**GAO-09-492**                      Published: Mar 27, 2009. Publicly Released: Apr 22, 2009.                  

-   
-   
-   
-   

    Jump To:  
-  Elder Abuse 
-  Services for Older Adults 
-  State and Local-Level Drivers and Trends 
-  State and Local Fiscal Projections 
-  Federal Borrowing 
-  Managing the Debt 
-  Summary of Funding Provisions 
-  Auditing the Government's Books 
-  Unpacking the Financial Report 
-  Highlights 
-  Recommendations 
-  Background 
-  About This Work 
-  About This Work 
-  Trends 
-  About the Center 
-  Why It's High Risk 
-  What Remains To Be Done 
-  Key Reports 
-  Newest COVID-Related Reports 
-  AI Use Cases 
-  Flood Insurance 
-  Past Pandemic-Related Reports 
-  CARES Act Oversight Reports 
-  All COVID-19 Reports 
-  Report Suspected Fraud 
-  Subjects 
-  How to Get Notified 
-  Past Reports 
-  Public Health Threats 
-  Explore the FY 2022 and 2023 Funds 
-  Status of FY22 Projects 
-  Lessons Learned 
-  Agency Reports 
-  Recent Reports 
-  Recommendations 
-  Supplemental Material 
-  Full Report 
-  Additional Data 
-  View Decision 
-  Downloads 
-  Previously Identified Actions 
-  Related Pages 
-  Associated Agencies 
-  Tough Choices and Opportunities Ahead 
-  Americas Fiscal Future Key Areas 
-  Retirement Security Key Areas 
-  Current List 
-  About The High Risk List 
-  Area Ratings 
-  Previous High Risk Products 
-  Search Federal Vacancies 
-  Past Federal Vacancies 
-  Violation Letters 
-  About the Yellow Book 
-  Advisory Council 
-  Related Resources 
-  Comment Letters 
-  Related Publications 
-  Contacts and Resources 
-  Major Issues Facing the Nation 
-  Meeting Strategic Challenges 
-  Additional Resources 
-  Resources 
-  GAO Contacts 
-  Mission Teams 
-  Operations and Staff Offices  
-  Organization Chart  
-  Why a Career at GAO? 
-  Am I Qualified? 
-  Company Culture 
-  Reasonable Accommodations 
-  Video Gallery 
-  Paid Internships 
-  Student Volunteers 
-  Professional Development Program 
-  Advancement 
-  Executive Candidate Program 
-  Summer Associates 
-  Externships 
-  Benefits 
-  Contacts 

Skip to Highlights

## Highlights

The Department of Homeland Security (DHS) has called for using risk-informed approaches to help prioritize its investments, develop plans, and allocate resources in a way that balances security and commerce. Within DHS, the Transportation Security Administration (TSA) is responsible for making risk-informed investments to secure the transportation system. GAO evaluated to what extent TSA (1) implemented a risk management approach to inform the allocation of resources across the transportation sector and (2) followed internal control standards in its efforts to implement and use a risk management approach to inform resource allocation.

In conducting this work, GAO analyzed, among other things, DHS and TSA documents, such as TSA’s risk management methodology, and compared them to DHS’s risk management framework for infrastructure protection, compared TSA’s management activities to criteria in federal internal control standards, and interviewed DHS and TSA officials.

To promote effective use of risk management, GAO is recommending, among other things, that the Assistant Secretary, TSA, work with DHS to validate its risk management approach, conduct comprehensive risk assessments, and establish related internal controls. DHS concurred with all of our recommendations.

TSA has taken some actions but has not fully implemented a risk management approach to inform the allocation of resources across the transportation modes (aviation, mass transit, highway, freight rail, and pipeline). DHS’s risk management framework for infrastructure protection consists of six sequential steps that are used to systematically and comprehensively identify risk and establish risk-informed security priorities. TSA has taken some actions that the six steps require but has not conducted comprehensive risk assessments. For example, TSA collected information related to threat, vulnerability, and consequence within the transportation modes but has not conducted risk assessments that integrate these three components for each mode or the transportation sector as a whole. Identifying and prioritizing risk in this way is essential to efforts to allocate resources to address the highest priority risks. TSA developed an approach to prioritization based primarily on intelligence instead of comprehensive risk assessments. However, DHS has not reviewed or validated this methodology; thus, TSA lacks assurance that its approach provides the agency and DHS information needed to guide investment decisions to ensure resources are allocated to the highest risks. TSA also did not have a plan specifying the degree to which risk assessments are needed for the sector, the appropriate level of resources required to complete them, and time frames for completing its risk assessment efforts. Without a plan to identify the scope, resource requirements, and timeline for risk assessments, it will be difficult for TSA to ensure that it conducts timely and cost-effective risk assessments to inform resource allocation.

TSA has not followed federal internal control standards to assist it in implementing DHS’s risk management framework and informing resource allocation. Specifically, TSA lacked the following:

- An organizational structure that allows the agency to direct and control operations to achieve agency objectives. Although TSA officials acknowledged that a focal point for TSA’s risk management activities is needed, the agency has not yet established such a focal point.
- Policies, procedures, and guidance to assist its offices in ensuring that DHS’s National Infrastructure Protection Plan (NIPP) risk management framework and related activities, such as risk assessments, are implemented as DHS and TSA intended for the transportation sector and its individual modes.
- A mechanism to monitor the quality of performance. While TSA reports to DHS on the implementation of its risk management activities, it did not discuss all of the steps necessary to implement DHS’s risk management framework, such as the status of efforts taken to complete risk assessment activities including threat, vulnerability, and consequence assessments.

Without effectively implementing such controls, TSA cannot provide reasonable assurance that its resources are being used effectively and efficiently to achieve security priorities and that accountability and oversight regarding the quality of risk management activities implemented exists.

## Recommendations

## Recommendations for Executive Action

See All 6 Recommendations

## Full Report

Highlights

Full Report (63 pages)

Accessible Text 

## Office of Public Affairs

### Media Inquiries

Sarah Kaczmarek
kaczmareks@gao.gov

(202) 512-4800

### Public Inquiries

Public Affairs
PublicAffairs@gao.gov

(202) 512-4800

## Topics

Homeland Security

Agency missionsClassified defense informationComputer securityCost analysisCost effectiveness analysisCritical infrastructureCritical infrastructure protectionEmergency preparednessHomeland securityInternal controlsQuality assuranceReporting requirementsRisk assessmentRisk managementSecurity assessmentsStrategic planningSystems analysisTerrorismTransportation industryTransportation planningTransportation safetyTransportation security