DHS' Progress in 

Implementing the Federal 

Information Technology 

Acquisition Reform Act 

October 21, 2016 

OIG-16-138 (revised) 
 

 

 

 

 

DHS OIG HIGHLIGHTS 

DHS’ Progress in Implementing the Federal

Information Technology Acquisition Reform Act 

October 21, 2016 

Why We Did 

This Audit 

In 2012, we reported on 

DHS’ challenges in 

implementing an effective 

information technology (IT) 

management program. 

FITARA was enacted in 

2014 to institutionalize IT 

reform across the Federal 

Government. We 

conducted this audit to 

determine the extent to 

which DHS has 

implemented FITARA to 

improve department-wide 

IT management and 

oversight. 

 

What We 

Recommend 

We made three 

recommendations to the 

DHS CIO to ensure 

effective implementation of 

the authorities and 

reporting requirements of 

FITARA. 

For Further Information: 

Contact our Office of Public Affairs at 

(202) 254-4100, or email us at 

DHS-OIG.OfficePublicAffairs@oig.dhs.gov 

 

What We Found 

The Department of Homeland Security (DHS) reported 

substantial progress implementing the Federal Information 

Technology Acquisition Reform Act (FITARA) to improve 

department-wide IT management and oversight. As of April 

2016, DHS stated it had implemented 11 of the 17 required 

FITARA elements to enhance the Chief Information Officer’s 

(CIO) budget, acquisition, and organizational authority. 

Milestones have been established to fulfill the remaining six 

elements by March 2018. The reported progress was largely 

due to the focused efforts of CIO office personnel to 

establish a FITARA Implementation Team and ensure DHSwide collaboration. Such actions have resulted in 

department-wide IT management enhancements and policy 

revisions, although the outcome of these actions could not 

yet be measured at the time of our review. 

The Department must take additional steps to improve IT 

investment transparency, risk management, and review 

and reporting processes in line with FITARA. The CIO office 

has implemented several key enhancements, such as 

updating the agency-wide IT portfolio review process. 

However, other requirements such as reporting on the use 

of incremental development and conducting program 

reviews of high-risk investments were not fully met. These 

shortfalls were due, in part, to incomplete departmental 

processes to ensure compliance. Until these requirements 

are fully implemented, DHS will be challenged to ensure 

accurate reporting on adoption of incremental development 

and timely reviews of its high-risk IT investments. 

DHS Response 

The DHS CIO concurred with our recommendations. 

www.oig.dhs.gov OIG-16-138 
o~,en~~FYr

a

3E Jqr

`"~° ~f` 

OFFICE OF INSPECTOR GENERAL

Department of Homeland Security

Washington, DC 20528 / www.oig.dhs.gov

October 21, 2016

MEMORANDUM FOR: Luke J. McCormack

Chief Information Officer

De artment of Homeland Security

FROM: Sondra F. M auley

Assistant Inspector General

Office of Information Technology Audits

SUBJECT: DHS' Progress in Implementing the Federal Information

Technology Acquisition Reform Act (OIG-16-138)

Attached for your information is our revised final report, DHS' Progress in

Implementing the Federal Information Technology Acquisition Reform Act

(FITARA). We reissued the report with revisions to clarify in the Highlights and

Results of Audit sections that reported DHS progress in FITARA

implementation was based on DHS 2016 FITARA Self-Assessment, which was

submitted to the Office of Management and Budget on April 29, 2016. We also

make it clear in our revised Objective, Scope, and Methodology section that,

because FITARA implementation was in an early phase and continuously

changing during our field work, we did not take steps to verify the information

the Department reported. These revisions do not change the overall findings or

recommendations in the report. Please see the attached errata sheet for details.

Please call me with any questions, or your staff may contact Kristen Bernard,

Director, Information Technology Management Division, at (202) 254-0962.

Attachment
 

 

 

 

Errata page for OIG-16-138 

DHS’ Progress in Implementing the Federal

Information Technology Acquisition Reform Act 

Change made to the DHS OIG Highlights section, 1st paragraph, 1st 

sentence (see below): 

Changed from:
 

The Department of Homeland Security (DHS) has made significant progress 

implementing the Federal Information Technology Acquisition Reform Act
 

(FITARA) to improve department-wide IT management and oversight. 

Changed to:
 

The Department of Homeland Security (DHS) reported substantial progress 

implementing the Federal Information Technology Acquisition Reform Act
 

(FITARA) to improve department-wide IT management and oversight. 

Change made to the DHS OIG Highlights section, 1st paragraph, 2nd 

sentence (see below): 

Changed from:
 

Since August 2015, DHS has fully implemented 11 of the 17 required 

FITARA elements to enhance the Chief Information Officer’s (CIO) budget, 

acquisition, and organizational authority. 

Changed to:
 

As of April 2016, DHS stated it had implemented 11 of the 17 required 

FITARA elements to enhance the Chief Information Officer’s (CIO) budget, 

acquisition, and organizational authority.
 

Change made to the DHS OIG Highlights section, 1st paragraph, 4th 

sentence (see below): 

Changed from:
 

The progress made was largely due to the focused efforts of CIO office 

personnel to establish a FITARA Implementation Team and ensure DHSwide collaboration. 

Changed to:
 

The reported progress was largely due to the focused efforts of CIO office 

personnel to establish a FITARA Implementation Team and ensure DHSwide collaboration. 
 

 

Change made to the Results of Audit section, page 8, 1st paragraph, 1st 

sentence (see below): 

Changed from:
 

DHS has made significant progress implementing FITARA to improve
 

department-wide IT management and oversight. 

Changed to:
 

DHS reported substantial progress implementing FITARA to improve 

department-wide IT management and oversight. 

Change made to the Results of Audit section, page 8, 1st paragraph, 2nd 

sentence (see below): 

Changed from:
 

Since August 2015, DHS has fully implemented 11 of the 17 required FITARA 

elements to enhance CIO’s budget, acquisition, and organizational authority.
 

Changed to:
 

As of April 2016, DHS stated it had implemented 11 of the 17 required 

FITARA elements to enhance CIO’s budget, acquisition, and organizational 

authority. 

Change made to the Results of Audit section, page 8, 1st paragraph, 4th 

sentence (see below): 

Changed from:
 

The progress made was largely due to the focused efforts of CIO office 

personnel to establish a FITARA Implementation Team and ensure DHS-wide 

collaboration.
 

Changed to:
 

The reported progress was largely due to the focused efforts of CIO office 

personnel to establish a FITARA Implementation Team and ensure DHS-wide 

collaboration.
 

Change made to the Progress in Enhancing CIO Authorities under 

FITARA section, page 8, 1st paragraph, 1st sentence (see below): 

Changed from:
 

The Department made significant progress in implementing many of the 17 CIO 

responsibilities identified in OMB’s Common Baseline for IT Management, 

outlined earlier in table 1. 
 

 

 

Changed to:
 

The Department reported substantial progress in implementing many of the 17 

CIO responsibilities identified in OMB’s Common Baseline for IT Management, 

outlined earlier in table 1.
 

Change made to the Progress in Enhancing CIO Authorities under 

FITARA section, page 8, 1st paragraph, 2nd sentence (see below): 

Changed from:
 

As of April 30, 2016, DHS had fully implemented 11 elements and had partially 

implemented the remaining 6 elements. 

Changed to:
 

In its April 30, 2016 self-assessment, DHS stated it had fully implemented 11 

elements and had partially implemented the remaining 6 elements. 

Change made to the Progress in Enhancing CIO Authorities under 

FITARA section, page 8, 1st paragraph, 4th sentence (see below): 

Changed from:
 

(For a complete status of DHS’ progress in implementing the Common 

Baseline, see appendix C.)
 

Changed to:
 

(For a complete status of DHS’ reported progress in implementing the Common 

Baseline, see appendix C.)
 

Change made to the Progress in Enhancing CIO Authorities under 

FITARA section, page 9, Table 2, Table Title (see below): 

Changed from:
 

Table 2. Implementation Progress as of April 2016
 

Change to: 

Table 2. DHS Assessment of FITARA Implementation Progress as of April 2016
 

Change made to the Progress in Enhancing CIO Authorities under 

FITARA section, page 9, Table 2, Table Source (see below): 

Changed from:
 

Source: OIG-generated from OCIO data
 

Change To: 

Source: OIG-generated from DHS’ 2016 FITARA Self-Assessment
 
 

 

 

Change made to the Progress in Enhancing CIO Authorities under 

FITARA section, page 9, 2nd paragraph, 4th sentence (see below): 

Changed from:
 

By that time, OCIO had completed 109 of the 131 required actions and had 

defined milestones for completing the remaining 22 actions by March 2018, as 

shown in table 3.
 

Change to: 

By that time, OCIO reported it had completed 109 of the 131 required actions 

and had defined milestones for completing the remaining 22 actions by March 

2018, as shown in table 3.
 

Change made to the Progress in Enhancing CIO Authorities under 

FITARA section, page 10, Table 3, Table Title (see below): 

Changed from:
 

Table 3. Milestones for Completion of the Remaining 22 Action Items
 

Change to: 

Table 3. DHS Milestones for Completing the Remaining 22 Action Items
 

Change made to the Progress in Enhancing CIO Authorities under 

FITARA section, page 10, Table 3, Table Source (see below): 

Changed from:
 

Source: OIG-generated from OCIO data
 

Change to: 

Source: OIG-generated from DHS’ 2016 FITARA Self-Assessment
 

Change made to the FITARA Implementation Progress Ensured by 

Focused OCIO Approach section, page 10, 1st paragraph, 1st sentence 

(see below): 

Changed from:
 

DHS progress in implementing FITARA was attributable to efforts by OCIO 

personnel to establish a FITARA Implementation Team and ensure departmentwide collaboration.
 

Change to:
 

DHS’ reported progress in implementing FITARA was attributable to efforts by 

OCIO personnel to establish a FITARA Implementation Team and ensure 

department-wide collaboration.
 
 

 

Change made to the FITARA Implementation Has Resulted in 

Documented Enhancements, But Few Realized Benefits to Date section, 

page 12, 2nd paragraph, 1st sentence (see below): 

Changed from:
 

In March 2016, OCIO personnel also restructured the steps in the Budget 

Execution phase to increase the DHS CIO’s visibility of IT reprogramming 

requests.
 

Change to:
 

In March 2016, OCIO personnel also reported restructuring steps in the 

Budget Execution phase to increase the DHS CIO’s visibility of IT
 

reprogramming requests.
 

Change made to the Appendix A: Objective, Scope, and Methodology, 

page 22, 3rd paragraph, 3rd sentence (see below): 

Sentences added:
 

We obtained DHS’ report to OMB on its progress in implementing FITARA. 

Because implementation was in an early phase and continuously changing, we 

did not take steps to verify the information at that time, but will conduct a 

follow-up verification audit at a later date.
 

Change made to the Appendix C: DHS’ Common Baseline 

Implementation Status, page 26, Table Source (see below): 

Changed from:
 

Source: OIG-generated from DHS OCIO data
 

Change to: 

Source: OIG-generated from DHS’ 2016 FITARA Self-Assessment
 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Table of Contents 

Background .................................................................................................... 2
 

Results of Audit .............................................................................................. 8
 

Progress in Enhancing CIO Authorities under FITARA ........................... 8
 

Recommendations ............................................................................... 16
 

IT Investment Review and Reporting Functions Need Additional 

Improvement ....................................................................................... 18
 

Recommendations ............................................................................... 20
 

Appendixes 

Appendix A: Objective, Scope, and Methodology ................................. 22
 

Appendix B: DHS Comments to the Draft Report ................................. 24
 

Appendix C: DHS’ Common Baseline Implementation Status ............... 26
 

Appendix D: Office of IT Audits Major Contributors to This Report ....... 27
 

Appendix E: Report Distribution.......................................................... 28
 

Abbreviations 

CIO Chief Information Officer 

EBMO Enterprise Business Management Office 

FITARA Federal Information Technology Acquisition Reform Act 

IT information technology 

OCIO Office of the Chief Information Officer 

OIG Office of Inspector General 

OMB Office of Management and Budget 

www.oig.dhs.gov OIG-16-138 
 

 

 

 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Background
 

The Homeland Security Act of 2002,1 as amended, established the position of 

the DHS Chief Information Officer (CIO). The primary mission of the DHS CIO, 

as outlined in the 2014 DHS Information Technology Integration and 

Management Directive, is to oversee and manage all Department information 

technology (IT) systems and to establish IT priorities, policies, processes, 

standards, guidelines, and procedures.2 The CIO governs across the 22 

component agencies to ensure that technologies and services are in place and 

effectively managed to meet the Department’s mission needs. 

DHS components rely heavily on IT to perform a wide range of mission 

operations, including counterterrorism, border security, and emergency 

response. To support its mission operations in fiscal year 2016, DHS had an IT 

budget of approximately $6.2 billion, representing approximately 15 percent of 

the overall DHS budget of nearly $41 billion. Given the size and significance of 

this investment, effective management of IT programs and expenditures is 

critical. 

The DHS CIO reports to the Under Secretary for Management and is supported 

by the Office of the CIO (OCIO), which administers the Department’s IT 

infrastructure, applications, services, and management functions. OCIO is 

responsible for ensuring that DHS’ approximately 240,000 employees remain 

connected to the Department’s IT infrastructure environment and receive the 

needed operational support. Figure 1 shows the current DHS OCIO 

organizational structure. 

1 Public Law 107-296 

2 DHS Directive 142-02, Information Technology Integration and Management, February 6, 2014 

www.oig.dhs.gov 2 OIG-16-138 
 

 

 

 

 

 

 

 

 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Figure 1. DHS OCIO Organizational Structure 

Source: DHS website 

Federal statutes and regulations provide guidance for establishing an effective 

IT management structure, which is increasingly critical to Federal agency 

success. The Clinger-Cohen Act of 1996 requires that Federal agencies establish 

a CIO to institute, guide, and oversee frameworks for managing IT agencywide.3 Additionally, the Act gives agency CIOs the responsibility for advising 

the agency head on whether IT programs and projects should be continued, 

modified, or terminated, as well as overseeing the acquisition of IT resources. 

However, despite the CIO authorities granted, the continuance of duplicative, 

wasteful, and low-value investments have highlighted the need to further 

strengthen IT management and governance practices across the Federal 

Government. 

Further, the Office of Management and Budget (OMB) implemented a series of 

Federal IT reform initiatives beginning in 2009. These initiatives included: 

•	 Federal IT Dashboard – a public website providing performance updates 

and supporting data for major IT investments.4 

•	 TechStat Accountability Sessions – a framework for OMB and agency 

leadership to use to conduct IT program reviews.5 

3 Public Law 104-106
 4 The IT Dashboard was launched on June 1, 2009, to provide Federal agencies and the public 

the ability to view details on IT investments online and to track their progress over time.
 5 OMB Memorandum 10-31, Immediate Review of Information Technology Projects, July 28,
 

www.oig.dhs.gov 3	 OIG-16-138 

2010 
 

 

 

 

 

 

 

 

 

 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

•	 Federal Data Center Consolidation Initiative – an effort to reduce 

redundancy and inefficiency among the growing number of data centers 

across the Federal Government.6 

•	 IT Reform Plan – an initiative by the Federal CIO to improve IT 

acquisitions and operational efficiencies, and to deliver more IT value to 

the taxpayer.7 

•	 PortfolioStat – a standard approach for agencies to conduct annual, 

agency-wide IT portfolio reviews to reduce commodity IT spending and 

demonstrate how IT investments align with agency mission and business 

functions.8 

The timeline in figure 2 shows when OMB enacted these initiatives. 

Figure 2. IT Reform Initiatives Timeline 

Source: DHS Office of Inspector General (OIG)-generated using OMB IT reform 

guidance 

Although these initiatives increased IT governance capabilities across the 

Federal Government, management deficiencies remained. Recognizing a need 

for additional reform in government-wide IT management, Congress enacted 

the Federal Information Technology Acquisition Reform Act (FITARA) in 

December 2014.9 This legislation was intended to create more enduring 

improvements to Federal agency IT management practices and build upon the 

CIO responsibilities outlined in the Clinger-Cohen Act. 

6 Federal CIO Memorandum, Federal Data Center Consolidation Initiative, February 26, 2010 

7 Federal CIO’s 25-Point Implementation Plan to Reform Federal Information Technology 

Management, December 9, 2010 

8 OMB Memorandum 12-10, Implementing PortfolioStat, March 30, 2012 

9 Public Law 113-291. 

www.oig.dhs.gov 4	 OIG-16-138 
 

 

 

 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

FITARA requirements are separated into unique but interrelated elements 

intended to institutionalize previous reform initiatives and significantly improve 

the overall management and governance of IT across the Federal Government. 

The key elements of FITARA are: 

•	 Agency CIO Authority Enhancements 

•	 Enhanced Transparency and Improved Risk Management 

•	 Portfolio Review 

•	 Federal Data Center Consolidation Initiative 

•	 Expansion of Training and Use of IT Cadres 

•	 Maximizing the Benefit of the Federal Strategic Sourcing Initiative 

•	 Government-wide Software Purchasing Program 

In June 2015, OMB released implementation guidance in a memorandum, 

Management and Oversight of Federal Information Technology, to help agencies 

align their IT resources with specific FITARA requirements.10 This guidance 

was intended to: 

•	 establish government-wide IT management controls that meet FITARA 

requirements, while providing agencies with the flexibility to adapt to 

unique internal requirements and processes; 

•	 clarify the CIO’s role and strengthen the relationship between agency and 

bureau CIOs; and 

•	 strengthen CIO accountability for IT cost, schedule, performance, and 

security. 

OMB’s June 2015 memorandum also identified specific IT management 

controls, referred to as the Common Baseline for IT Management, to enhance 

CIO authority and accountability.11 As shown in table 1, the Common Baseline 

included 17 specific responsibilities across 4 main areas of CIO authority: (1) 

Budget Formulation; (2) Budget Execution; (3) Acquisition; and 

(4) Organization and Workforce. The Common Baseline also addressed the roles 

and responsibilities of other Senior Agency Officials engaged in IT investment 

oversight. 

10 OMB Memorandum 15-14, Management and Oversight of Federal Information Technology,
 

June 10, 2015
 11 OMB Memorandum 15-14, Management and Oversight of Federal Information Technology,
 

June 10, 2015, Attachment A: Common Baseline for IT Management and CIO Assignment Plan
 

provides descriptions for each of the 17 required capabilities, identified by letters “A” through
 

“Q” explaining the roles and responsibilities for CIOs as well as other Senior Agency Officials.
 

www.oig.dhs.gov 5	 OIG-16-138 
 

 

 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Table 1. OMB’s Common Baseline for IT Management 

Source: OIG-generated from OMB guidance 

OMB’s guidance for implementing the Common Baseline includes three 

primary actions for agencies to perform in 2015 and 2016: 

•	 Complete a self-assessment and implementation plan for submission to 

OMB by August 15, 2015. 

•	 Fully implement Common Baseline responsibilities by December 31, 

2015. 

•	 Conduct annual reviews and updates to the self-assessment, with the 

first update to OMB on April 30, 2016, and subsequent updates due 

April 30th of each year. 

IT reform is needed to help DHS create a unified IT infrastructure for effective 

department-wide IT management. Since its inception in 2003, the Department 

has faced longstanding challenges in the areas of CIO authority and IT 

investment management. We have issued three reports to help the Department 

improve in these areas. 

www.oig.dhs.gov 6	 OIG-16-138 
 

 

 

 

 

 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

•	 In 2004, we reported that the DHS CIO was not a member of the senior 

management team with the authority to strategically manage 

department-wide IT assets and programs. We recommended that, among 

other things, the Deputy Secretary assign the CIO a key role in all levels 

of the Department’s investment review process.12 

•	 In 2008, we reported that ongoing staffing shortages and inconsistent IT 

budget practices continued to impede progress and hinder the CIO’s 

ability to ensure IT management practices. We recommended that the 

CIO update the OCIO staffing plan, and develop comprehensive budget 

and strategic plans aligned with DHS’ mission.13 

•	 In 2012, we reported that the CIO had increased oversight and authority 

of IT. However, budget review process improvements were needed to 

enable the CIO to identify and resolve issues before IT investments were 

finalized. We recommended that the Deputy Under Secretary for 

Management assign the CIO centralized control over the Department’s IT 

budget planning process.14 

12 Improvements Needed to DHS’ Information Technology Management Structure, OIG-04-30, 

July 2004 

13 Progress Made in Strengthening DHS Information Technology Management, But Challenges 

Remain, OIG-08-91, September 2008 14 DHS Information Technology Management Has Improved, But Challenges Remain, OIG-12-82, 

May 2012 

www.oig.dhs.gov 7	 OIG-16-138 
 

 

 

 

 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Results of Audit
 

DHS reported substantial progress implementing FITARA to improve 

department-wide IT management and oversight. As of April 2016, DHS stated it 

had implemented 11 of the 17 required FITARA elements to enhance CIO’s 

budget, acquisition, and organizational authority. Milestones have been 

established to fulfill the remaining six elements by March 2018. The reported 

progress was largely due to the focused efforts of CIO office personnel to 

establish a FITARA Implementation Team and ensure DHS-wide collaboration. 

Such actions have resulted in department-wide IT management enhancements 

and policy revisions, although the outcome of these actions could not yet be 

measured at the time of our review. 

The Department must take additional steps to improve IT investment 

transparency, risk management, and review and reporting processes in line 

with FITARA. The CIO office has implemented several key enhancements, such 

as updating the agency-wide IT portfolio review process. However, other 

requirements such as reporting on the use of incremental development and 

conducting program reviews of high-risk investments were not fully met. These 

shortfalls were due, in part, to incomplete departmental processes to ensure 

compliance. Until these requirements are fully implemented, DHS will be 

challenged to ensure accurate reporting on adoption of incremental 

development and timely reviews of its high-risk IT investments. 

Progress in Enhancing CIO Authorities under FITARA 

The Department reported substantial progress in implementing many of the 17 

CIO responsibilities identified in OMB’s Common Baseline for IT Management, 

outlined earlier in table 1. In its April 30, 2016 self-assessment, DHS stated it 

had fully implemented 11 elements and had partially implemented the 

remaining 6 elements. As shown in table 2, the Department’s most substantial 

progress was in the area of budget formulation, which entailed ensuring 

visibility over IT resources and a CIO role in budget submissions, planning, 

and requests. (For a complete status of DHS’ reported progress in 

implementing the Common Baseline, see appendix C.) 

www.oig.dhs.gov 8 OIG-16-138 
 

 

 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Table 2. DHS Assessment of FITARA Implementation Progress as of April 

2016 

Source: OIG-generated from DHS’ 2016 FITARA Self-Assessment 

In August 2015, the Department completed an initial FITARA Common 

Baseline Self-Assessment and Plan, also as required by OMB.15 One key 

element of this plan was establishing a baseline by which to measure 

alignment with each of the 17 specific requirements. To perform this 

measurement, OCIO personnel reviewed their existing IT management policy 

documents, standard operating procedures, and documented processes to 

identify which of the 17 required capabilities were already in place. The 

Department concluded that it had 3 elements fully implemented and 14 

elements partially implemented at that time. 

The Department’s initial 2015 self-assessment and plan also identified specific 

actions needed to fully implement each of the 17 Common Baseline elements. 

OMB approved this plan in October 2015 and agreed with the current status, 

actions, and target dates the Department had identified. In April 2016, the 

Department conducted its first annual review and update of the selfassessment. By that time, OCIO reported it had completed 109 of the 131 

required actions and had defined milestones for completing the remaining 22 

actions by March 2018, as shown in table 3. 

15 DHS FITARA Common Baseline Self-Assessment and Plan, August 15, 2015 

www.oig.dhs.gov 9 OIG-16-138 
 

 

 

 

 

 

 

 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Table 3. DHS Milestones for Completing the Remaining 22 Action Items 

Source: OIG-generated from DHS’ 2016 FITARA Self-Assessment16 

FITARA Implementation Progress Ensured by Focused OCIO Approach 

DHS’ reported progress in implementing FITARA was attributable to efforts by 

OCIO personnel to establish a FITARA Implementation Team and ensure 

department-wide collaboration. The team was put in place in April 2015 to lead 

and manage the execution and coordination of all FITARA implementation 

activities. The Executive Director of the OCIO Enterprise Business Management 

Office (EBMO) oversees this team, which is comprised of five Directors and four 

supporting staff. Team activities included defining, assigning, and completing 

the 131 actions listed in OCIO’s FITARA implementation plan. The team 

documented “as-is” processes, collaborated with subject matter experts, 

reviewed existing policies, and drafted documents needed to support FITARA 

implementation. 

Further, the implementation team effectively collaborated with Chief Executives 

Offices and department-wide stakeholders to carry out implementation efforts. 

For example, the team conducted weekly working group sessions with these 

stakeholders to redesign business processes and update policies. The team also 

established a FITARA Component Integrated Planning Team as a formal 

mechanism to work with component CIOs. Starting in November 2015, 13 

component CIOs had appointed representatives to serve as members of the 

integrated planning team and as points of contact for weekly coordination 

meetings with the FITARA Implementation Team. 

16 Table 3 represents the status of action items as of the Department’s formal FITARA selfassessment and update submitted to OMB on April 30, 2016. We did not verify the status of 

action items scheduled for completion in May 2016, just after the end of our fieldwork. The one 

outstanding action item related to budget formulation pertained to a pilot initiative that was 

not considered essential for achieving full implementation of the FITARA budget formulation 

elements. 

www.oig.dhs.gov 10 OIG-16-138 
 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

FITARA Implementation Has Resulted in Documented Enhancements, But 

Few Realized Benefits to Date 

By April 2016, OCIO’s implementation efforts had resulted in much-needed 

revisions to department-wide IT management processes and policy. Specifically, 

OCIO had documented updates to various processes and policies to enhance 

CIO authority in the Common Baseline areas of IT budget formulation, budget 

execution, acquisition, and organization and workforce. However, these 

updates were largely improvements on paper, with measurable outcomes not 

yet evident, as of the completion of our fieldwork. Until the FITARA 

improvements are fully executed with performance measures in place to ensure 

their effectiveness, the Department will be hampered by the IT budget and 

acquisition challenges we have reported on since DHS’ inception in 2003. 

Updates to IT Processes and Policies 

FITARA implementation has resulted in updates to various processes and 

policies. Such updates are intended to enhance CIO authority in the Common 

Baseline areas of IT budget formulation, budget execution, acquisition, and 

organization and workforce. As of the end of our audit fieldwork, these policies 

remained largely conceptual and had not yet been put in practice. 

First, from late 2015 to early 2016, OCIO personnel reviewed and revised their 

existing budget process in collaboration with the Office of the Chief Financial 

Officer. The budget process, known as the Department’s Planning, 

Programming, Budgeting, and Execution process, shown in figure 3, was 

reviewed in detail to realign the CIO’s roles and responsibilities to meet 

FITARA requirements throughout each of the four phases of the budget cycle. 

www.oig.dhs.gov 11 OIG-16-138 
 

 

 

 

 

 

 

 

 

 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Figure 3. Revisions to DHS’ Planning, Programming, Budgeting, and 

Execution Process
 

Source: OIG-generated based on DHS data 

The programming phase, for example, was refined to enable the CIO to 

influence component IT budgets early in the process. The revised programming 

phase requires component CIOs to develop their IT spending plans, also called 

Resource Allocation Plans, in collaboration with the Department CIO.17 

Previously, there was minimal collaboration between the DHS OCIO and 

component OCIOs in developing these requests for IT resources. OCIO 

anticipates that once the Department CIO and component CIOs carry out this 

updated process in upcoming budget cycles, it will provide greater assurance 

that component IT budget plans are aligned with departmental IT goals and 

objectives. 

In March 2016, OCIO personnel also reported restructuring steps in the 

Budget Execution phase to increase the DHS CIO’s visibility of IT 

reprogramming requests.18 Specifically, the updated process provides the CIO 

with greater review and approval authority over component IT-related 

reprogramming submissions. Prior to this change, components could make 

reprogramming requests without the DHS CIO’s oversight. OCIO expects this 

17 Components develop their Resource Allocation Plan based on the strategic guidance derived
 

from the planning phase of the Planning, Programming, Budgeting, and Execution process.
 

Resource Allocation Plans, developed during programming, serve as the basis for how
 

components propose to fund their operations in coming years. 18 Reprogramming allows components to transfer funds among appropriations during budget
 

execution.
 

www.oig.dhs.gov 12 OIG-16-138 
 

 

 

 

 

 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

process change will help ensure CIO influence regarding any adjustments to IT 

spending plans that could have potential impact on the Department’s IT 

environment. 

The Department revised two key budget policies in March 2016 to reflect these 

enhancements to the CIO’s budget authority. Specifically, OCIO and the Office 

of the Chief Financial Officer updated Directive 102-02, Capital Planning and 

Investment Control, signed on March 23, 2016. They also updated Directive 

101-01, Planning, Programming, Budget, and Execution, which was pending 

signature by the Under Secretary for Management as of May, 2016. These 

policies are expected to improve the DHS CIO’s oversight of IT budget requests 

once they become day-to-day practice. 

Second, to meet FITARA’s IT acquisition requirements, the Department 

expanded the CIO’s role in the IT acquisitions review process. Specifically, in 

2015 OCIO personnel worked with the Office of the Chief Procurement Officer 

to update the Department’s existing acquisition plan review and approval 

process to include CIO certification of major IT program acquisition plans.19 

This certification was intended to provide the DHS CIO with an opportunity to 

influence major programs early in the acquisition life cycle. The CIO had begun 

certifying acquisition plans for major programs as of May 2016. OCIO 

personnel were working to formally integrate this certification step into their IT 

Acquisition Review process by October 2016. OCIO anticipates that, once fully 

implemented, this revised process will increase the CIO’s ability to steer IT 

investments toward the use of DHS shared services, IT already existing in other 

components, strategic sourcing, and other approaches to both reduce costs 

and improve the end product. 

OCIO personnel worked with personnel from the Office of the Chief 

Procurement Officer during 2016 to revise three key policies to reflect these 

enhancements to the CIO’s acquisition authority: DHS Instruction 102-01-

001, Acquisition Management Instruction; the Homeland Security Acquisition 

Manual; and the Acquisition Planning Guide. The policy updates, completed in 

March 2016, are expected to improve the DHS CIO oversight, upon integration 

into routine IT acquisition practice. 

Third, to meet FITARA’s organization and workforce requirements, OCIO 

reviewed the existing performance framework to ensure the DHS CIO has 

sufficient input into component CIOs’ annual performance evaluations. OCIO 

personnel worked with the Office of the Chief Human Capital Officer during 

19 An acquisition plan is a key tool for managing major acquisitions by providing comprehensive 

documentation of the end-to-end acquisition approach. 

www.oig.dhs.gov 13 OIG-16-138 
 

 

 

 

 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

2015 on how best to revise performance plans for component CIOs to reflect 

this change. The updated CIO evaluation criteria were included in the March 

2016 performance plan guidance to component heads for execution. 

Measurable Outcomes of FITARA Enhancements not yet Evident 

Despite these process and policy revisions to meet FITARA requirements, they 

largely remained improvements on paper with few measurable outcomes as of 

the May 2016 end of our fieldwork. EBMO and Chief Executive Office personnel 

agreed it was too early in the FITARA implementation process to assess its 

impact. Until FITARA improvements are fully institutionalized with 

performance measures in place to ensure their effectiveness, the Department 

will continue to be hampered by the IT budget and acquisition challenges we 

have reported on since DHS’ inception in 2003. 

For example, only upon complete implementation will the FITARA 

enhancements address ongoing deficiencies in the CIO’s IT budget authority. 

Specifically, we reported in 2012 that the Department’s current IT budget 

process did not provide the DHS CIO opportunity to effectively influence 

components’ IT budgets.20 Although the DHS CIO conducted a review of all 

components’ IT budgets as part of the existing budget formulation process, the 

review took place after components had completed planning activities for 

specific IT initiatives. The review was not effective in changing component IT 

spending plan submissions. As a result, components could obtain funding for 

IT investments, regardless of the DHS CIO’s input during the budget review 

process. 

Additionally, only upon complete implementation will the FITARA 

enhancements provide the Department CIO with greater authority and visibility 

needed to address longstanding IT acquisition oversight deficiencies. For 

example, in 2004, we reported that the DHS CIO did not have sufficient 

visibility or approval authority for department-wide IT investments.21 We later 

reported in 2008 and 2012 that the DHS CIO had taken steps to improve IT 

acquisition authority.22 This included establishing an IT Acquisition Review 

process in 2006 to provide CIO oversight of all IT acquisitions and 

procurements more than $2.5 million. However, the DHS CIO’s acquisition 

20 DHS Information Technology Management Has Improved, But Challenges Remain, OIG-12-82, 

May 2012

21 Improvements Needed to DHS’ Information Technology Management Structure, OIG-04-30, July 

22 Progress Made in Strengthening DHS Information Technology Management, But Challenges 

Remain, OIG-08-91, September 2008; and DHS Information Technology Management Has 

Improved, But Challenges Remain, OIG-12-82, May 2012 

www.oig.dhs.gov 14 OIG-16-138 

2004 
 

 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

review takes place after acquisition planning activities are completed. 

Consequently, a program office may proceed without CIO consultation until 

just prior to actual IT procurement. 

As part of our audit, we asked the DHS CIO to opine on whether FITARA 

provided the necessary authority, visibility, and oversight to manage the 

Department’s IT effectively. The CIO provided the following formal statement: 

I think we’ve made great strides towards getting to an improved level of 

authority, visibility and oversight. We were doing a lot of the things that 

FITARA calls for and now we’ve got it documented and codified. I’m 

confident that once we go through a complete budget cycle we’ll 

demonstrate that the processes are institutionalized, so that these 

processes can and will continue. I’m now reviewing and approving 

acquisition plans and reprogramming requests and those are just two 

examples of authority, visibility, and oversight that I didn’t have before. 

Performance Measurements Are Needed 

A final step in ensuring effectiveness is defining the performance measures 

needed to gauge the impact of FITARA enhancements on department-wide 

management of IT. Establishing metrics associated with FITARA’s key goals, 

such as greater visibility into IT spending and reduced duplication of 

investments, would provide assurance of the long-term success of these efforts. 

DHS has recognized the need for establishing measures to substantiate the 

impact of FITARA. For example, OCIO briefings to senior leadership identified 

the need for measures early on in FITARA implementation planning. As such, 

OCIO personnel outlined a third phase to their FITARA implementation 

approach that is focused solely on the development of measures to assess 

performance and outcomes, as shown in figure 4. 

www.oig.dhs.gov 15 OIG-16-138 
 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Figure 4. Plan for Performance Measures and Outcomes 

Source: DHS OCIO 

At the time of our audit, OCIO personnel planned to initiate Phase III in July 

2016. This phase entailed assessing the success of FITARA implementation, 

determining the need for readjustments to new processes, measuring the 

impact of FITARA, and defining a performance scorecard. The performance 

scorecard was envisioned as a way to measure the adoption of FITARA at the 

component level going forward. Until these steps are completed, however, the 

Department will be unable to identify the potential effects of FITARA or to focus 

on further improvements to IT management. Many of FITARA’s intended 

benefits, such as process integration and improved collaboration, are 

multifaceted in nature and may never be easy to quantify. 

Recommendations 

We recommend that the CIO: 

Recommendation 1: Complete all remaining implementation action items to 

ensure full implementation of the CIO responsibilities defined in FITARA. 

Recommendation 2: Develop and implement metrics to measure the 

performance and impact of FITARA enhancements for fostering improved 

management and oversight of IT across the Department. 

www.oig.dhs.gov 16 OIG-16-138 
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

OIG Analysis of Agency Comments 

We obtained written comments on a draft of this report from the DHS CIO. We 

have included a copy of the comments in their entirety in appendix B. 

In the comments, the DHS CIO concurred with our recommendations and 

provided details on the current actions OCIO is taking to address specific 

findings and recommendations in the report. We have reviewed the DHS CIO’s 

comments and provided an evaluation here. 

In response to recommendation 1, the DHS CIO concurred and provided an 

update on additional progress made since May 2016 to implement the CIO 

responsibilities defined in FITARA. Specifically, OCIO completed three 

additional Common Baseline elements to further enhance the CIO’s authority 

in the areas of IT Budget Execution and IT Acquisition. We recognize the 

Department’s actions as progress toward addressing this recommendation and 

look forward to future updates on completion of the remaining action items. 

This recommendation is open and resolved. 

Responding to recommendation 2, the DHS CIO concurred and indicated that 

that OCIO has outlined a third phase to develop measures and assess 

performance and outcomes as part of its FITARA implementation approach. In 

addition, the DHS CIO provided details on OCIO participation in a Federal 

government-wide working group to identify FITARA performance metrics, as 

well as efforts to measure FITARA implementation within the Department’s 

components. We look forward to learning more about continued progress on 

these initiatives. This recommendation is open and resolved. 

www.oig.dhs.gov 17 OIG-16-138 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

IT Investment Review and Reporting Functions Need Additional 

Improvement 

The Department needs to take additional steps to improve certain IT 

investment transparency, risk management, and review and reporting 

processes in line with FITARA requirements. The CIO office has implemented 

several key enhancements, such as updating the agency-wide IT portfolio 

review process and reporting on cost savings and cost avoidance achieved as a 

result of new strategies adopted. However, other requirements such as 

reporting on the use of incremental development and conducting program 

reviews on high-risk investments were not fully met. These shortfalls were due, 

in part, to incomplete departmental processes to ensure compliance. Until 

these requirements are fully implemented, DHS will be challenged to ensure 

accurate reporting on adoption of incremental development and timely reviews 

of its high-risk IT investments. 

Several IT Review and Reporting Requirements Implemented 

OCIO has implemented several major FITARA review and reporting 

requirements necessary for IT investment oversight. For example, OCIO 

updated its agency-wide IT portfolio review process, called PortfolioStat, to 

ensure alignment with FITARA guidance. FITARA requires agencies to hold 

PortfolioStat sessions on a quarterly basis with OMB, the agency CIO, and 

other attendees, whereas these oversight sessions were previously required 

annually.23 Agencies also must report the status of PortfolioStat action items to 

OMB on a quarterly basis for IT monitoring across the Federal Government. 

From our audit, we determined that OCIO was conducting quarterly 

PortfolioStat sessions and reporting the status of action items, as required. 

OCIO also reports its cost savings to OMB, as FITARA requires. Agencies must 

provide OMB with information on cost savings and cost avoidance achieved as 

a result of efficiency strategies the agency has implemented. Our audit 

confirmed that DHS provided this information to OMB and, in return, received 

a summary scorecard of performance data from OMB. 

23 OMB, Memorandum for Heads of Executive Departments and Agencies: Implementing 

PortfolioStat, M-12-10 (Washington, DC, March 30, 2012); OMB, Memorandum for the Heads of 

Executive Departments and Agencies: Fiscal Year 2013 PortfolioStat Guidance: Strengthening 

Federal IT Portfolio Management, M-13-09 (Washington, DC, March 27, 2013). OMB, 

Memorandum for the Heads of Executive Departments and Agencies: Fiscal Year 2014 

PortfolioStat, M-14-08 (Washington, DC, May 7, 2014). 

www.oig.dhs.gov 18 OIG-16-138 
 

 

 

 

 

 

 

 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Other IT Review and Reporting Requirements Need Improvement 

At the same time, however, OCIO did not meet other key FITARA reporting 

requirements. For example, the Department did not accurately report on CIO 

certification of incremental development. Incremental development is a 

software development methodology that delivers and tests capabilities in 

smaller increments over shorter periods of time in close collaboration with the 

customer. FITARA requires the CIO to certify that the agency’s IT investments 

are adequately implementing incremental development (i.e., the delivery of new 

or modified technical functionality to users occurs at least every 6 months), as 

defined in capital planning guidance issued by OMB.24 

OCIO had developed a process to certify that DHS IT investments were 

delivering technical functionality to users at least every 6 months. However, we 

found that the Department did not update each major IT investment business 

case to accurately reflect the CIO’s determination on whether incremental 

development was adequately used, as required. In May 2016, we compared 

OCIO’s list of IT investments using incremental development with information 

reported in the business cases for 92 DHS major investments and found 

instances where the information did not match. For instance, some IT 

investments that the CIO considered incremental development did not include 

that certification in their business cases. Conversely, we identified business 

cases for IT investments incorrectly claiming certification that were not on the 

CIO’s list of incremental investments. 

Also, by the end of our audit fieldwork, OCIO had not implemented an 

Automatic TechStat requirement in accordance with the guidance OMB issued 

in June 2015 regarding FITARA implementation.25 A TechStat is a face-to-face, 

evidence-based accountability review of an IT program with agency leadership. 

TechStat sessions are a tool for getting ahead of critical problems in an 

investment, turning around underperforming investments, or terminating 

investments as appropriate. OMB requires a department or agency to hold an 

Automatic TechStat session if an investment has a high-risk rating on the IT 

Dashboard for three consecutive months since July 1, 2015. 

In March 2016, we identified seven DHS IT investments that were rated 

“Moderately High Risk” between July and September 2015 and, therefore, 

should have had Automatic TechStat sessions performed by the end of the 

following month. As of May 2016, DHS had not performed Automatic TechStat 

sessions on the seven investments we identified. 

24 FITARA Section 831.B.ii, Fiscal Year 2017 IT Budget - Capital Planning Guidance 

25 OMB M-15-14, Management and Oversight of Federal Information Technology, June 10, 2015 

www.oig.dhs.gov 19 OIG-16-138 
 

 

 

 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Refinements to Processes Are Needed 

Deficiencies in meeting certain FITARA review requirements were due, in part, 

to a lack of adequate processes. For example, the process for certifying 

incremental development did not include a mechanism to ensure that CIO 

certification results were accurately reported in each investment’s business 

cases. OCIO personnel acknowledged this problem and indicated they planned 

to enhance their process to address this deficiency. 

The Department also had not finalized its policy to ensure that Automatic 

TechStat sessions are carried out as required. Specifically, the Department 

incorporated the Automatic TechStat requirement into draft guidance dated 

October 2015, but this guidance had not yet been approved by May 2016, the 

end of our audit fieldwork. EBMO personnel also said that Automatic TechStat 

sessions had not been conducted for some investments that were either 

delayed by bid protests or had outdated acquisition documentation. For other 

cases, EBMO personnel said TechStat sessions had recently occurred, or the 

investments were part of an ongoing IT acquisition transformation pilot. The 

Department would benefit from finalizing its policy to ensure that TechStat 

sessions are more timely held in the future. 

Oversight of IT Investments and Accurate Reporting Are Hindered 

Until DHS fully implements these reporting and review requirements, the CIO 

will be challenged to ensure accurate reporting on adoption of incremental 

development or timely reviews of high-risk investments. To illustrate, 

Automatic TechStat sessions are to provide value by focusing management 

attention on troubled projects and establishing clear corrective actions for 

turning the projects around or terminating them. Without these reports and 

reviews to support them, DHS may not identify or address program risks in a 

timely manner. 

Recommendation 

We recommend that the CIO: 

Recommendation 3: Update existing departmental policies and procedures to 

promote compliance with FITARA transparency and risk management reporting 

and review requirements. 

www.oig.dhs.gov 20 OIG-16-138 
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

OIG Analysis of Agency Comments 

In response to recommendation 3, the DHS CIO concurred and indicated that 

OCIO will update and improve policies and procedures to promote compliance 

with FITARA transparency, risk management, portfolio review, and reporting 

requirements. Further, the DHS CIO indicated that OCIO would provide 

information to the IT Dashboard, as required by OMB guidance. We look 

forward to updates on the specific actions OCIO is taking to implement 

accurate reporting on the use of incremental development, as well as ensure 

that required program reviews of high-risk investments are conducted. This 

recommendation is open and resolved. 

www.oig.dhs.gov 21 OIG-16-138 
 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Appendix A 

Objective, Scope, and Methodology 

The Department of Homeland Security Office of Inspector General was 

established by the Homeland Security Act of 2002 (Public Law 107−296) by 

amendment to the Inspector General Act of 1978. As part of our ongoing 

responsibilities to assess the efficiency, effectiveness, and economy of the 

departmental programs and operations, we conducted an audit to determine 

the extent to which DHS has implemented FITARA to improve department-wide 

IT management and oversight. 

We researched and reviewed Federal laws and guidance, and Department 

management directives, instructions, and other written procedures. We 

obtained documents, testimony, and news articles related to requirements and 

implementation of FITARA. Additionally, we reviewed recent Government 

Accountability Office and DHS OIG reports to identify prior findings and 

recommendations. We used this information to establish a data collection 

approach that consisted of focused information-gathering meetings and 

documentation analysis. 

We held interviews and participated in teleconferences with DHS staff at 

headquarters offices to learn about the Department’s progress in FITARA 

implementation. We met with the DHS CIO, the Principal Deputy CIO, the 

Executive Director of EBMO, and other OCIO officials, to discuss their roles 

and responsibilities as related to FITARA and the planned implementation 

process. We obtained DHS’ report to OMB on its progress in implementing 

FITARA. Because implementation was in an early phase and continuously 

changing, we did not take steps to verify the information at that time, but will 

conduct a follow-up verification audit at a later date. 

We met with senior agency officials including the Chief Procurement Officer, 

the Deputy Chief Financial Officer, the Office of the Chief Human Capital 

Officer, the Office of Program Accountability and Risk Management, the Joint 

Requirements Council, the Office of Policy, and the Chief Readiness Support 

Officer to obtain their perspectives on the Department’s efforts and anticipated 

results related to FITARA. 

We met with Integrated Planning Team representatives from seven major DHS 

components to discuss the coordination of FITARA implementation efforts 

between headquarters and component-level OCIOs. These components were 

U.S. Customs and Border Protection, the Federal Emergency Management 

Agency, U.S. Immigration and Customs Enforcement, the Transportation 

www.oig.dhs.gov 22 OIG-16-138 
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Security Administration, U.S. Citizenship and Immigration Services, the United 

States Coast Guard, and the United States Secret Service. 

We appreciate the courtesies extended to us during the performance of this 

audit. Major OIG contributors to the audit are identified in appendix D. 

We conducted this performance audit between February and May 2016 

pursuant to the Inspector General Act of 1978, as amended, and according to 

generally accepted government auditing standards. Those standards require 

that we plan and perform the audit to obtain sufficient, appropriate evidence to 

provide a reasonable basis for our findings and conclusions based upon our 

audit objectives. We believe that the evidence obtained provides a reasonable 

basis for our findings and conclusions based upon our audit objectives. 

www.oig.dhs.gov 23 OIG-16-138 
 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Appendix B 

DHS Comments to the Draft Report 

www.oig.dhs.gov 24 OIG-16-138 
 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

www.oig.dhs.gov 25 OIG-16-138 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Appendix C

DHS’ Common Baseline Implementation Status 

Category Element Initial Status 

(August 2015) 

Current Status 

(April 2016) 

Budget 

Formulation 

A. Visibility of IT resources Implemented Implemented 

B. CIO role in pre-budget 

submission 

Partially 

Implemented Implemented 

C. CIO role in planning program 

management 

Partially 

Implemented Implemented 

D. CIO role in budget request Partially 

Implemented Implemented 

Budget Execution 

E. Ongoing CIO engagement with 

program managers 

Partially 

Implemented Implemented 

F. Visibility of IT planned 

expenditure reporting to CIO 

Partially 

Implemented 

Partially 

Implemented 

G. CIO defines IT processes and 

policies 

Partially 

Implemented Implemented 

H. CIO role on program governance 

boards 

Partially 

Implemented 

Partially 

Implemented 

J. CIO role in recommending 

modification, termination, or pause 

of IT 

Partially 

Implemented 

Partially 

Implemented 

L. CIO approval of reprogramming Partially 

Implemented Implemented 

Acquisition 

I. Shared acquisition and 

procurement responsibilities 

Partially 

Implemented 

Partially 

Implemented 

K. CIO review and approval of 

acquisitions 

Partially 

Implemented 

Partially 

Implemented 

Organization and 

Workforce 

M. CIO approves new bureau CIOs Implemented Implemented 

N. CIO role in ongoing bureau 

CIOs’ evaluations 

Partially 

Implemented Implemented 

O. Bureau IT Leadership Directory Partially 

Implemented Implemented 

P. IT Workforce Partially 

Implemented 

Partially 

Implemented 

Q. CIO reports to agency head (or 

deputy/Chief Operating Officer) Implemented Implemented 

Source: OIG-generated from DHS’ 2016 FITARA Self-Assessment 

www.oig.dhs.gov 26 OIG-16-138 
 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Appendix D 

Office of IT Audits Major Contributors to This Report 

Kristen Bernard, Division Director 

Steven Staats, Audit Manager 

Christopher Browning, Senior Program Analyst 

Shawn Ward, Senior Program Analyst 

Ann Brooks, Referencer 

www.oig.dhs.gov 27 OIG-16-138 
 

 

 

 

 

 

 

OFFICE OF INSPECTOR GENERAL 

Department of Homeland Security 

Appendix E 

Report Distribution 

Department of Homeland Security 

Secretary 

Deputy Secretary 

Chief of Staff 

General Counsel 

Executive Secretary 

Director, GAO/OIG Liaison Office 

Assistant Secretary for Office of Policy 

Assistant Secretary for Office of Public Affairs 

Assistant Secretary for Office of Legislative Affairs 

DHS OCIO Component Liaison 

Office of Management and Budget 

Chief, Homeland Security Branch 

DHS OIG Budget Examiner 

Congress 

Congressional Oversight and Appropriations Committees 

www.oig.dhs.gov 28 OIG-16-138 
 

 

 

 

 

 

ADDITIONAL INFORMATION AND COPIES 

To view this and any of our other reports, please visit our website at: www.oig.dhs.gov. 

For further information or questions, please contact Office of Inspector General Public Affairs 

at: DHS-OIG.OfficePublicAffairs@oig.dhs.gov. Follow us on Twitter at: @dhsoig. 

OIG HOTLINE 

To report fraud, waste, or abuse, visit our website at www.oig.dhs.gov and click on the red 

"Hotline" tab. If you cannot access our website, call our hotline at (800) 323-8603, fax our 

hotline at (202) 254-4297, or write to us at: 

Department of Homeland Security 

Office of Inspector General, Mail Stop 0305 

Attention: Hotline 

245 Murray Drive, SW 

Washington, DC 20528-0305