a

GAO

United States Government Accountability Office

Report to Congressional Committees

August 2007 HOMELAND 

SECURITY

U.S. Visitor and 

Immigrant Status 

Program’s 

Long-standing Lack of 

Strategic Direction 

and Management 

Controls Needs to Be 

Addressed

GAO-07-1065
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

August 2007

HOMELAND SECURITY

U.S. Visitor and Immigrant Status 

Program’s Long-standing Lack of 

Strategic Direction and Management 

Controls Needs to Be Addressed 

Highlights of GAO-07-1065, a report to 

congressional committees 

The Department of Homeland

Security (DHS) has established a 

program known as U.S. Visitor and 

Immigrant Status Indicator

Technology (US-VISIT) to collect, 

maintain, and share information, 

including biometric identifiers, on 

certain foreign nationals who travel

to the United States. By

congressional mandate, DHS is to

develop and submit an expenditure

plan for US-VISIT that satisfies 

certain conditions, including being 

reviewed by GAO. GAO reviewed

the plan to (1) determine if the plan

satisfied these conditions, (2) 

follow up on certain 

recommendations related to the 

program, and (3) provide any other

observations. To address the 

mandate, GAO assessed plans and 

related documentation against 

federal guidelines and industry 

standards and interviewed the

appropriate DHS officials. 

What GAO Recommends

Because outstanding

recommendations already address 

all of the management weaknesses

discussed in this report, GAO is 

reiterating prior recommendations 

and recommending that the 

Secretary of DHS report to the 

department’s authorization and

appropriations committees on its

reasons for not fully addressing the 

legislative conditions and prior 

GAO recommendations. DHS 

largely agreed with the report and 

provided additional information 

and views that GAO has

incorporated and addressed in the 

report as appropriate. 

The US-VISIT expenditure plan, including related program documentation 

and program officials’ statements, satisfies or partially satisfies some but not 

all of the legislative conditions required by the Department of Homeland 

Security Appropriations Act, 2007. For example, the department satisfied the 

condition that it provide certification that an independent verification and 

validation agent is currently under contract for the program and partially 

satisfied the condition that US-VISIT comply with DHS’s enterprise 

architecture. However, the department did not satisfy the conditions that the 

plan include a comprehensive US-VISIT strategic plan and a complete 

schedule for biometric exit implementation. 

DHS partially implemented GAO’s oldest open recommendations pertaining 

to US-VISIT. For example, while the department partially completed the 

recommendation that it develop and begin implementing a US-VISIT system

security plan, the scope of the plan does not extend to all the systems that 

comprise US-VISIT. In addition, while the expenditure plan provides some 

information on US-VISIT’s cost, schedule, and benefits associated with 

planned capabilities, the information provided is not sufficiently defined and 

detailed to address GAO’s recommendation and provide a reasonable basis 

for measuring progress and holding the department accountable for results. 

GAO identified several additional observations. On the positive side, DHS 

data show that the US-VISIT prime contract is being executed according to 

cost and schedule expectations. However, DHS continues to propose 

disproportionately heavy investment in US-VISIT program managementrelated activities without adequate justification or full disclosure. Further, 

DHS continues to propose spending tens of millions of dollars on US-VISIT 

exit projects that are not well-defined, planned, or justified on the basis of 

costs, benefits, and risks. 

Overall, the US-VISIT fiscal year 2007 expenditure plan and other available 

program documentation do not provide a sufficient basis for effective 

program oversight and accountability. Both the legislative conditions and 

GAO’s open recommendations are aimed at accomplishing both, and thus 

they need to be addressed quickly and completely. However, despite ample 

opportunity to do so, DHS has not done so and the reasons why are unclear. 

Until these recommendations are addressed, GAO does not believe that the 

program’s disproportionate investment in management-related activities 

represents a prudent and warranted course of action or to expect that the 

newly launched exit endeavor will produce results different from past 

results—namely, no operational exit solution despite expenditure plans 

allocating about a quarter of a billion dollars to various exit activities. www.gao.gov/cgi-bin/getrpt?GAO-07-1065.

To view the full product, including the scope 

and methodology, click on the link above. 

For more information, contact Randolph C. 

Hite at (202) 512-3439 or hiter@gao.gov. 
Page i GAO-07-1065 Homeland Security

Contents

Letter 1

Compliance with Legislative Conditions 2

Status of Open Recommendations 2

Observations on the Expenditure Plan and Management of 

US-VISIT 6

Conclusions 7

Recommendation for Executive Action 8

Agency Comments and Our Evaluation 9

Appendixes

Appendix I: Briefing Slides 12

Appendix II: Comments from the Department of Homeland Security 155

Appendix III: GAO Contact and Staff Acknowledgments 163

Abbreviations

DHS Department of Homeland Security

EA enterprise architecture

EVM earned value management

HLS Homeland Security

OMB Office of Management and Budget

POE port of entry

SEI Software Engineering Institute

TECS Treasury Enforcement Communications System

US-VISIT U.S. Visitor and Immigrant Status Indicator Technology

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-07-1065 Homeland Security

United States Government Accountability Office

Washington, D.C. 20548

A

August 31, 2007 Letr

The Honorable Robert C. Byrd

Chairman

The Honorable Thad Cochran

Ranking Member

Subcommittee on Homeland Security

Committee on Appropriations

United States Senate 

The Honorable David E. Price

Chairman

The Honorable Harold Rogers

Ranking Member

Subcommittee on Homeland Security

Committee on Appropriations

House of Representatives

The Department of Homeland Security (DHS) submitted to Congress in 

March 2007 its fiscal year 2007 expenditure plan for the U.S. Visitor and 

Immigrant Status Indicator Technology (US-VISIT) program pursuant to 

the Department of Homeland Security Appropriations Act, 2007.1

 US-VISIT 

is a governmentwide program to collect, maintain, and share information 

on foreign nationals who enter and exit the United States. The program’s 

goals are to enhance the security of U.S. citizens and visitors, facilitate 

legitimate trade and travel, ensure the integrity of the U.S. immigration 

system, and protect the privacy of visitors to the United States. As required 

by the appropriations act, we reviewed US-VISIT’s fiscal year 2007 

expenditure plan. Our objectives were to (1) determine whether the 

expenditure plan satisfies legislative conditions specified in the 

appropriations act, (2) determine the status of our oldest open 

recommendations pertaining to US-VISIT,2

 and (3) provide observations 

about the expenditure plan and DHS’ management of US-VISIT.

1

Pub. L. No. 109-295 (Oct. 4, 2006).

2

Our reports on US-VISIT expenditure plans have resulted in 28 recommendations, 6 of 

which pertain to the US-VISIT expenditure plan and 22 of which pertain to the US-VISIT 

program. The recommendations that we focused on are those that have been open for 4 

years. For a full list of US-VISIT-related GAO reports, see appendix I, attachment 2.
Page 2 GAO-07-1065 Homeland Security

On June 15, 2007, and on June 20, 2007, we briefed the staffs of the Senate 

and House Appropriations Subcommittees on Homeland Security, 

respectively, on the results of our review. This report transmits these 

results. The full briefing, including our scope and methodology, is reprinted 

in appendix I.

Compliance with 

Legislative Conditions

The US-VISIT expenditure plan, including related program documentation 

and program officials’ statements, satisfies or partially satisfies some, but 

not all, of the legislative conditions. Specifically, the legislative conditions 

that DHS certify that an independent verification and validation agent is 

currently under contract for the program and that the DHS Investment 

Review Board, the Secretary of Homeland Security, and the Office of 

Management and Budget (OMB) review and approve the plan were 

satisfied.3

 However, DHS only partially satisfied the legislative conditions 

that it (1) meet the capital planning and investment control review 

requirements established by OMB, including OMB Circular A-11, part 7; 

(2) comply with DHS’ enterprise architecture; and (3) comply with federal 

acquisition rules, requirements, guidelines, and systems acquisition 

management practices. In addition, DHS did not satisfy the legislative 

conditions that the plan include (1) a comprehensive US-VISIT strategic 

plan and (2) a complete schedule for biometric exit implementation.

Status of Open 

Recommendations

DHS has partially implemented our recommendations pertaining to USVISIT that have been open for 4 years. These recommendations, along with 

their status, are summarized here.

• Recommendation: Develop and begin implementing a system security 

plan and perform a privacy impact analysis and use the results of this 

analysis in near term and subsequent system acquisition decision 

making.

DHS has partially implemented this recommendation. In December 2006, 

the program office developed a US-VISIT security strategy and has since 

begun implementing it. However, the scope of this strategy does not extend 

to all the systems that comprise US-VISIT, such as the Treasury

3

One additional legislative condition—that the plan be reviewed by us—was also satisfied.
Page 3 GAO-07-1065 Homeland Security

Enforcement Communications System (TECS). We recently testified4 that 

TECS has neither the security controls and defensive perimeters in place 

for preventing an intrusion, nor the capability to detect an intrusion should 

one occur. Until a more comprehensive security strategy is developed, the 

systems that comprise US-VISIT could place it at increased risk. 

• Recommendation: Develop and implement a plan for satisfying key 

acquisition management controls, including acquisition planning, 

solicitation, requirements management, project management, contract 

tracking and oversight, evaluation, and transition to support, and 

implement the controls in accordance with Software Engineering 

Institute (SEI) guidance.5

DHS has partially implemented this recommendation. Since 2005, the 

program office reports progress in implementing 113 practices associated 

with six SEI key process areas. However, the six areas of focus do not 

include all of the management controls that our recommendations cover, 

such as solicitation and transition to support. As long as the program office 

does not address all of the management controls that we have 

recommended, it will unnecessarily increase program risks.

• Recommendation: Ensure that expenditure plans fully disclose what 

system capabilities and benefits are to be delivered, by when, and at 

what cost, as well as how the program is being managed.

DHS has partially implemented this recommendation. The fiscal year 2007 

expenditure plan discloses planned system capabilities, estimated 

schedules and costs, and expected benefits. However, schedules, costs, and 

benefits are not always defined in sufficient detail to be measurable and to 

permit oversight. Finally, the plan does not fully disclose challenges or 

changes associated with program management. Without such information, 

the expenditure plan may not provide Congress with enough information to 

exercise effective oversight and to hold the department accountable.

4

House Committee on Homeland Security, Hacking the Homeland: Investigating 

Cybersecurity Vulnerabilities at the Department of Homeland Security: Hearing before 

the Subcommittee on Emerging Threats, Cybersecurity, and Science and Technology,

110th Cong., 1st sess., 2007.

5

This recommendation merges two of our prior recommendations.
Page 4 GAO-07-1065 Homeland Security

• Recommendation: Ensure that the human capital and financial 

resources provided are sufficient to establish a fully functional and 

effective program office and associated management capability. 

DHS has partially implemented this recommendation. At one point in 2006, 

all of the program office’s 115 government positions were filled. However, 

21 positions have since become vacant. Without adequate human capital, 

particularly in key positions and for extended periods, program risks will 

increase.

• Recommendation: Clarify the operational context within which USVISIT must operate.

DHS has partially implemented this recommendation. DHS has yet to 

define the operational context in which US-VISIT is to operate, such as 

having a departmentally approved strategic plan or a well-defined 

department enterprise architecture (EA). While the expenditure plan 

includes a departmentally approved US-VISIT strategic plan, it does not 

address key elements of relevant federal strategic planning guidance. 

Moreover, we recently reported6

 that the version of the department’s EA7

that DHS has been using for US-VISIT alignment purposes was missing 

architecture content and was developed with limited stakeholder input. 

Finally, although program officials have met with related programs to 

coordinate their respective efforts, specific coordination efforts have not 

been assigned to any DHS entity. Until a well-defined operational context 

exists, the department will be challenged in its ability to define and 

implement US-VISIT and related border security and immigration 

management programs in a manner that promotes interoperability, 

minimizes duplication, and optimizes departmental capabilities and 

performance.

• Recommendation: Determine whether proposed US-VISIT increments 

will produce mission value commensurate with costs and risks and 

disclose to its executive bodies and Congress the results of these 

business cases and planned actions.

6

GAO, Homeland Security: DHS Enterprise Architecture Continues to Evolve, but 

Improvements Needed, GAO-07-564 (Washington D.C.: May 9, 2007).

7

The focus of our review was DHS EA 2006. In March 2007, DHS issued HLS EA 2007.
Page 5 GAO-07-1065 Homeland Security

DHS has partially implemented this recommendation. We recently reported 

that, while a business case was prepared for Increment 1B,8

 the analysis 

performed met only four of the eight criteria in OMB guidance. Since then, 

the program office has developed business cases for two projects: Unique 

Identity and U.S. Travel Documents-ePassports (formerly Increment 2A), 

and we have ongoing work to address, among other things, these business 

cases. Further, the program office has yet to develop a business case for 

another project that it plans to begin implementing this year—biometric 

exit at air ports of entry (POE). Until the program office has reliable 

business cases for each US-VISIT project in which alternative solutions for 

meeting mission needs are evaluated on the basis of costs, benefits, and 

risks, it will not be able to adequately inform its executive bodies and 

Congress about its plans and will not provide the basis for prudent 

investment decision making.

• Recommendation: Develop and implement a human capital strategy 

that provides for staffing open positions with individuals who have the 

requisite core competencies (knowledge, skills, and abilities).

DHS has partially implemented this recommendation. In February 2006, we 

reported9

 that the program office issued a human capital plan and had 

begun implementing it. However, DHS stopped doing so during 2006 

pending departmental approval of a DHS-wide human capital initiative and 

because all program office positions were filled. However, as noted earlier, 

the program office now reports that it has 21 government positions—

including critical leadership positions—that are now vacant. Moreover, it 

has stated that it developed a new human capital plan but we did not 

review this plan because it is still undergoing departmental review. Until 

the department approves the human capital plan and the program office 

begins to implement it, the program will continue to be at risk.

• Recommendation: Develop and implement a risk management plan and 

ensure that all high risks and their status are reported regularly to the 

appropriate executives.

8

Air and Sea Exit Deployment.

9

GAO, Homeland Security: Recommendations to Improve Management of Key Border 

Security Program Need to Be Implemented, GAO-06-296 (Washington, D.C.: Feb. 14, 2006).
Page 6 GAO-07-1065 Homeland Security

DHS has partially implemented this recommendation. US-VISIT has 

approved a risk management plan and has begun implementing it. 

However, the current risk management plan does not address when risks 

should be elevated beyond the level of the US-VISIT Program Director. 

According to program officials, elevation of US-VISIT risks is at the 

discretion of the Program Director, and no risks have been elevated to DHS 

executives since December 2005. Until the program office ensures that high 

risks are appropriately elevated, department executives will not have the 

information they need to make informed investment decisions.

• Recommendation: Define performance standards for US-VISIT that are 

measurable and reflect the limitations imposed on US-VISIT capabilities 

by relying on existing systems.

DHS has partially implemented this recommendation. The program office 

has defined technical performance standards for several increments, but 

these standards do not contain sufficient information to determine whether 

they reflect the limitations imposed by relying on existing systems. As a 

result, the ability of these increments to meet performance requirements 

remains uncertain and the ability to identify and effectively address 

performance shortfalls is missing.

Observations on the 

Expenditure Plan and 

Management of USVISIT

While available data show that prime contract cost and schedule 

expectations are being met, aspects of the US-VISIT program continue to 

lack definition and justification. Each of our observations in this regard are 

summarized here.

• Earned value management (EVM) data on ongoing prime contract task 

orders show that cost and schedule baselines are being met.

EVM is a program management tool for measuring progress by comparing 

the value of work accomplished with the amount of work expected to be 

accomplished.10 Data provided by the program office show that the 

cumulative cost and schedule variances for the overall prime contract and 

all 12 ongoing task orders are within an acceptable range of performance. 

10The EVM system used by the prime contractor has yet to be certified by an outside agent 

(see briefing slide 36 in app. I for details).
Page 7 GAO-07-1065 Homeland Security

• DHS continues to propose a heavy investment in program managementrelated activities without adequate justification or full disclosure.

Program management is an important and integral aspect of any system 

acquisition program and should be justified in relation to the size and 

significance of the acquisition activities being performed. In 2006, program 

management costs represented 135 percent of planned development. This 

means that for every dollar spent on new capabilities, $1.35 was spent on 

management. The fiscal year 2007 expenditure plan similarly proposed 

investing $1.25 on management-related activities for every dollar invested 

in new development. However, the plan does not explain the reasons for 

the sizable investment in management-related activities or otherwise justify 

it on the basis of measurable expected value. Without disclosing and 

justifying its proposed investment and program management-related 

efforts, it is unclear that such a large amount of funding for these activities 

represents the best use of resources.

• Lack of a well-defined and justified exit solution introduces the risk of 

repeating failed and costly past exit efforts. DHS has issued a high-level 

schedule for air exit, but information supporting that schedule is not yet 

available. In addition, there are no other exit program plans available 

that define what will be done, by what entities, and at what cost in order 

to define, acquire, deliver, deploy, and operate this capability. This 

includes developing plans describing expected system capabilities, 

identifying key stakeholder roles/responsibilities and buy-in, 

coordinating and aligning with related programs, and allocating funding 

to activities. Furthermore, DHS has not performed an analysis 

comparing the life cycle costs of the air exit solution to its expected 

benefits and risks. Since 2004, we have reported on a similar lack of 

definition and justification of prior US-VISIT exit efforts, even though 

prior expenditure plans have allocated funding of $250 million to 

completing these efforts. As of today, these prior efforts have not 

produced an operational exit solution. Without better definition and 

justification of its future exit efforts, the department runs the serious 

risk of repeating its past failures.

Conclusions US-VISIT’s prime contract cost and schedule metrics show that 

expectations are being met, according to available data, although the EVM 

system that the metrics are based on has yet to be independently certified. 

Notwithstanding this, such performance is a positive sign.
Page 8 GAO-07-1065 Homeland Security

However, most of the many management weaknesses raised in this report 

have been the subject of our prior US-VISIT reports and testimonies and, 

thus, are not new. Accordingly, we have already made a litany of 

recommendations to correct each weakness, as well as follow-on 

recommendations to increase DHS attention to and accountability for 

doing so. Despite this, recurring legislative conditions associated with USVISIT expenditure plans continue to be less than fully satisfied and 

recommendations that we made 4 years ago have still not been fully 

implemented.

Exacerbating this situation is the fact that DHS did not satisfy two new 

legislative conditions associated with the fiscal year 2007 expenditure plan, 

and serious questions continue to exist about DHS’ justification for and 

readiness to invest current, and potentially future, fiscal year funding 

relative to an exit solution and program management-related activities.

DHS has had ample opportunity to address these many issues, but it has 

not. As a result, there is no reason to expect that its newly launched exit 

endeavor, for example, will produce results different from past 

endeavors—namely, DHS will not have an operational exit solution despite 

expenditure plans allocating about a quarter of a billion dollars to various 

exit activities. Similarly, on the basis of past efforts, there is no reason to 

believe that the program’s disproportionate investment in managementrelated activities represents a prudent and warranted course of action. All 

told, this means that needed improvements in US-VISIT program 

management practices are long overdue. Both the legislative conditions 

and our open recommendations are aimed at accomplishing these 

improvements, and they need to be addressed quickly and completely. Thus 

far, they have not been, and the reasons that they have not are unclear.

Recommendation for 

Executive Action

Because our outstanding US-VISIT recommendations already address all of 

the management weaknesses discussed in this report, we are reiterating 

our prior recommendations and recommending that the Secretary of DHS 

report to the department’s authorization and appropriations committees on 

its reasons for not fully addressing its expenditure plan legislative 

conditions and our prior recommendations.
Page 9 GAO-07-1065 Homeland Security

Agency Comments and 

Our Evaluation

We received written comments on a draft of this report from DHS, which 

were signed by the Director, Departmental GAO/IG Liaison Office, and are 

reprinted in appendix II. 

In its comments, DHS stated that it agreed with the majority of our findings, 

adding that the department realizes, and our report supports the fact, that 

improvements to US-VISIT’s management controls, operational context, 

and human capital are needed. DHS also stated that the US-VISIT program 

office would aggressively engage with us to address our open 

recommendations, noting that it appreciates the guidance provided by our 

reports. In this regard, DHS’s comments described efforts completed, 

underway, and planned to address our recommendations, most of which 

were already reflected in the draft report. New information in DHS’s 

comments covered its intentions relative to the next US-VISIT expenditure 

plan and the next US-VISIT strategic plan, both of which are to be issued in 

fiscal year 2008. This new information is consistent with the intent of our 

open recommendations. New information also included the US-VISIT 

Director’s intention to communicate high-priority risks to the Under 

Secretary of the National Protection and Programs Directorate, which is 

also in line with our open recommendations. 

However, DHS also stated that it disagreed with the “partially complete” 

status that we assigned to one of our open recommendations. It also stated 

that our observation characterizing past US-VISIT exit efforts as failed and 

costly implicitly devalued the experience and empirical data that the 

department gained from these proof-of-concept efforts, and this 

observation did not recognize relevant information about the program’s use 

of biographic exit procedures. We do not agree with either of these 

comments, as discussed below.

• With the respect to the “partially complete” status that our report 

assigns to the open recommendation for the program to develop and 

begin implementing a system security plan, and to perform a privacy 

impact analysis and use the results of this analysis in near term and 

subsequent system acquisition decision making, DHS stated that it 

considers this recommendation satisfied. In this regard, the department 

describes a number of actions that the program has taken with respect 

to US-VISIT security and privacy. We do not take issue with the actions 

that DHS described, and would note that our draft report already 

recognizes them. Moreover, we too consider the privacy component of 

our recommendation satisfied. However, we do not agree with the 
Page 10 GAO-07-1065 Homeland Security

department’s position relative to the scope of US-VISIT’s security 

strategy in that it does not address known vulnerabilities associated 

with a US-VISIT component system—TECS.11 As we state in our report, 

TECS is an integral component of US-VISIT and, according to federal 

security standards, a system security plan, or in US-VISIT’s case the 

system security strategy, typically covers such component systems. 

Therefore, we believe that the US-VISIT security risk assessment and 

security strategy need to explicitly address such vulnerabilities, and 

thus we do not consider the entire recommendation as being fully 

satisfied. 

• With respect to our characterization of past US-VISIT exit efforts, the 

department stated that we incorrectly viewed these past efforts as “ends 

in themselves” and as “failed and costly” because they did not 

immediately conclude with operational systems. According to DHS, the 

program never intended for these efforts to be more than proof-ofconcept learning experiences that would form the basis for more 

workable future system solutions. We do not agree with these 

comments. As we state in our report, the program first committed to full 

deployment of a biometric exit capability in 2003, and it has continued 

to make similar deployment commitments in subsequent years. At the 

same time, we have chronicled a pattern of inadequate analysis 

surrounding the expected costs, benefits, and risks of these exit efforts 

since 2004, and thus an absence of reliable information upon which to 

view their expected value and base informed exit-related investment 

decisions. Nevertheless, the program continued to invest each year in 

these biometric exit efforts, thus far having allocated about $250 million 

in funding to them. At no time, however, was any analysis produced to 

justify investing a quarter of a billion dollars to gain “experiences and 

empirical data” for such a sizeable investment. Rather, commitments 

were repeatedly made in expenditure plans for deploying an operational 

exit solution. While we recognize the value and role of demonstration 

and pilot efforts as a means for learning and informing future 

development efforts, our point is that exit-related efforts have been 

inadequately defined and justified over the last 4 years, despite being 

allocated $250 million, and the fiscal year 2007 expenditure proposes 

more of the same.

11GAO, Information Security: Homeland Security Needs to Immediately Address 

Significant Weaknesses in Systems Supporting the US-VISIT Program, GAO-07-870

(Washington, D.C.: July 13, 2007).
Page 11 GAO-07-1065 Homeland Security

With respect to not recognizing the program’s use of biographic exit 

procedures in the above described observation, the department is correct 

that we describe these procedures in other sections of our report but not as 

part of this observation. We do not include this information under this 

observation because its focus is on the 4 years and $250 million that has 

been devoted to biometric-based exit efforts, and the lack of definition and 

justification in the fiscal year 2007 expenditure plan for these biometric 

efforts going forward. 

We are sending copies of this report to the Chairmen and Ranking Members 

of other Senate and House committees and subcommittees that have 

authorization and oversight responsibilities for homeland security. We are 

also sending copies to the Secretary of Homeland Security, Secretary of 

State, and the Director of OMB. We will also make copies available to 

others on request. In addition, the report will be available at no charge on 

GAO’s Web site at www.gao.gov.

If you or your staffs have any questions on matters discussed in this report, 

please contact me at (202) 512-3439 or at hiter@gao.gov. Contact points for 

our Offices of Congressional Relations and Public Affairs may be found on 

the last page of this report. GAO staff who have made significant 

contributions to this report are listed in appendix III.

Randolph C. Hite

Director, Information Technology Architecture

and Systems Issues
Page 12 GAO-07-1065 Homeland Security

Appendix I

Briefing Slides AAppenednxidexiIs

1

Briefing to the Staffs of the

Subcommittees on Homeland Security

Senate and House Committees on Appropriations

June 15, 2007

Homeland Security: U.S. Visitor and Immigrant Status 

Program’sLong-standing Lack of Strategic Direction and 

Management Controls Needs to be Addressed
Appendix I

Briefing Slides

Page 13 GAO-07-1065 Homeland Security

2

Briefing Overview

• Introduction

• Objectives

• Results in Brief

• Background

• Results

• Legislative Conditions

• Status of Open Recommendations

• Observations

• Conclusions

• Recommendations for Executive Action

• Agency Comments
Appendix I

Briefing Slides

Page 14 GAO-07-1065 Homeland Security

3

Briefing Overview

• Attachment 1. Scope and Methodology

• Attachment 2. Related Products List

• Attachment 3. Description of US-VISIT Program 

• Attachment 4. Description of Increments and Component Systems
Appendix I

Briefing Slides

Page 15 GAO-07-1065 Homeland Security

4

Introduction

The U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT) program of 

the Department of Homeland Security (DHS) is a governmentwide program to 

collect, maintain, and share information on foreign nationals who enter and exit the

U.S. The goals of US-VISIT are to 

• enhance the security of U.S. citizens and visitors,

• facilitate legitimate travel and trade,

• ensure the integrity of the U.S. immigration system, and 

• protect the privacy of our visitors.
Appendix I

Briefing Slides

Page 16 GAO-07-1065 Homeland Security

5

Introduction

The Department of Homeland Security Appropriations Act, 2007,1 states that DHS 

may not obligate $200 million of the $362.494 million appropriated for the US-VISIT 

project until the Senate and House Committees on Appropriations receive a plan

for expenditure that 

• meets the capital planning and investment control review requirements 

established by the Office of Management and Budget (OMB), including 

Circular A-11, part 7;2

• complies with DHS’s enterprise architecture;

• complies with the acquisition rules, requirements, guidelines, and systems 

acquisition management practices of the federal government;

• includes a certification by the DHS Chief Information Officer (CIO) that an 

independent verification and validation (IV&V) agent is currently under contract 

for the project; 

1Pub. L. No. 109-295 (Oct. 4, 2006).

2OMB Circular A-11 establishes policy for planning, budgeting, acquisition, and management of federal capital assets.
Appendix I

Briefing Slides

Page 17 GAO-07-1065 Homeland Security

6

Introduction

• is reviewed and approved by the DHS Investment Review Board (IRB), the 

Secretary of Homeland Security, and OMB; 

• is reviewed by GAO;

• includes a comprehensive US-VISIT strategic plan; and 

• includes a complete schedule for biometric exit implementation. 

On March 20, 2007, DHS submitted its fiscal year 2007 expenditure plan for 

$362.494 million to the House and Senate Appropriations Subcommittees on 

Homeland Security.
Appendix I

Briefing Slides

Page 18 GAO-07-1065 Homeland Security

7

Objectives

As agreed, our objectives were to

1. determine whether the US-VISIT fiscal year 2007 expenditure plan satisfies 

the legislative conditions, 

2. determine the status of our oldest open recommendations pertaining to USVISIT,3 and

3. provide observations about the expenditure plan and management of the 

program.

We conducted our work at US-VISIT offices in Arlington, Virginia, from March 2007 

through June 2007 in accordance with generally accepted government auditing 

standards. Details of our scope and methodology are described in attachment 1.

3Our reports on US-VISIT expenditure plans have resulted in 28 recommendations, six of which pertain to the US-VISIT 

expenditure plan and 22 of which pertain to the US-VISIT program. The recommendations that we focused on are those 

that have been open for 4 years. For a full list of US-VISIT related GAO reports, see attachment 2. 
Appendix I

Briefing Slides

Page 19 GAO-07-1065 Homeland Security

8

Results in Brief: Objective 1

Legislative Conditions

Summary of Fiscal Year 2007 US-VISIT Expenditure Plan’s Satisfaction of 

Legislative Conditions

aDoes not satisfy or provide for satisfying all key aspects of the condition we reviewed. bSatisfies or provides for satisfying some, but not all, key aspects of the condition that we reviewed.

cSatisfies or provides for satisfying every aspect of the condition that we reviewed.

Includes a complete schedule for biometric exit implementation X

Includes a comprehensive US-VISIT strategic plan X

Does not satisfya

Is reviewed by GAO X

Is reviewed and approved by the DHS IRB, the DHS Secretary, and OMB X

Legislative conditions

Includes a certification by the DHS CIO that an IV&V agent is currently X

under contract for the program

Complies with the acquisition rules, requirements, guidelines, and systems X

acquisition management practices of the federal government

Complies with the DHS enterprise architecture X

Meets the capital planning and investment control review requirements X

established by OMB, including OMB A-11, part 7

Satisfies Partially satisfiesb c

Source: GAO.
Appendix I

Briefing Slides

Page 20 GAO-07-1065 Homeland Security

9

Results in Brief: Objective 2

Open Recommendations

Summary of Status of Open Recommendations 

dA recommendation is partially complete when documentation indicates that some, but not all, actions needed to implement it have been taken. eA recommendation is complete when documentation demonstrates that it has been fully addressed. f

This recommendation is the merger of two of our prior recommendations.

3. Ensure that expenditure plans fully disclose what system capabilities and benefits are to be delivered, by X

when, and at what cost, as well as how the program is being managed. 

2. Develop and implement a plan for satisfying key acquisition management controls, including acquisition X

planning, solicitation, requirements management, project management, contract tracking and oversight, 

evaluation, and transition to support, and implement the controls in accordance with Software Engineering 

Institute (SEI) guidance.f

5. Clarify the operational context within which US-VISIT must operate. X

4. Ensure that the human capital and financial resources are provided to establish a fully functional and X

effective program office and associated management capability. 

1. Develop and begin implementing a system security plan and perform a privacy impact analysis and use the X

results of this analysis in near term and subsequent system acquisition decision making.

Complete Partially e

complete Open recommendations d

Source: GAO.
Appendix I

Briefing Slides

Page 21 GAO-07-1065 Homeland Security

10

Results in Brief: Objective 2

Open Recommendations

Summary of Status of Open Recommendations (cont’d) 

dA recommendation is partially complete when documentation indicates that some, but not all, actions needed to implement it have been taken. eA recommendation is complete when documentation demonstrates that it has been fully addressed. gThis recommendation is the merger of three of our prior recommendations.

8. Develop and implement a risk management plan and ensure that all high risks and their status are reported X

regularly to the appropriate executives.

7. Develop and implement a human capital strategy that provides for staffing open positions with individuals X

who have the requisite core competencies (knowledge, skills, and abilities).

9. Define performance standards for US-VISIT that are measurable and reflect the limitations imposed by X

relying on existing systems.

6. Determine whether proposed US-VISIT increments will produce mission value commensurate with costs X

and risks and disclose to its executive bodies and the Congress the results of these business cases and 

planned actions.g

Complete Partially e

complete Open recommendations d

Source: GAO.
Appendix I

Briefing Slides

Page 22 GAO-07-1065 Homeland Security

11

Results in Brief: Objective 3

Observations

Observation Summaries

• DHS data show that the US-VISIT prime contract is being executed according 

to cost and schedule expectations, as defined and measured by a wellaccepted progress measurement technique known as earned value 

management.

• DHS continues to propose disproportionately heavy investment in US-VISIT 

program management-related activities without adequate justification or full 

disclosure, to the point of spending $1.25 on management for every dollar 

invested in new development. Without justifying and fully disclosing such a 

large investment in program management, questions persist as to whether this 

represents the best use of DHS resources. 

• DHS continues to propose spending tens of millions of dollars on exit projects 

that are not well-defined, planned, or justified on the basis of costs, benefits 

and risks. Without properly positioning itself for effectively and efficiently 

investing in an exit solution, DHS risks repeating its prior failed and costly exit 

efforts.
Appendix I

Briefing Slides

Page 23 GAO-07-1065 Homeland Security

12

Results in Brief: Recommendations and 

Agency Comments

Because our outstanding US-VISIT recommendations already address all of the 

management weaknesses discussed in this briefing, we are reiterating our prior 

recommendations, and recommending that DHS report to its congressional 

authorization and appropriations committees the reasons for it not fully satisfying its 

US-VISIT expenditure plan legislative requirements and our prior 

recommendations.

In comments on a draft of this briefing, DHS stated that the briefing was factually 

correct, that GAO's guidance provided value to the program, and that it would 

continue to address our recommendations. 
Appendix I

Briefing Slides

Page 24 GAO-07-1065 Homeland Security

13

Background

US-VISIT Overview

The goals of the US-VISIT program are to enhance the security of U.S. citizens and 

visitors, facilitate legitimate travel and trade, ensure the integrity of the U.S. 

immigration system, and protect the privacy of our visitors. US-VISIT is to 

accomplish these things by 

• collecting, maintaining, and sharing biometric and other information on certain 

foreign nationals who enter and exit the United States; 

• identifying foreign nationals who (1) have overstayed or violated the terms of 

their admission; (2) can receive, extend, or adjust their immigration status; or 

(3) should be apprehended or detained by law enforcement officials;

• detecting fraudulent travel documents, verifying traveler identity, and 

determining traveler admissibility through the use of biometrics; and

• facilitating information sharing and coordination within the immigration and 

border management community.
Appendix I

Briefing Slides

Page 25 GAO-07-1065 Homeland Security

14

Background

US-VISIT Program Office

Organizational Structure and Functional Responsibilities4

4 See attachment 3 for more details on the current organization structure. A proposed program office reorganization is 

currently being reviewed by DHS.
Appendix I

Briefing Slides

Page 26 GAO-07-1065 Homeland Security

15

Background

Acquisition Strategy 

DHS originally planned to deliver biometric entry and exit capability in four major 

increments.

• Increments 1 through 3 were to be interim, or temporary, solutions that focus 

on building interfaces among existing (legacy) systems; enhancing the 

capabilities of these systems; and deploying these systems to air, sea, and 

land ports of entry (POEs). 

• Increment 4 was to be a series of incremental releases, or mission capability 

enhancements, that were to deliver long-term strategic capabilities for meeting 

program goals. 

• In May 2004, DHS awarded an indefinite-delivery/indefinite-quantity5 prime

contract to Accenture and its partners for delivering future US-VISIT 

capabilities.6

5An indefinite-delivery/indefinite-quantity contract provides for an indefinite quantity, within stated limits, of supplies or 

services during a fixed period of time. The government schedules deliveries or performance by placing orders with the 

contractor.

6Accenture’s partners in this contract include, among others, Raytheon Company, the Titan Corporation, and SRA 

International, Inc.
Appendix I

Briefing Slides

Page 27 GAO-07-1065 Homeland Security

16

Background

Description and History of Increments

Increment 1

Increment 1 was intended to establish entry and exit capabilities at air and sea 

POEs. Increment 1 air and sea entry capabilities were deployed on January 5, 

2004, at 115 airports and 14 seaports for individuals requiring nonimmigrant visas 

to enter the United States.7 These capabilities include collecting and matching 

biographic information, biometric data (two digital index finger scans) and a digital 

photograph for selected foreign nationals. In addition, several types of increment 1 

air and sea exit devices for collecting biometric data were piloted at 12 airports and 

2 seaports. This 3-year pilot focused on the technical feasibility of a biometric exit 

solution at air and sea POEs. The pilot ended in May 2007.

7 On September 30, 2004, US-VISIT expanded biometric entry procedures to include individuals from visa waiver countries 

applying for admission.
Appendix I

Briefing Slides

Page 28 GAO-07-1065 Homeland Security

17

Background

Description and History of Increments

Increment 2

Increment 2 was originally to extend US-VISIT entry and exit capabilities to the 50 

busiest land POEs by December 31, 2004. Subsequently, the increment was 

divided into three parts—2A, 2B, and 2C. 

• Increment 2A established entry capabilities at land, sea, and air POEs to 

biometrically authenticate machine-readable visas and other travel and entry 

documents issued by Department of State (State) and DHS to foreign 

nationals.8 These capabilities were deployed to all POEs by October 23, 2005, 

except for e-Passports, which were deployed to 33 POEs by November 14, 

2006. These 33 POEs account for 97 percent of all travelers entering with ePassports.

8Legislation requiring the installation of software and equipment at POEs to authenticate machine-readable visas and travel 

documents and to have visa waiver countries issue e-Passports established a deadline of October 26, 2004 (Pub. L. No. 

107-173, (May 14, 2002)), but this date was subsequently changed (Pub. L. No. 108-299 (Aug. 9, 2004)) to October 26, 

2005, before DHS and State requested an extension from the congressional committee providing oversight to change the 

date to October 26, 2006. 
Appendix I

Briefing Slides

Page 29 GAO-07-1065 Homeland Security

18

Background

Description and History of Increments

• Increment 2B extended the increment 1 entry solution to the 50 busiest land 

POEs and included redesigning the process for issuing a handwritten form I949 to enable the electronic capture of biographic, biometric (unless the 

traveler is exempt),10 and related travel documentation for travelers arriving in 

secondary inspection. This capability was deployed to the 50 busiest land 

POEs as of December 29, 2004. 

• Increment 2C was a proof-of-concept demonstration of the feasibility of using 

passive radio frequency identification (RFID) technology11 to record travelers’ 

entry and exit via a unique ID number tag embedded in the form I-94. It was 

originally deployed at five land POEs. The demonstration was terminated in 

November 2006.

9Form I-94s are used to record a foreign national’s entry into the United States. The form has two parts—arrival and 

departure—containing a unique number for the purposes of recording and matching the arrival and departure records 

of nonimmigrants.

10For example, diplomats and persons under the age of 14 or over the age of 79 are exempt from US-VISIT 

requirements. 

11Radio frequency technology relies on proximity cards and card readers. Radio frequency devices read the 

information contained on the card when the card is passed near the device. The information can contain personal 

identification of the cardholder.
Appendix I

Briefing Slides

Page 30 GAO-07-1065 Homeland Security

19

Background

Description and History of Increments

Increment 3

Increment 3 was to extend increment 2B entry capabilities to 104 land POEs by 

December 31, 2005. It was essentially completed as of December 19, 2005.12

Increment 4 – Unique Identity

All expenditure plans prior to fiscal year 2006 have described increment 4 as a yetto-be-defined, strategic solution. The fiscal year 2006 plan described increment 4 

as the combination of two projects: (1) Transition to 10 fingerprints in the 

Automated Biometric Identification System (IDENT) and (2) Interoperability 

between IDENT and the Federal Bureau of Investigation’s Integrated Automated 

Fingerprint Identification System (IAFIS). The fiscal year 2007 expenditure plan 

combines the two projects, with a third called enumeration (developing a single 

identifier for each individual), into a single project referred to as Unique Identity. 

12 At one POE, these capabilities were deployed by December 19, 2005, but were not fully operational until January 7, 

2006, because of a telephone company strike that prevented the installation of a high-capacity communications line. 
Appendix I

Briefing Slides

Page 31 GAO-07-1065 Homeland Security

20

Background

Entry Systems Overview13

Systems Diagram of Entry Capability

13For details on the processes underlying each increment and systems supplying information to US-VISIT, see attachment 4.
Appendix I

Briefing Slides

Page 32 GAO-07-1065 Homeland Security

21

Background

Chronology of Expenditure Plans

14In fiscal year 2003, the expenditure plan called for $375 million, but the appropriated amount was for $362 million. The 

difference of $13 million was to have been made up through authorized user fees collected by U.S. Immigration and Customs 

Enforcement. However, only $5 million in user fees was provided to the program, for a total of $367 million.

$1,744,394

$362,494

$336,600

$340,000

$330,000

$362,000

$13,300

Funds

appropriated

(in thousands)

2006 08/10/2006 $336,600 $336,600

$1,757,394

$362,494

$340,000

$330,000

$375,000

$13,300

Funds

requested

(in thousands)

$1,557,394

$162,494

$340,000

$330,000

$367,00014

$13,300

Funds released

to date

(in thousands)

Total

2005 10/19/2004

2007 03/20/2007

2004 01/27/2004

2003 06/05/2003

2002 11/15/2002

Date

submitted

Fiscal 

year

Source: GAO, based on an analysis of DHS data.
Appendix I

Briefing Slides

Page 33 GAO-07-1065 Homeland Security

22

Background

2007 Expenditure Plan Funding Allocation

8,000

8,000

Other

138,800

138,800

Operations and 

Maintenance

Management reserve 0 0 0 8,000

103,700

0

0

0

14,100

76,500

8,100

5,000

Development

86,300

0

62,500

0

1,400

17,400

2,700

2,300

Contractor

program

management

support

25,700

0

0

25,700

0

0

0

0

Government 

program

management

(costs in thousands)

Contractor program management 62,500

support

Program management and 25,700

operations

Exit (air and sea) $ 7,300

Total $362,500

Operations and maintenance 138,800

Data integrity and biometric support 15,500

services

Unique Identity (10-print, 93,900

enumeration, and IDENT/IAFIS 

interoperability)

U.S. travel documents and e- 10,800

Passports (2A PKD)

Areas of expenditure/Projects (see Total

next slides for descriptions)

Source: GAO, based on an analysis of DHS data.
Appendix I

Briefing Slides

Page 34 GAO-07-1065 Homeland Security

23

Background

Summary of 2007 US-VISIT Expenditure Plan

Exit: Includes planning and implementation of the chosen deployment option for the 

implementation of an exit screening program at air and sea ports. 

U.S. travel documents and e-Passports: Includes development, testing, and deployment of 

public key directory (PKD) validation services15 for e-Passport readers. 

Unique Identity: Includes implementing the 10-fingerprint scanners and the interim data 

sharing model (iDSM);16 related systems interoperability; associated facilities and engineering 

support; and systems architecture, engineering and integration, and design.

Data Integrity and Biometric Support Services: Includes providing qualified leads and 

actionable information to the U.S. Customs and Border Protection Service and U.S. 

Immigration and Customs Enforcement; establishment of lookout records for visa denials and 

adverse actions by border officials. 

Program management and operations : Includes the government salaries and benefits for 

115 government program office positions necessary to manage and operate the program, 

including relocation costs, personnel security checks, and training.

15 These services verify and authenticate the origins of e-passports and traveler’s identities. 16 The iDSM is a prototype of new functionality allowing US-VISIT and the Federal Bureau of 

Investigation to share biometric and associated biographic information. It was deployed in September 2006.
Appendix I

Briefing Slides

Page 35 GAO-07-1065 Homeland Security

24

Background

Summary of 2007 US-VISIT Expenditure Plan

Contractor services-program management: Includes the program office support 

contractors.

Operations and maintenance: Includes operations and maintenance of Increment 

1, 2, and 3 systems, including technical, application, system, network, and 

infrastructure support costs. 

Program management reserve: Includes funds allocated to accommodate 

unknown timing and magnitude of risks.
Appendix I

Briefing Slides

Page 36 GAO-07-1065 Homeland Security

25

Background

US-VISIT Project Life Cycle Management

US-VISIT has adopted its own methodology for managing its projects throughout 

their respective life cycles. This methodology is known as the US-VISIT Enterprise 

Life Cycle Methodology (ELCM). Within the ELCM is a component methodology for 

managing software-based system projects known as the US-VISIT Delivery 

Methodology (UDM). According to version 4.3 of UDM (April 2007), it

• Applies to new development projects and existing, operational projects. 

• Specifies the documentation and reviews that should take place within 

each of the methodology’s six phases: plan, analyze, design, build, test, 

and deploy. 

• Allows for tailoring to meet the needs and requirements of individual 

projects, in which specific activities, deliverables, and milestone reviews 

that are appropriate for the scope, risk, and context of the project can be 

set for each phase of the project.

The chart on the following page shows where US-VISIT projects are in terms of the 

life cycle methodology.
Appendix I

Briefing Slides

Page 37 GAO-07-1065 Homeland Security

26

Background: US-VISIT Project Status 

(New Development and Operational) 

IDENT/IAFIS

Interoperability 

IOC** 

10-Print 

Pilot

Exit * Unique Identity

New Development Work Pattern

Plan Analyze Design Build Test Deploy

Enumeration

Services

Public Key 

Directory

Increments

1, 2, and 3

UDM Gate Reviews

* Exit project in pre-planning; not within the UDM Technology Workstream

IDENT/IAFIS

Interoperability 

iDSM

** IOC: Initial Operational Capability

Operational

Source: GAO, based on an analysis of DHS data.
Appendix I

Briefing Slides

Page 38 GAO-07-1065 Homeland Security

27

Background

US-VISIT Task Orders

Support for SecurePass IPT, an integrated 

international registered traveler program designed to 

enhance national security and improve efficiency

Completed

Aug 2005

February

2005

International 

Registered

Traveler IPT

U.S. Travel 

Documents and ePassports

US-VISIT Prime Contract Task Orders’ Status and Description According to Area of 

Expenditure/Project

Planning and implementation of the US-VISIT 

Increment 2C Proof of Concept Project

Ongoingh September

2004

Increment 2C

Exit

Area of 

Expenditure/ Project

Pilot, test, and evaluate three exit alternatives (kiosk, 

mobile, hybrid) at selected international ports of 

departure

Completed

May 2005

August

2004

Exit pilot beta 

survey data 

collection

Purchase of materials, including hardware and 

software, to meet requirements of the PKD validation 

services project

Material support to March 2007 Ongoing

Increment 2A -

PKD

Development and implementation of PKD Validation 

Service to allow for biometric comparison and 

authentication of US visas and other travel documents

Increment 2A - March 2005 Ongoing

PKD

Air and Sea Exit Deployment—provide services for 

national deployment of the 1B exit solution as 

determined from results of 1B pilots

Completed

Dec 2006

February

2005

Increment 1B

Status/

Completion 

Date

Task Order Name Start Description

Source: GAO, based on an analysis of DHS data.

hIncrement 2C was terminated in November 2006. This task order will close once shutdown activities are complete.
Appendix I

Briefing Slides

Page 39 GAO-07-1065 Homeland Security

28

Background

US-VISIT Task Orders

US-VISIT Prime Contract Task Orders’ Status and Description According to Area of 

Expenditure/Project

Support Program Office Data Management Branch—

identify errors, omissions, and trends in data; 

recommend corrective actions; provide refined data 

to other offices (e.g., U.S. Immigration and Customs 

Enforcement) to support criminal investigations, 

lookout creation, and informed 

managerial/operational decision making

August Ongoing

2004

Data management 

support

Data Integrity and 

Biometric Support

Unique Identity

Area of 

Expenditure/ 

Project

Planning, development and implementation of the 

Biometric Identification Systems Project, now 

referred to as Unique Identity (IDENT/IAFIS 

integration and IDENT 10-print)

October Ongoing

2004

IT solutions delivery 

November Ongoing Program and technical integration support services

2006

Integration support 

to the Unique ID 

project office

Material, maintenance licenses, warranty, etc. in 

support of task 007 IT solutions

Material support to April 2007 Ongoing

task order 007

Status/

Completion 

Date

Task Order Name Start Description

Source: GAO, based on an analysis of DHS data.
Appendix I

Briefing Slides

Page 40 GAO-07-1065 Homeland Security

29

Background

US-VISIT Task Orders

Develop and maintain the standards, guidance, 

architectures, performance models, and other 

engineering processes necessary to support the 

development of functionality

September Ongoing

2004

Program level 

engineering

US-VISIT Prime Contract Task Orders’ Status and Description According to Area of 

Expenditure/Project

Contractor Support -

Program

Management 

Area of 

Expenditure/ 

Project

Create a US-VISIT blueprint that describes a 

comprehensive approach to achieving the overall 

vision for US-VISIT’s immigration and border 

management enterprise

Completed

Nov 2006

May

2005

Blueprint

Create and document a comprehensive strategic 

plan that describes necessary activities to 

integrate US-VISIT processes and systems

Completed

March 2005

October

2004

Strategic Plan

Support the development and maintenance of 

program planning artifacts and analyze phases of 

project execution and planning, updating, and 

implementing the US-VISIT Strategic Plan

November Ongoing

2006

Development and 

support of program 

planning activities

Status/ Description

Completion 

Date

Task Order Name Start

Ongoing Comprehensive program and project 

management methodology, policies, processes, 

procedures, and support to program office

Program level July 2004

management

Source: GAO, based on an analysis of DHS data.
Appendix I

Briefing Slides

Page 41 GAO-07-1065 Homeland Security

30

Background

US-VISIT Task Orders

US-VISIT Prime Contract Task Orders’ Status and Description According to Area of 

Expenditure/Project

Operations and 

Maintenance

Area of 

Expenditure/ 

Project

Ongoing

Ongoing

Status/

Completion 

Date

Management of operations and maintenance activities 

for deployed capabilities

August

2006

Operations and 

maintenance

Provisioning of office/facility space, furniture, 

workstations, telecommunications and other 

infrastructure to support contractor activities

March 

2005

Facilities and 

infrastructure

Task Order Name Start Description

Source: GAO, based on an analysis of DHS data.
Appendix I

Briefing Slides

Page 42 GAO-07-1065 Homeland Security

31

Background

Overview of DHS Investment Management Process

DHS recently changed its investment management process. Prior to 2006, DHS IT 

programs, including US-VISIT, were subject to key decision point reviews. 

According to DHS, this approach was adopted from the Department of Defense’s 

investment management process, and while well-suited for the acquisition of fighter 

jets, ships, etc., was not well-suited for acquisition of IT systems. 

Accordingly, DHS drafted an Investment Review Process guide that adopts an 

approach using milestone decision points (MDP) linking five life cycle phases: (1) 

project initiation, (2) concept and technology development, (3) capability 

development and demonstration, (4) production and deployment, and (5) 

operations and support. According to DHS, this guide provides more flexibility, 

allowing DHS to tailor the number of phases and milestone reviews based on risk 

and visibility. MDP reviews can be performed concurrently with an expenditure plan 

review. The draft guide was issued in March 2006; as of May 2007, the draft guide 

had not been approved. 
Appendix I

Briefing Slides

Page 43 GAO-07-1065 Homeland Security

32

Background

Overview of DHS Investment Control Process

Under the draft guide, a program sends an investment review request to the 

Integrated Project Review Team (IPRT) prior to the initial MDP. The IPRT assigns 

the program to a portfolio, and schedules the program for a Joint Requirements 

Council and/or IRB review. According to the official from DHS’s Program Analysis 

and Evaluation Directorate who is responsible for overseeing program adherence 

to the investment control process, it is being used for all DHS programs. 
Appendix I

Briefing Slides

Page 44 GAO-07-1065 Homeland Security

33

Objective 1: Legislative Conditions

Condition 1

The fiscal year 2007 US-VISIT expenditure plan, related program 

documentation, and program officials’ statements satisfy (in part or total) 

most, but not all, of the legislative conditions. 

Condition 1. The plan, including related program documentation and program 

officials’ statements, satisfies or partially satisfies all aspects of the capital 

planning and investment control review requirements established by OMB, 

including OMB Circular A-11, part 7.18

The table that follows provides examples of the results of our analysis, including 

areas in which the A-11 requirements have been and have not been fully satisfied. 

Given that the A-11 requirements are intended to minimize a program’s exposure 

to risk, permit performance measurement and oversight, and promote 

accountability, any areas in which the program falls short of the requirements 

reduce the chances of delivering cost-effective capabilities and measurable results 

on time and within budget. 

18 OMB Circular A-11, part 7 establishes policy for planning, budgeting, acquisition, and management of federal capital 

assets.
Appendix I

Briefing Slides

Page 45 GAO-07-1065 Homeland Security

34

Objective 1: Legislative Conditions 

Condition 1

The US-VISIT enterprise risk assessment was completed in December 2005. It 

identified a number of risks, their likelihood of occurrence, their potential impact, 

and recommended controls to address each risk. The most recent version of the 

risk management plan was approved in February 2007. Under the processes 

defined in this plan, risks are to be monitored and reviewed by program 

management and stakeholders through integrated project teams. All identified 

risks are to be logged in the risk database and are to be individually reviewed by 

the Director. Both the Exhibit 300 and the Risk Management Plan address the 

19 OMB-identified risk elements.

Provide a summary of the investment’s 

risk assessment, including how 19 OMBidentified risk elements are being 

addressed.

The expenditure plan and fiscal year 2007 Exhibit 300 provide a description of 

US-VISIT but do not include its status in the DHS capital planning and 

investment control process. According to program officials, the program was reevaluated under the MDP process defined in the draft DHS investment review 

process guide. On February 7, 2007, it passed its first MDP and is now 

undergoing its second MDP review. Also, the expenditure plan and related 

program documents identify a number of program assumptions. Examples of 

assumptions cited in the fiscal year 2007 Exhibit 300 submission include (1) 

existing facilities at land POEs will not support the proposed incorporation of 

biometric devices without investment in equipment and infrastructure, and (2) 

improved exit processes are needed to collect accurate data on departures.

Provide a brief description of the 

investment and its status in the capital 

planning and investment control review, 

including major assumptions made 

about the investment.

Source: OMB criteria and GAO analysis of DHS documentation.

Examples of A-11 Conditions Results of our analysis
Appendix I

Briefing Slides

Page 46 GAO-07-1065 Homeland Security

35

Objective 1: Legislative Conditions 

Condition 1

The plan does not describe US-VISIT relative to the DHS enterprise architecture 

(EA) or the capital planning and investment control process. Moreover, the last 

review of program compliance with the DHS EA was in August 2004, and since 

then US-VISIT and the DHS architecture have changed significantly. With regard 

to the FEA, the fiscal year 2007 OMB Exhibit 300 budget submission contains 

tables that satisfy OMB’s requirement for listing the various aspects of the FEA 

that the program supports. In February 2007, the program completed a MDP1 

review, which program officials told us revalidated the program. The program 

has since submitted to the Enterprise Architecture Center of Excellence its 

MDP2 review package. US-VISIT’s architecture alignment is further discussed 

under the legislative condition 2 section of this briefing. 

Demonstrate that the investment is 

included in the agency’s enterprise 

architecture and capital planning and 

investment control process. Illustrate 

agency’s capability to align the 

investment to the Federal Enterprise 

Architecture (FEA).

As we previously reported, US-VISIT’s 2004 security plan and privacy impact 

assessments generally satisfied OMB and the National Institute of Standards 

and Technology (NIST) security guidance. Further, the expenditure plan states 

that all of the US-VISIT component systems have been certified and accredited 

and given authority to operate. Also, the program office developed a security 

strategy in December 2006 that was based on the 2005 risk assessment. 

However, this security strategy was limited to the systems under US-VISIT 

control and does not mention, for example, the Treasury Enforcement 

Communications System (TECS) which provides biographic information to USVISIT and is owned by Customs and Border Protection. According to NIST 

Special Publication 800-18, a comprehensive security strategy should include all 

component systems. We have ongoing work to evaluate the quality of US-VISIT 

security documents and practices. 

Provide a description of an investment's 

security and privacy issues. Summarize 

the agency's ability to manage security at 

the system or application level. 

Demonstrate compliance with the 

certification and accreditation processes 

as well as the mitigation of IT security 

weaknesses.

Source: OMB criteria and GAO analysis of DHS documentation.

Examples of A-11 Conditions Results of our analysis
Appendix I

Briefing Slides

Page 47 GAO-07-1065 Homeland Security

36

Objective 1: Legislative Conditions 

Condition 1

The program is currently relying on the prime contractor’s EVM system to 

manage the prime contractor’s progress against cost and schedule goals. This 

EVM system was self-certified by the prime contractor in December 2003 as 

meeting established standards, but has yet to be verified by the agency or an 

independent representative of the agency as required by OMB. In December 

2006, the program office contracted with the Defense Contract Management 

Agency to conduct this verification, but it will not be completed until August 2008. 

Finally, while the fiscal year 2006 expenditure plan stated that all US-VISIT 

contractors will perform EVM and program officials stated that this will be 

performed in accordance with DHS guidelines for all contracts after October 1, 

2006, the fiscal year 2007 expenditure plan does not continue to make this 

commitment.

Provide a summary of the investment’s 

status in accomplishing baseline cost 

and schedule goals through the use of an 

earned value management (EVM) 

system or operational analysis, 

depending on the life-cycle stage.

Source: OMB criteria and GAO analysis of DHS documentation.

Examples of A-11 Conditions Results of our analysis
Appendix I

Briefing Slides

Page 48 GAO-07-1065 Homeland Security

37

Objective 1: Legislative Conditions 

Condition 2

Condition 2. The plan, including related program documentation and program 

officials’ statements, partially provides for satisfying the condition that it comply 

with DHS’s EA. 

According to federal guidelines and best practices, investment compliance with an 

EA is essential for ensuring that an organization’s investment in new and existing 

systems is defined, designed, and implemented in a way that promotes integration 

and interoperability and minimizes overlap and redundancy, thus optimizing 

enterprisewide efficiency and effectiveness. A compliance determination is not a 

one-time event that occurs when an investment begins, but is, rather, a series of 

determinations that occurs throughout an investment’s life cycle as changes to both 

the EA and the investment’s architecture are made. 

The DHS Enterprise Architecture Board, supported by the Enterprise Architecture 

Center of Excellence, is responsible for ensuring that projects demonstrate 

adequate technical and strategic compliance with the department’s EA. 
Appendix I

Briefing Slides

Page 49 GAO-07-1065 Homeland Security

38

Objective 1: Legislative Conditions 

Condition 2

The DHS Enterprise Architecture Board has not conducted a detailed review of USVISIT architecture compliance in more than 2 years. In August 2004, the board 

reviewed US-VISIT’s architectural alignment with some aspects of the DHS EA,

and it recommended that US-VISIT be given conditional approval to proceed.19

However, we reported20 in February 2005 that this architectural compliance was 

limited because:

• DHS’ determination was based on version 1.0 of the EA, which was missing, in 

part or in whole, all the key elements expected in a well-defined architecture, 

such as a description of business processes, information flows among these 

processes, and security rules associated with these information flows. 

• DHS did not provide sufficient documentation to allow us to understand the 

methodology and criteria for architecture compliance or to verify analysis 

justifying the conditional approval.

19The condition was that the program office resubmit documentation upon approval of the US-VISIT strategic plan, which 

at the time was to be January 2005. 

20 GAO, Homeland Security: Some Progress Made, but Many Challenges Remain on U.S. Visitor and Immigrant Status 

Indicator Technology Program, GAO-05-202 (Washington D.C.: Feb. 23, 2005).
Appendix I

Briefing Slides

Page 50 GAO-07-1065 Homeland Security

39

Objective 1: Legislative Conditions 

Condition 2

Moreover, the next architecture alignment review did not occur until more than 2 

years later, in November 2006. This review was part of US-VISIT’s MDP1 

revalidation review, and it focused on compliance with 2 components of the DHS 

EA 2006. In February 2007 US-VISIT received MDP1 approval with the stipulation 

that the program undergo a MDP2 review within 60 days.

This February 2007 MDP1 alignment determination does not fully satisfy the 

legislative condition for several reasons. 

• The review was based on US-VISIT documentation that was not current. In 

particular, the US-VISIT Mission Needs Statement21 did not reflect recent 

changes to the program, such as the IDENT/IAFIS interoperability and 

expansion of IDENT to collect 10, rather than 2, prints. 

• The review assessed compliance with only general aspects of the DHS EA, 

such as the investment portfolio, the architecture principles, and the business 

model. It did not include US-VISIT’s compliance with other relevant aspects of 

the EA, such as the data and information security components. 

21 Department of Homeland Security, US-VISIT Mission Needs Statement (Washington, D.C.: Nov. 20, 2003).
Appendix I

Briefing Slides

Page 51 GAO-07-1065 Homeland Security

40

Objective 1: Legislative Conditions 

Condition 2

• The review was based on DHS EA 2006. We reported22 in May 2007 that this 

version was missing important architectural content and did not address most 

of the comments made by DHS stakeholders. As a result, we concluded that it 

was not complete, consistent, understandable, or usable.

Program officials told us that they submitted documentation for a more 

comprehensive MDP2 alignment review to the Enterprise Architecture Centers of 

Excellence in April 2007. They also stated that they have mitigated the risks of USVISIT being misaligned with the DHS EA through other means. These included:

• submitting the technical baseline of existing hardware and software to the EA 

Center for Excellence for inclusion in the DHS EA;

• submitting technology insertion requests for new equipment planned for USVISIT, such as RFID technology, to the EA Center of Excellence for review and 

inclusion in the DHS EA, and 

• relating US-VISIT capabilities with the business and services models of the 

FEA reference models. 22 GAO, Homeland Security: DHS Enterprise Architecture Continues to Evolve, But Improvements Needed, GAO-07-564 

(Washington D.C.: May 9, 2007). 
Appendix I

Briefing Slides

Page 52 GAO-07-1065 Homeland Security

41

Objective 1: Legislative Conditions 

Condition 2

Notwithstanding these steps, DHS has yet to demonstrate, through verifiable 

documentation and methodologically-based analysis, that US-VISIT is aligned with 

a well-defined DHS EA. As a result, the program will remain at risk of being 

defined and implemented in a way that does not support optimized departmentwide 

operations, performance, and achievement of strategic goals and outcomes.
Appendix I

Briefing Slides

Page 53 GAO-07-1065 Homeland Security

42

Objective 1: Legislative Conditions 

Condition 3

Condition 3. The plan, including related program documentation and program 

officials’ statements, partially provides for satisfying the condition that it comply 

with the acquisition rules, requirements, guidelines, and systems acquisition 

management practices of the federal government.23

Federal IT acquisition requirements, guidelines, and management practices provide 

an acquisition management framework that is based on the use of rigorous and 

disciplined processes for planning, managing, and controlling the acquisition of IT 

resources.24 Effective acquisition management processes are embodied in 

published best practices models, such as the Software Engineering Institute (SEI) 

Capability Maturity Models®. These models explicitly define, among other things, 

acquisition process management controls that are recognized hallmarks of 

successful organizations and that, if implemented effectively, can greatly increase 

the chances of acquiring software-intensive systems that provide promised 

capabilities on time and within budget.

23 We did not review the program’s compliance with the Federal Acquisition Regulation. 24 See, for example, the Clinger-Cohen Act of 1996, Pub. L. No. 104-106, (Feb. 10, 1996) and OMB Circular A-130.
Appendix I

Briefing Slides

Page 54 GAO-07-1065 Homeland Security

43

Objective 1: Legislative Conditions 

Condition 3

We reported in September 200325 that the program office had not defined key 

acquisition management controls to support the acquisition of US-VISIT, and 

therefore its efforts to acquire, deploy, operate, and maintain system capabilities 

were at risk of not meeting system requirements and benefit expectations on time 

and within budget. 

Subsequently, the program adopted SEI Capability Maturity Model Integration26

(CMMI®) to guide its efforts to employ effective acquisition management practices 

and approved an acquisition management process improvement plan dated May 

16, 2005. One of the goals of this plan was to achieve a CMMI® level 2 capability 

rating from SEI by October 2006. 

25 GAO, Homeland Security: Risks Facing Key Border and Transportation Security Program Need to be Addressed, GAO-03-

1083 (Washington D.C.: Sept. 19, 2003). 

26 The CMMI® ranks organizational maturity according to five levels. Maturity levels 2 through 5 require verifiable existence and 

use of certain key process areas.
Appendix I

Briefing Slides

Page 55 GAO-07-1065 Homeland Security

44

Objective 1: Legislative Conditions 

Condition 3

In September 2005, DHS’s initial assessment of 13 US-VISIT key acquisition 

process areas revealed a number of weaknesses. In light of this, US-VISIT updated 

its acquisition management process improvement plan, narrowing the scope of the 

process improvement activities to six of the CMMI process areas--project planning, 

project monitoring and control, requirements management, risk management, 

configuration management, and product and process quality assurance—and 

focusing on two US-VISIT projects—U.S. Travel Documents-ePassports (formerly 

Increment 2A) and Unique Identity. Under the updated plan, the goal for an 

external CMMI evaluation remained October 2006. 

During 2006, the program conducted periodic assessments in the six key process 

areas and reported that while it had increased the number of fully and largely 

implemented practices within these six areas, sufficient progress had not been 

made to pass an external evaluation in October 2006. Some of the weaknesses 

reported were: 
Appendix I

Briefing Slides

Page 56 GAO-07-1065 Homeland Security

45

Objective 1: Legislative Conditions 

Condition 3

• Insufficient definition of processes and preparation of supporting documents for 

areas such as systems development, budget and finance, facilities, and 

strategic planning (e.g., product work flow among organizational units was 

unclear and not documented, and roles, responsibilities, and assignments for 

performing work tasks and activities were not adequately defined and 

documented).

• Lack of policies, process descriptions, and templates for requirements 

development and management.

• Lack of definition of roles, responsibilities, work products, expectations, 

resources, and accountability of external stakeholder organizations.

The program has since revised its process improvement plan. Among other things, 

the revised plan delays the date for having an external CMMI evaluation from 

October 2006 to November 2007. At the same time, it has continued to address the 

weaknesses discovered during earlier internal assessments. Based on its latest 

periodic assessment (March 2007), the program office reports that 83 percent of 

key practices are now either fully or largely implemented, up from 26 percent in 

August 2005 (see chart on next slide).
Appendix I

Briefing Slides

Page 57 GAO-07-1065 Homeland Security

46

Objective 1: Legislative Conditions 

Condition 3

Status of US-VISIT Implementation of 113 Key Practices Associated with Six CMMI Key Process 

Areas 

0

10

20

30

40

50

60

70

80

August 2005 June 2006 November 2006 March 2007

Implemented Practices

Largely Implemented Practices

Partially Implemented Practices

Not Implemented Practices

Source: GAO, based on an analysis of DHS data.
Appendix I

Briefing Slides

Page 58 GAO-07-1065 Homeland Security

47

Objective 1: Legislative Conditions 

Condition 3

In addition, the fiscal year 2007 expenditure plan reported progress in a seventh 

key process area not included in the program’s CMMI improvement efforts—

contract tracking and oversight.

• In 2006, we reported27 that the program office had not effectively overseen 

US-VISIT related contract work performed on its behalf by other DHS and 

non-DHS agencies, and these agencies did not always establish and 

implement the full range of controls associated with effective management 

of contractor activities. Further, neither the program office nor the other 

agencies had implemented effective financial controls.28

• Since this report was issued, the program office has instituted the use of 

oversight plans for new task order and contract awards and is developing a 

set of requirements for reimbursable contracts that address our 

recommendations to enhance the probability of successful performance and 

reduce risks. 

27 GAO, Homeland Security: Contract Management and Oversight for Visitor and Immigrant Status Program Need to 

Be Strengthened, GAO-06-404 (Washington, D.C.: June 9, 2006). 28 Financial controls include practices to provide accurate, reliable, and timely accounting for billings and 

expenditures.
Appendix I

Briefing Slides

Page 59 GAO-07-1065 Homeland Security

48

Objective 1: Legislative Conditions 

Condition 3

Notwithstanding this reported progress in implementing acquisition management 

process areas, the program’s acquisition management improvement efforts are 

focused on only seven acquisition management process areas. Other areas are 

also relevant to the program and need to be addressed. The status of the program 

office’s efforts to implement our recommendations aimed at implementing the full 

range of acquisition management controls is discussed later in this briefing.
Appendix I

Briefing Slides

Page 60 GAO-07-1065 Homeland Security

49

Objective 1: Legislative Conditions 

Condition 4

Condition 4. The plan satisfies the condition that it include a certification by the 

DHS CIO that an IV&V agent is currently under contract for the project. 

On February 21, 2007, the DHS Deputy CIO certified in writing that two 

independent verification and validation agents29 were under contract for US-VISIT 

and that these agents met the requirements and standards for an IV&V agent. 

29 One IV&V contractor was obtained to assess organizational program risk. The second IV&V contractor was obtained to 

independently assess system testing activities.
Appendix I

Briefing Slides

Page 61 GAO-07-1065 Homeland Security

50

Objective 1: Legislative Conditions 

Condition 5

Condition 5. The plan, including related program documentation and program 

officials’ statements, satisfies the requirement that it be reviewed and approved by 

the DHS Investment Review Board, the Secretary of Homeland Security, and OMB. 

• The DHS Deputy Secretary, who is also the chair of the Investment Review 

Board, approved the fiscal year 2007 expenditure plan, and 

• OMB approved the plan on March 20, 2007. 
Appendix I

Briefing Slides

Page 62 GAO-07-1065 Homeland Security

51

Objective 1: Legislative Conditions 

Condition 6

Condition 6. The plan satisfies the requirement that it be reviewed by GAO. 

Our review was completed on June 15, 2007.
Appendix I

Briefing Slides

Page 63 GAO-07-1065 Homeland Security

52

Objective 1: Legislative Conditions 

Condition 7

Condition 7. The plan does not satisfy the condition that it include a 

comprehensive US-VISIT strategic plan.

Strategic plans are the starting point and basic underpinning for results-oriented 

management. Such plans articulate the fundamental mission of an organization, or 

program, and lay out its long-term goals and objectives for implementing that 

mission, including the resources needed to reach these goals. Federal legislation 

and guidelines30 require that agencies’ strategic plans include six key elements: (1) 

a comprehensive mission statement, (2) strategic goals and objectives, (3) 

strategies and the various resources needed to achieve the goals and objectives, 

(4) a description of the relationship between the strategic goals and objectives and 

annual performance goals, (5) an identification of key external factors that could 

significantly affect the achievement of strategic goals, and (6) a description of how 

program evaluations were used to develop or revise the goals and a schedule for 

future evaluations. As we have previously reported,31 (cont’d)

30 Government Performance and Results Act of 1993, Pub. L. No. 103-62 (Aug. 3, 1993) and OMB Circular A-11, Preparation, 

Submission, and Execution of the Budget, (June 30, 2006) provide guidance in this instance since the US-VISIT strategic 

plan is not an agencywide strategic plan.

31 GAO, Managing for Results: Critical Issues for Improving Federal Agencies’ Strategic Plans, GAO/GGD-97-180 

(Washington, D.C.: Sep. 16, 1997).
Appendix I

Briefing Slides

Page 64 GAO-07-1065 Homeland Security

53

Objective 1: Legislative Conditions 

Condition 7

strategic plans should also include a discussion of management challenges facing 

the program that may threaten its ability to meet long-term, strategic goals and 

efforts to coordinate among cross-cutting programs, activities, or functions. 

While the US-VISIT program is not required to explicitly follow these guidelines, the 

guidelines nonetheless provide a framework for effectively developing strategic 

plans and the basis for program accountability. However, the US-VISIT strategic 

plan32 does not include any of these key elements associated with effective 

strategic plans. In summary, the plan describes eight desired program capabilities33

and provides an implementation strategy that describes how each of these 

capabilities will be delivered over a multi-year investment horizon through three 

categories of activities – Foundation, Transformation, and Globalization.

32 The fiscal year 2007 expenditure plan contains an appendix titled “Comprehensive Strategic Plan for US-VISIT,” which the

US-VISIT Program Director told us is the program’s approved strategic plan. 33 The eight capabilities are: (1) identify a person, (2) assess risk and eligibility, (3) record entry, exit, and status, 

(4) take law enforcement actions, (5) communicate with external entities, (6) manage knowledge, information, and intelligence, 

(7) manage the immigration and border management enterprise and (8) infrastructure development. In an earlier section of the 

strategic plan, only seven of the capabilities are discussed, omitting “infrastructure development.”
Appendix I

Briefing Slides

Page 65 GAO-07-1065 Homeland Security

54

Objective 1: Legislative Conditions 

Condition 7

• Foundation activities, which are described as modernization, enhancement, 

and expansion of capabilities and technologies, as well as leveraging current 

capabilities and technologies.

• Transformation activities, which are described as the implementation of 

processes and technologies that cut across the particular functions and entities 

that make up the immigration and border management system.

• Globalization activities, which are described as the coordination and sharing of 

information with foreign governments to improve the ability to detect and 

prevent potential threats from either entering the United States or remaining 

here.
Appendix I

Briefing Slides

Page 66 GAO-07-1065 Homeland Security

55

Objective 1: Legislative Conditions 

Condition 7

However, the plan does not provide time frames for the completion of these broad 

investment categories. The plan also does not include strategic goals and 

objectives or strategies for achieving goals and objectives. As a result, it is not 

clear what program capabilities will be delivered when and whether they are 

aligned with the program’s goals and objectives. Further, the plan does not include 

a comprehensive mission statement, describe the relationships between strategic 

goals and annual performance goals, the external factors that could affect the 

program, and the program evaluations used to establish or revise the goals. 

In addition, the US-VISIT strategic plan does not address management challenges 

facing the program, such as those addressed in our past recommendations. And 

although the strategic plan identifies the ability to communicate with external 

stakeholders as a desired capability, the plan does not provide any evidence of 

such past communication or explain the relationship between US-VISIT and other 

organizations within the border and immigration management enterprise. For 

example, it does not describe the relationship between US-VISIT and DHS’s 

Western Hemisphere Travel Initiative, even though both programs involve the entry 

of certain foreign individuals at U.S. POEs.
Appendix I

Briefing Slides

Page 67 GAO-07-1065 Homeland Security

56

Objective 1: Legislative Conditions 

Condition 7

While the strategic plan is missing important content, other related program 

documentation includes some of this content. For example, the fiscal year 2007 

expenditure plan and the US-VISIT Mission Needs Statement state the program’s 

mission and goals. In addition, the US-VISIT Program Blueprint describes eight 

core capabilities, which are very similar to those described in the strategic plan, 

and maps those capabilities to four business outcomes. However, the Blueprint 

does not include strategic goals, so it is not clear whether the business outcomes 

are aligned with US-VISIT’s goals. Further, the outcomes are not described in the 

strategic plan.

The Program Blueprint also notes that responsibilities for immigration and border 

management are spread across multiple agencies and departments. However, it 

does not provide clear delineations of these organizations’ respective tasks, 

services, or efforts. Further, the strategic plan does not cite or describe any 

coordination efforts to address this situation. Additionally, the Blueprint identifies 

border and immigration management enterprise stakeholders and identifies, for 

each stakeholder, needs and priorities, challenges, how the business outcomes will 

benefit the stakeholder, and stakeholder constraints that will affect business 

outcomes.
Appendix I

Briefing Slides

Page 68 GAO-07-1065 Homeland Security

57

Objective 1: Legislative Conditions 

Condition 7

This means that while some of the content of a US-VISIT strategic plan is captured 

in a fragmented fashion across a range of documents, the full range of content 

needed to define an authoritative strategic direction, focus, and roadmap for the 

program that is approved by departmental leadership is missing. Without it, DHS 

reduces the chances that the US-VISIT program will achieve desired results and 

succeed in achieving the program’s goals and objectives. 
Appendix I

Briefing Slides

Page 69 GAO-07-1065 Homeland Security

58

Objective 1: Legislative Conditions 

Condition 8

Condition 8. The plan, including related program documentation and program 

officials’ statements, does not satisfy the condition that it include a complete 

schedule for biometric exit implementation.

The fiscal year 2007 expenditure plan addresses DHS’ near-term deployment plans 

for biometric exit capabilities at air and sea POEs. Further, it notes the absence of 

near-term biometric options for land POEs and mentions only a possible near-term, 

interim option that is being considered. In addition, the expenditure plan addresses 

all three locations of US-VISIT technology (air, sea, and land). However, the 

expenditure plan’s discussion of exit capabilities is conceptual and general and 

does not contain a schedule for the full implementation of US-VISIT exit capabilities 

at air, sea and land POEs.
Appendix I

Briefing Slides

Page 70 GAO-07-1065 Homeland Security

59

Objective 1: Legislative Conditions 

Condition 8

Air

The plan states that DHS plans to incorporate air exit into the airline check-in 

process. However, the plan does not provide any details as to what capabilities will 

be acquired and deployed when and at what cost. Instead, it states that DHS plans 

to integrate US-VISIT’s efforts with CBP’s pre-departure Advance Passenger 

Information System34 and TSA’s Secure Flight35 for purposes of partnering with the 

airline industry. Further, the plan does not include any schedule of air exit 

implementation activities, but rather, simply states that DHS plans to initiate efforts 

on its air exit solution at an unspecified time during the third quarter of fiscal year 

2007, and will fully deploy the air exit solution by an unspecified time during 

calendar year 2008. 

34The Advanced Passenger Information System captures arrival and departure manifest information provided by air and

sea carriers.

35 Secure Flight is a program being developed by TSA to prescreen passengers – or match passenger information against 

terrorist watch lists to identify individuals who should undergo additional security scrutiny – for domestic flights.
Appendix I

Briefing Slides

Page 71 GAO-07-1065 Homeland Security

60

Objective 1: Legislative Conditions 

Condition 8

On June 11, 2007, DHS provided us with a schedule for air exit, which the 

department characterized as high-level. For example, it does not include the 

underlying details supporting the timelines for such areas of activity as system 

design, system testing, and system development. However, program officials told 

us that greater detail existed to support the schedule, but that because this had not 

been approved by DHS, could not be provided. The schedule provided indicates 

that the air exit solution will be fully deployed by June 2009, which is at least six 

months after the deployment date provided in the expenditure plan.

Sea

The plan states that DHS will initiate planning efforts on the sea exit deployment at 

an unspecified time during fiscal year 2007, and that it will emulate the technology 

and operational plans used for the air exit solution. However, the plan does not 

provide any details about how, when, and at what cost the sea exit solution will be 

accomplished, or provide a completion date or any interim dates.

36GAO, Border Security: US-VISIT Program Faces Strategic, Operational, and Technological Challenges at Land Ports of 

Entry, GAO-07-248 (Washington, D.C.: Dec. 6, 2006).
Appendix I

Briefing Slides

Page 72 GAO-07-1065 Homeland Security

61

Objective 1: Legislative Conditions 

Condition 8

Land

Consistent with our December 2006 report,36 the plan states that implementing a 

biometric exit solution at land POEs is significantly more complicated and costly 

than air or sea exit because it would require a costly expansion of existing exit 

capacity, including physical infrastructure, land acquisition, and staffing. Because of 

this, the plan concludes that land exit cannot be practically based on biometric 

validation in the short term. In lieu of biometric-based exit at land POEs in the near 

term, the plan states that DHS will initially seek to match entry and exit records 

using biographic information in instances where departure information is not 

collected from an individual who leaves the country, as in the case of an individual 

who does not submit their Form I-9437 upon departure. 

36GAO, Border Security: US-VISIT Program Faces Strategic, Operational, and Technological Challenges at Land Ports of 

Entry, GAO-07-248 (Washington, D.C.: Dec. 6, 2006). 37I-94 forms are used to track foreign nationals’ arrivals and departures. Each form is divided into two parts: an entry portion 

and an exit portion. Each form contains a unique number printed on both portions of the form for the purposes of subsequent

recording and matching the arrival and departure records for nonimmigrants.
Appendix I

Briefing Slides

Page 73 GAO-07-1065 Homeland Security

62

Objective 1: Legislative Conditions 

Condition 8

However, the plan does not specify what this near-term focus entails and how, 

when, and at what cost it will be accomplished. Rather, it says that DHS has not yet 

determined a time frame or any cost estimates for the initiation of a land exit 

solution.
Appendix I

Briefing Slides

Page 74 GAO-07-1065 Homeland Security

63

Objective 2: Open Recommendations

Recommendation 1

Recommendation 1: Develop and begin implementing a system security plan and 

perform a privacy impact analysis and use the results of this analysis in near-term 

and subsequent system acquisition decision-making.

Status: Partially complete

A system security plan and privacy impact assessment are important to 

understanding system requirements and ensuring that the proper safeguards are in 

place to protect system data, resources, and individuals’ privacy. Both best 

practices and federal guidance advocate their development and use. 

System Security Plan

The purpose of a system security plan is to define the steps that will be taken (i.e., 

security controls that will be implemented) to cost-effectively address known 

security risks. We reported38 in 2005 that the program office developed a US-VISIT 

system security plan that was generally consistent with federal practice. However, 

we also reported at that time that the plan was not based on a security risk 

assessment.

38 GAO-05-202.
Appendix I

Briefing Slides

Page 75 GAO-07-1065 Homeland Security

64

Objective 2: Open Recommendations

Recommendation 1

In December 2005, the program office developed a US-VISIT risk assessment that 

addressed the risk elements required by OMB, including having an inventory of 

known risks, their probability of occurrence and impact, and recommended controls 

to address them. At that time, program officials told us that they intended to 

develop a US-VISIT security strategy that reflected the results of this risk 

assessment.

In December 2006, the program office developed a US-VISIT security strategy and 

has since begun implementing it. For example, it has conducted security 

evaluations of commercial off-the-shelf software products before adding them to 

the program’s technical baseline. However, the scope of this strategy does not 

extend to all the systems that comprise US-VISIT. For example, the Treasury 

Enforcement Communications System (TECS), an integral component of USVISIT, is not under the US-VISIT inventory of systems because it is owned by 

Customs and Border Protection. 
Appendix I

Briefing Slides

Page 76 GAO-07-1065 Homeland Security

65

Objective 2: Open Recommendations

Recommendation 1

The fact that the US-VISIT security strategy’s scope is limited to only systems that 

the program office owns is not consistent with our recommendation. We have 

ongoing work to evaluate the quality of US-VISIT security documents and 

practices, including TECS implementation of security controls.

Privacy Impact Assessment

The purpose of a privacy impact assessment is to ensure handling of information 

conforms to applicable legal, regulatory, and policy requirements regarding privacy, 

determine the risks and effects of collecting, maintaining, and disseminating 

information in identifiable form39 in an electronic information system, and examine 

and evaluate protections and alternative processes for handling information to 

mitigate potential privacy risks. 

39 Information in a form that permits individuals to be identified.
Appendix I

Briefing Slides

Page 77 GAO-07-1065 Homeland Security

66

Objective 2: Open Recommendations

Recommendation 1

In February 2006, we reported40 that the program office had developed and 

periodically updated a privacy impact assessment. However, we also reported that 

system documentation only partially addressed privacy. Since then, program 

officials told us that they have taken steps to ensure that the impact assessment’s 

results are used in deciding and documenting the content of US-VISIT projects. For 

example, they said that privacy office representatives are included in key project 

definition, design, and development meetings to ensure that privacy issues are 

addressed and that key system documentation now reflects privacy-based needs. 

Furthermore, US-VISIT privacy officials recently conducted an audit of system 

documentation to ensure that privacy is being addressed. They found only a single 

instance where privacy should have been addressed in system documentation but 

was not. Finally, our review of recently issued system documentation shows 

privacy concerns are being addressed.

40 GAO, Homeland Security: Recommendations to Improve Management of Key Border Security Program Need to Be 

Implemented, GAO-06-296 (Washington, D.C.: February 14, 2006).
Appendix I

Briefing Slides

Page 78 GAO-07-1065 Homeland Security

67

Objective 2: Open Recommendations

Recommendation 2

Recommendation 2: Develop and implement a plan for satisfying key acquisition 

management controls, including acquisition planning, solicitation, requirements 

management, project management, contract tracking and oversight, evaluation, 

and transition to support, and implement the controls in accordance with Software 

Engineering Institute (SEI) guidance.41

Status: Partially complete

Effective acquisition management controls are important contributors to the 

success of programs like US-VISIT. SEI has defined a range of acquisition 

management controls as part of its capability maturity models, which, when 

properly implemented, have been shown to increase the chances of delivering 

promised system capabilities on time and within budget. 

In June 2003, we first reported42 that the program did not have key acquisition 

management controls in place, and we reiterated this point in September 2003.43

41 This recommendation is the merger of two of our prior recommendations.

42 GAO, Information Technology: Homeland Security Needs to Improve Entry Exit System Expenditure Planning, GAO-03-

563 (Washington, D.C.: June 9, 2003).

43 GAO-03-1083.
Appendix I

Briefing Slides

Page 79 GAO-07-1065 Homeland Security

68

Objective 2: Open Recommendations

Recommendation 2

In May 2005, the program office developed a plan for satisfying SEI acquisition 

management guidance and began implementing it. Its 2005 assessment addressed 

13 SEI key process areas, a number of which were consistent with the seven 

management controls that we recommended. 

In April 2006, the program office updated its plan to focus on six key process areas: 

acquisition project planning, requirements management, project monitoring and 

control, risk management, configuration management, and product and process 

quality assurance.

Since 2005, the program office reports that it has made progress in implementing 

the 113 practices associated with these six key process areas, as previously 

discussed. However, the six areas of focus do not include all of the management 

controls that we recommended. For example, solicitation, contract tracking and 

oversight, and transition to support are not included. While the program office 

reports that it has also addressed contract tracking and oversight as part of 

responding to a later recommendation that we made (not one of the nine 

recommendations addressed in this briefing), it also reports that it has yet to 

address the other two management controls. 
Appendix I

Briefing Slides

Page 80 GAO-07-1065 Homeland Security

69

Objective 2: Open Recommendations

Recommendation 2

It is important for the program office to address all of the management controls that 

we recommended. If it does not, it will unnecessarily increase program risks.
Appendix I

Briefing Slides

Page 81 GAO-07-1065 Homeland Security

70

Objective 2: Open Recommendations

Recommendation 3

Recommendation 3: Ensure that expenditure plans fully disclose what system 

capabilities and benefits are to be delivered, by when, and at what cost, as well as 

how the program is being managed.

Status: Partially complete

The fiscal year 2007 expenditure plan discloses planned system capabilities, 

estimated schedules and costs, and expected benefits, but meaningful information 

about schedules, costs, and benefits is missing. Further, while the plan does 

provide information on some acquisition activities, it does not adequately describe 

how the program is being managed in a number of areas and does not disclose the 

management challenges that it continues to face. Without such information, the 

expenditure plan does not provide Congress with enough information to exercise 

effective oversight and hold the department accountable. 
Appendix I

Briefing Slides

Page 82 GAO-07-1065 Homeland Security

71

Objective 2: Open Recommendations

Recommendation 3

Schedule

The fiscal year 2007 expenditure plan provides time commitments for some 

capabilities; however, these are not specific. For example, the plan states the 

following:

• Unique Identity

• Deployment of 10-print pilot to 10 air locations to begin in late 2007.

• Initial Operating Capability functionality targeted for September 2008.

• Exit 

• Air exit solution deployment will begin in third quarter 2007 and continue 

through 2008. 

• Begin work in fiscal year 2007 on sea exit deployment that will emulate 

technology and operational plans adopted for commercial aviation

environment.
Appendix I

Briefing Slides

Page 83 GAO-07-1065 Homeland Security

72

Objective 2: Open Recommendations

Recommendation 3

Moreover, no schedule commitments are made for the development and 

deployment of PKD validation capabilities.

Costs

The fiscal year 2007 expenditure plan identifies each project’s funding. In some 

cases, this information is provided with meaningful detail that allows for 

understanding of how the funds will be used. For example 

• Unique Identity shows the following activities and costs:

• Acquisition and Procurement ($21.2 million)—purchase and initial 

deployment of 10-print capture devices and upgrades in network 

capabilities (bandwidth and technology refreshes) at 119 airports, 9 

seaports, and 155 land ports. 

• Update DHS Border and Process Technology ($2.0 million)—update 

device to client biometric interfaces and further 10-print prototype testing 

and evaluation.
Appendix I

Briefing Slides

Page 84 GAO-07-1065 Homeland Security

73

Objective 2: Open Recommendations

Recommendation 3

However, in other cases, costs are not described at a level that would permit such 

understanding. For example: 

• Contractor Services (Project Assigned) ($12.1 million) - contractor services 

and support for the project-related resource planning and management 

(including the areas of configuration, acquisition, and risk), as well as project 

performance metrics and reporting in the areas of cost, schedule, scope, and 

quality management. This exact wording is also used for this category in two 

other projects with different costs. 

In addition, unlike prior expenditure plans, carryover funds from prior years that are 

planned for use in 2007 are not allocated to 2007 activities. For example: 

• Exit - A total of $7.3 million in fiscal year 2007 funds, plus fiscal year 2006 

carryover funds of $20 million are mentioned as being allocated to begin the 

process of deploying DHS’ integrated air exit strategy and initial planning for 

sea exit. However, only the $7.3 million is allocated among the activities listed. 

No information is presented regarding the allocation of the $20 million in 

carryover funds to these activities or any others.
Appendix I

Briefing Slides

Page 85 GAO-07-1065 Homeland Security

74

Objective 2: Open Recommendations

Recommendation 3

Benefits

The fiscal year 2007 expenditure plan cites benefits associated with the projects. 

However, the benefits are broadly stated. For example, the plan describes exit 

benefits as “Safer and more secure travel” and Unique Identity benefits as 

“Facilitation of efficient, yet secure, trade and travel.”

Acquisition Management

The 2007 expenditure plan describes a range of key acquisition management 

activities and control areas. These include: 

• Requirements development and management 

• Configuration management

• Data governance

However, the plan does not fully disclose challenges that the program faces in 

managing acquisition activities, nor does it discuss key areas in which change is 

occurring, such as capital planning and investment controls and human capital 

management.
Appendix I

Briefing Slides

Page 86 GAO-07-1065 Homeland Security

75

Objective 2: Open Recommendations

Recommendation 4 

Recommendation 4: Ensure that the human capital and financial resources are 

provided to establish a fully functional and effective program office and associated 

management capability. 

Status: Partially complete

DHS established the US-VISIT program office in July 2003 and determined the 

office’s staffing needs to be 115 government and 117 contractor personnel. In 

September 2003, we reported44 that the program office lacked adequate human 

capital and financial resources. In August 2004, the program office, in conjunction 

with OPM developed a draft human capital plan. Agency officials stated that, at one 

point in 2006, all of the 115 government positions were filled. In addition, the 

program has received about $1.4 billion in funding, and we recently reported that it 

has devoted an increasing proportion of its annual appropriation to program office 

and related management activities.

44 GAO-03-1083.
Appendix I

Briefing Slides

Page 87 GAO-07-1065 Homeland Security

76

Objective 2: Open Recommendations

Recommendation 4 

Since then, however, 21 of the government positions have become vacant. 

According to program officials, they have taken interim steps to address this void in 

leadership by temporarily assigning other staff to cover them. They added that they 

plan to fill all the positions through aggressive recruitment and that they do not 

consider the vacancies to present a risk to the program. However, without 

adequate human capital, particularly in key positions and for extended periods, 

program risks will invariably increase.
Appendix I

Briefing Slides

Page 88 GAO-07-1065 Homeland Security

77

Objective 2: Open Recommendations

Recommendation 5

Recommendation 5: Clarify the operational context within which US-VISIT must 

operate.

Status: Partially complete

As we have previously reported, all programs exist within a larger operational (and 

technological) context or frame of reference that is captured in such strategically 

focused instruments as strategic plans and an EA. Additionally, having a strategic 

plan and an EA are recognized best practices and provided for in federal guidance.

In 2003, we reported45 that DHS had yet to define the operational context in which 

US-VISIT is to operate, such as a well-defined department EA or a departmentally 

approved strategic plan. In the absence of this operational context, we stated that 

program officials could make assumptions and decisions that, if they proved 

inconsistent with subsequent departmental policy decisions, would require USVISIT rework to make it interoperable with related programs and systems, such as 

the FBI’s 10-print biometric identity system known as IAFIS. Moreover, we stated 

that US-VISIT could be defined and implemented in a way that made it duplicative 

of other programs and systems, such as the Secure Border Initiative or the 

Western Hemisphere Travel Initiative.

45 GAO-03-1083.
Appendix I

Briefing Slides

Page 89 GAO-07-1065 Homeland Security

78

Objective 2: Open Recommendations

Recommendation 5

Since then, we have continued to report on the absence of this context. Most 

recently, we reported46 in February 2006 that this operational context was still a 

work in process. Specifically, we found that although a strategic plan was drafted 

that program officials said showed how US-VISIT was aligned with DHS’s 

organizational mission and defined an overall vision for immigration and border 

management across multiple departments and external stakeholders with common 

objectives, strategies, processes, and infrastructures, this plan had been awaiting 

departmental approval at that time for more than 11 months. 

In February 2007, we reported46 that US-VISIT was still lacking a departmentally 

approved operational context, and that this was exacerbated by DHS’s recent 

launching of other major programs without defining their relationships to US-VISIT. 

Examples of these programs are:

• Secure Border Initiative (SBI), a multi-year program to secure the borders 

and reduce illegal immigration by installing state-of-the-art surveillance 

technologies along the border, increasing border security personnel, and 

ensuring information access to DHS personnel at and between ports of 

entry.

46 GAO-06-296. 47 GAO-07-278.
Appendix I

Briefing Slides

Page 90 GAO-07-1065 Homeland Security

79

Objective 2: Open Recommendations

Recommendation 5

• Western Hemisphere Travel Initiative (WHTI), which is to implement the 

provisions of the Intelligence Reform and Terrorism Prevention Act of 200448

requiring citizens of the United States, Canada, Bermuda, and Mexico to have 

a designated document for entry or re-entry into the United States that 

establishes the bearer’s identity and citizenship. 

US-VISIT continues to lack a well-defined operational context. 

• As discussed earlier in this briefing, the fiscal year 2007 expenditure plan 

includes an appendix titled “Comprehensive Strategic Plan for US-VISIT,” 

which the Program Director told us is the department’s officially approved USVISIT strategic plan. However, as we discussed in the legislative conditions 

section of the briefing, key elements of relevant federal guidance for a strategic 

plan are not addressed in this plan. For example, no specific outcome-related 

goals for major functions and operations of US-VISIT or specific objectives to 

meet those goals are provided, nor does it address external factors that could 

affect achievement of program goals. Finally, this strategic plan does not 

address the explicit relationships between US-VISIT and either the SBI or 

WHTI programs. 48 Pub. L. No. 108-458, § 7209, 118 Stat. 3638, 3823 (Dec. 17, 2004).
Appendix I

Briefing Slides

Page 91 GAO-07-1065 Homeland Security

80

Objective 2: Open Recommendations

Recommendation 5

• We recently reported49 that DHS’s EA has evolved beyond prior versions. 

However, the DHS EA 200650 was not complete for several reasons. For 

example, it was missing architecture content, such as a transition plan and 

evidence of a gap analysis between the “as is” and “to be” architectures, and it 

was developed with limited stakeholder input: support contractors and 

organizational stakeholders provided a range of comments on completeness, 

internal consistency, and understandability of a draft of the EA, but the majority 

of comments were not addressed. Because the EA was not complete,

internally consistent and understandable, we concluded that its usefulness was 

limited, in turn limiting DHS’s ability to guide and constrain IT investments in a 

way that promotes interoperability and reduces overlap and duplication. 

49 GAO-07-564. 50 The focus of our review was the DHS EA 2006. In March 2007, DHS issued HLS 2007.
Appendix I

Briefing Slides

Page 92 GAO-07-1065 Homeland Security

81

Objective 2: Open Recommendations

Recommendation 5

Program officials told us that they have met with related programs to coordinate 

their respective efforts. They stated that DHS’s Office of Screening Coordination 

and Operations (SCO) has been trying to coordinate and unify the departmental 

components’ initiatives by bringing border management stakeholders together. 

However, specific coordination efforts have not been assigned to the SCO or any 

other DHS entity. 

The absence of a well-defined operational context within which to define and 

pursue US-VISIT has been long-standing. Until this context exists, the department 

will be challenged in its ability to define and implement US-VISIT and related 

border security and immigration management programs in a manner that promotes 

interoperability, minimizes duplication, and optimizes departmental capabilities and 

performance.
Appendix I

Briefing Slides

Page 93 GAO-07-1065 Homeland Security

82

Objective 2: Open Recommendations

Recommendation 6

Recommendation 6: Determine whether proposed US-VISIT increments will 

produce mission value commensurate with costs and risks and disclose to its 

executive bodies and the Congress the results of these business cases and 

planned actions.51

Status: Partially complete

The decision to invest in any system capability should be based on reliable 

analysis of return on investment. Moreover, according to relevant guidance, 

incremental investments in major systems should be individually supported by 

such analyses of benefits, costs, and risks. Without such analyses, an 

organization cannot adequately know that a proposed investment is a prudent 

and justified use of limited resources. 

In June and September 2003, and in February 2005, we reported52 that proposed 

investments in the then entry/exit system, US-VISIT Increment 1, and US-VISIT 

Increment 2B, respectively, were not justified by reliable business cases. 

51 This recommendation is the merger of three recommendations.

52 GAO-03-563, GAO-03-1083, and GAO-05-202. 
Appendix I

Briefing Slides

Page 94 GAO-07-1065 Homeland Security

83

Objective 2: Open Recommendations

Recommendation 6

Further, in February 2006 we reported53 that while a business case was prepared 

for Increment 1B, the analysis performed met only four of the eight criteria in 

OMB guidance. For example, it did not include a complete uncertainty analysis 

for the alternatives evaluated.

More recently, the program office has developed business cases for two projects: 

Unique Identity and U.S. Travel Documents-ePassports (formerly Increment 

2A).54 However, the program office has not developed a business case for 

another project that it plans to begin implementing this year—biometric exit at air 

POEs. As discussed later in the observations section of this briefing, the program 

office has defined very little about its proposed solution to meeting its exit needs 

at air POEs, including an analysis of alternative solutions to meeting this need on 

the basis of their relative costs, benefits, and risks. 

54 We have ongoing work to address, among other things, these business cases.

53 GAO-06-296.
Appendix I

Briefing Slides

Page 95 GAO-07-1065 Homeland Security

84

Objective 2: Open Recommendations

Recommendation 6

Until the program office has reliable business cases for each US-VISIT project in 

which alternative solutions for meeting mission needs are evaluated on the basis 

of costs, benefits, and risks, it will not be able to adequately inform its executive 

bodies and the Congress about its plans and will not provide the basis for prudent 

investment decision making.
Appendix I

Briefing Slides

Page 96 GAO-07-1065 Homeland Security

85

Objective 2: Open Recommendations

Recommendation 7

Recommendation 7: Develop and implement a human capital strategy that provides 

for staffing open positions with individuals who have the requisite core 

competencies (knowledge, skills, and abilities).

Status: Partially complete

Strategic management of human capital involves proactive efforts to understand an 

entity’s future workforce needs, existing workforce capabilities, and the gap 

between the two and to chart a course of action defining how this gap will be 

continuously addressed. Such an approach to human capital management is both 

a best practice and provision in federal guidance.

In September 2003, we reported55 that US-VISIT did not have a human capital 

strategy. In February 2006, we reported56 that the program office issued a human 

capital plan and began implementing it. However, it stopped doing so during 2006 

pending a departmental approval of a DHS-wide human capital initiative, known as 

MAXHR, and because all program office positions were filled. However, as noted 

earlier, the program office now reports that it has 21 government positions, 

including critical leadership positions, vacant. 

55 GAO-03-1083. 56 GAO-06-296.
Appendix I

Briefing Slides

Page 97 GAO-07-1065 Homeland Security

86

Objective 2: Open Recommendations

Recommendation 7

According to program officials, US-VISIT recently developed a new human capital 

plan as part of their Organizational Improvement Initiative and this plan is now 

being reviewed by the department. Because its approval is pending, we were not 

provided a copy. 
Appendix I

Briefing Slides

Page 98 GAO-07-1065 Homeland Security

87

Objective 2: Open Recommendations

Recommendation 8

Recommendation 8: Develop and implement a risk management plan and ensure 

that all high risks and their status are reported regularly to the appropriate 

executives.

Status: Partially complete

In September 2003, we reported57 that US-VISIT was a risky undertaking due to 

several factors, including its large scope and complexity and various program 

weaknesses. We concluded that these risks, if not effectively managed, would 

likely cause program cost, schedule, and performance problems. 

Since then, US-VISIT approved a risk management plan and began to put into 

place a risk management process that included, among other things, subprocesses

for identifying, analyzing, managing, and monitoring risk. It also defined and began 

implementing a governance structure to oversee and manage the process, and it 

maintains a risk database that is available to program management and staff.

57 GAO-03-1083.
Appendix I

Briefing Slides

Page 99 GAO-07-1065 Homeland Security

88

Objective 2: Open Recommendations

Recommendation 8

In February 2006,58 we reported that the risk management process detailed in the 

risk management plan was not being consistently applied across the program. In 

addition, we reported that thresholds for elevating risks to department executives 

were not being applied and risk elevation was being left to the discretion of the 

Program Director. Since then, the program has provided training to its employees 

to ensure that they understood how to apply the risk management process. 

However, program officials told us that they have eliminated the thresholds for 

elevating risks beyond the US-VISIT Program Office. Further, no risks have been 

elevated to department executives since December 2005, and no specific guidance 

on when risks should be elevated beyond the US-VISIT Program Director is 

provided in the current risk management plan.

Until the program office ensures that high risks are appropriately elevated, 

department executives will not have the information they need to make informed 

investment decisions.

58 GAO-06-296.
Appendix I

Briefing Slides

Page 100 GAO-07-1065 Homeland Security

89

Objective 2: Open Recommendations

Recommendation 9

Recommendation 9: Define performance standards for US-VISIT that are 

measurable and reflect the limitations imposed on US-VISIT capabilities by relying 

on existing systems.

Status: Partially complete

The operational performance of US-VISIT depends largely on the performance of 

the existing systems that have been integrated to form it. This means that, for 

example, the availability of US-VISIT is constrained by the downtime of existing 

systems.

In February 2006, we reported59 that the program office had defined technical 

performance standards for several increments (e.g., Increments 1, 2B, and 2C), 

but these standards did not contain sufficient information to determine whether or 

not they reflected the limitations imposed by reliance on existing systems. Since 

then, program officials told us that they have not updated the performance 

standards for Increments 1-3 to reflect limitations imposed by relying on existing 

systems. As a result, the ability of these increments to meet performance 

requirements remains uncertain.

59 GAO-06-296.
Appendix I

Briefing Slides

Page 101 GAO-07-1065 Homeland Security

90

Objective 2: Open Recommendations

Recommendation 9

Recently, the program office has developed requirements-related documentation 

on Unique Identity elements, including the iDSM. While this documentation 

specifies a requirement that the model be able to exchange information with 

external systems, and refers to this as a system constraint, it does not assess the 

quantitative impact that these changes would impose on the system. In order to 

determine such impacts, it is necessary to assess such factors as the response 

time and throughput of US-VISIT feeder systems on US-VISIT. 

Until the program defines performance standards that reflect the limitations of the 

existing systems upon which US-VISIT relies, the program lacks the ability to 

identify and effectively address performance shortfalls. 
Appendix I

Briefing Slides

Page 102 GAO-07-1065 Homeland Security

91

Objective 3: Observation 1

Earned Value Data Show Favorable Variances

Observation 1: Earned value management data on ongoing prime contract task 

orders show that cost and schedule baselines are being met.

Earned value management (EVM) is a program management tool for measuring 

progress by comparing, during a given period of time, the value of work 

accomplished with the amount of work expected to be accomplished. This 

comparison permits performance to be evaluated based on calculated variances 

from the planned (baselined) cost and schedule. EVM is both an industry 

accepted practice and an OMB requirement.

The program office requires its prime contractor to use EVM,60 and the data 

provided by the program office show that the cumulative cost and schedule 

variances for the overall prime contract and all 12 ongoing task orders are within 

an acceptable range of performance. 

60 The EVM system used by the prime contractor has yet to be certified by an outside agent (see page 36 for details). 
Appendix I

Briefing Slides

Page 103 GAO-07-1065 Homeland Security

92

Objective 3: Observation 1

Earned Value Data Show Favorable Variances

Our analysis of baseline and actual performance data using generally accepted 

earned value analysis techniques show that as of February 2007, the prime 

contractor had an overall

• Positive cost variance for all task orders combined (i.e., was under budget) 

by about $17.1 million (about 7 percent of the $ 238.9 million worth of work to 

be completed).

• Negative schedule variance for all task orders combined (i.e., had a schedule 

slip) of only about $1.3 million worth of work (less than 1 percent of the work 

scheduled for the period). 

The six-month (September 2006-February 2007) trend in cost and schedule 

variances for the prime contract are shown on the next two pages. 
Appendix I

Briefing Slides

Page 104 GAO-07-1065 Homeland Security

93

Objective 3: Observation 1

Earned Value Data Show Favorable Variances

Cumulative Cost Variance

$8,000,000

$10,000,000

$12,000,000

$14,000,000

$16,000,000

$18,000,000

Sep-06 Oct-06 Nov-06 Dec-06 Jan-07 Feb-07

Source: GAO, based on an analysis of DHS data.
Appendix I

Briefing Slides

Page 105 GAO-07-1065 Homeland Security

94

Objective 3: Observation 1

Earned Value Data Show Favorable Variances

Cumulative Schedule Variance

$(1,400,000)

$(1,200,000)

$(1,000,000)

$(800,000)

$(600,000)

$(400,000)

$(200,000)

$-

Sep-06 Oct-06 Nov-06 Dec-06 Jan-07 Feb-07

Source: GAO, based on an analysis of DHS data.
Appendix I

Briefing Slides

Page 106 GAO-07-1065 Homeland Security

95

Objective 3: Observation 1

Earned Value Data Show Favorable Variances

Our analysis of these data for two specific task orders showed similar results. 

Specifically,

• Task order 4: Program Level Engineering. This task order includes the 

development and maintenance of the US-VISIT target architecture, related 

standards, engineering plans, and guidance as well as performance 

modeling and technology assessments. As of February 2007, it 

• Showed a positive cost variance (i.e., was under budget) by about 

$4.1 million (about 9.6 percent of the $ 42.7 million worth of work to be 

completed).

• Showed a negative schedule variance (i.e., had a schedule slip) by 

about $230,000 worth of work (less than one percent of the work 

scheduled for the period).
Appendix I

Briefing Slides

Page 107 GAO-07-1065 Homeland Security

96

Objective 3: Observation 1

Earned Value Data Show Favorable Variances

• Task order 7: IT Solutions Delivery. This task order contains several Unique 

Identity project subtasks including (1) operation and maintenance of USVISIT’s IDENT biometric identification system, (2) development and 

maintenance of the iDSM, (3) IDENT expansion to 10 prints, and (4) 

development and testing of enumeration functionality for the U.S. Citizenship 

and Immigration Services. As of February 2007, it

• Showed a positive cost variance (i.e., was under budget) by about 

$747,000 (less than 2 percent of the $44.5 million worth of work to be 

completed).

• Showed a negative schedule variance (i.e., had a schedule slip) of 

about $384,000 worth of work (less than one percent of the work 

scheduled for the period).

All of the above cited variances are within the expected range of 10 percent.
Appendix I

Briefing Slides

Page 108 GAO-07-1065 Homeland Security

97

Objective 3: Observation 2

Management Funding Remains High and Unjustified

Observation 2: DHS continues to propose a heavy investment in program 

management-related activities without adequate justification or full disclosure.

Program management is an important and integral aspect of any system 

acquisition program. Our recommendations to DHS aimed at strengthening USVISIT program management are grounded in our research, OMB requirements, 

and recognized best practices relative to the importance of strong program 

management capabilities. The importance of this area, however, does not in and 

of itself justify the level of investment in such activities. Rather, investment in 

program management-related activities, similar to investment in any program 

capability, should be based on full disclosure of the scope, nature, size, and value 

of the program and such investments should be justified in relation to the size and 

significance of the acquisition activities being performed. 
Appendix I

Briefing Slides

Page 109 GAO-07-1065 Homeland Security

98

Objective 3: Observation 2

Management Funding Remains High and Unjustified

Earlier this year, we reported,61 that the program’s investment in program 

management had risen significantly over the past 4 years, particularly in relation 

to the program’s declining level of new system development. The fiscal year 2007 

expenditure plan proposes a level of investment in program management similar 

to that for 2006. At the same time, no explanation or justification of such a 

relatively large investment in program management-related funding has been 

provided. Specifically,

• The fiscal year 2003 expenditure plan provided $30 million for program 

management and operations. In contrast, the fiscal year 2006 plan provided 

$126 million for program management-related functions. At the same time, 

funds provided for new development fell from $325 million in 2003 to $93 

million in 2006. 

• Restated, program management costs represented about 9 percent of 

planned development costs in 2003 but 135 percent of planned development 

in 2006. This means that in 2006, for every dollar spent on new capabilities, 

$1.35 was spent on management. 

61 GAO-07-278.
Appendix I

Briefing Slides

Page 110 GAO-07-1065 Homeland Security

99

Objective 3: Observation 2

Management Funding Remains High and Unjustified

• According to program officials, the fiscal year 2006 plan did not 

properly categorize proposed program management-related funding 

according to its intended use. They added that future expenditure 

plans would provide greater clarity into funds used for management 

versus development.

• The fiscal year 2007 expenditure plan proposed investing a comparable 

percentage of funding on management-related activities vis-à-vis new 

development. Specifically, our analysis shows that, for every dollar invested 

in new development, $1.25 is to be spent on management-related activities at 

either the program or project level. 

Charts showing this trend in management-related funding in relation to new 

development funding are on the following two pages. 
Appendix I

Briefing Slides

Page 111 GAO-07-1065 Homeland Security

100

Objective 3: Observation 2

Management Funding Remains High and Unjustified

Development, Operations, and Program/Project Management Cost Trends, FY 2002 - FY 

2007
Appendix I

Briefing Slides

Page 112 GAO-07-1065 Homeland Security

101

Objective 3: Observation 2

Management Funding Remains High and Unjustified

Program/Project Management Costs as Percentage of New Development
Appendix I

Briefing Slides

Page 113 GAO-07-1065 Homeland Security

102

Objective 3: Observation 2

Management Funding Remains High and Unjustified

The fiscal year 2007 expenditure plan does not explain the reasons for the sizable 

investment in management-related activities or otherwise justify it on the basis of 

measurable expected value. Without disclosing and justifying its proposed 

investment and program management-related efforts, it is unclear that such a 

large amount of funding for these activities represents the best use of resources. 
Appendix I

Briefing Slides

Page 114 GAO-07-1065 Homeland Security

103

Objective 3: Observation 3

Exit Remains Inadequately Defined and Justified

Observation 3: Lack of a well-defined and justified exit solution introduces 

the risk of repeating failed and costly past exit efforts.

The decision to invest in a system or system component should be based on a 

clear definition of what capabilities, what stakeholders, and what will be delivered 

according to what schedule and at what cost. Moreover, it should be economically 

justified via reliable analysis showing that execution of the plan will produce 

mission value commensurate with expected costs and risks.

According to the fiscal year 2007 expenditure plan, DHS intends to begin 

deploying an exit capability at air and sea POEs and spend $27.3 million doing 

so. More specifically, the plan states that

• $7.3 million in fiscal year 2007 funding and $20 million in fiscal year 2006 

carryover funding will be used, in part, to begin the process of planning and 

designing an air and sea exit solution;

• the air exit solution will be fully deployed by an unspecified time during 

calendar year 2008;

• the air exit solution will be integrated with commercial airlines’ existing 

passenger check-in processes; and
Appendix I

Briefing Slides

Page 115 GAO-07-1065 Homeland Security

104

Objective 3: Observation 3

Exit Remains Inadequately Defined and Justified

• the sea exit solution will emulate the technology and operational plans 

adopted for air exit.

However, while US-VISIT has developed a high-level schedule for air exit, 

information supporting that schedule was not provided to GAO and no other exit 

program plans are available that define what will be done, by what entities, and at 

what cost to define, acquire, deliver, deploy, and operate this capability, including 

plans describing expected system capabilities, identifying key stakeholder (e.g., 

airlines) roles/responsibilities and buy-in, coordinating and aligning with related 

programs, and allocating funding to activities. In addition, the exit schedule 

provided by the program office indicates that the air exit solution is to be fully 

implemented by June 2009, which is at least 6 months after the full deployment 

date provided in the expenditure plan.

Further, available documentation (e.g., the expenditure plan) 

• does not define what key terms mean, such as “full implementation” and 

“integrated;”
Appendix I

Briefing Slides

Page 116 GAO-07-1065 Homeland Security

105

Objective 3: Observation 3

Exit Remains Inadequately Defined and Justified

• does not specify what the $20 million in fiscal year 2006 carryover funding 

will be spent on, and only allocates the $7.3 million in fiscal year 2007 

funding to such broad categories of activities as project management, 

contractor services, and planning and design; and

• does not describe what has been done and what is planned to engage with 

commercial airlines, even though the recently-provided air exit schedule 

states that the department plans to issue a proposed federal regulation 

requiring airlines to participate in this effort by end of calendar year 2007.

Moreover, no analysis comparing the life cycle costs of the air exit solution to its 

expected benefits and risks is available. In particular, neither the 2007 

expenditure plan nor any other program documentation describe measurable 

outcomes (benefits and results) that will result from an air exit solution.
Appendix I

Briefing Slides

Page 117 GAO-07-1065 Homeland Security

106

Objective 3: Observation 3

Exit Remains Inadequately Defined and Justified

According to the expenditure plan, significant air exit planning and testing has 

been conducted over the past 3 years and the air exit solution is based in part on 

these efforts. However, during this time we have continued to report on 

fundamental limitations in the definition and justification of those efforts. For 

example,

• In September 2003,62 we reported that DHS had not economically justified 

the initial US-VISIT increment (which was to include an exit capability at air 

and sea POEs) on the basis of benefits, costs, and risks. As result, we 

recommended that DHS determine whether proposed incremental 

capabilities will produce value commensurate with program costs and risks.

62 GAO-03-1083.
Appendix I

Briefing Slides

Page 118 GAO-07-1065 Homeland Security

107

Objective 3: Observation 3

Exit Remains Inadequately Defined and Justified

• In May 2004,63 we reported that an exit capability (including biometric 

capture) was not deployed to the 80 air and 14 sea POEs as part of 

Increment 1 deployment in December 2003, as originally intended. Instead, a 

pilot exit capability was deployed to only one air and one sea POE on 

January 5, 2004. At that time, program officials told us that it was being 

piloted at only two locations because they decided to evaluate other exit 

alternatives and planned to select an alternative for full deployment by 

December 31, 2004.

• In February 2005,64 we reported that DHS had not adequately planned for 

evaluating the air and sea exit alternatives because the scope and timeline of 

the pilot evaluations were compressed. We recommended that the program 

office reassess its plans for deploying an exit capability to ensure that the 

scope of the pilot provided an adequate evaluation of alternatives.

63GAO, Homeland Security: First Phase of Visitor and Immigrant Status Program Operating, but Improvements Needed,

GAO-04-586 (Washington, D.C.: May 11, 2004).

64 GAO-05-202.
Appendix I

Briefing Slides

Page 119 GAO-07-1065 Homeland Security

108

Objective 3: Observation 3

Exit Remains Inadequately Defined and Justified

• In February 2006,65 we reported that DHS had analyzed the cost, benefits, 

and risks for its air and sea exit capability, but the analyses did not 

demonstrate that the program was producing or would produce mission value 

commensurate with expected costs and benefits, and the costs upon which 

the analyses were based were not reliable. We also raised questions about 

the adequacy of the program’s air exit pilot evaluation, noting that the results 

showed an average compliance of only 24 percent across the three

alternatives. We concluded that until exit alternatives were adequately 

evaluated, the program office would not be in a position to select the best 

solution. We further noted that without an effective exit capability, the 

benefits and the mission value of US-VISIT would be greatly diminished. We 

did not make a recommendation to address this because we had already 

addressed the situation through a prior recommendation. 

65GAO-06-296.
Appendix I

Briefing Slides

Page 120 GAO-07-1065 Homeland Security

109

Objective 3: Observation 3

Exit Remains Inadequately Defined and Justified

• In December 2006,66 we reported that US-VISIT officials had concluded that 

a biometric US-VISIT land exit capability could not be implemented without 

incurring a major impact on land POE facilities. We also reported that the 

land exit pilots had surfaced several performance problems, such as RFID 

devices not reading a majority of travelers’ tags during testing and multiple 

RFID devices installed on poles or structures over roads reading information 

from the same traveler tag. We recommended that DHS report to Congress 

information on the costs, benefits, and feasibility of deploying biometric and 

nonbiometric exit capabilities at land POEs.

66GAO-07-248.
Appendix I

Briefing Slides

Page 121 GAO-07-1065 Homeland Security

110

Objective 3: Observation 3

Exit Remains Inadequately Defined and Justified

• In February 2007,67 we reported that DHS had not adequately defined and 

justified its past investment in exit pilots and demonstration projects. We 

noted that the program had devoted considerable time and resources to exit 

but still did not have either an operational exit capability or a viable exit 

solution to deploy. Further, exit-related program documentation did not 

adequately define what work was to be done or what these efforts would 

accomplish and did not describe measurable outcomes from the pilot or 

demonstration efforts, or related cost, schedule, and capability commitments 

that would be met. We recommended that planned expenditures be limited 

for exit pilots and demonstration projects until such investments are 

economically justified and until each investment has a well-defined 

evaluation plan. 

67 GAO-07-278.
Appendix I

Briefing Slides

Page 122 GAO-07-1065 Homeland Security

111

Objective 3: Observation 3

Exit Remains Inadequately Defined and Justified

Notwithstanding these long-standing limitations in planning for and justifying its 

exit efforts, and notwithstanding that funding for exit-related efforts in US-VISIT 

expenditure plans for fiscal years 2003 through 200668 totals about $250 million, 

no operational exit capability exists. Unless the department better plans and 

justifies its new exit efforts, it runs the serious risk of repeating this past failure. 

68As reported in the fiscal year 2005 and revised 2006 expenditure plans. The fiscal year 2007 plan reported that of this 

amount, $53.1 million was still available as prior year carryover ($17.7 million from land and $35.4 million from air and sea).

Our assessment of these reported numbers is detailed in the Scope and Methodology discussion found in Attachment 1.
Appendix I

Briefing Slides

Page 123 GAO-07-1065 Homeland Security

112

Conclusions

US-VISIT’s prime contract cost and schedule metrics show that expectations are 

being met, according to available data, although their earned value management 

system that the metrics are based on has yet to be independently certified. 

Nothwithstanding this, such performance is a positive sign.

However, the vast majority of the many management weaknesses raised in this 

briefing have been the subject of our prior US-VISIT reports and testimonies, and 

thus are not new. Accordingly, we have already made a litany of recommendations 

to correct each weakness, as well as follow-on recommendations to increase DHS 

attention to and accountability for doing so. Despite this, recurring legislative 

conditions associated with US-VISIT expenditure plans continue to be less than 

fully satisfied, and recommendations that we made 4 years ago are still not fully 

implemented.

Exacerbating this situation is the fact that the DHS did not satisfy two new 

legislative conditions associated with the fiscal year 2007 expenditure plan, and 

serious questions continue to exist about DHS’s justification for and readiness to 

invest current, and potentially future, fiscal year funding relative to an exit solution 

and program management-related activities. 
Appendix I

Briefing Slides

Page 124 GAO-07-1065 Homeland Security

113

Conclusions

DHS has had ample opportunity to address these many issues, but it has not. As a 

result, there is no reason to expect its newly launched exit endeavor, for example, 

to produce results different from its past endeavors—namely, no operational exit 

solution despite expenditure plans allocating about a quarter of billion dollars to 

various exit activities. Similarly, there is no reason to believe that the program’s 

disproportionate investment in management-related activities represents a prudent 

and warranted course of action. All told, this means that needed improvements in 

US-VISIT program management practices are long overdue. Both the legislative 

conditions and our open recommendations are aimed at accomplishing these 

improvements, and thus they need to be addressed quickly and completely. Thus 

far, they have not been and the reasons that they have not are unclear.
Appendix I

Briefing Slides

Page 125 GAO-07-1065 Homeland Security

114

Recommendations for Executive Action

Because our outstanding US-VISIT recommendations already address all of the 

management weaknesses discussed in this briefing, we are reiterating our prior 

recommendations, and recommending that the Secretary of DHS report to the 

department’s authorization and appropriations committees on its reasons for not 

fully addressing its expenditure plan legislative conditions and our prior 

recommendations.
Appendix I

Briefing Slides

Page 126 GAO-07-1065 Homeland Security

115

Agency Comments

We provided a draft of this briefing to DHS and US-VISIT program officials and 

solicited their comments on it. In response, DHS and US-VISIT program officials, 

including the program director, stated that the briefing was factually correct and 

that GAO's continued guidance provided value to the program. They also stated 

that the program office would continue to address our open recommendations, and 

would formally comment on a draft of our report that transmits the briefing. 
Appendix I

Briefing Slides

Page 127 GAO-07-1065 Homeland Security

116

Attachment 1

Scope and Methodology

To accomplish our first objective, 

• we reviewed the fiscal year 2007 plan and other available program 

documentation related to each condition. In doing so, we examined not only 

completed actions and steps, but also planned actions and steps, including 

program officials’ stated commitments to perform such activities and steps. 

More specifically, we 

• compared the information in the program’s fiscal year 2007 Exhibit 300 

budget submission and related documentation to capital planning guidance 

(OMB A-11 part 7) to determine whether the information complies with the 

capital planning and investment controls, 

• assessed program documents against criteria in DHS’s Investment Review 

Process to determine whether the program could demonstrate compliance 

with the DHS enterprise architecture, 

• assessed the program’s software improvement program to determine the 

progress made in developing acquisition processes that meet industry 

standards,
Appendix I

Briefing Slides

Page 128 GAO-07-1065 Homeland Security

117

Attachment 1

Scope and Methodology

• reviewed documentation to determine whether an independent verification 

and validation agent was currently under contract, 

• reviewed documentation to determine whether the expenditure plan

received the required certification and approvals,

• reviewed US-VISIT’s strategic plan submission and compared it against 

federal legislation and guidelines, and GAO strategic planning criteria to 

determine whether US-VISIT’s strategic plan met best practices, and 

• reviewed US-VISIT’s exit submission to determine the extent to which it 

described the exit capabilities to be deployed and included a schedule for 

deploying these capabilities. 

• To accomplish our second objective, we 

• Reviewed and analyzed the fiscal year 2007 expenditure plan, US-VISIT’s 

most recent status reports on the implementation of our open 

recommendations, and related key documents, augmented as appropriate 

by interviews with program officials. Specifically, we reviewed and 

analyzed:
Appendix I

Briefing Slides

Page 129 GAO-07-1065 Homeland Security

118

Attachment 1

Scope and Methodology

• relevant systems acquisition documentation, including the program’s 

process improvement plan, risk management plan, and configuration 

management plan; 

• the program’s security plan, privacy impact assessment, and related 

system acquisition documents; 

• the program’s most recent draft human capital strategy and related 

documents;

• We also reviewed the fiscal year 2007 plan to determine whether it 

• disclosed key aspects of how the acquisition is being managed, 

including management areas that our prior reports on US-VISIT 

identified as important but missing (e.g., governance structure,

organizational structure, human capital, systems configuration, 

and system capacity); and

• fully disclosed system capabilities and related benefits as well as 

cost and schedule information.
Appendix I

Briefing Slides

Page 130 GAO-07-1065 Homeland Security

119

Attachment 1

Scope and Methodology

• To accomplish our third objective, we reviewed the fiscal year 2007 plan and 

other available program documentation related to each of the following areas. 

In doing so, we examined completed and planned actions and steps, including 

program officials’ stated commitments to perform them. For earned value, we 

reported data provided by the contractor to US-VISIT that is verified by USVISIT. To assess its reliability, we reviewed relevant documentation and 

interviewed the system owner for the earned value data. More specifically, we 

addressed US-VISIT efforts to:

• track and manage cost and schedule commitments by applying 

established earned value analysis techniques to baseline and actual 

performance data from cost performance reports,

• define and justify program management costs by reviewing and 

analyzing data on costs provided as part of the expenditure plan; and

• define and implement an exit strategy for air, sea, and land by 

reviewing and analyzing information provided as part of the 

expenditure plan. 
Appendix I

Briefing Slides

Page 131 GAO-07-1065 Homeland Security

120

Attachment 1

Scope and Methodology

Additionally, in February 2007,1 we reported that the system that US-VISIT 

uses to manage its finances (U.S. Immigration and Customs Enforcement’s 

Federal Financial Management System (FFMS)) has reliability issues. In light 

of these issues, the US-VISIT Budget Office tracks program obligations and 

expenditures separately using a spreadsheet and comparing this spreadsheet 

to the information in FFMS. Based on a review of this spreadsheet, there is 

reasonable assurance that the US-VISIT budget numbers being reported by 

FFMS are accurate. 

For DHS-provided data that our reporting commitments did not permit us to 

substantiate, we have made appropriate attribution indicating the data’s source. To 

assess the reliability of US-VISIT’s electronic document repository, we reviewed 

relevant documentation and talked with an agency official about data quality control 

procedures. We determined the data were sufficiently reliable for the purposes of 

this report.

We conducted our work at US-VISIT program offices in Arlington, Virginia, from 

March 2007 through June 2007, in accordance with generally accepted 

government auditing standards.

1GAO-07-278
Appendix I

Briefing Slides

Page 132 GAO-07-1065 Homeland Security

121

Attachment 2

Related Products List

Related Products List

• Homeland Security: DHS Enterprise Architecture Continues to Evolve But 

Improvements Needed. GAO-07-564. Washington D.C.: May 9, 2007 

• Homeland Security: US-VISIT Program Faces Operational, Technological, and 

Management Challenges. GAO-07-632T. Washington D.C.: March 20, 2007.

• Homeland Security: US-VISIT Has Not Fully Met Expectations and 

Longstanding Program Management Challenges Need to Be Addressed. GAO07-499T. Washington D.C.: February 16, 2007.

• Homeland Security: Planned Expenditures for U.S. Visitor and Immigrant 

Status Program Need to Be Adequately Defined and Justified. GAO-07-278.

Washington D.C.: February 14, 2007.

• Border Security: US-VISIT Program Faces Strategic, Operational, and 

Technological Challenges at Land Ports of Entry. GAO-07-378T. Washington 

D.C.: January 31, 2007.
Appendix I

Briefing Slides

Page 133 GAO-07-1065 Homeland Security

122

Attachment 2

Related Products List

Related Products List

• Border Security: US-VISIT Program Faces Strategic, Operational, and 

Technological Challenges at Land Ports of Entry. GAO-07-248. Washington 

D.C.: December 6, 2006.

• Homeland Security: Contract Management and Oversight for Visitor and 

Immigrant Status Program Need to Be Strengthened. GAO-06-404.

Washington, D.C.: June 9, 2006.

• Homeland Security: Progress Continues, but Challenges Remain on 

Department’s Management of Information Technology. GAO-06-598T.

Washington, D.C.: March 29, 2006.

• Homeland Security: Recommendations to Improve Management of Key Border 

Security Program Need to Be Implemented. GAO-06-296. Washington, D.C.: 

February 14, 2006

• Homeland Security: Visitor and Immigrant Status Program Operating, but 

Management Improvements Are Still Needed. GAO-06-318T. Washington, 

D.C.: January 25, 2006.
Appendix I

Briefing Slides

Page 134 GAO-07-1065 Homeland Security

123

Attachment 2

Related Products List

Related Products List

• Information Security: Department of Homeland Security Needs to Fully 

Implement Its Security Program. GAO-05-700. Washington, D.C.: June 17, 

2005.

• Information Technology: Customs Automated Commercial Environment

Program Progressing, but Need for Management Improvements Continues. 

GAO-05-267. Washington, D.C.: March 14, 2005. 

• Homeland Security: Some Progress Made, but Many Challenges Remain on 

U.S. Visitor and Immigrant Status Indicator Technology Program. GAO-05-202.

Washington, D.C.: February 23, 2005.

• Border Security: State Department Rollout of Biometric Visas on Schedule, but 

Guidance Is Lagging. GAO-04-1001. Washington, D.C.: September 9, 2004.

• Border Security: Joint, Coordinated Actions by State and DHS Needed to 

Guide Biometric Visas and Related Programs. GAO-04-1080T. Washington, 

D.C.: September 9, 2004.
Appendix I

Briefing Slides

Page 135 GAO-07-1065 Homeland Security

124

Attachment 2

Related Products List

Related Products List

• Homeland Security: First Phase of Visitor and Immigration Status Program 

Operating, but Improvements Needed. GAO-04-586. Washington, D.C.: May 

11, 2004. 

• Homeland Security: Risks Facing Key Border and Transportation Security 

Program Need to Be Addressed. GAO-04-569T. Washington, D.C.: March 18, 

2004.

• Homeland Security: Risks Facing Key Border and Transportation Security 

Program Need to Be Addressed. GAO-03-1083. Washington, D.C.: September 

19, 2003.

• Information Technology: Homeland Security Needs to Improve Entry Exit 

System Expenditure Planning. GAO-03-563. Washington, D.C.: June 9, 2003.
Appendix I

Briefing Slides

Page 136 GAO-07-1065 Homeland Security

125

Attachment 3

Detailed Description of US-VISIT Program 

The US-VISIT program consists of nine organizations and uses contractor

support services in several areas. The roles and responsibilities of each of the 

nine organizations include the following:

• Chief Strategist is responsible for developing and maintaining the 

strategic vision and related documentation, transition plan, and business 

case.

• Budget and Financial Management is responsible for establishing the 

program’s cost estimates; analysis; and expenditure management 

policies, processes, and procedures that are required to implement and 

support the program by ensuring proper fiscal planning and execution of 

the budget and expenditures.

• Mission Operations Management is responsible for developing business 

and operational requirements based on strategic direction provided by the 

Chief Strategist. 
Appendix I

Briefing Slides

Page 137 GAO-07-1065 Homeland Security

126

Attachment 3

Detailed Description of US-VISIT Program 

• Outreach Management is responsible for enhancing awareness of the 

US-VISIT requirements among foreign nationals, key domestic 

audiences, and internal stakeholders by coordinating outreach to media, 

third parties, key influencers, Members of Congress, and the traveling 

public.

• Information Technology Management is responsible for developing 

technical requirements based on strategic direction provided by the Chief 

Strategist and business requirements developed by Mission Operations 

Management.

• Implementation Management is responsible for developing accurate, 

measurable schedules and cost estimates for the delivery of mission 

systems and capabilities.

• Acquisition and Program Management is responsible for establishing and 

managing the execution of program acquisition and management policies, 

plans, processes, and procedures.
Appendix I

Briefing Slides

Page 138 GAO-07-1065 Homeland Security

127

Attachment 3

Detailed Description of US-VISIT Program 

• Administration and Training is responsible for developing and 

administering a human capital plan that includes recruiting, hiring, 

training, and retaining a diverse workforce with the competencies 

necessary to accomplish the mission.

• Facilities and Engineering Management is responsible for establishing 

facilities and environmental policies, procedures, processes, and 

guidance required to implement and support the program office.
Appendix I

Briefing Slides

Page 139 GAO-07-1065 Homeland Security

128

Attachment 3

Detailed Description of US-VISIT Program

The program uses contractor support services in the following six subject matter 

areas:

• Facilities and Infrastructure – provides the infrastructure and facilities support 

necessary for current and anticipated future staff for task orders awarded 

under the prime contract. 

• Program-Level Management – defines the activities required to support the 

prime contractor’s program management office, including quality management, 

task order control, acquisition support, and integrated planning and scheduling.

• Program-Level Engineering – assures integration across incremental 

development of US-VISIT systems and maintains interoperability and 

performance goals.

• Data Management Support – analyzes data for errors and omissions, corrects 

data, reports changes to the appropriate system of record owners, and 

provides reports. 
Appendix I

Briefing Slides

Page 140 GAO-07-1065 Homeland Security

129

Attachment 3 

Detailed Description of US-VISIT Program

• Data Management and Governance – provides support in the implementation 

of data management architecture and transition and sequencing plans, 

conducts an assessment of the current data governance structure and 

provides a recommendation for the future data governance structure, including 

a data governance plan.

• Mission Operations Data Integrity Improvements – determines possible ways 

to automate some of the data feeds from legacy systems, making the data 

more reliable.
Appendix I

Briefing Slides

Page 141 GAO-07-1065 Homeland Security

130

Attachment 4

Detailed Description of Increments and Component Systems

Below is a discussion of the processes underlying each increment and the 

systems that provide information to US-VISIT. 

Increment 1 processes –Increment 1 includes the following five processes at air 

and sea ports of entry (POE): pre-entry, entry, status management, exit, and 

analysis, which are depicted in the graphic below.
Appendix I

Briefing Slides

Page 142 GAO-07-1065 Homeland Security

131

Attachment 4

Detailed Description of Increments and Component Systems

Pre-entry process:

Pre-entry processing begins with initial petitions for visas, grants of visa status, or 

the issuance of travel documentation. When a foreign national applies for a visa at 

a U.S. consulate, biographic and biometric data are collected and shared with 

border management agencies. The biometric data (i.e., fingerprint scan of the right 

and left index fingers) are transmitted from the Department of State (State) to the 

Department of Homeland Security (DHS), where the fingerprints are run against the 

Automated Biometric Identification System (IDENT) to verify identity and to run a 

check against the biometric watch list. The results of the biometric check are 

transmitted back to State. A “hit” response prevents State’s system from printing a 

visa for the applicant until the information is cleared by a consular officer. 

Pre-entry also includes transmission by commercial air and sea carriers of crew 

and passenger manifests before arriving in the United States.1 These manifests are 

transmitted through the Advance Passenger Information System (APIS). The APIS 

lists are run against the biographic lookout system and identify those arrivals who 

have biometric data available. 

In addition, POEs review the APIS list in order to identify foreign nationals who 

need to be scrutinized more closely. 

1Pub. L. 107-173 (May 14, 2002).
Appendix I

Briefing Slides

Page 143 GAO-07-1065 Homeland Security

132

Attachment 4

Detailed Description of Increments and Component Systems

Entry process:

When the foreign national arrives at a primary POE inspection booth, the inspector, 

using a document reader, scans the machine-readable travel documents. APIS 

returns any existing records on the foreign national to the US-VISIT workstation 

screen, including manifest data matches and biographic lookout hits. When a 

match is found in the manifest data, the foreign national’s name is highlighted and 

outlined on the manifest data portion of the screen. 

Biographic information, such as name and date of birth, is displayed on the bottom 

half of the computer screen, as well as the photograph from State’s Consular 

Consolidated Database. The inspector at the booth scans the foreign national’s 

fingerprints (left and right index fingers) and takes a digital photograph. This 

information is forwarded to the IDENT database, where it is checked against stored 

fingerprints in the IDENT lookout database. 
Appendix I

Briefing Slides

Page 144 GAO-07-1065 Homeland Security

133

Attachment 4

Detailed Description of Increments and Component Systems

If no prints are currently in IDENT, the foreign national is enrolled in US-VISIT (i.e., 

biographic and biometric data are entered). If the foreign national’s fingerprints are 

already in IDENT, the system performs a match (a comparison of the fingerprint 

taken during the primary inspection to the one on file) to confirm that the person 

submitting the fingerprints is the person on file. If the system finds a mismatch of 

fingerprints or a watch list hit, the foreign national is sent to an inspection booth for 

further screening or processing.

While the system is checking the fingerprints, the inspector questions the foreign 

national about the purpose of his or her travel and length of stay. The inspector 

adds the class of admission and duration of stay information into the Treasury

Enforcement Communications Systems (TECS), and stamps the “admit until” date 

on the Form I-94.

If the foreign national is ultimately determined to be inadmissible, the person is 

detained, lookouts are posted in the databases, and appropriate actions are taken.
Appendix I

Briefing Slides

Page 145 GAO-07-1065 Homeland Security

134

Attachment 4

Detailed Description of Increments and Component Systems

Within 2 hours after a flight lands and all passengers have been processed, TECS 

is to send the Arrival Departure Information System (ADIS) the records showing the 

class of admission and the “admit until” dates that were modified by the inspector.

Status management process:

The status management process manages the foreign national’s temporary 

presence in the United States, including the adjudication of benefits applications 

and investigations into possible violations of immigration regulations. 

Commercial air and sea carriers transmit departure manifests electronically for 

each departing passenger. These manifests are transmitted through APIS and 

shared with ADIS. ADIS matches entry and exit manifest data to ensure that each 

record showing a foreign national entering the United States is matched with a 

record showing the foreign national exiting the United States. 
Appendix I

Briefing Slides

Page 146 GAO-07-1065 Homeland Security

135

Attachment 4

Detailed Description of Increments and Component Systems

ADIS also provides the ability to run queries on foreign nationals who have entry 

information but no corresponding exit information. 

ADIS receives status information from the Computer Linked Application Information 

Management System and the Student and Exchange Visitor Information System on 

foreign nationals. 

Exit process:

The exit process includes the carriers’ electronic submission of departure manifest 

data to APIS. This biographic information is passed to ADIS, where it is matched 

against entry information. 
Appendix I

Briefing Slides

Page 147 GAO-07-1065 Homeland Security

136

Attachment 4

Detailed Description of Increments and Component Systems

Analysis:

An ongoing analysis capability is to provide for the continuous screening against 

watch lists of individuals enrolled in US-VISIT for appropriate reporting and action. 

As more entry and exit information becomes available, it is to be used to analyze 

traffic volume and patterns as well as to perform risk assessments. The analysis is 

to be used to support resource and staffing projections across the POEs, strategic 

planning for integrated border management analysis performed by the intelligence 

community, and determination of travel use levels and expedited traveler programs.
Appendix I

Briefing Slides

Page 148 GAO-07-1065 Homeland Security

137

Attachment 4

Detailed Description of Increments and Component Systems

Increment 2B and Increment 3 processes –

Increments 2B and 3 deployed US-VISIT entry processing capabilities to land 

POEs. These two increments are similar to Increment 1 (air and sea POEs), with 

several noteworthy differences.

• No advance passenger information is available to the inspector before the 

traveler arrives for inspection. 

• Travelers subject to US-VISIT are processed at secondary inspection, rather 

than at primary inspection.

• Inspectors’ workstations use a single screen, which eliminates the need to 

switch between the TECS and IDENT screens. 
Appendix I

Briefing Slides

Page 149 GAO-07-1065 Homeland Security

138

Attachment 4

Detailed Description of Increments and Component Systems

• Form I-94 data are captured electronically. The form is populated by data 

obtained when the machine-readable zone of the travel document is swiped. If 

visa information about the traveler exists in the Datashare database,2 it is used 

to populate the form. Fields that cannot be populated electronically are 

manually entered. A copy of the completed form is printed and given to the 

traveler for use upon exit.

• No electronic exit information is captured.

2Datashare includes a data extract from State’s Consular Consolidated Database system and includes the visa photograph, 

biographical data, and the fingerprint identification number assigned when a nonimmigrant applies for a visa.
Appendix I

Briefing Slides

Page 150 GAO-07-1065 Homeland Security

139

Attachment 4

Detailed Description of Increments and Component Systems

Component systems

US-VISIT Increments 1 through 3 include the interfacing and integration of existing 

systems and, with Increment 2C, the creation of a new system. The three main 

existing systems are as follows: 

• Arrival Departure Information System (ADIS) stores

• non-citizen traveler arrival and departure data received from air and sea 

carrier manifests,

• arrival data captured by CBP officers at air and sea POEs, 

• Form I-94 issuance data captured by CBP officers at Increment 2B land 

POEs, and

• status update information provided by the Student and Exchange Visitor 

Information System (SEVIS) and the Computer Linked Application 

Information Management System (CLAIMS 3) (described below).
Appendix I

Briefing Slides

Page 151 GAO-07-1065 Homeland Security

140

Attachment 4

Detailed Description of Increments and Component Systems

ADIS provides record matching, query, and reporting functions.

• The passenger processing component of the Treasury Enforcement 

Communications Systems (TECS) includes two systems: 

• Advance Passenger Information System (APIS) captures arrival and 

departure manifest information provided by air and sea carriers, and

• Interagency Border Inspection System (IBIS) maintains lookout data and 

interfaces with other agencies’ databases. 

CBP officers use these data as part of the admission process. The results of 

the admission decision are recorded in TECS and ADIS. 
Appendix I

Briefing Slides

Page 152 GAO-07-1065 Homeland Security

141

Attachment 4

Detailed Description of Increments and Component Systems

• The Automated Biometric Identification System (IDENT) collects and stores 

biometric data on foreign visitors, including data such as 

• Federal Bureau of Investigation information3 on all known and suspected 

terrorists, selected wanted persons (foreign-born, unknown place of birth, 

previously arrested by DHS), and previous criminal histories for high-risk 

countries;

• DHS Immigration and Customs Enforcement information on deported 

felons and sexual registrants; and 

• DHS information on previous criminal histories and previous IDENT 

enrollments.

3Information from the Federal Bureau of Investigation includes fingerprints from the Integrated Automated Fingerprint 

Identification System.
Appendix I

Briefing Slides

Page 153 GAO-07-1065 Homeland Security

142

Attachment 4

Detailed Description of Increments and Component Systems

US-VISIT also exchanges biographic information with other DHS systems, 

including SEVIS and CLAIMS 3:

• SEVIS is a system that contains information on foreign students and 

• CLAIMS 3 is a system that contains information on foreign nationals who 

request benefits, such as change of status or extension of stay.

Some of the systems involved in US-VISIT, such as IDENT and AIDMS, are 

managed by the program office, while some systems are managed by other 

organizational entities within DHS. For example:

• TECS is managed by CBP,

• SEVIS is managed by Immigration and Customs Enforcement,

• CLAIMS 3 is under United States Citizenship and Immigration Services, 

and

• ADIS is owned by US-VISIT, but is managed by CBP. 
Appendix I

Briefing Slides

Page 154 GAO-07-1065 Homeland Security

143

Attachment 4

Detailed Description of Increments and Component Systems

US-VISIT also interfaces with other, non-DHS systems for relevant purposes, 

including watch list4 (i.e. lookout) updates and checks to determine whether a visa 

applicant has previously applied for a visa or currently has a valid U.S. visa. In 

particular, US-VISIT receives biographic and biometric information from State’s

Consular Consolidated Database as part of the visa application process, and 

returns fingerscan information and watch list changes. 

4Watch list data sources include DHS’s Customs and Border Protection and Immigration and Customs Enforcement; 

the Federal Bureau of Investigation; legacy DHS systems; the U.S. Secret Service; the U.S. Coast Guard; the 

Internal Revenue Service; the Drug Enforcement Agency; the Bureau of Alcohol, Tobacco, & Firearms; the U.S. 

Marshals Service; the U.S. Office of Foreign Asset Control; the National Guard; the Treasury Inspector General; the 

U.S. Department of Agriculture; the Department of Defense Inspector General; the Royal Canadian Mounted Police; 

the U.S. State Department; Interpol; the Food and Drug Administration; the Financial Crimes Enforcement Network; 

the Bureau of Engraving and Printing; and the Department of Justice Office of Special Investigations.
Page 155 GAO-07-1065 Homeland Security

Appendix II

Comments from the Department of Homeland 

Security ApendxiI
Appendix II

Comments from the Department of Homeland 

Security

Page 156 GAO-07-1065 Homeland Security
Appendix II

Comments from the Department of Homeland 

Security

Page 157 GAO-07-1065 Homeland Security
Appendix II

Comments from the Department of Homeland 

Security

Page 158 GAO-07-1065 Homeland Security
Appendix II

Comments from the Department of Homeland 

Security

Page 159 GAO-07-1065 Homeland Security
Appendix II

Comments from the Department of Homeland 

Security

Page 160 GAO-07-1065 Homeland Security
Appendix II

Comments from the Department of Homeland 

Security

Page 161 GAO-07-1065 Homeland Security
Appendix II

Comments from the Department of Homeland 

Security

Page 162 GAO-07-1065 Homeland Security
Page 163 GAO-07-1065 Homeland Security

Appendix III

GAO Contact and Staff Acknowledgments ApendxiI

GAO Contact Randolph C. Hite, (202) 512-3439 or hiter@gao.gov

Staff 

Acknowledgments

In addition to the contact named above, Tonia Johnson (Assistant 

Director), Eric Costello, Deborah Davis, Neil Doherty, Nancy Glover, 

Joshua Hammerstein, David Hinchman, Scott Pettis, Karl Seifert, Teresa 

Smith, Daniel Wexler, and Charles Youman made key contributions to this 

report.

(310650)
GAO’s Mission The Government Accountability Office, the audit, evaluation and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help 

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

Obtaining Copies of 

GAO Reports and 

Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost 

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To 

have GAO e-mail you a list of newly posted products every afternoon, go to 

www.gao.gov and select “Subscribe to Updates.”

Order by Mail or Phone The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to:

U.S. Government Accountability Office

441 G Street NW, Room LM

Washington, D.C. 20548

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Congressional 

Relations

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, D.C. 20548

Public Affairs Susan Becker, Acting Manager, Beckers@GAO.gov (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149

Washington, D.C. 20548