HOMELAND 

SECURITY 

ACQUISITIONS

Identifying All NonMajor Acquisitions 

Would Advance 

Ongoing Efforts to 

Improve Management

Report to Congressional Requesters 

April 2017

GAO-17-396

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-17-396, a report to 

congressional requesters

April 2017

HOMELAND SECURITY ACQUISITIONS

Identifying All Non-Major Acquisitions Would 

Advance Ongoing Efforts to Improve Management

What GAO Found

The Department of Homeland Security’s (DHS) component agencies—such as 

the U.S. Coast Guard and Customs and Border Protection—lack the information 

needed to effectively oversee their non-major acquisitions because they cannot 

confidently identify all of them. They identified over $6 billion in non-major 

acquisitions; however, GAO found 8 of the 11 components could not identify

them all. Several officials indicated that their focus had been on major 

acquisitions historically, and they had not turned their attention to non-major

acquisitions until more recently. Many component officials said they were still in 

the process of identifying all of these acquisitions, but it was unclear when they 

would complete these efforts. DHS headquarters had not established time

frames for components to do so, which may have resulted in components losing 

traction in their efforts. Federal internal controls standards establish that 

management should obtain relevant data from reliable sources in a timely 

manner. Another key challenge involves the use of baselines, which establish a 

program’s critical cost, schedule, and performance parameters. Component 

officials identified 38 non-major acquisitions that were active at the start of fiscal 

year 2017 (as opposed to acquisitions that have been delivered to end users and 

are considered to be non-active). GAO found that most of the active non-major 

acquisitions (23 of 38) did not have approved baselines, and that the value of the 

acquisitions without baselines constituted nearly half of the total value of the

active acquisitions.

Value of Active Non-Major Acquisitions Identified by Components as of October 1, 2016

At the beginning of fiscal year 2017, some components did not require approved 

baselines. However, in response to GAO’s preliminary findings, in February 

2017, DHS required component leadership to approve baselines for non-major

acquisitions, which should help components oversee them more effectively. 

DHS headquarters is taking steps to help components establish more effective 

management controls for non-major acquisitions. In 2015, DHS headquarters 

officials established a process to review them annually. In February 2017, in 

response to GAO’s preliminary findings, DHS established that components shall 

use the annual reviews to assess the extent to which non-major acquisitions are 

on track to meet cost, schedule, and performance parameters from approved

baselines. DHS leadership has also established ongoing reporting requirements 

for non-major acquisitions. All components have started entering non-major 

acquisition data into DHS’s central acquisition information system, and 

headquarters officials are taking steps to improve the reliability of these data.

View GAO-17-396. For more information, 

contact Michele Mackin at (202) 512-4841 or 

mackinm@gao.gov.

Why GAO Did This Study

Each year, DHS acquires a wide array 

of systems intended to help its 

component agencies execute their

many critical missions. GAO has 

previously reported that DHS’s process 

for managing its major acquisitions is 

maturing. However, non-major 

acquisitions (generally those with cost 

estimates of less than $300 million) are

managed by DHS’s component

agencies and have not received as 

much oversight. Recently GAO 

reported on a non-major acquisition 

that was executed poorly, limiting

DHS’s ability to address human capital 

weaknesses. 

GAO was asked to examine DHS’s 

management of non-major 

acquisitions. This report assesses: (1) 

the extent to which component 

leadership is effectively overseeing 

non-major acquisitions; and (2) the 

extent to which DHS headquarters has 

helped components establish effective 

management controls for non-major 

acquisitions.

GAO reviewed policy and component 

guidance, and interviewed officials 

from DHS headquarters and 11 

components responsible for managing 

non-major acquisitions. GAO also 

traced non-major acquisition data from 

DHS’s central acquisition data system

to source documents to assess data 

reliability.

What GAO Recommends

GAO recommended that DHS 

headquarters establish time frames for 

components to identify all non-major 

acquisitions. DHS concurred with 

GAO’s recommendation and directed 

components to identify all non-major 

acquisitions by October 31, 2017.
Page i GAO-17-396 Homeland Security Acquisitions

Letter 1

Background 4

Component Officials Identified Billions in Non-Major Acquisitions, 

but Most Could Not Confidently Identify the Full Scope 7

DHS Headquarters Has Recently Increased Focus on Non-Major 

Acquisitions, and New Policy May Help Ensure More Effective 

Management 20

Conclusions 24

Recommendation for Executive Action 25

Agency Comments and Our Evaluation 25

Appendix I Objectives, Scope, and Methodology 26

Appendix II Comments from the Department of Homeland Security 30

Appendix III Department of Homeland Security Guidance on the Identification

of All Non-Major Acquisitions 32

Appendix IV GAO Contact and Staff Acknowledgments 34

Tables

Table 1: Data Reliability Issues GAO Identified in Non-Major 

Acquisition Data Reported by Department of Homeland 

Security (DHS) Component Officials 14

Table 2: DHS Components and Whether GAO or Component 

Officials Identified Data Reliability Issues 15

Figures

Figure 1: Department of Homeland Security Acquisition Decision 

Authorities and Dollar Thresholds for Major and 

Non-Major Acquisitions 5

Figure 2: DHS Acquisition Lifecycle Framework and Acquisition 

Decision Events 6

Figure 3: Examples of Active DHS Non-Major Acquisitions 9

Contents
Page ii GAO-17-396 Homeland Security Acquisitions

Figure 4: Number of Non-Major Acquisitions That Components 

Identified as of October 1, 2016, by Acquisition 

Lifecycle Phase 10

Figure 5: Number of Component-Identified Active Non-Major 

Acquisitions with Component-Approved Baselines as of 

October 1, 2016 18

Figure 6: Value of Active Non-Major Acquisitions Identified by 

Components and Status of Baselines as of 

October 1, 2016 19
Page iii GAO-17-396 Homeland Security Acquisitions

Abbreviations 

ADA Acquisition Decision Authority 

CAE Component Acquisition Executive 

CBP Customs and Border Protection 

DHS Department of Homeland Security 

DNDO Domestic Nuclear Detection Office 

FEMA Federal Emergency Management Agency 

FLETC Federal Law Enforcement Training Centers 

FOC full operational capability 

ICE Immigration and Customs Enforcement 

INVEST Investment Evaluation, Submission, & Tracking 

IT information technology 

MD Management Directive 

NPPD National Protection and Programs Directorate 

OCIO Office of the Chief Information Officer 

PARM Office of Program Accountability and Risk Management 

TSA Transportation Security Administration 

USCIS U.S. Citizenship and Immigration Services 

USCG U.S. Coast Guard 

USSS U.S. Secret Service 

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-17-396 Homeland Security Acquisitions

441 G St. N.W.

Washington, DC 20548

April 13, 2017

The Honorable Ron Johnson

Chairman

The Honorable Claire McCaskill

Ranking Member

Committee on Homeland Security and Governmental Affairs

United States Senate

The Honorable Scott Perry

Chairman

The Honorable J. Luis Correa

Ranking Member

Subcommittee on Oversight and Management Efficiency

Committee on Homeland Security

House of Representatives

The Honorable Bonnie Watson Coleman

House of Representatives

Each year, the Department of Homeland Security (DHS) acquires a wide 

array of systems intended to help its component agencies execute their 

many critical missions. These systems include those that help Customs 

and Border Protection (CBP) secure the border, the Federal Emergency 

Management Agency (FEMA) register disaster survivors for assistance, 

and the U.S. Coast Guard (USCG) perform search and rescue missions. 

We have previously concluded that DHS’s process for managing its major 

acquisitions—those assets with total costs of $300 million or more—is 

maturing. For example, earlier this year we found that DHS had approved 

cost, schedule, and performance baselines for all major acquisitions that 

we reviewed.1 However, many mission critical capabilities are provided by 

smaller dollar value, or non-major acquisitions, which are generally 

managed by individual components of DHS, including CBP, FEMA, and 

USCG. We have previously reported on the management challenges 

facing one non-major acquisition at DHS. Specifically, in 2016 we found 

that the DHS Performance and Learning Management System—a key 

 

1

GAO, Homeland Security Acquisitions: Earlier Requirements Definition and Clear 

Documentation of Key Decisions Could Facilitate Ongoing Progress, GAO-17-346SP 

(Washington, D.C.: Apr. 6, 2017).

Letter
Page 2 GAO-17-396 Homeland Security Acquisitions

element of DHS’s Human Resources Information Technology 

investment—had experienced schedule slippages, management turnover, 

and other challenges that limited DHS’s ability to address human capital 

weaknesses.2

You asked us to examine DHS’s management of non-major acquisitions. 

This review addresses both the components’ management of these 

acquisitions as well as the department’s oversight role. Specifically, this 

report assesses (1) the extent to which component leadership is 

effectively overseeing non-major acquisitions and (2) the extent to which 

DHS headquarters has helped components establish effective 

management controls for non-major acquisitions.

To identify the extent to which component leadership is effectively 

overseeing non-major acquisitions, we reviewed department and 

component policy, guidance, and key acquisition documents, such as 

acquisition program baselines; and interviewed department and 

component officials. In an effort to identify all non-major acquisitions at 

DHS, we asked officials from DHS’s Office of Program Accountability and 

Risk Management (PARM), who are responsible for overseeing the 

department’s acquisitions, to identify the DHS components that manage 

non-major acquisitions. The 11 DHS component offices and agencies we 

reviewed are:

• Customs and Border Protection,

• Domestic Nuclear Detection Office (DNDO),

• Federal Emergency Management Agency,

• Federal Law Enforcement Training Centers,

• Immigration and Customs Enforcement,

• National Protection and Programs Directorate (NPPD),

• Office of the Chief Information Officer (OCIO),

• Transportation Security Administration,

• U.S. Citizenship and Immigration Services (USCIS),

• U.S. Coast Guard, and

 2

GAO, Homeland Security: Oversight of Neglected Human Resources Information 

Technology Investment Is Needed, GAO-16-253 (Washington, D.C.: Feb. 11, 2016). 
Page 3 GAO-17-396 Homeland Security Acquisitions

• U.S. Secret Service (USSS).

We developed and sent a data collection instrument to each component, 

asking them to identify all non-major acquisitions and report basic 

acquisition information such as capability description, total acquisition 

cost, and full operational capability (FOC) date.3 In addition, we asked for 

supporting documentation, such as acquisition program baselines, for all 

active acquisitions as of October 1, 2016.4 To assess the reliability of the 

data provided by components, we reviewed the data to identify outliers, 

missing data and other potential errors, requested clarification from 

component officials, and compared the data to source documents when 

available. Based on this assessment, we determined that the population 

of current non-major acquisitions and their associated acquisition costs 

could not be reliably determined. However, we determined that the data 

were sufficiently reliable to identify the minimum number of these 

acquisitions, and the general magnitude of the minimum acquisition costs 

associated with active non-major acquisitions. For those acquisitions that 

components could identify, we found issues with the reliability of data 

components provided as further discussed in the report. To assess the 

reliability of the non-major acquisition data in DHS’s Investment 

Evaluation, Submission, & Tracking (INVEST) system, which is the 

department’s central acquisition information system, we traced data from 

the system to source documents. We found the data in INVEST not to be 

sufficiently reliable for our purposes of reporting on the universe of nonmajor acquisitions, as further discussed in this report.

To identify the extent to which DHS headquarters has helped components

establish effective management controls for non-major acquisitions, we 

reviewed department policy and guidance; assessed current and planned 

oversight mechanisms; identified circumstances that trigger increased 

headquarters oversight; and interviewed officials from PARM as well as 

component officials. Appendix I provides detailed information on our 

scope and methodology.

We conducted this performance audit from February 2016 to April 2017 in 

accordance with generally accepted government auditing standards.

 3

Department of Homeland Security, Office of Policy, DHS Lexicon: Terms and Definitions

(2015). FOC is the time at which an investment becomes fully operational, with all 

functions deployed to the designated user(s), as defined by the Program Manager. 

4

We define acquisitions to be active when they have entered the obtain phase of the 

acquisition lifecycle and have not yet achieved FOC as of October 1, 2016.
Page 4 GAO-17-396 Homeland Security Acquisitions

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

DHS’s acquisition management policy, commonly referred to as MD-102, 

as implemented by the DHS Instruction Manual, establishes two 

overarching categories of acquisitions: acquisitions of capital assets—

such as information technology (IT) systems or aircraft—and acquisitions 

of services—such as those provided by security guards and emergency 

responders.5 For each acquisition type, acquisitions are further 

categorized as major or non-major based on expected cost.6 An 

acquisition’s major or non-major status determines who acts as the 

Acquisition Decision Authority (ADA), the individual responsible for 

management and oversight of the acquisition. DHS policy established the 

DHS Chief Acquisition Officer as the ADA for major acquisitions and the 

Component Acquisition Executive (CAE)—the senior acquisition official 

within the component—as the ADA for all non-major acquisitions. CAEs 

have overarching responsibility for the acquisition cost, schedule, risk, 

and system performance of the component’s acquisition portfolio and are 

responsible for ensuring that appropriate acquisition planning takes place. 

According to the DHS Instruction Manual, the CAEs are required to 

establish component-specific non-major acquisition policies and guidance 

that support the “spirit and intent” of department acquisition policies. 

CAEs establish unique processes for managing their components’ nonmajor acquisitions. Components that do not have CAE-approved policies 

for non-major acquisition management are required to follow MD-102 and 

the Instruction until those policies are developed. Figure 1 illustrates the 

decision authority and thresholds for major and non-major acquisitions.

 5

DHS policies and processes for managing its major acquisition programs are primarily 

set forth in Acquisition Management Directive (MD) 102-01 and DHS Instruction Manual 

102-01-001, Acquisition Management Instruction/Guidebook. DHS issued the initial 

version of this directive in November 2008. DHS issued the current version of MD 102-01 

on July 28, 2015 and the current version of MD 102-01-001 on March 9, 2016.

6

MD-102 also categorizes acquisition programs into 3 levels. Level 1 and Level 2 

programs are considered major acquisitions. Level 3 programs are considered non-major 

acquisitions. 

Background
Page 5 GAO-17-396 Homeland Security Acquisitions

Figure 1: Department of Homeland Security Acquisition Decision Authorities and Dollar Thresholds for Major and Non-Major 

Acquisitions

a

Chief Acquisition Officers and Component Acquisition Executives can delegate acquisition authority 

at certain acquisition decision events in DHS’s acquisition lifecycle framework.

b

An acquisition’s life cycle cost estimate includes an accounting of all resources and associated cost 

elements required to develop, produce, deploy, and sustain a particular acquisition.

c

In some circumstances, asset acquisitions with a value of $300 million or greater may remain 

designated as non-major. For example, acquisitions that are considered low risk may be approved by 

DHS leadership to remain non-major acquisitions even when their life cycle costs are $300 million or 

greater.
Page 6 GAO-17-396 Homeland Security Acquisitions

DHS acquisition policy establishes an acquisition lifecycle framework that 

includes a series of five acquisition decision events. These acquisition 

decision events provide the ADA an opportunity to assess whether an 

acquisition meets certain requirements and is ready to proceed through 

the lifecycle phases. Figure 2 depicts the five acquisition decision events 

and the four phases of the acquisition lifecycle.

Figure 2: DHS Acquisition Lifecycle Framework and Acquisition Decision Events

As part of an acquisition decision event for a major acquisition, the ADA 

reviews and approves key acquisition documents, such as an acquisition 

program baseline. An acquisition program baseline establishes an 

acquisition’s critical cost, schedule, and performance parameters. 

Baselines are useful management tools that can help leadership (1) 

understand of the scope of an acquisition, (2) assess how well the 

acquisition is being executed, and (3) secure adequate funding. For nonmajor acquisitions, each CAE has flexibility in deciding how his or her 

component will apply the acquisition lifecycle framework and the types of 

documentation that will be required at each acquisition decision event. 

The Instruction grants the components flexibility when managing nonmajor acquisitions.

Within DHS headquarters, PARM is the lead office responsible for 

overseeing the department’s acquisition processes. PARM has a direct 

management role with major acquisitions and less oversight of non-major 

acquisitions. For non-major acquisitions, PARM’s role is to ensure CAEs 

are overseeing their components’ acquisitions appropriately, and facilitate 
Page 7 GAO-17-396 Homeland Security Acquisitions

component efforts to report acquisition information using DHS’s INVEST 

system, among other things. The INVEST system is a central repository 

for data on DHS acquisitions and investments, such as budget, schedule, 

and performance information. INVEST data are used to oversee both 

major and non-major acquisitions and to satisfy internal and external 

reporting requirements.

DHS’s component agencies lack the information needed to effectively 

oversee their non-major acquisitions because they cannot confidently 

identify all of them. They identified over $6 billion in non-major 

acquisitions; however, we found 8 of the 11 components could not identify 

all of their non-major acquisitions and we found that the data that 9 

components provided for these acquisitions were unreliable. Several 

officials indicated that their focus had been on major acquisitions 

historically, and they had not turned their attention to non-major 

acquisitions until more recently. Many component officials said they were 

still in the process of identifying all of their non-major acquisitions, but it 

was unclear when they would complete these efforts. DHS headquarters 

had not established time frames for components to do so, which may 

have resulted in components losing traction in their efforts. Federal 

internal controls standards establish that management should obtain 

relevant data from reliable sources in a timely manner. Another key 

challenge involves the use of baselines, which establish a program’s 

critical cost, schedule, and performance parameters. Component officials 

identified 38 non-major acquisitions that were active at the start of fiscal 

year 2017 (as opposed to acquisitions that have been delivered to end 

users and are considered to be non-active). We found that most of the 

active non-major acquisitions (23 of 38) did not have approved baselines, 

and that the value of the acquisitions without baselines constituted nearly 

half of the total value of the active acquisitions. At the beginning of fiscal 

year 2017, some components did not require approved baselines. 

However, in response to our preliminary findings, in February 2017, DHS 

required component leadership approve baselines for non-major 

acquisitions, which should help components oversee them more 

effectively.7

 7

DHS, Level 3 Acquisition Management, Instruction Number 102-01-010.

Component Officials

Identified Billions in 

Non-Major 

Acquisitions, but Most 

Could Not Confidently 

Identify the Full 

Scope
Page 8 GAO-17-396 Homeland Security Acquisitions

Component officials identified 38 non-major acquisitions, valued at 

greater than $6 billion, that were active as of the start of fiscal year 2017. 

We define acquisitions to be active when they have entered the obtain 

phase of the acquisition lifecycle and have not yet achieved FOC. Of the 

reported 38 active acquisitions, 36 were capital asset acquisitions with a 

total value exceeding $6 billion. The remaining two active acquisitions 

were services acquisitions with combined annual expenditures of $19 

million in 2016. Across DHS, components identified a total of 255 nonmajor acquisitions in all phases of the acquisition lifecycle.

DHS’s non-major acquisitions encompass diverse systems and 

capabilities that address critical mission needs including immigration 

services, law enforcement, and disaster response. For example, nonmajor acquisitions include USCG response boats that perform law 

enforcement and search and rescue missions; CBP’s Mobile Video 

Surveillance System, which identifies and detects illegal incursions into 

areas that have gaps in coverage from other surveillance systems; and 

DNDO’s Human Portable Tripwire, a small, wearable system that can 

detect radiological threats. Figure 3 depicts these three acquisitions.

Components Reported 

That They Plan to Spend 

More Than $6 Billion on 

Their Non-Major 

Acquisitions
Page 9 GAO-17-396 Homeland Security Acquisitions

Figure 3: Examples of Active DHS Non-Major Acquisitions

Acquisition management efforts have the greatest impact on active 

acquisitions. When an acquisition is considered active, managers 

develop, test, and evaluate the extent to which the acquired capability can 

meet DHS mission needs, and adhere to critical cost, schedule, and 

performance parameters. By comparison, acquisition management 

activities have less impact on acquisitions that have reached FOC 

because these acquisitions have passed key decision events in the 

acquisition lifecycle. Meanwhile, we define acquisitions that are very early 

in the acquisition life cycle, i.e. in the need or analyze/select phases, to 

be pre-active. Pre-active acquisitions do not yet have critical cost, 

schedule, and performance parameters because component officials 

have not yet agreed on what they want, when they want it, or how much 

they want to spend. Figure 4 depicts the number of non-major 

acquisitions component officials identified by acquisition lifecycle phase.
Page 10 GAO-17-396 Homeland Security Acquisitions

Figure 4: Number of Non-Major Acquisitions That Components Identified as of 

October 1, 2016, by Acquisition Lifecycle Phase

Note: The data in the figure does not represent all of the department’s non-major acquisitions, as 

components were not able to identify the full scope.

• About 74 percent of the non-major acquisitions that component 

officials identified (189 of 255) had reached FOC at the start of fiscal 

year 2017, and components were operating and maintaining them 

until disposal. Although officials indicated these acquisitions were no 

longer active and had already passed all of their major acquisition 

decision events, it is still important for DHS to understand the scope of 

these acquisitions because up to 70 percent of an acquisition’s total 

life cycle costs can occur after FOC.

• About 11 percent of the non-major acquisitions that component 

officials identified (28 of 255) are in the pre-active phases of the 

acquisition lifecycle. During these phases, program managers identify

a mission need that justifies investment in a new acquisition and 

evaluate alternative options to meet that need.

DHS component officials identified 255 non-major acquisitions across 

DHS, but officials from most of the components (8 of 11) also reported to 

us that they were not confident that they had accounted for all of their 

non-major acquisitions. However, these officials also told us they were 

working to improve their ability to identify their non-major acquisitions 

going forward. In the view of some officials, the problems lie primarily in 

tracking the non-active acquisitions, rather than those that are still active. 

Even when component officials could identify these acquisitions, we 

found that the data they provided were often unreliable. The data 

reliability issues often involved the type of information included in 

acquisition baselines, specifically cost, schedule, and capability 

information.

Component Officials Could 

Not Identify All Non-Major 

Acquisitions, and Data Are 

Unreliable
Page 11 GAO-17-396 Homeland Security Acquisitions

We spoke with officials from 11 components to get their perspective on 

whether they were able to accurately identify the full scope of their nonmajor acquisitions. Officials from 8 of the 11 DHS components told us 

they could not identify all of their non-major acquisitions. These officials 

were able to provide data on some acquisitions, but they were not 

confident that they had identified all of them. Officials from 3 of the 8 

components stated that they were more confident in their ability to identify 

all active acquisitions but were less sure that the full scope of post-FOC 

acquisitions were identified. Component officials offered two reasons for 

the lack of confidence in the data:

1. Historically, managing non-major acquisitions has been a relatively 

low priority when compared to managing major acquisitions or other 

component activities.

2. The components lack effective procedures for identifying those 

acquisitions.

Officials from all of the components we reviewed indicated that they are 

working to improve their management of non-major acquisitions for a 

variety of reasons, including to improve their ability to monitor acquisition 

cost growth and other acquisition performance metrics.

• Competing priorities: Officials from 6 components indicated that 

managing non-major acquisitions has historically been a lower priority 

than managing major acquisitions or other component activities. For 

example, CBP officials reported that since 2011, CBP’s CAE staff has 

focused on bringing major acquisitions into compliance with DHS 

acquisition policy. It took CBP until 2016 to baseline all of its Level 1

acquisitions. In 2014, CBP officials turned their attention to non-major 

acquisitions. They began to identify their non-major acquisitions, and 

worked to understand their purpose, status, and the CBP offices they 

support. According to CBP officials, these efforts are ongoing.

Similarly, following the issuance of MD-102 in 2008, FEMA focused 

on managing major acquisitions before placing an emphasis on nonmajor acquisition management in 2015. According to component 

officials, FEMA is now developing a more robust management 

process for non-major acquisitions. They said that the first step toward 

increasing the management rigor for these acquisitions is to 

accurately identify them.

• Ineffective procedures: Officials from 2 components stated that they 

lack effective procedures for identifying non-major acquisitions. USCG 

and USCIS officials acknowledged that their procedures for identifying 

these acquisitions need improvement. Specifically, a USCG official 

Most Components Could Not 

Identify All of Their Non-Major 

Acquisitions
Page 12 GAO-17-396 Homeland Security Acquisitions

told us that USCG procedures do not always successfully distinguish 

IT acquisitions from non-acquisition activities. According to the official, 

many non-major IT acquisition activities may be occurring, but the 

USCG acquisition support staff may not be aware of them. USCG 

officials said that the component has approximately 400-500 IT 

investments to assess to determine whether they should be identified 

as acquisitions. As a result, USCG may be underreporting the dollar 

value of non-major acquisitions. According to USCG officials, the 

process of identifying all such acquisitions is underway.

Additionally, a senior USCIS official stated that his component’s 

method for identifying its smaller non-major acquisitions needs 

improvement. USCIS combines its smallest acquisitions—those 

valued at less than $50 million—into a single acquisition, aligns each 

combined acquisition to specific offices within USCIS, such as the 

Office of Information Technology, and tracks each combined 

acquisition as a single acquisition. Using this approach, USCIS may 

be underreporting the number of non-major acquisitions, as multiple 

acquisitions may be counted as one, and the CAE may be missing 

opportunities to influence the acquisitions at key decision events. To 

improve tracking of these acquisitions, the official told us that USCIS 

is evaluating each individual acquisition to determine if it is active, and 

if it should be managed as a stand-alone acquisition. In addition, 

according to USCIS officials, USCIS has recently revised its nonmajor acquisition policy, which will change the acquisition tracking 

requirement. This revision is expected to be finalized in 2017.

DHS component officials told us that they were working to improve their 

ability to identify non-major acquisitions. For example, officials from 4 

components stated that they were using new guidance provided in a 2016 

update to the DHS Instruction Manual to more consistently categorize all 

acquisitions as (1) capital acquisitions, (2) service acquisitions, or (3) 

simple procurements. The guidance includes a series of yes-or-no 

questions that acquisition officials answer to categorize a particular 

acquisition. Component officials said these categorizations are helping 

them identify all of the non-major acquisitions in their respective 

portfolios. For example, FEMA officials said they have used the new 

guidance to determine whether acquisitions considered procurements 

should actually be managed as non-major acquisitions. Officials from the 

other components reported efforts such as updating component policies 

and performing ongoing reviews to identify which activities are 

acquisitions. However, it was unclear when these various efforts to 

identify the full scope of all non-major acquisitions would be complete 

because no timelines had been established by DHS headquarters, which 
Page 13 GAO-17-396 Homeland Security Acquisitions

may have resulted in components losing traction in their efforts. Federal 

internal controls standards establish that management should obtain 

relevant data from reliable sources in a timely manner.8 Until components 

have identified all of their non-major acquisitions, they cannot effectively 

manage their acquisition portfolios or apply the level and type of oversight 

that complies with department policy. Having an established time frame 

should help ensure that the actions underway are seen to completion.

In addition to the components’ inability to identify all non-major 

acquisitions, our analysis and information received from component 

officials identified a number of data reliability issues. Specifically, our 

analysis found that the data provided by 8 of the 11 components were not 

complete.9 For example, several life cycle cost estimates did not include 

government personnel costs. In addition, most of the components that 

reported active acquisitions could not provide approved baselines 

supporting the data they provided, in part because some components did 

not require approved baselines. Officials from 6 components also 

acknowledged they have issues with data reliability, specifically with 

accuracy and completeness, which could hinder their CAEs’ ability to 

manage non-major acquisitions in accordance with DHS acquisition 

policy.

Our analysis of all non-major acquisition data provided by the DHS 

components found that the data were complete for over 60 percent of the 

acquisitions reported and that data for active acquisitions had fewer 

issues with incomplete data than acquisitions that were post-FOC. In 

responding to our requests for information, 5 components did not provide 

a complete FOC date or cost information for at least one of their active 

non-major acquisitions. Although the components have different 

requirements for documenting such information, key acquisition 

management best practices recommend that all acquisitions have well 

defined requirements and establish realistic cost and schedule 

estimates.10 Table 1 describes the data reliability issues that we identified 

in the component-reported non-major acquisition data.

 8

GAO, Standards for Internal Control in the Federal Government, GAO-14-704G

(Washington, D.C.: Sept. 10, 2014).

9

Data completeness refers to the extent that relevant records are present and that the 

fields in each record are populated appropriately.

10GAO, Homeland Security: DHS Requires More Disciplined Investment Management to 

Help Meet Mission Needs, GAO-12-833 (Washington, D.C.: Sept. 18, 2012).

Most Components Provided 

Data with Reliability Issues
Page 14 GAO-17-396 Homeland Security Acquisitions

Table 1: Data Reliability Issues GAO Identified in Non-Major Acquisition Data Reported by Department of Homeland Security 

(DHS) Component Officials 

Acquisition 

Phase

Number of 

Acquisitions 

Component 

Officials Identified

Number with No 

Identified Data Issues

(Percent with No 

Identified Data Issues)

Number with Data 

Issues: No Capability 

Description

Number with Data 

Issues: No Full 

Operational Capability 

(FOC) Date

Number with Data 

Issues: Incomplete 

or No Cost 

Pre-Active 28 28 (100) N/Aa N/Aa N/Aa

Active 38 26 (68) 0 1 11

Post-FOC 189 105 (56) 36 45 79

Total 255 159 (62) 36 46 90

Source: GAO analysis of DHS component data. | GAO-17-396

a

Cost, schedule and performance parameters are not applicable for pre-active acquisition programs 

for major acquisitions and therefore not applicable to non-major acquisitions.

Cost, schedule, and capability information are basic acquisition data that 

would be included in an acquisition baseline, and we have previously 

found that these types of information help senior leadership manage 

acquisitions more effectively.11 However, most of the components that 

reported active acquisitions could not provide approved baselines for all 

of their non-major acquisitions since not all of them were required to 

provide approved baselines.

In addition to the completeness issues we identified, officials from 6 

components acknowledged that they have issues with data reliability, 

specifically with accuracy and completeness.

• Accuracy: Officials from 5 components reported issues with the 

accuracy of the non-major acquisition data they provided. Data 

accuracy refers to the extent that recorded data reflect the actual 

underlying information. For example, DNDO officials stated they did 

not have full confidence in 20 percent of the acquisition data they 

reported because most DNDO non-major acquisitions were not 

required to have program baselines. Instead, DNDO is using rough 

order of magnitude cost estimates for these acquisitions, which they 

acknowledged are inherently inaccurate.

• Completeness: Officials from 3 of the 6 components also told us that 

their non-major acquisitions data were incomplete. Data 

completeness refers to the extent that relevant records are present—

 11GAO-12-833.
Page 15 GAO-17-396 Homeland Security Acquisitions

an issue addressed in the scope discussion above—and that the 

fields in each record are populated appropriately. For example, FEMA 

officials said that they had limited cost value data for non-major 

acquisitions because many of these acquisitions have not had formal 

life cycle cost estimates, and that improvements to their non-major 

acquisitions data are required in order to provide such estimates.

Table 2 lists the components we reviewed, whether we identified data

reliability issues—specifically incomplete data—in the non-major 

acquisition data reported by the components, and whether component 

officials self-identified data reliability issues in that data. For 9 

components, we identified data reliability issues through our analysis, 

component officials identified data reliability issues themselves, or both.

Table 2: DHS Components and Whether GAO or Component Officials Identified 

Data Reliability Issues

GAO-Identified

Data Reliability Issues

Component-Identified 

Data Reliability Issues

Customs and Border Protection 

(CBP)

Yes Yes

Domestic Nuclear Detection Office 

(DNDO)

Yes Yes

Federal Emergency Management 

Agency (FEMA)

Yes Yes

Federal Law Enforcement Training 

Centers (FLETC)

No No

Immigration and Customs 

Enforcement (ICE)

No Yes

National Protection and Programs 

Directorate (NPPD)

Yes Yes

Office of the Chief Information Officer 

(OCIO)

Yes No

Transportation Security 

Administration (TSA)

Yes No

U.S. Citizenship and Immigration 

Services (USCIS)

Yes Yes

U.S. Coast Guard (USCG) No No

U.S. Secret Service (USSS) Yes No

Source: GAO analysis of DHS component data. │ GAO-17-396
Page 16 GAO-17-396 Homeland Security Acquisitions

In accordance with the CAE responsibilities outlined in the DHS 

Instruction Manual, CAEs have developed a variety of processes to 

maintain and report data on non-major acquisitions. For example, USCG 

officials reported using the INVEST system and three of their own 

systems to track and report data on non-major acquisitions. They told us 

their non-major acquisition data and corresponding documentation is 

regularly compiled and CAE staff review it every month. Meanwhile, CBP 

officials reported using a less centralized approach. CBP officials track 

non-major acquisition data in two department-level systems and multiple 

component-level systems, including several Microsoft Excel spreadsheets 

and Microsoft Access databases. CBP officials reported that their 

component lacks a systematic data review process, and that they had to

manually aggregate their data to respond to our queries.

Additionally, components’ policies for managing non-major acquisitions 

vary. For example, at the start of fiscal year 2017, 7 components had 

policies in place requiring component leadership to approve program 

baselines for active non-major acquisitions. However, the 4 other 

components did not. Our prior work and DHS acquisition policy 

emphasize the importance of the critical cost, schedule, and performance 

parameters that a baseline provides. As our work showed in 2012, the 

baseline is a critical tool for managing an acquisition.12 First, it is an 

agreement between program-, component-, and department-level officials 

establishing what the capabilities being acquired should cost, when they 

should be delivered, and how they should perform. DHS acquisition policy 

for major acquisitions requires that the ADA approve a program’s 

baseline before it initiates design and development activities, and this 

baseline then serves as a performance management tool to monitor and 

measure an acquisition’s execution. Second, baselines can help 

acquisition leaders secure funding needed for programs to meet critical 

cost, schedule, and performance parameters. If a program is not fully 

funded, a baseline can help leaders identify the trade-offs needed to fund 

the program with existing resources. Our prior work has demonstrated 

that resources, including time and funding, should be consistent with 

performance requirements. For major programs, the ADA confirms the 

program is fully resourced through the next 5 years when the ADA 

approves the program’s baseline.

 12GAO-12-833.

As Authorized, 

Components Use a Variety 

of Processes to Manage 

Non-Major Acquisitions, 

but Few Consistently 

Track against Baselines
Page 17 GAO-17-396 Homeland Security Acquisitions

At the start of fiscal year 2017, the majority of DHS’s active non-major 

acquisitions did not have component-approved baselines, though 3 

components—NPPD, USCG, and USSS—did have baselines for all of the 

active non-major acquisitions they identified. Across the 11 components, 

over half of the reported active non-major acquisitions (23 of 38) did not 

have approved baselines, including both of the active services 

acquisitions. The baselines provided by the components for the remaining 

15 acquisitions varied in length and detail, but each included the cost, 

schedule, and performance parameters needed to monitor a program 

over time. Some components provided other types of acquisition 

documentation, such as an Operational Requirements Document or Test 

and Evaluation Master Plan. However, in each case, we determined that 

the documents submitted did not effectively define the acquisitions by 

linking their cost, schedule, and performance parameters. As such, we 

did not consider these documents to represent a baseline. Figure 5 

shows the number of active non-major acquisitions and the number of 

component-approved baselines at each component.
Page 18 GAO-17-396 Homeland Security Acquisitions

Figure 5: Number of Component-Identified Active Non-Major Acquisitions with Component-Approved Baselines as of October 

1, 2016

Note: The data in the figure does not represent all of the department’s non-major acquisitions, as 

components were not able to identify the full scope.
Page 19 GAO-17-396 Homeland Security Acquisitions

We found that the 21 capital acquisitions without CAE-approved 

baselines constituted a 47 percent share ($3.0 billion) of the 

approximately $6.4 billion components reported as the total value of their 

non-major capital acquisitions. Figure 6 shows the value of non-major 

acquisitions with CAE-approved baselines and the value of those without 

CAE-approved baselines.

Figure 6: Value of Active Non-Major Acquisitions Identified by Components and 

Status of Baselines as of October 1, 2016

Note: The data in the figure does not represent all of the department’s non-major acquisitions, as 

components were not able to identify the full scope.

Component officials offered a variety of reasons why their CAEs had not 

approved baselines for non-major acquisitions. For example, they said 

that (1) the baselines for these acquisitions have been a relatively low 

priority and were therefore still pending development or approval; (2) their 

components chose not to require program baselines for non-major 

acquisitions; or (3) while the component requires baselines for future nonmajor acquisitions, the acquisitions were initiated prior to the 

establishment of that requirement.

However, this situation is likely to change, given that, in February 2017, 

DHS issued a new policy specifically focused on managing non-major 

acquisitions. In response to our preliminary findings, during the course of 

our audit, the Under Secretary for Management included in this policy a 

requirement that component leadership approve baselines for these 

acquisitions.13 This new requirement should help components execute 

their acquisitions more effectively. Specifically, as identified above, CAEs 

are likely to: (1) accurately understand the size of their portfolio; (2) have 

adequate knowledge about execution against cost, schedule and 

 13DHS, Level 3 Acquisition Management, Instruction Number 102-01-010. 
Page 20 GAO-17-396 Homeland Security Acquisitions

performance parameters when making acquisition decisions; and (3) 

secure the funding the acquisition needs to meet those parameters. 

Establishing a program baseline need not be a significant program 

burden. Baselines should reflect basic, existing acquisition information in 

a format that is effective for component management.

DHS headquarters officials have increased their focus on non-major 

acquisitions, and a new policy may help DHS’s component agencies 

establish effective management controls, particularly by helping ensure 

the new baseline policy is implemented. In 2015, DHS headquarters 

officials established an annual review process for non-major acquisitions 

with life cycle cost estimates greater than $50 million, and they now plan 

to use this process to ensure that components are assessing acquisition 

performance against approved cost, schedule and performance 

baselines. DHS leadership has also added new reporting requirements 

for these acquisitions, and, in response, all components have started 

entering non-major acquisition data into INVEST, DHS’s central 

acquisition information system. The data component officials entered into 

INVEST during 2016 were unreliable, but headquarters officials are taking 

steps to improve the reliability of this data. Further, DHS headquarters 

officials have defined roles and responsibilities for managing non-major 

acquisitions, hired an oversight official specifically responsible for these 

acquisitions, and elevated selected non-major acquisitions for 

department-level oversight.

MD-102 establishes that the Executive Director of PARM should ensure 

CAEs are overseeing their components’ non-major acquisitions 

appropriately.14 Specifically, the policy states that the Executive Director 

shall review CAE governance activities and monitor the performance of 

non-major acquisitions. To this end, PARM has implemented a series of 

annual reviews of components’ non-major acquisitions with a life cycle 

cost greater than $50 million that have not yet achieved FOC. According 

to our analysis, the $50 million threshold provides PARM insight into the 

bulk of the resources components plan to allot to these acquisitions. 

Components valued 21 of their 38 reported active non-major acquisitions 

at more than $50 million, and these acquisitions account for 

approximately 95 percent—$6.1 billion—of the roughly $6.4 billion 

 14Ibid.

DHS Headquarters 

Has Recently 

Increased Focus on 

Non-Major 

Acquisitions, and 

New Policy May Help 

Ensure More Effective 

Management

PARM Plans to Use 

Annual Reviews to Ensure 

Components Are 

Managing Non-Major 

Acquisitions Appropriately
Page 21 GAO-17-396 Homeland Security Acquisitions

components reported as the total value of their active non-major 

acquisitions.

PARM initiated these reviews in 2015, and, during the first round, officials 

said they reviewed the components’ non-major acquisition policies in an 

effort to determine whether these policies aligned with departmental 

guidance. PARM officials also said the components provided updates on 

the acquisitions’ costs, key milestones, and capabilities.

For the second series of annual reviews in 2016, the DHS Under 

Secretary for Management issued a memorandum intended to increase 

the rigor of PARM’s non-major acquisition reviews. The memorandum 

stated that the components must provide PARM “evidence of sufficient 

acquisition documentation as tailored by the CAE” and report cost, 

schedule, and performance metrics with associated milestones. However, 

the memorandum did not identify (1) any minimum requirements for 

sufficient acquisition documentation; or (2) the specific cost, schedule, 

and performance metrics the components should report to PARM. To 

clarify the requirements, later in 2016, PARM developed more detailed 

instructions for the 2016 annual review. PARM instructed the components 

to identify whether they had an overarching policy or set of policies that 

were specific to non-major acquisitions, and whether these policies 

aligned with departmental guidance. PARM instructed the components to 

report the annual costs associated with each acquisition, provide a highlevel schedule, include a description of the capability or service being 

acquired, and discuss issues such as the CAE’s confidence in the 

program’s meeting the metrics in the program baseline, if a baseline was 

indeed in place.

Additionally, in response to our preliminary findings, a new policy that 

DHS finalized in February 2017 includes a requirement that component 

leadership approve baselines for non-major acquisitions that have not yet 

achieved FOC, and states that PARM’s Executive Director will leverage 

its reviews to assess whether CAEs are (a) baselining these acquisitions 

in accordance with the requirement; and (b) tracking the acquisitions’

progress against cost, schedule, and performance parameters from 

approved baselines. These reviews would help PARM’s Executive 

Director determine whether CAEs are overseeing their non-major 

acquisitions in accordance with MD-102. Federal internal control 
Page 22 GAO-17-396 Homeland Security Acquisitions

standards state that management should monitor program results and 

evaluate these results against a previously established baseline.15

As part of its efforts to increase oversight of non-major acquisitions, DHS 

leadership now requires components to enter data into the INVEST 

system for all non-major acquisitions valued at greater than $50 million 

that have not yet reached FOC. INVEST, DHS’s central system for 

acquisition information, is used by program-, component-, and 

department-level officials to enter and obtain information for monthly 

reporting and monitoring. In the past, components were required to enter 

non-major acquisition data into INVEST only for IT acquisitions valued at 

greater than $50 million as part of the DHS IT Capital Planning and 

Investment Control process. In March 2016, DHS’s Under Secretary for 

Management issued a memo requiring components to enter data into 

INVEST for both IT and non-IT non-major acquisitions valued at greater 

than $50 million.

However, we found that the data component officials had entered into 

INVEST for non-major acquisitions through 2016 were unreliable. Only 

about half of the acquisitions eligible for entry into INVEST had been 

entered into the system. As of January 2017, component officials had 

entered data into INVEST for 10 of the 21 programs that were eligible for 

entry into the system—i.e., active non-major acquisitions valued at 

greater than $50 million. For the majority of the non-major acquisitions in 

INVEST, we found few source documents—particularly baselines—that 

CAEs could use to validate the data. A December 2016 requirement 

states that CAEs must validate the accuracy of these data in INVEST 

twice a year, mirroring the current certification requirement for major 

acquisitions. This recent requirement, combined with the February 2017 

baselining requirement, will likely improve the reliability of the data.

Additionally, component officials have reported challenges when trying to 

enter non-major acquisition data into INVEST. PARM did not initially 

provide specific guidance on entering the data, and officials from some 

components said they were confused about the amount and type of 

information that should be entered into INVEST. In response to this 

confusion, PARM officials created a new guidebook in October 2016 and 

 15GAO-14-704G. 

Components Have Started 

Entering Non-Major 

Acquisition Data into 

INVEST and Headquarters 

Is Taking Steps to Improve 

Data Reliability
Page 23 GAO-17-396 Homeland Security Acquisitions

issued additional instructions in a December 2016 memo intended to 

clarify the INVEST data-entry process.

In addition to PARM’s implementation of annual non-major acquisition 

reviews and the requirement to enter non-major acquisition data into 

INVEST, DHS headquarters has taken several additional actions to help 

improve the components’ management of these acquisitions. These 

actions include the following:

• Defining roles and responsibilities for managing non-major 

acquisitions. In February 2017, the DHS Under Secretary for 

Management more clearly defined CAEs’ roles and responsibilities for 

managing non-major acquisitions. PARM also issued new non-major 

acquisition management guidance specific to the DHS Management 

Directorate in February 2017. The new policy consolidates the 

Management Directorate’s CAE authority by designating the Deputy 

Director of PARM the CAE for all of the Management Directorate’s 

non-major acquisitions. Previously, offices within the Management 

Directorate, such as the OCIO and the Office of the Chief Readiness 

Support Officer, had their own CAEs. One such office in the scope of 

our review—OCIO—did not use the acquisition lifecycle process for its 

acquisition management. This new policy could help to ensure the 

various offices take a consistent approach.

• Hiring an oversight official specifically responsible for non-major 

acquisitions. In light of the billions of dollars the department is 

spending on these acquisitions, in May 2016, PARM hired an official 

to focus solely on DHS’s non-major acquisitions. This official’s 

responsibilities and goals include working with the DHS components 

to develop and improve their policies and processes for managing 

non-major acquisitions, in part by ensuring that they align with 

departmental guidance.

• Formalizing the process for identifying/categorizing acquisitions.

DHS’s Master Acquisition Oversight List identifies the department’s 

acquisitions and categorizes them by component, major or non-major 

status, and acquisition type, in order to help DHS’s acquisition 

managers apply the appropriate oversight requirements. In 2015, 

PARM established a DHS Master Acquisition Oversight List 

Governance Board. This body reviews and approves major and nonmajor acquisition additions, removals, and other updates to the 

department’s Master Acquisition Oversight List. The board members 

consist of representatives from the department’s lines of business, 

DHS Headquarters Has 

Taken Additional Actions to 

Help Improve 

Components’

Management of Non-Major 

Acquisitions
Page 24 GAO-17-396 Homeland Security Acquisitions

including the Office of the Chief Financial Officer, OCIO, and the 

Office of the Chief Procurement Officer.

• Elevating non-major acquisitions for department-level oversight.

Finally, in some circumstances, the DHS Under Secretary for 

Management has elevated selected non-major acquisitions to major 

acquisition status, and, as a result, these acquisitions have received 

greater department oversight. For example, in April 2016, the Under 

Secretary for Management elevated CBP’s Remote Video 

Surveillance System to major acquisition status in response to an 

expansion in the acquisition’s scope that increased its value above 

the non-major acquisition dollar threshold. Similarly, at FEMA’s 

request, the Under Secretary for Management elevated FEMA’s 

Integrated Public Alert and Warning System acquisition to major 

status because of its complexity, cross-component impact, and high 

visibility outside of the department. DHS officials stated that the Under 

Secretary for Management may elevate non-major acquisitions for 

other reasons, including external events such as congressional and 

media interest, if a program’s importance to DHS’s strategic and 

performance plans is disproportionate to its size, and if an acquisition 

has significant program or policy implications.

These actions reflect DHS leadership’s increased focus on non-major 

acquisitions as the department continues to work to mature its acquisition 

management processes across all of its component agencies.

Over the past 8 years, DHS leadership has taken several steps to mature 

its acquisition management processes. More recently, DHS leadership 

has increasingly focused on its non-major acquisitions, which is fitting, 

given the billions of dollars going to these programs. Primary 

responsibility for managing these acquisitions rests, appropriately, with 

component officials. However, the fact that officials from few components 

could confidently identify the full scope of their non-major acquisitions is 

problematic. Understandably, the focus to date has been on active 

acquisitions, but it is also important that components understand the 

extent of their non-major acquisitions that have been fielded but are still 

receiving taxpayer funds to operate. Without an established time frame 

for components to identify the full picture of their non-major acquisitions—

particularly given their acknowledged resource constraints and competing 

priorities—progress may not have been sustained.

Conclusions
Page 25 GAO-17-396 Homeland Security Acquisitions

To improve the management of DHS’s non-major acquisitions, we 

recommended that the Secretary of Homeland Security direct the Under 

Secretary for Management to establish a time frame for components to 

identify all of their non-major acquisitions.

We provided a draft of this product to DHS for comment. In its written 

comments, reproduced in appendix II, DHS concurred with our 

recommendation and indicated that the Under Secretary for Management 

has directed Component Acquisition Executives to identify all Level 3 

acquisitions across DHS by no later than October 31, 2017. We reviewed 

the supporting documentation provided by DHS, reproduced in appendix 

III, and determined that this direction addressed the recommendation.

DHS also provided technical comments that we addressed as 

appropriate.

We are sending copies of this report to the appropriate congressional 

committees, the Secretary of the Department of Homeland Security, and 

other interested parties. In addition, the report is available at no charge on 

the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact 

me at (202) 512-4841 or mackinm@gao.gov. Contact points for our Office 

of Congressional Relations and Public Affairs may be found on the last 

page of this report. GAO staff who made key contributions to this report 

are listed in appendix IV.

Michele Mackin

Managing Director, Acquisition and Sourcing Management

Recommendation for 

Executive Action

Agency Comments 

and Our Evaluation
Page 26 GAO-17-396 Homeland Security Acquisitions

The objectives of this audit were designed to examine the Department of 

Homeland Security’s (DHS) management of non-major acquisitions. This 

review addresses both the components’ management of non-major 

acquisitions as well as the department’s oversight role. Specifically, this 

report assesses (1) the extent to which component leadership is 

effectively overseeing non-major acquisitions and (2) the extent to which 

DHS headquarters has helped components establish effective 

management controls for non-major acquisitions.

To identify the extent to which component leadership is effectively 

overseeing non-major acquisitions, we attempted to identify all non-major 

acquisitions within DHS. We asked officials from DHS’s Office of Program 

Accountability and Risk Management (PARM), which are responsible for 

overseeing the department’s acquisitions, to identify the components that 

manage non-major acquisitions. PARM identified 14 DHS components in 

response. We requested data from the 14 DHS components and obtained 

non-major acquisition data from 11 components. Officials from the 3 

remaining components stated that they did not manage non-major 

acquisitions. For example, officials from the DHS Science and 

Technology Directorate stated that their component does not identify any 

acquisition valued at less than $50 million as a non-major acquisition and, 

based on that definition, the component does not have any non-major 

acquisitions to report. For this reason, we removed the Science and 

Technology Directorate from our scope. The 11 DHS component offices 

and agencies we reviewed are:

• Customs and Border Protection,

• Domestic Nuclear Detection Office,

• Federal Emergency Management Agency,

• Federal Law Enforcement Training Centers,

• Immigration and Customs Enforcement,

• National Protection and Programs Directorate,

• Office of the Chief Information Officer,

• Transportation Security Administration,

• U.S. Citizenship and Immigration Services,

• U.S. Coast Guard, and

• U.S. Secret Service.

Appendix I: Objectives, Scope, and 

Methodology
Page 27 GAO-17-396 Homeland Security Acquisitions

We developed a data collection instrument, sent it to each component, 

and requested the acquisition name, capability description, total 

acquisition cost, acquisition type, most recent acquisition decision events, 

full operational capability (FOC) date, and acquisition lifecycle phase for 

all of the component’s non-major acquisitions. We used a data collection 

instrument to obtain non-major acquisitions data based on preliminary 

discussions with DHS and component officials that indicated we should 

work directly with the components to collect this information. 

To assess the reliability of the data provided by components, we reviewed 

the data to identify outliers, missing data and other potential errors, and 

compared the data to source documents when available. In interviews 

and via e-mail correspondence; we provided component officials an 

opportunity to review, discuss, and, where applicable, correct any 

completeness and accuracy issues. In addition, we requested that each 

component update its non-major acquisition data to be accurate as of 

October 1, 2016. We also requested and reviewed information on how the 

components enter, store, access, update, and review non-major 

acquisition data, as well as component officials’ comments on the 

reliability of the data they provided. Based on this assessment, we 

determined that the population of current non-major acquisitions and their 

associated acquisition costs could not be reliably determined. However, 

we determined that the data were sufficiently reliable to identify the 

minimum number of non-major acquisitions, and the general magnitude of 

the minimum acquisition costs associated with active non-major 

acquisitions. For those acquisitions that components could identify, we 

found that the data components provided for these non-major acquisitions 

were generally unreliable as further discussed in the report.

In addition to the non-major acquisitions at the components that PARM 

identified, with the assistance of component officials we also identified 

one non-major acquisition at the DHS Office of the Chief Readiness 

Support Officer and one non-major acquisition at the DHS Office of the 

Chief Security Officer. We included these acquisitions in our scope when 

working to identify the universe of non-major acquisitions at DHS. As a 

final quality assurance step, we returned the collected and updated data 

collection instruments to the respective components, and requested 

officials verify and, when applicable, correct the data.

To designate each acquisition active, pre-active, or post-FOC, we 

reviewed the FOC and acquisition phase data that the component officials 

provided. We designated an acquisition active if it had reached 

Acquisition Decision Event 2A but had not reached FOC by October 1, 
Page 28 GAO-17-396 Homeland Security Acquisitions

2016. If any increment, project, or segment of an acquisition was active, 

we designated the entire acquisition active. We designated acquisitions 

with an FOC date on or before October 1, 2016 post-FOC, and those that 

had not yet reached Acquisition Decision Event 2A by October 1, 2016

pre-active. For acquisitions with conflicting data, we confirmed our 

designation with component officials. In addition, we collected acquisition 

cost information for each acquisition, specifically, life cycle cost estimates 

for capital asset acquisitions and annual expenditure data for services 

acquisitions. For active acquisitions that did not have final cost estimates 

in place, we accepted and reported the preliminary information that was 

available, such as rough order of magnitude estimates or life cycle cost 

estimates with lower confidence levels.

To understand the processes components use to manage non-major 

acquisitions and assess the extent to which components were 

consistently baselining these acquisitions, we reviewed draft and final 

DHS acquisition policy, and component-level non-major acquisition 

policies and guidance. We also requested and reviewed acquisition 

decision memos and component-approved acquisition program 

baselines—or any equivalent documents containing cost, schedule, and 

performance parameters—for all acquisitions that were active as of 

October 1, 2016. We then reviewed each baseline document to determine 

whether it actually contained cost, schedule, and performance 

parameters in accordance with key acquisition management practices we

established in previous reports. We also interviewed department and 

component officials to expand our understanding of component 

management processes, and determine why the components were or 

were not approving baselines for non-major acquisitions.

To identify the extent to which DHS headquarters has helped components 

establish effective management controls for non-major acquisitions, we 

reviewed draft and final department acquisition policy, guidance, and 

memos to identify how PARM and other headquarters entities contribute 

to non-major acquisition management. We also reviewed this 

documentation to identify existing and planned oversight mechanisms for 

non-major acquisitions. We requested information from officials at nine 

DHS headquarters entities and the 11 DHS components in our scope to 

identify how, if at all, DHS headquarters entities other than PARM monitor 

or interact with non-major acquisitions during the acquisition process. We 

interviewed officials from PARM to discuss PARM’s annual review 

process, DHS’s Master Acquisition Oversight List, and other efforts to 

address non-major acquisitions. Finally, we interviewed officials from 

PARM and the components to better understand ongoing efforts to enter 
Page 29 GAO-17-396 Homeland Security Acquisitions

non-major acquisition data into DHS’s Investment Evaluation, 

Submission, & Tracking (INVEST) system, which is the department’s 

central system for information on its acquisitions. We also interviewed 

officials to better understand the circumstances under which DHS 

headquarters elevates non-major acquisitions to major acquisition status, 

increasing headquarters oversight.

To assess the reliability of the data in the INVEST system, we traced nonmajor acquisition data from INVEST to available source documents. We 

collected INVEST reports for active non-major acquisitions and compared 

cost information in those reports to available source documents, such as 

acquisition program baselines and life cycle cost estimates. To assess 

relevant internal controls, we reviewed the DHS INVEST User Guide and 

Training Manual and identified the purpose and structure of the INVEST 

system. We subsequently evaluated INVEST reports and identified the 

forms each component used to enter data into INVEST, as well as the 

level of completeness of the forms and any system-generated errors. 

Finally, we interviewed component and PARM officials to understand 

what, if any, internal controls headquarters and components were using 

for the non-major acquisition data before, during, and after entering that 

data into INVEST. We found the data in INVEST not to be sufficiently 

reliable for our purposes of reporting on the universe of non-major 

acquisitions.

We conducted this performance audit from February 2016 to April 2017 in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.
Page 30 GAO-17-396 Homeland Security Acquisitions

Appendix II: Comments from the Department 

of Homeland Security
Page 31 GAO-17-396 Homeland Security Acquisitions
Page 32 GAO-17-396 Homeland Security Acquisitions

Appendix III: Department of Homeland 

Security Guidance on the Identification of All 

Non-Major Acquisitions
Page 33 GAO-17-396 Homeland Security Acquisitions
Page 34 GAO-17-396 Homeland Security Acquisitions

Michele Mackin, (202) 512-4841 or mackinm@gao.gov

In addition to the contact listed above, Nathan Tranquilli (Assistant 

Director), Katherine Trimble (Assistant Director), Betsy Gregory-Hosler 

(Analyst-in-Charge), Andrew Fisher, Javier Irizarry, Kirsten Leikem, and 

John Rastler made significant contributions to this report. Peter Anderson, 

Christopher Businsky, Lorraine Ettaro, and Sylvia Schatz also made key 

contributions to this report.

Appendix IV: GAO Contact and Staff 

Acknowledgments

GAO Contact

Staff 

Acknowledgments

(100662)
The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO’s website (http://www.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to http://www.gao.gov

and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO’s website, http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, LinkedIn, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at www.gao.gov and read The Watchblog.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Strategic Planning and 

External Liaison

Please Print on Recycled Paper.