**GAO-11-581**                      Published: Jul 28, 2011. Publicly Released: Jul 28, 2011.                  

-   
-   
-   
-   

    Jump To:  
-  Elder Abuse 
-  Services for Older Adults 
-  State and Local-Level Drivers and Trends 
-  State and Local Fiscal Projections 
-  Federal Borrowing 
-  Managing the Debt 
-  Summary of Funding Provisions 
-  Auditing the Government's Books 
-  Unpacking the Financial Report 
-  Highlights 
-  Recommendations 
-  Background 
-  About This Work 
-  About This Work 
-  Trends 
-  About the Center 
-  Why It's High Risk 
-  What Remains To Be Done 
-  Key Reports 
-  Newest COVID-Related Reports 
-  AI Use Cases 
-  Flood Insurance 
-  Past Pandemic-Related Reports 
-  CARES Act Oversight Reports 
-  All COVID-19 Reports 
-  Report Suspected Fraud 
-  Subjects 
-  How to Get Notified 
-  Past Reports 
-  Public Health Threats 
-  Explore the FY 2022 and 2023 Funds 
-  Lessons Learned 
-  Agency Reports 
-  Recent Reports 
-  Recommendations 
-  Supplemental Material 
-  Full Report 
-  Additional Data 
-  View Decision 
-  Downloads 
-  Previously Identified Actions 
-  Related Pages 
-  Associated Agencies 
-  Tough Choices and Opportunities Ahead 
-  Americas Fiscal Future Key Areas 
-  Retirement Security Key Areas 
-  Current List 
-  About The High Risk List 
-  Area Ratings 
-  Previous High Risk Products 
-  Search Federal Vacancies 
-  Past Federal Vacancies 
-  Violation Letters 
-  About the Yellow Book 
-  Advisory Council 
-  Related Resources 
-  Comment Letters 
-  Related Publications 
-  Contacts and Resources 
-  Major Issues Facing the Nation 
-  Meeting Strategic Challenges 
-  Additional Resources 
-  Resources 
-  GAO Contacts 
-  Mission Teams 
-  Operations and Staff Offices  
-  Organization Chart  
-  Why a Career at GAO? 
-  Am I Qualified? 
-  Company Culture 
-  Reasonable Accommodations 
-  Video Gallery 
-  Paid Internships 
-  Student Volunteers 
-  Professional Development Program 
-  Advancement 
-  Executive Candidate Program 
-  Summer Associates 
-  Externships 
-  Benefits 
-  Contacts 

Skip to Highlights

## Highlights

Since its creation in 2003, the Department of Homeland Security (DHS) has been developing new information technology (IT) systems to perform both mission-critical and support functions; however, it has faced challenges in developing these systems. One way to manage the inherent risks of developing and acquiring systems is through independent verification and validation (IV&V)--a process conducted by a party independent of the development effort that provides an objective assessment of a project's processes, products, and risks throughout its life cycle and helps ensure that program performance, schedule, and budget targets are met. GAO was asked to determine (1) how DHS's IV&V policies and procedures for IT acquisitions compare with leading practices and (2) the extent to which DHS has implemented IV&V on its large IT system acquisitions. To do so, GAO assessed DHS's policy against industry standards and leading practice guides, as well as analyzed how eight selected IT programs had implemented IV&V.

DHS recognizes the importance of IV&V and recommends its use on major IT programs. Nevertheless, its acquisition policy does not address the elements of leading practices for IV&V. Specifically, the department has not established risk-based decision making criteria for determining whether, or the extent to which, programs should utilize IV&V. In addition, department policy does not define the degree of independence required of agents and does not require that programs determine and document the planned scope of their efforts, including the program activities subject to review; the resources required; roles and responsibilities; and how the results will be reported and acted upon. Moreover, the policy does not address overseeing DHS's investment in IV&V. Thus, officials were unaware of the extent to which it was being used on major IT acquisition programs, associated expenditures, or if those expenditures are producing satisfactory results. Absent such policy elements and more effective oversight, the department's investments in IV&V efforts are unlikely to provide optimal value for the department and, in some cases, may even fail to deliver any significant benefits. Many large IT acquisition programs across DHS reported using IV&V as part of their acquisition and/or development processes. Nevertheless, the eight major IT acquisition programs that GAO analyzed did not consistently implement the elements of leading practice. For example, the eight did not fully apply a structured, risk-based decision making process when deciding if, when, and how to utilize IV&V. In part, these weaknesses are due to the lack of clear departmentwide guidance regarding the use of such practices. As a result, the department's IV&V efforts may not consistently contribute toward meeting IT acquisition cost, schedule, and mission goals. GAO recommends that DHS (1) update its acquisition policy to reflect elements of effective IV&V, (2) monitor and ensure implementation of this policy on applicable new and ongoing IT programs, and (3) collect data on IV&V usage and use it to evaluate the effectiveness of these investments. DHS concurred with GAO's recommendations and described actions planned or under way to address them.

## Recommendations

## Recommendations for Executive Action

## Full Report

Highlights

Full Report (65 pages)

Accessible Text 

## Office of Public Affairs

Sarah Kaczmarek
kaczmareks@gao.gov

(202) 512-4800

## Topics

Government Operations

Agency missionsBest practicesData collectionDecision makingEvaluation criteriaEvaluation methodsIndependent research and developmentInformation technologyInternal controlsIT acquisitionsIT investment managementLessons learnedOperational testingPolicy evaluationProcurement planningProcurement policyProgram evaluationProgram managementRisk managementSoftware verification and validationSystems designSystems development life cycleTestingAssessmentsPolicies and proceduresProgram implementationSystems development