GAO 

United States Government Accountability Office

Report to Congressional Requesters

HOMELAND 

SECURITY 

Key US-VISIT 

Components at 

Varying Stages of 

Completion, but 

Integrated and 

Reliable Schedule 

Needed 

November 2009 

GAO-10-13 
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

November 2009

HOMELAND SECURITY

Key US-VISIT Components at Varying Stages of 

Completion, but Integrated and Reliable Schedule 

Highlights of GAO-10-13, a report to Needed 

congressional requesters 

The Department of Homeland 

Security’s (DHS) U.S. Visitor and 

Immigrant Status Indicator 

Technology (US-VISIT) program 

stores and processes biometric and 

biographic information to, among 

other things, control and monitor 

the entry and exit of foreign 

visitors. Currently, an entry 

capability is operating at almost 

300 U.S. ports of entry, but an exit 

capability is not. GAO has 

previously reported on limitations 

in DHS’s efforts to plan and 

execute its efforts to deliver USVISIT exit, and made 

recommendations to improve these 

areas. GAO was asked to determine 

(1) the status of DHS’s efforts to 

deliver a comprehensive exit 

solution and (2) to what extent 

DHS is applying an integrated 

approach to managing its 

comprehensive exit solution. To 

accomplish this, GAO assessed USVISIT exit project plans, schedules, 

and other management 

documentation against relevant 

criteria, and it observed exit pilots. 

What GAO Recommends

GAO is augmenting its prior 

recommendations to the Secretary 

of Homeland Security aimed at 

strengthening US-VISIT exit 

planning and execution by 

recommending that the Secretary 

ensure that an integrated master 

schedule for the department’s 

Comprehensive Exit project be 

developed and maintained in 

accordance with the key practices 

embodied in relevant guidance. 

DHS concurred with GAO’s 

recommendation. 

DHS has established a Comprehensive Exit project within its US-VISIT 

program that consists of six components that are at varying stages of 

completion. These components and the status of each according to the project 

execution process of US-VISIT’s system life cycle management methodology 

are summarized in the figure below. 

Comprehensive Exit Components and Status

Sources: GAO analysis of DHS data and information from program officials.

Note: Because the Air Exit Pilots were decommissioned upon completion, they were not transitioned beyond the 

project execution process. 

Complete In progress Not yet started

Air/Sea Biometric 

Release 1

Reporting Phase 1

Air Exit Pilots

Long-term Air/Sea

Temporary Worker 

Visa Exit Pilot

Long-term Land

Project execution life cycle phases

Component Plan Analyze Design Build Test Deploy Transition

N/A

Note: Because the Air Exit Pilots were decommissioned upon completion, they were not transitioned 

beyond the project execution process. 

To DHS’s credit, the US-VISIT program office has established integrated project 

management plans for, and has adopted an integrated approach to, interacting 

with and involving stakeholders in its Comprehensive Exit project. However, it 

has not adopted an integrated approach to scheduling, executing, and tracking 

the work that needs to be accomplished to deliver a comprehensive exit 

solution. Rather, it is relying on several separate and distinct schedules to 

manage individual components and the US-VISIT prime contractor’s work that 

supports these components. Moreover, neither of the two component schedules 

that GAO reviewed are reliable because they have not been derived in 

accordance with relevant guidance. Specifically, both the Air Exit Pilots 

schedule and the Temporary Worker Visa Exit Pilot schedule only fully meet 

one of nine key schedule estimating practices, and either partially, minimally, or 

do not meet the remaining eight. In contrast, the prime contractor’s schedule is 

largely reliable, as it fully or substantially meets all nine practices. 

Without a master schedule for the Comprehensive Exit project that is 

integrated and derived in accordance with relevant guidance, DHS cannot 

reliably commit to when and how the work will be accomplished to deliver a 

comprehensive exit solution to its almost 300 ports of entry, and it cannot 

adequately monitor and manage its progress toward this end. 

View GAO-10-13 or key components.

For more information, contact Randolph C. 

Hite at (202) 512-3439 or hiter@gao.gov. 
Page i GAO-10-13 

Contents 

Letter 1

Background 2 

Comprehensive Exit Project Consists of Six Components That Are 

in Various Phases of Delivery 13 

DHS Approach to Managing Comprehensive Exit Project Is Not 

Fully Integrated 20 

Conclusions 28 

Recommendation for Executive Action 29 

Agency Comments and Our Evaluation 29 

Appendix I Objectives, Scope, and Methodology 31 

Appendix II Detailed Results of GAO Assessment of Schedules 

for Ongoing Comprehensive Exit Components and 

Prime Contractor Schedule 33 

Appendix III Comments from the Department of 

Homeland Security 45 

Appendix IV GAO Contact and Staff Acknowledgments 47 

Tables 

Table 1: Component and Contractor Schedules Satisfaction of GAO 

Schedule Estimating Best Practices 28 

Table 2: US-VISIT Air Exit Pilots Schedule Compared to Best 

Practices 33 

Table 3: US-VISIT Temporary Worker Visa Exit Pilot Schedule 

Compared to Best Practices 38 

Table 4: US-VISIT Contractor Schedule Compared to Best Practices 42 

Figures 

Figure 1: Mission Processes Supported by US-VISIT 5 

 Homeland Security 
Figure 2: Timeline of Incremental US-VISIT Capabilities 8 

Figure 3: Comprehensive Exit Components and Status 14 

Figure 4: Illustration of Air Exit Pilots Biometric Data Collection 

and Transmission Process 17 

Abbreviations 

CBP U.S. Customs and Border Protection 

DHS Department of Homeland Security 

DMIA Immigration and Naturalization Service Data Management 

Improvement Act of 2000 

ELCM Enterprise Life Cycle Methodology 

FBI Federal Bureau of Investigation 

IDENT Automated Biometric Identification System 

IIRIRA Illegal Immigration Reform and Immigrant Responsibility Act 

of 1996 

POE port of entry 

RFID radio frequency identification 

TSA Transportation Security Administration 

US-VISIT U.S. Visitor and Immigrant Status Indicator Technology 

WBS work breakdown structure 

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately. 

Page ii GAO-10-13 Homeland Security
Page 1 GAO-10-13 

 

United States Government Accountability Office

Washington, DC 20548 

 

November 19, 2009 

The Honorable Bennie G. Thompson 

Chairman 

Committee on Homeland Security 

House of Representatives 

The Honorable Loretta Sanchez 

Chairwoman 

Subcommittee on Border, Maritime 

 and Global Counterterrorism 

Committee on Homeland Security 

House of Representatives 

For many years, Congress and the executive branch have sought better 

ways to record and track the arrival and departure of foreign travelers 

through U.S. air, sea, and land ports of entry (POE). Pursuant to a series of 

statutory mandates, the Department of Homeland Security (DHS), in 

coordination with the Department of State, established a program to use 

biometric and biographic information to control and monitor the preentry, entry, status, and exit of certain foreign visitors and immigrants. 

This program, which is called the U.S. Visitor and Immigrant Status 

Indicator Technology (US-VISIT) program,1

 is intended to enhance the 

security of U.S. citizens and visitors, facilitate legitimate travel and trade, 

ensure the integrity of the U.S. immigration system, and protect the 

privacy of visitors to the United States. Since 2006, DHS has been 

operating a US-VISIT entry capability at about 300 air, sea, and land POEs, 

and has conducted evaluations and proof-of-concept experiments relative 

to a US-VISIT exit capability. However, it has yet to develop and deploy an 

operational exit solution at U.S. POEs. The program’s current efforts to 

1

US-VISIT currently applies to a certain group of foreign nationals—nonimmigrants from 

countries whose residents are required to obtain nonimmigrant visas before entering the 

United States and residents of certain countries who are exempt from U.S. visa 

requirements when they apply for admission to the United States for up to 90 days for 

tourism or business purposes under the Visa Waiver Program. US-VISIT also applies to (1) 

lawful permanent residents; (2) Mexican nonimmigrants traveling with a Border Crossing 

Card, who wish to remain in the United States longer than 30 days, or who declare that they 

intend to travel more than 25 miles into the country from the border; and (3) Canadians 

traveling to the United States for certain specialized reasons. See 8 C.F.R. § 235.1(f). 

 Homeland Security 
 

develop an exit capability are collectively referred to as the 

Comprehensive Exit project. 

Because of the strategic importance of a US-VISIT exit capability to our 

nation’s evolving immigration and border management missions, you 

asked us to determine (1) the status of DHS’s efforts to deliver a 

comprehensive exit solution and (2) to what extent DHS is employing an 

integrated approach to managing its Comprehensive Exit solution. To 

accomplish our objectives, we reviewed key program documentation, 

including plans and schedules, to determine the composition of the 

Comprehensive Exit project and the status of its components. We also 

reviewed key Comprehensive Exit project management documentation 

and compared it with guidance relevant to the management of interrelated 

initiatives. 

We conducted this performance audit at the US-VISIT Program Office in 

Arlington, Virginia; U.S. Customs and Border Protection (CBP) 

headquarters offices in Washington, D.C.; Transportation Security 

Administration (TSA) headquarters offices in Arlington, Virginia; Detroit 

Metropolitan Wayne County Airport in Detroit, Michigan; and HartsfieldJackson Atlanta International Airport in Atlanta, Georgia, from January 

2009 to November 2009 in accordance with generally accepted government 

auditing standards. Those standards require that we plan and perform the 

audit to obtain sufficient, appropriate evidence to provide a reasonable 

basis for our findings and conclusions based on our audit objectives. We 

believe that the evidence obtained provides a reasonable basis for our 

findings and conclusions based on our audit objectives. For more details 

on our objectives, scope, and methodology, see appendix I. 

US-VISIT’s goals are to (1) enhance the security of U.S. citizens and 

visitors, (2) facilitate legitimate travel and trade, (3) ensure the integrity of 

the U.S. immigration system, and (4) protect the privacy of visitors.2

 The 

program is to achieve these goals by 

Background 

• collecting, maintaining, and sharing information on certain foreign 

nationals who enter and exit the United States; 

 

2

US-VISIT program documentation now refers to these as “principles.” 

Page 2 GAO-10-13 Homeland Security
 

• identifying foreign nationals who (1) have overstayed or violated the terms 

of their visit; (2) can receive, extend, or adjust their immigration status; or 

(3) should be apprehended or detained by law enforcement officials; 

• detecting fraudulent travel documents, verifying visitor identity, and 

determining visitor admissibility through the use of biometrics (digital 

fingerprints and a digital photograph); and 

• facilitating information sharing and coordination within the immigration 

and border management community. 

Federal Statutes Provide a 

Strategic Framework for 

US-VISIT 

A series of statutes that date back more than a decade have provided a 

framework for developing and deploying US-VISIT entry and exit 

capabilities. The Illegal Immigration Reform and Immigrant Responsibility 

Act of 1996 (IIRIRA)3

 required the Attorney General to develop an 

automated system to record the departure of every foreign national from 

the United States and then match it to the individual’s arrival record. 

Subsequently, section 2(a) of the Immigration and Naturalization Service 

Data Management Improvement Act (DMIA) of 20004

 amended the original 

entry-exit provisions of IIRIRA and required the Attorney General5

 to 

implement an integrated entry and exit data system for foreign nationals.6

More specifically, DMIA required an electronic system that would provide 

access to and integrate foreign national arrival and departure data that are 

authorized or required to be created or collected under law and are in an 

electronic format in Department of Justice or Department of State 

databases, such as those used at POEs and consular offices. The system, 

as described in DMIA, is to compare available arrival records with 

available departure records, allow online search procedures to identify 

foreign nationals who may have overstayed their authorized period of 

admission, and use available data to produce a report of arriving and 

departing foreign nationals. DMIA also required the implementation of the 

system at airports and seaports by December 31, 2003, at the 50 highest-

 

3

Pub. L. No. 104-208, div. C, § 110 (Sept. 30, 1996). 

4

8 U.S.C. § 1365a. 

5

Effective March 1, 2003, the functions of the Immigration and Naturalization Service 

moved from the Department of Justice to DHS. 

6

On April 29, 2003, the Secretary of DHS renamed the entry-exit system the US-VISIT 

system. 

Page 3 GAO-10-13 Homeland Security
 

volume land POEs by December 31, 2004, and at all remaining POEs by 

December 31, 2005. 

Subsequent laws added specific biometric requirements. The USA 

PATRIOT Act of 2001,7

 as amended, required the development and 

certification of a technology standard by January 26, 2003, including 

appropriate biometric identifiers that can be used to verify the identity of 

persons applying for a U.S. visa or seeking to enter the United States 

pursuant to a visa, for the purposes of conducting background checks, 

confirming identity, and ensuring that a person has not received a visa 

under a different name. The act also required DHS and the Department of 

State to focus on the utilization of biometric technology and the 

development of tamper-resistant documents readable at POEs for the 

integrated entry and exit data system. 

The Visa Waiver Permanent Program Act8

 required DHS to develop and 

implement a fully automated system to control entry and exit of aliens at 

airports and seaports who enter the United States under the Visa Waiver 

Program. The act was subsequently amended to require, not later than 

August 3, 2008, an exit system that uses biometric information and records 

every alien participating in the Visa Waiver Program that departs the 

United States by air.9

The Intelligence Reform and Terrorism Prevention Act of 200410 requires 

the collection of biometric exit data for all categories of individuals 

required to provide biometric entry data under US-VISIT, regardless of the 

POE where they entered the United States. The law also required DHS to 

develop a plan to accelerate the full implementation of the program. 

The Implementing Recommendations of the 9/11 Commission Act of 200711

further addressed the Visa Waiver Program by restricting DHS’s authority 

 

7

8 U.S.C. § 1379. USA PATRIOT Act stands for the Uniting and Strengthening America by 

Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001. As 

applicable here, the act’s requirements for the Immigration and Naturalization Service were 

taken over by DHS. 

8

8 U.S.C. § 1187(h). 

9

8 U.S.C. § 1187(i). 

108 U.S.C. § 1365b(d). 

118 U.S.C. § 1187(c)(8). 

Page 4 GAO-10-13 Homeland Security
 

to admit additional countries into the Visa Waiver Program until the 

department, among other things, was able to certify that it could verify the 

departure of not less than 97 percent of foreign nationals who exit from 

U.S. airports and had incorporated biometric indicators (such as 

fingerprints) into the air exit system by June 30, 2009. 

Overview of US-VISIT 

Scope and Systems 

Environment 

US-VISIT supports a series of homeland security-related mission processes 

that cover hundreds of millions of foreign national travelers who enter and 

leave the United States at about 300 air, sea, and land POEs. These five 

processes are described in the next section and depicted in figure 1. 

Figure 1: Mission Processes Supported by US-VISIT 

Entry Exit

Analysis

Pre-entry Status

Sources: GAO analysis of US-VISIT data; Nova Development Corp. (clipart).

• Pre-entry: the process of evaluating a traveler’s eligibility for required 

travel documents, enrolling travelers in automated inspection programs, 

and prescreening travelers entering the United States. 

• Entry: the process of determining a traveler’s admissibility into the United 

States at air, sea, or land POEs. 

• Status management: the process of managing and monitoring the 

changes and extensions of the visits of lawfully admitted nonimmigrant 

foreign nationals to ensure that they adhere to the terms of their admission 

and that they notify appropriate government entities when they do not. 

Page 5 GAO-10-13 Homeland Security
 

• Exit: the process of collecting information on travelers departing the 

United States. 

• Analysis: the process of continuously screening against watch lists of 

individuals enrolled in US-VISIT for appropriate reporting and action. 

To support these processes, US-VISIT systems and equipment must 

exchange data with a variety of other systems, some of which are owned 

by other agencies. For example, US-VISIT’s Automated Biometric 

Identification System (IDENT) collects and stores biometric data about 

foreign visitors, including information from the Federal Bureau of 

Investigation (FBI), U.S. Immigration and Customs Enforcement 

information on deported felons and sexual offender registrants, and DHS 

information on previous criminal histories and previous IDENT 

enrollments. IDENT connects to a number of different systems, some of 

which are described here. 

• Arrival and Departure Information System is owned by US-VISIT and 

stores noncitizen traveler arrival and departure biographic data received 

from air and sea carrier manifests. It matches entry, immigration status 

updates, and departure data to provide immigration status, including 

whether the individual has overstayed his or her authorized period of stay. 

• Consular Consolidated Database is owned by the Department of State and 

includes information on visa applicants. 

• TECS, formerly known as the Treasury Enforcement Communications 

System, is owned by CBP and maintains lookout (i.e., watch list) data, 

interfaces with other agencies’ databases, and is currently used by CBP 

officers at POEs to verify traveler information and update traveler data. 

• U.S. Coast Guard’s Mona Pass Proof-of-Concept is determining the 

feasibility of deploying a mobile biometrics identification capability on 

Coast Guard cutters in the Mona Passage12 and in the Coast Guard’s South 

Florida patrol area. 

 

12The Mona Passage is located between the Dominican Republic and Puerto Rico. The 

objective of the U.S. Coast Guard’s effort is to demonstrate the feasibility of using 

biometric data (fingerprints) to identify and support prosecution of interdicted individuals. 

Using real-time satellite connectivity, interdicted individuals are enrolled in US-VISIT’s 

IDENT database and are biometrically checked against known and suspected terrorists, 

aggravated felons, previous deportees, and recidivists. 

Page 6 GAO-10-13 Homeland Security
 

• Integrated Automated Fingerprint Identification System is owned by FBI 

and is the bureau’s automated 10-fingerprint matching system and is 

electronically connected to all 50 states, as well as some federal agencies. 

Overview of US-VISIT 

History, Organizational 

Placement, and Progress 

The US-VISIT program has roots in a program known as Entry Exit, which 

was established by the former Immigration and Naturalization Service in 

2002 in response to IIRIRA and other relevant legislation. Following the 

merger of the functions of the Immigration and Naturalization Service into 

DHS in 2003, the program was placed in DHS’s Border and Transportation 

Security Directorate and renamed US-VISIT. In 2007, US-VISIT was moved 

to DHS’s National Protection and Programs Directorate. 

DHS has delivered US-VISIT entry, and evaluated exit, capabilities in a 

series of increments. As a result, a biometrically enabled entry capability 

has been fully operational at about 300 air, sea, and land POEs since 

December 2006 (115 airports, 14 seaports, and 154 of 170 land ports13), but 

an exit capability has yet to be fully deployed. Increment 1 (air and sea 

entry), Increment 2B (land entry),14 and Increment 3 (land entry) 

addressed the deployment of an entry capability, while Increment 1B (air 

and sea exit) and Increment 2C (land exit) evaluated different alternatives 

for collecting exit information. The timing and purpose of each increment, 

as well as the delivery of other significant US-VISIT capabilities, are 

depicted in figure 2 and described after the figure. 

 

13According to program officials, 14 of the remaining 16 POEs do not have an operational 

need to deploy US-VISIT because visitors subject to US-VISIT are, by regulation, not 

authorized to enter the United States at these locations, with the exception of lawful 

permanent residents who are allowed to enter the United States at any POE. The other two 

POEs do not have the necessary transmission lines to operate US-VISIT, and thus they 

process visitors manually. 

14Increment 2A enhanced existing entry capability at land, sea, and air POEs to 

biometrically authenticate machine-readable visas and other travel and entry documents 

issued by the Department of State and DHS to foreign nationals. These capabilities were 

deployed to all POEs by October 23, 2005, except for e-Passports, which were deployed to 

33 POEs by November 14, 2006. These 33 POEs account for 97 percent of all travelers 

entering with e-Passports. 

Page 7 GAO-10-13 Homeland Security
 

Figure 2: Timeline of Incremental US-VISIT Capabilities 

Source: GAO analysis of DHS documentation. 

2004 2005 2006 2007

Increment 1B air/sea

exit pilots

Increment 2C land entry/exit 

RFID proof-of-concept

Comprehensive Exit

chartered

Increment 1 air/sea entry 

deployed

Increment 2B land entry 

deployed

Increment 3 land entry 

deployed

J FMAM J J A S ONDJ FMAM J J A S OND J FMAM J J A S ONDJ FMAM J J A S OND

Increments 1, 2B, and 3, which largely involved building interfaces among 

existing systems and enhancing the systems’ capabilities and supporting 

infrastructure, were delivered sequentially from January 2004 to December 

2006. Specifically, in January 2004, the program office began operating 

most aspects of its planned biometric entry capability at 115 airports and 

14 seaports for certain foreign nationals, including those from visa waiver 

countries (Increment 1).15 This capability was expanded to the 50 busiest 

land POEs by December 2004 (Increment 2B) and essentially deployed to 

104 remaining land POEs by December 2005 (Increment 3).16 As of 

December 2006, the program office was operating this entry capability at 

154 of 170 land POEs. 

According to DHS, US-VISIT entry operations have produced mission 

value. For example, as of June 2009, the program reported that it had more 

than 150,000 biometric hits in entry resulting in more than 8,000 people 

having adverse actions, such as denial of entry, taken against them. 

Further, about 43,000 leads were referred to the U.S. Immigration and 

Customs Enforcement immigration enforcement unit, resulting in 1,691 

arrests.17 Although difficult to demonstrate, officials have also cited the 

possible deterrence of terrorist entry due to the program’s publicized 

capability to verify visitor identity at U.S. borders during entry and to 

match visitors against watch lists of known and suspected terrorists. 

 

15On September 30, 2004, US-VISIT expanded biometric entry procedures to include 

individuals from visa waiver countries applying for admission. 

16At one POE, these capabilities were deployed by December 19, 2005, but were not fully 

operational until January 7, 2006, because of a telephone company strike that prevented the 

installation of a T-1 line. 

17We did not verify this information. 

Page 8 GAO-10-13 Homeland Security
 

In parallel with the delivery of entry capabilities, DHS examined the use of 

technology for recording the exit of travelers in the air, sea, and land 

environments. 

• Increment 1B consisted of a series of air and sea biometric exit pilots that 

operated from January 2004 to May 2007 at 14 U.S. POEs. The purpose of 

these pilots was to evaluate three different types of technology solutions: 

self-service kiosk, mobile device, and a combination of the two. All three 

solutions involved capturing a traveler’s digital photograph and 

fingerprint. The pilots established the technical feasibility of a biometric 

exit solution at air and sea POEs. They also identified issues that limited 

the operational effectiveness of the solution (e.g., unacceptably low 

traveler compliance rates). 

• Increment 2C, land entry/exit proof-of-concept demonstrations, operated 

at five ports of entry from August 2005 to November 2006. The purpose of 

these demonstrations was to examine the feasibility of using passive radio 

frequency identification (RFID) technology18 to record travelers’ entry and 

exit via a unique ID number tag embedded in the Form I-94 and to provide 

CBP officers in pedestrian lanes with biographic, biometric, and watch list 

data. The demonstrations showed that RFID technology was too immature 

to meet the requirements of a land exit solution. 

Currently, US-VISIT development and deployment efforts consist of two 

ongoing projects: (1) Unique Identity and (2) Comprehensive Exit. 

• Unique Identity is to establish a single identity for all individuals 

encountered across the immigration and border mission area. This project 

consists of developing and deploying three capabilities. First, 10-print 

identification is to provide the means for capturing 10 fingerprints and 

enables the other two Unique Identity components, and increases the 

fingerprint matching accuracy in IDENT. DHS plans to complete 10-print 

deployment to all POEs in the fall of 2009. Second, enumeration is to 

associate the biometric and biographical data within IDENT and FBI’s 

fingerprint identification system with individuals encountered by 

immigration and border management entities. DHS reports that 

enumeration is being used by DHS’s U.S. Citizenship and Immigration 

Services. Third, IDENT interoperability with FBI’s fingerprint 

 

18Radio frequency technology relies on proximity cards and card readers. Radio frequency 

devices read the information contained on the card when the card is passed near the 

device. The information can contain personal identification of the cardholder. 

Page 9 GAO-10-13 Homeland Security
 

identification system is to enable DHS and FBI to share biometric and 

related biographic, criminal history, and immigration history data. DHS 

reports the development of this interoperability is in the second of three 

phases, each of which expands the types and amount of data shared 

between DHS and FBI, and that planning has begun for the third phase. In 

2007, DHS estimated that Unique Identity would cost the department 

about $5.7 billion to acquire, and about $40.1 billion to operate and 

maintain through the year 2020. 

• Comprehensive Exit was chartered in August 2007 to develop and deploy 

air and sea exit capability and to plan for a land exit solution. Project 

stakeholders include U.S. Immigration and Customs Enforcement, the 

Office of Screening Coordination and Operations, CBP, air and sea 

carriers, port authorities, TSA, and the U.S. Coast Guard. 

In April 2008, DHS issued a Notice of Proposed Rule Making19 to announce 

the intent to implement biometric exit verification at air and sea POEs. 

Under this notice, commercial air and sea carriers would be responsible 

for developing and deploying the capability to collect the biometrics from 

departing travelers and transmit them to DHS. According to program 

planning documents, US-VISIT originally planned to publish a final rule in 

June 2008 and for an initial capability to be deployed by December 2008. 

However, a final rule has yet to be published and, according to US-VISIT 

program officials, an official date for doing so has not been established. 

Subsequent to the rule making notice, the Consolidated Security, Disaster 

Assistance, and Continuing Appropriations Act, 200920 mandated that no 

US-VISIT fiscal year 2009 appropriations be used for the implementation of 

an air exit solution pursuant to the rule making notice until DHS reported 

to the Senate and House Committees on Appropriations on pilot tests that 

had been conducted for at least two scenarios: (1) airline collection and 

transmission of biometric exit data, as proposed in the rule making notice 

and (2) CBP collection of such information at the departure gate. 

Through fiscal year 2009, DHS had been appropriated about $2.5 billion for 

US-VISIT. As of July 2009, the program reported that about $186 million of 

that amount had been obligated to develop air/sea and land exit solutions 

 

1973 Fed. Reg. 22065 (Apr. 24, 2008). 

20Consolidated Security, Disaster Assistance, and Continuing Appropriations Act, 2009, 

Pub. L. No. 110-329, 122 Stat. 3574, 3668-70 (Sept. 30, 2008). 

Page 10 GAO-10-13 Homeland Security
 

since 2002.21 The department requested about $356 million for US-VISIT in 

fiscal year 2010 and was appropriated about $374 million. 

Prior GAO Reviews of USVISIT Exit Have Raised 

Challenges and Issues 

Since 2004, we have identified a range of management challenges and 

issues associated with DHS efforts to develop and deploy an exit solution. 

For example, we reported in May 200422 that a limited exit portion of USVISIT had deployed to only two POEs. In February 2005, 23 we reported 

that the ongoing air and sea exit pilot faced a compressed timeline, had 

missed milestones, and potentially was to be reduced in scope and that the 

changing facts and circumstances surrounding the exit pilot had 

introduced additional risk. In December 2006,24 we reported that DHS 

could not implement a biometric exit capability without incurring a major 

impact on land POE facilities. In February and August 2007,25 we found 

that DHS had not adequately defined and justified its proposed 

expenditures for exit pilots and demonstration projects and that it had not 

developed a complete schedule for biometric exit implementation. 

In February 2008,26 we reported that the Comprehensive Exit project had 

not been adequately defined, citing its lack of appropriate analysis to 

support established high-level project milestones. Accordingly, we 

recommended that DHS develop a plan for delivering a comprehensive 

exit capability that included, among other things, key milestones and 

 

21We did not independently verify the accuracy of this information. 

22GAO, Homeland Security: First Phase of Visitor and Immigration Status Program 

Operating, but Improvements Needed, GAO-04-586 (Washington, D.C.: May 11, 2004). 

23GAO, Homeland Security: Some Progress Made, but Many Challenges Remain on U.S. 

Visitor and Immigrant Status Indicator Technology Program, GAO-05-202 (Washington, 

D.C.: Feb. 23, 2005). 

24GAO, Border Security: US-VISIT Program Faces Strategic, Operational, and 

Technological Challenges at Land Ports of Entry, GAO-07-248 (Washington, D.C.: Dec. 6, 

2006). 

25GAO, Homeland Security: Planned Expenditures for U.S. Visitor and Immigrant Status 

Program Need to Be Adequately Defined and Justified, GAO-07-278 (Washington, D.C.: 

Feb. 14, 2007) and Homeland Security: U.S. Visitor and Immigrant Status Program’s 

Long-standing Lack of Strategic Direction and Management Controls Needs to Be 

Addressed, GAO-07-1065 (Washington, D.C.: Aug. 31, 2007). 

26GAO-08-361. 

Page 11 GAO-10-13 Homeland Security
 

performance measures. In September 2008,27 we further reported that DHS 

was unlikely to meet its timeline for implementing an air exit system with 

biometric indicators, such as fingerprints, by July 1, 2009, due to several 

unresolved issues, such as opposition to the department’s published plan 

by the airline industry. Most recently, in December 2008,28 we reported 

that DHS still had not developed a schedule for the full implementation o

a comprehensive exit solution. In each of these reports, we made

recommendations to ensure that US-VISIT exit was planned, designed, 

developed, and implemented in an effective and efficient manner. DHS 

generally agreed with our recommendations. 

f 

 

US-VISIT Projects 

Governed by Life Cycle 

Development Methodology 

The US-VISIT Enterprise Life Cycle Methodology (ELCM) is a framework 

for planning, managing, and implementing capabilities program-wide that 

applies to all US-VISIT program increments, task orders, mission 

capability enhancements, projects, components, acquisitions, and all 

agreements with partner/stakeholder and contractor organizations. Among 

other things, the ELCM provides guidance for managing related US-VISIT 

projects that have distinct cost, schedule, scope, and risk components, and 

that may be at different project phases at a given time. 

The ELCM consists of several process areas, such as program 

management, project execution, and operations and maintenance. The 

project execution process area includes seven subprocesses, or phases. 

The subprocesses are 

• plan, which focuses on project-level planning for individual initiatives and 

builds on the strategic planning that occurs in the program planning 

process area; 

• analyze, which includes the gathering, identification, refinement, analysis, 

and management of requirements; 

• design, which includes designing the applications, technical architecture, 

technical infrastructure, and application training; 

27GAO, Visa Waiver Program: Actions Are Needed to Improve Management of the 

Expansion Process, and to Assess and Mitigate Program Risks, GAO-08-967 (Washington, 

D.C.: Sept. 15, 2008). 

28GAO, Homeland Security: U.S. Visitor and Immigrant Status Indicator Technology 

Program Planning and Execution Improvements Needed, GAO-09-96 (Washington, D.C.: 

Dec. 12, 2008). 

Page 12 GAO-10-13 Homeland Security
 

• build, which includes the development of the application, technical 

architecture, and technical infrastructure; 

• test, which includes testing the components built and validating the 

solution with users; 

• deploy, which includes rolling out the application, technical architecture, 

technical infrastructure, and training to the organization; and 

• transition, which includes ensuring that all identified transition tasks are 

carried out and any open issues from deployment are documented and 

addressed. 

The operations and maintenance process provides for ongoing support of 

a deployed system solution. A typical project will be planned, developed, 

and deployed during project execution and sustained as part of operations 

and maintenance. 

Within each subprocess, the ELCM specifies certain activities that are to 

be performed. For example, the test subprocess defines a series of nine 

tests that are to be conducted, including user acceptance testing, which 

verifies that the system meets user requirements, and operational 

readiness testing, which ensures the operational environment’s readiness 

to accept the new system. 

Comprehensive Exit was initiated to develop and implement a means to 

capture biometric information from travelers who are subject to US-VISIT 

as they exit the United States, and to do so in a way that integrates 

biometrics collection into existing exit procedures at air, sea, and land 

POEs and enables the matching of biometric exit and entry records to 

determine which travelers have left the country. According to DHS, this 

capability will allow the department to confirm the identity of a person 

leaving the country, and thereby (1) maximize investigative resources by 

preventing searches for travelers who have already left the country; and 

(2) identify overstays by country and by visa category, to better inform 

policy decision makers. 

Comprehensive Exit 

Project Consists of 

Six Components That 

Are in Various Phases 

of Delivery 

DHS is pursuing the Comprehensive Exit project through six component 

efforts, each of which addresses either the air/sea or land environments: 

Page 13 GAO-10-13 Homeland Security
 

• The air/sea environment is being addressed through Air/Sea Biometric Exit 

Release 1, Reporting Phase 1, the Air Exit Pilots, and Long-term Air/Sea 

Exit. 

• The land environment is being addressed through the Temporary Worker 

Visa Exit Pilot and Long-term Land Exit. 

The two long-term components for Air/Sea and Land have yet to begin. 

They are to be informed or supported by the four other components. 

According to program officials, planning for the two long-term 

components is contingent upon departmental decisions that have not yet 

been made. 

DHS is employing the ELCM to manage each component. The status of 

each exit component relative to the ELCM project execution subprocesses 

is summarized in figure 3 and discussed in more detail after the figure. 

Figure 3: Comprehensive Exit Components and Status 

Note: Because the Air Exit Pilots were decommissioned upon completion, they were not transitioned 

beyond the project execution process. 

Complete

In progress

Not yet started

Sources: GAO analysis of DHS data and information from program officials. 

Air/Sea Biometric 

Release 1

Reporting Phase 1

Air Exit Pilots

Long-term Air/Sea

Temporary Worker 

Visa Exit Pilot

Long-term Land

Project execution life cycle phases

Component Plan Analyze Design Build Test Deploy Transition

N/A

Page 14 GAO-10-13 Homeland Security
 

The purpose of Air/Sea Biometric Exit Release 1 is to modify IDENT to 

collect, validate, and store the biometric and biographic data for travelers 

who are subject to US-VISIT and exiting the United States via the air or sea 

environments. For example, this component allows for the biographic and 

biometric information provided by a departing passenger to be matched 

against a watch list and, if a hit is found, the passenger’s IDENT record is 

annotated to make the information available for any future encounters 

between that individual and other agencies, such as CBP, U.S. Immigration 

and Customs Enforcement, or local law enforcement. According to 

program officials, Release 1 was initiated to support the Long-term Air/Sea 

Exit solution, but it will also allow IDENT to process land POE exit-related 

data. 

Air/Sea Biometric Exit 

Release 1 

Testing for this component is in progress, and its completion depends 

upon the completion of another component. Requirement validation 

testing of Release 1 was completed in October 2008, with all planned test 

cases executed. According to program officials, final testing of the release 

will not occur until data from the Long-term Air/Sea Exit solution are 

available. 

Reporting Phase 1 The purpose of Reporting Phase 1 is to enhance IDENT’s reporting 

capabilities in order to support the information needs of a wide range of 

US-VISIT users, including the analysis and evaluation of the Air Exit Pilot 

results.29 Additional phases are envisioned to deliver other US-VISIT 

reporting capabilities, such as text-based reporting, charts and graphs, 

spreadsheet downloading to authorized users’ workstations, on-demand 

reporting, and near real-time reporting. However, these additional phases 

have yet to be defined. 

Final testing of Phase 1 was completed in April 2009, with all planned 

requirements and test cases executed and five problems of low and 

medium severity detected. All five were addressed during final testing. 

Phase 1 was deployed in April 2009 and has transitioned to the operations 

and maintenance process area. 

 

29Exit-related reporting capabilities were originally managed under the Comprehensive Exit 

project but were later moved to the Unique Identity project. This component is also known 

as US-VISIT Integrated Enterprise Web-based Reporting, which was originally called 

Enterprise Reporting Services. 

Page 15 GAO-10-13 Homeland Security
 

Air Exit Pilots The purpose of the Air Exit Pilots was to evaluate the impact on airport 

exit operations of identifying, verifying, and collecting information from 

passengers who were subject to US-VISIT and leaving the United States. 

More specifically, the pilots are to 

• evaluate identity verification and exit-recording capabilities when used 

with existing POE operations and infrastructure and 

• biometrically and biographically verify the identity, record the exit, and 

update the IDENT and Arrival and Departure Information System records 

of each subject traveler departing the United States at the pilot locations. 

DHS originally announced the purpose and conditions of an air exit 

capability in the Notice of Proposed Rulemaking30 published by DHS in 

April 2008. As noted earlier, the Consolidated Security, Disaster 

Assistance, and Continuing Appropriations Act, 200931 subsequently 

required DHS to pilot the two exit operational scenarios described in the 

notice: airline collection and transmission of biometric exit data and CBP 

collection of such information at the departure gate. DHS decided to pilot 

two government alternatives: passenger screening by CBP officers at the 

departure gate (as required by the act) and passenger screening by TSA 

officials at the TSA security checkpoint. DHS did not pilot the airline 

alternative because the airlines decided not to participate. 

The CBP alternative was piloted at Detroit Metropolitan Wayne County 

Airport and the TSA alternative at Hartsfield-Jackson Atlanta International 

Airport. Pilot testing at both locations was completed in May 2009, using 

biographic and biometric data collected from a sampling of travelers who 

were subject to US-VISIT. Although one system problem was found 

(collected fingerprint images appeared upside down and mirrored), it was 

corrected and all planned requirements and test cases successfully 

executed. The pilots began in May 2009, and they operated until July 2009, 

as planned. The US-VISIT Comprehensive Exit project manager told us 

that the pilots have been decommissioned. According to the Air Exit Pilots 

schedule, the only remaining activity for this component is developing and 

issuing the final rule for the Long-term Air/Sea Exit component. 

 

3073 Fed. Reg. 22065 (Apr. 24, 2008). 

31Pub. L. No. 110-329 (Sept. 30, 2008). 

Page 16 GAO-10-13 Homeland Security
 

The Air Exit Pilots used two types of portable biometric collection 

devices: (1) a hand-held device (“mobile device”) that scanned information 

on travel documents and collected biometrics one fingerprint at a time and 

(2) a small suitcase (“portable device”) that contained a laptop computer, 

document scanning device, and a biometric scanner that collected a fourprint slap. (See fig. 4.) The Detroit pilot used both devices. According to a 

TSA official, only mobile devices were used in Atlanta because of the 

limited space available within the checkpoint area. 

Figure 4: Illustration of Air Exit Pilots Biometric Data Collection and Transmission 

Process 

The pilots consisted of these four steps: 

Source: GAO analysis of agency data. 

Detroit air exit pilot

(CBP officer)

Mobile and portable devices Secure 

computer 

connection

Dedicated workstation

US-VISIT staff

Atlanta air exit pilot

(Transportation Security Officer)

Mobile device Dedicated workstation

US-VISIT staff

IDENT

• Identification. For the CBP pilot, CBP officers prescreened passengers 

after they provided their boarding passes to airline employees to identify 

passengers who were subject to US-VISIT and to then direct them to a 

CBP processing station in the jetway. For the TSA pilot, a TSA Ticket 

Document Checker prescreened every passenger entering the checkpoint 

Page 17 GAO-10-13 Homeland Security
 

to identify subject passengers32 who were escorted to a processing station 

manned by Transportation Security Officers equipped with mobile devices. 

• Collection. Both CBP and TSA officers scanned a machine-readable 

travel document presented by a passenger to collect biographic data. If the 

document did not scan correctly, the officers were instructed to enter the 

biographic data manually into the device. The officers then used the 

mobile or portable device to collect an index and middle fingerprint or a 

four-print image, respectively. 

• Processing. Once the device indicated that the collected prints were of 

sufficient quality, the CBP and TSA officers directed the passenger to 

continue onto the departing aircraft or through the normal checkpoint 

security screening. 

• Transmission. US-VISIT staff uploaded the information from the devices 

to a dedicated workstation and transmitted the data to IDENT via a secure 

network connection. Once transmitted, the data were matched to existing 

records. 

DHS approved a report on the pilot results in October 2009. We are 

statutorily required to review this report.33

Long-term Air/Sea Exit According to program officials, planning for a target solution for air and 

sea POEs will begin once the pilots have been completed and after the 

final rule has been published. According to the US-VISIT Deputy Director, 

an official date for publishing the final rule has not been established. In 

general, program officials said that the final rule is to specify how and 

when an operational air/sea exit solution will be implemented. 

Temporary Worker Visa 

Exit Pilot 

The purpose of the Temporary Worker Visa Exit Pilot is to capture the 

final departure of certain H2 visa temporary workers at two land border 

crossings. The pilot is to use kiosks adapted for outdoor use to record the 

 

32This was accomplished by determining several basic flyer characteristics, including 

whether the passenger was a U.S. citizen and, if not, whether the passenger was flying to a 

foreign destination. 

33Pub. L. No. 110-329, 122 Stat. 3669-3670 (Sept. 30, 2008). 

Page 18 GAO-10-13 Homeland Security
 

exit of H-2A and H-2B visa holders34 who (1) previously entered and are 

now departing the United States through either San Luis, Arizona, or 

Douglas, Arizona, and (2) are required to record their final departure with 

CBP. In December 2008, DHS issued two Federal Register notices 

announcing the implementation of the pilot,35 one addressing H-2A visa 

holders and one addressing H-2B visa holders. According to the notices, 

the pilot was to be deployed in August 2009. However, according to the 

US-VISIT Comprehensive Exit Project Manager, the pilot was suspended 

during the testing subprocess due to lack of CBP funding. The CBP 

Program Manager for Admissibility and Passenger Programs told us that 

the pilot is now scheduled for deployment in December 2009. 

Both the US-VISIT program office and CBP are involved in the pilot. The 

program office is responsible for project management and kiosk design, 

development, and operations and maintenance. CBP is to support the 

development and deployment of the kiosks, and is to operate the pilot. As 

with the Air Exit Pilots, exit information collected from departing travelers 

is to be transmitted to IDENT, where it is to be matched against existing 

records. Assembly testing was completed in May 2009, with all planned 

requirements and test cases executed. 

The pilot was originally planned to run for 1 year, after which its 

effectiveness and feasibility as a potential part of Comprehensive Exit was 

to be analyzed. However, according to the CBP Program Manager for 

Admissibility and Passenger Programs, CBP intends to assess the pilot 

after 6 months of deployment to determine whether to continue it. 

According to US-VISIT and CBP officials, the pilot results will help inform 

future decisions on the pedestrian component of the Long-term Land Exit 

component. 

Long-term Land Exit According to the US-VISIT Program Director and program documentation, 

a land exit strategy for recording biometric exit at land POEs was 

completed in November 2008 as planned, and is currently being reviewed 

by DHS leadership. The Program Director further told us that until the 

strategy is approved, no other Land Exit activities will be initiated. As a 

 

34H-2A visas are issued to temporary agricultural workers and H-2B visas are issued to 

temporary nonagricultural workers. 

3573 Fed. Reg. 77049 (Dec. 18, 2008) and 73 Fed. Reg. 77817 (Dec. 19, 2008). 

Page 19 GAO-10-13 Homeland Security
 

result, this component has yet to begin the first ELCM project execution 

subprocess. 

Given that the Comprehensive Exit project is part of the larger US-VISIT 

program and consists of multiple components involving several DHS 

component organizations, it is important for the project to be planned and 

executed in an integrated fashion. To this end, the US-VISIT program 

office has established integrated project management plans, and has 

adopted an integrated approach to interacting with and involving project 

stakeholders, both of which are important ingredients to project success. 

However, US-VISIT has not developed and employed an integrated 

approach to scheduling, executing, and tracking the work that needs to be 

accomplished to deliver the Comprehensive Exit solution. Rather, it is 

relying on several separate and distinct schedules to manage individual 

aspects of the project. Moreover, not all of these individual schedules are 

reliable because they have not been derived in accordance with relevant 

schedule estimating guidance. Without a Comprehensive Exit integrated 

master schedule that is derived in accordance with relevant guidance, the 

program office cannot reliably commit to when and how the work needed 

to deliver the Comprehensive Exit solution will be performed, and it 

cannot adequately manage and measure its progress in executing the work 

needed to deliver it. 

DHS Approach to 

Managing 

Comprehensive Exit 

Project Is Not Fully 

Integrated 

Comprehensive Exit 

Project Management Plans 

Are Integrated 

According to relevant guidance,36 a key to project success is a well-defined 

project management plan that provides a complete and integrated view of 

how the project is being managed. Among other things, the project 

management plan should (1) define or reference key project management 

processes, (2) be integrated with other plans that affect project 

management, and (3) reflect the current and complete scope of the 

project. 

The US-VISIT program has developed a plan for managing Comprehensive 

Exit that is largely well defined. Specifically, the project management plan 

calls for tailoring the ELCM framework, which defines a standard set of 

project management processes. Further, the program office has applied 

this tailored approach to individual Comprehensive Exit components (e.g, 

 

36Carnegie Mellon University Software Engineering Institute, CMMI for Acquisition, 

version 1.2 (November 2007). 

Page 20 GAO-10-13 Homeland Security
 

Release 1, Reporting Phase 1, and Air Exit Pilots). In addition, the project 

management plan is aligned with relevant US-VISIT program plans and 

procedures, as well as individual Comprehensive Exit component plans. 

For example, it incorporates by reference a number of key management 

processes defined in the US-VISIT program-level management plan, such 

as risk management, configuration management, requirements 

management, and schedule management. Also, it is referenced in, and 

aligned with, the component management plan for the Air Exit Pilots. 

Further, the project management plan has recently been revised, as called 

for in the plan, to define a more current and complete scope of the project, 

and to incorporate actual and planned project changes.37

By having a Comprehensive Exit management plan that reflects an 

integrated approach to project management, the US-VISIT program office 

has established an important means for managing project activities in a 

standard and consistent manner. 

DHS Stakeholders Have 

Been Integrated into 

Comprehensive Exit Pilots 

Relevant system acquisition guidance recognizes that collaboration among 

relevant stakeholders is an important part of an integrated project 

management approach.38 We have reported that such collaboration can 

produce better results and outcomes than could be achieved when 

stakeholders do not act in an integrated and coordinated manner.39 In this 

regard, our research shows that effective collaborative activities involve 

the following practices. 

• Establishing common outcomes: defining and articulating a shared or 

common outcome(s) or purpose(s) that organizations or programs are 

mutually seeking to achieve and that are consistent with their respective 

goals and missions. 

• Establishing mutually reinforcing or joint strategies: creating 

strategies that work in concert with those of partner organizations or 

programs, or that are joint in nature. 

 

37The revision is dated May 2009 and, according to the Comprehensive Exit Project 

Manager, it will not be completed until a decision on Air Exit has been reached. This 

revision does not yet include the Temporary Worker Visa Exit Pilot. 

38CMMI for Acquisition. 

39GAO, Results-Oriented Government: Practices That Can Help Enhance and Sustain 

Collaboration among Federal Agencies, GAO-06-15 (Washington, D.C.: Oct. 21, 2005). 

Page 21 GAO-10-13 Homeland Security
 

• Leveraging resources: identifying the human, technological, physical, 

and financial resources needed to initiate or sustain the collaborative 

effort. 

• Agreeing on roles and responsibilities: working together to define and 

agree on partners’ respective roles and responsibilities, including how the 

collaboration efforts will be led. 

• Establishing a compatible means to operate across organizational 

boundaries: creating compatible standards, policies, procedures, and data 

systems that will be used in the collaborative effort. 

• Developing mechanisms to monitor, evaluate, and report on 

results: putting in place the means to monitor, evaluate, and report on the 

collaborative effort to identify areas for improvement. 

As previously discussed, the Comprehensive Exit project’s pilot 

components involve multiple stakeholders, including the US-VISIT 

program office, CBP, and TSA. To their credit, these stakeholders have 

collaborated in a manner that is consistent with these practices. As a 

result, they have established the means to align their activities, processes, 

and resources to accomplish the objectives of the Comprehensive Exit 

project pilots. 

Within DHS, the US-VISIT program office, along with CBP and TSA, share 

a common mission to secure our nation’s borders. Consistent with this 

shared mission, these organizations have defined a common purpose for 

both the Air Exit Pilots and the Temporary Worker Visa Exit Pilot. 

Specifically, the shared purpose of the Air Exit Pilots was to evaluate the 

operational impact of collecting biometric exit data from travelers near the 

departure gate and at the TSA security checkpoint, and thereby help 

inform the implementation of the Air Exit solution. The shared purpose of 

the Temporary Worker Visa Exit Pilot is to ensure that temporary guest 

workers depart the United States at the completion of their work 

authorizations and to analyze the effectiveness and feasibility of one part 

of the overall Land Exit solution. 

Establishing Common 

Outcomes 

The US-VISIT program office, CBP, and TSA have established joint 

management strategies for executing the Air Exit Pilots and the 

Temporary Worker Visa Exit Pilot. Specifically, an Integrated Project 

Team, which is led by the program office and includes representatives 

from CBP and TSA, was assigned responsibility for planning, execution, 

and control of both pilots. In addition, the program office developed an Air 

Establishing Mutually 

Reinforcing or Joint Strategies 

Page 22 GAO-10-13 Homeland Security
 

Exit Pilots Management Plan that defines the project management 

approach for implementing the Air Exit Pilots. While the program office 

did not establish a comparable management plan for the Temporary 

Worker Visa Exit Pilot, it developed a business concept of operations that 

documents the proposed business process and operational changes 

needed to implement the Temporary Worker Visa Exit Pilot. Both 

documents were reviewed by relevant stakeholders. 

As previously noted, an Integrated Project Team was assigned 

responsibility for planning, execution, and control of both pilots. This 

team has leveraged human, technological, physical, and financial 

resources provided by the program office, CBP, and TSA. Specifically, key 

personnel from each organization are members of the Integrated Project 

Team, and are involved in supporting the execution of the pilots. For 

example, CBP and TSA provided or plan to provide personnel for 

collecting biometrics during the pilots, and the program office provided or 

plans to provide on-site technical support during the pilots. In addition, the 

program office and CBP have funded their respective efforts, while an 

interagency agreement has been executed for the program office to fund 

TSA personnel needed for pilot operations. Also, the program office 

provided or plans to provide the technology (e.g., mobile and portable 

devices and kiosks for collecting biometrics and the IDENT system to 

process and store the biometric data received). Further, CBP and TSA 

leveraged their physical presence at the Detroit Metropolitan Wayne 

County Airport and the Hartsfield-Jackson Atlanta International Airport. 

Also, CBP is leveraging and augmenting its physical infrastructure at the 

San Luis and Douglas POEs in Arizona. For example, it is ensuring that 

proper network connectivity exists from the kiosks to IDENT and that 

needed electrical and facility modifications are made at the sites. 

Leveraging Resources 

The program office, CBP, and TSA have defined and agreed on roles and 

responsibilities for the Air Exit Pilots and the Temporary Worker Visa Exit 

Pilot. Specifically, the Air Exit Pilots Management Plan and business 

concept of operations documents define roles and responsibilities for the 

program office, CBP, and TSA, and these documents were reviewed or 

approved by all relevant parties. For example, the Air Exit Pilots Business 

Concept of Operations states that the program office is to evaluate and 

determine which biometric data collection devices will be used and 

provide these devices, as well as the necessary training, to CBP and TSA, 

while CBP and TSA are to collect the biometric exit data from travelers 

who were subject to US-VISIT during the pilot. Also, the Air Exit Pilots 

Management Plan identifies individual roles and responsibilities for key 

program personnel providing direct support to the project. Further, the 

Agreeing on Roles and 

Responsibilities 

Page 23 GAO-10-13 Homeland Security
 

Temporary Worker Visa Exit Pilot business concept of operations states 

that the program office is to serve as the overall project manager and 

acquire the kiosks, while CBP is to serve as the operational manager and 

perform the day-to-day maintenance and operation of the kiosks once they 

have been deployed to the sites. It also defines more detailed roles and 

responsibilities for specific groups within the program office and CBP, 

such as US-VISIT Project Management, US-VISIT Information Technology 

Management, CBP Office of Field Operations, and CBP Office of 

Information Technology. 

As the overall project management lead for both pilots, the program office 

established an Integrated Project Team that includes CBP and TSA and 

has aligned the pilots with the ELCM and other project management 

procedures to ensure they are managed consistently. For example, CBP 

and the program office were both involved in developing requirements for 

the Temporary Worker Visa Exit Pilot. As another example, when CBP 

officials identified a lack of CBP funding for the Temporary Worker Visa 

Exit Pilot, they reported this to the program office as a risk. The risk was 

subsequently tracked through the risk management process. As another 

example, CBP required a change in the kiosk solution for the Temporary 

Worker Visa Exit Pilot to allow it to withstand outdoor use, and submitted 

a change request through the established change management process to 

“ruggedize” the kiosks. 

Establishing a Compatible 

Means to Operate Across 

Organizational Boundaries 

The Comprehensive Exit project management approach includes 

mechanisms for monitoring, evaluating, and reporting on the results of 

project efforts. For example, the project management plan discusses 

quality assurance activities, such as peer review of project artifacts and 

deliverables, and testing and evaluation of hardware and software. As 

another example, the project management plan identifies status reporting 

requirements, such as quarterly program management reviews, which 

provide an overview of the project’s status, budget, resource levels, and 

any outstanding issues. In addition, the program office has applied pilotspecific mechanisms for monitoring, evaluating, and reporting on results. 

For example, the Air Exit Pilots Management Plan describes a five-step 

process improvement model for identifying, implementing, and evaluating 

solutions to problems during the execution of the pilots. Also, this plan 

establishes a stakeholder communication matrix, which documents the 

activities and reports for intra/inter-agency communication throughout 

different phases of the pilot (e.g., ongoing, predeployment, deployment, 

pilot operations, and disposition and analysis). Further, the program office 

defined performance metrics for the evaluation of the Air Exit Pilots, and 

it involved CBP and TSA in doing so. 

Developing Mechanisms to 

Monitor, Evaluate, and Report 

on Results 

Page 24 GAO-10-13 Homeland Security
 

The success of a project depends in part on having an integrated and 

reliable master schedule that defines, among other things, when work 

activities will occur, how long they will take, and how they are related to 

one another. As such, the project schedule not only provides a road map 

for systematic project execution, but also provides the means by which to 

gauge progress, identify and address potential problems, and promote 

accountability. In addition, US-VISIT’s program and project management 

guidance and plans recognize that schedule management plays a critical 

role in the success of its activities. For example, the program management 

plan requires a tiered and integrated master schedule that includes 

contractor schedules for each task order and a project level schedule. 

Further, US-VISIT’s program guidance states that the integrated master 

schedule provides a means to ensure attainability of program objectives 

and evaluate the project’s progress in doing so. 

Comprehensive Exit 

Schedules Are Not 

Integrated and Reliable 

Program officials told us they do not have an integrated master schedule 

for the Comprehensive Exit project. Instead, each ongoing project 

component40 has its own separate schedule. In addition, the US-VISIT 

prime contractor has its own schedule to support the project components, 

although program officials said that the work in this schedule is manually 

incorporated into each component schedule. However, our analysis of the 

schedules for ongoing Comprehensive Exit components, as well as the 

contractor’s schedule, did not show any evidence of this, and the program 

office provided no other documentation to demonstrate that the manual 

incorporation exists. According to program officials, DHS cannot develop 

a complete schedule for the Comprehensive Exit project until decisions 

have been made on the direction and scope of the Air/Sea and Land exit 

solutions. However, relevant guidance41 states that a comprehensive 

schedule should reflect all activities for a project and recognizes that there 

can be uncertainties and unknown factors in schedule estimates due to, 

among other things, limited data. In light of such uncertainties and 

unknowns, the guidance discusses the need to perform a schedule risk 

analysis to determine the level of uncertainty and to help identify and 

mitigate the risks. 

 

40At the time of our review, the Air Exit Pilots were ongoing. As discussed earlier in this 

report, the pilots have since been completed. 

41GAO, Cost Estimating and Assessment Guide, GAO-09-3SP (Washington, D.C.: March 

2009). 

Page 25 GAO-10-13 Homeland Security
 

As a result, DHS does not have a comprehensive project view of the work 

that must be, among other things, sequenced, timed, resourced, and riskadjusted to deliver the Comprehensive Exit solution. Without such a view, 

a sound basis does not exist for knowing with any degree of confidence 

when and how the project will be completed. 

The lack of an integrated master schedule is compounded by the fact that 

the individual component schedules are not reliable. Our research has 

identified nine practices associated with developing and maintaining a 

reliable schedule.42 These practices are (1) capturing all activities, 

(2) sequencing all activities, (3) assigning resources to all activities, 

(4) establishing the duration of all activities, (5) integrating schedule 

activities horizontally and vertically, (6) establishing the critical path for 

all activities, (7) identifying float43 between activities, (8) conducting a 

schedule risk analysis, and (9) updating the schedule using logic and 

durations to determine the dates. In addition, the project management 

plan states that a project schedule should reflect the work breakdown 

structure for the project as well as ELCM required artifacts. The plan also 

requires that the project schedule be horizontally and vertically integrated, 

that all scheduled milestones and tasks be linked logically, and that 

schedule status be captured on a regular basis. 

Both the Air Exit Pilots schedule and the Temporary Worker Visa Exit 

Pilot schedule only fully meet one of the nine key schedule estimating 

practices, and either partially, minimally, or do not meet the remaining 

eight. In contrast, the prime contractor’s schedule is largely reliable, as it 

fully or substantially meets all nine practices. To be considered reliable, 

relevant guidance states that a schedule needs to fully meet all nine 

practices. The extent to which the two component schedules and 

contractor’s schedule meet the nine practices are summarized below and 

in table 1. A detailed discussion of the extent to which each schedule 

meets the nine practices is in appendix II. 

• Component schedules: Both the Air Exit Pilots and Temporary Worker 

Visa Exit Pilot schedules establish the duration of time planned for 

executing key activities, and they detail work activities that are integrated 

 

42GAO-09-3SP. 

43Float is the amount of time an activity can slip before affecting the critical path. The 

critical path is the longest path through the schedule. If an activity on the critical path slips, 

the entire project will be delayed. 

Page 26 GAO-10-13 Homeland Security
 

with higher-level milestones and summary activities. However, neither 

schedule reflects a valid critical path due to a high number of missing 

dependencies and rigid schedule constraints. For example, the schedule 

contains 16 remaining activities that identify dates when the activities 

must begin. These are rigid schedule constraints and such dates remain 

fixed regardless of the allocation of resources or predecessor activities 

finishing on time, earlier, or later. This is important because the critical 

path represents the longest chain of activities through the network and 

determines the length of the project. Thus, delays in an activity that is on 

the critical path would cause the entire component effort to slip. Without a 

valid critical path, the program office cannot accurately determine the 

amount of time required to complete the project component and assess 

how delays impact the projected completion date. According to program 

officials, they manage each exit component to a critical path that is 

calculated by the scheduling software on a weekly basis. However, as 

noted above, the critical paths are not valid due to missing dependencies 

and rigid schedule constraints. 

In addition, neither schedule is based on a schedule risk analysis. A 

schedule risk analysis is important because it allows high-priority risks to 

be identified and mitigated, and the level of confidence in meeting 

projected completion dates to be predicted. Also, officials stated they do 

not perform regular, electronic checks on the schedules to know the true 

status of the components and thus ensure the integrity of the schedules’ 

logic. Furthermore, neither schedule assigns resources to activities, which 

limits insight into current or projected resource allocation issues. Without 

assigning resources, the risk of the projected completion date slipping is 

increased. 

• Contractor schedule: The prime contractor’s schedule reflects a number 

of best practices. For example, this schedule can be traced to the 

contractor’s work breakdown structure, activities have appropriate logical 

sequencing, and resources are assigned to activities. In addition, 

contractor representatives stated they have performed a risk assessment 

of the schedule and regularly update the status and perform tests to ensure 

the integrity of schedule logic. However, the schedule does not reflect a 

valid critical path because it contains two separate critical paths that are 

not linked. By definition, the critical path must run from the first event to 

the last event without a break in continuity. As stated previously, without 

a valid critical path, the contractor cannot accurately determine the 

amount of time required to complete scheduled work. 

Page 27 GAO-10-13 Homeland Security
 

Table 1: Component and Contractor Schedules Satisfaction of GAO Schedule Estimating Best Practices 

Practice Air Exit Pilots 

Temporary Worker 

Visa Exit Pilot 

Contractor 

schedule 

Capturing all activities Partially Partially Met 

Sequencing all activities Partially Minimally Met 

Assigning resources to all activities Minimally Minimally Met 

Establishing the duration of all activities Met Met Met 

Integrating schedule activities horizontally and vertically Partially Partially Substantially 

Establishing the critical path for all activities Minimally Minimally Substantially 

Identifying float between activities Minimally Minimally Met 

Conducting a schedule risk analysis Not Met Not Met Met 

Updating the schedule using logic and durations to determine the dates Partially Partially Met 

Source: GAO analysis of US-VISIT data. 

Notes: “Met” means the program provided complete evidence that satisfies the entire criterion. 

“Substantially” means the program provided evidence that satisfies a large portion of the criterion. 

“Partially” means the program provided evidence that satisfies about half of the criterion. “Minimally” 

means the program provided evidence that satisfies a small portion of the criterion. “Not met” means 

the program provided no evidence that satisfies any of the criterion. 

Without a fully integrated and reliably derived schedule for the entire 

Comprehensive Exit project, the program office cannot identify when and 

how a full exit capability will be delivered, and it cannot adequately manage 

and measure its progress in executing the work needed to deliver it. 

To DHS’s credit, it has completed or has under way five of six components 

that fall under the auspices of its US-VISIT Comprehensive Exit project, 

the status of which range from preplanning to transitioning to operations 

and maintenance, and it is managing some aspects of these various project 

components in an integrated manner. For example, each component is 

being governed by a defined and standardized US-VISIT project execution 

methodology, and each component is subject to the management 

processes, such as processes managing project risks. Further, those 

components that involve multiple organizational stakeholders are being 

executed to ensure that stakeholders interact in an integrated and 

coordinated manner. 

Conclusions 

Page 28 GAO-10-13 Homeland Security
 

Nevertheless, if and when Comprehensive Exit will be operational remains 

unclear, in part because DHS still does not have an integrated master 

schedule defining the timing and sequencing of the work and events 

needed to deliver US-VISIT exit capabilities to its air, sea, and land ports of 

entry. Instead, it has separate schedules for managing individual 

components, as well as the prime contractor’s schedule that supports all 

the components, that do not collectively provide a road map for delivering 

a comprehensive exit solution, including things such as the sequencing 

and timing of the work needed to produce the solution, a realistic target 

date for doing so, and the resources associated with executing the work. 

Moreover, even the individual schedules governing the execution of what 

DHS described as unrelated components are not sufficiently reliable as 

standalone schedules. For the Comprehensive Exit project to be managed 

in a fully integrated manner, it is important for DHS to develop and 

implement an integrated master schedule. If it does not, it will not be able 

to commit to when and how the exit side of US-VISIT will become 

operational, and it will not have a key aspect of the means by which to get 

there and to measure its progress in doing so. 

To better ensure the successful delivery of a comprehensive US-VISIT exit 

solution, we are augmenting our prior recommendations aimed at 

strengthening Comprehensive Exit project planning. Specifically, we 

recommend that the Secretary of Homeland Security direct the 

Undersecretary for National Protection and Programs to have the USVISIT Program Director develop and maintain an integrated master 

schedule for the Comprehensive Exit project in accordance with the nine 

practices discussed in this report. 

Recommendation for 

Executive Action 

In written comments on a draft of this report, signed by the Director, 

Departmental GAO/Office of the Inspector General Liaison Office and 

reprinted in appendix III, the department stated that it concurred with our 

recommendation. 

Agency Comments 

and Our Evaluation 

DHS also provided technical comments, which we have incorporated into 

this report as appropriate. 

We will send copies of this report to the Chairman and Ranking Member of 

the Senate Committee on Homeland Security and Governmental Affairs, 

the Chairmen and Ranking Members of the Senate and House 

Appropriations Committees, and other Senate and House committees and 

Page 29 GAO-10-13 Homeland Security
 

subcommittees that have authorization and oversight responsibilities for 

homeland security. We will also send copies to the Secretary of Homeland 

Security and the Director of the Office of Management and Budget. In 

addition, this report will be available at no charge on the GAO Web site at 

www.gao.gov. 

Should you or your offices have any questions on matters discussed in this 

report, please contact me at (202) 512-3439 or at hiter@gao.gov. Contact 

points for our Offices of Congressional Relations and Public Affairs may 

be found on the last page of this report. Key contributors to this report are 

Randolph C. Hite 

listed in appendix IV. 

Director, Information Technology Architecture 

 and Systems Issues 

Page 30 GAO-10-13 Homeland Security
Appendix I: Objectives, Scope, and 

Methodology 

Page 31 GAO-10-13 

Appendix I: Objectives, Scope, and 

Methodology 

Our objectives were to determine (1) the status of the Department of 

Homeland Security’s (DHS) efforts to deliver a comprehensive exit 

solution for the United States Visitor and Immigrant Status Indicator 

Technology (US-VISIT) program and (2) the extent to which DHS is 

applying an integrated approach to managing its comprehensive exit 

solution. 

To determine the status of efforts to deliver a comprehensive exit solution, 

we first identified the component efforts which constitute the 

Comprehensive Exit project, and then we identified the status of each 

relative to the phases in the US-VISIT Enterprise Life Cycle Methodology 

(ELCM). We reviewed key program documentation, such as the US-VISIT 

Comprehensive Exit Project Plan and Comprehensive Exit project 

documentation (e.g., concepts of operation, design documents, project 

schedules, requirements documentation, and test plans). In doing so, we 

focused on determining such key factors as what project activities were 

planned, when and how they were to be accomplished, and whether 

activities were completed as planned. We also interviewed officials from 

the US-VISIT program office, U.S. Customs and Border Protection (CBP), 

and the Transportation Security Administration (TSA) to determine how 

the comprehensive exit solution is being designed and implemented, and 

what future plans for the project have been developed. Finally, we visited 

the Detroit Metropolitan Wayne County Airport and the Hartsfield-Jackson 

Atlanta International Airport to observe the operation of the Air Exit Pilots 

and interviewed officials from US-VISIT (both locations), CBP (Detroit), 

and TSA (Atlanta) to obtain details as to how the pilots were operating. 

To determine the extent to which DHS is applying an integrated approach 

to managing the Comprehensive Exit Project, we assessed project 

planning, stakeholder coordination, and schedule estimation efforts 

against relevant best practices. Specifically, 

• To identify the extent to which DHS is applying an integrated approach to 

project planning, we reviewed key project planning documentation, such 

as the US-VISIT Comprehensive Exit Project Plan and Air Exit Pilots 

Management Plan, and compared it with relevant best practices for 

integrated project management.1

 

1

Carnegie Mellon University Software Engineering Institute, CMMI for Acquisition, version 

1.2 (November 2007). 

 Homeland Security 
Appendix I: Objectives, Scope, and 

Methodology 

• To establish the extent to which DHS is applying key stakeholder 

coordination and collaboration practices to the Comprehensive Exit 

project, we reviewed key project planning documentation (e.g., 

Comprehensive Exit Project Plan, Air Exit Pilots Management Plan, 

concepts of operation, and project tailoring plans) and compared it with 

relevant best practices.2

• To determine the extent to which DHS is applying key schedule estimating 

practices to the Exit Project, we reviewed schedule estimates for ongoing 

exit work3

 (Air Exit Pilots schedule, Temporary Worker Visa Exit Pilot 

schedule, contractor schedule) and compared them with relevant best 

practices.4

 In doing so, we categorized our determinations as either met, 

substantially, partially, minimally, and not met.5

 Our determinations were 

also based on interviews with knowledgeable US-VISIT, CBP, and TSA 

officials. 

We conducted this performance audit at the US-VISIT Program Office in 

Arlington, Virginia; CBP headquarters offices in Washington, D.C.; TSA 

headquarters offices in Arlington, Virginia; Detroit Metropolitan Wayne 

County Airport in Detroit, Michigan; and Hartsfield-Jackson Atlanta 

International Airport in Atlanta, Georgia, from January 2009 to November 

2009 in accordance with generally accepted government auditing 

standards. Those standards require that we plan and perform the audit to 

obtain sufficient, appropriate evidence to provide a reasonable basis for 

our findings and conclusions based on our audit objectives. We believe 

that the evidence obtained provides a reasonable basis for our findings 

and conclusions based on our audit objectives. 

 

2

GAO, Results-Oriented Government: Practices That Can Help Enhance and Sustain 

Collaboration among Federal Agencies, GAO-06-15 (Washington, D.C.: Oct. 21, 2005). 

3

At the time of our review, the Air Exit Pilots were ongoing. As discussed earlier in this 

report, the pilots have since been completed. 

4

GAO, GAO Cost Estimating and Assessment Guide, GAO-09-3SP (Washington, D.C.: 

March 2009). 

5

“Met” means the program provided complete evidence that satisfies the entire criterion. 

“Substantially” means the program provided evidence that satisfies a large portion of the 

criterion. “Partially” means the program provided evidence that satisfies about half of the 

criterion. “Minimally” means the program provided evidence that satisfies a small portion 

of the criterion. “Not met” means the program provided no evidence that satisfies any of 

the criterion. 

Page 32 GAO-10-13 Homeland Security
Appendix II: Detailed Results of GAO 

Assessment of Schedules for Ongoing 

Comprehensive Exit Components and Prime 

Contractor Schedule 

Appendix II: Detailed Results of GAO Assessment 

of Schedules for Ongoing Comprehensive Exit 

Components and Prime Contractor Schedule 

Our research has identified nine practices associated with effective 

schedule estimating:1

 (1) capturing all activities, (2) sequencing all 

activities, (3) assigning resources to all activities, (4) establishing the 

duration of all activities, (5) integrating schedule activities horizontally 

and vertically, (6) establishing the critical path for all activities, 

(7) identifying float2

 between activities, (8) conducting a schedule risk 

analysis, and (9) updating the schedule using logic and durations to 

determine the dates. 

For the Comprehensive Exit project, we analyzed schedules representing 

ongoing work, which included the Air Exit Pilots component schedule, the 

Temporary Worker Visa Exit Pilot component schedule, and the prime 

contractor schedule,3

 against the nine best practices. Tables 2, 3, and 4 

provide the detailed results of our analyses of these schedules. 

Table 2: US-VISIT Air Exit Pilots Schedule Compared to Best Practices 

Practice Explanation 

Criterion 

meta

GAO analysis 

Capturing all 

activities 

The schedule should reflect all activities (e.g., 

steps, events, outcomes, etc.) as defined in the 

program’s work breakdown structure (WBS), to 

include activities to be performed by both the 

government and its contractors. 

Partially While officials stated that the schedule is built 

from the bottom up by subject matter experts on 

integrated project teams consisting of both 

government and contractor staff, and that the 

schedule is linked to a statement of work via 

activity identification numbers, the Air Exit Pilots 

schedule contains neither activity identification 

information, nor unique WBS elements that would 

link to an overarching WBS. 

 

1

GAO-09-3SP. 

2

Float is the amount of time an activity can slip before affecting the critical path. 

3

The prime contractor schedule contains activities for the task order covering its support of 

Comprehensive Exit. 

Page 33 GAO-10-13 Homeland Security 
Appendix II: Detailed Results of GAO 

Assessment of Schedules for Ongoing 

Comprehensive Exit Components and Prime 

Contractor Schedule 

Practice Explanation 

Criterion 

meta

GAO analysis 

Sequencing all 

activities 

The schedule should be planned so that it can 

meet program-critical dates. To meet this 

objective, key activities need to be logically 

sequenced in the order that they are to be carried 

out. In particular, activities that must finish prior to 

the start of other activities (i.e., predecessor 

activities) as well as activities that cannot begin 

until other activities are completed (i.e., successor 

activities) should be identified. By doing so, 

interdependencies among activities that 

collectively lead to the accomplishment of events 

or milestones can be established and used as a 

basis for guiding work and measuring progress. 

Partially The Air Exit Pilots schedule does not adequately 

sequence activities due to a high number of 

missing dependencies and the use of “hard” 

constraints. While the schedule contains some 

logically sequenced activities, 26 percent of 

remaining activitiesb

 are missing dependencies 

(i.e., predecessor or successor activities). The 

majority of these activities are missing successor 

activities. If an activity that has no logical 

successor slips, the schedule will not reflect the 

effect on the critical path, float, or scheduled start 

dates of downstream activities. In addition, the 

schedule contains 10 “dangling” activities, which 

are activities that have no link from their finish 

date. These tasks can continue indefinitely 

without disrupting any other activity, including the 

finish milestone date. Further, 10 percent of the 

remaining activities (16 activities) identify dates 

that the activities must start on. These are 

considered “hard” constraints because they are 

inflexible. Such dates remain fixed regardless of 

the allocation of resources or predecessor 

activities finishing on time, earlier, or later. 

Officials told us these constraints reflect 

congressionally mandated dates. However, a 

schedule should serve as a proactive, dynamic 

management tool that reflects the current reality 

of the effort and accurately projects remaining 

duration, rather than a calendar of proposed 

dates. Also, the schedule may be misconstrued 

when reported to higher levels of management if 

senior management is not aware of the number of 

days behind schedule. 

Assigning 

resources to all 

activities 

The schedule should reflect what resources (i.e., 

labor, material, and overhead) are needed to do 

the work, whether all required resources will be 

available when they are needed, and whether any 

funding or time constraints exist. 

Minimally Labor, material costs, other direct charges, and 

resources (such as testing facilities or other 

equipment) are not reflected in the schedule. 

Instead, groups are assigned to activities at the 

organization level (e.g., Information and 

Technology Management). Officials confirmed 

they do not assign resources in their schedules 

beyond the organization level. It is important that 

the program office gain an understanding of 

resources needed to complete the work. This 

information would assist US-VISIT in forecasting 

the likelihood of activities being completed based 

on their projected end dates. The current 

schedule does not allow for insight into current or 

projected overallocation of resources, thus 

significantly increasing the risk of the component 

effort slipping. 

Page 34 GAO-10-13 Homeland Security
Appendix II: Detailed Results of GAO 

Assessment of Schedules for Ongoing 

Comprehensive Exit Components and Prime 

Contractor Schedule 

Practice Explanation 

Criterion 

meta

GAO analysis 

Establishing the 

duration of all 

activities 

The schedule should realistically reflect how long 

each activity will take to execute. In determining 

the duration of each activity, the same rationale, 

data, and assumptions used for cost estimating 

should be used for schedule estimating. Further, 

these durations should be as short as possible 

and they should have specific start and end dates. 

Excessively long periods needed to execute an 

activity should prompt further decomposition of 

the activity so that shorter execution durations will 

result. 

Met Durations of key activities in the schedule reflect 

scheduling best practices, and officials stated that 

activity durations are based on government and 

contractor expert opinions, as well as historical 

data. 

Integrating 

schedule 

activities 

horizontally and 

vertically 

The schedule should be horizontally integrated, 

meaning that it should link the products and 

outcomes associated with already sequenced 

activities. These links are commonly referred to as 

handoffs and serve to verify that activities are 

arranged in the right order to achieve aggregated 

products or outcomes. The schedule should also 

be vertically integrated, meaning that traceability 

exists among varying levels of activities and 

supporting tasks and subtasks. Such mapping or 

alignment among levels enables different groups 

to work to the same master schedule. 

Partially The schedule is mostly vertically integrated with 

the majority of milestones and detail activities 

being subsumed by higher summary milestones 

and activities. In addition, the Air Exit Pilots 

schedule is not horizontally integrated, meaning 

that the activities across the multiple teams are 

not arranged in the right order to achieve 

aggregated products or outcomes. It is not 

possible to accurately trace the network from 

beginning to end because the schedule does not 

reflect a valid critical path. In addition, program 

officials stated that the schedule reflects all 

government and contractor activities for the 

component, and that integration of the schedule 

with the prime contractor’s schedule is addressed 

through a manual process performed on a weekly 

basis. However, we did not receive evidence 

demonstrating that the Air Exit Pilots schedule 

and prime contractor schedule were integrated. 

Establishing the 

critical path for 

all activities 

Using scheduling software, the critical path—the 

longest duration path through the sequenced list 

of key activities—should be identified. The 

establishment of a program’s critical path is 

necessary for examining the effects of any activity 

slipping along this path. Potential problems that 

may occur on or near the critical path should also 

be identified and reflected in the scheduling of the 

time for high-risk activities. 

Minimally Officials told us they manage to the critical path, 

as defined by the scheduling software, on a 

weekly basis. However, the Air Exit Pilots 

schedule does not exhibit a valid critical path. A 

valid critical path represents the longest chain of 

activities through the schedule and determines 

the length of the component effort. By managing 

to the hard constraints rather than the true critical 

path, management does not have a clear picture 

of available float that would mitigate the risks 

associated with slipping tasks. Furthermore, 

removing all hard constraints will not identify the 

true critical path within the schedule because of 

the high number of missing dependencies. 

Page 35 GAO-10-13 Homeland Security
Appendix II: Detailed Results of GAO 

Assessment of Schedules for Ongoing 

Comprehensive Exit Components and Prime 

Contractor Schedule 

Practice Explanation 

Criterion 

meta

GAO analysis 

Identifying float 

between 

activities 

The schedule should identify float—the time that a 

predecessor activity can slip before the delay 

affects successor activities—so that schedule 

flexibility can be determined. As a general rule, 

activities along the critical path typically have the 

least amount of float. 

Minimally The Air Exit Pilots schedule displays an 

unrealistic amount of float. Specifically, 49 

activities have greater than 100 days of float. 

Officials told us they were aware of the float and 

are satisfied that the float reflects reality because 

of unique circumstances. However, 17 of the 

activities with high float times (between 97 to 236 

days) are missing successor activities. A missing 

successor link will cause excessive float because 

the activities can essentially slip or carry on for 

months without affecting the finish date. Total 

float cannot be truly determined unless all 

activities have at least one predecessor link and 

one successor link. However, as stated 

previously, 26 percent of the remaining activities 

are missing such links. 

Conducting a 

schedule risk 

analysis 

A schedule risk analysis uses a good critical path 

method schedule and data about project schedule 

risks as well as Monte Carlo simulation 

techniques to predict the level of confidence in 

meeting a program’s completion date, the amount 

of time contingency needed for a level of 

confidence, and the identification of high-priority 

risks. This analysis focuses not only on critical 

path activities but also on other schedule paths 

that may become critical. A schedule/cost risk 

assessment recognizes the interrelationship 

between schedule and cost and captures the risk 

that schedule durations and cost estimates may 

vary because of, among other things, limited data, 

optimistic estimating, technical challenges, and 

lack of qualified personnel. As a result, the 

baseline schedule should include a buffer or a 

reserve of extra time. Schedule reserve for 

contingencies should be calculated by performing 

a schedule risk analysis. As a general rule, the 

reserve should be held by the project manager 

and applied as needed to those activities that take 

longer than scheduled because of the identified 

risks. Reserves of time should not be apportioned 

in advance to any specific activity since the risks 

that will actually occur and the magnitude of their 

impact is not known in advance. 

Not met The program office has not performed a schedule 

risk analysis. Thus, it is not possible to determine 

a level of confidence in meeting the projected 

completion date or whether proper reserves have 

been incorporated into the schedule. A schedule 

risk analysis will calculate schedule reserve, 

which can be set aside for those activities 

identified as high risk. Without this reserve, the 

program office faces the risk of delays to the 

scheduled completion date if any delays were to 

occur on critical path activities. 

Page 36 GAO-10-13 Homeland Security
Appendix II: Detailed Results of GAO 

Assessment of Schedules for Ongoing 

Comprehensive Exit Components and Prime 

Contractor Schedule 

Practice Explanation 

Criterion 

meta

GAO analysis 

Updating the 

schedule using 

logic and 

durations to 

determine the 

dates 

The schedule should use logic and durations in 

order to reflect realistic start and completion dates 

for program activities. The schedule should be 

continually monitored to determine when 

forecasted completion dates differ from the 

planned dates, which can be used to determine 

whether schedule variances will affect 

downstream work. Maintaining the integrity of the 

schedule logic is not only necessary to reflect true 

status, but is also required before conducting a 

schedule risk analysis. The schedule should avoid 

logic overrides and artificial constraint dates that 

are chosen to create a certain result on paper. To 

ensure that the schedule is properly updated, 

individuals trained in critical path method 

scheduling should be responsible for updating the 

schedule status. 

Partially Program officials told us they use the schedule in 

weekly management and risk meetings. However, 

according to the schedule’s status date, there are 

eight activities that should have started but do not 

have an actual start date; nine activities that 

should have finished but do not have an actual 

finish date; and two activities that have an actual 

start date 1 week in the future. These anomalies 

indicate the presence of questionable logic in the 

schedule, suggesting that management may 

need to re-evaluate the process for correctly 

updating the schedule. In addition, the manual 

process for updating the progress of contractor 

activities in the component schedule may lead to 

errors, especially without unique WBS elements 

assigned to the activities to assist schedulers in 

the process. Furthermore, program officials stated 

they do not routinely verify the validity of the 

schedule logic using scheduling software 

diagnostic reports. Assessing the health of the 

schedule after updating its status is encouraged, 

as actual progress typically overrides scheduled 

logic. 

Source: GAO analysis of US-VISIT data. 

a

“Met” means the program provided complete evidence that satisfies the entire criterion. 

“Substantially” means the program provided evidence that satisfies a large portion of the criterion. 

“Partially” means the program provided evidence that satisfies about half of the criterion. “Minimally” 

means the program provided evidence that satisfies a small portion of the criterion. “Not met” means 

the program provided no evidence that satisfies any of the criterion. 

b

An activity that is less than 100 percent complete is considered a “remaining activity.” 

Page 37 GAO-10-13 Homeland Security
Appendix II: Detailed Results of GAO 

Assessment of Schedules for Ongoing 

Comprehensive Exit Components and Prime 

Contractor Schedule 

Table 3: US-VISIT Temporary Worker Visa Exit Pilot Schedule Compared to Best Practices 

Practice Explanation 

Criterion 

meta

GAO analysis 

Capturing all 

activities 

The schedule should reflect all activities (e.g., 

steps, events, outcomes, etc.) as defined in the 

program’s WBS, to include activities to be 

performed by both the government and its 

contractors. 

Partially While officials stated that the schedule is built 

from the bottom up by subject matter experts on 

integrated project teams consisting of both 

government and contractor staff, and that the 

schedule is linked to a statement of work via 

activity identification numbers, the Temporary 

Worker Visa Exit Pilot schedule does not contain 

activity identification information. In addition, the 

WBS for Comprehensive Exit does not include 

tasks for the effort and therefore cannot be 

mapped to the pilot’s schedule. 

Sequencing all 

activities 

The schedule should be planned so that it can 

meet program-critical dates. To meet this 

objective, key activities need to be logically 

sequenced in the order that they are to be carried 

out. In particular, activities that must finish prior to 

the start of other activities (i.e., predecessor 

activities) as well as activities that cannot begin 

until other activities are completed (i.e., successor 

activities) should be identified. By doing so, 

interdependencies among activities that 

collectively lead to the accomplishment of events 

or milestones can be established and used as a 

basis for guiding work and measuring progress. 

Minimally The Temporary Worker Visa Exit Pilot schedule 

does not adequately sequence activities due to a 

high number of missing dependencies. 

Specifically, 42 percent of the remaining activities 

have missing dependencies (i.e., predecessor or 

successor activities). The majority of these 

activities are missing successor activities. If an 

activity that has no logical successor slips, the 

schedule will not reflect the effect on the critical 

path, float, or scheduled start dates of 

downstream activities. In addition, we identified 

five “dangling” activities, meaning they do not 

have proper links to logically determine their start 

or finish dates. Further, 13 percent of the 

remaining activities identify dates for which the 

activity may not start earlier than. These are 

considered “soft” constraints, in that they are 

past-limiting, not future-limiting. This means that if 

predecessor tasks slip, the constrained task will 

slip if properly sequenced. While not necessarily 

a poor scheduling practice, the use of this many 

soft constraints does limit the ability of the 

schedule to dynamically respond to changes. If 

predecessor tasks are completed earlier than 

scheduled, these downstream tasks will not shift 

to take advantage of time savings. 

Page 38 GAO-10-13 Homeland Security
Appendix II: Detailed Results of GAO 

Assessment of Schedules for Ongoing 

Comprehensive Exit Components and Prime 

Contractor Schedule 

Practice Explanation 

Criterion 

meta

GAO analysis 

Assigning 

resources to all 

activities 

The schedule should reflect what resources (i.e., 

labor, material, and overhead) are needed to do 

the work, whether all required resources will be 

available when they are needed, and whether any 

funding or time constraints exist. 

Minimally Labor, material costs, other direct charges, and 

resources (such as testing facilities or other 

equipment) are not reflected in the schedule. 

Instead, groups are assigned to activities at the 

organization level (e.g., Information and 

Technology Management). Program officials 

confirmed they do not assign resources in their 

schedules beyond the organization level. It is 

important that the program office gain an 

understanding of resources needed to complete 

the work. This information would assist the 

program office in forecasting the likelihood of 

activities being completed based on their 

projected end dates. The current schedule does 

not allow for insight into current or projected 

overallocation of resources, thus significantly 

increasing the risk of the component effort 

slipping. 

Establishing the 

duration of all 

activities 

The schedule should realistically reflect how long 

each activity will take to execute. In determining 

the duration of each activity, the same rationale, 

data, and assumptions used for cost estimating 

should be used for schedule estimating. Further, 

these durations should be as short as possible 

and they should have specific start and end dates. 

Excessively long periods needed to execute an 

activity should prompt further decomposition of 

the activity so that shorter execution durations will 

result. 

Met Durations of key activities in the schedule reflect 

scheduling best practices. Further, officials stated 

that activity durations are based on government 

and contractor expert opinions, as well as 

historical data. 

Integrating 

schedule 

activities 

horizontally and 

vertically 

The schedule should be horizontally integrated, 

meaning that it should link the products and 

outcomes associated with already sequenced 

activities. These links are commonly referred to as 

handoffs and serve to verify that activities are 

arranged in the right order to achieve aggregated 

products or outcomes. The schedule should also 

be vertically integrated, meaning that traceability 

exists among varying levels of activities and 

supporting tasks and subtasks. Such mapping or 

alignment among levels enables different groups 

to work to the same master schedule. 

Partially The Temporary Worker Visa Exit Pilot schedule is 

mostly vertically integrated, with the majority of 

milestones and detail activities being subsumed 

by higher summary milestones and activities. In 

addition, the Temporary Worker Visa Exit Pilot 

schedule is not horizontally integrated, meaning 

that the activities across the multiple teams are 

not arranged in the right order to achieve 

aggregated products or outcomes. It is not 

possible to accurately trace the schedule from 

beginning to end because of the number of 

missing dependencies and the fact that the 

schedule does not reflect a valid critical path. In 

addition, program officials stated that the 

schedule reflects all government and contractor 

activities for the component, and that integration 

of the schedule with the prime contractor’s 

schedule is addressed through a manual process 

performed on a weekly basis. However, we did 

not receive evidence demonstrating that the 

Temporary Worker Visa Exit Pilot schedule and 

prime contractor schedule were integrated. 

Page 39 GAO-10-13 Homeland Security
Appendix II: Detailed Results of GAO 

Assessment of Schedules for Ongoing 

Comprehensive Exit Components and Prime 

Contractor Schedule 

Practice Explanation 

Criterion 

meta

GAO analysis 

Establishing the 

critical path for 

all activities 

Using scheduling software, the critical path—the 

longest duration path through the sequenced list 

of key activities—should be identified. The 

establishment of a program’s critical path is 

necessary for examining the effects of any activity 

slipping along this path. Potential problems that 

may occur on or near the critical path should also 

be identified and reflected in the scheduling of the 

time for high-risk activities. 

Minimally Officials told us they manage to the critical path, 

as defined by the scheduling software, on a 

weekly basis. However, the Temporary Worker 

Visa Exit Pilot schedule does not exhibit a valid 

critical path. A valid critical path represents the 

longest chain of activities through the schedule 

and determines the length of the component 

effort. By definition, the critical path must run from 

the first event to the last event without a break in 

continuity. Two activities in the schedule, “Kiosk 

Early Start Go Live Date” and “Removal of 

Equipment” are separated via a 225-day lag. 

Unrealistic total float calculations due to this lag 

are creating an invalid critical path throughout the 

network. Further, any critical path within the 

schedule—with or without lags—will be invalid 

due to almost half the activities missing 

dependencies. 

Identifying float 

between 

activities 

The schedule should identify float—the time that a 

predecessor activity can slip before the delay 

affects successor activities—so that schedule 

flexibility can be determined. As a general rule, 

activities along the critical path typically have the 

least amount of float. 

Minimally The Temporary Worker Visa Exit Pilot schedule 

displays an unrealistic amount of float. 

Specifically, 56 activities have greater than 225 

days of float. Officials told us they were aware of 

the float and are satisfied that the float reflects 

reality because of unique circumstances. 

However, 16 of the activities with high float times 

(between 226 and 306 days) are missing 

successor activities. A missing successor link will 

cause excessive float because the activities can 

essentially slip or carry on for months without 

affecting the finish date. The majority of excessive 

float is created due to the misuse of lags. The 

finish milestone of the project is separated from 

its predecessor via a 225-day lag. Program 

officials told us this lag represents operations and 

maintenance activity. Operations and 

maintenance is typically a level of effort type of 

task and as such is not usually captured in a 

schedule. However, there are three activities 

scheduled beyond the lag, which is having an 

adverse effect on the schedule’s total float. This 

is because preceding tasks not tied directly to 

operations and maintenance are able to slip at 

least 225 days with no effect on the network. 

These excessive float values are responsible for 

the invalid critical path. 

Page 40 GAO-10-13 Homeland Security
Appendix II: Detailed Results of GAO 

Assessment of Schedules for Ongoing 

Comprehensive Exit Components and Prime 

Contractor Schedule 

Practice Explanation 

Criterion 

meta

GAO analysis 

Conducting a 

schedule risk 

analysis 

A schedule risk analysis uses a good critical path 

method schedule and data about project schedule 

risks as well as Monte Carlo simulation 

techniques to predict the level of confidence in 

meeting a program’s completion date, the amount 

of time contingency needed for a level of 

confidence, and the identification of high-priority 

risks. This analysis focuses not only on critical 

path activities but also on other schedule paths 

that may become critical. A schedule/cost risk 

assessment recognizes the interrelationship 

between schedule and cost and captures the risk 

that schedule durations and cost estimates may 

vary because of, among other things, limited data, 

optimistic estimating, technical challenges, and 

lack of qualified personnel. As a result, the 

baseline schedule should include a buffer or a 

reserve of extra time. Schedule reserve for 

contingencies should be calculated by performing 

a schedule risk analysis. As a general rule, the 

reserve should be held by the project manager 

and applied as needed to those activities that take 

longer than scheduled because of the identified 

risks. Reserves of time should not be apportioned 

in advance to any specific activity since the risks 

that will actually occur and the magnitude of their 

impact is not known in advance. 

Not met The program office has not performed a schedule 

risk analysis. Thus, it is not possible to determine 

a level of confidence in meeting the projected 

completion date or whether proper reserves have 

been incorporated into the schedule. A schedule 

risk analysis will calculate schedule reserve, 

which can be set aside for those activities 

identified as high risk. Without this reserve, the 

program office faces the risk of delays to the 

scheduled completion date if any delays were to 

occur on critical path activities. 

Updating the 

schedule using 

logic and 

durations to 

determine the 

dates 

The schedule should use logic and durations in 

order to reflect realistic start and completion dates 

for program activities. The schedule should be 

continually monitored to determine when 

forecasted completion dates differ from the 

planned dates, which can be used to determine 

whether schedule variances will affect 

downstream work. Maintaining the integrity of the 

schedule logic is not only necessary to reflect true 

status, but is also required before conducting a 

schedule risk analysis. The schedule should avoid 

logic overrides and artificial constraint dates that 

are chosen to create a certain result on paper. To 

ensure that the schedule is properly updated, 

individuals trained in critical path method 

scheduling should be responsible for updating the 

schedule status. 

Partially Program officials told us they use the schedule in 

weekly management and risk meetings. There 

were no anomalies in the schedule’s start or 

finish dates, or tasks that had begun out of 

sequence. However, the manual process for 

updating the progress of contractor activities in 

the component schedule may lead to errors, 

especially without unique WBS elements 

assigned to the activities to assist schedulers in 

the process. Furthermore, program officials stated 

they do not routinely verify the validity of the 

schedule logic using scheduling software 

diagnostic reports. Assessing the health of the 

schedule after updating its status is encouraged, 

as actual progress typically overrides scheduled 

logic. 

Source: GAO analysis of US-VISIT data. 

a

“Met” means the program provided complete evidence that satisfies the entire criterion. 

“Substantially” means the program provided evidence that satisfies a large portion of the criterion. 

“Partially” means the program provided evidence that satisfies about half of the criterion. “Minimally” 

means the program provided evidence that satisfies a small portion of the criterion. “Not met” means 

the program provided no evidence that satisfies any of the criterion. 

Page 41 GAO-10-13 Homeland Security
Appendix II: Detailed Results of GAO 

Assessment of Schedules for Ongoing 

Comprehensive Exit Components and Prime 

Contractor Schedule 

Table 4: US-VISIT Contractor Schedule Compared to Best Practices 

Practice Explanation 

Criterion 

meta

GAO analysis 

Capturing all 

activities 

The schedule should reflect all activities (e.g., 

steps, events, outcomes, etc.) as defined in the 

program’s WBS, to include activities to be 

performed by both the government and its 

contractors. 

Met Officials stated that the schedule includes all 

prime contractor effort related to the US-VISIT 

Comprehensive Exit project, and that the scope 

captured in this schedule was reviewed and 

approved in the Integrated Baseline Review 

conducted in November 2008. The prime 

contractor also noted that the schedule is 

vertically integrated into an internal integrated 

master schedule that captures all prime 

contractor effort associated with US-VISIT. 

Sequencing all 

activities 

The schedule should be planned so that it can 

meet program-critical dates. To meet this 

objective, key activities need to be logically 

sequenced in the order that they are to be carried 

out. In particular, activities that must finish prior to 

the start of other activities (i.e., predecessor 

activities) as well as activities that cannot begin 

until other activities are completed (i.e., successor 

activities) should be identified. By doing so, 

interdependencies among activities that 

collectively lead to the accomplishment of events 

or milestones can be established and used as a 

basis for guiding work and measuring progress. 

Met The majority of remaining activities within the 

schedule are logically sequenced, by defining 

predecessor and successor activities, and 

containing a small amount of constraints, 

several of which are due to external 

dependencies outside of the control of the prime 

contractor. 

Assigning 

resources to all 

activities 

The schedule should reflect what resources (i.e., 

labor, material, and overhead) are needed to do 

the work, whether all required resources will be 

available when they are needed, and whether any 

funding or time constraints exist. 

Met According to officials, resources are fully loaded 

into the schedule until it is formally baselined. 

Once the schedule is baselined, the resource 

information is moved to software more 

conducive to managing and updating resource 

information. 

Establishing the 

duration of all 

activities 

The schedule should realistically reflect how long 

each activity will take to execute. In determining 

the duration of each activity, the same rationale, 

data, and assumptions used for cost estimating 

should be used for schedule estimating. Further, 

these durations should be as short as possible 

and they should have specific start and end dates. 

Excessively long periods needed to execute an 

activity should prompt further decomposition of 

the activity so that shorter execution durations will 

result. 

Met Durations of key activities in the schedule reflect 

scheduling best practices. Further, officials 

stated that activity durations are based on 

historical data on projects performed by the 

prime contractor. 

Page 42 GAO-10-13 Homeland Security
Appendix II: Detailed Results of GAO 

Assessment of Schedules for Ongoing 

Comprehensive Exit Components and Prime 

Contractor Schedule 

Practice Explanation 

Criterion 

meta

GAO analysis 

Integrating 

schedule 

activities 

horizontally and 

vertically 

The schedule should be horizontally integrated, 

meaning that it should link the products and 

outcomes associated with already sequenced 

activities. These links are commonly referred to as 

handoffs and serve to verify that activities are 

arranged in the right order to achieve aggregated 

products or outcomes. The schedule should also 

be vertically integrated, meaning that traceability 

exists among varying levels of activities and 

supporting tasks and subtasks. Such mapping or 

alignment among levels enables different groups 

to work to the same master schedule. 

Substantially The prime contractor schedule is vertically 

integrated, with all major milestones and lower 

level tasks associated with summary tasks. In 

addition, the schedule is mostly horizontally 

integrated. Specifically, external dependencies 

show connections with other scheduled effort, 

and the majority of activities are linked to 

predecessors and successors with no hard 

constraints. However, the critical path does not 

span the entire project. As such, predetermined 

milestones and calendar dates appear to dictate 

the length of the schedule rather than the critical 

path. 

Establishing the 

critical path for 

all activities 

Using scheduling software the critical path—the 

longest duration path through the sequenced list 

of key activities—should be identified. The 

establishment of a program’s critical path is 

necessary for examining the effects of any activity 

slipping along this path. Potential problems that 

may occur on or near the critical path should also 

be identified and reflected in the scheduling of the 

time for high-risk activities. 

Substantially Contractor officials told us they manage to the 

critical path as defined by the scheduling 

software. However, the contractor schedule 

does not exhibit a valid critical path. Specifically, 

we found two separate critical paths in the 

contractor schedule: one related to the Air Exit 

Pilots and another related to the Temporary 

Worker Visa Exit Pilot. A valid critical path 

represents the longest chain of activities through 

the schedule and determines the length of the 

effort. By definition, the critical path must run 

from the first event to the last event without a 

break in continuity. 

Identifying float 

between 

activities 

The schedule should identify float—the time that a 

predecessor activity can slip before the delay 

affects successor activities—so that schedule 

flexibility can be determined. As a general rule, 

activities along the critical path typically have the 

least amount of float. 

Met The contractor schedule displays a realistic 

amount of float for its efforts. 

Page 43 GAO-10-13 Homeland Security
Appendix II: Detailed Results of GAO 

Assessment of Schedules for Ongoing 

Comprehensive Exit Components and Prime 

Contractor Schedule 

Practice Explanation 

Criterion 

meta

GAO analysis 

Conducting a 

schedule risk 

analysis 

A schedule risk analysis uses a good critical path 

method schedule and data about project schedule 

risks as well as Monte Carlo simulation 

techniques to predict the level of confidence in 

meeting a program’s completion date, the amount 

of time contingency needed for a level of 

confidence, and the identification of high-priority 

risks. This analysis focuses not only on critical 

path activities but also on other schedule paths 

that may become critical. A schedule/cost risk 

assessment recognizes the interrelationship 

between schedule and cost and captures the risk 

that schedule durations and cost estimates may 

vary because of, among other things, limited data, 

optimistic estimating, technical challenges, and 

lack of qualified personnel. As a result, the 

baseline schedule should include a buffer or a 

reserve of extra time. Schedule reserve for 

contingencies should be calculated by performing 

a schedule risk analysis. As a general rule, the 

reserve should be held by the project manager 

and applied as needed to those activities that take 

longer than scheduled because of the identified 

risks. Reserves of time should not be apportioned 

in advance to any specific activity since the risks 

that will actually occur and the magnitude of their 

impact is not known in advance. 

Met Contractor officials stated that they use schedule 

risk analysis software, and that a schedule risk 

analysis was performed prior to establishing its 

baseline schedule for Comprehensive Exit. 

Officials further stated that the results of the 

baseline risk analysis were provided to the USVISIT program office during the initial baseline 

review. 

Updating the 

schedule using 

logic and 

durations to 

determine the 

dates 

The schedule should use logic and durations in 

order to reflect realistic start and completion dates 

for program activities. The schedule should be 

continually monitored to determine when 

forecasted completion dates differ from the 

planned dates, which can be used to determine 

whether schedule variances will affect 

downstream work. Maintaining the integrity of the 

schedule logic is not only necessary to reflect true 

status, but is also required before conducting a 

schedule risk analysis. The schedule should avoid 

logic overrides and artificial constraint dates that 

are chosen to create a certain result on paper. To 

ensure that the schedule is properly updated, 

individuals trained in critical path method 

scheduling should be responsible for updating the 

schedule status. 

Met Contractor officials stated that Control Account 

Managers are responsible for updating the 

status of the schedule on a weekly basis, which 

includes updating the progress of their tasks and 

ensuring actual start and actual finish dates are 

accurate. Officials also stated they perform 

diagnostic tests on the schedule periodically to 

ensure the schedule is sequenced logically. 

Source: GAO analysis of US-VISIT data. 

a

“Met” means the program provided complete evidence that satisfies the entire criterion. 

“Substantially” means the program provided evidence that satisfies a large portion of the criterion. 

“Partially” means the program provided evidence that satisfies about half of the criterion. “Minimally” 

means the program provided evidence that satisfies a small portion of the criterion. “Not met” means 

the program provided no evidence that satisfies any of the criterion. 

Page 44 GAO-10-13 Homeland Security
Appendix III: Comments from the Department Appendix III: Comments from the of Homeland Security 

Department of Homeland Security 

Page 45 GAO-10-13 Homeland Security 
Appendix III: Comments from the Department 

of Homeland Security 

Page 46 GAO-10-13 Homeland Security
Appendix IV: 

S

GAO Contact and 

taff Acknowledgments

Page 47 GAO-10-13 

Appendix IV: GAO Contact and Staff 

Acknowledgments 

Randolph C. Hite, (202) 512-3439, or hiter@gao.gov

In addition to the individual named above, Paula Moore, Assistant 

Director; Justin Booth; Neil Doherty; Rebecca Eyler; Nancy Glover; 

Richard Hagerman; Dave Hinchman; Jason Lee; Karen Richey; and Jeanne 

Sung made key contributions to this report. 

 Homeland Security 

GAO Contact 

Staff 

Acknowledgments 

(310672) 
GAO’s Mission The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help 

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost 

is through GAO’s Web site (www.gao.gov). Each weekday afternoon, GAO 

posts on its Web site newly released reports, testimony, and 

correspondence. To have GAO e-mail you a list of newly posted products, 

go to www.gao.gov and select “E-mail Updates.” 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Phone The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s Web site, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information. 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Ralph Dawn, Managing Director, dawnr@gao.gov, (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, DC 20548 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548 

Public Affairs 

Please Print on Recycled Paper