<

DEPARTMENT OF HOMELAND SECURITY

Office of Inspector General 

Letter Report: 

Review of DHS’ Financial Systems 

Consolidation Project 

May 2008 OIG-08-47 
 

 

 

 

Office of Inspector General 

U.S. Department of Homeland Security 

Washington, DC 20528 

May 9, 2008 

MEMORANDUM FOR: David Norquist 

 Chief Financial Officer 

FROM: Richard L. Skinner 

 Inspector General 

SUBJECT: Review of DHS’ Financial Systems Consolidation Project, OIG-08-47 

We evaluated the Department of Homeland Security’s (DHS) financial systems consolidation 

strategy. Specifically, our objective was to determine the progress DHS is making in developing 

and implementing its financial systems consolidation plan. 

The Resource Management Transformation Office (RMTO) has developed a strategy to 

consolidate key component financial systems to either the Systems Applications and Products 

(SAP) or Oracle Financial platforms. In addition, the RMTO has developed project plans and 

other supporting documentation for this financial systems consolidation project. These items 

include a migration timeline, a draft concept of operations, a systems development lifecycle 

document, and an internal alternatives analysis. 

Generally, the RMTO’s evaluation provided adequate support for its decision to use two financial 

systems solutions. However, the RMTO has not conducted a complete analysis of possible service 

providers outside of DHS as required by Office of Management and Budget (OMB) guidance, and 

DHS does not have a documented waiver from OMB indicating that they do not have to comply 

with this guidance. Additionally, during the fiscal year 2007 financial statement audit, the external 

auditors outlined problems with the change control process in the Oracle platform. These change 

control problems could cause unsupported adjustments to not only the United States Coast Guard 

(Coast Guard) and Transportation Security Administration (TSA) financial data, but also to the 

data of other DHS components that will be migrated to the new financial system. Finally, the 

external auditors said that these change control issues could potentially lead to a scope limitation 

for the DHS financial statement audit. 

Our report contains 3 recommendations aimed at improving the overall effectiveness of DHS’ 

strategy to consolidate financial systems within the department. These recommendations advise 

that the RMTO conduct a full analysis of possible service providers in the federal government, 

including the OMB centers of excellence, to determine if any of these systems can meet DHS’ 

financial management needs. In addition, the RMTO needs to improve its change control 

Letter Report: Review of DHS’ Financial Systems Consolidation Project 

1 
 

processes by identifying and correcting scripts being used by the Coast Guard and TSA. Your 

office concurred with all recommendations. Within 90 days of the date of this memorandum, 

please provide our office with additional information about the activities underway or planned by 

the RMTO to address our recommendations, including responsible parties, key milestones, and 

other supporting information. 

Consistent with our responsibility under the Inspector General Act, we are providing copies of our 

report to appropriate congressional committees with oversight and appropriation responsibility 

over the DHS. In addition, we will post a copy of the report on our website for public 

dissemination. 

Should you have any questions, please call me, or your staff may contact Frank Deffer, Assistant 

Inspector General for IT Audits, at (202) 254-4100. 

Financial Systems Consolidation Strategy 

The DHS Chief Financial Officer (CFO) has developed a strategy to consolidate the department’s 

financial systems down to two platforms—SAP and Oracle Financials. This effort is being called 

the Transformation and Systems Consolidation (TASC) program. According to the RMTO, by 

deciding to consolidate to these two financial systems, the CFO chose the decision of least risk, 

which is to move to an alternative already in place and one with which some of the components are 

already familiar. SAP and Oracle Financials are also two of the most widely used financial 

systems in the private and public sectors. In addition, these two financial platforms have been 

approved by the DHS Chief Information Officer (CIO) and meet the requirements of the 

department’s enterprise architecture. This is outlined in Homeland Security Management 

Directive number 0007.1, which states that each IT investment must align with the overall DHS 

enterprise architecture. 1 By selecting a system that meets the CIO’s guidelines, approval by the 

CIO’s enterprise architecture committee is not required. 

By consolidating down to these two platforms, the use of other department-wide financial systems 

will be minimized by the year 2011—42% of components transitioned by 2009 and 96% of 

components transitioned by 2011. Figure 1 represents the consolidation of DHS budget authority 

from eight financial systems to four by 2011. The major financial systems included in Figure 1 are 

as follows: Integrated Financial Management Information System (IFMIS), Oracle Federal 

Financial system (OFF), SAP, Federal Financial Management System (FFMS), Momentum, and 

the Department of Justice (DOJ). Eventually, the department will move from the two solutions to 

one final platform after the year 2011. 

1

 Homeland Security Management Directives System 0007.1, Information Technology Integration and 

Management, March 15, 2007. 

Letter Report: Review of DHS’ Financial Systems Consolidation Project 

2 
 

 

Figure 1: DHS Budget Authority 

The migration plan created by the RMTO and approved by Congress as part of the fiscal years 

2007-2008 expenditure plan is to incorporate the smaller components onto the Oracle platform and 

develop a best practices methodology to be used for the migration of larger components in the later 

years of the program. Once the Oracle baseline is in place, the solutions architect2

 will re-host the 

TSA and the Domestic Nuclear Detection Office to the DHS datacenter location in Stennis, 

Mississippi. 3 Following this move, the solutions architect will migrate the Office of Health 

Affairs and the Science and Technology directorates to the new baseline. Shown in Table 1 are the 

components and their current financial management systems. By the end of FY 2011, most of 

these components, with the exception of the Federal Law Enforcement Training Center and the 

U.S. Secret Service, will be moving to one of the two platforms. 

DHS Component Current Financial System 

Federal Law Enforcement Training Center Momentum 

U.S. Customs and Border Protection Systems Applications and Products in 

Data Processing (SAP) 

U.S. Coast Guard Core Accounting System (Oracle-based) 

Transportation Security Administration Core Accounting System (Oracle-based) 

Domestic Nuclear Detection Office Core Accounting System (Oracle-based) 

Federal Emergency Management Agency Integrated Financial Management 

Information System 

U.S. Secret Service Core Accounting System (Oracle-based) 

Immigration and Customs Enforcement Federal Financial Management System 

Citizenship and Immigration Service Federal Financial Management System 

DHS Headquarters 

• Office of Health Affairs 

• Science and Technology Directorate 

• Office of the Chief Information Officer 

• Office of the Chief Financial Officer 

• Office of the Chief Procurement Officer 

• National Protection and Programs 

• Intelligence and Analysis 

• Operations Coordination 

Federal Financial Management System 

Table 1 – DHS Components and Financial Systems 

2

 The solutions architect is the company that wins the contract award for the TASC project. 

3

 Currently the U.S. Coast Guard is the service provider for both the TSA and the Domestic Nuclear Detection 

Office. 

Letter Report: Review of DHS’ Financial Systems Consolidation Project 

3 
 

 

 

Throughout this process, the focus of the RMTO’s work has been on the Oracle baseline. For 

example, the request for proposals issued via the Enterprise Acquisition Gateway and Leading 

Edge solution states that there are two approved shared baselines for the financial systems 

consolidation; however, all of the tasks outlined in the RMTO documentation focus on the 

activities that pertain to the Oracle baseline. In addition, RMTO officials said that the only 

component that is considering moving to the SAP baseline is the Federal Emergency Management 

Agency (FEMA). However, additional evaluation needs to be completed by the RMTO and the 

solutions architect prior to the final decision. Moreover, the RMTO has created some of the 

documentation critical to DHS’ success in implementing an integrated financial system—all for 

the Oracle platform. These documents include a concept of operations, a draft program 

management plan, a systems development lifecycle document, a risk management plan, and a 

migration timeline. The RMTO is also currently working on a governance plan and charter, a 

change control configuration document, and a helpdesk support document. 

Evaluation of Operational Solutions Not Complete 

DHS did not perform a complete analysis of all potential systems and service providers as part of 

its process to select a financial systems solution. As a result, DHS may not have had sufficient 

information to support its decision to exclude obtaining financial system operational and hosting 

support from other sources. 

OMB Circular A-130 directs that federal agencies must ensure that decisions to improve existing 

information systems or develop new information systems are initiated only when no alternative 

private sector or governmental source can efficiently meet the need.4 Further, in 2005, OMB 

issued additional guidance on the Federal Management Line of Business Initiative.5 The Financial 

Management Line of Business Initiative’s overall vision is to improve the cost, quality, and 

performance of financial management systems by leveraging shared service solutions (i.e. Centers 

of Excellence), and implementing other government-wide reforms that foster efficiencies in federal 

financial operations. As required by this guidance, federal agencies must have competitive options 

available for financial systems, including consideration of shared service alternatives and existing 

federal financial systems, when deciding on a new agency financial system. As a part of this 

guidance, OMB discussed requirements for transparency and standardization among the Financial 

Management Line of Business Initiative and steps federal agencies should undertake in order to 

migrate to a center of excellence. 

Contrary to OMB guidance, the RMTO did not consider potential shared service providers or any 

other external agency as part of the alternatives analysis for the TASC program. Instead, the 

RMTO excluded the centers of excellence from consideration, without conducting a full analysis 

of their respective capabilities. An RMTO official said the department had obtained a verbal 

waiver from OMB, allowing DHS to exclude the centers of excellence from consideration, and to 

proceed with RMTO’s strategy for consolidating systems using the Oracle solution. OMB 

officials said that this waiver, while not documented, represents OMB’s official position on the 

4

 Office of Management and Budget Circular A-130, Management of Federal Information Resources, 

November 28, 2000-Revision. 

5

 Office of Management and Budget, Update on the Financial Management Line of Business and the 

Financial Systems Integration Office, Memorandum, December 16, 2005.
 Letter Report: Review of DHS’ Financial Systems Consolidation Project 

4 
 

 

matter. However, section 10.b of OMB Circular A-130 calls for written waiver requests, and 

requires that the agency publish the request in the Federal Register. 

After obtaining the waiver from OMB, the RMTO began to look internally to leverage current 

DHS investments. In determining which internal system solution was right for DHS, the RMTO 

conducted multiple analyses of current DHS component financial systems. The first analysis 

outlined DHS’ financial management vision, the current state of DHS’ financial management 

systems, the consolidation approach, and recommendations on the way forward. 

RMTO Analysis of Alternatives 

As part of this analysis, the RMTO identified four alternatives within the department as possible 

solutions for the financial systems consolidation effort. These four alternatives discussed were to: 

(1) build a new Department-level financial management system to supersede the component-level 

systems, (2) consolidate one or more existing component systems, (3) conduct a comprehensive 

upgrade to existing systems to address corrective action plan weaknesses, and (4) maintain status 

quo. Each of these alternatives was compared with the requirements outlined by the RMTO, and 

the analysis disclosed that of these four alternatives, the consolidation of component systems met 

all of these requirements. 

Once it was determined that the consolidation of component systems would best meet the 

department’s needs, the RMTO performed a second analysis to identify which internal systems 

could best be matched with internal DHS components. In this analysis the RMTO evaluated five 

systems: (1) FFMS—in use by the Immigrations and Customs Enforcement agency, (2) OFF—in 

use by TSA, (3) SAP—in use by the Customs and Border Protection, (4) IFMIS—in use by FEMA 

and (5) Momentum—in use by the Federal Law Enforcement Training Center. DHS determined 

that using two service providers would be the best benefit for the department because this option 

allowed DHS to leverage current investments already in place. 

Generally, the RMTO’s internal analyses provide adequate support for its decision to use two 

service providers in the initial stages of its financial systems consolidation strategy. However, its 

decision to exclude potential external service providers, such as other federal departments, is not 

supported by any documented analysis, and thus is not justified and should be revisited. A 

complete evaluation of potential service providers can help ensure that DHS is implementing the 

best system to support the processing of financial transactions and ultimately help DHS receive an 

unqualified opinion on its financial statements. 

Change Control Issues Exist with One of the Proposed Solutions 

The RMTO does not have a change control plan in place for the TASC program. As required by 

the DHS Sensitive Systems Policy Directive 4300A, DHS is required to prepare configuration 

management plans for all IT systems and establish, implement, and enforce configuration 

management controls as set forth by the configuration management plan. 6 Additionally, DHS’ 

draft System Lifecycle Guide requires that each IT project have a configuration plan, which 

6

 DHS Sensitive Systems Security Policy 4300.A, version 5.5, Information Technology Security Program, 

September 2007. 

Letter Report: Review of DHS’ Financial Systems Consolidation Project 

5 
 

identifies the configuration management policy, procedures, structures, and roles/responsibilities to 

be used in executing configuration management. This plan should also assess the impact of 

change, define the Change Control Board, and identify the processes used by the Change Control 

Board in evaluating and approving changes to the system. Additionally, OMB Memorandum 97-

16, Information Technology Architectures, requires configuration management and control 

processes as well as quality software engineering processes be implemented to maintain 

compliance with the architecture. 7 Specifically, this memorandum requires configuration changes 

to be tested and validated prior to acceptance for operational use across the architecture. The 

RMTO is finalizing a governance document and change control plan that will outline the process 

for system changes for the financial system once the Oracle baseline is moved to the DHS data 

center in Stennis, Mississippi. 

The National Institute of Standards and Technology, Special Publication 800-53, states that 

configuration change control involves the systematic proposal, justification, test/evaluation, 

review, and disposition of proposed changes. 8 The external financial statement auditors reported a 

lack of approvals for the initiation, testing, and final approval of regular and emergency system 

changes. The external auditors also found that the Coast Guard’s Finance Center in Chesapeake, 

Virginia, developed its own process to create and implement changes through the use of scripts. 

These scripts are used to increase the functionality of the system and fix data that are not properly 

processed in Coast Guard and TSA financial systems. Some of these scripts were developed to 

correct current software problems that have been awaiting development through the formal change 

control process. 

The presence of these scripts indicates that controls are not properly designed and that the integrity 

of TSA and Coast Guard financial data can be compromised. These scripts may cause 

unsupported adjustments to Coast Guard and TSA financial data that ultimately affect multiple 

accounts and financial statement line items. In addition, because these scripts are unsupported, 

there is the potential that they may not be considered when future system modifications and 

interfaces are developed for these systems. This could lead to more transaction processing errors 

that could result in the misstatement of Coast Guard, TSA, and DHS financial statements. The 

external auditors have indicated that these scripts could lead to a potential scope limitation for the 

financial statement audit. 

An RMTO official said that the RMTO would look into the scripting problem with the TSA Oracle 

Financial system. In addition, this official noted that while there will always be some scripts run 

with any system chosen, the RMTO nonetheless needs to research the scripts that are currently run 

to determine what procedures they perform and the effect of these procedures on TSA’s financial 

data. 

7

 Office of Management and Budget Memorandum 97-16, Information Technology Architectures, June 18, 

1997. 

8

 National Institute of Standards and Technology, Special Publications 800-53, revision 2 (Public 

Draft), Recommended Security Controls for Federal Information Systems, November 2007. 

Letter Report: Review of DHS’ Financial Systems Consolidation Project 

6 
Impact of April 15, 2008, Court Decision 

After we issued our draft report, the United States Court of Federal Claims issued a ruling in the 

bid protest case of Savantage Financial Services, Inc. vs. United States. In its decision, the court 

ruled that DHS’ decision to use Oracle and SAP financial software systems via “Brand Name 

Justification” document is an improper sole source procurement in violation of the Competition in 

Contracting Act. The court rejected DHS’ argument that its solicitation was not a procurement, 

but a task order under an existing contract. Further, the court determined that the DHS’ sole 

source procurement decision was arbitrary and capricious: there did not appear to be a reasonable 

basis for DHS’ decision, the contracting officer abused her discretion, and the decision violated 

applicable law. The court enjoined DHS from proceeding with the solicitation until DHS conducts 

a competitive procurement in accordance with the law to select financial management systems 

application software. 

In response to this decision, RMTO is revisiting its financial systems consolidation strategy. 

Recommendations 

We recommend that the DHS Chief Financial Officer direct the RMTO to: 

•	 Recommendation #1: Conduct a full evaluation of financial service providers available in 

the federal government, including OMB’s shared service providers, to determine if any of 

these systems can meet DHS’ financial management needs more efficiently. 

•	 Recommendation #2: Identify all scripts being used at the Coast Guard and TSA and 

analyze them to determine their effect on financial transactions, as well as their effect on 

DHS’ financial statements. 

•	 Recommendation #3: Correct the scripts before migrating any DHS components to the 

new TSA based DHS financial system. 

Management Comments and OIG Analysis 

We obtained written comments on a draft of this report from the DHS CFO. We have included a 

copy of the comments in their entirety at Appendix A. 

In the comments, the CFO concurred with all of the findings and recommendations of our report. 

In addition to providing formal responses to the three recommendations, the CFO and the RMTO 

provided us with technical clarification on some statements in the report. 

In response, the CFO concurred with Recommendation #1; however, the response does not 

adequately address our recommendation. The CFO’s response states that the RMTO will look at 

external providers who can help DHS implement the current TSA baseline approach. This is not 

the intent of our recommendation. The TSA baseline was selected by DHS without an analysis of 

financial systems external to DHS. The intent of our recommendation is for the CFO to review 

external agency financial systems to see if these systems are more efficient and cost effective to 

DHS before moving forward with the TSA baseline approach. 

Recommendation # 1 is considered unresolved and open. 

Letter Report: Review of DHS’ Financial Systems Consolidation Project 

7 
 

In response to recommendation # 2, the CFO stated that the RMTO has identified the scripts that 

affect financial transactions currently in use at the Coast Guard and the TSA. The CFO and 

RMTO have identified a total of 60 scripts, and in 20 cases the underlying issues have been 

corrected and the scripts have been eliminated. Ten additional scripts have been corrected and are 

undergoing government acceptance testing, and 30 remaining scripts still need to be fixed. Once 

the RMTO has successfully contracted a Solutions Architect, the RMTO, along with the contractor 

will identify the impact area of each script, its materiality, and assign it a priority. 

In response to recommendation #3, the CFO outlined various efforts to correct scripts before 

migrating any DHS components to the new TSA based financial system. The CFO and RMTO 

will ensure that scripts are eliminated before any components go to the new system. Project plans 

will be available to oversee and monitor corrective action activities. 

Recommendations #2 and #3 are considered to be resolved but open pending verification of 

planned action. 

****************** 

This review is based on analysis of applicable documentation and interviews with personnel and 

officials of relevant agencies and institutions. We conducted our audit from August 2007 to 

January 2008 under the authority of the Inspector General Act of 1978, as amended, and according 

to generally accepted government audit standards. 

Letter Report: Review of DHS’ Financial Systems Consolidation Project 

8 
Appendix A: Management Response 

Letter Report: Review of DHS’ Financial Systems Consolidation Project 

9
 
 

10
 

Appendix A: Management Response 

Letter Report: Review of DHS’ Financial Systems Consolidation Project 
Letter Report: Review of DHS’ Financial Systems Consolidation Project 

11
 

Appendix A: Management Response 
Letter Report: Review of DHS’ Financial Systems Consolidation Project 

12
 

Appendix A: Management Response 
Letter Report: Review of DHS’ Financial Systems Consolidation Project 

13 

Appendix B: Major Contributors 

Frank Deffer, Assistant Inspector General, Department of Homeland Security, 

Information Technology Audits 

Sharon Huiswoud, Director, Department of Homeland Security, Information 

Technology Audits 

John McCoy, Director, Department of Homeland Security, Financial 

Management Audits 

Meghan Sanborn, Senior Program Analyst, Department of Homeland 

Security, Information Technology Audits 

Anthony Nicholson, Senior IT Auditor, Department of Homeland Security, 

Information Technology Audits 

Matthew Worner, Referencer, Department of Homeland Security, Information 

Technology Audits 
Letter Report: Review of DHS’ Financial Systems Consolidation Project 

14 

 

 

Appendix C: Distribution List 

Department of Homeland Security 

Secretary 

Deputy Secretary 

Chief of Staff 

Deputy Chief of Staff 

General Counsel 

Executive Secretary 

Director, GAO/OIG Liaison Office 

Assistant Secretary for Policy 

Assistant Secretary for Legislative Affairs 

Assistant Secretary for Public Affairs 

Under Secretary for Management 

Director, GAO/OIG Liaison 

Chief Information Officer 

Office of Management and Budget 

Chief, Homeland Security Branch 

DHS OIG Budget Examiner 

Congress 

Congressional Oversight and Appropriations Committees, as appropriate 
 

Additional Information and Copies 

To obtain additional copies of this report, call the Office of Inspector General (OIG) at 

(202) 254-4199, fax your request to (202) 254-4305, or visit the OIG web site at 

www.dhs.gov/oig. 

OIG Hotline 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal 

or noncriminal misconduct relative to department programs or operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

•	 Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, Attention: 

Office of Investigations - Hotline, 245 Murray Drive, SW, Building 410, 

Washington, DC 20528, 

The OIG seeks to protect the identity of each writer and caller.