Testimony 

Before the Subcommittee on Management, 

Integration, and Oversight, Committee on 

Homeland Security, House of 

Representatives

United States Government Accountability Office

GAO

For Release on Delivery 

Expected at 3:00 p.m. EST 

Wednesday, June 29, 2005 STRATEGIC BUDGETING

Risk Management 

Principles Can Help DHS 

Allocate Resources To 

Highest Priorities 

Statement of David M. Walker 

Comptroller General of the United States 

GAO-05-824T 
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

www.gao.gov/cgi-bin/getrpt?GAO-05-824T.

To view the full product, including the scope 

and methodology, click on the link above. 

For more information, contact Norman Rabkin 

at (202) 512-8777 or rabkinn@gao.gov. 

Highlights of GAO-05-824T, a testimony 

before the Subcommittee on 

Management, Integration, and Oversight, 

House Committee on Homeland Security 

June 29, 2005

STRATEGIC BUDGETING 

Risk Management Principles Can Help 

DHS Allocate Resources to Highest 

Priorities 

The nation faces a long-term fiscal imbalance, and the role of the federal 

government is being reshaped by many forces, such as evolving defense and 

homeland security policies and new organizational and institutional 

arrangements for carrying out public activities. Given these circumstances, 

there is a critical need for the federal government to reexamine the base of 

its programs, policies, functions, and activities. A periodic reexamination of 

major federal spending and tax policies offers the prospect for the American 

government to eliminate outmoded operations and better align its operations 

with the demands of a changing world. The management and performance 

reforms enacted by Congress in the past 15 years have provided new tools to 

support this kind of reexamination. However, these new tools must be 

implemented by agencies and used by the Congress in its decision making in 

order to be effective. 

Performance budgeting can help policymakers address important questions 

about whether and how programs contribute to their stated goals. It can help 

enhance the government’s capacity to assess competing claims for federal 

dollars by arming decision makers with better information on the results of 

individual programs, as well as on various federal policies and programs 

addressing common goals. Performance budgeting, however, cannot provide 

answers to every resource question—particularly where allocation is a 

function of competing values and interests that depend on factors other than 

program performance. 

Congress and the President have agreed on DHS’s mission, and DHS has 

established strategic objectives for achieving its mission. However, DHS’s 

strategic plan does not detail the associated resources necessary to carry out 

its mission and achieve its strategic goals. DHS has called for using riskbased approaches to prioritize its resource investments regarding critical 

infrastructure, and for developing plans and allocating resources in a way 

that balance security and freedom. It must carefully weigh the benefit of 

homeland security endeavors and allocate resources where the benefit of 

reducing risk is worth the additional cost. A comprehensive risk 

management framework—which includes an assessment of risk through 

threat, vulnerability, and criticality assessments—should be applied to guide 

these decisions. DHS has not completed a comprehensive national threat 

and risk assessment. However, some components of DHS have taken initial 

steps to apply elements of risk management to its operations and decision 

making. For example, the Coast Guard has taken actions to assess and 

mitigate vulnerabilities in order to enhance maritime security, and the 

Transportation Security Administration has conducted vulnerability 

assessments at selected general aviation airports. Congress and agencies 

have a shared responsibility for ensuring that performance budgeting and 

risk management approaches are both useful and used. 

Previous GAO work has outlined 

the nation’s growing fiscal 

imbalance and called for a 

fundamental reexamination of the 

base of the federal government. 

The significant resources directed 

to the Department of Homeland 

Security (DHS) indicate that a 

robust homeland security program 

is viewed as critical to the 

protection and prosperity of 

Americans. This testimony 

addresses the need for a 

fundamental reexamination of the 

base of government, the role that 

performance budgeting tools can 

play in helping inform agency 

activities, and DHS’s use of 

performance budgeting and risk 

management concepts. It also 

includes examples from GAO work 

on homeland security issues that 

highlight DHS attempts to define an 

acceptable and achievable level of 

risk. 
Page 1 GAO-05-824T 

Mr. Chairman and Members of the Subcommittee: 

I am pleased to be here today to discuss how the Department of Homeland 

Security (DHS) can use performance budgeting and risk management 

principles to maximize program performance in an environment of 

increasing fiscal constraints. 1

Today I will touch on the need for a fundamental reexamination of the 

base of government, given our current, imprudent, and unsustainable 

fiscal path. Then I will turn to and discuss the important role that 

performance budgeting and risk management principles can play in setting 

priorities for the department’s homeland security activities. Finally, I will 

draw upon our work in DHS on homeland security issues to highlight 

examples of where the department has attempted to define an acceptable 

and achievable level of risk. 

The significant resources directed to homeland security and to DHS in 

particular indicate that a robust homeland security program is viewed as 

critical to the nation’s protection and prosperity. It is clear that before the 

events of September 11, 2001, it was difficult to anticipate the array of new 

and challenging demands on federal programs, and to envision the claims 

on future budgets for homeland security concerns. Given current trends 

and challenges facing the nation—including the long-term fiscal 

imbalance--it is critical that the federal government reexamine the base of 

federal spending and tax programs, at the same time holding all programs 

accountable for spending wisely and achieving real results. 

By using performance budgeting tools and the priorities outlined in the 

National Strategy for Homeland Security, the department will be in a 

better position to respond to changing circumstances. The Government 

Performance and Results Act of 1993 (GPRA)2

 and various assessment 

efforts, such as the Administration’s Program Assessment Rating Tool 

(PART), can provide a foundation for a baseline review of existing 

policies, programs, functions, and activities in the department. In addition, 

they have the potential to help decision makers assess competing claims 

 1

In this testimony, the term performance budgeting refers to any linkage between 

budgeting and expected or actual evidence-based performance and results-based 

information. 

2

Pub. L. No. 103-62, 107 Stat. 285 (1993). 
Page 2 GAO-05-824T 

by providing better information on the results of individual programs, and 

on policies and programs designed to address common goals. 

Just as we know that the threat of terrorism will persist well into the 21st 

century, we also know it is unrealistic to expect future funding increases 

for homeland security efforts to occur at the same rate as in the recent 

past. Given the reality that no amount of money can make us completely 

safe from a terrorist attack, the National Strategy for Homeland Security 

provides guidance for considering how to make the best use of available 

funds to mitigate the most serious risks, while also assuring that the 

reduction in risk is worth the amount of additional cost. Since we cannot 

afford to protect everything against all threats, GAO has advocated that 

DHS make clear the link between the choices made about protection 

priorities and the allocation of available resources. Proposals to reduce 

risk must be evaluated on numerous dimensions – their dollar cost and 

their impact on other goals and values. Decisions on the level of resources, 

the allocation of those resources, and how to balance security against 

other societal goals and values also need to be considered. 

Our recent work at DHS suggests that developing and using a risk-based 

approach for making resource investment decisions will not be easy. 

Decision makers may not have complete or current information on threats, 

vulnerabilities, consequences, alternatives, and costs. Nevertheless, we see 

benefits in continuing to develop the approach, and are prepared to work 

with the department and others in the Administration to make it happen. 

This testimony is based on our wide-ranging work on GPRA, federal 

budget and performance integration, and 21st century challenges; as well 

as our work on homeland security and risk management. We conducted 

our work in accordance with generally accepted government auditing 

standards. 

Known demographic trends, rising health care costs, and lower federal 

revenues as a percentage of the economy are the major drivers of the 

nation’s large and growing structural deficits. The nation cannot ignore 

this fiscal large and growing fiscal imbalance—it is not a matter of 

whether the nation deals with the fiscal gap, but how and when. GAO’s 

long-term budget simulations illustrate the magnitude of this fiscal 

challenge. Figures 1 and 2 show these simulations under two different sets 

of assumptions. Figure 1 uses the Congressional Budget Office’s (CBO) 

January 2005 baseline through 2015. As required by law, that baseline 

assumes no changes in current law, that discretionary spending grows 

The Long-Term Fiscal 

Challenge Drives the 

Fiscal Future and the 

Need for 

Reexamination 
Page 3 GAO-05-824T 

with inflation through 2015, and that all tax cuts currently scheduled to 

expire actually do expire. In Figure 2, two assumptions about that first 10 

years are changed: (1) discretionary spending grows with the economy 

rather than with inflation, and (2) all tax cuts currently scheduled to 

expire are made permanent. In both simulations discretionary spending is 

assumed to grow with the economy after 2015 and revenue is held 

constant as a share of gross domestic product (GDP) at the 2015 level. 

Also in both simulations, long-term Social Security and Medicare spending 

are based on the 2005 trustees’ intermediate projections, and we assume 

that benefits continue to be paid in full after the trust funds are exhausted. 

Long-term Medicaid spending is based on CBO’s December 2003 long-term 

projections under their midrange assumptions. 

Figure 1 

1

Composition of Spending as a Share of GDP

Under Baseline Extended

0

10

20

30

40

50

2004 2015 2030 2040

Fiscal year

Percent of GDP

Net interest Social Security Medicare & Medicaid All other spending

Revenue

Notes: In addition to the expiration of tax cuts, revenue as a share of GDP increases through 2015 due to (1) real bracket creep, (2) more 

taxpayers becoming subject to the AMT, and (3) increased revenue from tax-deferred retirement accounts. After 2015, revenue as a share 

of GDP is held constant. 

Source: GAO’s March 2005 analysis.
Page 4 GAO-05-824T 

Figure 2 

2

0

10

20

30

40

50

2004 2015 2030 2040

Fiscal year

Percent of GDP

Net interest Social Security Medicare & Medicaid All other spending

Composition of Spending as a Share of GDP

Assuming Discretionary Spending Grows with GDP After 

2005 and All Expiring Tax Provisions are Extended

Revenue

Notes: Although expiring tax provisions are extended, revenue as a share of GDP increases through 2015 due to (1) real bracket

creep, (2) more taxpayers becoming subject to the AMT, and (3) increased revenue from tax-deferred retirement accounts. After 

2015, revenue as a share of GDP is held constant. 

Source: GAO’s March 2005 analysis.

As these simulations illustrate, absent policy changes on the spending 

and/or revenue side of the budget, the growth in spending on federal 

retirement and health entitlements will encumber an escalating share of 

the government’s resources. Indeed, when we assume that recent tax 

reductions are made permanent and discretionary spending keeps pace 

with the economy, our long-term simulations suggest that by 2040 federal 

revenues may be adequate to pay little more than interest on the federal 

debt. Neither slowing the growth in discretionary spending nor allowing 

the tax provisions to expire—nor both together—would eliminate the 

imbalance. Although federal tax policies will likely be part of any debate 

about our fiscal future, making no changes to Social Security, Medicare, 

Medicaid, and other drivers of the long-term fiscal gap would require at 

least a doubling of federal taxes in the future—and that seems both 

unrealistic and inappropriate. 

Demographic shifts and rising health care costs are not the only forces at 

work that require the federal government to rethink its entire approach to 

program performance, policy design, public priorities, and management 

practices. Other important forces are working to reshape American 
Page 5 GAO-05-824T 

society, our place in the world, and the role of the federal government. 

These include evolving defense and homeland security policies, increasing 

global interdependence, and advances in science and technology. In 

addition, the federal government increasingly relies on new networks and 

partnerships to develop public policy and achieve positive results, often 

including multiple federal agencies, domestic and international non- or 

quasi-government organizations, for-profit and not-for-profit contractors, 

and state and local governments. 

If government is effectively to address these trends, it cannot treat all of its 

existing programs, policies, and activities as givens. Outmoded 

commitments and operations constitute an encumbrance on the future 

that can and does erode the capacity of the nation to better align its 

government with the needs and demands of a changing world and society. 

Accordingly, reexamining the base of all major existing federal spending 

and tax programs, policies, and activities by reviewing their results and 

testing their continued relevance and relative priority for our changing 

society is an important step in the process of assuring fiscal responsibility 

and facilitating national renewal.3

A periodic reexamination offers the prospect of addressing emerging 

needs by weeding out programs and policies that are redundant, outdated, 

or ineffective. Those programs and policies that remain relevant could be 

updated and modernized by improving their targeting and efficiency 

through such actions as redesigning allocation and cost-sharing 

provisions, consolidating facilities and programs, and streamlining and 

reengineering operations and processes. The tax policies and programs 

financing the federal budget can also be reviewed with an eye toward both 

the overall level of revenues that should be raised as well as the mix of 

taxes that are used. 

Reexamining the base offers compelling opportunities to both redress our 

current and projected fiscal imbalance while better positioning 

government to meet the new challenges and opportunities of the 21st 

century. In this regard, the management and performance reforms enacted 

by Congress in the past 15 years have provided new tools to gain insight 

into the financial, program, and management performance of federal 

 3

For more information on reexamination of federal programs, see GAO, 21st Century 

Challenges: Reexamining the Base of the Federal Government, GAO-05-325SP

(Washington, D.C.: February 2005). 
Page 6 GAO-05-824T 

agencies and activities. The information being produced as a result can 

provide a strong basis to support the much needed and long overdue 

review, reassessment, and reprioritization process. 

With GPRA as their centerpiece, these reforms also laid the foundation for 

performance budgeting by establishing infrastructures in the agencies to 

improve the supply of information on planning, performance and costs. 

GPRA is designed to inform congressional and executive decision making 

by providing objective performance and cost information on the 

effectiveness and efficiency of federal programs and spending. A key 

purpose of GPRA is to create closer and clearer links between the process 

of allocating scarce resources and the expected results to be achieved 

with those resources.4

 Importantly, GPRA requires both a connection to 

the structures used in congressional budget presentations and 

consultation between the executive and legislative branches on agency 

strategic plans.5

 Because these requirements are grounded in statute, 

Congress has an oversight stake in GPRA’s success. Over a decade after its 

enactment, GPRA has succeeded in expanding the supply of performance 

information and institutionalizing a culture of performance as well as 

providing a solid foundation for more recent budget and performance 

initiatives.6

Building on GPRA, the current administration has made the integration of 

performance and budget information one of five top governmentwide 

management priorities. Under the President’s Management Agenda (PMA), 

agencies are expected to implement integrated financial and performance 

management systems that routinely produce information that is (1) 

timely—to measure and affect performance, (2) useful—to make more 

informed operational and investing decisions, and (3) reliable—to ensure 

consistent and comparable trend analysis over time and to facilitate better 

performance measurement and decision making. It is critical that 

budgetary investments in this area be viewed as part of a broader initiative 

to improve the accountability and management capacity of federal 

 4

See Pub. L. No. 103-62, Sec. 2, 107 Stat. at 285 (1993). 

5

5 U.S.C. Sec. 306 and 31 U.S.C. Secs. 1115-1116. 

6

GAO, Results-Oriented Government: GPRA Has Established a Solid Foundation for 

Achieving Greater Results, GAO-04-38 (Washington, D.C.: March 10, 2004). 

Performance 

Budgeting Holds 

Promise for 

Reassessment and 

Priority Setting 
Page 7 GAO-05-824T 

agencies and programs. Over the longer term, failing to discover and 

correct performance problems will be much more costly. 

The Program Assessment and Rating Tool (PART) is a questionnaire that 

is designed to provide a systematic approach to assessing the strengths 

and weaknesses of a program. PART asks, for example, whether a 

program’s long-term goals are specific, ambitious, and focused on 

outcomes, and whether annual goals demonstrate progress toward 

achieving the long-term goals. It is intended to be evidence-based, drawing 

on a wide array of information, including authorizing legislation, GPRA 

strategic plans and performance plans and reports, financial statements, 

inspector general and GAO reports, and independent program 

evaluations.7

 Importantly, PART can be used to identify gaps in 

information. The fact that a program’s PART score suffers from the 

absence of information provides added impetus for agencies to enhance 

their evaluation and information-gathering capabilities.8

PART’s program-by-program approach fits with OMB’s agency-by-agency 

budget reviews, but it is not well suited to addressing crosscutting issues 

or to looking at broad program areas in which several programs address a 

common goal. It is often critical to understand how each program fits with 

a broader portfolio of tools and strategies—such as regulations, direct 

loans, and tax expenditures—to accomplish federal missions and 

performance goals. 

The credibility of performance information, including related cost data, 

and the ability of federal agencies to produce credible evaluations of their 

programs’ effectiveness are key to the success of performance budgeting. 

As I have testified before, this type of information is critical for effective 

 7

The Office of Management and Budget (OMB) has used PART to assess the performance 

of 32 programs in DHS reported in the President’s budgets for fiscal years 2004-2006. The 

assessment consisted of programs operated by the Coast Guard, Transportation and 

Security Administration, Immigration and Customs Enforcement, Customs and Border 

Protection, Office for Domestic Preparedness, Science and Technology, and the Federal 

Emergency Management Agency, among others. On the basis of answers to 25 questions 

relating to a program’s purpose, planning, management, results and accountability, OMB 

concluded performance was effective for 4 programs, moderately effective for 6 programs, 

and adequate for 6 programs. OMB found that results were not demonstrated for the 

remaining 16 programs. 

8

For a detailed examination of PART, see GAO, Performance Budgeting: Observations on 

the Use of OMB’s Program Assessment Rating Tool for the Fiscal Year 2004 Budget, 

GAO-04-174 (Washington, D.C.: January 30, 2004). 
Page 8 GAO-05-824T 

performance measurement to support decisions in areas ranging from 

program efficiency and effectiveness to sourcing and contract 

management. 9 To be effective, this information must be not only timely 

and reliable, but also both useful and used. 

Federal performance and accountability reforms have given much 

attention to increasing the supply of performance information over the 

past several decades. However, improving the supply of performance 

information is in and of itself insufficient to achieve and sustain resultsbased performance budgeting and management approaches. Rather, it 

needs to be accompanied by a demand for and use of that information by 

congressional decision makers and executive managers alike. The history 

of performance budgeting suggests that congressional support and use of 

this information is critical to sustain reforms over time. Congress has a 

number of opportunities to provide its perspective on performance issues 

and performance goals, such as when it establishes or reauthorizes a new 

program, during the annual appropriations process, and in its oversight of 

federal policies and programs. 

Performance budgeting can do a great deal to help policy makers address 

important questions, such as whether programs are contributing to their 

stated goals, are well-coordinated with related initiatives at the federal 

level or elsewhere, and are targeted to the intended beneficiaries. 

However, it should not be expected to provide the answers to all resource 

allocation questions in some automatic or formula-driven process. 

Performance problems may well prompt budget cuts, program 

consolidations, or eliminations. Alternatively, as in the case of homeland 

security, programs that existed before September 11 may now be deemed 

to be of sufficiently high priority to the nation that they inspire enhanced 

investments and reforms in program design and management. Conversely, 

even a program that is found to be exceeding its performance expectations 

can be a candidate for budgetary cuts if it is a lower priority than other 

competing claims in the process. The determination of priorities is a 

function of competing values and interests that may be informed by 

performance information but also reflects other factors, such as the 

overall budget situation, the state of the economy, security needs, equity 

considerations, unmet societal needs, and the appropriate role of the 

federal government in addressing any such needs. 

 9

GAO, Management Reform: Assessing the President’s Management Agenda, GAO-05-574T

(Washington, D.C.: April 21, 2005). 
Page 9 GAO-05-824T 

As reflected in the Homeland Security Act of 200210 (enacted in November 

2002) and the National Strategy for Homeland Security (issued in July 

2002), both Congress and the President have agreed that DHS should be 

focused on preventing terrorist attacks, reducing the country’s 

vulnerability to terrorism, and minimizing the damage and recovering from 

any attacks that may occur. The President’s national strategy also notes 

that the United States “must carefully weigh the benefit of each homeland 

security endeavor and only allocate resources where the benefit of 

reducing risk is worth the amount of additional cost.” It recognizes that 

the need for homeland security is not tied solely to the current terrorist 

threat but to enduring vulnerability from a range of potential threats that 

could include weapons of mass destruction and bioterrorism. 

Using the national strategy and the act as foundations, the department 

issued its first departmentwide strategic plan in February 2004. The 

strategic plan sets out the following strategic objectives for achieving 

DHS’s mission: 

• Awareness—Identify and understand threats, assess vulnerabilities, 

determine potential impacts, and disseminate timely information to our 

homeland security partners and the American public. 

• Prevention—Detect, deter, and mitigate threats to our homeland. 

• Protection—Safeguard our people and their freedoms, and critical 

infrastructure, property and the economy of our nation from acts of 

terrorism, natural disasters, or other emergencies. 

• Response—Lead, manage, and coordinate the national response to acts 

of terrorism, natural disasters, or other emergencies. 

• Recovery—Lead national, state, local, and private sector efforts to 

restore services and rebuild communities after acts of terrorism, 

natural disasters, or other emergencies. 

• Service—Serve the public effectively by facilitating lawful trade, travel 

and immigration. 

• Organizational excellence—Value our most important resource, our 

people. Create a culture that promotes a common identity, innovation, 

 10Pub. L. No. 107-296, 116 Stat. 2135 (2002). 

Planning and Risk 

Management Key to 

Overall Approach for 

Allocating Homeland 

Security Resources 
Page 10 GAO-05-824T 

mutual respect, accountability and teamwork to achieve efficiencies, 

effectiveness, and operational synergies. 

In a report earlier this year to the House Government Reform 

Subcommittee on National Security, Emerging Threats and International 

Relations, we pointed out that while DHS has made considerable progress 

in its planning efforts, its strategic plan did not address the relationship 

between annual and long-term goals.11 This linkage is critical for 

determining whether DHS has a clear sense of how it will assess progress 

toward achieving the intended results for its long-term goals. In addition, 

the plan does not include specific budgetary, human capital, or other 

resources needed to achieve the long-term goals. 

Although the strategic plan did not detail the resources DHS believes it 

needs to carry out its mission and achieve its strategic goals, DHS has 

presented some of this information as part of its annual budget materials. 

Congress has required OMB to present a crosscutting perspective on 

homeland security spending as part of the President’s Budget. The 

discussion of homeland security spending by strategic goal across all 

federal agencies is an example of the impact that congressional oversight 

can have on budget presentations and analysis. As we have previously 

noted, the structure of appropriations accounts and congressional 

justifications also reflects choices about how resource allocation choices 

are framed and the types of controls and incentives considered most 

important. Given Congress’s role in setting national priorities and 

allocating resources to achieve them, Congressional comfort with the 

structure of and analyses in budget justifications is critical. The 

department should work with its congressional committees to assure that 

the information it provides is useful to Congress in achieving its legislative, 

oversight, appropriations, and control objectives. 

The national strategy and DHS’s strategic plan called for the use of riskbased decisions to prioritize DHS’s resource investments regarding 

homeland security related programs. In addition, Homeland Security 

Presidential Directive/HSPD-7, issued in December 2003, charged DHS 

with integrating the use of risk management into homeland security 

 11GAO, Results-Oriented Government: Improvements to DHS’ Planning Process Would 

Enhance Usefulness and Accountability, GAO-05-300 (Washington, D.C.: March 31, 2005). 

Risk Management 
Page 11 GAO-05-824T 

activities related to the protection of critical infrastructure. The directive 

called on the department to develop policies, guidelines, criteria, and 

metrics for this effort. The new DHS Secretary testified on June 9, 2005, to 

the need for managing risk at the homeland security level by developing 

plans and allocating resources in a way that balance security and freedom. 

He noted the importance of assessing the full spectrum of threats and 

vulnerabilities, conducting risk management, and setting realistic priorities 

in guiding decisions about how to best organize to prevent, respond to, 

and recover from an attack. 

Armed with better planning and performance information, the department 

needs to develop a more formal and disciplined approach to risk 

management. Answering questions such as “What is an acceptable level of 

risk to guide homeland security strategies and investments?” and “What 

criteria should be used to target federal funding for homeland security to 

maximize results and mitigate risk within available resource levels?” will 

not be easy. Yet these kinds of questions may also provide a window of 

opportunity to rethink approaches to long-standing problems and 

concerns. 

A risk management framework for making homeland security and 

counterterrorism investment decisions consists of a number of 

components. Assessing risk is a critical component of a risk management 

approach, and it should be reflective of current and future likely threats, 

which should be informed but not driven by past actions. Assessing risk 

involves three key elements—threats, vulnerabilities, and criticality (or 

consequences)—that provide input into the decision-making process. A 

threat assessment identifies and evaluates potential threats on the basis of 

factors such as capabilities, intentions, and past activities. Threats might 

be present at the global, national, or local level, and their sources include 

terrorists and criminal enterprises. Threat information emanates from 

“open” sources and intelligence (both strategic and tactical). However, we 

will never know if we have identified every threat or event and may not 

have complete information about the threats we have identified. 

Consequently, two other elements of the approach, vulnerability and 

criticality assessments, are essential to better prepare against threats. A 

vulnerability assessment identifies weaknesses that may be exploited by 

identified threats and suggests options to address those weaknesses. A 

criticality assessment evaluates and prioritizes assets and functions in 

terms of specific criteria, such as their importance to public safety and the 

economy, as a basis for identifying which structures or processes are 

relatively more important to protect from attack. Information from these 
Page 12 GAO-05-824T 

three assessments can lead to a risk characterization, such as high, 

medium, or low, and provides input for prioritizing security initiatives.12

For example, an airport that is determined to be a critical asset, vulnerable 

to attack, and a likely target would be at high risk and, therefore, would be 

a higher priority for funding than an airport that is less vulnerable to an 

attack. In this vein, aviation security measures shown to reduce the risk to 

the most critical assets would provide the greatest protection for the cost. 

Figure 3 depicts a risk management cycle representing a series of 

analytical and managerial steps, basically sequential, that can be used to 

assess risk, assess alternatives for reducing risks, choose among those 

alternatives, implement the alternatives, monitor their implementation, 

and continually use new information to adjust and revise the assessments 

and actions, as needed. Adoption of a risk management framework such as 

this can aid in assessing risk by determining which vulnerabilities should 

be addressed in what ways within available resources. 13

 12GAO, Transportation Security: Systematic Planning Needed to Optimize Resources, 

GAO-05-357T (Washington, D.C.: February 15, 2005). 

13GAO, Protection of Chemical and Water Infrastructure: Federal Requirements, Actions 

of Sected Facilities, and Remaining Challenges, GAO-05-327 (Washington, D.C.: March 28, 

2005). 
Page 13 GAO-05-824T 

Figure 3: Risk Management Framework 

In addition to being dynamic, the approach may be applied at various 

organizational levels, from multiagency or sectoral down to individual 

investments or projects. Some adaptation of the framework may be 

expected—for instance, risk management choices available to site 

managers may entail departmental or statutory constraints. 

In our latest high-risk series, released in January 2005, we noted that an 

area of increasing concern involves the need for the completion of 

comprehensive national threat and risk assessments in a variety of areas, 

including homeland security. 14 As GAO reported in its review of DHS’s first 

strategic plan, stakeholder involvement was limited. Stakeholder 

involvement in the planning process is important to ensure that DHS’s 

efforts and resources are aligned with other federal and nonfederal 

partners with shared responsibilities for homeland security and that they 

are targeted at the highest priorities. At the same time, this threat/risk 

assessment concept can be applied to a broad range of existing federal 

government programs, functions, and activities. 

A viable risk management approach would also affect outcomes beyond 

the federal sector. The choice and design of policy tools, such as grants, 

regulations, and tax incentives, can enhance the capacity of all levels of 

government to target areas of highest risk and greatest need, promote 

 14GAO, High-Risk Series: An Update, GAO-05-207 (Washington, D.C.: January 2005). 
Page 14 GAO-05-824T 

shared responsibilities by all parties, and track and assess progress toward 

achieving national preparedness goals. For example, in order to promote a 

stronger federal, state, local, and regional partnership to improve 

homeland security, Congress needs to determine how to concentrate 

federal grant funds in the places with the highest risks. Given the 

significant needs and limited federal resources, it will be important to 

target areas of greatest need. Congressional proposals to alter the formula 

for allocating homeland security funds to states reflect attention to this 

issue. We have noted that the formula for federal grant distribution should 

be based on several considerations, including relative threats and 

vulnerabilities faced by states and communities as well as the state or 

local government’s capacity to respond to a disaster.15

Several DHS component agencies have taken some initial steps toward 

risk management. For example, agencies such as the Coast Guard and 

Customs and Border Protection (CBP) have taken actions to try to 

mitigate vulnerabilities and enhance maritime security. Security plans for 

seaports, facilities, and vessels have been developed based on assessments 

that identify their vulnerabilities. In addition, the Coast Guard is using a 

Port Security Risk Assessment Tool, which is designed to prioritize risk 

according to a combination of possible threat, consequence, and 

vulnerability. Under this approach, seaport infrastructure that is 

determined to be both a critical asset and a likely and vulnerable target 

would be a high priority for security enhancements or funding. By 

comparison, infrastructure that is vulnerable to attack but not as critical or 

infrastructure that is very critical but already well protected would be 

lower in priority. We are currently conducting a detailed review of the use 

of risk management for maritime security. 

In the transportation area, the Transportation Security Administration 

(TSA) has conducted limited vulnerability assessments at selected general 

aviation airports based on specific security concerns or requests by airport 

officials. Agency officials told us that conducting assessments was costly 

and, therefore, impractical to do for the 19,000 general aviation airports 

nationwide, or even the approximately 4,800 public-use general aviation 

airports. TSA intended to implement a risk management approach to 

better assess threats and vulnerabilities of general aviation aircraft and 

 15GAO, Homeland Security: Reforming Federal Grants to Better Meet Outstanding Needs, 

GAO-03-1146T (Washington, D.C.: September 3, 2003). 

Some Elements of 

Risk Management 

Being Used at DHS 
Page 15 GAO-05-824T 

airports and, as part of this approach, was developing an online 

vulnerability self-assessment tool to be completed by individual airport 

managers. However, we noted limitations to the use of the self-assessment 

tool, and TSA had not developed a plan with specific milestones to 

implement the assessment, thereby making it difficult to monitor the 

progress of its efforts. Also, TSA had not conducted an overall systematic 

assessment of threats to, or vulnerabilities of, general aviation to 

determine how to better prepare against terrorist threats. 

Immigration and Customs Enforcement’s Office of Investigations (OI) has 

taken some initial steps to base future budget requests on threat 

assessments. To develop its budget request and workforce plans for fiscal 

year 2007 and beyond, OI field offices conducted baseline threat 

assessments on a regional basis using scenarios such as the presence of a 

business that transports biological materials and may employ terrorists. 

Related performance measures have been developed, but are not yet in 

use. 

CBP had taken some steps to address the risks posed by terrorist 

smuggling of weapons in oceangoing cargo containers. Although CBP’s 

strategy incorporated some elements of risk management, we reported 

that CBP had not performed a comprehensive set of threat, criticality, 

vulnerability, and risk assessments that experts said are vital for 

determining levels of risk for each container.16

With respect to the allocation of homeland security funds to states, 

approximately 40 percent of the $5.1 billion in statewide grant funds 

awarded in fiscal years 2002 through 2005 were shared equally among the 

50 states, the District of Columbia, the Commonwealth of Puerto Rico, and 

U.S. territories. The remaining amount was distributed according to state 

population. Therefore, this formula for allocating money is not risk-based. 

Several congressional proposals have been advanced to alter the statewide 

funding formula to base it more directly on risk considerations. This seems 

to be both appropriate and necessary given current and projected deficits. 

One proposal would largely maintain the portion of funds shared equally 

by the states but would base the distribution of the remaining funds on a 

risk-based formula similar to the one currently used for urban area grants. 

Another proposal (from this committee) would reduce the minimum 

 16GAO, Homeland Security: Summary of Challenges Faced in Targeting Ocean Going 

Cargo Containers for Inspection, GAO-04-557T (Washington, D.C.: March 31, 2004) 
Page 16 GAO-05-824T 

amount of funding shared equally by states to approximately 14 percent of 

total funding and establish a board to allocate the remaining funds through 

an evaluation of threat, vulnerability, and the potential consequences of a 

terrorist attack. 

As the nation faces a long-term fiscal imbalance, and the role of the federal 

government is being reshaped, there is a critical need for the federal 

government to reexamine the base of its programs, policies, functions, and 

activities. Performance budgeting can help enhance the government’s 

capacity to assess competing claims for federal dollars by providing 

decision makers with better information on the results of individual 

programs, as well as on various federal policies and programs addressing 

common goals. 

In this context, the importance of DHS’ mission cannot be overstated. 

While absolute security for the U.S. homeland is impossible, seeking to 

minimize vulnerability must remain a goal. Much is at stake when 

decisions are made about how to allocate limited resources across a large 

number of programs in multiple DHS agencies. GAO has consistently 

advocated implementation of a risk management approach for prioritizing 

efforts and focusing resources. This kind of approach is especially 

important since we seek to address threats that are seemingly limitless 

with resources that are limited. It is necessary to prioritize both risks and 

the actions taken to reduce risks. Where can resources do the most good? 

How should they be allocated across risks and across risk-reducing 

activities? Risk-based, priority-driven decisions can help inform decision 

makers in allocating finite resources to the areas of greatest need. 

Congress and agencies have a shared responsibility for ensuring that 

performance budgeting and risk management approaches are both useful 

and used. Congress can play an important role by using the resulting 

information in the authorization, appropriations, and oversight process. 

Further, to the extent that Congress wants to instill a risk-based approach, 

it is important to recognize that agencies need to have some flexibility in 

implementing it. 

As the Congress and DHS move to rebalance resource priorities to address 

the relative risks facing the nation, it is important to reexamine major 

existing programs and activities based on their relative contribution to 

reducing the areas of greatest vulnerability. This will require making tough 

choices to identify those activities with the greatest potential net benefit 

for the nation as a whole, while reassessing the need for other programs 

with more limited or less nationwide scale and importance. Going 

Concluding 

observations 
Page 17 GAO-05-824T 

forward, we need to rethink certain traditional funding strategies, such as 

per capita based formulas and earmarks to determine whether they are 

consistent with a risk based approach. 

We should not expect this effort to be easy or the path forward to be 

smooth. Risk assessment is difficult in many government areas. It is 

especially so in the area of homeland security in which initial probabilities 

and consequences and the effectiveness of countermeasures are unusually 

difficult to determine. Getting relevant, reliable, and timely information for 

risk assessment is also quite difficult. Nevertheless, the effort should be 

made. A comprehensive approach should be developed and maintained. 

The state of the art for risk management will take time to mature. This will 

require sustained management commitment—and continued involvement, 

support, and oversight by Congress. 

This completes my prepared statement. I would be pleased to respond to 

any questions you or other members of the subcommittee may have. 

For future information on this testimony, please contact Norman J. Rabkin 

at 202-512-8777. Other key contributors included Denise Fantone, 

Kimberly Gianopoulos, Susan Irving, Jacqueline Nowicki, Evi Rezmovic, 

and Jonathan Tumin. 

(440434) 
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately. 
The Government Accountability Office, the audit, evaluation and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help 

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost 

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To 

have GAO e-mail you a list of newly posted products every afternoon, go 

to www.gao.gov and select “Subscribe to Updates.” 

The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to: 

U.S. Government Accountability Office 

441 G Street NW, Room LM 

Washington, D.C. 20548 

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm 

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, D.C. 20548 

Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800 

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548 

GAO’s Mission 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Mail or Phone 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

PRINTED ON RECYCLED PAPER