Background

In July 2002, President Bush issued the National Strategy for Homeland  Security. The strategy set forth overall objectives to prevent terrorist  attacks within the United States, reduce America’s vulnerability to  terrorism, and minimize the damage and assist in the recovery from  attacks that occur. The strategy set out a plan to improve homeland  security through the cooperation and partnering of federal, state, local,  and private sector organizations on an array of functions. The National  Strategy for Homeland Security specified a number of federal  departments, as well as nonfederal organizations, that have important  roles in securing the homeland. In terms of federal departments, DHS was  assigned a leading role in implementing established homeland security  mission areas.
In November 2002, the Homeland Security Act of 2002 was enacted into  law, creating DHS. This act defined the department’s missions to include  preventing terrorist attacks within the United States; reducing U.S.  vulnerability to terrorism; and minimizing the damages, and assisting in  the recovery from, attacks that occur within the United States. The act  also specified major responsibilities for the department, including to  analyze information and protect infrastructure; develop countermeasures  against chemical, biological, radiological, and nuclear, and other emerging  terrorist threats; secure U.S. borders and transportation systems; and  organize emergency preparedness and response efforts. DHS began  operations in March 2003. Its establishment represented a fusion of 22  federal agencies to coordinate and centralize the leadership of many  homeland security activities under a single department.
A variety of factors have affected DHS’s efforts to implement its mission  and management functions. These factors include both domestic and  international events, such as Hurricanes Katrina and Rita, and major  homeland security-related legislation. Figure 1 provides a timeline of key  events that have affected DHS’s implementation.

	Our Report Assesses DHS’s Progress in Implementing Its Mission and Management Functions

Our report assesses DHS’s progress across 14 mission and management  areas. We based these areas on those identified in the National Strategy  for Homeland Security, the goals and objectives set forth in the DHS  strategic plan and homeland security presidential directives, our reports,  and studies conducted by the DHS IG and other organizations and groups,  such as the 9/11 Commission and the Century Foundation. The 14 we  identified are  5.  Surface transportation security  7.  Emergency preparedness and response  8.  Critical infrastructure and key resources protection  9.  Science and technology  12. Human capital management  13. Information technology management  14. Real property management  For each mission and management area, we identified performance  expectations and vetted them with DHS officials. These performance  expectations are a composite of the responsibilities or functions—derived  from legislation, homeland security presidential directives and executive  orders, DHS planning documents, and other sources—that the department  is to achieve. Our analysts and subject matter experts reviewed our prior  work, DHS IG work, and evidence DHS provided between March and July  2007, including DHS officials’ assertions when supported by  documentation. On the basis of this analysis and our experts’ judgment,  we then assessed the extent to which DHS had achieved each of the  expectations we identified. We made preliminary assessments for each  performance expectation based solely on GAO and DHS IG work. In  March through July, we received additional information from DHS, which  we reviewed and used to inform our final assessments. In some cases the  assessments remained the same as our preliminary ones, and in other  cases they changed.
When our review of our prior work, the DHS IG’s work, and DHS’s  documentation indicated that DHS had satisfied most of the key elements  of a performance expectation, we concluded that DHS had generally  achieved it. When our reviews showed that DHS had not yet satisfied most  of the key elements of a performance expectation, we concluded that DHS  had generally not achieved it. More specifically, where our prior work or  that of the DHS IG indicated DHS had not achieved a performance  expectation and DHS did not provide documentation to prove otherwise,  we concluded that DHS had generally not achieved it. For a small number  of performance expectations we could not make an assessment because  neither we nor the DHS IG had completed work and the information DHS  provided did not enable us to clearly assess DHS’s progress.
We used these performance expectation assessments to determine DHS’s  overall progress in each mission and management area. After making an  assessment for each performance expectation, we added up those rated as  generally achieved. We divided this number by the total number of  performance expectations for the mission or management area, excluding  those performance expectations for which we could not make an  assessment. If DHS generally achieved more than 75 percent of the  identified performance expectations, we identified its overall progress as  substantial. When the number achieved was more than 50 percent but 75  percent or less, we identified its overall progress as moderate. If DHS  generally achieved more than 25 percent but 50 percent or less, we  identified its overall progress as modest. For mission and management  areas in which DHS generally achieved 25 percent or less of the  performance expectations, we identified overall progress as limited.
We and the DHS IG have completed varying degrees of work for each  mission and management area, and DHS’s components and offices  provided us with different amounts and types of information. As a result,  our assessments of DHS’s progress in each mission and management area  reflect the information available for our review and analysis and are not  equally comprehensive across all 14 mission and management areas. It is  also important to note that while there are qualitative differences between  the performance expectations, we did not weigh some more heavily than  others in our overall assessments of mission and management areas. We  also recognize that these expectations are not time bound, and DHS will  take actions to satisfy these expectations over a sustained period of time.  Our assessment of DHS’s progress relative to each performance  expectation refers to the progress made by the department since March  2003 and does not imply that DHS should have fully achieved each  performance expectation at this point.
In commenting on a draft of our report, DHS took issues with our  methodology. First, DHS believed that we altered the criteria we used to  judge the department’s progress. We did not change our criteria; rather we  made a change in terminology to better convey the intent behind the  performance expectations that DHS achieve them instead of merely take  actions that apply or relate to them. Second, DHS took issue with the  binary standard approach we used to assess each performance  expectation. We acknowledge the limitations of this standard in our report  but believe it was appropriate for our review given that the Administration  has generally not established quantitative goals and measures for the  expectations. Therefore, we could not assess where along a spectrum of  progress DHS stood in achieving each performance expectation. Third,  DHS was concerned about an apparent shift in criteria we applied after the  department provided us additional information and documents. What DHS  perceived as a change in criteria for certain performance expectations was  really the process by which we disclosed our preliminary assessment;  analyzed additional documents and information from DHS; and updated  and, in many cases revised, our assessments based on the additional  inputs. Fourth, DHS raised concerns with consistency in our application of  the methodology. Our core team of GAO analysts and managers reviewed  all inputs from GAO staff to ensure consistent application of our  methodology, criteria, and analytical process, and our quality control  process included detailed reviews of the report’s facts as well as  assurances that we followed generally accepted government auditing  standards. Finally, DHS points outs that we treated all performance  expectations as if they were of equal significance. In our report, we  acknowledged that differences exist, but we did not weight the  performance expectations because congressional, departmental, and  others’ views on the relative priority of each expectation may be different,  and we did not believe it was appropriate to substitute our judgment for  theirs.
Overall, we appreciate DHS’s concerns and recognize that in such a broad- based endeavor, some level of disagreement is inevitable, especially at any  given point in time. However, we have been as transparent as possible  regarding our purpose, methodology, and professional judgments and  believe that our methodology provides a sound basis for the progress  report.

	DHS Has Made Progress in Implementing Mission and Management Functions but Has Faced Difficulties in Its Implementation Efforts

Our report shows that since March 2003, DHS has attained some level of  progress in implementing the performance expectations in all of its major  mission and management areas, but the rate of progress among these  areas has varied. Overall, DHS has made more progress in its mission  areas than in its management areas, reflecting an understandable focus on  implementing efforts to secure the homeland. As DHS continues to mature  as an organization, we believe it will be able to put more focus—and  achieve more expectations—in the management areas.
Within its mission areas, DHS has made more progress in developing  strategies, plans, and programs than in implementing them. For example,  in the area of border security we found that DHS has developed a  multiyear strategy and initiative for identifying illegal border crossings  between ports of entry. However, DHS is in the early stages of  implementing this strategy, and we and the DHS IG identified problems  with implementation of past programs with similar objectives. Likewise, in  the area of emergency preparedness and response, DHS has developed the  National Incident Management System. However, we have reported that  much more work remains for DHS to effectively coordinate its  implementation.
Below we provide more information on progress made by DHS in its  mission and management areas.
DHS’s border security mission includes detecting and preventing  terrorists and terrorist weapons from entering the United States;  facilitating the orderly and efficient flow of legitimate trade and travel;  interdicting illegal drugs and other contraband; apprehending  individuals who are attempting to enter the United States illegally;  inspecting inbound and outbound people, vehicles, and cargo; and  enforcing laws of the United States at the border. As shown in table 2,  we identified 12 performance expectations for DHS in the area of  border security and found that DHS has generally achieved 5 of them  and has generally not achieved 7 others.
DHS’s immigration enforcement mission includes apprehending,  detaining, and removing criminal and illegal aliens; disrupting and  dismantling organized smuggling of humans and contraband as well as  human trafficking; investigating and prosecuting those who engage in  benefit and document fraud; blocking and removing employers’ access  to undocumented workers; and enforcing compliance with programs to  monitor visitors. As shown in table 3, we identified 16 performance  expectations for DHS in the area of immigration enforcement and  found that DHS has generally achieved 8 of them and has generally not  achieved 4 others. For 4 performance expectations, we could not make  an assessment.
DHS’s immigration services mission includes administering  immigration benefits and working to reduce immigration benefit fraud.  As shown in table 4, we identified 14 performance expectations for  DHS in the area of immigration services and found that DHS has  generally achieved 5 of them and has generally not achieved 9 others.
DHS’s aviation security mission includes strengthening airport  security; providing and training a screening workforce; prescreening  passengers against terrorist watch lists; and screening passengers,  baggage, and cargo. As shown in table 5, we identified 24 performance  expectations for DHS in the area of aviation security and found that  DHS has generally achieved 17 of them and has generally not achieved  7 others.
DHS’s surface transportation security mission includes establishing  security standards and conducting assessments and inspections of  surface transportation modes, which include passenger and freight rail;  mass transit; highways, including commercial vehicles; and pipelines.
As shown in table 6, we identified 5 performance expectations for DHS  in the area of surface transportation security and found that DHS has  generally achieved 3 of them and has generally not achieved 2.
DHS’s maritime security responsibilities include port and vessel  security, maritime intelligence, and maritime supply chain security. As  shown in table 7, we identified 23 performance expectations for DHS in  the area of maritime security and found that DHS has generally  achieved 17 of them and has generally not achieved 4 others. For 2  performance expectations, we could not make an assessment.
DHS’s emergency preparedness and response mission includes  preparing to minimize the damage and recover from terrorist attacks  and disasters; helping to plan, equip, train, and practice needed skills of  first responders; and consolidating federal response plans and  activities to build a national, coordinated system for incident  management. As shown in table 8, we identified 24 performance  expectations for DHS in the area of emergency preparedness and  response and found that DHS has generally achieved 5 of them and has  generally not achieved 18 others. For 1 performance expectation, we  could not make an assessment.
DHS’s critical infrastructure and key resources protection  activities include developing and coordinating implementation of a  comprehensive national plan for critical infrastructure protection,  developing partnerships with stakeholders and information sharing and  warning capabilities, and identifying and reducing threats and  vulnerabilities. As shown in table 9, we identified 7 performance  expectations for DHS in the area of critical infrastructure and key  resources protection and found that DHS has generally achieved 4 of  them and has generally not achieved 3 others.
DHS’s science and technology efforts include coordinating the  federal government’s civilian efforts to identify and develop  countermeasures to chemical, biological, radiological, nuclear, and  other emerging terrorist threats. As shown in table 10, we identified 6  performance expectations for DHS in the area of science and  technology and found that DHS has generally achieved 1 of them and  has generally not achieved 5 others.
DHS’s acquisition management efforts include managing the use of  contracts to acquire goods and services needed to fulfill or support the  agency’s missions, such as information systems, new technologies,  aircraft, ships, and professional services. As shown in table 11, we  identified 3 performance expectations for DHS in the area of  acquisition management and found that DHS has generally achieved 1  of them and has generally not achieved 2 others.
DHS’s financial management efforts include consolidating or  integrating component agencies’ financial management systems. As  shown in table 12, we identified 7 performance expectations for DHS in  the area of financial management and found that DHS has generally  achieved 2 of them and has generally not achieved 5 others.
DHS’s key human capital management areas include pay,  performance management, classification, labor relations, adverse  actions, employee appeals, and diversity management. As shown in  table 13, we identified 8 performance expectations for DHS in the area  of human capital management and found that DHS has generally  achieved 2 of them and has generally not achieved 6 others.
DHS’s information technology management efforts include  developing and using an enterprise architecture, or corporate  blueprint, as an authoritative frame of reference to guide and constrain  system investments; defining and following a corporate process for  informed decision making by senior leadership about competing  information technology investment options; applying system and  software development and acquisition discipline and rigor when  defining, designing, developing, testing, deploying, and maintaining  systems; establishing a comprehensive, departmentwide information  security program to protect information and systems; having sufficient  people with the right knowledge, skills, and abilities to execute each of  these areas now and in the future; and centralizing leadership for  extending these disciplines throughout the organization with an  empowered Chief Information Officer. As shown in table 14, we  identified 13 performance expectations for DHS in the area of  information technology management and found that DHS has generally  achieved 2 of them and has generally not achieved 8 others. For 3  performance expectations, we could not make an assessment.
DHS’s responsibilities for real property management are specified in  Executive Order 13327, “Federal Real Property Asset Management,”  and include establishment of a Senior Real Property Officer,  development of an asset inventory, and development and  implementation of an asset management plan and performance  measures. As shown in table 15, we identified 9 performance  expectations for DHS in the area of real property management and  found that DHS has generally achieved 6 of them and has generally not  achieved 3 others.
Our report contains detailed information on DHS’s progress in achieving  each of the performance expectations, including a detailed summary of  our work, the DHS IG’s work, and DHS documentation and officials’  statements. We also provide our basis for each assessment. In commenting  on a draft of our report, DHS disagreed with our assessments for 42 of the  171 performance expectations noted above. In our report, we provide  detailed responses to DHS’s comments on the 42 performance  expectations. We look forward to discussing our assessments in all the  mission and management areas in more detail with the committee and  subcommittees to help inform their ongoing oversight efforts.

	Cross-cutting Issues Have Hindered DHS’s Implementation Efforts

Our work has identified cross-cutting issues that have hindered DHS’s  progress in its mission and management areas. These issues include: (1)  transforming and integrating DHS’s management functions; (2)  establishing baseline performance goals and measures and engaging in  effective strategic planning efforts; (3) applying and improving a risk  management approach for implementing missions and making resource  allocation decisions; (4) sharing information with key stakeholders; and  (5) coordinating and partnering with federal, state, local, and private  sector agencies entities.
The creation of DHS is an enormous management challenge, and DHS  faces a formidable task in its transformation efforts as it works to  integrate over 170,000 federal employees from 22 component agencies.  Each component agency brought differing missions, cultures, systems,  and procedures that the new department had to efficiently and  effectively integrate into a single, functioning unit. At the same time it  weathers these growing pains, DHS must still fulfill its various  homeland security and other missions. DHS has developed a strategic  plan, is working to integrate some management functions, and has  continued to form necessary partnerships to achieve mission success.  Despite these efforts, we reported earlier this year that DHS  implementation and transformation remains high-risk because DHS has  not yet developed a comprehensive management integration strategy  and its management systems and functions⎯especially related to  acquisition, financial, human capital, and information  management⎯are not yet fully integrated and wholly operational.
A number of DHS’s programs lack outcome goals and measures, a fact  that may hinder the department’s ability to effectively assess the results  of program efforts or fully assess whether the department is using  resources effectively and efficiently, especially given various agency  priorities for resources. In particular, we have reported that some of  DHS’s components have not developed adequate outcome-based  performance measures or comprehensive plans to monitor, assess, and  independently evaluate the effectiveness of their plans and  performance. For example, in August 2005 we reported that U.S.  Immigration and Customs Enforcement lacked outcome goals and  measures for its worksite enforcement program and recommended that  the agency set specific time frames for developing these goals and  measures. Further, we have reported that many of DHS’s border- related performance goals and measures are not fully defined or  adequately aligned with one another, and some performance targets are  not realistic. We have also recognized that DHS faces some inherent  difficulties in developing performance goals and measures to address  its unique mission and programs, such as in developing measures for  the effectiveness of its efforts to prevent and deter terrorist attacks.
Within its sphere of responsibility, DHS cannot afford to protect  everything against all possible threats. As a result, DHS must make  choices about how to allocate its resources to most effectively manage  risk. In April 2007, DHS established the new Office of Risk Management  and Analysis to serve as the DHS Executive Agent for national-level  risk management analysis standards and metrics; develop a  standardized approach to risk; develop an approach to risk  management to help DHS leverage and integrate risk expertise across  components and external stakeholders; assess DHS risk performance  to ensure programs are measurably reducing risk; and communicate  DHS risk management in a manner that reinforces the risk-based  approach. It is too early to tell what effect this office will have on  strengthening departmentwide risk management activities. Several  DHS component agencies have taken steps toward integrating risk- based decision making into their decision-making processes. For  example, the Coast Guard has developed security plans for seaports,  facilities, and vessels based on risk assessments. Other components  have not always utilized such an approach. In addition, DHS has not  performed comprehensive risk assessments in transportation, critical  infrastructure, and the immigration and customs systems to guide  resource allocation decisions. For example, DHS has not fully utilized a  risk-based strategy to allocate resources among transportation sectors.  Although TSA has developed tools and processes to assess risk within  and across transportation modes, it has not fully implemented these  efforts to drive resource allocation decisions.
In 2005, we designated information sharing for homeland security as  high-risk and continued that designation in 2007. We recently reported  that the nation still lacked an implemented set of governmentwide  policies and processes for sharing terrorism-related information but  has issued a strategy on how it will put in place the overall framework,  policies, and architecture for sharing with all critical partners—actions  that we and others have recommended. DHS has taken some steps to  implement its information-sharing responsibilities. For example, DHS  implemented a network to share homeland security information. States  and localities are also creating their own information “fusion” centers,  some with DHS support. However, DHS did not fully adhere to key  practices in coordinating efforts on its homeland security information  network with state and local information sharing initiatives and faces  other information-sharing challenges, including developing productive  information-sharing relationships among the federal government, state  and local governments, and the private sector.
To secure the nation, DHS must form effective and sustained  partnerships among legacy component agencies and also with a range  of other entities, including other federal agencies, state and local  governments, the private and nonprofit sectors, and international  partners, but has faced difficulties in doing so. Thirty-three of the 43  initiatives the National Strategy for Homeland Security are required  to be implemented by three or more federal agencies. In addition, the  private sector is a key homeland security partner. For example, DHS  must partner with individual companies and organizations to protect  vital national infrastructure, such as the nation’s water supply,  transportation systems, and chemical facilities. In October 2006 we  reported that all 17 critical infrastructure sectors had established their  respective government councils, and nearly all sectors had initiated  their voluntary private sector councils in response to the National  Infrastructure Protection Plan. In addition, through its Customs-Trade  Partnership Against Terrorism Program, CBP has worked in  partnership with private companies to review their supply chain  security plans. However, DHS has faced some challenges in developing  other effective partnerships and in clarifying the roles and  responsibilities of various homeland security stakeholders. For  example, federal and private sector stakeholders stated that the  Transportation Security Administration (TSA) has not provided them  with the information they would need to support TSA’s efforts for the  Secure Flight program. Further, lack of clarity regarding roles and  responsibilities caused DHS difficulties in coordinating with its  emergency preparedness and response partners in responding to  Hurricanes Katrina and Rita.

	Concluding Observations

Given the leading role that DHS plays in securing the homeland, it is  critical that the department’s mission programs and management systems  and functions operate as efficiently and effectively as possible. In the more  than 4 years since its establishment, the department has taken important  actions to secure the border and the transportation sector and to defend  against, prepare for, and respond to threats and disasters. DHS has had to  undertake these critical missions while also working to transform itself  into a fully functioning cabinet department—a difficult undertaking for  any organization and one that can take, at a minimum, 5 to 7 years to  complete even under less daunting circumstances. At the same time, a  variety of factors, including Hurricanes Katrina and Rita, threats to and  attacks on transportation systems in other countries, and new  responsibilities and authorities provided by Congress have forced the  department to reassess its priorities and reallocate resources to address  key domestic and international events and to respond to emerging issues  and threats.
As it moves forward, DHS will continue to face the challenges that have  affected its operations thus far, including transforming into a high- performing, results-oriented agency; developing results-oriented goals and  measures to effectively assess performance; developing and implementing  a risk-based approach to guide resource decisions; and establishing  effective frameworks and mechanisms for sharing information and  coordinating with homeland security partners. DHS has undertaken efforts  to address these challenges but will need to give continued attention to  these efforts in order to efficiently and effectively identify and prioritize  mission and management needs, implement efforts to address those needs,  and allocate resources accordingly. Efforts to address these challenges are  especially important given the threat environment and long-term fiscal  imbalance facing the nation. While this testimony contains no new  recommendations, in past products GAO has made approximately 700  recommendations to DHS. DHS has implemented some of these  recommendations and taken actions to implement others. However, we  have reported that the department still has much to do to ensure that it  conducts its missions efficiently and effectively while it simultaneously  prepares to address future challenges that face the department and the  nation.
A well-managed, high-performing Department of Homeland Security is  essential to meeting the significant homeland security challenges facing  the nation. As DHS continues to evolve, implement its programs, and  integrate its functions, we will continue to review its progress and  performance and provide information to Congress and the public on its  efforts.
This concludes my prepared statement. I would be pleased to answer any  questions you and the Committee members may have.

	GAO Contact and Staff Acknowledgments

For further information about this testimony, please contact Norman J.  Rabkin, Managing Director, Homeland Security and Justice, at 202-512- 8777 or rabkinn@gao.gov. Other key contributors to this statement were  Jason Barnosky, Rebecca Gambler, Kathryn Godfrey, Christopher Keisling,  Thomas Lombardi, Octavia Parks, and Sue Ramanathan.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.

Summary:
Why GAO Did This Study

The Department of Homeland Security's (DHS) recent 4-year anniversary provides an opportunity to reflect on the progress DHS has made. The creation of DHS was one of the largest federal reorganizations in the last several decades, and GAO has reported that it was an enormous management challenge and that the size, complexity, and importance of the effort made the challenge especially daunting and critical to the nation's security. Our prior work on mergers and acquisitions has found that successful transformations of large organizations, even those faced with less strenuous reorganizations than DHS, can take at least 5 to 7 years to achieve. This testimony is based on our August 2007 report evaluating DHS's progress since March 2003. Specifically, it addresses DHS's progress across 14 mission and management areas and key themes that have affected DHS's implementation efforts.

What GAO Found

Since its establishment in March 2003, DHS has made varying levels of progress in implementing its mission and management areas, as shown in the following table. In general, DHS has made more progress in its mission areas than in its management areas. Within its mission areas, DHS has made progress in developing plans and programs, but has faced challenges in its implementation efforts. Key underlying themes have affected DHS's implementation efforts. These include strategies to achieve agency transformation, strategic planning and results management, risk management, information sharing, and partnerships and coordination. For example, we have designated DHS's implementation and transformation as high-risk. While DHS has made progress in transforming its component agencies into a fully functioning department, it has not yet addressed elements of the transformation process, such as developing a comprehensive transformation strategy. DHS also has not yet fully adopted and applied a risk management approach in implementing its mission and management functions. Some DHS component agencies have taken steps to do so, but this approach is not yet used departmentwide. In addition, DHS has taken steps to share information and coordinate with homeland security partners but has faced difficulties in these partnership efforts. Given DHS's leading role in securing the homeland, it is critical that the department's mission and management programs operate as efficiently and effectively as possible. DHS has taken important actions to secure the border and transportation sectors and to prepare for and respond to disasters. DHS has had to undertake these missions while also working to transform itself into a fully functioning cabinet department--a difficult task for any organization. As DHS moves forward, it will be important for the department to continue to develop more measurable goals to guide implementation efforts and to enable better accountability. It will also be important for DHS to continually reassess its mission and management goals, measures, and milestones to evaluate progress made, identify past and emerging obstacles, and examine alternatives to effectively address those obstacles.