U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Publishing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

28–418 PDF 2018

DHS FINANCIAL SYSTEMS: WILL MODERNIZATION 

EVER BE ACHIEVED? 

HEARING 

BEFORE THE

SUBCOMMITTEE ON 

OVERSIGHT AND 

MANAGEMENT EFFICIENCY 

OF THE

COMMITTEE ON HOMELAND SECURITY 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED FIFTEENTH CONGRESS 

FIRST SESSION 

SEPTEMBER 26, 2017 

Serial No. 115–29 

Printed for the use of the Committee on Homeland Security 

Available via the World Wide Web: http://www.govinfo.gov 


Congress.#13
(II) 

COMMITTEE ON HOMELAND SECURITY 

MICHAEL T. MCCAUL, Texas, Chairman 

LAMAR SMITH, Texas 

PETER T. KING, New York 

MIKE ROGERS, Alabama 

JEFF DUNCAN, South Carolina 

LOU BARLETTA, Pennsylvania 

SCOTT PERRY, Pennsylvania 

JOHN KATKO, New York 

WILL HURD, Texas 

MARTHA MCSALLY, Arizona 

JOHN RATCLIFFE, Texas 

DANIEL M. DONOVAN, JR., New York 

MIKE GALLAGHER, Wisconsin 

CLAY HIGGINS, Louisiana 

JOHN H. RUTHERFORD, Florida 

THOMAS A. GARRETT, JR., Virginia 

BRIAN K. FITZPATRICK, Pennsylvania 

RON ESTES, Kansas 

BENNIE G. THOMPSON, Mississippi 

SHEILA JACKSON LEE, Texas 

JAMES R. LANGEVIN, Rhode Island 

CEDRIC L. RICHMOND, Louisiana 

WILLIAM R. KEATING, Massachusetts 

DONALD M. PAYNE, JR., New Jersey 

FILEMON VELA, Texas 

BONNIE WATSON COLEMAN, New Jersey 

KATHLEEN M. RICE, New York 

J. LUIS CORREA, California 

VAL BUTLER DEMINGS, Florida 

NANETTE DIAZ BARRAGA ́ N, California 

BRENDAN P. SHIELDS, Staff Director 

STEVEN S. GIAIER, Deputy Chief Counsel 

MICHAEL S. TWINCHEK, Chief Clerk 

HOPE GOINS, Minority Staff Director 

SUBCOMMITTEE ON OVERSIGHT AND MANAGEMENT EFFICIENCY 

SCOTT PERRY, Pennsylvania, Chairman 

JEFF DUNCAN, South Carolina 

JOHN RATCLIFFE, Texas 

CLAY HIGGINS, Louisiana 

RON ESTES, Kansas 

MICHAEL T. MCCAUL, Texas (ex officio) 

J. LUIS CORREA, California 

KATHLEEN M. RICE, New York 

NANETTE DIAZ BARRAGA ́ N, California 

BENNIE G. THOMPSON, Mississippi (ex officio) 

RYAN CONSAUL, Subcommittee Staff Director 

ERICA D. WOODS, Interim Subcommittee Minority Staff Director 

(III) 

C O N T E N T S 

Page 

STATEMENTS

The Honorable Scott Perry, a Representative in Congress From the State 

of Pennsylvania, and Chairman, Subcommittee on Oversight and Management Efficiency: 

Oral Statement ..................................................................................................... 1 

Prepared Statement ............................................................................................. 2 

The Honorable J. Luis Correa, a Representative in Congress From the State 

of California, and Ranking Member, Subcommittee on Oversight and Management Efficiency: 

Oral Statement ..................................................................................................... 3 

Prepared Statement ............................................................................................. 4 

The Honorable Bennie G. Thompson, a Representative in Congress From 

the State of Mississippi, and Ranking Member, Committee on Homeland 

Security: 

Prepared Statement ............................................................................................. 5 

WITNESSES

Mr. Chip Fulghum, Deputy Under Secretary for Management, U.S. Department of Homeland Security: 

Oral Statement ..................................................................................................... 6 

Prepared Statement ............................................................................................. 7 

Ms. Michele F. Singer, Director, Interior Business Center, U.S. Department 

of the Interior: 

Oral Statement ..................................................................................................... 10 

Prepared Statement ............................................................................................. 11 

Ms. Elizabeth Angerman, Executive Director, United Shared Services Management, Office of Government-Wide Policy, U.S. General Services Administration: 

Oral Statement ..................................................................................................... 13 

Prepared Statement ............................................................................................. 14 

Mr. Asif A. Khan, Director, Financial Management and Assurance, U.S. Government Accountability Office: 

Oral Statement ..................................................................................................... 16 

Prepared Statement ............................................................................................. 18 

APPENDIX

Questions From Chairman Scott Perry for Chip Fulghum .................................. 41 

Questions From Chairman Scott Perry for Elizabeth Angerman ........................ 42 

(1) 

DHS FINANCIAL SYSTEMS: WILL 

MODERNIZATION EVER BE ACHIEVED? 

Tuesday, September 26, 2017 

U.S. HOUSE OF REPRESENTATIVES, COMMITTEE ON HOMELAND SECURITY, SUBCOMMITTEE ON OVERSIGHT AND

MANAGEMENT EFFICIENCY, Washington, DC. 

The subcommittee met, pursuant to notice, at 2 o’clock p.m., in 

Room HVC–210, Capitol Visitor Center, Hon. Scott Perry [Chairman of the subcommittee] presiding. 

Present: Representatives Perry, Duncan, Ratcliffe, Higgins, 

Estes, Correa, Rice, and Barraga ́n. 

Mr. PERRY. The Committee on Homeland Security Subcommittee 

on Oversight and Management Efficiency will come to order. 

The purpose of this hearing is to examine the failures and path 

forward with modernizing the Department of Homeland Security’s 

financial systems. 

The Chair now recognizes himself for an opening statement. 

As the third-largest Federal Cabinet agency, the Department of 

Homeland Security, or DHS, has a duty to be an effective steward 

of taxpayer dollars. Sound management of its finances is vital to 

implementing the homeland security mission. 

With a multitude of priorities, including responding to major 

emergencies like Hurricanes Harvey and Irma, securing our porous 

borders, protecting cyber space and enforcing our immigration 

laws, DHS’s senior leadership needs timely financial information to 

inform its decisions. 

In addition, DHS needs systems that can be fully protected 

against the latest cyber threats to ensure personal and other sensitive data isn’t compromised. Unfortunately, the Department’s 

third and latest attempt to modernize its flagging financial systems 

has failed and DHS is struggling to determine a solid path forward. 

DHS has been attempting to modernize its financial systems for 

well over a decade. The two previous attempts wasted, or cost, over 

$50 million to build a Department-wide integrated financial system. 

Following these failures—and I say that because we are still try- ing, we still don’t have anything after the $50 million—but following these failures, DHS chose to modernize component financial 

systems with the most critical need first. 

In 2013, the Obama administration urged agencies to use Federal shared service providers to improve financial systems. Shortly 

thereafter, DHS decided to enter a discovery phase with the InteVerDate Mar 15 2010 13:08 Mar 01, 2018 Jkt 000000 PO 00000 Frm 00005 Fmt 6633 Sfmt 6633 H:\115TH CONGRESS\17OM0926\17OM0926.TXT HEATH
2 

rior Business Center, or the IBC, within the Department of Interior. 

By August 2014, DHS had entered into an agreement with the 

IBC to modernize systems for the Domestic Nuclear Detection Office, Transportation Security Administration, and the U.S. Coast 

Guard at a cost of $79 million. 

Congressional watchdogs at GAO, or the Government Accountability Office, warned in 2013 that DHS had an increased risk of, 

among other things, investing in and implementing systems that 

do not provide the desired capabilities and ineffectively use resources during its financial system modernization efforts. 

GAO’s prediction came true. Costs for the project have ballooned 

to over $124 million as of August, about 60 percent more than the 

original estimate. 

However, the truth is that DHS has no idea how much it will 

cost in the end. TSA’s modernized system will go live over 2 years 

later than planned and the Coast Guard system will not be modernized at all under the current agreement with the IBC. This outcome is simply astounding, reprehensible, and unacceptable from a 

pure cost standpoint, if not from an efficacy standpoint. 

It is proof that the Obama administration’s Federal shared service provider concept was doomed to fail for such a large agency. 

GAO attributes the failure to numerous causes: Lack of proper 

planning, aggressive schedule, complex and changing requirements, 

increased cost, and management and communication failures. DHS 

is now rushing to implement a new strategy which will likely put 

taxpayer dollars at risk to waste. 

We are at a critical moment. DHS must fully engage with the 

private sector to help salvage this disaster. Leveraging industry’s 

talents is what should have been done in the first place and is the 

only possible way DHS might right this ship. 

As a former small-business owner, it baffles me how the Federal 

Government can spend over 10 years and hundreds of millions of 

dollars and have so little to show for it. Businesses large and small 

have to modernize systems and processes every single day. It may 

be hard, but it doesn’t take them decades and hundreds of millions 

of dollars to do it. 

Mr. Fulghum, you were on the ground floor of this effort. You 

were involved in the negotiations with the IBC and its implementation as the chief financial officer. I demand on behalf of the taxpayers a full explanation as to how we got here and what is being 

done to fix this mess. 

Quite frankly, the magnitude of this failure demands accountability by those in charge and it calls into question the management directorate’s ability to lead critical management issues facing 

DHS in the future based on what has been done in the past. 

[The statement of Chairman Perry follows:] 

STATEMENT OF CHAIRMAN SCOTT PERRY

SEPTEMBER 26, 2017 

As the third-largest Federal cabinet agency, the Department of Homeland Security (DHS) has a duty to be an effective steward of taxpayer dollars. Sound management of its finances is vital to implementing the homeland security mission. With 

a multitude of priorities including responding to major emergencies like Hurricanes 

3 

Harvey and Irma, securing our porous borders, protecting cyber space, and enforcing 

our immigration laws, DHS’s senior leadership needs timely financial information 

to inform its decisions. In addition, DHS needs systems that can be fully protected 

against the latest cyber threats to ensure personal and other sensitive data isn’t 

compromised. Unfortunately, the Department’s third, and latest, attempt to modernize its flagging financial systems has failed, and DHS is struggling to determine 

a solid path forward. 

DHS has been attempting to modernize its financial systems for well over a dec- ade. The two previous attempts wasted over $50 million to build a Department-wide 

integrated financial system. Following these failures, DHS chose to modernize component financial systems with the most critical need first. In 2013, the Obama administration urged agencies to use Federal shared service providers to improve financial systems. Shortly thereafter, DHS decided to enter a ‘‘discovery phase’’ with 

the Interior Business Center (IBC) within the Department of Interior. By August 

2014, DHS had entered into an agreement with IBC to modernize systems for the 

Domestic Nuclear Detection Office, Transportation Security Administration, and the 

U.S. Coast Guard at a cost of $79 million. Congressional watchdogs at GAO warned 

in 2013 that DHS had ‘‘an increased risk of, among other things, investing in and 

implementing systems that do not provide the desired capabilities and inefficiently 

use resources during its financial system modernization efforts.’’ GAO’s prediction came true. Costs for the project have ballooned to over $124 million as of August—about 60 percent more than the original estimate. However, the 

truth is that DHS has no idea how much it will cost in the end. TSA’s modernized 

system will go live over 2 years later than planned and Coast Guard’s system will 

not be modernized at all under the current agreement with IBC. This outcome is 

simply astounding, reprehensible, and unacceptable. It is proof that the Obama administration’s Federal shared service provider concept was doomed to fail for such 

a large agency. GAO attributes the failure to numerous causes: Lack of proper planning, aggressive schedule, complex and changing requirements, increased costs, and 

management and communication failures. DHS is now rushing to implement a new 

strategy, which will likely put taxpayer dollars at more risk to waste. We are at 

a critical moment; DHS must fully engage with the private sector to help salvage 

this disaster. Leveraging industry’s talents is what should have been done in the 

first place and is the only possible way DHS might right this ship. 

As a former small business owner, it baffles me how the Federal Government can 

spend over 10 years and hundreds of millions of dollars and have so little to show 

for it. Businesses, large and small, have to modernize systems and processes every 

day; it may be hard but it doesn’t take them decades and hundreds of millions of 

dollars to do it. Mr. Fulghum, you were on the ground floor of this effort. You were 

involved in the negotiations with IBC and its implementation as the chief financial 

officer. I want a full explanation as to how we got here and what’s being done to 

fix this mess. Quite frankly, the magnitude of this failure demands accountability 

by those in charge and it calls into question the Management Directorate’s ability 

to lead critical management issues facing DHS in the future. 

Mr. PERRY. The Chair now recognizes the Ranking Minority 

Member of the subcommittee, the gentleman from California, Mr. 

Correa, for his statement. 

Mr. CORREA. Thank you, Chairman Perry. 

I want to thank our witnesses here today, a very important hearing, very important issues. 

An area critical to our Nation’s security as well as safeguarding 

taxpayer dollars, there is a need for Department of Homeland Security to have a modern and effective information technology system. 

In 2013 under the Obama administration, the Office of Management and Budget instructed each Federal agency to implement a 

Federal shared service provider for financial systems management. 

The goal was simple: To support decision making and improve the 

Department’s ability to provide timely and accurate financial reporting. Essentially, how much money we are spending, when are 

we spending it, and how we are spending it. 

Following OMB’s guidelines, DHS immediately entered into an 

agreement with the Department of Interior’s shared service proVerDate Mar 15 2010 13:08 Mar 01, 2018 Jkt 000000 PO 00000 Frm 00007 Fmt 6633 Sfmt 6602 H:\115TH CONGRESS\17OM0926\17OM0926.TXT HEATH
4 

vider, Interior Business Center, becoming the first Cabinet-level 

agency to move to a Federal provider for financial management. 

During a year-long discovery phase, many called into question 

IBC’s ability to transfer large agencies the size of TSA and Coast 

Guard, yet the Department and IBC moved ahead with an agreement anyway. Unfortunately, the plan to transfer the Domestic 

Nuclear Detection Office, DNDO, TSA, and Coast Guard to an IBC 

solution failed. 

It is even more troubling that DHS spent millions of dollars, as 

our Chair has said, on this modernization effort with nothing really 

to show for it. Financial systems, financial management is key to 

the success of DHS and its mission. 

According to DHS financial statement auditors, despite receiving 

clean audits, DHS faces long-term challenges in sustaining a clean 

audit opinion and providing reliable, timely, and useful financial 

data to support operational decision making. These deficiencies 

have contributed to the GAO’s decision to designate DHS management functions, including financial management, as high-risk. 

I hope today’s witnesses can highlight the errors that occurred 

with the financial systems modernization effort and how DHS can 

move ahead toward achieving shared service solutions for financial 

systems. 

Let me say that having come from the State of California, what 

we believe is probably the fourth-largest economy in the world, IT 

was always a challenge in the State of California. It was always 

expensive, never done right, never on time, constant monitoring 

was needed. Big contracts, small contracts, private contracts, inhouse contracts, always a challenge. 

At the end of the day, I think part of the solution is going to be 

constant monitoring, constant reports to this committee and others 

to make sure that whatever is being done in terms of implementing 

IT is being done right. 

With that, I yield the balance of my time, Mr. Chairman. 

[The statement of Ranking Member Correa follows:] 

STATEMENT OF RANKING MEMBER J. LUIS CORREA

SEPTEMBER 26, 2017 

This subcommittee has held hearings on a range of matters, some of which do not 

have bipartisan agreement. One area we do have common ground on, however, is 

the need for the Department of Homeland Security to have modern, effective information technology systems. 

In 2013, under the Obama administration, the Office of Management and Budget 

instructed each Federal agency to move towards a Federal shared service provider 

for financial systems management. This initiative was designed to strengthen access 

to, and quality of, financial information to support decision making and improve the 

Department’s ability to provide timely and accurate financial reporting. 

Simply put, DHS should, at any given moment, know how money is being spent 

across the Department. 

In furtherance of OMB’s guidelines, DHS quickly entered into an agreement with 

the Department of Interior’s shared service provider, Interior Business Center 

(IBC), becoming the first Cabinet-level agency to move to a Federal provider for financial management. During a year-long discovery phase, many called into question 

IBC’s ability to migrate large agencies the size of TSA and Coast Guard, yet the 

Department and IBC moved forward with an agreement. 

Unfortunately, the plan to migrate DNDO, TSA, and Coast Guard to an IBC solution failed due to a number of problems, including insufficient product delivery, incompatible expectations, and unexpected delays. I am troubled to hear that despite 

5 

such a lengthy discovery period, neither IBC nor DHS predicted this unfortunate 

result. 

It is even more troubling that DHS spent millions of dollars on this modernization 

effort with nothing to show for it. Financial systems management is critically important to the success of DHS in fulfilling its mission. 

According to DHS financial statement auditors, despite receiving clean audits, 

DHS faces long-term challenges in sustaining a clean audit opinion and providing 

reliable, timely, and useful financial data to support operational decision making. 

These deficiencies contributed to GAO’s decision to designate DHS’s management 

functions, including financial management, as high-risk. 

I hope today’s witnesses can shine light onto the errors that occurred with the 

financial systems modernization effort and the manner in which DHS can move towards achieving a shared service solution for its financial systems. 

Too often, DHS has failed to establish effective management and oversight of its 

IT improvement efforts. It is time for DHS to fix the out-of-date, inefficient IT systems currently in use and address these issues once and for all. 

Mr. PERRY. The Chair thanks the gentleman from California. 

Other Members of the subcommittee are reminded that opening 

statements may be submitted for the record. 

[The statement of Ranking Member Thompson follows:] 

STATEMENT OF RANKING MEMBER BENNIE G. THOMPSON

SEPTEMBER 26, 2017 

The recent hurricanes illustrate that when a crippling natural disaster or other 

major incident hits our country, the Department of Homeland Security needs a precise understanding of both its human and financial resources in order to make timely decisions that will ultimately affect the American people. 

Its goes without saying that knowing how funds are distributed and spent 

throughout the Department at any given moment is critical to ensuring taxpayer 

dollars are spent effectively and efficiently. Throughout my tenure on this committee we have initiated multiple GAO audits and held oversight hearings on financial systems modernization, and it is clear that it is more than an uphill battle for 

DHS. 

For over a decade, DHS has attempted to modernize its financial systems, and 

has been unsuccessful to date. Since DHS’s inception there have been three failed 

attempts to modernize the agency’s financial systems—leaving billions of taxpayer 

dollars wasted. Before DHS embarks on another attempt to modernize its financial 

systems it should at least have an adequate and thorough roadmap of how this modernization is to be achieved. 

Unfortunately, President Trump has made it clear that financial systems modernization is not a priority at DHS, leaving the fate of financial management systems modernization uncertain. Under the President’s budget, DHS would lose $41 

million toward its Financial Systems Modernization program. 

The President’s misguided priorities for DHS include diverting critical resources 

away from information technology improvements towards fulfilling campaign fantasies, such as a multi-billion dollar wall along the Southern Border. 

I look forward to hearing from the witnesses today about the lessons learned from 

previous modernization efforts and how DHS can move forward in a positive direction for the good of the Department and out of respect for the American taxpayers’ 

hard-earned dollars. 

Mr. PERRY. We are pleased to have a distinguished panel of witnesses before us today. The witnesses’ entire written statements 

will appear in the record. 

The Chair will introduce the witnesses first and then recognize 

each of you for your testimony. 

The honorable Chip Fulghum is the deputy under secretary for 

management at DHS. Mr. Fulghum joined DHS in October 2012 as 

its budget director and has served in numerous senior positions including acting deputy secretary, acting under secretary for management, and chief financial officer. Prior to joining the Department, 

6 

Mr. Fulghum served for 28 years in the United States Air Force 

retiring with a rank of colonel. 

We thank him for his service. 

Ms. Michele Singer has been the director of the Interior Business 

Center in the Department of Interior since June 2015. In this capacity, she leads delivery of shared services to support interior offices and bureaus as well as over 150 other Federal agencies. Ms. 

Singer previously worked on issues related to Indian Affairs and 

joined the Department of Interior in 2000. 

Welcome. 

Ms. Elizabeth Angerman—is that correct, did I—thank you, 

ma’am—has been executive director of Unified Shared Services 

Management at the General Services Administration, or the GSA, 

since October 2015. In this position, she provided agencies input 

and advice on best practices related to designing and executing 

shared administrative functions. Prior to GSA, Ms. Angerman was 

executive director of the Office of Financial Innovation and Transformation, or FIT, in the Treasury Department. 

Welcome. 

Finally, Mr. Asif Khan is a director for financial management 

and assurance issues at the U.S. Government and Accountability 

Office. Mr. Khan leads GAO’s evaluations related to financial management issues at the Department of Homeland Security and Department of Defense. Mr. Khan joined the GAO in January 2009 

after almost 20 years in public accounting with major firms auditing and advising U.S. Government agencies. 

We welcome him. 

The Chair now recognizes Mr. Fulghum for his opening statement. 

Sir. 

STATEMENT OF CHIP FULGHUM, DEPUTY UNDER SECRETARY 

FOR MANAGEMENT, U.S. DEPARTMENT OF HOMELAND SECURITY 

Mr. FULGHUM. Chairman Perry, Ranking Member Correa, thank 

you for the opportunity to appear today to discuss our efforts regarding financial systems modernization. 

Today I will focus my comments on the need for modernization, 

the experience with the shared service model, what we have delivered to date, our lessons learned, and our path forward. 

Since the Department’s inception, we have had a clear need for 

modernized financial solutions, given that some of today’s systems 

lack functionality, aren’t integrated, contribute to data inconsistency, rely on old, outdated technology, and create additional security risks, all of which leads to manual processes, workarounds, 

and creates internal control business process risks. 

Despite that fact, I am very proud of the fact that since 2013 the 

Department of Homeland Security has earned four straight clean 

audits, which clearly demonstrates our ability to be good stewards 

of the taxpayers’ money. We still, however, need modernized solutions. 

Beginning in 2013, we followed OMB direction via memorandum 

MD13–08 to pursue a Federal shared service model. We were the 

first large Cabinet-level agency to do so. Despite a limited availVerDate Mar 15 2010 13:08 Mar 01, 2018 Jkt 000000 PO 00000 Frm 00010 Fmt 6633 Sfmt 6602 H:\115TH CONGRESS\17OM0926\17OM0926.TXT HEATH
7 

ability of shared service providers, we partnered with IBC based on 

the fact that they were certified by Treasury, FIT, and the fact that 

their leadership provided assurance that they would have the capability and the resources necessary to service a large Federal Cabinet agency. 

Over the next 31⁄2 years, we have experienced numerous challenges to include schedule delays and cost increases, which are unacceptable, primarily driven by a lack of understanding of our business requirements and the inability of IBC to adequately staff up. 

This caused me to pause the program twice, the first time in 

2015 and again in 2016 when I made the decision along with IBC 

to end the relationship with IBC. In spite of these challenges, we 

have an integrated financial solution that works and is the foundation of the effort moving forward for what is known as the TRIO. 

Each day, that system, that has been in place for over 2 years, 

makes payments, records accurate obligations, provides timely financial reporting, provides monthly financial statements, writes 

contracts, records those obligations in an integrated fashion into 

our financial system, provides real-time funds check and has improved our internal control capability. 

This system meets 75 percent of the requirements. When TSA 

functionality is available in October, we will be over 80 percent, 

which was the plan from the start. 

Given past challenges and the lessons learned, we have determined that IBC’s business model does not meet the needs of a large 

Federal agency. Moving forward, we will leverage the investment 

made in the system and solution that works and build on the lessons learned to finish out the United States Coast Guard. 

To do this, we will have more frequent check-ins and more thorough testing of the system, more incremental releases, and we will 

have built-in transparency of cost and schedule with a contractor 

and a contracting mechanism that is simplified and performancebased. 

We have restructured our program office to have clear accountability. We will continue to have oversight from both the Department, USSM, and OMB. We will be able to fully leverage the Department’s resources to include management of various lines of 

businesses, which, as GAO has noted in its most recent high-risk 

report, continues to mature its processes and reduce the number of 

high-risk items. 

In closing, I believe we have a solid path forward, but there is 

still risk. There is funding risk, there is continued risk of litigation, 

there is technical risk, and there is staffing risk. We will manage 

those risks by using the recommendations from GAO in their recent audit to manage more effectively those risks. 

We owe you further results and the buck stops with me. I remain 

committed and accountable to deliver results and build on the system that is working today. 

[The prepared statement of Mr. Fulghum follows:] 

PREPARED STATEMENT OF CHIP FULGHUM

SEPTEMBER 26, 2017 

Chairman Perry, Ranking Member Correa, and distinguished Members of the subcommittee, thank you for the opportunity to appear today to discuss financial sysVerDate Mar 15 2010 13:08 Mar 01, 2018 Jkt 000000 PO 00000 Frm 00011 Fmt 6633 Sfmt 6621 H:\115TH CONGRESS\17OM0926\17OM0926.TXT HEATH
8 

tems modernization (FSM) at the Department of Homeland Security (DHS). My 

comments will focus on our progress to date, challenges we have experienced, and 

why we are on the right path for this initiative. 

We acknowledge that improving DHS financial management systems has been a 

long-term effort, but during our recent modernization efforts, we have achieved successes, and continue to achieve planned milestones. Twenty-three months ago, we 

successfully moved the Domestic Nuclear Detection Office (DNDO) to a new shared 

services baseline solution that provides increased functionality, reduces audit risk, 

and provides real-time integration. We are preparing to move the Transportation 

Security Administration (TSA) functionality into production. The current solution 

meets 75 percent of DNDO, TSA, and the U.S. Coast Guard’s (USCG) requirement 

needs. Once TSA is in production, 85 percent of DHS functional requirements for 

DNDO, TSA, and the USCG financial, acquisition, and asset management will be 

met. 

Additionally, U.S. Customs and Border Protection (CBP) is on a modernized platform, the Federal Law Enforcement Training Centers (FLETC) have performed a 

successful upgrade to its current financial system, and the U.S. Secret Service is finalizing its implementation of a solution upgrade to occur in October 2017. We will 

continue to build on these successes as we move forward. 

DHS has had a critical need to modernize its financial management systems from 

its inception. When DHS was first established, there were 13 separate core financial 

systems across its components, operating under legacy policies and disparate business processes. These systems were comprised of outdated technology, were mostly 

non-integrated—with many still relying on manual processes which led to inconsistent data and reporting—and did not fully support DHS goals of strong, integrated internal controls and enhanced efficiency and security. 

Previous attempts to integrate DHS components’ financial, asset, and acquisition 

management systems include the 2004 eMerge2 Program, which was halted due to 

its inability to build the necessary and critical integration among various commercial software products, and the Transformation and Systems Consolidation (TASC) 

program. 

The Department’s efforts to modernize its financial management systems have 

been subject to repeated legal challenges before the Government Accountability Office (GAO), the U.S. Court of Federal Claims, and the Court of Appeals for the Federal Circuit. Most recently, the Inter-Agency Agreement process with the Department of the Interior (DOI) was challenged. The Department prevailed in that litigation (and the appeal) in October 2016. 

Despite having a complex mission and systems that are not interoperable, DHS 

has been able to achieve and sustain an unmodified—clean—audit opinion on our 

financial statements for the past 4 years. 

Working together, the financial management community launched a multi-year effort to drive the Department toward a clean audit opinion and a full accounting for 

how it spends taxpayer dollars. Through dedication of senior leadership, development and implementation of standard policies and processes for financial reporting 

such as the DHS Accounting Classification Structure (ACS) and Common Appropriation Structure (CAS), hiring of talented professionals, commitment of our workforce, 

improvement of our business intelligence tools, and consistent and continuous training, DHS has achieved audit success and reduced the number of material weaknesses in our internal controls over financial reporting from 18 to 3. 

After the TASC program was halted, DHS again moved to meet its financial management system needs by following direction provided by the Under Secretary for 

Management (USM) in a September 2011 memorandum, Moving Forward with Financial Systems Projects. The approach was to modernize components with the 

greatest business need for modernized financial management systems and leverage 

business intelligence to aggregate data in lieu of acquiring a Department-wide solution. 

In establishing the FSM program, we followed the OMB memorandum M–13–08, 

Improving Financial Management Systems Through Shared Services, which prescribed a shared service approach for new core accounting systems proposals or 

mixed systems upgrades. Following the direction of the previous USM and the OMB 

directive’s guidance, DHS identified the USCG, with TSA and DNDO as their customers, as the components with the most critical need to update their current system. 

OMB provided a limited number of Federal Shared Service Providers (FSSP) certified to service large Cabinet-level agencies such as DHS. The DOI’s Interior Business Center (IBC) is one of four OMB-designated FSSPs certified through Treasury’s 

Office of Financial Innovation and Transformation (FIT). In 2013, DHS established 

9 

an Inter-Agency Agreement for a Discovery phase to evaluate the IBC solution and 

its fit for DNDO, TSA, and the USCG. 

Through the Discovery process, IBC validated they could transition the three components to their solution, and DHS confirmed that the IBC solution would meet the 

components’ functional and operational support needs. DHS and IBC worked closely 

with OMB and Treasury to obtain approval to proceed with implementation. As a 

pilot, DNDO, a small DHS component, migrated to the accounting solution in November 2015 and then migrated to the procurement part of the solution in March 

2016. 

Overall, this integrated solution provides improved functionality and integration, 

has a lower risk of information security issues, will provide a consolidated view of 

project costs across components, and increases transparency and reliability of information. The solution also supports the implementation of the DHS ACS. 

Throughout our 4-year partnership, there have been several challenges including 

an incomplete understanding of the requirements and complexities related to providing a standard solution for a Cabinet-level agency the size of DHS. The recent 

GAO audit also highlighted five categories that name many of the areas where we 

faced these challenges: Complex requirements, project resources, project schedule, 

project cost, and project management and communications. 

Late in 2016, IBC informed DHS they would not be able to continue the USCG 

implementation and could not support further engagement activities with other 

DHS components as planned. DHS and IBC agreed that preserving the investment 

DHS has made is now paramount and will move us forward while delivering the 

best value for the Government. However, the current structure of the project between IBC and DHS is not sustainable. DHS and IBC determined the best path is 

to move the software solution to a new hosting location, or data center, and for DHS 

to assume operation of the system while we continue the TSA and USCG migrations. 

Both IBC and DHS have worked closely together to build out the remaining requirements for TSA. TSA will transition to the system once data migration, user 

training, and organizational change management activities are complete, the system 

stability has been proven, and any risks to auditability are mitigated. Moving forward, our FSM approach will shift from leveraging FSSPs to reemphasizing the 

DHS business process standardization and further reducing our system footprint 

where possible. 

We have found our personnel have the deepest understanding of DHS mission 

needs and how they are best supported through systems and processes. Our management team remains fully engaged and integrated; the Office of the Chief Information Officer and the Office of the Chief Procurement Officer are particularly involved in the day-to-day work of implementing our integrated financial management 

solution. We have reached out to components and brought in additional subject-matter expertise across relevant business process areas, strengthened our testing and 

evaluation program, involved systems engineers from the DHS Science & Technology Directorate, and are working closely with the Office of Program Accountability and Risk Management to meet best practices and minimize risks. 

The decision to leverage the solution currently in use by DNDO provides the best 

available option to meet DHS financial management needs for TSA and USCG within a reasonable time frame. DHS will preserve its robust governance structure, with 

Acquisition Review Board oversight, and a fully engaged FSM Executive Steering 

Committee. Additionally, the DHS management chiefs and components will continue 

working closely together to ensure success as the FSM initiative moves forward. 

To apply the lessons learned from the IBC engagement and better support the initiative going forward, DHS has changed its implementation approach from individual component projects to a single initiative and added a Joint Program Management Office (JPMO). The JPMO provides centralized program governance and 

streamlined decision making; This stands in contrast to our effort with IBC, where 

governance and decision making was split across two entities. 

The JPMO is responsible for successful execution, schedule maintenance, risk 

management, and all other program management activities. The JPMO is staffed 

with DHS Headquarters and component subject-matter experts working together to 

better identify and mitigate risk, implement risk mitigation plans, increase component integration, and support business process standardization across the Department. 

DHS will leverage internal program management processes and expertise to lead 

the program and introduce implementation support tools to perform requirements 

management, evaluate system performance, and coordinate and document testing. 

We will require earned value management from our vendors and establish quality 

controls for services and deliverables. We will increase transparency into costing 

10 

and status, using a time and materials methodology initially and transitioning to 

a firm fixed price once we have a very clear picture of our detailed requirements 

for the hosting and system integrators. 

The GAO–17–799 Report examines the extent to which DHS followed best practices in analyzing alternatives and selecting its FSM approach; whether DHS used 

best practices when managing the risks of using IBC; and the key factors and challenges that have impacted the FSM program and DHS’s plans for completing key 

priorities. DHS concurs with both GAO recommendations to improve guidance related to conducting Analysis of Alternatives and to improve our risk management 

approach. Actions are already in progress to address these recommendations, and 

they will be incorporated into the current FSM efforts. 

In summary, DHS has made a significant investment in the IBC financial management solution, which has delivered a standardized baseline solution with increased functionality and integration for DNDO and will deliver improved financial 

operations for TSA and USCG when they migrate. We will continue to move forward, exercising sound business judgment, obtaining the best value for the Department, and striving for a wise use of public resources while maintaining our clean 

audit opinion, mitigating risks, and incorporating lessons learned. We cannot keep 

patching our legacy systems at components and never realize the benefits that come 

from moving to a modern integrated business solution that meets our requirements. 

We will continue to keep you updated on the progress of our plan for the transition 

from IBC. 

Chairman Perry, Ranking Member Correa, and distinguished Members of the subcommittee, thank you again for the opportunity to testify today and I look forward 

to your questions. 

Mr. PERRY. Thank you, Mr. Fulghum. 

The Chair now recognizes Ms. Singer for an opening statement. 

Ma’am. 

STATEMENT OF MICHELE F. SINGER, DIRECTOR, INTERIOR 

BUSINESS CENTER, U.S. DEPARTMENT OF THE INTERIOR 

Ms. SINGER. Thank you. Chairman Perry, Ranking Member 

Correa, and Members of the subcommittee, thank you for this opportunity to discuss the Department of Homeland Security financial system modernization program. 

I am Michele Singer, the director of the Interior Business Center 

at the U.S. Department of the Interior, and I began overseeing this 

program for IBC in April 2016. 

The Interior Business Center is a certified Federal shared service 

provider in financial management and human resources and payroll. We are also an authorized provider for acquisition services. 

Currently, we serve more than 170 Federal agencies and organizations. Like other shared service providers, IBC supports customer 

agencies’ missions by providing critical business and administrative 

support. 

The Interior Business Center operates a customer-funded, full 

cost-recovery business model and does not receive any appropriated 

funds. These unique circumstances can present significant challenges for scaleability, particularly in migrating Cabinet-level agency components to a common shared service solution. 

In partnership with IBC since 2014, DHS has undertaken an effort to modernize, consolidate, and integrate the agency’s vast financial resources and assets. The scheduling costs provided for in 

this project were based on requirements designed to be implemented and shared across the DHS TRIO component. Over evolution of this program, the identification of additional requirements 

resulted in a deviation from a shared model to a more customized 

and expensive solution. Increasing resources to accommodate these 

11 

needs has and will continue to increase the overall cost of the program. 

The engagement between IBC and DHS has resulted in the creation of valuable assets. These assets can and will be transitioned, 

ensuring that the investments made to date are preserved. This 

program has experienced a number of complex and multifaceted 

challenges, yet it has also provided for an opportunity for lessons 

learned regarding the feasibility and execution of the shared services implementation of a large federated agency. 

I would like to highlight just a few of those lessons learned for 

you today. To achieve strong adoption of standard business processes, customer agencies must evaluate their complex business 

processes with a willingness to differentiate and potentially eliminate those disparate processes that are not legally mandated. 

With shared services model, existing business processes must 

converge into unified processes that can be shared amongst all 

components and amongst different agencies. This requires a strong 

centralized management team designated in power to drive standardization. Someone must have the authority to say no to individualized requests supporting a single component. Customer agencies 

must have a clearly-defined communications strategy that ensures 

all stakeholders are engaged at appropriate times and the customer 

agencies should not defer to a service provider to communicate 

across its organization. 

Service providers must help a customer agency execute a comprehensive training plan that needs to ensure employees understand how to do their jobs within new processes, not just how to 

operate the system. 

Moving to a shared service provider for mission support services 

is challenging; however, with effective change management plan 

and business process reengineering, Federal agencies can modernize their financial management systems and realize the benefits 

of a shared service solution. 

Thank you for this opportunity, and I do look forward to your 

questions. 

[The prepared statement of Ms. Singer follows:] 

PREPARED STATEMENT OF MICHELE F. SINGER

SEPTEMBER 26, 2017 

Chairman Perry, Ranking Member Correa, and Members of the subcommittee, 

thank you for this opportunity to discuss the Department of Homeland Security 

(DHS) Financial Systems Modernization (FSM) Program. I am Michele Singer, the 

director of the Interior Business Center (IBC) at the U.S. Department of the Interior 

(Interior). I began overseeing the DHS FSM Program for IBC in April 2016. 

The Interior Business Center is a certified Federal shared services provider in financial management and human resources/payroll, and an authorized provider for 

acquisition services. Currently, we serve more than 170 Federal agencies and organizations, and like other shared service providers, IBC supports customer agencies’ 

missions by providing critical business and administrative support services. 

In partnership with IBC since 2014, DHS has undertaken an effort to modernize, 

consolidate, and integrate the agency’s vast financial resources and assets. The DHS 

FSM Program included prioritization of the DHS components with the most critical 

business need to modernize their financial management systems. Integration of the 

modernized financial systems with asset management and acquisition systems 

would result in component-level integrated financial management systems. With 

this effort, DHS became the first Cabinet-level agency to engage a Federal shared 

services provider to modernize its core financial system. 

12 

1 Using off-the-shelf functionality as a baseline, IBC implements and maintains a 

preconfigured version of Oracle Federal Financials that incorporates processes common to Federal agencies. The application is hosted in a shared environment. In addition to the integrated 

modules that make up the core financials solution, the preconfigured version supported by IBC 

also includes a set of standard reports, which provides general data elements that are used by 

most Federal agencies. 2 Interior’s Working Capital Fund was established pursuant to 43 U.S. Code § 1467. The Interior Franchise Fund was established pursuant to the Omnibus Consolidated Appropriations Act 

of 1997, Pub. L. 104–208. 

Following the roadmap defined by the Office of Management and Budget and the 

Department of the Treasury Office of Financial Innovation and Transformation that 

encouraged agencies to use certified Federal providers for their future modernization efforts, IBC and DHS entered into an interagency agreement (IAA) for the financial system implementation of the DHS ‘‘Trio’’ components: USCG, TSA, and 

DNDO. Before signing the agreement in August 2014, IBC completed a discovery 

effort with DHS to determine if IBC’s Federalized Oracle Federal Financials solution 1 would meet the financial management systems needs of the DHS Trio components. 

The IBC operates a customer-funded, full-cost recovery business model in the 

working capital fund and Interior Franchise Fund and does not receive appropriated 

funds.2 These unique circumstances can present significant challenges for 

scalability, particularly in migrating Cabinet-level agency components to a common, 

shared service solution. The schedule and costs presented in the IAA were based 

on specific requirements designed to be implemented and shared across the DHS 

Trio components. Over the evolution of this program, the identification of additional, 

unique DHS and component requirements resulted in a deviation from a shared 

model to a more customized and expensive solution. Increasing resources to accommodate the more custom solution has—and will continue to—increase the overall 

cost of the DHS FSM Program. 

In January 2017, IBC and DHS began planning for a transition of the DHS FSM 

Program components to a new environment. Transitioning the program to a DHSonly environment has been chosen as the path forward due to the unique and complex requirements that are incongruous with the shared service model. 

The engagement between the IBC and DHS has resulted in the creation of valuable assets that can and will be transitioned, ensuring that the investments made 

to date are preserved. This program has experienced a number of complex and 

multifaceted challenges, yet it has also provided an opportunity for lessons learned 

regarding the feasibility and execution of a shared services implementation for a 

large, federated agency. I would like to highlight some of these lessons learned for 

the subcommittee today. 

BUSINESS PROCESS DOCUMENTATION AND REDESIGN

To successfully implement a shared service solution, customer agencies play an 

important role in their organizations’ change management. To achieve strong adoption of standard business processes, customer agencies must evaluate their complex 

business processes with a willingness to differentiate (and potentially eliminate) disparate processes that are not legally mandated. Additionally, a documented approach for transition, arbitration, and change management must be communicated 

and understood by all agency components, obtaining buy-in and understanding of 

how the new system will operate. 

GOVERNANCE

With a shared service model, existing business processes must converge into unified standard processes that can be shared between all components within an agency. This requires a strong, centralized management team designated and empowered 

to drive standardization across the entire organization. Someone must have the authority to say ‘‘no’’ to individualized requests supporting a single component. 

STAKEHOLDER COMMUNICATION AND ENGAGEMENT

Customer agencies must have a clearly-defined communication strategy that ensures that all stakeholders are engaged at the appropriate times. The customer 

agency should not defer to or rely on the service provider to communicate across 

its organization. 

13 

TRAINING

Service providers should help customer agencies execute a comprehensive training 

plan that ensures employees understand how to do their jobs within the new processes, not just how to use the system. This training should include a crosswalk, comparing how business processes are done today with how they will be done in the 

new system. 

Moving to a shared provider for mission support services is challenging. However, 

with an effective change management plan and business process reengineering, Federal agencies can modernize their financial management systems and realize the 

benefits of a shared service solution. 

Thank you and I look forward to your questions. 

Mr. PERRY. The Chair thanks you, Ms. Singer. 

The Chair now recognizes Ms. Angerman for an opening statement. 

STATEMENT OF ELIZABETH ANGERMAN, EXECUTIVE DIRECTOR, UNITED SHARED SERVICES MANAGEMENT, OFFICE OF 

GOVERNMENT-WIDE POLICY, U.S. GENERAL SERVICES ADMINISTRATION 

Ms. ANGERMAN. Thank you. Chairman Perry, Ranking Member 

Correa, and Members of the committee, it is a pleasure to appear 

before you today. 

My name is Beth Angerman and I am the executive director of 

the Unified Shared Services Management Office in the General 

Services Administration. I have served the Federal Government as 

a career employee for 12 years and spent the majority of my career 

focused on Government-wide programs helping to consolidate and 

centralize common administrative activities. 

My comments today will focus on the potential benefits that 

shared services could bring to the Federal Government and the lessons learned that are shaping the path forward. 

The need for modernization of aging and high-risk IT systems is 

an on-going concern for senior leadership across the Federal landscape. The challenge of funding, managing, and securing legacy 

systems distracts resources from the critical missions that Federal 

agencies are accountable to deliver. 

Furthermore, the work force is performing very similar and duplicative work across Government and is doing so oftentimes following manual and legacy processes. 

Agencies have been asked to assess how they can reduce this duplication and put more resources on mission work. Shared services 

is an industry best practice that can help. 

The USSM office was created within GSA in 2015 to design the 

standards for more integrated solutions across administrative functions, provide transparency into the performance of shared service 

providers, and to provide advice and best practices to agencies who 

are planning these kinds of transformative efforts. 

The Federal Government has been sharing services for more 

than 40 years, but with varying degrees of success. In 2004, the 

Government consolidated 26 different payroll systems to four and 

saved the Government over $1 billion over 10 years. More than 70 

percent of the Government is using a shared solution for personnel 

action processing systems and over 85 percent of all payments are 

processed from a centralized system at the Department of Treasury. 

14 

Despite this progress, the Government still lags behind private 

industry in adopting shared services as a best practice. The Federal 

Government has over 100 time-and-attendance systems and over 

40 financial management systems. These are just two of several examples of the duplications that exist today. 

The Government can do better, but we must acknowledge the lessons learned as critical input to the strategy moving forward. 

Those lessons and best practices are published in a playbook by 

USSM to assist agencies in the pivot to a shared environment. 

USSM engaged with several agencies, including the Departments 

of the Interior and Homeland Security, and industry experts to inform the creation of the USSM playbook. The partnerships delivered a functional financial management solution that DHS is confident will meet the majority of their complex needs and they intend to protect the investment as they transition forward. 

Over the course of the last 2 years, USSM has informed the program on best practices to improve change management, integrated 

project management and risk management, and many improvements were made. However, the gap between the complex needs of 

a large Cabinet-level agency like DHS and the intended service delivery mode at IBC has led these agencies to end their partnership. 

This experience has uncovered a critical opportunity for the Government to document what capabilities it requires in the future of 

administrative systems. 

USSM has designed a methodology and governance structure for 

capturing and maintaining those requirements inclusive of standard data definitions. The Federal community will need to reconcile 

the differences that exist among them today and agree on standard 

business rules for common functions. While uniquenesses do exist 

because of vastly different missions and legislation, it is a common 

belief that there is more alike about us than different. 

This work, coordinated by my office, will allow the Government 

to leverage its buying power and manage risk by sharing the burden of maintaining and securing technology with industry. 

The Government has too many legacy systems today. If we let 

agencies replace those systems without consolidating, we will be 

building the legacy systems of tomorrow without access to capital 

to maintain them. This is challenging work and it requires leadership to see the long-term potential, but if we are successful we will 

have more time, energy, and resources to dedicate to missions and 

better meet the needs of American taxpayers. 

I am grateful for the opportunity to speak with you today, and 

I would welcome any questions from the committee. 

[The prepared statement of Ms. Angerman follows:] 

PREPARED STATEMENT OF ELIZABETH ANGERMAN

SEPTEMBER 26, 2017 

Chairman Perry, Ranking Member Correa, and Members of the subcommittee, it 

is a pleasure to appear before you today. My name is Elizabeth Angerman and I 

am the executive director of the Office of Unified Shared Services Management at 

the U.S. General Services Administration (GSA). My comments today will focus on 

the potential benefits that shared services could bring to the Federal Government 

and the lessons learned that are shaping the role that GSA will play to help agencies recognize those benefits. 

15 

1https://www.opm.gov/services-for-agencies/hr-line-of-business/cost-benefit-analysis/fy-2011- 

cost-benefit-analysis-report.pdf. 2https://www.pwc.com/us/en/outsourcing-shared-services-centers/assets/hfs-report-pwc-developing-framework-global-services.pdf. 3 ‘‘The Government We Need’’, Technology CEO Council, January 2016. 

The need for modernization of aging and high-risk IT systems is an on-going concern for senior leadership across the Federal landscape. The challenge of funding, 

managing, and securing legacy systems distracts resources from the critical missions 

that Federal agencies are accountable to deliver. Furthermore, common processes to 

hire and retain Federal employees, process accounting transactions, and procure 

goods and services are also decentralized, redundant, and often manual. As agencies 

investigate ways to allocate more resources to their missions, GSA is well-positioned 

to advise agencies on best practices related to shared services and, more importantly, leverage the buying power of the Federal Government to provide contracts 

and services that deliver both modern technology and services that will drive standardization and efficiency across Government. 

The Unified Shared Services Management (USSM) office was created within GSA 

in 2015 to design the standards for more integrated solutions of administrative functions across lines of business, provide transparency into the performance of Federal 

Shared Service Providers to inform agency decision making, and to provide advice 

and guidance to agencies that are planning for new administrative solutions based 

on lessons learned and best practices. USSM’s mission is to transform the way Government does business internally to improve the way the Government serves the 

American public. Given declining resources and a need to focus more on mission, 

the time has never been more right to understand how increased sharing can help 

agencies address these challenges. 

The Federal Government has been sharing services for more than 40 years with 

varying degrees of success. In 2004, the Government consolidated 26 different payroll systems to four, which saved the Government over $1 billion over 10 years.1

Today, more than 70 percent of Federal Government agencies use a shared solution 

for personnel action processing systems, and over 85 percent of payments are processed from a centralized system at the U.S. Department of Treasury. Last year, the 

U.S. Government Accountability Office (GAO) stated that ‘‘moving to shared services 

can save the Federal Government billions of dollars as well as reduce duplicative 

efforts, decrease systems upgrades, and free up resources for mission-critical activities’’ (GAO Report 16–477). 

Despite this progress, the Government still lags behind private industry in adopting shared services for daily business operations. In comparison, over 90 percent of 

Fortune 500 companies have implemented shared services.2 IBM, for example, in its Center for the Business of Government report, stated it reduced spending by $4 billion over 4 years through its own reorganization to a shared services model. Procter 

and Gamble saved $900 million in cost savings over an 8-year transformation. The 

Technology CEO Council, comprised of chief executive officers from some of America’s largest IT companies, estimates shared services could lead to $47 billion in cost 

reductions for the Government over 10 years.3

The potential of shared services to save taxpayers money and make Government 

more efficient is clear, but there is still much work to be done to fully realize these 

benefits. According to the Office of Personnel Management’s 2015 Human Resources 

Line of Business Strategic Framework, the Federal Government has over 100 time 

and attendance systems. The fiscal year 2016 Cross-Agency Priority Goal Report reports that the Federal Government has over 40 financial management systems, with 

many ancillary add-ons. While successful adoption of shared services has seen various levels of success across Government, these numbers alone clearly show this is 

an effort that should not be abandoned. Instead, the Government must acknowledge 

the lessons learned from both successes and failures as critical input to the shared 

service strategy moving forward. It is USSM’s mission to ensure this happens. 

Over the last 2 years, USSM has consulted with many agencies that have 

partnered with Federal Shared Service Providers to provide advice and guidance on 

best practices and lessons learned to improve the likelihood of successful migrations 

and modernizations. These lessons and best practices impact both the behavior of 

customers (demand) and the expectations of providers (supply), and are published 

in a playbook to assist agencies in the pivot to a shared operational environment. 

The playbook provides guidance, templates, and a coordinated review process that 

can inform management and oversight of these investments and migrations. 

As part of its outreach, USSM engaged with the U.S. Department of Homeland 

Security (DHS) and the U.S. Department of the Interior to inform the creation of 

the USSM playbook. The partnership delivered a functional financial management 

16 

solution that DHS claims meets the majority of their complex needs and they intend 

to protect the investment as they transition to the path forward. Over the course 

of the last 2 years, USSM has informed the program on best practices to improve 

change management, integrated program management, and risk management, and 

many improvements have been made. However, the gap between the complex needs 

of a large Cabinet-level agency like DHS and the current service delivery model at 

the Interior Business Center has led to the decision to end the partnership and for 

DHS to reclaim ownership of the system. We will continue to use our expertise to 

consult with DHS and other agencies, as appropriate, in their journey to modernize 

and improve their common administrative functions. 

The challenge for the Federal Government is that we have not been able to articulate, in a coordinated and consistent way, the agreed-upon business needs for common administrative systems and/or services. The shared solutions available to agencies today were not designed to meet the all-encompassing needs of large, Cabinetlevel agencies. To address the lack of Government-wide standards, USSM has designed a methodology and governance structure for capturing and maintaining those 

standards, inclusive of required capabilities, data definitions, and the intersection 

of processes across multiple lines of business. The process to develop these standards involves many agencies working across administrative functions to deliver a 

Government-wide framework that can be the common baseline moving forward. 

While unique requirements do exist because of vastly different missions and statutory authorizations, it is a common belief that there is more about administrative 

functions that is alike than different. This work, coordinated by GSA USSM, will 

allow the Government to leverage its buying power for common capabilities and 

share the burden of maintaining and securing technology with industry. This is particularly critical as many of these common functions rely on legacy systems. With 

the right strategy, we cannot only retire these legacy systems, but also avoid building a new generation of future legacy systems by partnering with the private sector 

to get modern technology and keep that technology modern in the future. 

GSA’s effort to advance shared services is about delivering a more efficient Government for the American people. The challenge we face collectively is how to manage the risk and reduce the barriers to successful modernization and migration. If 

we are successful in improving and consolidating mission support services, agencies 

will have resources to dedicate more time, energy, and funding to their missions to 

better satisfy the needs of the American public. 

I am grateful for the opportunity to speak with you today and look forward to 

working with the committee on our mutual goal of advancing a Government that 

works better and costs less. 

Thank you for your time today and I welcome any questions from the subcommittee. 

Mr. PERRY. Thank you, Ms. Angerman. 

The Chair now recognizes Mr. Khan for an opening statement. 

STATEMENT OF ASIF A. KHAN, DIRECTOR, FINANCIAL MANAGEMENT AND ASSURANCE, U.S. GOVERNMENT ACCOUNTABILITY OFFICE 

Mr. KHAN. Good afternoon, Chairman Perry, Ranking Member 

Correa, and Members of the subcommittee. 

I am here to discuss our recent work on the Department of 

Homeland Security’s effort to improve its financial management 

and reporting and the difficult challenges they face. 

I would like to thank the subcommittee for holding this hearing. 

DHS’s ability to manage its operations and reasonably ensure effective financial management has been hampered by deficiencies in 

its internal controls and its financial management systems. These 

deficiencies contributed to our decisions in designating DHS’s management functions, including financial management, as a high risk 

in 2003. 

DHS has received a clean opinion on its financial statements for 

the past 4 years, which is commendable; however, financial management system deficiencies have continued to persist and conVerDate Mar 15 2010 13:08 Mar 01, 2018 Jkt 000000 PO 00000 Frm 00020 Fmt 6633 Sfmt 6602 H:\115TH CONGRESS\17OM0926\17OM0926.TXT HEATH
17 

tribute to a material weakness in DHS internal controls over financial reporting. 

Today, I will discuss the results of our recent review of DHS efforts to modernize its financial management systems that will assist in sustaining the clean opinion on its financial statements and 

help achieve effective internal controls over financial reporting 

management decision making. 

We reported in 2013 on challenges related to DHS’s previous attempts to implement a Department-wide integrated financial management system. We also reported on material weaknesses that 

limit DHS’s ability to process, store, and report financial data. 

Since our last report, DHS has adopted a decentralized approach 

evaluating options for modernizing its systems, including the use 

of shared service providers. 

As part of this effort, DHS initiated their TRIO project focused 

on migrating three DHS components, the Domestic Nuclear Detection Office, the Transportation Security Administration, and the 

Coast Guard, to a modernized financial management system provided by the Department of Interior’s Interior Business Center, the 

IBC. 

The TRIO project is a key effort to address longstanding system 

deficiencies. Assessing and managing the risks associated with the 

projects are essential to realizing DHS’s modernization goals. 

In our recent review, we found that DHS and the TRIO components did not fully follow best practices for conducting alternatives 

analysis for modernizing their financial management systems or for 

managing the risks related to its use of IBC on the TRIO project. 

We have made recommendations to address these concerns. 

Certain key challenges impacting the TRIO project emerged from 

our interviews with DHS, IBC, OMB, and other oversight agencies. 

We grouped these challenges into five broad categories. First, 

project resources. IBC experienced significant turnover in key positions over the course of this project. 

Second, project schedule. Migrating the TRIO components to IBC 

within the original time frame was a significant challenge, given 

the overall magnitude and complexity of the project. 

Third, complex requirements. Early in the TRIO project, DHS 

and IBC agreed to use a newer and unproven technology in this environment, which introduced additional complexity to the project’s 

requirements. 

Fourth, project costs. These increased significantly due to schedule delays, unanticipated complexities, and other challenges. 

Last, project management and communication. The TRIO project 

team primarily focused on the delivery of technology at the expense 

of other project management activities, such as organizational 

change management and communication management. Eventually, 

in January 2017, DHS and IBC formed a joint contingency plan 

working group to assess options for addressing these challenges. A 

few months later, DHS decided that migrating the TRIO components from IBC to a DHS data center was the best option for its 

path forward. 

Through continued reliance on compensating controls and complex manual workarounds, DHS has been able to achieve a clean 

audit opinion on its financial statements. However, DHS will conVerDate Mar 15 2010 13:08 Mar 01, 2018 Jkt 000000 PO 00000 Frm 00021 Fmt 6633 Sfmt 6602 H:\115TH CONGRESS\17OM0926\17OM0926.TXT HEATH
18 

1GAO, DHS Financial Management: Better Use of Best Practices Could Help Manage System 

Modernization Project Risks, GAO–17–799 (Washington, DC: Sept. 26, 2017). 2GAO, High-Risk Series: Progress on Many High-Risk Areas, While Substantial Efforts Needed 

on Others, GAO–17–317 (Washington, DC: Feb. 15, 2017), and High-Risk Series: An Update, 

GAO–03–119 (Washington, DC: January 2003). In 2013, we changed the name of this high-risk 

area from ‘‘Implementing and Transforming DHS’’ to ‘‘Strengthening DHS Management Functions’’ to recognize DHS’s progress in its implementation and transformation since its creation, 

as well as to focus on its remaining challenges in strengthening its management functions and 

integrating those functions across the Department. The ‘‘Strengthening DHS Management Functions’’ high-risk area includes challenges in acquisition, information technology, human capital, 

and financial management. 3GAO, DHS Financial Management: Additional Efforts Needed to Resolve Deficiencies in Internal Controls and Financial Management Systems, GAO–13–561 (Washington, DC: Sept. 30, 

2013). 4 A material weakness is a deficiency, or a combination of deficiencies, in internal control over 

financial reporting such that there is a reasonable possibility that a material misstatement of 

the entity’s financial statements will not be prevented, or detected and corrected, on a timely 

basis. A deficiency in internal control exists when the design or operation of a control does not 

allow management or employees, in the normal course of performing their assigned functions, 

to prevent, or detect and correct, misstatements on a timely basis. 

tinue to face challenges to establishing effective internal controls 

over financial reporting because of the lack of effective financial 

systems and related processes. 

Fully incorporating best practices and lessons learned from prior 

commutation efforts would help DHS achieve its goal of modernizing financial systems which are critical to establishing sound internal controls that safeguard assets and ensure proper accountability as well as provide reliable, timely, and useful information 

to support day-to-day decision making and oversight. 

To support this subcommittee’s oversight, GAO will continue 

monitoring the Department’s financial management improvement 

efforts. 

Chairman Perry, Ranking Member Correa, and Members of the 

subcommittee, this concludes my statement. I will be pleased to respond to any questions that you have at this time. Thank you. 

[The prepared statement of Mr. Khan follows:] 

PREPARED STATEMENT OF ASIF A. KHAN

SEPTEMBER 26, 2017 

Chairman Perry, Ranking Member Correa, and Members of the subcommittee: I 

am pleased to be here today to discuss the findings from our report being released 

today on the Department of Homeland Security’s (DHS) recent financial management system modernization efforts.1 Since DHS’s creation in 2003, its ability to 

manage operations and reasonably assure effective financial management has been 

hampered by significant internal control and financial management system deficiencies. These deficiencies contributed to our decision to designate DHS’s management functions, including financial management, as high-risk.2

In 2013, we reported on challenges related to DHS’s previous attempts to implement a Department-wide integrated financial management system as well as specific actions and outcomes related to modernizing financial management systems 

that are critical to addressing high-risk issues.3 We also reported on the existence 

of certain material weaknesses that limited DHS’s ability to process, store, and report financial data in a manner that ensures accuracy, confidentiality, integrity, and 

availability of data without substantial manual intervention.4 DHS subsequently 

adopted a decentralized approach to upgrade or replace legacy financial management systems and has been evaluating various options for modernizing its systems, 

including the use of shared service providers (SSP). As part of this effort, DHS initiated the TRIO project, which has focused on migrating the Domestic Nuclear Detection Office (DNDO), Transportation Security Administration (TSA), and U.S. Coast 

Guard (Coast Guard), or ‘‘the TRIO components,’’ to a modernized financial management system solution provided by the Department of the Interior’s Interior Business 

Center (IBC). The TRIO project represents a key effort to address long-standing financial management system deficiencies, and DHS’s efforts to effectively assess and 

19 

5Office of Management and Budget, Improving Financial Systems Through Shared Services, 

OMB Memorandum M–13–08 (Washington, DC: Mar. 25, 2013). According to this memorandum, 

agencies must consider, as part of their alternatives analysis, the use of a Federal SSP, and 

OMB will consider funding the use of commercial SSPs as an appropriate solution if the agency’s 

business case demonstrates that a commercial SSP can provide a better value to the Federal 

Government than a Federal solution. 6Office of Management and Budget and Department of the Treasury, Reducing Costs and Improving Efficiencies Through Federal Shared Service Providers for Financial Management (May 

2, 2014), accessed August 3, 2017, https://www.treasury.gov/connect/blog/Pages/Shared-Service-Providers-for-Financial-Management.aspx. 7GAO, Amphibious Combat Vehicle: Some Acquisition Activities Demonstrate Best Practices; 

Attainment of Amphibious Capability to be Determined, GAO–16–22 (Washington, DC: Oct. 28, 

2015). That report updated the AOA best practices initially published in GAO, DOE, and NNSA 

Project Management: Analysis of Alternatives Could Be Improved by Incorporating Best Practices, GAO–15–37 (Washington, DC: Dec. 11, 2014). These AOA best practices are based on longstanding, fundamental tenets of sound decision making and economic analysis and were identified by compiling and reviewing commonly-mentioned AOA policies and guidance that are 

known to and have been used by Government and private-sector entities. App. II of our report 

provides additional details on GAO-identified AOA best practices and their relationship to the 

four characteristics of a reliable, high-quality AOA process; see GAO–17–799. 8Software Engineering Institute, Capability Maturity Model® Integration (CMMI®) for Acquisition, Version 1.3, CMU/SEI–2010–TR–032 (Hanscom Air Force Base, MA: November 2010). 

manage risks associated with this project are essential to realizing its modernization 

goals. 

In 2013, the Office of Management and Budget (OMB) issued direction to agencies 

to consider Federal SSPs as part of their alternatives analysis.5 Subsequently, in 

May 2014, OMB and the Department of the Treasury (Treasury) designated IBC as 

one of four Federal SSPs for financial management to provide core accounting and 

other services to Federal agencies.6 In addition, Treasury’s Office of Financial Innovation and Transformation’s (FIT) responsibilities related to the governance and 

oversight of Federal SSPs were subsequently transferred to the Unified Shared 

Services Management office (USSM) after USSM was established in October 2015 

as an entity within the General Services Administration. 

This statement summarizes our report that examined: (1) The extent to which 

DHS and the TRIO components followed best practices in analyzing alternatives, 

and the key factors, metrics, and processes used in their choice of a modernized financial management system; (2) the extent to which DHS managed the risks of 

using IBC for its TRIO project consistent with risk management best practices; and 

(3) the key factors and challenges that have impacted the TRIO project and DHS’s 

plans for completing the remaining key priorities. 

To accomplish these objectives, we interviewed key officials and reviewed relevant 

documents. We compared the information we obtained to: (1) GAO-identified best 

practices for conducting an analysis of alternatives (AOA) process and related characteristics of a reliable, high-quality AOA process 7 and (2) best practices published 

by the Software Engineering Institute (SEI) for preparing for risk management, 

identifying and analyzing risks, and mitigating identified risks.8 We also reviewed 

TRIO components’ alternatives analyses documentation and evaluated their processes and related DHS guidance against the GAO-identified 22 best practices for 

conducting an AOA process. In addition, we reviewed DHS’s and the TRIO components’ risk management guidance and compared documentation and information obtained supporting their risk management efforts to best practices published by SEI. 

We also met with DHS, IBC, FIT, and USSM officials as well as OMB staff to obtain 

their perspectives on key factors and challenges that have impacted the TRIO 

project and DHS’s plans for completing remaining priorities. The work on which this 

statement is based was performed in accordance with generally accepted Government auditing standards. More details on our scope and methodology can be found 

in appendix I of our report. 

In brief, we found that DHS and the TRIO components did not fully follow best 

practices for conducting an AOA process and managing the risks of using IBC on 

the TRIO project, and we made two recommendations to address these concerns. 

DHS agreed with both recommendations and has taken action or has plans to implement them. In addition, we found that insufficient resources, complex requirements, 

and other challenges have impacted the TRIO project and contributed to a 2-year 

delay now expected in the implementation of Coast Guard’s and TSA’s modernized 

solution. In May 2017, DHS determined that migrating away from IBC to a DHS 

data center represented the best path forward. 

20 

DHS DID NOT ALWAYS FOLLOW AOA BEST PRACTICES

DNDO Substantially Met and Coast Guard and TSA Partially Met Best Practices 

for Conducting AOAs 

During 2012 and 2013, the TRIO components each completed an alternatives 

analysis to determine a preferred alternative for modernizing their financial management systems. Based on our assessment of these analyses, we found that DNDO 

substantially met the four characteristics that encompass the GAO-identified 22 

best practices for conducting a reliable, high-quality AOA process, while the Coast 

Guard and TSA both substantially met one and partially met three of these four 

characteristics. For example, although TSA’s alternatives analysis substantially met 

the ‘‘credible’’ characteristic, it partially met the ‘‘well-documented’’ characteristic, in 

part, because risk mitigation strategies, assumptions, and constraints associated 

with each alternative were not discussed in its analysis. Similarly, Coast Guard’s 

alternatives analysis substantially met the ‘‘comprehensive’’ characteristic; however, 

it partially met the ‘‘credible’’ characteristic, in part, because there was no indication that it contained sensitivity analyses on the impact of changing assumptions 

on its overall costs or benefits analyses. Our assessment is summarized in table 1. 

21 

TABLE 1: DHS TRIO COMPONENTS’ ADHERENCE TO CHARACTERISTICS OF A RELIABLE, HIGH-QUALITY ANALYSIS OF 

ALTERNATIVES PROCESS 

AOA Characteristic 

Overall GAO Assessment 

Coast Guard TSA DNDO 

Well-documented ............................ Partially met .................................. Partially met .................................. Substantially met. Comprehensive ............................... Substantially met .......................... Partially met .................................. Substantially met. Unbiased ......................................... Partially met .................................. Partially met .................................. Substantially met. Credible ........................................... Partially met .................................. Substantially met .......................... Substantially met. 

Source: GAO assessment of TRIO component information. For additional information on the methodology used to assess TRIO components’ adherence to characteristics of a reliable analysis of alternatives process, see GAO–17–799/GAO–17–803T. Legend: Coast Guard = U.S. Coast Guard; DHS = Department of Homeland Security; DNDO = Domestic Nuclear Detection Office; TSA = Transportation Security Administration. 

22 

9Software Engineering Institute, CMMI® for Acquisition, Version 1.3. 

Further, we found that DHS’s guidance did not fully or substantially incorporate 

5 of the GAO-identified 22 best practices. For example, although the guidance addressed risk management in general terms, it did not detail the need to document 

risk mitigation strategies for each alternative or address the need for an independent review—one of the most reliable means to validate an AOA process. Based 

on these analyses and other factors, the TRIO components determined that migrating to a Federal SSP represented the best alternative, and in 2014, DHS selected 

IBC as the Federal SSP for the project. However, because Coast Guard’s and TSA’s 

alternatives analyses did not fully or substantially reflect all of the characteristics 

noted above, we concluded that they are at increased risk that the alternative selected may not achieve mission needs. In our report, we made a recommendation 

for DHS to develop and implement effective processes and improve guidance to reasonably assure that future alternatives analyses fully follow AOA process best practices and reflect the four characteristics of a reliable, high-quality AOA process. In 

commenting on our report, DHS concurred with GAO’s recommendation and stated 

that it has issued guidance and instructions that addressed the recommendation. As 

part of our recommendation follow-up process, we will review DHS’s guidance and 

other relevant information. 

DHS MET THREE AND PARTIALLY MET FOUR BEST PRACTICES FOR MANAGING THE RISKS

OF USING IBC FOR THE TRIO PROJECT

Risk management best practices call for the identification of potential problems 

before they occur so that risk-handling activities can be planned throughout the life 

of the project to mitigate adverse impacts on achieving objectives. These best practices involve the following goals: Preparing for risk management, identifying and 

analyzing risks, and mitigating identified risks.9 Based on our evaluation, we found 

that DHS’s processes did not fully follow best practices for managing project risks 

related to its use of IBC on the TRIO project. Specifically, we determined that 

DHS’s processes met three of seven risk management best practices but partially 

met the remaining four best practices largely because its guidance did not sufficiently address these best practices. For example, although DHS created joint teams 

with IBC and provided additional resources to IBC to help address mitigation concerns, it did not always develop sufficiently detailed risk mitigation plans that included contingency plans for selected critical risks in the event that their impacts 

are realized. As a result, although IBC’s capacity and experience for migrating large 

agencies the size of Coast Guard and TSA was identified as a risk in July 2014, 

a contingency plan working group to address this and other concerns was not established until January 2017. Table 2 summarizes the extent to which DHS followed 

these seven best practices for managing TRIO project risks. 

23 

TABLE 2: DEPARTMENT OF HOMELAND SECURITY’S ADHERENCE TO BEST PRACTICES FOR MANAGING TRIO PROJECT RISKS 

Best Practice Practice Statement GAO Assessment 

Goal 1: Prepare for risk management: Preparation for 

risk management is conducted: 

Determine risk sources and categories ................. Determine risk sources and categories .......................... Met. Define risk parameters ........................................... Define parameters used to analyze and categorize 

risks and to control the risk management efforts.

Partially met. 

Establish a risk management strategy ................. Establish and maintain the strategy to be used for 

risk management.

Met. 

Goal 2: Identify and analyze risks: Risks are identified 

and analyzed to determine their relative importance: 

Identify risks ........................................................... Identify and document risks ........................................... Partially met. Evaluate, categorize, and prioritize risks ............. Evaluate and categorize each identified risk using defined risk categories and parameters, and determine each risk’s relative priority. Met. 

Goal 3: Mitigate risks: Risks are handled and mitigated 

as appropriate to reduce adverse impacts on achieving objectives: 

Develop risk mitigation plans ................................ Develop a risk mitigation plan in accordance with the 

risk management strategy.

Partially met. 

Implement risk mitigation plans ........................... Monitor the status of each risk periodically and implement the risk mitigation plan as appropriate. Partially met. 

Source: Software Engineering Institute (best practices) and GAO analysis of DHS data. For additional information on the methodology used to assess DHS’s 

adherence to risk management best practices, see GAO–17–799/GAO–17–803T. 

Legend: DHS = Department of Homeland Security; Met = DHS-documented processes generally satisfied all elements of the specific practice; Partially met = 

DHS-documented processes generally satisfied some but not all elements of the specific practice. 

24 

According to DHS officials, DHS relied heavily on IBC to manage risks associated 

with the TRIO project and, in particular, those for which IBC was assigned as the 

risk owner. They also acknowledged DHS’s responsibility for overseeing IBC’s TRIO 

project risk management efforts and described various actions taken to address 

growing concerns regarding IBC’s efforts, such as offering DHS assistance to IBC’s 

project management functions to help reduce exposure of underlying risks. Despite 

these efforts, DHS officials stated that challenges associated with the interagency 

agreement structure and terms of the performance work statement with IBC on the 

TRIO project limited DHS’s visibility into IBC’s overall cost, schedule, and performance controls and ability to oversee IBC’s risk management efforts. 

Further, the issues associated with the best practices we assessed as partially met 

were largely attributable to limitations in DHS and TRIO project guidance and policies. We concluded that by not adopting important elements of risk management 

best practices into project guidance, DHS and the TRIO components increase the 

risk that potential problems would not be identified before they occur and that activities to mitigate adverse impacts would not be effectively planned and initiated. 

In our report, we made a recommendation for DHS to improve its Risk Management Planning Handbook and other relevant guidance for managing risks associated 

with financial management system modernization projects to fully incorporate risk 

management best practices. In commenting on our report, DHS concurred with 

GAO’s recommendation and identified actions it plans to take to implement it. 

KEY FACTORS AND CHALLENGES IMPACTING THE TRIO PROJECT AND DHS’S PATH

FORWARD

DHS, IBC, FIT, and USSM officials and OMB staff identified several key factors 

and challenges that have impacted the TRIO project, which we grouped into five 

broad categories: Project resources, project schedule, complex requirements, project 

costs, and project management and communications. Examples of the key factors 

and challenges that were identified for each of these categories include: 

• Project resources.—Concerns about IBC’s experience and its capacity to handle 

a modernization project involving agencies the size of Coast Guard and TSA 

were identified as significant risks in July 2014, prior to DHS and IBC’s entering the TRIO project implementation phase in August 2014. According to DHS 

officials and documentation, IBC encountered Federal employee hiring challenges and was unable to ramp up and deploy the resources necessary to meet 

required deliverables and experienced significant turnover in key leadership 

and TRIO project positions over the course of the project. IBC officials acknowledged these challenges and that staff assigned early in the project lacked the 

experience and expertise necessary for managing large-scale projects and, as a 

result, many of the risks initially identified were not effectively addressed. 

• Project schedule.—Migrating the TRIO components to IBC within original time 

frames was a significant challenge given the overall magnitude and complexity 

of the TRIO project. DHS identified delays in stabilizing the production environment after DNDO’s migration to IBC and in meeting proposed baseline schedules for implementing Coast Guard and TSA on the modernized solution. 

• Complex requirements.—DHS, IBC, FIT, and USSM officials acknowledged the 

overall complexity of the TRIO project and that the lack of a detailed understanding of the components’ requirements earlier in the project affected IBC 

and DHS’s ability to satisfy the requirements as planned. USSM and FIT officials told us that under the shared services model, the approach for onboarding 

new customers usually involves migrating to a proven configuration of a solution that is already being used by the provider’s existing customers. However, 

rather than taking this approach, DHS and IBC agreed to implement a more 

recent version of Oracle Federal Financial software (version 12.2) with integrated contract life cycle and project modules, increasing the complexity of 

TRIO project requirements. A FIT official told us that the functionality of this 

more recent version of software is very different than that of the version IBC’s 

existing customers used and that IBC did not have the needed Government personnel with knowledge and experience associated with it. 

• Project costs.—Estimated costs of the TRIO project significantly increased because of schedule delays, unanticipated complexities, and other challenges. According to a January 2017 summary prepared by DHS, estimated IBC-related 

TRIO project implementation costs through fiscal year 2017 increased by approximately $42.8 million (54 percent) from the $79.2 million provided in the 

original August 2014 interagency agreement with IBC, in part, to address challenges affecting the project. 

25 

• Project management and communication.—DHS officials expressed concerns regarding the effectiveness of IBC’s project management efforts, including cost, 

schedule, and change management. They also stated that DHS provided significant time and resources to make up for fundamental project management activities that were under IBC’s control and not performed. They also acknowledged 

challenges in DHS’s project management and communication efforts and identified lessons learned to help improve future efforts, such as being more prepared 

for organizational changes and centralizing program management functions to 

help reduce duplicate efforts across components. According to USSM officials, 

the TRIO project team focused an unbalanced portion of its efforts on the delivery of technology at the expense of organizational change management, communication management, and other project management areas. An OMB staff 

member concurred with the lessons learned identified by DHS and noted the 

importance of DHS having well-defined requirements for the project and better 

coordination to achieve the desired outcomes. 

These challenges contributed to a 2-year delay now expected in the implementation of Coast Guard’s and TSA’s modernized solution. To help address them, DHS 

and IBC established review teams and have taken other steps to assess potential 

mitigating steps. For example, in January 2017, DHS and IBC established a joint 

contingency plan working group (CPWG) to assess viable options for addressing 

stakeholder concerns and key TRIO priorities moving forward. In February 2017, 

DHS and IBC presented two options for addressing these concerns, and in April 

2017, the CPWG recommended moving away from IBC to a commercial service provider as the best course of action to complete TRIO project implementation. In May 

2017, DHS determined that this option was not viable and that migrating the solution from IBC to a DHS data center represented the best option and initiated discovery efforts to further assess this as its path forward for the TRIO project. As of 

August 2017, results of these efforts were under review by DHS leadership. As the 

path forward is still evolving, it is too early to determine the extent to which these 

challenges, and DHS’s efforts to effectively address them, will impact DHS’s ability 

to achieve TRIO project goals. 

In commenting on our report, DHS stated that it remains committed to its financial system modernization program and that it will continue to apply sound program 

and risk management best practices to achieve its modernization goals. 

Chairman Perry, Ranking Member Correa, and Members of the subcommittee, 

this concludes my statement. I would be pleased to respond to any questions you 

may have at this time. 

Mr. PERRY. The Chair thanks the gentleman. 

The Chair now recognizes himself for 5 minutes for questioning. 

I guess I will start with you, Mr. Fulghum. I don’t have to say, 

you know, what, $50 million the first time, $124 million this time. 

I appreciate you saying the buck stops with you, and I understand 

to a certain extent that maybe this wasn’t your idea how this 

should be with the shared services model, but you were told that 

is what you were going to do and it was your mission when you 

moved out. 

But you must understand, and I am sure you do, that we can’t 

accept that loss of money, that expenditure, without having a viable product all these years later now. 

One of your other testifiers there talked about the deliverables, 

and I will ask her about that because I think she said there is 

some value that has been retained here. 

But to me, you served your country in uniform, and I am sure 

you are well familiar with these processes, but any kind of project, 

you know, whether it is attacking the enemy or whether it is cleaning the hangar, you have got some milestones, right? You know you 

have got to get past some things and evaluate your circumstances, 

see where you are and see if you are on track. 

It doesn’t seem to me, and I might be wrong, so I will ask Ms. 

Singer at some point, too, but from your standpoint when you 

signed this agreement, when you agreed to this whole prospect, 

26 

were there milestones in place? If there were, briefly, what were 

they? 

If there were milestones to make sure that you stayed on track, 

it seems like at this point that we have failed to meet them or recognize them or we just blew past them. What the heck is going on 

here? 

Mr. FULGHUM. So first of all, what I would say is, and to 

Michele’s point, we do have a system that is functioning and working and we can talk about that. But as far as the milestones go, 

we had an integrated schedule and we sat down routinely and 

looked at that schedule. Showing that schedule was green, green, 

green in around the May time frame of 2016, it was turned to yellow and red. 

At that point, I called the folks together, including IBC, her 

former colleague, and said, what the heck is going on? We stopped 

the project at that point. We sat down with them and said, what 

can we do to course correct? We put some things in place in terms 

of incremental releases, more frequent check-ins, increased oversight and some other things and also provided some resources to 

IBC. We were able to DNDO up and running. 

Subsequently to that, we began on TSA’s effort and again the 

schedule started to go south. That’s about the time Michele showed 

up, we sat down again because of their inability to adequately resource themselves as well as what I would say is a misunderstanding of requirements of a large, complex Federal agency that 

would be a standardized solution for that type of agency, we made 

the decision to part ways. 

But we do have a solution that is functioning, is making payments, is writing contracts, is producing financial statements and 

is the foundation of the system moving forward, which is why we 

made the decision to continue. 

Mr. PERRY. You just elaborated on the two times that you 

stopped it. 

Mr. FULGHUM. So, yes, sir. We stopped it before we ultimately 

got DNDO up and running. Then along with IBC we made the decision to end the relationship, as she said, in January 2017. 

Mr. PERRY. Was that, the ending of the relationship, was that envisioned, so to speak, or at least some tenet of what would precipitate that in the original agreement? So say this is what we want 

to get accomplished, these are our milestones, if you can’t get it 

done we are going to be done because of this, this, and this. Was 

that envisioned at the genesis of the agreement, or was that never 

considered? 

Mr. FULGHUM. It wasn’t in the agreement. 

Mr. PERRY. So if it is not in the agreement, it doesn’t seem like 

we are going to be very efficient. 

Now, I am going to talk to Ms. Singer here for a moment. I guess 

my point to that is that, yeah, while you agreed to part ways, I am 

not sure we got the best value out of the deal. If somebody, you 

know, if somebody is working on my house, and I have an agreement, and I am going to pay you $50,000 to do X work on the 

house, and I know that I am going to terminate it at some point 

if you don’t perform, I am going to want some of my money back 

or I am going to want, you know, X amount of work done. 

27 

But that all has to be determined up front, you can’t wait until 

you are in the middle of the construction to figure that out. It is 

too late, feelings are hurt, so on and so forth. 

Really quickly, and maybe we will do a second round here, Ms. 

Singer, you said there were value of assets to be transferred. What 

is the value? So we spent $124 million on this round. What do you 

consider the value of the assets to be? 

Ms. SINGER. The valuable assets I speak of is Oracle Federal Financial 12.2, the system that was developed, coded, tested, and implemented for DNDO. In the next quarter of this fiscal year, we 

will have released 3.0 which will include 80 percent of the 

functionality needed for TSA and Coast Guard. 

So at this point, the operational system that DNDO is using 

every day will be available for DHS to manage in one of their data 

centers and bring live TSA and Coast Guard in the coming years. 

Mr. PERRY. So we are 60 percent over budget. I think the original 

estimate was $70-some million, we are $124 million. What do you 

assess the value to be? Because we have got DNDO up, right? We 

have got a shell or a structure or a foundation for TSA, we have 

got nothing for Coast Guard. So we have paid 60 percent more, is 

that the value of it? I mean, are you saying that was worth $124 

million? Did we just miss the estimate? 

Ms. SINGER. I absolutely believe the estimate was missed. Now, 

my assessment is based on the record assessment of historical 

agreements back and forth, the best I could determine in the last 

18 months that I have been managing this. 

I also think it highlights IBC at the time did not understand the 

complexity and the needs of an agency like DHS. They were vastly 

larger than anything we had undertaken. Our 17 other agencies 

that reside on Oracle Federal Financial 12.1 use a common solution 

and we are the No. 1-rated financial services provider in customer 

service to those 17 agencies. 

So the underestimation of the magnitude of the effort on both 

sides was real. But as the director of the shared service provider 

looking back over the record, I am extremely disappointed that I 

had predecessors who did not recognize that at the time and exercise more discipline both internally in their own organization in 

IBC as well as as a provider with DHS to help prevent some of the 

delays and cost overruns. 

Mr. PERRY. All right, thank you. 

My time is long expired. 

The Chair now recognizes Ranking Member Correa. 

Mr. CORREA. Thank you, Mr. Chairman. 

First of all, to the witnesses, thank you very much for your testimony. 

Mr. Fulghum, a quick question. Given all of the challenges that 

we are talking about here, cyber attacks, are we more vulnerable, 

less vulnerable? Where are we with that, protecting our data from 

the bad guys? 

Mr. FULGHUM. I mean, what I would tell you is I call it a fullcontact sport and we have to be diligent 24/7. We have real threats 

out there each and every day. 

Mr. CORREA. Are we more vulnerable than usual or have we 

taken care of business? 

28 

Mr. FULGHUM. I think we have done everything we can to protect 

ourselves. 

Mr. CORREA. Thank you very much. 

Ms. Singer, very quickly, we talked about the Oracle system. The 

Chairman talked about ownership, what we got out of our investment. Oracle 3.0, is that what you said? Who owns that? Do we 

own that or does Oracle? Is that something proprietary to Oracle? 

When we need to, you know, work it, modify it, does Oracle come 

in and do it or our in-house folks do it? 

Ms. SINGER. It can be a combination. We have in-house folks who 

have some skills in modifying the system. But generally, we do 

work with industry. It is always a public/private. 

Mr. CORREA. How is the contract written? Is it proprietary or 

non-proprietary? 

Ms. SINGER. It is not proprietary. The underlying system is proprietary to Oracle, the out-of-the-box system. However, when it is 

coded and additional functionality is added, that is generally by another—— 

Mr. CORREA. So whatever asset we have, we can possibly use 

that since we own it in other areas of government. 

Ms. SINGER. Absolutely. 

Mr. CORREA. Given all the lessons learned. 

Ms. SINGER. Absolutely, this asset—— 

Mr. CORREA. So possibly we do have something of value there 

that we are getting out of taxpayer dollars. 

If I can now move to Ms. Angerman. USSM’s role in partnership 

between DHS and the Interior Business Center, IBC, how engaged 

with USSM during the discovery phase in the implementation of 

the IBC solution? 

Ms. ANGERMAN. Thank you for your question. USSM was set up 

in 2015 and so the project was very much in flight when USSM 

was created. We, however, engaged with the program on a fairly 

regular basis to share what we knew to be best practices and lessons learned on how a shared service can be best implemented. 

Mr. CORREA. Now, the lessons learned that were articulated by 

IBC, DHS, both thought it was clear that DNDO was failing the 

migration. The TSA migration would also be delayed. So Coast 

Guard, where were we with that migration? 

Ms. ANGERMAN. I think that question may be best answered by 

Mr. Fulghum who can provide the status of that program. 

Mr. CORREA. Mr. Fulghum. 

Mr. FULGHUM. So currently, we are in the final stages of planning to transition from IBC to our own data center. Right now, our 

notional schedule says, based on funding and some other things, 

that we believe we can have it up and running in fiscal year 2021. 

Mr. CORREA. Another question, Ms. Angerman. After all these attempts to standardize into a single platform, are we going to centralize or decentralize? What are we doing right now in terms of 

the philosophy? I find that sometimes we take a shot at an effort 

and sometimes we find that maybe there are shortcomings, so then 

we take a policy swing from centralization to decentralization. How 

would you characterize right now the status in terms of implementing solutions to these problems? 

29 

Ms. ANGERMAN. I would characterize right now as taking a step 

back and really looking at what we have learned today, both from 

this program and from others that have attempted these kinds of 

transformational efforts. 

I think we have two options for moving forward. One is we step 

back and we go back to a decentralized model and we let every 

agency build their own finance systems and H.R. systems and then 

we figure out how to keep those modern and funded. Or we agree 

that we want to consolidate that IT and we want to mitigate that 

risk for taxpayers and we want to get scale for the Government. 

Mr. CORREA. I am running out of time, so let me quickly—we 

just talked about Oracle, we have got some value there. So could 

that be used in the decentralization process? 

Ms. ANGERMAN. We don’t know yet. The truth is that we need 

to sit down as a Government and include all of the agencies in a 

discussion about what requirements we actually have for future financial management systems, inclusive of large and small agencies. 

We need to be able to articulate that as a Government and speak 

with one voice as what we need, and then we will be able to assess 

solutions, both that are in Government today and potentially new 

solutions from industry that can help us satisfy financial management needs holistically. 

Mr. CORREA. Mr. Chair, I yield. 

Mr. PERRY. The Chair thanks the gentleman. 

The Chair now recognizes Mr. Higgins from Louisiana. 

Mr. HIGGINS. Thank you, Mr. Chairman. 

Colonel Fulghum, thank you for your service of 28 years, sir. 

Your resume is very, very impressive. As an old soldier, I would 

imagine that looking at your resume if you can’t get this thing 

done, I can’t imagine who could. So although I recognize you as a 

gentleman of great accomplishment, and I also recognize in your 

spirit, sir, and read within your statements great frustrations of 

what has unfolded and transpired over the last years. Would that 

be an accurate assessment? 

Mr. FULGHUM. I share the committee’s frustration. 

Mr. HIGGINS. OK. 

Ms. Singer, in your opening statement, you stated that to achieve 

strong adoption of standard business processes, customer agencies 

must evaluate their complex business processes with a willingness 

to differentiate and potentially eliminate disparate processes that 

are not legally mandated. That was many syllables in one sentence. 

But to me, that means eliminate unnecessary duplicative policies 

and procedures. 

The GAO report cites IBC officials describing DHS’s approach to 

project management often resulted in duplicated meetings and 

lengthy decision-making process involving several officials and 

multiple review and approval processes. 

Colonel, did you have the authority to eliminate during the 

course? I realize you are dealing with multiple bureaucracies and 

perhaps what would be recognized by the citizens that we serve as 

the very worst manifestation of heavy bureaucracy in the Federal 

Government, and you were in charge of a large project. Did you 

30 

have the authority to eliminate some of these unnecessary lengthy 

meetings and multiple reviews and approval processes? 

Mr. FULGHUM. Yes, sir, and we did. 

Mr. HIGGINS. Did you find during the course of your efforts to 

make this thing work, did you find resistance out of the Executive 

branch or out of any of the alphabet branches that you were working with? Has that resistance dissipated over the course of the last 

6 months? 

Mr. FULGHUM. I think there was a persistence to head toward 

the Federal shared services model under the previous administration. I have seen an increased adaptability to the model we are 

going to under this administration. 

Mr. HIGGINS. Thank you, sir. 

I would like to ask, I believe, you, Colonel, and Ms. Singer, any 

member of the panel that could answer this, were any private models, best-practice models from private endeavors, large, massive entities like Walmart or Home Depot, Lowe’s, they have gone through 

modernization processes through the course of their existence, were 

any private models used or brought in to study their best practices? 

Mr. FULGHUM. Yes, sir. During our analysis of alternatives, we 

looked at the private sector. In addition to that, we had an independent look at what the private sector is currently doing. 

Mr. HIGGINS. Did you find that—I am honing in on something 

here. 

Mr. FULGHUM. Yes, sir. 

Mr. HIGGINS. The Chairman clearly pointed out that private 

businesses have to modernize all the time. We do it with the most 

efficient means by which moving forward that we can possibly find 

and determine. I am asking, is the bureaucracy of the agencies that 

you are working with so thick that the common best practices 

found in private industry toward modernization just doesn’t quite 

work? 

Mr. FULGHUM. I would say it is a challenge working in the bureaucracy. That said, our independent look showed that large corporations also failed in terms of modernizing their systems, so they 

didn’t always get it right either. 

Mr. HIGGINS. Can you give us an example of that? 

I am sorry, Mr. Chairman, I am over my time. 

Mr. FULGHUM. I don’t have a specific example of a corporation, 

but we can certainly provide the committee with the results of our 

analysis. 

Mr. HIGGINS. That would be interesting to review. Thank you for 

your answer and thank you for your service, sir. 

Mr. Chairman, I yield. 

Mr. PERRY. The Chair thanks the gentleman. 

The Chair recognizes the gentlelady from California, Ms. 

Barraga ́n. 

Ms. BARRAGA ́ N. Thank you, Mr. Chairman. 

Ms. Angerman, do you know what processes and criteria DHS 

used to select IBC as its SSP for financial management? 

Ms. ANGERMAN. Thank you for your question. I know that the 

process that they went through at DHS to select IBC was largely 

driven by the memorandum M13–08 to direct agencies to a shared 

service provider. 

31 

Ms. BARRAGA ́ N. Do you know if DHS and IBC if they did at all 

communicate to ensure whether the systems were interoperable 

such that IBC’s system could fully integrate DHS’s system? 

Ms. ANGERMAN. I am aware that during the discovery process 

they went into some depth to discuss what the integration needs 

would be with other systems that would remain at DHS. 

Ms. BARRAGA ́ N. Who was responsible for identifying and reconciling discrepancies between IBC’s systems capabilities and DHS’s 

system requirements? 

Ms. ANGERMAN. That is the purpose of the discovery process, 

which is that they sit down and they talk about the way that the 

process exists today at the customer agency, how the process works 

at the shared service provider, and they try to close those gaps and 

figure out how they will change their processes to adapt to the solution. 

Ms. BARRAGA ́ N. Thank you. 

Mr. Fulghum, you talked a little bit about at some point you realized something was wrong and you all sat down to talk about it. 

How far after everything started did you realize that things were 

going wrong? 

Mr. FULGHUM. If I recall correctly, it was about 8 months in. 

Ms. BARRAGA ́ N. When we were 8 months in, did you realize that 

the Government was going to spend millions more than what was 

initially projected? 

Mr. FULGHUM. That was a part of when we paused the program. 

It clearly looked like we were off schedule and that we were going 

to have to expend additional resources, yes. But that is when we 

went through the replanning effort to see if we could turn the program around, which, again, we did deliver DNDO on time. Not on 

budget, but on time. 

Ms. BARRAGA ́ N. Then how much longer after that did you all decide that this wasn’t going to work and you terminated? 

Mr. FULGHUM. If I remember right, we began those discussions 

the following April and eventually determined that we wouldn’t be 

able to do it. 

Ms. BARRAGA ́ N. So pretty early on. 

Ms. Angerman, how do inadequate financial systems affect the 

operational capacity of DHS? 

Ms. ANGERMAN. Inadequate financial systems insomuch that 

they are legacy systems that need to be modernized introduce risk 

to being able to have access to data in a timely fashion and to be 

able to have consistent data across the Department to be able to 

make key decisions. 

Ms. BARRAGA ́ N. So is this system used to try to determine if 

projects are on track cost-wise? 

Mr. FULGHUM. So this system provides financial information that 

can inform future decisions around acquisitions or other things if 

that is what you are asking. 

Ms. BARRAGA ́ N. Well, I am just thinking, at a time when the administration is attempting to divert resources to projects like the 

border wall, I am curious to know if Congress and DHS management will have access to a full financial picture of the Department 

and where they are in these projects. 

32 

Mr. FULGHUM. So the Department has consolidated financial reporting today. We use business intelligence to get it. We have financial information that we produce every month from a consolidated nature, so, yes, we have a complete picture of the Department’s finances. 

Ms. BARRAGA ́ N. OK. I will yield back. 

Mr. PERRY. The Chair thanks the gentlelady. 

The Chair recognizes the gentleman from Texas, Mr. Ratcliffe. 

Mr. RATCLIFFE. Thank you, Mr. Chairman. 

Thank all the witnesses for being here today. 

We spend a lot of time, it seems, talking about what went wrong 

when you realized things went wrong, basically how we got here 

and the different initiatives ending in wasting $56 million, I think, 

and then $124 million. 

So having said all that, I guess what I really want to know and 

what I haven’t heard yet is, why should Congress have any assurance that the next attempt will be successful, especially given how 

aggressive the schedule appears to be? 

I want to start with you, Mr. Fulghum, and give you a chance 

to answer that. 

Mr. FULGHUM. So first of all, again, we do have the foundation 

of a solution that works. We know a lot more than we knew 2 years 

ago. 

Mr. RATCLIFFE. Well, let me stop you there. 

Mr. FULGHUM. Yes, sir. 

Mr. RATCLIFFE. Because you say that, but I heard the answers, 

some of the responses from Ms. Singer and Ms. Angerman, and 

what I heard was talking about lessons learned from where we 

were. 

Ms. Angerman, you said, well, we need to step back and decide 

whether or not to be decentralized and then you started and you 

weren’t able to finish that answer. 

Ms. Singer, you said, you know, we didn’t understand the need 

of DHS. That is a lot of don’t knows and don’t understands. That 

doesn’t inspire a whole lot of confidence, so that is the context of 

my question. 

Mr. FULGHUM. OK. So what I would say is they didn’t know and 

didn’t understand. They have a much better appreciation today of 

our requirements. The solution meets 75 percent of our requirements. As Ms. Singer said, when 3.0 comes in October, we will be 

at over 80 percent. That is how the system was originally designed. 

DNDO was to be a pilot with the basic foundation for an integrated 

solution, add TSA’s functionality and then add the Coast Guard’s. 

So that is why I say that we have a system that works to build 

on. 

Mr. RATCLIFFE. Thank you, Mr. Fulghum. 

Ms. SINGER. Ms. Angerman, I will give you a chance to sort-of 

weigh in and give your perspective on that as well. But I want to 

ask this question in connection with giving your answer, and that 

is, if there are lessons learned and there is a foundation for a solution going forward, what is the biggest risk that DHS still has to 

identify or mitigate at this point with respect to financial management and reporting systems? 

33 

Ms. SINGER. Thank you for that question. I think the biggest risk 

for any large, complex, federated agency—and the federated part is 

important because its component parts are vital, unique, or 

brought in to be part of the whole with their disparate systems and 

processes that they have brought with them—the biggest risk will 

always be finding a baseline that as many of those component 

parts can live with as possible and meet their vital and important 

business needs as well as be auditable and of sound financial organization. 

I think no one is better situated than DHS headquarters to understand that need. I see no one more committed than Mr. 

Fulghum, his leadership team to bring discipline to that effort. But 

it is an enormous challenge. The Department of the Interior went 

through it and that is an agency more than 150 years old, smaller, 

and less complex, but still struggled mightily in implementing one 

consolidated financial system. I lived through that and understood 

the complexities and that will always be the largest challenge. 

It will leave the question whether a large, complex, federated 

agency like DHS or others in the Federal Government belong with 

one of the existing shared service providers or whether they are 

best-suited with help from industry and guidance from best practices to consolidate on their own. I think the platform they have 

now provides that opportunity. 

Mr. RATCLIFFE. Ms. Angerman, I will give you a chance to weigh 

in on those points and questions. 

Ms. ANGERMAN. Thank you. I would largely agree with Ms. Singer’s comments. I would say that DHS has recognized that this will 

continue to be a challenge and they have created a joint program 

management office at headquarters and staffed it appropriately so 

that they are prepared to address challenges going forward. 

I would also say that this is an important lesson learned for the 

Government at large. So my comments about stepping back is that 

when we think about the strategy for shared services at large for 

the Government and what we are going to do going forward, this 

is really important data for us. 

In addition to some of the best practices, we have learned by 

talking to Fortune 500 companies who have had the same challenges when they tell us this is equally as hard for them to do, but 

where it has also been a proven best practice. All of that is really 

helping us to move forward with a better strategy. 

Mr. RATCLIFFE. Thank you. 

My time is expired. I yield back. 

Mr. PERRY. The Chair thanks the gentleman from Texas. 

The Chair recognizes the gentleman from Kansas, Mr. Estes. 

Mr. ESTES. Thank you, Mr. Chair. 

In my prior life before I ran for public office, I did some of this 

work, so I have got a little bit of understanding of some of the problems that you have run into in a complex project like that. 

I want to talk a little bit more about where are we going to go 

from here, I mean, what is the path forward, which is part of what 

we talked about in some of the notes here. 

So basically, we are pulling this into an operation by DHS and 

kind-of moving away from the shared services concept and moving 

forward. That is the plan right now with the use of the software? 

34 

Mr. FULGHUM. So what I would characterize it is we are moving 

from DOI’s environment into DHS’s and it will be a private cloud 

offering. We still have a shared service, just an internal shared 

service provider. So the Coast Guard is providing the accounting 

support today for those three entities. We will have one integrator 

contractor that will provide those platform services for all three 

components; it is just we are no longer asking for services from another Federal agency. 

Mr. ESTES. OK, that makes sense to some degree from a strategy, I guess. But there is probably another question for another 

hearing in terms of talking about where we go with the shared 

services model at the total Federal level, but not to sidetrack from 

that. 

Ms. Singer, one of the things you talked about was that we were 

80 percent of the way with Coast Guard and with TSA, and I guess 

expectations are first quarter of 2018 we would have the TSA software up and available. Is that 80 percent functioning and provides 

80 percent of the functionality that we wanted, or is it 80 percent 

of the way to being developed and programmed and tested? 

Ms. SINGER. I believe what we mean by that is delivering 80 percent of the desired functionality. There are interfaces to be developed and a couple of key components that DHS must decide whether or not they want to develop and implement that they are bestsituated to make that decision. 

For a shared service provider, like the Interior Business Center, 

those would be developments that I could not offer or provide to 

any other agency. They are very specific to DHS. That is why it 

doesn’t fit within this particular shared service model, but that 

does not mean that they are not necessary or vital to DHS to be 

able to carry out their important mission. 

It is just that last 20 percent of requirements will be for DHS 

to further develop and implement. But the full system is operating. 

For that functionality that they would like to see come on-board 

soon, there also exists workarounds. It allows the work to be done, 

but may be not in exactly the way they would like to see it. 

Mr. ESTES. So is the Oracle software platform going to be used 

by the Coast Guard to provide that support for TSA? 

Mr. FULGHUM. Yes, sir, same platform. I would describe it a little 

bit differently than Michele. DNDO is a basic 300-person operation. 

TSA has got about 60,000 employees, but their basic operation is 

fairly straightforward. The Coast Guard has a much more complex 

organizational structure and business practice than TSA. So when 

we get the 3.0 for TSA it will work for TSA. We need the last 20 

percent to add some increased functionality because of the complexity of the Coast Guard. 

Mr. ESTES. So going back to TSA and whether we are up and 

running, I mean, how are we going to use that for TSA? So what 

is the functionality that is going to be used for TSA come first 

quarter of 2018 if we are not using the software or going live with 

the software for them? 

Mr. FULGHUM. So today we will stay on the system that we are 

on and continue to stay on the legacy system until we are ready 

to migrate into the new solution. 

35 

Mr. ESTES. OK. One final question that I know may run longer 

than the time I have in terms of the answers. How much have we 

modified this software so that it makes upgrades difficult and complex and maybe even impact the ability to use future upgrades provided by the vendor in the future? 

Mr. FULGHUM. Well, I will start and Michele probably has more 

expertise than I do, but the out-of-the-box commercial software we 

are not modifying. What we are describing is, and it provides some 

integrated solution in terms of procurement, what we are talking 

about is other interfaces for property, logistics management and 

those type of things that interface with the solution. But the software itself we are not modifying. 

Ms. SINGER. There are significant additional functionality interfaces, as Mr. Fulghum noted, to the extent, I mean, if you looked 

at lines of code that have been written or modifications, what we 

call the requirements traceability matrix will show a significant 

number of changes in order to meet the DHS business needs. 

I do believe there are methods to ensure upgrades, enhanced security, and continued security of the system. It is not modified outside the realm of what can be continuously secured and updated. 

Mr. ESTES. Thank you. 

I am out of time. I yield back. 

Mr. PERRY. The Chair thanks the gentlemen. 

We will go for a second round as long as we can. 

Ms. Angerman, it is my understanding, so I just want to make 

sure I am correct here, that your agency provides input and advice 

on best practices related to design and execution. Is that generally 

speaking correct? 

Ms. ANGERMAN. Yes, that is correct, sir. 

Mr. PERRY. OK. So, Mr. Khan, in your testimony, you said that, 

and I want to make sure once again I am correct, that, in your 

opinion, based on your investigation, that the agency didn’t follow 

best practices. Is that correct? 

Mr. KHAN. Best practices was in terms of the alternatives analysis. We found that DNDO followed all the best practices. These 

are industry best practices so, I mean, they are well-known in the 

industry. However, TSA and Coast Guard did not follow all elements of the best practices to result in a high-quality, reliable alternatives analysis. 

Mr. PERRY. Were you able to determine why they wouldn’t? I 

mean, has that question been asked or do I need to ask Mr. 

Fulghum? You just determined they didn’t? 

Mr. KHAN. Right. We didn’t ask why, we just looked at the end 

results of their analysis that was done some time before we started 

our audit. 

Mr. PERRY. OK. 

Ms. Angerman, do you agree with that? Do you know if they, in 

your opinion, if they followed these best practices? I mean, you are 

the adviser on these things. 

Ms. ANGERMAN. I think there were always—we identified and observed opportunities to improve in the planning process and the 

change management process in the integrated project management 

between the two agencies and that they investigated through their 

36 

alternatives analysis the options that were available to them at the 

time. 

Mr. PERRY. OK. 

Mr. Fulghum, can you comment? I mean, you know, if these are 

well-known, widely-ascribed-to best practices, is there some reason 

why they can’t be followed or just recalcitrance or, you know, institutional bias for the organization, this is how we do things, this is 

how we have always done them, and we are not going to change, 

and we are going to resist? What is your take on this? 

Mr. FULGHUM. No, sir. We will follow the best practices that 

were identified. 

I think what GAO found was that, in the case of DNDO, they 

had an independent contractor do their alternatives analysis. While 

the Coast Guard and TSA went through an extensive review process, they didn’t have that independent contractor perform the analysis, I think is where we primarily fell short. 

Mr. PERRY. So are you saying that the Coast Guard and TSA 

should have had the independent contractor as—— 

Mr. FULGHUM. I think a best practice would have been to have 

an independent review of that analysis. What I am saying, though, 

is that there was an extensive review of that analysis of alternatives by a variety of folks, including Treasury FIT. 

Mr. PERRY. OK. In your testimony, Colonel, you said that it 

would be restructured for clearer accountability moving forward. 

Can you tell me what the difference in moving forward regarding 

accountability? Can you also describe if the private sector, so to 

speak, is going to be involved either more or to what extent moving 

forward? 

Mr. FULGHUM. OK. Well, I will start with the accountability and 

a clear line of accountability. What I was referring to is, when we 

originally set up the structure we had three program offices with 

someone sitting over them and they were four people with, what 

I would say, no one really in charge. So when we stopped to pause 

the program, one of the things that I did was I asked the now-acting CFO to go take a hard look at ourselves to see what is it that 

we can do better. Out of that came a joint program office where 

there is one person, she is sitting right behind me, who is accountable and in charge. 

So from that perspective, I completely agree that we were fragmented in terms of our communication. I believe we have fixed that 

now. 

As far as the private sector, we are going, as you know, we have 

a draft, an RFP out asking for what I call a systems integrator. 

That will be a performance-based contract with clear visibility into 

both cost and scheduling. 

Mr. PERRY. Excellent. Do you want to announce the gentleladybehind-you’s name who is going to be accountable so that when the 

next time we get together maybe she will be sitting on the dais 

with you? Or maybe we won’t have to get together, which would 

be even better. 

Mr. FULGHUM. I don’t expect us to get together on this topic. But 

ultimately, as I said at the start, I am the one that is responsible 

and accountable. 

37 

Mr. PERRY. All right. Mr. Fulghum, we are going to hold you to 

that. We appreciate that. 

With that, I will conclude my questioning and recognize the 

Ranking Member, Mr. Correa. 

Mr. CORREA. Thank you, Mr. Chair. 

Just as I am listening to your answers, I learn more and more 

and I have even more and more questions. But right now, we are 

not talking about all of DHS, we are just talking about certain portions of DHS. Correct? 

Mr. FULGHUM. That is correct. 

Mr. CORREA. OK. So are we looking at eventually getting the 

bugs out of this process and then integrating the remainder of the 

DHS departments? 

Mr. FULGHUM. So our plan would be moving forward, again, and 

a lot of this is dependent on funding, which, by the way, I completely understand, given where we are today, we have ICE with 

services themselves and four other customers and then we have 

FEMA left to go. So based on this model and looking to standardize 

and reduce the footprint, we would expect to repeat this model with 

both ICE and FEMA. 

The rest of DHS is operating on a modernized system, CBP, Secret Service, and FLETC. 

Mr. CORREA. So I guess, given the words you have just used, we 

are going to be using the best lessons learned here to try to move 

forward to essentially address the other departments as well, ICE 

and FEMA? 

Mr. FULGHUM. Right, again using that internal shared services 

approach. Yes, sir. 

Mr. CORREA. Let me say that, again, just based on my State legislative experience, you have got a challenge on your hands, we 

have a challenge on our hands. But I think that all of you here 

working together, coordinating with this committee and subcommittee, can make sure we coordinate and know what is going 

on so that we can best prepare for these surprises and we don’t 

have to be here in a quarter or thereafter and have to answer 

tough questions, but rather try to make sure that there aren’t any 

surprises as we move ahead. There will be. 

Again, as I listen to your testimony, I am getting these nightmares of what we went through in the State of California as a decentralization, not centralized, private, public, nothing really ended 

up being the right answer. But rather, I think we have to look at 

the process to make sure that we are managing the whole process 

and its implementation and adapting, I guess, to the circumstance 

as we move forward. 

Mr. Chair, I yield the remainder of my time. 

Mr. PERRY. The Chair thanks the gentleman. 

The Chair recognizes the gentleman from Louisiana, Mr. Higgins. 

Mr. HIGGINS. Mr. Chairman, I have more of a statement than a 

question. I would just like to commend this panel for your candid 

and courageous answers. This is a level of complexity to coordinate 

for modernization, an endeavor that was envisioned years ago, and 

to sit before a Congressional subcommittee like this and confess 

that lessons were learned and changes were made. 

38 

I was particularly struck by Ms. Singer’s honesty when she stated that the estimate was missed by her predecessors regarding the 

$70 million price tag that has evolved into a $124 million price tag, 

and we are not done yet. 

So, Mr. Chairman, I think every now and then we have some 

very squared-away panelists and this was one of those days. 

So we thank you all for your continued efforts. 

I yield the balance of my time. 

Mr. PERRY. The Chair thanks the gentleman and the use of the 

terminology ‘‘squared-away,’’ which hits close to home to me, and 

now recognizes Mr. Estes of Kansas. 

Mr. ESTES. I guess my first question deals with, what is the time 

frame? I know we have talked a little bit about having to take a 

step back and say what are we doing, when are we doing it, how 

are we doing it, but, you know, what is the time frame to come up 

with a plan, particularly for DNDO and Coast Guard and TSA from 

a cost standpoint and what to do, when? 

Mr. FULGHUM. So we are finalizing our plan to transition from 

IBC’s data center to ours. Once we have that plan finalized, we will 

go out on the street for an integration contractor, which we expect 

to award by the end of October. By May, I believe we will have the 

system transitioned, we will have DNDO up and running by the 

first quarter of fiscal year 2019, and then we will have TSA up and 

running the first quarter of 2020. The expectation is the Coast 

Guard the first quarter of 2021. 

Mr. ESTES. OK. What is the expectations now for particularly fiscal year 2018, but maybe even future years we don’t know yet, but 

for costs in fiscal year 2018 in terms of doing this work? Is that 

already laid out in the budget, or did the change in direction 

cause—— 

Mr. FULGHUM. So we believe the money we have asked for in the 

President’s budget in fiscal year 2018 is sufficient to do what we 

need to do in fiscal year 2018. 

Mr. ESTES. OK. So we talked a little bit about lessons learned. 

Granted, there was a lot more complexity from a standpoint of 

moving into a shared services model and, you know, as you mentioned, having different groups or different individuals from different groups trying to work together, but some of those things 

were pretty basic, I mean, in terms of the right resources and 

tracking the schedule and communication. 

So what is our plan to do in the future, going back to the question that was raised earlier about the confidence level that this 

next effort is going to succeed completely? 

Mr. FULGHUM. So what I would say is I think we have learned 

lessons on the amount of testing we do, so we are going to do more 

testing than was done previously before Michele got there. In addition to that, the contract structure that her predecessors put in 

place were complex, the relationships were complex. We have a 

much more simplified approach. 

Then I go back to that joint program office, one voice, one office 

that is running the entire project. Those things combined with the 

fact that because of Michele’s hard work and her team’s hard work 

we have got a solution that we can use that will be the foundation 

for TSA and the Coast Guard. 

39 

Mr. ESTES. OK, thank you. 

I yield back. 

Mr. PERRY. I think that votes have been called or will be momentarily, just for Members. 

To all the panelists, thank you very much for coming. I suspect 

in this regard we won’t see Ms. Singer or Ms. Angerman again on 

this subject. 

However, Mr. Fulghum, I do expect to see you again and hopefully not on this subject. But if Mr. Khan and his investigations 

and requirements determines that we need to sit down again we 

will. 

We hope to think that we haven’t wasted upward of over $50 mil- lion on the first round and $124 million on the second. We appreciate that there are some deliverables that Ms. Singer has alluded 

to and, Mr. Fulghum, you have validated. But still, it is too much. 

It is our job, all of us as citizens, to make sure that our taxpayers 

are getting the most out of every dollar and every cent. So that is 

our duty as well as the mission, the other mission which is to complete these tasks. Right? 

So to that end, we are going to keep an eye on things and hopefully we will have better success in the future. Maybe you can come 

in here and tell us that that money was well-spent and since then 

we have got all the other agencies, including FEMA, involved and 

included in this and we have one model that we can pull reports 

from and be integrated. That would be what I think we would hope 

for. 

So we appreciate your time today. The Chair thanks the witnesses for their valuable testimony and the Members for their 

questions. 

Members may have some additional questions for the witnesses 

and we ask you, the witnesses, to respond to those in writing. Pursuant to committee rule VII(D), the hearing record will remain 

open for 10 days. 

Without objection, the subcommittee stands adjourned. 

[Whereupon, at 3:18 p.m., the subcommittee was adjourned.] 

(41) 

A P P E N D I X 

QUESTIONS FROM CHAIRMAN SCOTT PERRY FOR CHIP FULGHUM

Question 1. How will DHS improve its decision-making processes and communications with the new system integrator? What accountability mechanisms will exist 

with the upcoming procurement that did not exist with the Interagency Agreement 

with IBC? 

Answer. Per the lessons learned from the effort to move the United States Coast 

Guard (USCG), the Transportation Security Administration (TSA), and the Domestic Nuclear Detection Office (DNDO) to the Department of the Interior’s Interior 

Business Center (IBC), a Federal shared service provider, changes have been made 

to improve the DHS decision-making process. The implementation approach has 

changed from individual component projects to a single initiative, which will streamline decision making. The new joint Program Management Office (JPMO) now provides centralized program governance, which differs from our effort with IBC. 

To fully staff the JPMO, DHS headquarters has requested and obtained component detailees with deep knowledge of component business processes and strong program management skills. The organizational structure of the JPMO provides single 

points of contact to communicate directly with the new system integrator. This 

eliminates the need for the system integrator to communicate with both DHS HQ 

and the component during the implementation. 

DHS will have direct contract oversight and engagement with vendors’ contractors 

that support this effort. The JPMO is establishing contract requirements that will 

enable the JPMO to manage program cost, schedule, and performance. This will include reports submitted by the system integrator contractor that captures monthly 

performance metrics for the scope, cost, and schedule, which the FSM JPMO will 

use to analyze and monitor performance throughout the program. The JPMO will 

compare these reports against the planned statement of work, schedule, and cost to 

assess the progress towards achieving program objectives, and inform decision-making activities for this effort. 

DHS will utilize a contract management plan to set acceptable quality levels that 

will be used to measure the quality of deliverables based on established, well-defined acceptance criteria. The contract will include a set of incremental deliverables 

for the contractor that will provide evidence of program progress against the 

planned cost and schedule, and allow DHS the opportunity to identify issues early, 

and develop and implement corrective actions more timely. Delivery of these artifacts will be aligned with recurrent program gate reviews to assess overall program 

progress. 

Question 2. What role will IBC play in assisting the new system integrator? Does 

the Interagency Agreement require IBC to provide support for the TSA solution once 

it is transitioned to DHS? Will the new system integrator be able to collaborate with 

IBC after the transition? 

Answer. The transition will require support from DOI IBC resources for the virtual transition of the solution, and the stand-up, testing, and validation of such solution once relocated to the DHS data centers. DOI IBC will facilitate technical 

knowledge transfer, either through documentation or discussions with the new 

hosting and system deployment vendors. DOI IBC will support the transition of the 

operation and maintenance support, including help desk services, to the DHS vendors and personnel. Lastly, DOI IBC will develop, deliver, and execute a plan for 

the careful, safe retirement and decommissioning of DHS specific information and 

or systems at the conclusion of the transition phase. 

DOI IBC will not provide direct solution support after the system has been fully 

transitioned to the DHS data center. DHS has included options within the transition Interagency Agreement (IAA) that will allow DHS and its vendors the ability 

to consult with DOI IBC after the transition to DHS is completed. 

42 

Question 3. How will DHS ensure that mistakes made in previous failed modernization efforts with industry vendors will not be repeated? 

Answer. DHS has gathered lessons learned from past attempts at financial systems modernization and incorporated them into the new approach. 

For example, DHS will segment the implementation using incremental 

deliverables with well-defined acceptance criteria. To monitor and oversee contractor 

performance, DHS has included EVM reporting requirements within the new contracts. 

To manage and control scope, DHS will leverage existing automated tools to track 

and manage requirements from operational, functional, and technical requirements 

through testing, with full traceability. This will allow better tracking of both the 

global requirements that are shared across all components and improve the identification and documentation of component-specific requirements. DHS will incorporate the full scope of testing activities, including testing of data and operational 

testing. Automated tools and extensive testing were noted lessons learned with our 

partnership with IBC. 

The JPMO will lead the organizational change management effort so that the organization is prepared from inception through post-implementation support. DHS 

will standardize the approach to change management through the application of a 

structured process and set of tools, across components, to better support users 

through change. This standardized approach includes early establishment of stakeholder engagement forums such as peer support networks, targeted, more frequent 

communications, and a much-improved approach to training users. Training will be 

transitioned from the basic system training provided by IBC to role-based, business 

process-based training. DHS will also move away from the train-the-trainer approach for most components, and leverage instead professional training resources, 

deeply familiar with the system, provided through the new contract. Improving program-wide change management will enable smoother transitions, allow users to 

more quickly become proficient, and addresses best practices identified through the 

regular lessons learned exercises DHS performed during the IBC engagement. 

Question 4. Aside from TSA and Coast Guard, what are the Department’s plans, 

including time frames, for modernizing other component systems? What risks, if 

any, exist with modernizing these systems? What additional costs might the Department incur in modernizing these systems? 

Answer. DHS has begun the planning to establish a strategic sourcing vehicle to 

meet the financial management system software needs for all DHS components. 

FEMA, ICE, and their customers plan to leverage the DHS strategic sourcing vehicle. 

The ICE and FEMA legacy systems are near end-of-life. The DHS components will 

continue to incur costs to maintain the legacy systems until they are modernized. 

The modernization risks are similar to those documented for the TSA and USCG. 

Risks include availability of funds, contract management, organization change management, data conversion, interfaces, and other technical risks. The delay for FEMA 

will also have cascading negative effects on other FEMA critical modernization efforts (Grants Management Modernization and NFIP’s insurance system modernization, known as Pivot). The delayed FSM will require a connection to FEMA’s legacy 

system now, and then a connection to the modernized system, which will require 

additional investment and effort. 

The JPMO will begin updating the cost estimates for FEMA, ICE, and the ICE 

customers in Q1 fiscal year 2018. After the LCCEs are completed, we welcome an 

opportunity to provide an update to the committee. 

QUESTIONS FROM CHAIRMAN SCOTT PERRY FOR ELIZABETH ANGERMAN

Question 1. What role will USSM have assisting DHS as it transitions to away 

from IBC and takes control of the TRIO solution? 

Answer. USSM’s role is to advise agencies on lessons learned as they implement 

shared services. The USSM Modernization and Migration Management (M3) Playbook is a valuable compilation of best practices and lessons learned from Government and industry for system modernizations in a shared environment. USSM will 

also continue to work with the Chief Financial Officer community to design common 

requirements for integrated solutions for mission support functions. As DHS defines 

its vision for the end-state solution, these integrated standards will be the foundation for moving forward. However, it remains the responsibility of the agencies to 

determine the best path forward for their modernizations. 

USSM recommends that DHS leverage the M3 Playbook as it consolidates internally. USSM will continue to be available to support DHS as an independent and 

objective resource, as needed and appropriate. 

43 

Question 2. What are the biggest risks DHS must identify, monitor, and mitigate 

to achieve financial systems modernization for the Transportation Security Administration (TSA) and the United States Coast Guard (USCG)? 

Answer. Change Management.—The most difficult part of these projects is re-engineering business processes to align to the solution and then helping the users to 

buy into and adopt the change. Focusing on training, clarifying roles and responsibilities, establishing service-level agreements, and defining overall success for the 

program by providing the proper attention, time, and resources is critical. 

• Business Process Re-engineering needs to be the preferred method of resolving 

any identified gaps over modification/customization of the software. Governance 

structures need to support the idea of ‘‘one decision maker’’ for the consolidated 

solution. 

• Sufficient communication with the stakeholder community is required to prepare them for the change and make sure they understand the value proposition. 

• Leveraging the M3 Playbook to create a business and technical end-state (with 

metrics to measure success) for the financial management function at DHS 

would help to create a shared vision for success. 

Program Management.—DHS should adopt project management best practices 

such as developing a resource-loaded schedule which is used to track actual costs 

of various program activities. 

• The value of an integrated, resource-loaded project schedule and strong schedule management discipline cannot be underestimated. 

• Define roles and responsibilities of the headquarters and component organizations, and assign one responsible official for decision making. 

• Define risks, mitigation strategies, and management practices critical to ensuring success. 

Governance.—A single accountable entity is critical as consensus management is 

not an effective way to make decisions and govern a large Department-wide program. An expedited and integrated decision-making process that addresses issues 

and mitigates risks is critical and must include senior officials in the agencies. 

• There is great value in having an integrated, co-located program management 

team to lead the work activities and identify and resolve gaps, conflicts, and priorities on a daily basis. 

• A single accountable entity is critical to resolve disputes and make decisions. 

Scope.—Project planning in the early stages is key. DHS needs to clearly define 

and articulate the vision for the end-state solution to include the strategy and a 

roadmap to achieve the vision. Stakeholders at all levels should be bought into the 

vision. 

• Importance of early stages of project planning—need to clearly define and articulate the vision for the financial management end-state, to include the strategy and a roadmap to achieve the vision. 

• All stakeholders need to understand the end-state to ensure scope creep does 

not imperil the timely completion of the work within the defined budget. 

Æ