Department of Homeland Security
Billions Invested in Major Programs Lack Appropriate Oversight Gao ID: GAO-09-29 November 18, 2008In fiscal year 2007, the Department of Homeland Security (DHS) obligated about $12 billion for acquisitions to support homeland security missions. DHS's major investments include Coast Guard ships and aircraft; border surveillance and screening equipment; nuclear detection equipment; and systems to track finances and human resources. In part to provide insight into the cost, schedule, and performance of these acquisitions, DHS established an investment review process in 2003. However, concerns have been raised about how well the process has been implemented--particularly for large investments. GAO was asked to (1) evaluate DHS's implementation of the investment review process, and (2) assess DHS's integration of the investment review and budget processes to ensure major investments fulfill mission needs. GAO reviewed relevant documents, including those for 57 DHS major investments (investments with a value of at least $50 million)--48 of which required department-level review through the second quarter of fiscal year 2008; and interviewed DHS headquarters and component officials.
While DHS's investment review process calls for executive decision making at key points in an investment's life cycle--including program authorization--the process has not provided the oversight needed to identify and address cost, schedule, and performance problems in its major investments. Poor implementation of the process is evidenced by the number of investments that did not adhere to the department's investment review policy--of DHS's 48 major investments requiring milestone and annual reviews, 45 were not assessed in accordance with this policy. At least 14 of these investments have reported cost growth, schedule slips, or performance shortfalls. Poor implementation is largely the result of DHS's failure to ensure that its Investment Review Board (IRB) and Joint Requirements Council (JRC)--the department's major acquisition decision-making bodies--effectively carried out their oversight responsibilities and had the resources to do so. Regardless, when oversight boards met, DHS could not enforce IRB and JRC decisions because it did not track whether components took actions called for in these decisions. In addition, many major investments lacked basic acquisition documents necessary to inform the investment review process, such as program baselines, and two out of nine components--which manage a total of 8 major investments--do not have required component-level processes in place. DHS has begun several efforts to address these shortcomings, including issuing an interim directive, to improve the investment review process. The investment review framework also integrates the budget process; however, budget decisions have been made in the absence of required oversight reviews and, as a result, DHS cannot ensure that annual funding decisions for its major investments make the best use of resources and address mission needs. GAO found almost a third of DHS's major investments received funding without having validated mission needs and requirements--which confirm a need is justified--and two-thirds did not have required life- cycle cost estimates. At the same time, DHS has not conducted regular reviews of its investment portfolios--broad categories of investments that are linked by similar missions--to ensure effective performance and minimize unintended duplication of effort for investments. Without validated requirements, life-cycle cost estimates, and regular portfolio reviews, DHS cannot ensure that its investment decisions are appropriate and will ultimately address capability gaps. In July 2008, 15 of the 57 DHS major investments reviewed by GAO were designated by the Office of Management and Budget as poorly planned and by DHS as poorly performing.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-09-29, Department of Homeland Security: Billions Invested in Major Programs Lack Appropriate Oversight
This is the accessible text file for GAO report number GAO-09-29
entitled 'Department Of Homeland Security: Billions Invested in Major
Programs Lack Appropriate Oversight' which was released on November 20,
2008.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Report to the Chairman, Subcommittee on Homeland Security, Committee on
Appropriations, House of Representatives:
United States Government Accountability Office:
GAO:
November 2008:
Department Of Homeland Security:
Billions Invested in Major Programs Lack Appropriate Oversight:
GAO-09-29:
GAO Highlights:
Highlights of GAO-09-29, a report to the Chairman, Subcommittee on
Homeland Security, Committee on Appropriations, House of
Representatives.
Why GAO Did This Study:
In fiscal year 2007, the Department of Homeland Security (DHS)
obligated about $12 billion for acquisitions to support homeland
security missions. DHS‘s major investments include Coast Guard ships
and aircraft; border surveillance and screening equipment; nuclear
detection equipment; and systems to track finances and human resources.
In part to provide insight into the cost, schedule, and performance of
these acquisitions, DHS established an investment review process in
2003. However, concerns have been raised about how well the process has
been implemented”particularly for large investments. GAO was asked to
(1) evaluate DHS‘s implementation of the investment review process, and
(2) assess DHS‘s integration of the investment review and budget
processes to ensure major investments fulfill mission needs. GAO
reviewed relevant documents, including those for 57 DHS major
investments (investments with a value of at least $50 million)”48 of
which required department-level review through the second quarter of
fiscal year 2008; and interviewed DHS headquarters and component
officials.
What GAO Found:
While DHS‘s investment review process calls for executive decision
making at key points in an investment‘s life cycle”including program
authorization”the process has not provided the oversight needed to
identify and address cost, schedule, and performance problems in its
major investments. Poor implementation of the process is evidenced by
the number of investments that did not adhere to the department‘s
investment review policy”of DHS‘s 48 major investments requiring
milestone and annual reviews, 45 were not assessed in accordance with
this policy. At least 14 of these investments have reported cost
growth, schedule slips, or performance shortfalls. Poor implementation
is largely the result of DHS‘s failure to ensure that its Investment
Review Board (IRB) and Joint Requirements Council (JRC)”the
department‘s major acquisition decision-making bodies”effectively
carried out their oversight responsibilities and had the resources to
do so. Regardless, when oversight boards met, DHS could not enforce IRB
and JRC decisions because it did not track whether components took
actions called for in these decisions. In addition, many major
investments lacked basic acquisition documents necessary to inform the
investment review process, such as program baselines, and two out of
nine components”which manage a total of 8 major investments”do not have
required component-level processes in place. DHS has begun several
efforts to address these shortcomings, including issuing an interim
directive, to improve the investment review process.
The investment review framework also integrates the budget process;
however, budget decisions have been made in the absence of required
oversight reviews and, as a result, DHS cannot ensure that annual
funding decisions for its major investments make the best use of
resources and address mission needs. GAO found almost a third of DHS‘s
major investments received funding without having validated mission
needs and requirements”which confirm a need is justified”and two-thirds
did not have required life-cycle cost estimates. At the same time, DHS
has not conducted regular reviews of its investment portfolios”broad
categories of investments that are linked by similar missions”to ensure
effective performance and minimize unintended duplication of effort for
investments. Without validated requirements, life-cycle cost estimates,
and regular portfolio reviews, DHS cannot ensure that its investment
decisions are appropriate and will ultimately address capability gaps.
In July 2008, 15 of the 57 DHS major investments reviewed by GAO were
designated by the Office of Management and Budget as poorly planned and
by DHS as poorly performing.
Table: DHS Major Investments Lacking Appropriate Oversight:
Oversight element: DHS review in accordance with policy;
Applicable investments: 48;
Number lacking element: 45;
Percent lacking element: 94.
Oversight element: Required information at key decision points;
Applicable investments: 34;
Number lacking element: 27;
Percent lacking element: 79.
Oversight element: Life-cycle cost estimate;
Applicable investments: 57;
Number lacking element: 39;
Percent lacking element: 68.
Source: GAO.
[End of table]
What GAO Recommends:
GAO is making several recommendations aimed at better ensuring DHS
fully implements and adheres to its investment review process,
including tracking major investments and better integrating oversight
results with budget decisions. DHS generally concurred with these
recommendations.
To view the full product, including the scope and methodology, click on
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-09-29]. For more
information, contact John Hutton at (202) 512-4841 or huttonj@gao.gov.
[End of section]
Contents:
Letter:
Results in Brief:
Background:
Lack of Adherence to the Investment Review Process Led to Oversight
Being Seldom Applied to Support Successful Acquisition Outcomes:
DHS's Investment Review and Budget Processes Are Not Integrated to Help
Ensure That Major Investments Maximize Resources to Meet Mission Needs:
Conclusions:
Recommendations for Executive Action:
Agency Comments and Our Evaluation:
Appendix I: Scope and Methodology:
Appendix II: Comments from the Department of Homeland Security:
Appendix III: Key Acquisition Documents by Major Investment:
Appendix IV: Department of Homeland Security Investments Reviewed by
GAO:
Tables:
Table 1: Investment Review Levels and Approval Authorities:
Table 2: DHS Investment Oversight Entities and Responsibilities:
Table 3: DHS Major Investments That Reported Cost Growth from Fiscal
Year 2007 to the Second Quarter of Fiscal Year 2008:
Table 4: DHS Investments without a Mission Needs Statement in Fiscal
Year 2008:
Table 5: Documentation for Investments in Phases That Require All Key
Acquisition Documents:
Figures:
Figure 1: DHS Investment Review Process:
Figure 2: Traceability of Key Acquisition Documents:
Figure 3: DHS Planning, Programming, Budgeting, and Execution Phases of
the Budget Process:
Abbreviations:
CBP: Customs and Border Protection:
CFO: Chief Financial Office:
CIS: Citizenship and Immigration Services:
CPO: Chief Procurement Office:
DHS: Department of Homeland Security:
DOD: Department of Defense:
FEMA: Federal Emergency Management Agency:
ICE: Immigration and Customs Enforcement:
IRB: Investment Review Board:
IT: information technology:
JRC: Joint Requirements Council:
OMB: Office of Management and Budget:
TSA: Transportation Security Administration:
US-VISIT: U.S. Visitor and Immigrant Status Indicator Technology:
[End of section]
United States Government Accountability Office:
Washington, DC 20548:
November 18, 2008:
The Honorable David E. Price:
Chairman:
Subcommittee on Homeland Security:
Committee on Appropriations:
House of Representatives:
Dear Mr. Chairman,
Since it was established in 2003, the Department of Homeland Security
(DHS) has been responsible for integrating 22 federal agencies with
disparate missions into one department. In fiscal year 2007, DHS
obligated about $12 billion for acquisitions to support homeland
security missions including responding to threats and hazards to the
nation and ensuring safe and secure borders. DHS components and offices
sponsor investments, and this portfolio[Footnote 1] includes Coast
Guard ships and aircraft; border surveillance and screening equipment;
nuclear detection equipment; and systems to track finances and human
resources. DHS plans to spend over $60 billion to acquire and sustain
such investments.
To help ensure these broad and complex acquisitions achieve the
department's national security mission, DHS established two key
processes in 2003: investment review and budgeting. Where the budget
process is used to allocate resources for DHS acquisitions, the
investment review process is intended to provide departmental insight
at key points in an investment's life cycle to assess the cost,
schedule, and performance of these acquisitions. However, concerns have
been raised about how well the investment review process has been
defined and implemented--particularly for large investments--to achieve
successful acquisition outcomes. Weaknesses in the investment review
process can have a rippling effect on the budget process because these
reviews are expected to inform annual funding decisions for major
investments. Since 2005, DHS has been revising the investment review
process and identified completing this effort as a priority in its 2008
high-risk management plan.[Footnote 2] Over this period, we have made a
series of recommendations to DHS aimed at strengthening its investment
review process.
Because of the large commitment of resources for these investments, you
asked us to (1) evaluate DHS's implementation of the investment review
process, and (2) assess DHS's integration of the investment review and
budget processes to ensure major investments fulfill mission needs.
To conduct our work, we reviewed relevant GAO and DHS Inspector General
reports and DHS documents, such as management directives and investment
oversight guidance provided to components. We reviewed decision memos
and investment documents for all 57 level 1 and level 2 major
investments identified by DHS. We specifically determined the level of
oversight provided for 48 of these major investments--those that
required department-level review from fiscal year 2004 through the
second quarter of fiscal year 2008. We compared DHS budget practices
with GAO and Office of Management and Budget (OMB) guidance on capital
programming principles. We also interviewed representatives of the
Chief Procurement Office (CPO), Chief Financial Office (CFO) and Chief
Information Office as well as nine DHS components and offices that
manage major investments. We conducted this performance audit from
September 2007 until November 2008 in accordance with generally
accepted government auditing standards. Those standards require that we
plan and perform the audit to obtain sufficient, appropriate evidence
to provide a reasonable basis for our findings and conclusions based on
our audit objectives. We believe that the evidence obtained provides a
reasonable basis for our findings and conclusions based on our audit
objectives. See appendix I for additional information on our scope and
methodology.
Results in Brief:
DHS has not effectively implemented or adhered to its investment review
process, which calls for executive decision making at key points in an
investment's life cycle--including program authorization--due to a lack
of senior management officials' involvement as well as limited
monitoring and resources; consequently, DHS has not provided the
oversight needed to identify and address cost, schedule, and
performance problems in its major investments. Of 48 major investments
requiring milestone or annual reviews, 45 were not reviewed in
accordance with the department's investment review policy, and 18 were
not reviewed at all. Four of these investments have transitioned into a
late acquisition phase--production and deployment--without any required
reviews. Poor implementation is largely the result of DHS's inability
to ensure that its Investment Review Board (IRB) and Joint Requirements
Council (JRC)--the department's major acquisition decision-making
bodies--effectively carried out their oversight responsibilities and
had sufficient resources such as personnel to support the oversight
function. Over the past several years, IRB and JRC review activities
did not keep pace with investments requiring review. Moreover, DHS
could not enforce decisions that were reached because the department
did not track whether components took the actions called for by the
IRB, such as addressing program requirement and performance
deficiencies. In addition, many major investments lacked required
acquisition documents necessary to guide and measure program
performance as well as inform the investment review process, such as
program baselines and, of those, over a third had cost growth, schedule
slips, or performance shortfalls from fiscal year 2007 through the
second quarter of fiscal year 2008. We also found that two components
that manage 8 major investments do not have required component-level
review systems in place. DHS has recognized these shortcomings and in
2007 began several efforts to clarify and better adhere to the
investment review process and released an interim acquisition
management directive in November 2008.
The investment review framework also integrates the budget process;
however, budget decisions have been made in the absence of oversight
reviews and, as a result, DHS cannot ensure that annual funding
decisions for its major investments make the best use of resources and
address mission needs. DHS officials explained that linking budget
decisions to investment oversight has been difficult due to the erratic
investment review schedule and that budget reviews can be the only
oversight provided. We found almost a third of DHS's 57 major
investments received funding without having IRB or JRC validated
mission needs and requirements--a milestone that confirms a need is
justified. GAO, OMB, and commercial best practices underscore the need
to validate requirements before allocating resources. In addition, two
thirds of DHS major investments did not have required life-cycle cost
estimates, which are essential to making informed budget decisions. At
the same time, DHS has not conducted regular reviews of its investment
portfolios--broad categories of investments that are linked by similar
missions--to ensure effective performance and minimize unintended
duplication of effort for proposed and ongoing investments. Without
validated mission needs, life-cycle cost estimates, and regular
portfolio reviews, DHS cannot ensure that its investments will
ultimately address capability gaps and avoid funding unintended
duplication of effort. As of July 2008, more than a quarter of DHS
major investments were on both the OMB Management Watch List and list
of high-risk projects with shortfalls, meaning that they are both
poorly planned and poorly performing. The DHS Undersecretary for
Management has said that strengthening the links between investment
review and budget decisions is a top priority.
To improve investment oversight, we are recommending that the Secretary
of Homeland Security take several actions to better ensure DHS and its
components fully implement and adhere to the investment review process,
including tracking major investments and better integrating oversight
results with budget decisions. DHS generally concurred with our
recommendations, citing actions taken and efforts under way to improve
the investment review process. The department's comments are reprinted
in appendix II. DHS components provided technical comments which were
incorporated as appropriate and where supporting documentation was
provided.
Background:
DHS invests in a wide array of complex acquisitions to achieve its
national security mission. DHS components and offices sponsor
investments to address mission capability gaps and are the end-users of
the developed acquisitions. DHS has stated that the Undersecretary for
Management, as the Chief Acquisition Officer, is responsible for
acquisition policy. The purpose of DHS's investment review and budget
processes are to provide oversight of these major investments.
Specifically, DHS established the investment review process in 2003 to
help protect its major investments by providing departmental oversight
of major investments throughout their life cycles and to help ensure
that funds allocated for investments through the budget process are
being spent wisely, efficiently, and effectively. In 2005, we reported
that this process adopted many acquisition best practices that, if
applied consistently, could help increase the chances for successful
outcomes.[Footnote 3] However, we noted that incorporating additional
program reviews and knowledge deliverables into the process could
better position DHS to make well-informed decisions. In 2007, we
further reported that DHS had not fully defined and documented policies
and procedures for investment management or fully implemented key
practices needed to control its information technology (IT)
investments.[Footnote 4] To strengthen DHS's investment management
capability, we recommended that the department fully define and
document project and portfolio-level policies and procedures and
implement key control processes. In addition to the investment review
process, the DHS budget process serves as the framework for decision
making for ongoing and future DHS programs. The framework is cyclic,
consisting of planning, programming, budgeting, and execution phases
that examine existing program funding and link the funding to program
performance to ensure funds are expended appropriately and that they
produce the expected results and benefits.
The investment review process framework manages investment risk
[Footnote 5] by developing an organized, comprehensive, and iterative
approach to identifying; assessing; mitigating; and continuously
tracking, controlling, and documenting risk tailored to each project.
The investment review process has four main objectives: (1) identify
investments that perform poorly, are behind schedule, are over budget,
or that lack capability, so officials can identify and implement
corrective actions; (2) integrate capital planning and investment
control with resource allocation and investment management; (3) ensure
that investment spending directly supports DHS's mission and identify
duplicative efforts for consolidation; and (4) ensure that DHS conducts
required management, oversight, control, reporting, and review for all
major investments.[Footnote 6] The process requires event-driven
decision making by high-ranking executives at a number of key points in
an investment's life cycle. The investment review process provides
guidance to components for all DHS investments, but it requires formal
[Footnote 7] department-level review and approval only for major
investments--those that are categorized as level 1 or 2 (see table 1).
[Footnote 8]
Table 1: Investment Review Levels and Approval Authorities:
Level: 1;
Review/approval: Investment Review Board (IRB) reviews and approves;
Acquisition costs[A]: Greater than $100 million;
Life cycle costs[B] (Applies only to IT Investments): Greater than $200
million.
Level: 2;
Review/approval: Joint Requirements Council (JRC) reviews and approves;
Acquisition costs[A]: Between $50 million and $100 million;
Life cycle costs[B] (Applies only to IT Investments): Between $100
million and $200 million.
Source: DHS Management Directive No. 1400.
[A] All costs for acquiring, by contract, interagency agreement, or for
other funding instruments, supplies and/ or services for a designated
investment through purchase or lease, whether the supplies are already
in existence or must be created, developed, demonstrated, and
evaluated, and without regard to the type of funds used, whether
appropriated or nonappropriated.
[B] The total cost to the federal government of acquiring, operating,
supporting, and, if applicable, disposing of the items being acquired.
[End of table]
The investment review process has two types of reviews: programmatic
and portfolio. Programmatic reviews are held at specific milestones and
require documentation and discussion commensurate with the investment's
life cycle phase. These reviews contribute to the investment review
goal of identifying investments that perform poorly, are behind
schedule, are over budget, or that lack capability so officials can
identify and implement corrective actions. Portfolio reviews are
designed to identify efforts for consolidation and mission alignment by
monitoring and assessing broad categories of investments that are
linked by similar missions to ensure effective performance,
minimization of overlapping functions, and proper funding. The IRB and
JRC are responsible for reviewing, respectively, level 1 and level 2
investments at key milestone decision points, but no less than
annually, and provide strategic guidance (see table 2). In addition to
requiring department-level review, DHS policy directs component heads
to conduct appropriate management and oversight of investments and
establish processes to manage approved investments at the component
level.[Footnote 9]
Table 2: DHS Investment Oversight Entities and Responsibilities:
Investment Review Board (IRB):
Level of review: Department;
Membership: Investment Review Board (IRB):
* Deputy Secretary (Chair);
* Under Secretary for Management (Vice Chair);
* Chief Financial Officer (CFO), Chief Procurement Officer (CPO), Chief
Information Officer;
* Office of the Secretary, Policy Office, Office of the General
Counsel;
* Director, Program Analysis and Evaluation (Executive Secretary);
* Chair, Joint Requirements Council (JRC) (Adjunct Member);
Examples of responsibilities:
* Review, validate, and approve all level 1 investments;
* Review and validate portfolio placement and alignment with the
strategic mission;
* Provide strategic guidance for the JRC and programs.
Joint Requirements Council (JRC):
Level of review: Department;
Membership: Investment Review Board (IRB):
* Chair appointed by the Deputy Secretary;
* Senior managers from each component and DHS line of business, General
Counsel designee;
* Director, Program Analysis and Evaluation (Executive Secretary);
Examples of responsibilities:
* Provide milestone reviews and approvals of level 2 investments;
* Manage investment portfolios, including determining portfolio
structure for an investment, conducting portfolio reviews, and making
portfolio-related recommendations to the IRB;
* Validate requirements through the Mission Needs Statements and review
projects to identify cross-functional requirements and applications.
Heads of components and offices:
Level of review: Component;
Membership: Investment Review Board (IRB):
* Chief Operating Officer from each component, for example:
Undersecretary, Administrator, Director, Chief Operating Officer, or
designee;
Examples of responsibilities:
* Approve all level 3 and 4 investments and ensure they comply with
DHS's investment review requirements[A];
* Establish processes and provide the requisite resources to manage
approved investments adequately;
* Submit joint/consolidated investments through the investment review
process.
Source: DHS Management Directive No. 1400.
[A] Level 3 investments have total acquisition costs between $5 million
and $50 million or IT life cycle costs between $20 million and $100
million. Level 4 investments have acquisition costs less than $5
million or IT life cycle costs less than $20 million.
[End of table]
The investment review process has three broad life cycle stages,
covering five investment phases and four decision points or milestones
(see fig. 1). In the preacquisition stage, gaps are to be identified
and capabilities to address them defined. In the first phase of the
acquisition stage--concept and technology development--requirements are
to be established and alternatives explored. In the next phase--
capability development and demonstration--prototypes are to be
developed. In the final acquisition phase, the assets are produced and
deployed. With the high dollar thresholds and inherent risk of level 1
and level 2 investments, IRB or JRC approval at milestone decision
points is important to ensure that major investment performance
parameters and documentation are satisfactorily demonstrated before the
investment transitions to the next acquisition phase. IRB and JRC
milestone reviews are not required once an investment reaches the
sustainment phase.
Figure 1: DHS Investment Review Process:
[Refer to PDF for image]
This figure is an illustration of the DHS Investment Review Process, as
follows:
Decision point: [Empty];
Investment phase: Program initiation;
Lifecycle phase: Preacqusition.
Decision point: 1: Program authorization;
Investment phase: Concept and technology development;
Lifecycle phase: Acquisition.
Decision point: 2: Alternative selection;
Investment phase: Capability development and demonstration;
Lifecycle phase: Acquisition.
Decision point: 3: Project decision;
Investment phase: Production and deployment;
Lifecycle phase: Acquisition.
Decision point: 4: Predeployment decision;
Investment phase: Operations and support;
Lifecycle phase: Sustainment.
Source: GAO presentation of DHS data.
[End of figure]
As designed, knowledge developed during each investment phase is to be
captured in key documents and is to build throughout the investment
life cycle. Performing the disciplined analysis required at each phase
is critical to achieving successful outcomes. The main goals of the
first investment phase, program initiation, are to determine gaps in
capabilities and then describe the capabilities to fill the gap--this
information is then captured in the mission needs statement. If the
mission needs statement is approved, the investment then moves to the
concept and technology development phase, which focuses both on setting
requirements and important baselines for managing the investment
throughout its life cycle. A key step in this phase is translating
needs into specific operational requirements, which are captured in the
operational requirements document. Operational requirements provide a
bridge between the functional requirements of the mission needs
statement and the detailed technical requirements that form the basis
of the performance specifications, which will ultimately govern
development of the system. Once the program has developed its
operational requirements document, it then uses these requirements to
inform the development of its acquisition program baseline, a critical
document that addresses the program's critical cost, schedule, and
performance parameters and is expressed in measurable terms. See figure
2 for a description of the documents.[Footnote 10]
Figure 2: Traceability of Key Acquisition Documents:
[Refer to PDF for image]
This figure is an illustration of the traceability of key acquisition
documents, as follows:
* Mission Needs Statement:
A formal description of the strategic need for an investment. It links
the gap in mission capability to the investments that will fill that
gap.
The capability gap described in the mission needs statement is
translated into system level performance capabilities to fill that gap.
* Operational Requirements Document:
Describes the operating environment, functions to be performed, the
need for interoperability with other systems, and other requirements.
It ultimately drives system performance and capability.
The performance parameters in the operational requirements document are
used to establish the performance baseline of the acquisition program
baseline.
* Acquisition Program Baseline:
Used to measure project performance, it summarizes critical cost,
schedule, and performance parameters, expressed in measurable,
quantitative terms that must be met to accomplish the goals of the
investment.
Must trace directly back to the mission gap expressed in the mission
needs statement and the requirements detailed in the operational
requirements document.
Source: GAO presentation of key acquisition documents.
[End of figure]
The department's budget policy has two main objectives: (1) articulate
DHS goals and priorities, and (2) develop and implement a program
structure and resource planning to accomplish DHS goals.[Footnote 11]
DHS uses the process to determine investment priorities and allocate
resources each year. The budget process emphasizes the importance of
ensuring investments expend funds appropriately and that investment
performance produces the expected benefits or results. IRB decisions
and guidance regarding new investments are to be reflected to the
extent possible in any iteration of the budget as appropriate. The
Office of the Chief Financial Officer (CFO) manages the budget process.
Lack of Adherence to the Investment Review Process Led to Oversight
Being Seldom Applied to Support Successful Acquisition Outcomes:
DHS has not effectively implemented or adhered to its investment review
process due to a lack of involvement by senior officials as well as
limited resources and monitoring; consequently, DHS has not identified
and addressed cost, schedule, and performance problems in many major
investments. Poor implementation largely rests on DHS's inability to
ensure that the IRB and JRC effectively carried out their oversight
responsibilities. Of 48 major investments requiring department-level
review,[Footnote 12] 45 were not reviewed in accordance with the
department's investment review policy, and 18 were not reviewed at all.
In the absence of IRB and JRC meetings, investment decisions were
reached outside of the required review process. Moreover, when IRB
meetings were held, DHS did not consistently enforce decisions that
were reached because the department did not track whether components
and offices took the actions required by the IRB. In addition, 27 major
investments have not developed or received DHS approval for basic
acquisition documents required to guide and measure the performance of
program activities--and the investment review process. Of those, over a
third reported cost, schedule, or performance breaches in fiscal year
2007 and second quarter fiscal year 2008. According to DHS
representatives, acquisition management practices are still new to many
components, and we found 24 investments lacked certified program
managers needed to develop basic acquisition documents. We found that
two out of nine components do not have required component-level review
processes to adequately manage their major investments. DHS has
recognized these deficiencies and began efforts in 2007 to clarify and
better adhere to the investment review process.
Most Major Investments Lacked Required Departmental Reviews and Many of
Those Exceeded Cost Estimates:
Of DHS's 48 major investments requiring department-level review between
fiscal year 2004 and the second quarter of fiscal year 2008, only three
had all milestone and annual reviews. Of the 39 level 1 investments
requiring IRB review and approval[Footnote 13] to proceed to the next
acquisition phase, as of March 2008, 18 have never been reviewed by the
IRB--4 of which have already reached production and deployment. The
remaining 21 level 1 investments received at least one milestone or
annual review through the investment review process. None of the 9
level 2 investments had JRC[Footnote 14] review and approval. DHS
policy provides that its major investments be reviewed no less than
yearly.[Footnote 15] However, in fiscal year 2007, the most recent year
for which data were available, only 7 of the 48 required annual reviews
were conducted. As a result, DHS lacked the information needed to
address cost, schedule, and performance deficiencies--a problem we
identified with over one-third of DHS's major investments between
fiscal year 2007 and the second quarter of fiscal year 2008. In our
prior work on the Department of Defense (DOD), we found that when such
reviews are skipped or not fully implemented, programs build momentum
and move toward product development with little if any early department-
level assessment of the costs and feasibility. Committing to programs
before they have this knowledge contributes to poor cost, schedule, and
performance outcomes.[Footnote 16]
DHS level 1 investments that were never reviewed through the IRB
process include some of the department's largest investments with
important national security objectives. For example, the Federal
Emergency Management Agency's (FEMA) Consolidated Alert and Warning
System, which has estimated life-cycle costs of $1.6 billion, includes
programs to update the Emergency Alerting System and other closely
related projects. In 2007, we reported that FEMA faces technical,
training, and funding challenges to develop an integrated alert and
warning system.[Footnote 17] Customs and Border Protection's (CBP)
Secure Freight Initiative, which has estimated life-cycle costs of $1.7
billion, is designed to test the feasibility of scanning 100 percent of
U.S.-bound cargo containers with nonintrusive equipment and radiation
detection equipment at foreign seaports. Earlier this year, we reported
that the Secure Freight Initiative faces a number of challenges,
including measuring performance outcomes, logistical feasibility of
some aspects of the investment, and technological issues.[Footnote 18]
While these two investments are still in the concept and technology
development phase, other major investments that have not been reviewed
are even further along in the investment life cycle--when problems
become more costly to fix. For example, CBP's Western Hemisphere Travel
Initiative, with estimated life-cycle costs of $886 million, is in
capability development and demonstration. The investment aims to
improve technologies to identify fraudulent documentation at U.S. ports
of entry. We recently reported that because key elements of planning
for the investment's management and execution remain uncertain, DHS
faces challenges deploying technology, and staffing and training
officers to use it.[Footnote 19]
Reviews of the 9 level 2 investments--those with acquisition costs
between $50 million and $100 million, or $100 million to $200 million
for information technology--were similarly lacking. While the JRC met
periodically between fiscal years 2004 and 2006, senior officials
stated that it did not make approval decisions about any level 2
investments. As a result, investments such as the following--which are
all now in the operations and support phase--were not reviewed and
approved by the JRC:
* FEMA's Total Asset Visibility, which has $91 million in estimated
life-cycle costs, aims to improve emergency response logistics in the
areas of transportation, warehousing, and distribution.
* Transportation and Security Administration's (TSA) Hazardous Threat
Assessment Program, which has $181 million in estimated life-cycle
costs, was developed to perform a security threat assessment on
applicants for licenses to transport hazardous materials.
* The National Protection and Programs Directorate's National Security
and Emergency Preparedness investment, which has $1.8 billion in
estimated life-cycle costs, aims to provide specially designed
telecommunications services to the national security and emergency
preparedness communities in the event of a disaster if conventional
communication services are ineffective.
During 2006, the JRC stopped meeting altogether after the chair was
assigned to other duties within the department. DHS representatives
recognized that since the JRC stopped meeting in 2006, there has been
no direction for requirements or oversight of level 2 investments at
the department level and that strengthening the JRC is a top priority.
In the meantime, oversight of level 2 investments has devolved to the
components.
Without the appropriate IRB and JRC milestone reviews, DHS loses the
opportunity to identify and address cost, schedule, and performance
problems and, thereby, minimize program risk. Fourteen of the
investments that lacked appropriate review through IRB and JRC
oversight experienced cost growth, schedule delays, and
underperformance--some of which was substantial. At least 8 investments
reported cost growth between fiscal year 2007 and the second quarter of
fiscal year 2008 (see table 3). Other programs experienced schedule
delays and underperformance. For example, CBP's Automated Commercial
Environment program reported a 20 percent performance shortfall in the
first quarter of fiscal year 2008. Moreover, we reported in July 2008
that the Coast Guard's Rescue 21 program changed its acquisition
baseline or cost, schedule, and performance goals four times resulting
in a total 182 percent cost growth and 5-year schedule slip.[Footnote
20]
Table 3: DHS Major Investments That Reported Cost Growth from Fiscal
Year 2007 to the Second Quarter of Fiscal Year 2008:
Investment: Chief Information Office: Infrastructure Transformation
Program;
Cost growth: 31 percent.
Investment: Coast Guard; Rescue 21;
Cost growth: 16 percent[A].
Investment: Customs and Border Protection (CBP); Border Patrol
Facilities;
Cost growth: 16 percent.
Investment: Customs and Border Protection (CBP); Consolidated Trusted
Traveler Program;
Cost growth: 23 percent.
Investment: Department of Homeland Security (DHS); Homeland Secure Data
Network;
Cost growth: 11 percent.
Investment: Federal Emergency Management Agency (FEMA); Disaster
Management E-Government;
Cost growth: 93 percent.
Investment: Immigration and Customs Enforcement (ICE); Detention and
Removal Modernization;
Cost growth: 8 percent.
Investment: Transportation Security Administration (TSA); Electronic
Baggage Screening Program;
Cost growth: 10 percent.
Source: GAO presentation of DHS data.
[A] The Coast Guard reported that it subsequently made progress in
reducing cost growth in the Rescue 21 program.
[End of table]
DHS has acknowledged that the IRB and JRC have not conducted oversight
in accordance with DHS policy--largely because the process has depended
on direct involvement and availability of high-level leadership as well
as a lack of sufficient staff resources to organize the review
meetings. According to DHS representatives, the Deputy Secretary was
unavailable to commit to the time required to conduct reviews of all
investments, so only some major investments were reviewed. Our prior
work shows that this problem existed from the start. For example, in
2004, we reported that DHS was having difficulty bringing all of its
information technology programs before the IRB in a timely manner.
[Footnote 21] We reported in 2005 that key stakeholders, such as the
Chief Procurement Officer, did not receive materials in time to conduct
a thorough review and provide meaningful feedback prior to investment
review meetings and recommended that DHS ensure that stakeholders,
including CPO officials, have adequate time to review investment
submissions and provide formal input to decision-making review boards.
[Footnote 22] Moreover, in 2007, we reported that DHS investment boards
did not conduct regular investment reviews and control activities were
not performed consistently across projects.[Footnote 23] DHS Chief
Procurement Office and Chief Financial Office representatives added
that the process was not adequately staffed to conduct annual reviews
of investments as required by the investment review policy. We have
previously recommended that DHS provide adequate resources, including
people, funding, and tools, for oversight of major investments.
[Footnote 24] A 2007 DHS assessment of 37 major investments found that
many investments are awaiting senior management review. For example,
FEMA's major investment, the flood map modernization program, requested
a key investment review decision meeting in 2004 that was subsequently
scheduled and canceled in 2006. As a result, the program proceeded from
development to operations and support without IRB review or approval.
Because of these limitations, alternative approaches to obtaining
decisions were adopted. Numerous officials reported that rather than
going through the formal investment review process, in some cases DHS
component officials began to seek approval directly from the Deputy
Secretary. For example, in November 2006, the DHS Inspector General
reported on the CBP's Secure Border Initiative program, noting that the
investment oversight processes were sidelined in the urgent pursuit of
SBInet's aggressive schedule and that the IRB and JRC processes were
bypassed and key decisions about the scope of the program and the
acquisition strategy were made without rigorous review and analysis or
transparency.[Footnote 25] DHS officials indicated that some decisions
were very informal, based on conversations with the Deputy Secretary
and without input from other IRB members. In such cases, the investment
review process was bypassed, including consideration of supporting
reviews and recommendations. DHS CPO and CFO representatives said they
did not always know whether a decision had been made through this
informal process.
Many Programs Lack Required Cost, Schedule, and Performance Data
Critical to Informing Investment Decisions:
DHS investment review policy requires programs to develop specific
documentation that captures key knowledge needed to make informed
investment decisions.[Footnote 26] This approach is similar to DOD's,
which requires adequate knowledge at critical milestones to reduce the
risk associated with each phase of the investment's life cycle and
enable program managers to deliver timely, affordable, quality
products.[Footnote 27] GAO's work on commercial best practices for
major acquisitions has demonstrated that this approach, if effectively
implemented, can significantly improve program outcomes.[Footnote 28]
Our prior work has found that inadequate attention to developing
requirements results in requirements instability, which can ultimately
cause cost escalation, schedule delays, and fewer end items.
Many major DHS investments do not have basic acquisition information
required by investment review policy to guide and measure the
performance of program activities and the investment review process. In
particular, mission needs statements, operational requirements
documents, and acquisition program baselines establish capability gaps,
requirements needed to address gaps, and cost, schedule, and
performance parameters, respectively. As of March 2008, of the 57 level
1 and 2 investments, 34 were in a phase that required all three
documents, but 27 did not have or only provided an unapproved draft of
one or more of these documents (see appendix III for the investments
lacking these approved documents). Of the 27 investments, we found that
over a third reported cost, schedule, or performance breaches between
fiscal year 2007 and second quarter fiscal year 2008. For example, the
Infrastructure Transformation program, which did not have an approved
operational requirements document or acquisition program baseline,
reported being up to 19 percent behind schedule in 2007. In another
instance, the Immigration and Customs Enforcement (ICE) Detention and
removal modernization program, which also lacked an approved
operational requirements document and acquisition program baseline,
reported schedule slippage of about 20 percent. Without required
development and review of key acquisition data, DHS cannot be sure that
programs have mitigated risks to better ensure good outcomes.
CPO representatives explained that department acquisition management
practices are new to many DHS components. For most investments, CPO
representatives said that program managers were not familiar with basic
acquisition documents and investment oversight staff had to work with
program managers to help them develop these documents prior to
investment reviews. In addition, we found that in fiscal year 2007, 24
major investments did not have program managers certified by DHS as
having the required knowledge and skills to oversee complex acquisition
programs.[Footnote 29] Moreover, other factors such as pressure to get
programs up and running, additional external requirements, and
technological challenges also impact the ability to successfully manage
acquisitions to support good acquisition outcomes. At the same time,
some component officials said that they received insufficient and
inconsistent guidance regarding what information should be included in
key acquisition documents. This issue is long-standing. For example, we
reported in 2005 that because of the small number of department
oversight staff, only limited support was provided to programs to
assist them in completing their submissions for oversight reviews.
[Footnote 30] In addition, component officials told us that key
acquisition documents are sometimes approved at the component level but
are not reviewed and approved at the department level. For example, TSA
officials indicated that documents needed for the Secure Flight and
Passenger Screening Programs were approved by TSA and submitted to DHS
for approval, but no action was taken to review and approve them.
Major Investments Move Forward without Addressing Deficiencies
Identified in Reviews:
The investment reviews that have been conducted have not always
provided the discipline needed to help ensure programs achieve cost,
schedule, and performance goals--even when a review identified
important deficiencies in an acquisition decision memorandum. DHS has
not routinely followed up on whether specific actions required by
acquisition decision memorandums to mitigate potential risks have been
implemented.
The IRB issued a 2004 acquisition decision memorandum approving the
U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT)--a
program that aims to facilitate travel and trade--to move into the
capability development and demonstration phase although the IRB found
the investment's cost, schedule, and performance risk to be high. The
memorandum stated that more clarity was needed on the program's end-
state capability, benefits related to life-cycle costs, and how it
planned to transition to the operations and support phase. We reported
that in 2006 DHS had yet to develop a comprehensive plan describing
what the end-state capability would be, and how, when, and at what cost
it would be delivered.[Footnote 31] In a 2006 decision memorandum, the
IRB again instructed US-VISIT to address the end-state capability, by
requiring a comprehensive affordable exit plan for airports, seaports,
and landports. We subsequently reported that, as of October 2007, US-
VISIT had yet to establish critical investment management processes,
such as effective project planning, requirements management, and
financial management, which are required to ensure that program
capabilities and expected mission outcomes are delivered on time and
within budget.[Footnote 32] In addition, DHS had not developed
capability for the other half of US-VISIT, even though it had allocated
about one-quarter of a billion dollars to this effort.
In a May 2006 decision memorandum, the IRB directed the Cargo Advanced
Automated Radiography System investment to develop within 6 months an
acquisition program baseline, a concept of operations, and an
operational requirements document. It also called for the investment to
be reviewed annually. As of the second quarter of fiscal year 2008, a
baseline and the concept of operations had been drafted, according to
program officials. However, an operational requirements document had
not been developed even though a $1.3 billion contract had been awarded
for the investment. In addition, the Cargo Advanced Automated
Radiography System investment had not yet received a follow-on review
by the IRB. In another example, in a December 2006 decision memorandum,
the IRB directed ICE's major investment Automation and Modernization to
update its acquisition program baseline, its cost-benefit analysis and
its life-cycle cost analysis. Automation and Modernization has since
updated its acquisition program baseline, but its cost analyses were
last updated in 2005.
Current and former CPO and CFO representatives noted that staffing has
not been sufficient to review investments in a timely manner and
conduct follow-up to ensure decisions are implemented. They indicated
that support was needed to undertake a number of functions, including:
designing the investment review process, collecting and reviewing
investment documentation, preparing analyses to support investment
decisions, and organizing review meetings, as well as conducting follow-
up for major investments. According to DHS representatives, from 2004
to 2007 there were four full-time equivalent DHS employees plus support
from four contractors to fulfill those responsibilities. Many
acquisition decision memos provided specific deadlines for components
to complete action items, but according to CPO and CFO representatives
IRB action items were not tracked. Without follow-up, the IRB did not
hold components and major investment program offices accountable for
addressing oversight concerns.
Component-Level Review Processes Are Not Fully Developed to Ensure That
Major Investments Receive Oversight:
DHS's investment review process requires that component heads establish
processes and provide the requisite resources to manage approved
investments adequately. Component heads are also responsible for
approving all level 3 and level 4 investments and ensuring they comply
with DHS investment review submission requirements. In the absence of
sufficient review at the department level, well-designed component-
level processes are particularly critical to ensuring that investments
receive some level of oversight. For example, CBP and TSA officials
reported that they relied on their component investment review
processes to ensure some level of oversight when the department did not
review their investments. However, for the nine components we reviewed,
two did not have a process in place and others had processes that were
either in development or not focused on the entire investment life
cycle. For example, the Domestic Nuclear Detection Office and the
National Protection and Programs Directorate did not have a formal
investment review process, meaning that in the absence of an IRB or JRC
review, their eight major investments received no formal review. While
FEMA has a process to manage contract-related issues, its review
process does not currently address the entire investment life cycle.
According to CPO representatives, the department is working with
components to ensure that components have a process in place to manage
investments and to have them designate an acquisition officer who is
accountable for major investments at the component level.
Gaps in Oversight Have Prompted DHS to Clarify the Investment Review
Process:
DHS has acknowledged that the investment review process has not been
fully implemented. In fact, the process has been under revision since
2005. DHS has begun to make improvements to the planning, execution,
and performance of major investments as initial steps to clarify and
better adhere to the investment review process. To gain an
understanding and awareness of DHS's major investments, in 2007 during
the course of our review, the Undersecretary for Management undertook
an assessment of 37 major investments conducted under the CPO's
direction. The assessment identified a range of systemic weaknesses in
the implementation of its investment review process and in the process
itself. The DHS assessment found:
* many level 1 investments await leadership decisions;
* acquisition decision memos lack rigor;
* a lack of follow-up and enforcement of oversight decisions;
* inadequate technical support at the investment level; and:
* unclear accountability for acquisitions at the component level.
Many of the deficiencies identified are consistent with our findings.
For example, the DHS assessment of Citizenship and Immigration Services
(CIS) found that investments were either missing, or using draft or
unsigned versions of key investment management documents, limiting
DHS's ability to measure the investments' performance. In one case, DHS
found that the Verification Information Systems investment is poorly
defined. In another case, DHS reported that CIS's investment
Transformation was using draft and unsigned acquisition documents,
including its mission needs statement, acquisition plan, and
acquisition program baseline. In 2007, we reported that: CIS had not
finalized its acquisition strategy for Transformation and cost
estimates therefore remain uncertain, plans do not sufficiently discuss
enterprise architecture alignment and expected project performance, and
these gaps create risks that could undermine Transformation's success
as it begins to implement its plans.[Footnote 33] In addition, DHS
found that CIS's investment Customer Service Web Portal did not have
key investment management documents and that the investment's
performance cannot be adequately assessed. Similarly, DHS found that
CIS's investment Integrated Document Production did not have
performance measures or documentation that performance metrics have
been implemented to measure program cost, schedule, and performance
execution.
To address the findings of its 2007 review, DHS is taking steps to
reiterate the DHS investment review policy and establish a more
disciplined and comprehensive investment review process. Beginning in
February 2008, interim policies were issued by the Undersecretary for
Management to improve management of major investments pending release
of a new investment review management directive. Specifically, the
Undersecretary for Management issued a memorandum in February 2008 on
initiating efforts to improve the quality of acquisition program
baselines for level 1 investments, and another in July 2008 on
improving life-cycle cost estimating for major investments. To help
address the backlog of investments awaiting review, the CPO has begun
to review and issue acquisition decision memorandums for each level 1
program. As of August 2008, acquisition decision memorandums had been
completed for three programs. The memorandums indicate documentation
that must be completed, issues that must be addressed, and related
completion dates before investment approval is given. The memorandums
also identify any limits or restrictions on the program until those
actions are completed. Further, the Undersecretary for Management
signed an interim acquisition management directive in November 2008 to
improve acquisition management and oversight pending results from a
formal DHS executive review.
DHS's Investment Review and Budget Processes Are Not Integrated to Help
Ensure That Major Investments Maximize Resources to Meet Mission Needs:
DHS's annual budget process for funding major investments has not been
appropriately informed by the investment review process--largely
because the IRB seldom conducts oversight reviews and when it has, the
two processes have not been aligned to better ensure funding decisions
fulfill mission needs. While DHS's investment review framework
integrates the two processes--an approach similarly prescribed by GAO
and OMB capital planning principles--many major investments received
funding without determining that mission needs and requirements were
justified. In addition, two-thirds of DHS major investments did not
have required life-cycle cost estimates, which are essential to making
informed budget and capital planning decisions. At the same time, DHS
has not conducted regular reviews of its investment portfolios--broad
categories of investments--to ensure effective performance and minimize
unintended duplication of effort for proposed and ongoing investments.
In July 2008, more than one-quarter of DHS's major investments were
designated by OMB as poorly planned and by DHS as poorly performing.
The DHS Undersecretary for Management has said that strengthening the
links between investment review and budget decisions is a top priority.
GAO and OMB Capital Planning Principles Emphasize an Integrated
Investment Approach to Manage Risk and Costs:
OMB and GAO capital planning principles underscore the importance of a
disciplined decision making and requirements process as the basis to
ensure that investments succeed with minimal risk and lowest life-cycle
cost.[Footnote 34] This process should provide agency management with
accurate information on acquisition and life-cycle costs, schedules,
and performance of current and proposed capital assets. The OMB Capital
Programming Guide also stresses the need for agencies to develop
processes for making investment decisions that deliver the right amount
of funds to the right projects.
In addition, OMB and GAO guidance provide that an investment review
policy should seek to use long-range planning and a disciplined,
integrated budget process for portfolio management to achieve
performance goals at the lowest life-cycle cost and least risk to the
taxpayer and the government. Investment portfolios are integrated,
agencywide collections of investments that are assessed and managed
collectively based on common criteria. Managing investments as
portfolios is a conscious, continuous, and proactive approach to
allocating limited resources among an organization's competing
initiatives in light of the relative benefits expected from these
investments. Our prior work at DOD has shown that fragmented decision-
making processes do not allow for a portfolio management approach to
make investment decisions that benefit the organization as a whole. The
absence of an integrated approach can contribute to duplication in
programs and equipment that does not operate effectively together.
[Footnote 35]
GAO best practices work also emphasizes that (1) a comprehensive
assessment of agency needs should be conducted, (2) current
capabilities and assets should be identified to determine if and where
a gap may lie between current and needed capabilities, and (3) a
decision about how best to meet the identified gap should be evaluated.
The approved mission needs statement must support the need for a
project before the project can proceed to the acquisition phase. OMB
guidance states that in creating capital plans, agencies should
identify a performance gap between the existing portfolio of agency
assets and the mission need that is not filled by the agency's asset
portfolio.[Footnote 36] Moreover, best practices indicate that
investment resources should match valid requirements before approval of
investments.
DHS Budget Decisions for Major Investments Have Generally Not Been
Informed by Mission Needs and Life-Cycle Cost Estimates:
The DHS investment review process calls for IRB decisions and program
guidance regarding new investments to be reflected to the extent
possible in the budget. The DHS budget process consists of overlapping
planning, programming, budgeting, and execution phases that examine
existing program funding and link funding to program performance to
ensure funds are expended appropriately and produce the expected
results and benefits (see fig. 3).
Figure 3: DHS Planning, Programming, Budgeting, and Execution Phases of
the Budget Process:
[Refer to PDF for image]
This figure is an illustration of the DHS Planning, Programming,
Budgeting, and Execution Phases of the Budget Process, as follows:
2007 PPBE:
Planning: Late 2004 through mid-2005;
Programming and budgeting: Mid-2005 through late 2006;
Execution (1 to 3 years depending on funding type): Late 2006 through
2007.
2008 PPBE:
Planning: Late 2005 through mid-2006;
Programming and budgeting: Mid-2006 through late 2007;
Execution (1 to 3 years depending on funding type): Late 2007 through
2008.
2009 PPBE:
Planning: Late 2006 through mid-2007;
Programming and budgeting: Mid-2007 through late 2008;
Execution (1 to 3 years depending on funding type): Late 2008 through
2009.
2010 PPBE:
Planning: Late 2007 through mid-2008;
Programming and budgeting: Mid-2008 through late 2009;
Execution (1 to 3 years depending on funding type): Late 2009 through
2010.
2011 PPBE:
Planning: Late 2008 through mid-2009;
Programming and budgeting: Mid-2009 through late 2010;
Execution (1 to 3 years depending on funding type): Late 2010 through
2011.
Source: DHS (data); GAO (analysis and presentation).
[End of figure]
Annually, components submit resource allocation proposals for major
investments to the CFO for review in March and, in turn, resource
allocation decisions are provided to components in July. According to
CFO representatives, information from investment oversight reviews
would be useful to inform investment annual resource allocation
decisions. CFO representatives explained that the CFO sought to align
resource allocation decisions with the IRB approvals in 2006, but this
was not possible because of the erratic investment review meeting
schedule. As a result, a number of CFO and CPO representatives
confirmed that funding decisions for major investments have not been
contingent upon the outcomes of the investment review process.
One of the primary functions of the IRB is to review and approve level
1 investments for formal entry into the annual budget process. However,
we found that 18 of DHS's 57 major investments did not have an approved
mission needs statement--a document that formally acknowledges that the
need is justified and supported. Specifically, the statement summarizes
the investment requirement, the mission or missions that the investment
is intended to support, the authority under which the investment was
begun, and the funding source for the investment. As such, approval of
the mission needs statement is required at the earliest stages of an
investment. Lacking information on which major investments have
validated mission needs, the CFO has allocated funds for major
investments for which a capability gap has not been established. We
reported in 2007 that DHS risked selecting investments that would not
meet mission needs in the most cost-effective manner.[Footnote 37] The
18 investments that lacked an approved mission needs statement
accounted for more than half a billion dollars in estimated fiscal year
2008 appropriations (see table 4).
Table 4: DHS Investments without a Mission Needs Statement in Fiscal
Year 2008 (Dollars in millions):
Citizenship and Immigration Services (CIS):
Customer Service Web Portal; $15.8;
Immigration CLAIMS 3.0; $10.9;
Integrated Document Production; $31.8;
Naturalization CLAIMS 4.0; $17.7;
Verification Information System; $37.9.
Domestic Nuclear Detection Office:
Advanced Spectroscopic Portal Program; $147.5;
Cargo Advanced Automated Radiography System Active Radiography
Detection Systems; $43.0.
Federal Emergency Management Agency (FEMA):
Consolidated Alert and Warning System; $25.6;
Disaster Management E-Government Initiative; $12.5;
Housing Inspection Services, Inspection Contracts; $40.5;
Total Asset Visibility (Phase I); $33.8.
Immigration and Customs Enforcement (ICE):
Asset Management Construction Account; $16.5;
Federal Financial Management System; $21.4.
National Protection and Program Directorate:
Infrastructure Information Collection Program; $14.2;
National Security and Emergency Preparedness; $117.6;
U.S. Computer Emergency Readiness Team; $76.6.
Office of Health Affairs:
National Bio-Surveillance Integration System; $5.3.
Transportation Security Administration (TSA):
Federal Air Marshall Service Air to Ground Communications System and
Tactical Information Sharing System; $12.6.
Total: $681.2.
Source: GAO analysis of DHS data and total 2008 costs reported in DHS
fiscal year 2009 capital asset plan and business case summaries.
[End of table]
In addition, two thirds of major investment budget decisions were
reached without a life-cycle cost estimate. A life-cycle cost estimate
provides an exhaustive and structured accounting of all resources and
associated cost elements required to develop, produce, deploy, and
sustain a particular program. Life-cycle costing enhances decision
making, especially in early planning and concept formulation of
acquisition and can support budgetary decisions, key decision points,
milestone reviews, and investment decisions. GAO and OMB guidance
emphasize that reliable cost estimates are important for program
approval and continued receipt of annual funding.[Footnote 38] DHS
policy similarly provides that life-cycle cost estimates are essential
to an effective budget process and form the basis for annual budget
decisions. However, 39 of the 57 level 1 and level 2 major DHS
investments we reviewed did not have a life-cycle cost estimate.
Moreover, DHS's 2007 assessment of 37 major investments also found
investments without life-cycle cost estimates and noted poor cost
estimating as a systemic issue. Without such estimates, DHS major
investments are at risk of experiencing cost overruns, missed
deadlines, and performance shortfalls. Cost increases often mean that
the government cannot fund as many programs as intended. To begin to
address this issue, the DHS Undersecretary for Management issued a memo
in July 2008 initiating an effort to review and improve the credibility
of life-cycle cost estimates for all level 1 investments prior to
formal milestone approval.
Lack of Portfolio Reviews Increases Risk of Duplication in DHS's Major
Investments:
The JRC is responsible for managing the department's level 1 and level
2 major investment portfolios and making portfolio-related
recommendations to the IRB. Managing investments as portfolios is a
continuous and proactive approach to allocating finite resources among
an organization's competing initiatives in light of the relative
benefits expected from these investments. Taking a portfolio
perspective allows an agency to determine how its collective
investments can optimally address its strategic goals and objectives.
As part of this responsibility, the JRC is expected to identify
crosscutting opportunities and overlapping or common requirements and
determine how best to ensure that DHS uses its finite resources wisely
in those areas. Specifically, the JRC reviews investments to identify
duplicative mission capabilities and to assess redundancies. While a
certain amount of redundancy can be beneficial, our prior work has
found that unintended duplication indicates the potential for
inefficiency and waste.[Footnote 39] The Enterprise Architecture Board
supports the JRC by overseeing the department's enterprise architecture
and performing technical reviews of level 1 and level 2 IT investments.
In 2007, we reported that DHS did not have an explicit methodology and
criteria for determining program alignment to the architecture.
[Footnote 40] We further reported that DHS policies and procedures for
portfolio management had yet to be defined, and as a result, control of
the department's investment portfolios was ad hoc.
When it met regularly, the JRC played a key role in identifying several
examples of overlapping investments, including passenger screening
programs. Specifically, in March 2006, the JRC identified programs that
had potential overlaps, including TSA's Secure Flight, TSA's Registered
Traveler, and CBP's Consolidated Registered Traveler programs, yet the
programs lacked coordination and were struggling with interoperability
and information sharing. Because the JRC stopped meeting soon
thereafter, DHS may have missed opportunities to follow up on these
cases or identify further cases of potential overlap. In 2007, we
reported that while TSA and CBP had begun coordinating efforts, they
had yet to align their passenger prescreening programs to identify
potential overlaps and minimize duplication.[Footnote 41] We
recommended that DHS take additional steps and make key policy and
technical decisions that were necessary to more fully coordinate these
programs. TSA and CBP have since worked with DHS to develop a strategy
to align regulatory policies and coordinate efforts to facilitate
consistency across their programs.[Footnote 42] In another case, we
reported that CIS's Transformation investment has been conducted in an
ad hoc and decentralized manner, and, in certain instances, is
duplicative with other IT investments.[Footnote 43]
DHS's 2007 assessment of 37 major investments also identified potential
overlap and duplication of effort between investments. Overall the
review found that limited communication and coordination across
components led to overlapping DHS programs. For example, DHS found that
the CIS Verification Information System had potential duplication of
requirements implementation with National Protection and Program
Directorate's U.S. Computer Emergency Readiness Team investment. In
another instance, DHS found the CIS Integrated Document Production
investment had an unclear relationship to other DHS credentialing
investments.
Limited DHS Investment Oversight Has Led OMB to Designate Many DHS
Programs as Poorly Planned and Poorly Performing:
OMB requires all agencies including DHS to submit program justification
documents[Footnote 44] for major investments to inform both
quantitative decisions about budgetary resources consistent with the
administration's program priorities, and qualitative assessments about
whether the agency's programming processes are consistent with OMB
policy and guidance. To help ensure that investments of public
resources are justified and that public resources are wisely invested,
OMB began using a Management Watch List in the President's fiscal year
2004 budget request as a means to oversee the justification for and
planning of agencies' information technology investments. This list was
derived based on a detailed review of each investment's Capital Asset
Plan and Business Case. In addition, OMB has established criteria for
agencies to use in designating high-risk projects that require special
attention from oversight authorities and the highest levels of agency
management. These projects are not necessarily at risk of failure, but
may be on the list because of one or more of the following four
reasons:
* The agency has not consistently demonstrated the ability to manage
complex projects.
* The project has exceptionally high development, operating, or
maintenance costs, either in absolute terms or as a percentage of the
agency's total portfolio.
* The project is being undertaken to correct recognized deficiencies in
the adequate performance of an essential mission program or function of
the agency, a component of the agency, or another organization.
* Delay or failure of the project would introduce for the first time
unacceptable or inadequate performance or failure of an essential
mission function of the agency, a component of the agency, or another
organization.
According to DHS officials, without input from investment oversight
reviews, a limited budget review of program justification documents
prior to OMB submittal can be the only oversight provided for some DHS
major investments. CFO representatives told us that in the absence of
investment review decisions, they rely on the best available
information provided by program managers in order to determine if
funding requests are reasonable. As a result, major investment programs
can proceed regardless of whether the investment has received the
appropriate IRB review or has required acquisition documents.
We reported that as of July 2008, 15 DHS major investments are on both
the OMB Management Watch List and list of high-risk projects with
shortfalls, meaning that they are both poorly planned and poorly
performing.[Footnote 45] According to DHS officials, the funding,
programming, and budget execution process is not integrated into the
requirements and acquisition oversight process and the DHS
Undersecretary for Management has said that strengthening these
processes is a top priority.
Conclusions:
The challenges DHS faces in implementing its investment review process
are long-standing and have generally resulted in investment decisions
that are inconsistent with established policy and oversight. Concurrent
with this lack of oversight are acquisition programs worth billions of
dollars with cost, schedule, and performance deficiencies. Weaknesses
in some component management practices compound the problem leaving
investments with little to no scrutiny or review. While the
department's process has been under revision since 2005, DHS has begun
new efforts to clarify and better adhere to the investment review
process. Without validating mission needs, requirements, and program
baselines including costs, as well as identifying duplicative efforts
and monitoring progress, DHS cannot appropriately manage investments
and inform the budget process. Until DHS aligns oversight of major
investments with annual budget decisions, the department is at risk of
failing to invest in programs that maximize resources to address
capability gaps and ultimately help meet critical mission needs.
Recommendations for Executive Action:
We recommend that the Secretary of Homeland Security direct the
Undersecretary for Management to take the following five actions to
better ensure the investment review process is fully implemented and
adhered to:
* Establish a mechanism to identify and track on a regular basis new
and ongoing major investments and ensure compliance with actions called
for by investment oversight boards.
* Reinstate the JRC or establish another departmental joint
requirements oversight board to review and approve acquisition
requirements and assess potential duplication of effort.
* Ensure investment decisions are transparent and documented as
required.
* Ensure that budget decisions are informed by the results of
investment reviews including IRB approved acquisition information and
life cycle cost estimates.
* Identify and align sufficient management resources to implement
oversight reviews in a timely manner throughout the investment life
cycle.
To improve investment management, we recommend that the Secretary of
Homeland Security direct component heads to take the following two
actions:
* Ensure that components have established processes to manage major
investments consistent with departmental policies.
* Establish a mechanism to ensure major investments comply with
established component and departmental investment review policy
standards.
Agency Comments and Our Evaluation:
We provided a draft of this report to DHS for review and comment. In
written comments, the department generally concurred with our findings
and recommendations, citing actions taken and efforts under way to
improve the investment review process. The department's comments are
reprinted in appendix II. DHS components also provided technical
comments which we incorporated as appropriate and where supporting
documentation was provided. In addition, several DHS components and
offices reported additional progress since the time of our review to
ensure their major investments comply with departmental policies.
DHS is taking important steps to strengthen investment management and
oversight. After being under revision since 2005, DHS issued a new
interim management directive on November 7, 2008, that outlines a
revised acquisition and investment review process. DHS also cited two
new offices within the Chief Procurement Office that were established
to provide better acquisition management and oversight; recently
completed program reviews; and plans to revise training, standards, and
certification processes for program managers. While many of these
efforts are noted in our report, investment management and oversight
has been an ongoing challenge since the department was established, and
continued progress and successful implementation of these recent
efforts will require sustained leadership and management attention.
DHS stated that the new interim acquisition management directive will
address many of our recommendations; however, our work has found that
DHS has not fully implemented similar steps in the past. For example,
in response to our first recommendation, to establish a mechanism to
identify and track on a regular basis new and ongoing major investments
and ensure compliance with actions called for by investment review
board decisions, DHS's new interim directive requires major programs to
participate in an acquisition reporting process. While DHS is in the
process of implementing a Next Generation Periodic Reporting System, it
is too soon to tell whether this system will be successfully
implemented. DHS's first-generation periodic reporting system was never
fully implemented, making it difficult for the department to track and
enforce investment decisions.
In response to our second recommendation, to reinstate the JRC or
establish another departmental joint requirements oversight board to
review and approve acquisition requirements and assess potential
duplication of effort, DHS stated it has already developed a new
Strategic Requirements Review process to assess capability needs and
gaps; completed pilots; and briefed senior leadership. According to
DHS's new interim acquisition management directive, the results of this
process are to be validated by the JRC, which is still in the process
of being established and for which no timeline was provided. Further,
as we found in this report, when the JRC was previously established in
2004, it was never fully implemented due to a lack of senior management
officials' involvement.
In response to our third recommendation, that DHS ensure investment
decisions are transparent and documented as required, DHS stated that
its new interim acquisition management directive already implements
this by requiring acquisition documentation for each acquisition
decision event and capturing decisions and actions in acquisition
decision memorandums. DHS also reported that it has conducted eight
Acquisition Review Board meetings with documented Acquisition Decision
Memorandums. While this progress is notable, our work has found that
since 2004, DHS's investment review board has not been able to
effectively carry out its oversight responsibilities and keep pace with
investments requiring review due to a lack of senior officials'
involvement as well as limited monitoring and resources. It is too soon
to tell whether DHS's latest efforts will be sustained to ensure
investments are consistently reviewed as needed.
Regarding our fourth recommendation, that the department ensure budget
decisions are informed by the results of investment reviews, the new
interim management directive creates a link between the budget and
requirements processes and describes interfaces with other investment
processes. While this process is more clearly established in the new
directive, its implementation will be evidenced in the documents
produced during upcoming budget cycles. We found in this report that
the previous investment review process also highlighted links to the
budget and other investment processes, yet the results of oversight
reviews did not consistently inform budget decisions.
In response to our fifth recommendation, to identify and align
sufficient management resources to implement oversight reviews in a
timely manner throughout the investment life cycle, DHS stated that it
has partially implemented the recommendation by establishing a senior
executive-led Acquisition Program Management Division within the Office
of the CPO and plans to increase staffing from its current level of 12
experienced acquisition and program management specialists to 58 by the
end of fiscal year 2010. Creating a new division to manage oversight
reviews is a positive step; however, we have found that DHS has been
challenged to provide sufficient resources to support its acquisition
oversight function and the CPO's office has had difficulty filling
vacancies in the past.
Regarding our two recommendations to improve investment management at
the component level, DHS noted that the new interim management
directive requires components to align their internal policies and
procedures by the end of the third quarter of fiscal year (June) 2009.
In addition, DHS plans to issue another management directive which will
instruct component heads to create component acquisition executives in
their organizations to be responsible for the implementation of
management and oversight of component acquisition processes. If fully
implemented, these steps should help to ensure that components have
established processes to manage major investments. DHS further noted
that establishment of the Acquisition Program Management Division, the
new interim acquisition management directive, reestablishment of the
acquisition review process, and other steps work together to ensure
major investments comply with established component and departmental
investment review policy standards. To implement this recommendation,
the new component acquisition executives will need to be in place and
successfully implement and ensure compliance with the new processes.
DHS will continue to face ongoing challenges to implementing an
effective investment review process identified in this report and
highlighted in the department's Integrated Strategy for High Risk
Management. For example, consistent with our findings, the strategy
cites challenges to ensuring availability of leadership to conduct
investment reviews; timely collection and assessment of program data;
and sufficient staff to support the investment review process.
Sustained leadership focus will be even more critical to implement
changes and maintain progress on acquisition management challenges as
the department undergoes its first executive branch transition in 2009.
As agreed with your offices, unless you publicly announce the contents
of this report, we plan no further distribution for 30 days from the
report date. At that time, we will send copies of this report to
interested congressional committees and the Secretary of Homeland
Security. We will also make copies available to others upon request. In
addition, the report will be available at no charge on GAO's Web site
at [hyperlink, http://www.gao.gov].
If you or your staff have questions regarding this report, please
contact me at (202) 512-4841 or huttonj@gao.gov. Contact points for our
Offices of Congressional Relations and Public Affairs may be found on
the last page of this report. Principal contributors to this report
were Amelia Shachoy, Assistant Director; William Russell; Laura
Holliday; Nicole Harkin; Patrick Peterson; Karen Sloan; Marie Ahearn;
and Kenneth Patton.
Sincerely yours,
Signed by:
John Hutton, Director:
Acquisition and Sourcing Management:
[End of section]
Appendix I Scope and Methodology:
Our objectives were to: (1) evaluate DHS's implementation of the
investment review process, and (2) assess DHS's integration of the
investment review and budget processes to ensure major investments
fulfill mission needs.
To assess how the investment review process has been implemented, we
reviewed the DHS Investment Review Process management directive and
corresponding handbook to determine which major investments required
DHS review. In doing so, we focused on determining such key factors as
how frequently major investments required oversight reviews and what
documents such as mission need statements and acquisition program
baselines are required to be approved by DHS executive review boards.
We included in our analyses 57 level 1 and level 2[Footnote 46]
investments that DHS identified for fiscal year 2008. We determined the
level of oversight provided to 48 of these major investments--those
that required department-level review from fiscal year 2004 through the
second quarter of fiscal year 2008. We also interviewed representatives
of the Chief Procurement Office (CPO), Chief Financial Office (CFO),
and Chief Information Office as well as nine DHS components and offices
that manage major investments. We then collected investment review and
program documents for each major investment and compared the
information to investment review policy requirements. We also reviewed
acquisition decision memorandums from fiscal year 2004 through the
second quarter of fiscal year 2008. Based on the decision memos and
investment information, we determined how many investments had been
reviewed in accordance with DHS policy from fiscal year 2004 through
the second quarter of fiscal year 2008. We also reviewed prior GAO
reports on DHS programs as well as commercial best practices for
acquisition. We reviewed DHS documents such as interim policy memos and
guidance and interviewed CPO staff regarding planned revisions to the
investment review process. We also compared our findings with a 2007
DHS internal assessment of 37 major investments. In addition, we
reviewed available DHS periodic reports on major investments as well as
component operational status reports to identify instances of cost
growth, schedule slips, and performance shortfalls for major
investments and to determine the status of program manager
certification in fiscal year 2007 through the second quarter of fiscal
year 2008. This information is self-reported by DHS major program
offices and all programs did not always provide complete information,
and we did not independently verify information in these reports.
To assess the integration of investment review and the budget process,
we reviewed DHS management directives for the investment review and the
planning, programming, budgeting, and execution process as well as
corresponding guidance. We also interviewed representatives from the
Chief Procurement Office and Chief Financial Office to discuss how the
processes have been integrated since 2004. We used investment data and
acquisition documents from each major investment program to determine
which had required life-cycle cost estimates and other documents such
as a validated mission need statements. We also reviewed fiscal year
2009 DHS budget justification submissions to OMB. We compared DHS
budget practices with GAO and Office of Management and Budget (OMB)
guidance on capital programming principles. In addition, we reviewed
relevant GAO reports.
We conducted this performance audit from September 2007 until November
2008 in accordance with generally accepted government auditing
standards. Those standards require that we plan and perform the audit
to obtain sufficient, appropriate evidence to provide a reasonable
basis for our findings and conclusions based on our audit objectives.
We believe that the evidence obtained provides a reasonable basis for
our findings and conclusions based on our audit objectives.
[End of section]
Appendix II: Comments from the Department of Homeland Security:
U.S. Department of Homeland Security:
Washington, DC 20528:
November 7, 2008:
Mr. John Hutton:
Director, Acquisition and Sourcing Management:
Government Accountability Office:
Washington, D.C. 20548:
Dear Mr. Hutton:
Thank you for the opportunity to review Draft Report GAO-09-29,
Department of Homeland Security: Billions Invested in Major Programs
Lack Appropriate Oversight.
The Department of Homeland Security (DHS) and the Office of the Chief
Procurement Officer (OCPO) generally concur with and have already
implemented GAO recommendations, as detailed below. During the past
year, for example, DHS:
1) Re-engineered the process for management of the Department's
Acquisition and Investment review process. New Acquisition Directive
(102-01), accompanied by an Instruction (102-01-001), replaces MD 1400
and lays out a comprehensive acquisition lifecycle framework and
acquisition process. Supporting the instruction are appendices
providing detailed information on critical acquisition related products
and processes. These will be implemented as Department Acquisition
policy at the beginning of November 2008;
2) Established the Acquisition Program Management Division and the Cost
Analysis Division within OCPO. These divisions provide departmental
policy, processes and procedures for DHS Acquisition Programs, as well
as both oversight of and assistance to our acquisition programs. They
are currently staffed with 12 experienced Acquisition and Program
management specialists, with support from the Defense Acquisition
University and the Homeland Security Institute. Current plans are to
increase staffing to a total of 58 by the end of FY-10;
3) Completed 37 quick-look program reviews, two Independent Review Team
level program reviews, and eight Acquisition Review Boards (ARB,
formerly Investment Review Boards, IRBs). These ARBs are issue-focused
and documented via Acquisition Decision Memorandums (ADMs). The revised
process provides much improved rigor and focus to this vital
Departmental oversight function, and are supported by the Chief
Information Officer's (CIO) Enterprise Architecture Board (EAB) and the
Chief Administrative Officer's (CAO) DHS Asset Review Boards (DARB).
Both boards provide technical expertise and assistance where needed. As
of the end of FY-08, eight ARBs have been conducted, with eight more
scheduled through December 2008; and;
4) CPO has also established revised training, standards, and
certification processes for program managers (MD 782) and will
implement standards for test and evaluation, systems engineering,
acquisition logistics, and cost analysis by the end of the CY.
The following is the Departmental response to the recommendations
outlined in the draft report:
1) Recommendation: Establish a mechanism to identify and track on a
regular basis new and ongoing major investments and ensure compliance
with actions called for by investment oversight boards.
Status: Recommendation already implemented. The DHS Chief Information
Office (CIO), in collaboration with the DHS Chief Procurement Office
(CPO), has reengineered the acquisition program periodic reporting
process and is implementing a new system, Next Generation Periodic
Reporting System (nPRS), after completing a successful pilot period. In
addition to tracking cost, schedule, and performance attributes of a
program's Acquisition Program Baseline (APB), the system tracks
Acquisition Decision Memorandum (ADM) action items that result from
Acquisition Review Boards (ARBs), as well as other pertinent
information.
2) Recommendation: Reinstate the JRC or establish another departmental
joint requirements oversight board to review and approve acquisition
requirements and assess potential duplication of effort.
Status: The DHS Office of Policy has already developed a new Strategic
Requirements Review Process to assess the Departmental capability needs
and gaps. This process feeds the yearly Integrated Planning Guidance
(IPG). Pilots of the new process have been completed and the results
briefed to senior DHS management.
3) Recommendation: Ensure investment decisions are transparent and
documented as required.
Status: Recommendation already implemented. DHS has implemented a new
Acquisition Management Directive, which identifies the required
acquisition documentation for each Acquisition Decision Event (ADE).
The documentation is reviewed by the Acquisition Review Team (ART),
under the direction of the Acquisition Program Management Division
(APMD), prior to each ADE. This identifies focused issues that form the
basis for the ARB review. Immediately following the ARB, the decisions
and actions are captured in an Acquisition Decision Memorandum (ADM)
which is staffed and signed by the Acquisition Decision Authority
(ADA). The new periodic reporting system mentioned above tracks the
acquisition program documentation including the ADMs. A status report
is periodically distributed to Department, Component, and program
office leadership.
4) Recommendation: Ensure that budget decisions are informed by the
results of investment reviews including IRB approved acquisition
information and lifecycle cost estimates.
Status: Recommendation already implemented. The new Acquisition
Directive and the accompanying Instruction address the interfacing
"touch points" with the Department's budgeting and requirements
decision processes. For example, a Mission Need Statement (MNS) is
required for Resource Allocation Proposals (RAPs). Additionally, the
Directive and Instruction describe the interfaces with other processes
(e.g. OMB Capital Planning and Investment Control (CPIC), DHS
Enterprise Architecture Board, and DHS Asset Review Board).
5) Recommendation: Identify and align sufficient management resources
to implement oversight reviews in a timely manner throughout the
investment lifecycle.
Status: Partially implemented. DHS has established a Senior Executive-
led Acquisition Program Management Division (APMD) within the Office of
the Chief Procurement Officer. Additionally, DHS has established a Cost
Analysis Division (CAD) also within the Office of the Chief Procurement
Officer to provide cost estimating guidance and to provide oversight of
program cost estimates. These divisions are currently staffed with 12
experienced Acquisition and Program management specialists, with
support from the Defense Acquisition University and the Homeland
Security Institute. Current plans are to increase staffing to a total
of 58 by the end of FY-10.
6) To improve investment management, we recommend that the Secretary of
Homeland Security direct component heads to take the following two
actions:
a. Ensure that components have established processes to manage major
investments consistent with departmental policies.
Status: Recommendation will be fully implemented by end of 3Q09 in the
new acquisition management directive plus the updated Acquisition Line
of Business Directive, which require Components to align their internal
policies and procedures. Additionally, Component Heads are instructed
to create a Component Acquisition Executive (CAE) position in their
organizations. This individual will be nominated by the Component Head,
approved by USM, and is responsible for the implementation of
management and oversight of their Component acquisition processes. In
addition to leading their Components through the Acquisition Review
Process for Level 1 and Level 2 programs at the Department Level, they
will also be responsible for executing the Acquisition Review Process
for Level 3 programs within their Component.
b. Recommendation: Establish a mechanism to ensure major investments
comply with established component and departmental investment review
policy standards.
Status: Recommendation implemented: The establishment of APMD, the new
Acquisition Directive and Instruction, the reestablishment of the ARB
process, the integration of the principal Department decision
processes, as well as the other acquisition initiatives underway (e.g.
the new periodic reporting system, the Component Acquisition
Executive) work together to ensure compliance with the Department's and
Component's acquisition policies.
We thank you again for the opportunity to review the report and provide
comments.
Sincerely,
Signed by:
Thomas W. Essig:
Chief Procurement Officer:
Department of Homeland Security:
[End of section]
Appendix III: Key Acquisition Documents by Major Investment:
Mission needs statements, operational requirements documents, and
acquisition program baselines establish capability gaps, requirements
needed to address those gaps, and cost, schedule, and performance
parameters, respectively. Of the 57 DHS level 1 and 2 investments, 34
were in an acquisition phase that required all three documents; 27
either did not develop the document or only provided an unapproved
draft of one or more of these documents (see table 5). Some major
investment programs provided acquisition program baselines approved at
the component level that were submitted but did not receive department
review and approval.
Table 5: Documentation for Investments in Phases That Require All Key
Acquisition Documents:
[A] Indicates that the program provided: a mission needs statement, an
operational requirements document, or a department-approved acquisition
program baseline.
[B] Indicates the program did not provide: a mission needs statement,
an operational requirements document, or a department-approved
acquisition program baseline.
Investment: Analysis and Operations: Common Operational Picture;
Mission Needs Statements:[A];
Operational Requirements Document: [A];
Acquisition Program Baseline: [B].
Investment: Analysis and Operations: Homeland Security Information
System;
Mission Needs Statements: [A];
Operational Requirements Document: [A];
Acquisition Program Baseline: [B].
Investment: Chief Human Capital Office: HR IT;
Mission Needs Statements: [A];
Operational Requirements Document: [A];
Acquisition Program Baseline: [B].
Investment: Chief Information Officer Office: Infrastructure;
Mission Needs Statements: [A];
Operational Requirements Document: [B];
Acquisition Program Baseline: [B].
Investment: Citizenship and Immigration Services: Customer Service Web
Portal;
Mission Needs Statements: [B];
Operational Requirements Document: [B];
Acquisition Program Baseline: [B].
Investment: Citizenship and Immigration Services: Integrated Document
Production;
Mission Needs Statements: [B];
Operational Requirements Document: [B];
Acquisition Program Baseline: [B].
Investment: Citizenship and Immigration Services: Transformation;
Mission Needs Statements: [A];
Operational Requirements Document: [B];
Acquisition Program Baseline: [B].
Investment: Coast Guard: Integrated Deepwater System;
Mission Needs Statements: [A];
Operational Requirements Document: [B];
Acquisition Program Baseline: [A].
Investment: Coast Guard: Nationwide Automatic Identification System;
Mission Needs Statements: [A];
Operational Requirements Document: [A];
Acquisition Program Baseline: [A].
Investment: Coast Guard: Rescue 21;
Mission Needs Statements: [A];
Operational Requirements Document: [A];
Acquisition Program Baseline: [A].
Investment: Coast Guard: Response Boat Medium;
Mission Needs Statements: [A];
Operational Requirements Document: [A];
Acquisition Program Baseline: [A].
Investment: Customs and Border Protection: Strategic Air Plan;
Mission Needs Statements: [A];
Operational Requirements Document: [A];
Acquisition Program Baseline: [B].
Investment: Customs and Border Protection: Automated Commercial
Environment;
Mission Needs Statements: [A];
Operational Requirements Document: [A];
Acquisition Program Baseline: [A].
Investment: Customs and Border Protection: Border Patrol Facilities;
Mission Needs Statements: [A];
Operational Requirements Document: [B];
Acquisition Program Baseline: [B].
Investment: Customs and Border Protection: Secure Border Initiative
net;
Mission Needs Statements: [A];
Operational Requirements Document: [A];
Acquisition Program Baseline: [B].
Investment: Customs and Border Protection: Secure Freight Initiative;
Mission Needs Statements: [A];
Operational Requirements Document: [A];
Acquisition Program Baseline: [B].
Investment: Customs and Border Protection: Western Hemisphere Travel
Initiative;
Mission Needs Statements: [A];
Operational Requirements Document: [B];
Acquisition Program Baseline: [B].
Investment: Domestic Nuclear Detection Office: Advanced Spectroscopic
Portal (ASP) Program;
Mission Needs Statements: [B];
Operational Requirements Document: [B];
Acquisition Program Baseline: [B].
Investment: Federal Emergency Management Agency: Disaster Management E-
Government Initiative;
Mission Needs Statements: [B];
Operational Requirements Document: [B];
Acquisition Program Baseline: [B].
Investment: Immigration and Customs Enforcement: Asset Management
Construction Account;
Mission Needs Statements: [B];
Operational Requirements Document: [B];
Acquisition Program Baseline: [B].
Investment: Immigration and Customs Enforcement: Automation and
Modernization;
Mission Needs Statements: [A];
Operational Requirements Document: [A];
Acquisition Program Baseline: [B].
Investment: Immigration and Customs Enforcement: Detention and Removal
Modernization;
Mission Needs Statements: [A];
Operational Requirements Document: [B];
Acquisition Program Baseline: [B].
Investment: Immigration and Customs Enforcement: Student and Exchange
Visitor Information System;
Mission Needs Statements: [A];
Operational Requirements Document: [A];
Acquisition Program Baseline: [B].
Investment: National Protection and Program Directorate: Critical
Infrastructure Warning Information Network;
Mission Needs Statements: [A];
Operational Requirements Document: [A];
Acquisition Program Baseline: [B].
Investment: National Protection and Program Directorate: Infrastructure
Information Collection Program;
Mission Needs Statements: [B];
Operational Requirements Document: [B];
Acquisition Program Baseline: [B].
Investment: National Protection and Program Directorate: U.S. Computer
Emergency Readiness Team;
Mission Needs Statements: [B];
Operational Requirements Document: [B];
Acquisition Program Baseline: [B].
Investment: National Protection and Program Directorate: U.S. Visitor
and Immigrant Status Indicator Technology;
Mission Needs Statements: [A];
Operational Requirements Document: [A];
Acquisition Program Baseline: [A].
Investment: Office of Health Affairs: National Bio-Surveillance
Integration System;
Mission Needs Statements: [B];
Operational Requirements Document: [B];
Acquisition Program Baseline: [B].
Investment: Science and Technology Directorate: National Bio-defense
Analysis and Countermeasures Center Facility;
Mission Needs Statements: [A];
Operational Requirements Document: [A];
Acquisition Program Baseline: [A].
Investment: Transportation Security Administration: Electronic Baggage
Screening Program;
Mission Needs Statements: [A];
Operational Requirements Document: [B];
Acquisition Program Baseline: [A].
Investment: Transportation Security Administration: Mission Scheduling
and Notification System;
Mission Needs Statements: [A];
Operational Requirements Document: [B];
Acquisition Program Baseline: [B].
Investment: Transportation Security Administration: Passenger Screening
Program;
Mission Needs Statements: [A];
Operational Requirements Document: [A];
Acquisition Program Baseline: [A].
Investment: Transportation Security Administration: Secure Flight;
Mission Needs Statements: [A];
Operational Requirements Document: [B];
Acquisition Program Baseline: [A].
Investment: Transportation Security Administration: Transportation
Worker Identification Credentialing;
Mission Needs Statements: [A];
Operational Requirements Document: [A];
Acquisition Program Baseline: [B].
Total Investments Missing at Least One Document: 27.
Source: GAO analysis of DHS data reported as of March 2008.
[End of table]
[End of section]
Appendix IV: Department of Homeland Security Investments Reviewed by
GAO:
Program: Analysis and Operations: Common Operational Picture;
Description: Provides fusion and visualization of information to create
timely and accurate situational awareness reports for the Secretary of
Homeland Security, the White House, and other users to detect, deter,
and prevent terrorist activities.
Program: Analysis and Operations: Homeland Security Information System;
Description: Facilitates information sharing and collaboration across
DHS and its partners; enables real-time sharing of threat information
for tactical first-responder support; and supports decision making in a
real time secure environment.
Program: Citizenship and Immigration Services: Immigration CLAIMS 3.0;
Description: Designed to support processing of applications and
petitions, capture fees and provide funds control, provide case status
and support, and record the results of the adjudication of each
application and petition.
Program: Citizenship and Immigration Services: Naturalization CLAIMS
4.0;
Description: Established to provide: naturalization processing,
interface with associated databases, improved accuracy, and more timely
and accurate information to the public.
Program: Citizenship and Immigration Services: Customer Service Web
Portal;
Description: Provides resources for all web development and maintenance
activities. Includes web content management, development of web based
transactions with Citizenship and Immigration Services customers and
staff, web site maintenance, and web site hosting.
Program: Citizenship and Immigration Services: Integrated Document
Production;
Description: Provides integrated card production system printers'
hardware and software, operational contract support, and facilities
required to print secure cards granting immigration privileges or
benefits to applicants.
Program: Citizenship and Immigration Services: Transformation;
Description: A system to allow all new immigration benefits
applications and petitions to be filed electronically through a
Citizenship and Immigration Services Internet web-based portal.
Citizenship and Immigration Services will have a more comprehensive
view of the customer and any potentially fraudulent transactions;
improved audit functionality and record management; better resource
management; and increased sharing of information within DHS and with
other agency partners such as Justice and State.
Program: Citizenship and Immigration Services: Verification Information
System;
Description: Supports the Systematic Alien Verification for
Entitlements Program by providing automated status-verification
information to federal, state, and local benefit-granting and
entitlement agencies, and the E-Verify program by allowing
participating employers to verify their new employees are authorized to
work in the United States.
Program: Coast Guard; Integrated Deepwater System;
Description: Aims to replace and modernize most of the Coast Guard's
fleet of offshore cutters, boats, aircraft, and command and control
systems over 25 years.
Program: Coast Guard; Marine Information for Safety and Law
Enforcement;
Description: Supports incident response, contingency planning,
violation reporting and processing, vessel casualty investigation and
analysis, vessel documentation, user fee collection, analysis of
mission performance, monitoring of program effectiveness.
Program: Coast Guard; Nationwide Automatic Identification System;
Description: Will implement a nationwide system for tracking and
exchanging information with identification system equipped vessels
operating in or approaching U.S. waters to improve homeland security
and enhance Coast Guard and DHS operational mission performance.
Program: Coast Guard; Rescue 21;
Description: Command, control and communication system that improves
mission execution in coastal zones. Essential to meet Search and Rescue
program goals. Results in improved response to distress calls and
better coordination and interoperability with other government agencies
and first responders.
Program: Coast Guard; Response Boat Medium;
Description: Intended to replace the aging 41-foot utility boats and
other large non-standard boats with assets more capable of meeting all
of the Coast Guard multi-mission operational requirements.
Program: Coast Guard; Vessel Logistics System;
Description: A collection of systems or applications used to provide
vessel logistics information management capacity to the Coast Guard.
Program: Customs and Border Protection (CBP): Automated Commercial
Environment;
Description: Web-based import and export system that consolidates seven
systems into one portal. It will provide advanced technology and
information to decide, before a shipment reaches U.S. borders, what
cargo should be targeted, and what cargo should be expedited.
Program: Customs and Border Protection (CBP): Automated Targeting
System Maintenance;
Description: Intranet-based enforcement and decision support tool that
is the cornerstone for all CBP targeting efforts. CBP uses the system
to improve the collection, use, analysis, and dissemination of
information to target, identify, and prevent potential terrorists and
terrorist weapons from entering the United States and identify other
violations and violators of U.S. law.
Program: Customs and Border Protection (CBP): Border Patrol Facilities;
Description: Will build additional facilities to meet the needs of
CBP's expansion of its Border Patrol agent staffing. The recent
addition of more agents and technology into enforcement activities has
exceeded existing facility capacity.
Program: Customs and Border Protection (CBP): Consolidated Trusted
Traveler Program;
Description: Framework used by trusted traveler programs for
registering enrollees and performing identification and validation
using automated systems.
Program: Customs and Border Protection (CBP): Non-Intrusive Inspection
Systems Program;
Description: Technologies support the interdiction of weapons of mass
destruction and effect, contraband, and illegal aliens being smuggled
across the United States border, while having a minimal impact on the
flow of legitimate commerce.
Program: Customs and Border Protection (CBP): Secure Border Initiative
net;
Description: Aims to integrate technology and tactical infrastructure
into a comprehensive border security suite. This system will improve
agent ability to respond to illegal activity and help DHS manage,
control, and secure the border.
Program: Customs and Border Protection (CBP): Secure Freight
Initiative;
Description: Phase I will deploy next-generation technology and
integrated systems to scan maritime containers for radiation or other
special nuclear material.
Program: Customs and Border Protection (CBP): Strategic Air Plan;
Description: Will help develop an integrated and coordinated air and
marine force to detect, interdict and prevent acts of terrorism arising
from unlawful movement of people, illegal drugs and other contraband
toward or across the borders of the United States. The goal is to
modernize and standardize the existing CBP air and marine fleets and
will require a specific number of primary and secondary air and marine
locations and additional personnel to meet growing needs.
Program: Customs and Border Protection (CBP): Traveler Enforcement
Compliance System Modernization;
Description: Consolidated business case between CBP and ICE that will
modernize: subject record "watch list" processing, inspection support
at ports of entry, as well as case management.
Program: Customs and Border Protection (CBP): Western Hemisphere Travel
Initiative;
Description: Will fulfill the regulatory requirement to develop and
implement a system to verify that U.S. and non-U.S. citizens present an
authorized travel document denoting identity and citizenship when
entering the United States.
Program: DHS; Description: Homeland Secure Data Network;
Description: Provides a state-of-the-art, flexible, secure through
security certification and accreditation, classified, collateral,
integrated, and centrally managed enterprise wide-area network.
Program: DHS Chief Information Office: Infrastructure Transformation;
Description: Includes the consolidated DHS IT infrastructure
environments which support the cross-organizational missions of
protecting the homeland from a myriad of threats. These IT
infrastructure investments are critical to providing a foundation in
which information can be disseminated and shared across all DHS
components, including external customers and intelligence partners, in
a secure, cost effective, and efficient manner.
Program: DHS Chief Financial Office: Financial Transformation & Systems
Consolidation;
Description: Aims to achieve compliant financial management services
and optimize financial management operations across the diverse systems
cobbled together in 2003 when DHS was created from 22 agencies and over
200,000 people.
Program: DHS Chief Human Capital Office: Human Resource Information
Technology;
Description: Aims to improve and consolidate DHS's vast array of
payroll and personnel systems. It will provide DHS with a common
flexible suite of human resource business systems.
Program: Domestic Nuclear Detection Office: Advanced Spectroscopic
Portal Program;
Description: Its systems will develop, procure, and deploy current and
next generation passive cargo portal units at the nation's borders.
Program: Domestic Nuclear Detection Office: Cargo Advanced Automated
Radiography System - Active Radiography Detection Systems;
Description: Will deliver an advanced imaging system that will
automatically detect high density material, detecting shielding that
could be used to hide special nuclear material and highly enriched
uranium or weapons grade plutonium. The system aims to improve
throughput rates providing more effective scanning of a higher portion
of cargo at the nation's ports of entry.
Program: Domestic Nuclear Detection Office: Joint Analysis Center;
Description: An integrated system to collect, analyze and distribute
status, alarms, alert, and spectral data from all radiation portal
monitors and equipment deployed at the Federal, State, Local, Tribal
and international levels.
Program: Federal Emergency Management Agency (FEMA): Consolidated Alert
& Warning System;
Description: Provides the president, governors, mayors, tribal
leadership with the ability to speak to the American people in the
event of a national emergency by providing an integrated, survivable,
all-hazards public alert and warning system that leverages all
available technologies and transmission paths. It will also provide
"situation awareness" to the public and leadership at multiple levels
of government in an emergency.
Program: Federal Emergency Management Agency (FEMA): Disaster
Management E-Government Initiative;
Description: Provides information exchange delivery mechanisms through
a portal for disaster information, an information exchange backbone,
and data interoperability standards.
Program: Federal Emergency Management Agency (FEMA): Flood Map
Modernization;
Description: Established a technology-based, cost effective process for
updating, validating, and distributing flood risk data and digitalized
flood maps throughout the Nation.
Program: Federal Emergency Management Agency (FEMA): Housing Inspection
Services, Inspection Contracts;
Description: Provides inspection staff and logistics at a moment's
notice to any Presidentially declared disaster. The state of readiness
is 24 hours a day, 7 days a week, 365 days a year.
Program: Federal Emergency Management Agency (FEMA): Total Asset
Visibility (Phase I);
Description: Provides FEMA, emergency support function partners, and
state decision makers with visibility of disaster relief assets and
shipments to help ensure that the right assets are delivered in the
right quantities to the right locations at the right time.
Program: Immigration and Customs Enforcement (ICE): Asset Management
Construction Account;
Description: Aims to satisfy three fundamental requirements: 1) house a
growing population of illegal aliens, 2) provide appropriate conditions
of confinement and 3) maintain its facility infrastructure. These
requirements must be met through a series of design and build actions
that begin with establishing facility infrastructure, continue with
establishing detention capacity and culminate in building secure
housing facilities.
Program: Immigration and Customs Enforcement (ICE): Automation and
Modernization;
Description: IT modernization and automation initiative that serves as
the principal ICE program to: enhance ICE's technology foundation,
maximize workforce productivity, secure the IT environment, and improve
information sharing across ICE and DHS.
Program: Immigration and Customs Enforcement (ICE): Detention and
Removal Modernization;
Description: Will provide operations management and field personnel the
technical tools necessary to apprehend, detain, and remove illegal
aliens in a cost-effective manner.
Program: Immigration and Customs Enforcement (ICE): Federal Financial
Management System;
Description: Provides ICE with core accounting capabilities.
Program: Immigration and Customs Enforcement (ICE): Student and
Exchange Visitor Information System;
Description: Web-based system that manages data on schools, program
sponsors, foreign students, exchange visitors, and their dependents
during their approved participation in the U.S. education system so
that only legitimate visitors enter the US.
Program: National Protection and Program Directorate: Critical
infrastructure Warning Information Network;
Description: Survivable network connecting DHS with sectors that
restore the infrastructure: electricity, IT and communications; states'
homeland security advisors; and sector-specific agencies and resources
for each critical infrastructure sector.
Program: National Protection and Program Directorate: Infrastructure
Information Collection Program;
Description: Collects, catalogs and maintains standardized and
quantifiable, risk-related infrastructure information to enable the
execution of national risk management and for prioritizing the data for
use by DHS partners.
Program: National Protection and Program Directorate: National Security
and Emergency Preparedness Priority Telecommunications Service;
Description: Aims to provide specially designed telecommunications
services to the national security and emergency preparedness user
community during natural or man-made disasters when conventional
communications services are ineffective. These telecommunication
services are used to coordinate response and recovery efforts and, if
needed, to assist with facilitating the reconstitution of the
government.
Program: National Protection and Program Directorate: US CERT;
Description: Combines the capabilities of four existing investments to
form a fully integrated IT system that will help fulfill the
organization's mission to collect, analyze, and respond to cyber
security threats and vulnerabilities pursuant to its mission and
authorities.
Program: National Protection and Program Directorate: US Visitor and
Immigrant Status Indicator Technology;
Description: Program is to collect, maintain, and share information,
including biometric identifiers, on foreign nationals to determine
whether an individual (1) should be prohibited from entering the United
States; (2) can receive, extend, change, or adjust immigration status;
(3) has overstayed or otherwise violated the terms of admission; (4)
should be apprehended or detained for law enforcement action; or (5)
needs special protection/attention (e.g., refugees). The vision of the
US-VISIT Program is to deploy end-to-end management of data on foreign
nationals covering their interactions with U.S. immigration and border
management officials before they enter, when they enter, while they are
in the U.S., and when they exit.
Program: Office of Health Affairs: National Bio-Surveillance
Integration System;
Description: Information Technology investment with a mission of
providing early detection and characterization of a biological attack
on the United States.
Program: Science and Technology Directorate: National Bio and Agro-
Defense Facility;
Description: Infrastructure investment to support the Science and
Technology Chemical and Biological Division program, which provides the
technologies and systems needed to anticipate, deter, detect, mitigate,
and recover from possible biological attacks on this nation's
population, agriculture or infrastructure. The program operates
laboratories and biological detection systems and conducts research.
Program: Science and Technology Directorate: National Biodefense
Analysis and Countermeasures Center Facility;
Description: Infrastructure investment to support the Science and
Technology Chemical and Biological Division program, a key component in
implementing the Presidents National Strategy for Homeland Security by
addressing the need for substantial research into relevant biological
and medical sciences to better detect, and mitigate the consequences of
biological attacks and to conduct risk assessments. The program
operates laboratories and biological detection systems and conducts
research.
Program: Transportation Security Administration (TSA): Electronic
Baggage Screening Program;
Description: Implements a national checked-baggage screening system to
protect against criminal and terrorist threats, while minimizing
transportation industry and traveling public burdens.
Program: Transportation Security Administration (TSA): FAMS Air to
Ground Communications System and Tactical Information Sharing System;
Description: An airborne communication system of systems (air-to-
ground, ground-to-air, air-to-air and intra-cabin) that will give Air
Marshall and other Law Enforcement Officers access to wireless
communications and the ability to share information while in flight.
Program: Transportation Security Administration (TSA): FAMS Mission
Scheduling and Notification System;
Description: System to manage the schedules of federal air marshals
given the flights available (~25,000 per day) and the complexities of
last minute changes due to flight cancellations.
Program: Transportation Security Administration (TSA): Hazmat Threat
Assessment Program;
Description: Leverages existing intelligence data to perform threat
assessments on commercial truck drivers who transport hazardous
materials to determine threat status to transportation security.
Program: Transportation Security Administration (TSA): Passenger
Screening Program;
Description: Provides the resources required to deploy and maintain
passenger screening and carry-on baggage screening equipment and
processes at approximately 451 airports nationwide in order to minimize
the risk of injury or death of people or damage of property due to
hostile acts of terrorism.
Program: Transportation Security Administration (TSA): Secure Flight;
Description: Will strengthen the security of the nation's
transportation systems by creating, implementing, and operating a
threat-based watch list matching capability for approximately 250
million domestic air carrier passengers per year.
Program: Transportation Security Administration (TSA): Transportation
Worker Identification Credentialing;
Description: Will improve security by establishing a system-wide common
secure biometric credential, used by all transportation modes, for
personnel requiring unescorted physical and/or logical access to secure
areas of the trans system.
Program: Transportation Security Administration (TSA): TSA Operating
Platform;
Description: Provides common environment for hosting applications;
integrated data infrastructure; content; and a collection of shared
services.
Source: DHS information.
[End of table]
[End of section]
Footnotes:
[1] DHS major investments include those with a total acquisition cost
of $50 million or above for noninformation technology investments or
life-cycle costs greater than $100 million for information technology
investments.
[2] DHS Integrated Strategy for High-risk Management (2008).
[3] GAO, Homeland Security: Successes and Challenges in DHS's Efforts
to Create an Effective Acquisition Organization, [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO-05-179] (Washington, D.C.: Mar.
29, 2005).
[4] GAO, Information Technology: DHS Needs to Fully Define and
Implement Policies and Procedures for Effectively Managing Investments,
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-424] (Washington,
D.C.: Apr. 27, 2007).
[5] DHS defines investment risk as a measure of the potential inability
to achieve project objectives within defined cost and schedule
constraints. It has two components: the probability of failing to
achieve a particular outcome and the consequences or impact of failing
to achieve that outcome.
[6] DHS Management Directive No.1400, Investment Review Process, Draft
Version 2.0 (March 2006) (interim guidance pending formal clearance,
hereafter referred to as DHS Management Directive No. 1400).
[7] DHS Management Directive No. 1400 authorizes DHS and components to
tailor investment reviews based on the level, type, risk, and
complexity of the investment and its associated acquisition strategy.
[8] Investments are categorized into one of four levels based on an
investment's total acquisition costs, or total life cycle costs for IT
investments. Investment levels determine the extent and scope of the
required project and program management, the level of reporting
requirements, and the review and approval authority.
[9] Responsibility for the acquisition function at DHS is shared
between the CPO and each DHS component head. Eight DHS components have
internal procurement offices with a Head of Contracting Activity who
reports directly to the component head and is accountable to the CPO.
The eight components are: Coast Guard, Customs and Border Protection,
Federal Emergency Management Agency, Federal Law Enforcement Training
Center, Immigration and Customs Enforcement, Office of Procurement
Operations, Secret Service, and Transportation Security Administration.
The Head of Contracting Activity for each component has overall
responsibility for the day-to-day management of the component's
acquisition function.
[10] DHS, Investment Management Handbook, Draft Version 0.14, (March
2006).
[11] DHS Management Directive No. 1330, Planning, Programming,
Budgeting, and Execution.
[12] DHS Management Directive No. 1400 provides that level 1 and level
2 programs will have reviews at milestone decision points but no less
than yearly, depending upon the type and nature of the acquisition.
[13] For level 1 investments, the IRB is the required review and
approval authority to proceed to the next acquisition phase.
[14] For level 2 investments, the JRC is the required review and
approval authority to proceed to the next acquisition phase.
[15] DHS Management Directive No. 1400.
[16] GAO, Best Practices: An Integrated Portfolio Management Approach
to Weapon System Investments Could Improve DOD's Acquisition Outcomes,
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-388] (Washington,
D.C.: Mar. 30, 2007).
[17] GAO, Emergency Preparedness: Current Emergency Alert System Has
Limitations, and Development of a New Integrated System Will Be
Challenging, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-411]
(Washington, D.C.: Mar. 30, 2007).
[18] GAO, Supply Chain Security: Challenges to Scanning 100 Percent of
U.S.-Bound Cargo Containers, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-08-533T] (Washington, D.C.: June 12, 2008).
[19] GAO, Homeland Security: DHS Has Taken Actions to Strengthen Border
Security Programs and Operations, but Challenges Remain, [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO-08-542T] (Washington, D.C.: Mar.
6, 2008).
[20] GAO, Information Technology: OMB and Agencies Need to Improve
Planning, Management, and Oversight of Projects Totaling Billions of
Dollars, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-1051T]
(Washington, D.C.: July 31, 2008).
[21] GAO, Information Technology: OMB and Department of Homeland
Security Investment Reviews, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-04-323] (Washington, D.C.: Feb. 10, 2004).
[22] See GAO, Homeland Security: Successes and Challenges in DHS's
Efforts to Create an Effective Acquisition Organization, [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO-05-179] (Washington, D.C.: Mar.
29, 2005).
[23] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-424].
[24] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-424].
[25] Department of Homeland Security, Office of the Inspector General,
Risk Management Advisory for the SBInet Program Initiation, OIG-07-07
(Washington, D.C.: Nov. 14, 2006).
[26] DHS Management Directive No. 1400; DHS Investment Management
Handbook, Draft version 0.14, (March 2006).
[27] See DOD, Department of Defense Directive Number 5000.1, The
Defense Acquisition System (May 12, 2003); Department of Defense
Instruction Number 5000.2, Operation of the Defense Acquisition System
(May 12, 2003); Defense Acquisition Guidebook, Version 1.0 (Oct. 17,
2004).
[28] GAO, Defense Acquisitions: Better Weapon Program Outcomes Require
Discipline, Accountability, and Fundamental Changes in the Acquisition
Environment, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-782T]
(Washington, D.C.: June 3, 2008).
[29] Per DHS Management Directive No. 0782, Acquisition Certification
Requirement for Program Managers, DHS Program Managers must be
certified at a level commensurate with the responsibilities of the
acquisition being managed or eligible for certification within 18
months of designation. The DHS CPO may consider temporary waivers to
training requirements in rare cases.
[30] See GAO, Homeland Security: Successes and Challenges in DHS's
Efforts to Create an Effective Acquisition Organization, [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO-05-179] (Washington, D.C.: Mar.
29, 2005).
[31] GAO, Homeland Security: U.S. Visitor and Immigration Status
Program's Long-standing Lack of Strategic Direction and Management
Controls Need to Be Addressed, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-07-1065] (Washington, D.C.: Aug. 31, 2007).
[32] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-542T].
[33] GAO, USCIS Transformation: Improvements to Performance, Human
Capital, and Information Technology Management Needed as Modernization
Proceeds, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-1013R]
(Washington, D.C.: July 17, 2007).
[34] GAO, Executive Guide: Leading Practices in Capital Decision-
Making, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO/AIMD-99-32]
(Washington D.C.: December 1998). OMB, Capital Programming Guide:
Supplement to Circular A-11, Part 7, Preparation, Submission, and
Execution of the Budget (Washington, D.C.: Executive Office of the
President, June 2006).
[35] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-388].
[36] OMB, Capital Programming Guide: Supplement to Circular A-11, Part
7, Preparation, Submission, and Execution of the Budget.
[37] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-424].
[38] GAO, Cost Assessment Guide: Best Practices for Estimating and
Managing Program Costs, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-07-1134SP] (Washington, D.C.: July 2007).
[39] GAO, Managing for Results: Using the Results Act to Address
Mission Fragmentation and Program Overlap, [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO/AIMD-97-146] (Washington, D.C.:
Aug. 29, 1997).
[40] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-424].
[41] GAO, Aviation Security: Progress Made in Systematic Planning to
Guide Key Investment Decisions, but More Work Remains, [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO-07-448T] (Washington, D.C.: Feb.
13, 2007).
[42] GAO, Aviation Security: Transportation Security Administration Has
Strengthened Planning to Guide Investments in Key Aviation Security
Programs, but More Work Remains, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-08-456T] (Washington, D.C.: Feb. 28, 2008).
[43] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-1013R].
[44] OMB, Circular No. A-11, Preparation, Submission, and Execution of
the Budget (Washington, D.C.: Executive Office of the President, June
2006); Circular No. A-130 Revised, Management of Federal Information
Resources (Washington, D.C.: Executive Office of the President, Nov.
28, 2000); and Capital Programming Guide: Supplement to Circular A-11,
Part 7, Preparation, Submission, and Execution of the Budget.
[45] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-1051T].
[46] DHS major investments include those with a total acquisition cost
of $50 million or above for noninformation technology investments or
life-cycle costs greater than $100 million for information technology
investments.
[End of section]
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
weekday, GAO posts newly released reports, testimony, and
correspondence on its Web site. To have GAO e-mail you a list of newly
posted products every afternoon, go to [hyperlink, http://www.gao.gov]
and select "E-mail Updates."
Order by Phone:
The price of each GAO publication reflects GAO‘s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO‘s Web site,
[hyperlink, http://www.gao.gov/ordering.htm].
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional
information.
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Ralph Dawn, Managing Director, dawnr@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, D.C. 20548:
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548:
