Engineering
Institute, Software Acquisition Capability Maturity Model (SA-CMM®),
Version 1.03 (March 2002).
[NOTE 19] For example see, GAO, Information Technology. Homeland
Security Needs to Improve Entry Exit System Expenditure Planning, GAO-
03-563 (Washington, D.C.: June 9, 2003).
[NOTE 20] For example see, Carnegie Mellon Software Engineering
Institute, Software Acquisition Capability Maturity Model (SA-CMM®),
Version 1.03 (March 2002).
Objective 2 Results:
Observations: Economic Justification:
Observation 1: Economic justification does not reflect recent and
planned changes in the program's scope and purpose.
Cost-benefit analyses are essential tools for making informed program
investment selection and control decisions and for establishing the
return on investment benchmark against which to measure whether
investments are delivering intended business value. Accordingly, the
Clinger-Cohen Act, OMB guidance, [NOTE 21] and investment management
best practices recognize the importance of having reliable and current
cost- benefit analyses.
INS developed an analysis of Atlas's costs and benefits in 2002. The
analysis estimated that the program would cost about $800 million to
implement over a 6-year period and would provide benefits of
approximately $1.1 billion dollars, primarily through better system
response times and reduced operations and maintenance costs, as shown
in the following figure.
Objective 2 Results:
Observations: Economic Justification:
Sources of Atlas program benefits:
Enhanced help desk operations: 3%:
Improved reliability: 5%:
Reduced operations/maintenance costs: 43%;
Better response time: 49%.
Source: DHS.
[End of figure]
As we have previously reported, [NOTE 22] it is important for cost-
benefit analyses to be updated to reflect material changes to a
program's scope, purpose, cost, timeframes, etc., so that agency
officials will have a reliable basis for program investment decisions.
Since ICE became responsible for Atlas in 2003, the bureau has
materially changed the program's scope, purpose, and priorities.
Specifically, Atlas was expanded to:
* support additional law enforcement units (and their business
requirements) that were merged into ICE (e.g., Federal Air Marshals
Service, Federal Protective Service, Customs investigations, Customs
intelligence); and:
* provide the flexibility to support new ICE priorities (e.g.,
integrating future anti-terrorism programs and projects, facilitating
information sharing with domestic and international law enforcement
organizations).
In addition, the program manager said that the program is to include
efforts to streamline and reengineer core business functions with the
application of information technology. According to this official,
details of these efforts are to be defined in the fiscal year 2005
Atlas expenditure plan.
According to the Atlas program manager, the cost benefit analysis has
not yet been revised to reflect changes to the program's scope and
purpose because doing so has not been a priority. According to the
fiscal year 2004 expenditure plan, revising the analysis is a "next
step" to be taken. However, existing plans do not identify a date for
doing so. The program manager stated that a current cost-benefit
analysis will be developed once funds provided for in the expenditure
plan become available. He also stated that the goal is to have a
contractor complete an updated cost benefit analysis on or about
September 30, 2005.
Until the cost benefit analysis is revised to reflect recent and
planned changes to the program, DHS will not have a reliable basis for
making informed Atlas investment decisions.
[NOTE 21] Clinger-Cohen Act of 1996, 40 U.S.C. 11101-11704; and Office
of Management and Budget (OMB) Circular A-130, Management of Federal
Information Resources (November 30, 2000).
[NOTE 22] For example, see GAO, Information Technology. Greater Use of
Best Practices Can Reduce Risks in Acquiring Defense Health Care
System, GAO-02-345 (Washington, D.C.: September 26, 2002).
Objective 2 Results:
Observations: Program Management Controls and Capabilities:
Observation 2: Program management controls and capabilities have yet to
be established.
As we have previously reported, [NOTE 23] the success of major
modernization programs such as Atlas depends on having an operational
program office that has, among other things, effectively implemented
rigorous and disciplined program management process controls and
adequately filled key human capital positions. Two activities key to
strategically managing human capital are performing staffing needs
assessments and defining staff roles and responsibilities.
The SEI's Software Acquisition Capability Maturity Model (SA-CMM®)[NOTE
24] has defined a suite of key acquisition process areas that are
necessary to manage the system acquisition program in a rigorous and
disciplined fashion. As described earlier in the briefing, these
process areas include:
* acquisition planning,
* solicitation,
* requirements development and management,
* project management,
* contract tracking and oversight, and
* evaluation.
ICE has begun to establish an Atlas program office. For example, the
bureau has drafted a management structure and plan, which includes
staff roles and responsibilities. However, the structure and plan are
currently being reviewed by ICE management and the program office is
not yet operational. Moreover, while key acquisition management
processes have been defined in the System Development Life Cycle
methodology, which our previous work [NOTE 25] has shown adequately
defines the critical management processes needed to successfully
acquire systems, the program office has yet to implement these
processes.
In addition, the program office is not adequately staffed. [NOTE 26]
Currently, the office has staffed the program manager position and it
has three contracting staff performing such functions as developing
staffing needs assessments and other program management related
activities. Further, while the program manager recently assessed
staffing needs for program support positions (e.g., financial
management, contracting, EA), he has not yet determined the staffing
needs for five Atlas projects. Specifically, the program manager
recently asked, and the project managers provided estimates of,
staffing needed, but these estimates were not based on an estimating
methodology or staffing needs assessment. Instead, the project managers
provided estimates of the staff that could be obtained given the
funding provided in the plan. Moreover, of the seven program support
positions that the program has determined it needs, none have been
filled. (The figure on the next slide shows the proposed office
structure, along with the organizational areas where staffing needs
have and have not been assessed, and where staffing needs have and have
not been filled.)
Proposed Program Management Office:
[See PDF for image]
Source: GAO analysis of DHS data.
Image contains footnotes 27-29.
[End of figure]
The program manager attributes the state of the program office,
including controls and capabilities, to competing DHS priorities. He
stated that ICE plans to strengthen program management controls and
capabilities once funds provided for in the expenditure plan are
available. In particular, he cited two projects (Transformation
Planning and Infrastructure Engineering) in the expenditure plan that
have this goal. However, existing program documentation does not
describe how and when these projects are to achieve this goal.
Moreover, it should be noted that of the $63.52 million obligated for
Atlas in fiscal years 2002 and 2003, $900,000 (or about 1.4 percent of
the total) was obligated for these two projects. While the current
expenditure plan proposes investing $2.17 of the $9.8 million on these
two projects, this still represents but 4 percent of the $73.37 million
Atlas funding to date going to improving program management. By
contrast, our work on other IT modernization programs, such as US-
VISIT, shows that roughly 19 percent was invested in program
management.
Until the above program management controls and capabilities are in
place and functioning, ICE faces the increased likelihood that Atlas
will not meet its objectives on schedule and within budget.
[NOTE 23] For example, see GAO, Information Technology. Homeland
Security Needs to Improve Entry Exit System Expenditure Planning, GAO-
03-563 (Washington, D.C.: June 9, 2003).
[NOTE 24] Carnegie Mellon Software Engineering Institute, Software
Acquisition Capability Maturity Model (SA-CMM®), Version 1.03 (March
2002).
[NOTE 25] For example, see GAO, Information Technology. Homeland
Security Needs to Improve Entry Exit System Expenditure Planning, GAO-
03-563 (Washington, D.C.: June 9, 2003).
[NOTE 26] According to the program manager, Atlas staff were
transferred to the US-Visitor and Immigrant Status Indicator Technology
program in 2003, which is managed by the DHS Under Secretary for Border
and Transportation Security.
[NOTE 27] Government full-time employees.
[NOTE 28] Contracting full-time employees.
[NOTE 29] According to the program manager, the staff for the
Transformation Planning project also serve as the staff for the program
office.
GAO Objective 2 Results:
Observations: Performance Goals and Measures:
Observation 3: Program goals, expected benefits, and reported
achievements are not fully aligned.
The Clinger-Cohen Act [NOTE 30] requires the use of effective IT
management practices, including measuring the contributions of IT
investments to achieving agency mission outcomes. To this end, OMB
states [NOTE 31] that agencies should, among other things:
* establish program performance goals and expected benefits,
* develop outcome-based measures to assess actual program performance
(i.e., achievements) against expected benefits, and:
* ensure that goals, expected benefits, and achievements are properly
aligned.
The Atlas expenditure plan and documentation show that the program has
defined goals and expected benefits and has reported actual
achievements accomplished during 2002 and 2003. The stated goals
include:
* enhancing productivity, and:
* assuring integrity, security, and privacy of information and data
assets, and promoting information sharing and collaboration.
The stated benefits include:
* better response time,
* reduced operations/maintenance costs,
* improved reliability, and:
* enhanced help desk operations.
In addition, examples of stated achievements are:
* purchased Active Directory hardware and software for the e-mail
system,
* initiated an interim Security Operations Center, and:
* developed a data encryption approach for the network.
However, the relationships among goals, benefits, and achievements have
not been defined, and are not otherwise apparent in all cases. For
example, it is not clear how the following reported achievements relate
to Atlas goals.
* improving the capacity of the network,
* implementing tools to monitor network performance, and:
* completing an Enterprise Information Concept of Operations document.
Moreover, the reported achievements are not expressed in terms of
measurable outcomes or results, but rather as activities completed.
The program manager stated that the 2002 and 2003 achievements were not
analyzed and aligned to program goals and benefits and outcome-based
measures were not developed because the emphasis at the time was on
buying and deploying long-overdue infrastructure upgrades as quickly as
possible. However, he also stated that the program intends to define,
ensure, and disclose the linkage among program goals, benefits, and
results in the future. To this end, the program manager stated that one
performance measure for each project has been defined as a starting
point and that other outcome-based performance measures will be defined
and used to assess program progress. However, existing program plans
and documentation do not specify how and when this will be done.
The program manager also told us that the state of Atlas's performance
practices are due to competing DHS priorities limiting the resources
that have been devoted to the program. Until the program aligns its
goals, benefits, and performance measures, it will not have the
necessary means for measuring progress, ensuring accountability, and
making well-informed investment decisions.
[NOTE 30] Clinger-Cohen Act of 1996, Public Law 104-106; and Office of
Management and Budget (OMB) Circular A-130, Management of Federal
Information Resources (November 30, 2000).
[NOTE 31] OMB Circular No. A-11, Part 7 (revised July 2004).
Objective 2 Results:
Observations: Expenditure Plan Lacks Detail:
Observation 4: Fiscal year 2004 expenditure plan does not provide
sufficient information on program commitments to permit effective
congressional oversight.
As we have previously reported, [NOTE 32] the legislative requirement
to submit expenditure plans for major IT modernization programs, like
Atlas, to the Appropriations Committees is intended to provide
lawmakers with a sufficient understanding of the programs to permit
informed decision- making about the use of the appropriated funds and
provide a mechanism for holding the agency accountable for results. Our
prior experience in working with Congress and other agencies on
developing and implementing expenditure plans shows that these plans
need to disclose a sufficient level and scope of information for
Congress to understand what the system capabilities and benefits are to
be delivered, by when, at what cost, and what progress is being made
against the commitments.
The Atlas expenditure plan does not show the level of detail and scope
of the program for Congress to understand its plans and commitments
relative to system capabilities, cost, benefits, and schedule. Further,
it does not sufficiently describe progress made against program
commitments (e.g., expected benefits).
Instead, the expenditure plan and supporting documentation describe,
for example, high-level system capabilities to be delivered under each
project, planned expenditure aggregated by project (not linked to
system capabilities). It does not link planned expenditures to system
capabilities, set milestones for delivery of system capabilities, or
discuss benefits to be realized as a result of planned system
investments.
According to the Atlas program manager, the state of the plan reflects
the program's uncertainty about the appropriate level of detail in
expenditure plans. This official also stated that future plans will
reflect GAO's published work on the content of program expenditure
plans. If it does not, the Congress will not have essential information
needed to make informed decisions about expenditure plan approval and
to oversee progress.
[NOTE 32] For example, see GAO, Information Technology. Homeland
Security Needs to Improve Entry Exit System Expenditure Planning, GAO-
03-563 (Washington, D.C.: June 9, 2003).
Conclusions:
The fiscal year 2004 Atlas expenditure plan, in combination with
related program documentation and program officials' statements,
satisfies the legislative conditions set forth by Congress. However,
this satisfaction is based on plans and commitments that provide for
meeting these conditions, rather than on completed actions to satisfy
the conditions. As such, much remains to be accomplished before Atlas
planning and management efforts can be considered effective and thereby
minimize the risks associated with the program's capacity to deliver
promised IT infrastructure capabilities and benefits on time and within
budget.
The current state of planning and management puts the program at risk.
While this is partially due to events beyond the program's control,
such as the department's decision to reprogram Atlas funding and to
redeploy Atlas staff to competing DHS priorities, as well as changes to
the program's scope and purpose when it transitioned from INS to ICE,
it is also due to the program's decision to not use fiscal year 2002
and 2003 funds to invest in program management capabilities.
Given that more than $60 million has been reportedly obligated to date
on the program, resources have been available to strengthen planning
and management capabilities in key areas, but investment in these areas
has been deferred. Deferral of establishing such program planning and
management controls and capabilities, such as having reliable and
current economic justification for the program, a capable program
office, and clearly aligned program goals, benefits, and performance
measures, introduce unnecessary risk to the program.
Moreover, not providing congressional decision-makers with the
information that they need about program commitments to be met with the
expenditure plan funds, including the benefits to be produced, the
capabilities to be delivered, and the cost and schedule estimates to be
met, impedes congressional oversight.
Recommendations for Executive Action:
To minimize risks to the Atlas program, we recommend that the Secretary
of Homeland Security, through the Under Secretary for Border and
Transportation Security, direct the Assistant Secretary for Immigration
and Customs Enforcement to ensure that ICE follows through on
commitments to implement effective management controls and capabilities
by:
* Revising and updating the cost-benefit analysis to identify current
mission requirements, how they will be met, and an estimate of the
program's incremental and life-cycle costs, benefit, schedule, and
return on investment. This should also include establishing plans,
associated tasks, and milestones for accomplishing this effort.
* Making the Atlas program office operational by (1) developing a
staffing needs assessment to determine the positions and the level of
staffing needed for all projects to adequately manage the program,
including a human capital strategy for acquiring the staff and a
timetable for bringing them on board; (2) finalizing the roles and
responsibilities for the positions identified in the staffing
assessment and for the projects; and (3) implementing and
institutionalizing key acquisition management controls, including risk
management processes where relevant responsibilities are assigned and
key risks and their status are reported to an executive body.
Recommendations for Executive Action:
* Developing and implementing an updated Atlas security plan and
privacy impact assessment. This should also include establishing plans,
associated tasks, and milestones for accomplishing this effort.
* Developing and implementing rigorous performance management practices
for the Atlas program that include properly aligned goals, benefits,
and achievements, and anticipated achievements that are defined in
measurable terms. This should also include establishing plans,
associated tasks, and milestones for accomplishing this effort.
* Ensuring that future expenditure plans fully disclose the system
capabilities, schedule, cost-benefits to be delivered, as well as the
acquisition strategy for Atlas.
Agency Comments:
In providing oral comments on a draft of this briefing, ICE's chief
information officer and the Atlas program manager agreed with our
findings and conclusions and stated that our recommendations were
reasonable. They also provided technical comments, which we
incorporated in the briefing as appropriate.
Attachment I: Scope and Methodology:
To accomplish our objectives, we:
* analyzed the fiscal year 2004 Atlas expenditure plan and supporting
documents against legislative conditions and other relevant federal
requirements, guidance, and best practices to determine whether the
conditions were met, and in doing so, considered the conditions met
when the expenditure plan, including supporting program documentation
and program officials' representations, either satisfied or provided
for satisfying the conditions, and:
* assessed supporting documentation and interviewed program and other
involved ICE and DHS officials to determine capabilities in key program
management areas, such as:
- acquisition planning,
- enterprise architecture,
- project management,
- human capital planning, and:
- risk management.
For DHS data that we did not substantiate, we have made appropriate
attribution indicating that data's source.
We conducted our work at ICE and DHS headquarters in Washington, D.C.
from March 2005 through May 2005 in accordance with generally accepted
government auditing standards.
[End of slide presentation]
[End of section]
Appendix II: Comments from the U.S. Department of Homeland Security:
U.S. Department of Homeland Security:
Washington, DC 20528:
August 18, 2005:
Mr. Randolph C. Hite:
Director, Information Technology Architecture and System Issues:
U.S. Government Accountability Office:
Washington, DC 20548:
The Department of Homeland Security (DHS) appreciates the opportunity
to review and comment on the Government Accountability Office's (GAO)
draft report GAO-05-805 entitled, "INFORMATION TECHNOLOGY: Management
Improvements Needed in Immigration and Customs Enforcement's
Infrastructure Modernization Program". The Department concurs with all
recommendations for executive action contained in the report.
To minimize risks to the Atlas program, GAO made the following
recommendations to ensure Immigration and Customs Enforcement (ICE)
follows through on commitments to implement effective management
controls and capabilities.
It should also be noted that with the recent release of expenditure
authority for the ATLAS FY04 funds, ICE is now better positioned to
aggressively address the concerns identified in the GAO Draft Report.
Some of the immediate steps already taken are described below.
GAO Recommendation 1: Revising and updating the cost-benefit analysis,
to identify current mission requirements, how they will be met, and an
estimate of the program's incremental and life cycle costs, benefit,
schedule and return on investment. This should also include
establishing plans, associated tasks and milestones for accomplishing
this effort.
Response: An Atlas Preliminary Business Case was completed on June 21,
2005. It reflects a high-level statement of the planned functionality
and environment established by Atlas. The Atlas Comprehensive Business
Case is being developed and is scheduled for completion by September
30, 2005. The Atlas Comprehensive Business Case will include a detailed
cost benefit analysis, operations and maintenance costs for all six
Atlas projects.
GAO Recommendation 2: Making the Atlas Program office operational by
(1) developing a staffing needs assessment to determine the positions
and the level of staffing needed for all projects to adequately manage
the program, including a human capital strategy for acquiring the staff
and a timetable for bringing them on board; (2) finalizing the roles
and responsibilities for the positions identified in the staffing
assessment and for the projects; and (3) implementing and
institutionalizing key acquisition management controls, including risk
management processes where relevant responsibilities are assigned and
key risks and their status are reported to an executive body.
Response: The Atlas Program Management Office (PMO) has been
established and full project staffing for the Atlas PMO has been
initiated. A draft organizational assessment for the Atlas PMO is
complete and undergoing review by ICE management. The draft
organizational assessment includes a detailed description of functional
roles and responsibilities for each Atlas PMO position. A comprehensive
Atlas staffing plan will be completed by September 30, 2005. Full
project staffing for the Atlas PMO will begin immediately.
Atlas acquisition strategies are reflected in the FY 2005 Atlas
Expenditure Plan, currently undergoing formal DHS management review.
The required Atlas Program Management Plan, Atlas Risk Management Plan,
Atlas Acquisition Plan, and Atlas Acquisition Program Baseline are
scheduled for completion by October 31, 2005.
GAO Recommendation 3: Developing and implementing an updated atlas
security plan and privacy impact assessment. This should also include
establishing plans, associated tasks and milestones for accomplishing
this effort.
Response: A Systems Security Plan, and Systems Security Test Plan, are
being developed and will be completed by December 31, 2005. The Atlas
Privacy Impact Assessment was submitted to the DHS Privacy Office on
August 2, 2005 for review.
GAO Recommendation 4: Developing and implementing rigorous performance
management practices for the Atlas program that include properly
aligned goals, benefits and achievements, and anticipated achievements
that are defined in measurable terms. This should also include
establishing plans, associated tasks and milestones for accomplishing
this effort.
Response: The FY 2005 Atlas Expenditure Plan includes a section
containing outcome measures and an appendix containing proposed Atlas
performance measures. ICE submitted the proposed Atlas performance
measures to the Office of Management and Budget (OMB) on July 13, 2005,
with its PART review.
The Atlas PMO is in the process of developing policies and procedures
to track these performance measures, and acquiring project management
tools to be used to support tracking program/project costs, schedules,
and performance.
GAO Recommendation 5: Ensuring that future expenditure plans fully
disclose the system capabilities, schedule, cost and benefits to be
delivered, as well as the acquisition strategy for Atlas.
Response: The FY 2005 Atlas Expenditure Plan, currently being reviewed
by DHS management, is a 74-page document consisting of an Executive
Summary, six sections and six appendices, and addresses planned
outcomes for each project, including system capabilities, project
schedule, costs, planned budget obligations and Atlas program benefits.
The FY 2005 Atlas Expenditure Plan also outlines acquisition
strategies. Future Atlas Expenditure Plans will be further improved
based upon lessons learned.
We thank you for the opportunity to provide comments on this draft
report and look forward to working with you on future homeland security
issues.
Sincerely,
Signed by:
Steven J. Pecinovsky:
Director, Departmental GAO/OIG Liaison:
[End of section]
Appendix III: GAO Contact and Staff Acknowledgments:
GAO Contact:
Randolph C. Hite, (202) 512-3439:
Staff Acknowledgments:
In addition to the individual named above, Gary Mountjoy, Assistant
Director; Nancy Glover; James Houtz; and Tammi Nguyen made key
contributions to this report.
(310605):
FOOTNOTES
[1] Pub. L. No. 108-90 (Oct. 1, 2003).
[2] During fiscal year 2004, the Department of Homeland Security
reprogrammed about $30.2 million of the $40 million to address other
ICE priorities, thereby leaving $9.8 million for the program.
[3] OMB Circular A-11 establishes policy for planning, budgeting,
acquiring, and managing federal capital assets. Capital investment and
control requirements are now found in OMB Circular A-11, part 7, rather
than in part 3.
[4] An enterprise architecture provides a clear and comprehensive
picture of an organization's operations and its supporting systems and
infrastructure. It is an essential tool for effectively and efficiently
engineering business processes and for implementing and evolving
supporting systems in a manner that maximizes interoperability,
minimizes overlap and duplication, and optimizes performance.
[5] The units include the Federal Air Marshals Service, Federal
Protective Service, Customs investigations, and Customs intelligence.
[6] According to the program manager, Atlas staffs were transferred to
the US-Visitor and Immigrant Status Indicator Technology program in
2003, which is managed by the DHS Under Secretary for Border and
Transportation Security.
GAO's Mission:
The Government Accountability Office, the investigative arm of
Congress, exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability
of the federal government for the American people. GAO examines the use
of public funds; evaluates federal programs and policies; and provides
analyses, recommendations, and other assistance to help Congress make
informed oversight, policy, and funding decisions. GAO's commitment to
good government is reflected in its core values of accountability,
integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through the Internet. GAO's Web site ( www.gao.gov ) contains
abstracts and full-text files of current reports and testimony and an
expanding archive of older products. The Web site features a search
engine to help you locate documents using key words and phrases. You
can print these documents in their entirety, including charts and other
graphics.
Each day, GAO issues a list of newly released reports, testimony, and
correspondence. GAO posts this list, known as "Today's Reports," on its
Web site daily. The list contains links to the full-text document
files. To have GAO e-mail this list to you every afternoon, go to
www.gao.gov and select "Subscribe to e-mail alerts" under the "Order
GAO Products" heading.
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. Government Accountability Office
441 G Street NW, Room LM
Washington, D.C. 20548:
To order by Phone:
Voice: (202) 512-6000:
TDD: (202) 512-2537:
Fax: (202) 512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: www.gao.gov/fraudnet/fraudnet.htm
E-mail: fraudnet@gao.gov
Automated answering system: (800) 424-5454 or (202) 512-7470:
Public Affairs:
Jeff Nelligan, managing director,
NelliganJ@gao.gov
(202) 512-4800
U.S. Government Accountability Office,
441 G Street NW, Room 7149
Washington, D.C. 20548:
