Department of Homeland Security: Continued Progress Made Improving and Integrating Management Areas, but More Work Remains
Published: 2012-09-20T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: This testimony discusses the Department of Homeland Security's (DHS) efforts to strengthen and integrate its management functions. DHS now has more than 200,000 employees and an annual budget of almost $60 billion, and its transformation is critical to achieving its homeland security and other missions. Since 2003, GAO has designated the implementation and transformation of DHS as high risk because DHS had to combine 22 agencies--several with major management challenges--into one department, and failure to effectively address DHS's management and mission risks could have serious consequences for our national and economic security. This high-risk area includes challenges in strengthening DHS's management functions--financial management, acquisition management, human capital, and information technology (IT)--the effect of those challenges on DHS's mission implementation, and challenges in integrating management functions within and across the department and its components. In November 2000, we published our criteria for removing areas from the high-risk list. This high-risk area includes challenges in strengthening DHS's management functions--financial management, acquisition management, human capital, and information technology (IT)--the effect of those challenges on DHS's mission implementation, and challenges in integrating management functions within and across the department and its components. Specifically, agencies must have (1) a demonstrated strong commitment and top leadership support to address the risks; (2) the capacity (that is, the people and other resources) to resolve the risks; (3) a corrective action plan that identifies the root causes, identifies effective solutions, and provides for substantially completing corrective measures in the near term, including but not limited to steps necessary to implement solutions we recommended; (4) a program instituted to monitor and independently validate the effectiveness and sustainability of corrective measures; and (5) the ability to demonstrate progress in implementing corrective measures. On the basis of our prior work, in a September 2010 letter to DHS, we identified, and DHS agreed to achieve, 31 actions and outcomes that are critical to addressing the challenges within the department's management areas and in integrating those functions across the department to address the high-risk designation. These key actions and outcomes include, among others, obtaining and then sustaining unqualified audit opinions for at least 2 consecutive years on the departmentwide financial statements; validating required acquisition documents in accordance with a department-approved, knowledge-based acquisition process; and demonstrating measurable progress in implementing its IT human capital plan and accomplishing defined outcomes. In January 2011, DHS issued its initial Integrated Strategy for High Risk Management, which included key management initiatives (e.g., financial management controls, IT program governance, and procurement staffing model) to address challenges and the outcomes we identified for each management area. DHS provided updates of its progress in implementing these initiatives in later versions of the strategy--June 2011, December 2011, and June 2012. Achieving and sustaining progress in these management areas would demonstrate the department's ability and ongoing commitment to addressing our five criteria for removing issues from the high-risk list. As requested, this testimony will discuss our observations, based on prior and ongoing work, on DHS's progress in achieving outcomes critical to addressing its high-risk designation for the implementation and transformation of the department.
section_title: What GAO Found
paragraphs: Since we designated the implementation and transformation of DHS as high risk in 2003, DHS has made progress addressing management challenges and senior department officials have demonstrated commitment and top leadership support for addressing the department's management challenges. However, the department has significant work ahead to achieve positive outcomes in resolving high-risk issues. For example, DHS faces challenges in modernizing its financial systems, implementing acquisition management controls, and improving employee satisfaction survey results, among other things. As DHS continues to mature as an organization, it will be important for the department to continue to strengthen its management functions, since the effectiveness of these functions affects its ability to fulfill its homeland security and other missions.

section_title: Letter
paragraphs: I am pleased to be here today to discuss the Department of Homeland  Security’s (DHS) efforts to strengthen and integrate its management  functions. DHS now has more than 200,000 employees and an annual  budget of almost $60 billion, and its transformation is critical to achieving  its homeland security and other missions. Since 2003, GAO has  designated the implementation and transformation of DHS as high risk  because DHS had to combine 22 agencies—several with major  management challenges—into one department, and failure to effectively  address DHS’s management and mission risks could have serious  consequences for our national and economic security. This high-risk  area includes challenges in strengthening DHS’s management  functions—financial management, acquisition management, human  capital, and information technology (IT)—the effect of those challenges on  DHS’s mission implementation, and challenges in integrating  management functions within and across the department and its  components.
In November 2000, we published our criteria for removing areas from the  high-risk list.commitment and top leadership support to address the risks; (2) the  capacity (that is, the people and other resources) to resolve the risks; (3)  a corrective action plan that identifies the root causes, identifies effective  solutions, and provides for substantially completing corrective measures  in the near term, including but not limited to steps necessary to implement  solutions we recommended; (4) a program instituted to monitor and  independently validate the effectiveness and sustainability of corrective  measures; and (5) the ability to demonstrate progress in implementing  corrective measures.
Specifically, agencies must have (1) a demonstrated strong  On the basis of our prior work, in a September 2010 letter to DHS, we  identified, and DHS agreed to achieve, 31 actions and outcomes that are  critical to addressing the challenges within the department’s management  areas and in integrating those functions across the department to address  the high-risk designation. These key actions and outcomes include,  among others, obtaining and then sustaining unqualified audit opinions for  at least 2 consecutive years on the departmentwide financial statements;  validating required acquisition documents in accordance with a  department-approved, knowledge-based acquisition process; and  demonstrating measurable progress in implementing its IT human capital  plan and accomplishing defined outcomes. In January 2011, DHS issued  its initial Integrated Strategy for High Risk Management, which included  key management initiatives (e.g., financial management controls, IT  program governance, and procurement staffing model) to address  challenges and the outcomes we identified for each management area.  DHS provided updates of its progress in implementing these initiatives in  later versions of the strategy—June 2011, December 2011, and June  2012. Achieving and sustaining progress in these management areas  would demonstrate the department’s ability and ongoing commitment to  addressing our five criteria for removing issues from the high-risk list.
My testimony this morning, as requested, will discuss our observations,  based on prior and ongoing work, on DHS’s progress in achieving  outcomes critical to addressing its high-risk designation for the  implementation and transformation of the department.
This statement is based on prior reports and testimonies we issued from  June 2007 through September 2012 and letters we submitted to DHS in  March and November 2011 providing feedback on the department’s  January and June 2011 versions of its Integrated Strategy for High Risk  Management. For the past products, among other methodologies, we  interviewed DHS officials; analyzed DHS strategies and other documents  related to the department’s implementation and transformation high-risk  area; and reviewed our past reports, issued since DHS began its  operations in March 2003. All of this work was conducted in accordance  with generally accepted government auditing standards; more-detailed  information on the scope and methodology from our prior work can be  found within each specific report. This statement is also based on  observations from our ongoing work related to DHS IT investments. For  this work, we analyzed recent cost and schedule performance for DHS’s  major IT investments as reported to the Office of Management and  Budget as of March 2012. We will report on the final results of this review  later this month. We are conducting this work in accordance with  generally accepted government auditing standards. Those standards  require that we plan and perform the audit to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe that the evidence obtained  provides a reasonable basis for our findings and conclusions based on  our audit objectives.
subsections: section_title: DHS Has Made Progress in Addressing Its Management Challenges, but Has Significant Work Ahead to Achieve High-Risk Outcomes
paragraphs: Since we designated the implementation and transformation of DHS as  high risk in 2003, DHS has made progress addressing management  challenges and senior department officials have demonstrated  commitment and top leadership support for addressing the department’s  management challenges. However, the department has significant work  ahead to achieve positive outcomes in resolving high-risk issues. For  example, DHS faces challenges in modernizing its financial systems,  implementing acquisition management controls, and improving employee  satisfaction survey results, among other things. As DHS continues to  mature as an organization, it will be important for the department to  continue to strengthen its management functions, since the effectiveness  of these functions affects its ability to fulfill its homeland security and  other missions.
Financial management. DHS has made progress in addressing its  financial management and internal controls weaknesses, but has been  unable to obtain an unqualified audit opinion on its financial statements  since the department’s creation and faces challenges in modernizing its  financial management systems. DHS has, among other things,  reduced the number of material weaknesses in internal controls from  18 in 2003 to 5 in fiscal year 2011; achieved its goal of receiving a qualified audit opinion on its fiscal year  2011 consolidated balance sheet and statement of custodial activity  for the first time since the department’s creation; established a goal of obtaining an audit opinion on all of its fiscal year  2012 financial statements; and expanded the scope of the annual financial audit to the complete set  of fiscal year 2012 financial statements, which DHS believes will help  it to obtain an unqualified opinion for fiscal year 2013.
However, DHS continues to face challenges in financial management. For  example, DHS anticipates difficulties in providing its auditors transaction- level detail to support balances reported in its fiscal year 2012 financial  statements in order to obtain an opinion on its financial statements. This  is due to, among other things, components not retaining original  acquisition documentation or enforcing policies related to recording  purchases and making payments. DHS also anticipates its auditors  issuing a disclaimer in their fiscal year 2012 report on internal controls  over financial reporting due to material weaknesses in internal controls,  such as lack of effective controls over the recording of financial  transactions related to property, plant, and equipment.
In addition, in December 2011, DHS reported that the Federal Emergency  Management Agency (FEMA), U.S. Coast Guard (USCG), and U.S.  Immigration and Customs Enforcement (ICE) have an essential business  need to replace their financial management systems, but DHS has not  fully developed its plans for upgrading existing or implementing new  financial systems at these agencies. According to DHS’s June 2012  version of its Integrated Strategy for High Risk Management, the  department plans to extend the useful life of FEMA’s current system by  about 3 years, while FEMA proceeds with a new financial management  system solution, and is in the process of identifying the specific approach,  necessary resources, and time frames for upgrading existing or  implementing new financial systems at USCG and ICE. Without sound  processes, controls, and systems, DHS faces long-term challenges in  obtaining and sustaining an unqualified opinion on both its financial  statements and internal controls over financial reporting, and ensuring its  financial management systems generate reliable, useful, timely  information for day-to-day decision making. We currently have ongoing  work related to DHS’s efforts to improve its financial reporting that we  expect to report on in the spring of 2013.
Acquisition management. DHS has made progress in the acquisition  management area by enhancing the department’s ability to oversee major  acquisition programs. For example:
DHS has established eight Centers of Excellence for cost estimating,  systems engineering, and other disciplines to bring together program  managers, senior leadership staff, and subject matter experts to  promote best practices, provide expert counsel, technical guidance,  and acquisition management tools; and each DHS component has  established a Component Acquisition Executive (CAE) to provide  oversight and support to programs within the component’s portfolio.
According to DHS, as of June 2012, 75 percent of the core CAE  support positions were filled.
In March 2012, DHS completed the development of a Procurement  Staffing Model to determine optimal numbers of personnel to properly  award and administer contracts. In June 2012, DHS reported that it is  taking steps to implement the staffing model throughout headquarters  and the components.
DHS included a new initiative (strategic sourcing) in its December  2011 Integrated Strategy for High Risk Management to increase  savings and improve acquisition efficiency by consolidating contracts  departmentwide for the same kinds of products and services. The  Office of Management and Budget’s Office of Federal Procurement  Policy has cited DHS’s efforts among best practices for implementing  federal strategic sourcing initiatives. Earlier this month, we reported  that the department has implemented 42 strategically sourced efforts  since the department’s inception. According to DHS data, the  department’s spending through strategic sourcing contract vehicles  has increased steadily from $1.8 billion in fiscal year 2008 to almost  $3 billion in fiscal year 2011, representing about 20 percent of DHS’s  procurement spending for that year.
However, DHS continues to face significant challenges in managing its  acquisitions. For example:
Earlier this week, we reported that 68 of the 71 program offices we  surveyed from January through March 2012 responded that they  experienced funding instability, workforce shortfalls, and/or changes  to their planned capabilities over the programs’ duration. We have  previously reported that these challenges increase the likelihood  acquisition programs will cost more and take longer to deliver  capabilities than expected.
Our recent review of DHS acquisition management also identified that  while DHS’s acquisition policy reflects many key program  management practices that could help mitigate risks and increase the  chances for successful outcomes, it does not fully reflect several key  portfolio management practices, such as allocating resources  strategically. DHS plans to develop stronger portfolio management  policies and processes, but until it does so, DHS programs are more  likely to experience additional funding instability, which will increase  the risk of further cost growth and schedule slips. We recommended  that DHS take a number of actions to help mitigate the risk of poor  acquisition outcomes and strengthen the department’s investment  management activities. DHS concurred with all of our  recommendations and noted actions it had taken or planned to  address them.
Human capital management. DHS has taken a number of actions to  strengthen its human capital management. For example:
DHS issued human capital-related plans, guidance, and tools to  address its human capital challenges, including a Workforce Strategy  for 2011-2016; a revised Workforce Planning Guide, issued in March  2011, to help the department plan for its workforce needs; and a  Balanced Workforce Strategy tool, which some components have  begun using to help achieve the appropriate mix of federal and  contractor skills.
The department implemented two programs to address senior  leadership recruitment and hiring, as we reported in February 2012.  While DHS’s senior leadership vacancy rate was as high as 25  percent in fiscal year 2006, it varied between 2006 and 2011 and  declined overall to 10 percent at the end of fiscal year 2011.
DHS developed outreach plans to appeal to veterans and other  underrepresented groups.
While these initiatives are promising, DHS continues to face challenges in  human capital management. For example:
As we reported in March 2012, based on our preliminary observations  of DHS’s efforts to improve employee morale, federal surveys have  consistently found that DHS employees are less satisfied with their  jobs than the government-wide average. DHS has taken steps to  identify where it has the most significant employee satisfaction  problems and developed plans to address those problems, such as  establishing a departmentwide Employee Engagement Executive  Steering Committee, but has not yet improved employee satisfaction  survey results. We plan to issue a final report on our findings later this  month.
As we reported in April 2012, changes in FEMA’s workforce,  workload, and composition have created challenges in FEMA’s ability  to meet the agency’s varied responsibilities and train its staff  appropriately. For example, FEMA has not developed processes to  systematically collect and analyze agencywide workforce and training  data that could be used to better inform its decision making. We  recommended that FEMA, among other things, identify long-term  quantifiable mission-critical goals, establish lines of authority for  agencywide workforce planning and training efforts, and develop  systematic processes to collect and analyze workforce and training  data. DHS concurred with our recommendations and reported actions  underway to address them.
Information technology management. DHS has made progress in  strengthening its IT management, but the department has much more  work to do to fully address its IT management weaknesses. Among other  accomplishments, DHS has:  strengthened its enterprise architecture; defined and begun to implement a vision for a tiered governance  structure intended to improve program and portfolio management, as  we reported in July 2012; established a formal IT Program Management Development Track  and staffed Centers of Excellence with subject matter experts to assist  major and non-major programs.
Based on preliminary observations from our review of DHS’s major at-risk  IT acquisitions we are performing for the committee, these improvements  may be having a positive effect. Specifically, as of March 2012,  approximately two-thirds of the department’s major IT investments we  reviewed (47 of 68) were meeting current cost and schedule  commitments (i.e. goals).
DHS has made progress, but the department has much more work to do  to fully address its IT management weaknesses. For example, the  department needs to:  finalize the policies and procedures associated with its new tiered  governance structure and continue to implement this structure, as we  recommended in our July 2012 report;  continue to implement its IT human capital plan, which DHS believed  would take 18 months to fully implement as of June 2012; and continue its efforts to enhance IT security by, among other things,  effectively addressing material weaknesses in financial systems  security, developing a plan to track and promptly respond to known  vulnerabilities, and implementing key security controls and activities.
Management integration. DHS has made progress in integrating its  individual management functions across the department and its  component agencies. For example, DHS has put into place common  policies, procedures, and systems within individual management  functions, such as human capital, that help to integrate its component  agencies, as we reported in September 2011. To strengthen this effort,  in May 2012, the Secretary of Homeland Security modified the  delegations of authority between the Management Directorate and their  counterparts at the component level. According to DHS, this action will  provide increased standardization of operating guidelines, policies,  structures, and oversight of programs. Additionally, DHS has taken steps  to standardize key data elements for the management areas across the  department to enhance its decision-making. For example, in April 2012,  the Under Secretary for Management appointed an executive steering  committee and tasked this committee with creating a “Data Mart” to  integrate data from disparate sources and allow the dissemination of  timely and reliable information by March 2013. Further, consistent with  our prior recommendations, DHS has implemented mechanisms to  promote accountability for management integration among department  and component management chiefs by, among other things, having the  department chiefs develop written objectives that explicitly reflect  priorities and milestones for that management function.
Although these actions are important, DHS needs to continue to  demonstrate sustainable progress in integrating its management  functions within and across the department and its components and take  additional actions to further and more effectively integrate the department.  For example, DHS recognizes the need to better integrate its lines of  business. The Integrated Investment Life Cycle Model (IILCM), which the  department is establishing to manage investments across the  department’s components and management functions, is an attempt at  doing that. DHS identified the IILCM as one of its most significant  management integration initiatives in January 2011. However, the June  2012 update reported that this initiative is in its early planning stages, will  be phased in over multiple budget cycles, and requires additional  resources to fully operationalize. In September 2012, DHS reported that it  has developed draft policy and procedural guidance to support  implementation of the IILCM and now plans to begin using aspects of this  new approach to develop portions of the department’s fiscal years 2015  through 2019 budget.
DHS strategy for addressing GAO’s high-risk designation. In January  2011, DHS issued an agencywide management integration strategy—the  Integrated Strategy for High Risk Management—as we recommended in  our March 2005 report on DHS’s management integration efforts. DHS’s  most recent version of the strategy, issued in June 2012, greatly  improved upon prior versions and addressed feedback we previously  provided by, for example, identifying key measures and progress ratings  for the 18 initiatives included in the strategy and the 31 outcomes.believe the June 2012 strategy, if implemented and sustained, provides a  path for DHS to address our high-risk designation.
DHS can further strengthen or clarify its Integrated Strategy for High Risk  Management to better enable DHS, Congress, and GAO to assess the  department’s progress in implementing its management initiatives by,  among other things: determining the resource needs for all of the  corrective actions in the strategy; communicating to senior leadership  critical resource gaps across all initiatives; and identifying program and  project risks in a supporting risk mitigation plan for all initiatives.
Going forward, DHS needs to continue implementing its Integrated  Strategy for High Risk Management and show measurable, sustainable  progress in implementing its key management initiatives and corrective  actions and achieving outcomes. We will continue to monitor, assess, and  provide feedback on DHS’s implementation and transformation efforts  through our ongoing and planned work, including the 2013 high-risk  update that we expect to issue in January 2013.
Chairman King, Ranking Member Thompson, and Members of the  Committee, this concludes my prepared statement. I would be pleased to  respond to any questions that you may have.
section_title: GAO Contact and Staff Acknowledgments
paragraphs: For questions about this statement, please contact David C. Maurer at  (202) 512-9627 or maurerd@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this statement. Individuals making key contributions to this statement  include Maria Strudwick, Assistant Director; Victoria Miller, Analyst-in- Charge; and Chloe Brown. Other contributors include: David Alexander,  Michael LaForge, Tom Lombardi, Anjalique Lawrence, Gary Mountjoy,  Sabine Paul, and Katherine Trimble. Key contributors for the previous  work that this testimony is based on are listed within each individual  product.
section_title: Appendix I: Summary of Actions and Outcomes for Addressing the Implementing and Transforming the Department of Homeland Security High-Risk Area
section_title: Related GAO Reports
paragraphs: Homeland Security: DHS Requires More Disciplined Investment  Management to Help Meet Mission Needs. GAO-12-833. Washington,  D.C.: September 18, 2012.
Department of Homeland Security: Oversight and Coordination of  Research and Development Should Be Strengthened. GAO-12-837.  Washington, D.C.: September 12, 2012.
Homeland Security: DHS Has Enhanced Procurement Oversight Efforts,  but Needs to Update Guidance. GAO-12-947. Washington, D.C.:  September 10, 2012.
Information Technology: DHS Needs to Further Define and Implement Its  New Governance Process. GAO-12-818. Washington, D.C.: July 25,  2012.
Federal Emergency Management Agency: Workforce Planning and  Training Could Be Enhanced by Incorporating Strategic Management  Principles. GAO-12-487. Washington, D.C.: April 26, 2012.
Department of Homeland Security: Preliminary Observations on DHS’s  Efforts to Improve Employee Morale. GAO-12-509T. Washington, D.C.:  March 22, 2012.
Department of Homeland Security: Continued Progress Made Improving  and Integrating Management Areas, but More Work Remains.  GAO-12-365T. Washington, D.C.: March 1, 2012.
Information Technology: Departments of Defense and Energy Need to  Address Potentially Duplicative Investments. GAO-12-241. Washington  D.C.: February 17, 2012.
DHS Human Capital: Senior Leadership Vacancy Rates Generally  Declined, but Components’ Rates Varied. GAO-12-264. Washington,  D.C.: February 10, 2012.
Department of Homeland Security: Additional Actions Needed to  Strengthen Strategic Planning and Management Functions.  GAO-12-382T. Washington D.C.: February 3, 2012.
Department of Homeland Security: Progress Made and Work Remaining  in Implementing Homeland Security Missions 10 Years after 9/11.  GAO-11-881. Washington D.C.: September 7, 2011.
High-Risk Series: An Update. GAO-11-278. Washington, D.C.: February  2011.
Information Security: Federal Agencies Have Taken Steps to Secure  Wireless Networks, but Further Actions Can Mitigate Risk. GAO-11-43.  Washington, D.C.: November 30, 2010.
Department of Homeland Security: Assessments of Selected Complex  Acquisitions. GAO-10-588SP. Washington, D.C.: June 30, 2010.
Information Security: Agencies Need to Implement Federal Desktop Core  Configuration Requirements. GAO-10-202. Washington, D.C.: March 12,  2010.
Financial Management Systems: DHS Faces Challenges to Successfully  Consolidating Its Existing Disparate Systems. GAO-10-76. Washington,  D.C.: December 4, 2009.
Department of Homeland Security: Actions Taken Toward Management  Integration, but a Comprehensive Strategy Is Still Needed. GAO-10-131.  Washington, D.C.: November 20, 2009.
Homeland Security: Despite Progress, DHS Continues to Be Challenged  in Managing Its Multi-Billion Dollar Annual Investment in Large-Scale  Information Technology Systems. GAO-09-1002T. Washington, D.C.:  September 15, 2009.
Department of Homeland Security: Billions Invested in Major Programs  Lack Appropriate Oversight. GAO-09-29. Washington, D.C.: November  18, 2008.
Department of Homeland Security: Better Planning and Assessment  Needed to Improve Outcomes for Complex Service Acquisitions.  GAO-08-263. Washington, D.C.: April 22, 2008.
Homeland Security: Departmentwide Integrated Financial Management  Systems Remain a Challenge. GAO-07-536. Washington, D.C.: June 21,  2007.
Information Technology Investment Management: A Framework for  Assessing and Improving Process Maturity, version 1.1. GAO-04-394G.  Washington, D.C.: March 2004.
High-Risk Series: Strategic Human Capital Management. GAO-03-120.  Washington, D.C.: January 2003.
Determining Performance and Accountability Challenges and High Risks.  GAO-01-159SP. Washington, D.C.: November 2000.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.