Homeland Security: Contract Management and Oversight for Visitor and Immigrant Status Program Need to Be Strengthened
Published: 2006-06-09T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Department of Homeland Security (DHS) has established a multibillion-dollar program--U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT)--to control and monitor the pre-entry, entry, visa status, and exit of foreign visitors. To deliver system and other program capabilities, the program relies extensively on contractors, some of whom are managed directly by US-VISIT and some by other agencies (including both DHS agencies, such as Customs and Border Protection, and non-DHS agencies, such as the General Services Administration). Because of US-VISIT's heavy reliance on contractors to deliver program capabilities, GAO was asked to determine whether DHS has established and implemented effective controls for managing and overseeing US-VISIT-related contracts.
section_title: What GAO Found
paragraphs: US-VISIT-related contracts have not been effectively managed and overseen. The US-VISIT program office established and implemented certain nonfinancial controls for those contracts that it managed directly, such as verifying that contractor deliverables satisfied established requirements. However, it did not implement effective controls for overseeing its contracts managed by other DHS agencies and by non-DHS agencies. Moreover, effective financial controls were not in place on any contracts that GAO reviewed. The program office did not know the full extent of US-VISIT-related contract actions, and it had not performed key nonfinancial practices associated with understanding contractor performance in meeting the terms of these contracts. This oversight gap was exacerbated by the fact that the other agencies had not always established and implemented effective controls for managing their respective contracts. These other agencies directly managed more than half (56 percent) of the total US-VISIT-related contract obligations reported to GAO. The program office and other agencies did not implement effective financial controls. Without these controls, some agencies were unable to reliably report US-VISIT contracting expenditures. Further, the program office and these other agencies improperly paid and accounted for related invoices, including making duplicate payments and payments for non-US-VISIT services with funds designated for US-VISIT. According to the US-VISIT program official responsible for contract matters, the program office has focused on contracts that it manages directly and decided to rely on the responsible agencies to manage the other contracts. Further, it has decided to use other agencies to properly manage financial matters for their respective contracts, and it also decided to rely on another agency for its own financial management services. Without effective contract management and oversight controls, the program office does not know that required program deliverables and mission results will be produced on time and within budget, and that proper payments are made.

section_title: Letter
paragraphs: The U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT)  program of the Department of Homeland Security (DHS) is a  governmentwide program for controlling and monitoring the pre-entry,  entry, visa status, and exit of foreign visitors. The department is taking an  incremental approach to acquiring and implementing US-VISIT, with the  initial increments focused on enhancing existing systems, modifying  facilities, and augmenting program office staff. In doing so, DHS has relied  heavily on contractor support, obtained through multiple existing  contracts managed by several DHS and non-DHS agencies. Because of the  importance of effective contractor management and oversight to this  program, you asked us to determine whether the department has  established and implemented effective controls for managing and  overseeing US-VISIT–related contractors.
To achieve this objective, we reviewed the contracting policies and  procedures of DHS and non-DHS agencies responsible for US-VISIT– related contracts. We also reviewed a set of contracting actions (contract  awards and task orders) that were performed between March 2002 and  March 2005. We could not ensure that the selected contracting actions  were statistically representative of all US-VISIT–related contracting  actions because DHS did not have a complete inventory of such actions.
Instead, we used a judgmental selection, focusing on service contracts  from fiscal years 2002 to 2005.
We conducted our review from March 2005 through April 2006 in  accordance with generally accepted government auditing standards.  Further details of our objective, scope, and methodology, including the  basis for our judgmental selection, are included in appendix I.
subsections: section_title: Background
paragraphs: In response to legislation, the Immigration and Naturalization Service  (INS) established in 2002 an Entry/Exit Program to strengthen  management of the pre-entry, entry, visa status, and exit of foreign  nationals who travel to the United States. With the creation of DHS in  March 2003 and the inclusion of INS as part of the new department, this  initiative was renamed US-VISIT. The goals of US-VISIT are to    enhance the security of U.S. citizens and visitors,  facilitate legitimate travel and trade,   ensure the integrity of the U.S. immigration system, and    protect the privacy of our visitors.
To achieve these goals, US-VISIT is to collect, maintain, and share  information on certain foreign nationals who enter and exit the United  States; detect fraudulent travel documents, verify traveler identity, and  determine traveler admissibility through the use of biometrics; and  facilitate information sharing and coordination within the border  management community.
As of October 2005, about $1.4 billion has been appropriated for the  program, and according to program officials, about $962 million has been  obligated.
subsections: section_title: Acquisition and Implementation Approach
paragraphs: DHS plans to deliver US-VISIT capability in four increments: Increments 1  through 3 are interim, or temporary, solutions that were to fulfill  legislative mandates to deploy an entry/exit system by specified dates;  Increment 4 is to implement a long-term vision that is to incorporate  improved business processes, new technology, and information sharing to  create an integrated border management system for the future. For  Increments 1 through 3, the program is building interfaces among existing  (“legacy”) systems; enhancing the capabilities of these systems; deploying  these capabilities to air, sea, and land ports of entry; and modifying ports  of entry facilities. These increments are to be largely acquired and  implemented through task orders placed against existing contracts.
Increment 1 concentrates on establishing capabilities at air and sea ports  of entry and is divided into two parts—1 and 1B. Increment 1 (air and sea  entry) includes the electronic capture and matching of biographic and  biometric information (two digital index fingerscans and a digital  photograph) for selected foreign nationals, including those from visa  waiver countries. Increment 1 was deployed on January 5, 2004, at 115  airports and 14 seaports. Increment 1B (air and sea exit) collects biometric exit data for select foreign nationals; it is currently deployed at 14 airports  and seaports.
Increment 2 focuses primarily on extending US-VISIT to land ports of  entry. It is divided into three parts—2A, 2B, and 2C.
Increment 2A includes the capability to biometrically compare and  authenticate valid machine-readable visas and other travel and entry  documents issued by the Department of State and DHS to foreign  nationals at all ports of entry (air, sea, and land ports of entry).  Increment 2A was deployed on October 23, 2005, according to program  officials. It is also to include the deployment by October 26, 2006, of  technology to read biometrically enabled passports from visa waiver  countries.
Increment 2B redesigned the Increment 1 entry solution and expanded  it to the 50 busiest U.S. land border ports of entry with certain  modifications to facilities. This increment was deployed to these 50  ports of entry as of December 29, 2004.
Increment 2C is to provide the capability to automatically, passively,  and remotely record the entry and exit of covered individuals using  radio frequency technology tags at primary inspection and exit lanes.  In August 2005, the program office deployed the technology to five  border crossings (at three ports of entry) to verify the feasibility of  using passive radio frequency technology to record traveler entries and  exits via a unique identification number embedded within government- issued travel documentation. The program office reported the  evaluation results in January 2006, and according to the Increment 2C  project manager, the program is planning to move forward with the  second phase of this increment.
Increment 3 extended Increment 2B entry capabilities to 104 of the  remaining 105 land ports of entry as of December 19, 2005.
Increment 4 is to define, design, build, and implement more strategic US- VISIT program capability, which program officials stated will likely consist  of a further series of incremental releases or mission capability  enhancements that will support business outcomes.
The first three increments of US-VISIT include the interfacing of existing  systems, the modification of facilities, and the augmentation of program  staff. Key existing systems include the following:    The Arrival Departure Information System (ADIS) is a database that stores  noncitizen traveler arrival and departure data received from air and sea  carrier manifests and that provides query and reporting functions.
The Treasury Enforcement Communications Systems (TECS) is a system  that maintains lookout (i.e., watch list) data, interfaces with other  agencies’ databases, and is currently used by inspectors at ports of entry  to verify traveler information and update traveler data.
TECS includes the Advance Passenger Information System (APIS), a  system that captures arrival and departure manifest information provided  by air and sea carriers.
The Automated Biometric Identification System (IDENT) is a system that  collects and stores biometric data about foreign visitors.
In May 2004, DHS awarded an indefinite-delivery/indefinite-quantity prime  contract to Accenture, which has partnered with a number of other  vendors. According to the contract, the prime contractor will develop an  approach to produce the strategic solution. In addition, it is to help  support the integration and consolidation of processes, functionality, and  data, and is to assist the program office in leveraging existing systems and  contractors in deploying and implementing the interim solutions.
section_title: Organizational Structure and Responsibilities
paragraphs: In July 2003, DHS established the US-VISIT program office, which is  responsible for managing the acquisition, deployment, and operation of  the US-VISIT system and supporting people, processes, and facilities.  Accordingly, the program office’s responsibilities include, among other  things,    delivering program and system capabilities on time and within budget and    ensuring that program goals, mission outcomes, and program results are  achieved.
Within DHS, the US-VISIT program organizationally reports directly to the  Deputy Secretary for Homeland Security, as seen in figure 1.
The program office is composed of a number of functional groups. Among  these groups, three deal with contractor management. These are the  Acquisition and Program Management Office (APMO), the Office of  Facilities and Engineering Management, and the Office of Budget and  Financial Management. As seen in figure 2, all three groups report directly  to the US-VISIT Program Director.
APMO is to manage execution of the program’s acquisition and program  management policies, plans, processes, and procedures. APMO is also  charged with ensuring effective selection, management, oversight, and  control of vendors providing services and solutions.
The Office of Facilities and Engineering Management is to implement the  program’s physical mission environment through, for example, developing  and implementing physical facility requirements and developing  cooperative relationships and partnering arrangements with appropriate  agencies and activities.
The Office of Budget and Finance is to develop executable budgets to  contribute to cost-effective performance of the US-VISIT program and  mission; ensure full accountability and control over program financial  assets; and provide timely, accurate, and useful financial information for  decision support.
section_title: US-VISIT Relationships with Other DHS and Non- DHS Agencies
paragraphs: Since its inception, US-VISIT has relied extensively on contractors to  deliver system and other program capabilities; these contractors include  both contractors managed directly by the program office and those  managed by other DHS and non-DHS agencies. Within the program office,  APMO manages the prime contract mentioned earlier, as well as other  program management-related contracts. All other contracts were awarded  and managed either by other DHS agencies or by two non-DHS agencies,  GSA and AERC. For the contracts managed by other DHS agencies, the  program office has entered into agreements with these agencies. These  agreements allow the program to use previously awarded contracts to  further develop and enhance the existing systems that now are part of US- VISIT. By entering into agreements with the various owners of these  systems, the program office has agreed to fund US-VISIT–related work  performed on the systems by these agencies, which include    CBP, which owns and manages TECS;  Immigration and Customs Enforcement (ICE), which owned and managed  IDENT (until 2004) and ADIS (until 2005), and still provides some  information technology support services; and the Transportation Security Administration (TSA), which in 2003 managed  the development of the air/sea exit pilot program.
In addition, through its Office of Facilities and Engineering Management,  the program office has established an interagency agreement with AERC  and has established reimbursable work authorizations with GSA. The  agreements with GSA and AERC generally provide for management  services in support of US-VISIT deployment.
When the US-VISIT program office was created in July 2003, the program  did not own or manage any of the key systems described earlier. Rather,  all systems were owned and managed by other DHS agencies (see fig. 3).  As of March 2005, the program office had assumed ownership and  management responsibility for IDENT, which was originally managed by  ICE; assumed management responsibility for the air/sea exit project,  which was originally managed by TSA; and shares responsibility for ADIS,  which was initially owned and managed by ICE. US-VISIT owns ADIS, but  CBP is responsible for managing the system. These relationships are  shown in figure 3.
IAAs establish a means for US-VISIT to transfer funds to other DHS and  non-DHS agencies for work done on its behalf. The IAAs first give the  servicing agencies (that is, the agencies performing the work for US-VISIT)  obligation authority to contract for US-VISIT work. Once the work has  been performed, the servicing agencies pay their vendors according to the  terms of their respective contracts and then request reimbursement of the  vendor payment from US-VISIT via the Intra-governmental Payment and  Collection (IPAC) system. In addition, the servicing agencies also receive  IPAC payments for the services they themselves provided for US-VISIT— essentially a fee for the cost of managing contracts on the program’s  behalf.
Table 1 lists the various agencies currently managing US-VISIT–related  contracts and summarizes their respective relationships with the program  office and the purpose of the contract actions that we reviewed.
section_title: Summary of DHS Reported Obligations for US-VISIT Contracts
paragraphs: Documentation provided by the agencies responsible for managing US- VISIT–related contracts shows that between March 2002 and March 31,  2005, they obligated about $347 million for US-VISIT–related contract  work. As shown in figure 4, about $152 million, or less than half (44  percent), of the $347 million in obligations reported to us was for  contracts managed directly by the US-VISIT program office. The remaining  $195 million, or 56 percent, was managed by other DHS and non-DHS  agencies. Specifically, $156 million, or 45 percent of the $347 million in  obligations reported to us for contracts, was managed by other DHS  agencies (TSA and CBP); $39 million, 11 percent, was managed by non- DHS agencies (GSA and AERC).
From the inception of the US-VISIT program office through September 30,  2005, the program reports that it transferred about $96.7 million to other  agencies via the IPAC system for direct reimbursement of contract costs  and for the agencies’ own costs.
section_title: Prior Reviews Related to DHS Contractor Oversight and Management
paragraphs: In January 2005, we observed the increased use of interagency  contracting by the federal government and noted the factors that can make  interagency contract vehicles high risk in certain circumstances. One of  these factors was that the use of such contracting vehicles contributes to a  much more complex environment in which accountability had not always  been clearly established, including designation of responsibility for such  critical functions as describing requirements and conducting oversight. We  concluded that interagency contracting should be designated a high-risk  area because of the challenges associated with such contracts, problems  related to their management, and the need to ensure oversight.
In March 2005, we also reported on challenges facing DHS’s efforts to  integrate its acquisition functions. One significant challenge was a lack of  sufficient staff in the Office of the Chief Procurement Officer to ensure  compliance with the department’s acquisition regulations and policies.  Another challenge was that the department’s Office of Procurement  Operations, which was formed to support DHS agencies that lacked their  own procurement support (such as US-VISIT), did not yet have sufficient  staff and relied heavily on interagency contracting. Further, the office had  not implemented management controls to oversee procurement activity,  including ensuring that proper contractor management and oversight had  been performed. We concluded that unless these challenges were  addressed, the department was at risk of continuing with a fragmented  acquisition organization that provided only stop-gap, ad hoc solutions.
section_title: Importance of Contractor Management Controls
paragraphs: Organizational policies and procedures are important management  controls to help program and financial managers achieve results and  safeguard the integrity of their programs. Agency management is  responsible for establishing and implementing financial and nonfinancial  controls, which serve as the first line of defense in ensuring contractor  performance, safeguarding assets, and preventing and detecting errors and  fraud.
Pursuant to 31 U.S.C. § 3512 (c),(d), the Comptroller General has  promulgated standards that provide an overall framework for establishing  and maintaining internal controls in the federal government. Policy and  guidance on internal control in executive branch agencies are provided by  the Office of Management and Budget (OMB) in Circular A-123, which  defines management’s fundamental responsibility to develop and maintain  effective internal controls. Specifically, management is responsible for  implementing appropriate internal controls; assessing the adequacy of  internal controls, including those over financial reporting; identifying  needed improvements and taking corrective action; and reporting annually  on internal controls.
The five general standards in our framework for internal control are  summarized below.
Control environment. Management and employees should establish and  maintain an environment throughout the organization that sets a positive  and supportive attitude toward internal control and conscientious  management. A key factor relevant to contractor management is having  clearly defined areas of authority and responsibility and appropriate lines  of reporting.
Risk assessment. Internal control should provide for an assessment of  the risks the agency faces from both external and internal sources.
Control activities. Internal control activities help ensure that  management’s directives are carried out. The control activities should be  effective and efficient in accomplishing the agency’s control objectives.  Key control activities associated with contract management include   appropriate documentation of transactions,    accurate and timely recording of transactions and events,    controls over information processing,  reviews by appropriate management in the organization, and   segregation of duties.
Information and communications. Information should be recorded and  communicated to management (and others who need it) in a form, and  within a time frame, that enables them to carry out their internal control  and other responsibilities. Key contract management activities include  identifying, capturing, and distributing information in a form and time  frame that allows people to perform their duties efficiently; and   ensuring that information flows throughout the organization and to  external users as needed.
Monitoring. Internal control monitoring should assess the quality of  performance over time and ensure that the findings of audits and other  reviews are promptly resolved.
To complement the standards, we developed a tool to help managers and  evaluators determine how well an agency’s internal controls are designed  and functioning and what, where, and how improvements may be  implemented. This tool is intended to be used concurrently with the  standards described above and with OMB Circular A-123. The tool  associates each standard with a list of major factors to be considered  when users review the controls for that standard, as well as points to be  considered that may indicate the degree to which the controls are  functioning.
Relevant acquisition regulations and IT acquisition management guidance  also provide criteria for effectively managing contractor activities. The  Federal Acquisition Regulation (FAR) requires that government agencies  ensure that the contractor performs the requirements of the contract, and  the government receives the service intended. However, the FAR does not  prescribe specific methods for doing so.
Other such methods or practices can be found in other acquisition  management guidance. In particular, the Capability Maturity Model  Integration model, developed by the Software Engineering Institute (SEI)  of Carnegie Mellon University, explicitly defines process management  controls that are recognized hallmarks for successful organizations and  that, if implemented effectively, can greatly increase the chances of  successfully acquiring software and systems. These controls define a  number of practices and subpractices relevant to managing and overseeing  contracts. These practices are summarized below.
Establish written policies and procedures for performing  contractor management. Polices establish the organization’s  expectations for performing contractor management activities. Procedures  provide the “how to” or method to be followed in implementing the  policies.
Establish and maintain a plan for performing the contract  oversight process. The plan should include, among other things, a  contractor management and oversight process description, requirements  for work products, an assignment of responsibility for performing the  process, and the evaluations and reviews to be conducted with the  contractor.
Assign responsibility and authority for performing the specific  contractor management activities. Responsibility should be assigned  for performing the specific tasks of the contractor management process.
Train the people performing or supporting the contractor  management process. Personnel participating in the contract oversight  process should be adequately trained and certified, as appropriate, to  fulfill their assigned roles.
Document the contract. This documentation should include, among  other things, a list of agreed-upon deliverables, a schedule and budget,  deliverable acceptance criteria, and types of reviews that will be  conducted with the contractor.
Verify and accept the deliverables. Procedures for accepting  deliverables should be defined; those accepting the deliverables should  verify that they meet requirements; the results of acceptance reviews or  tests should be documented; action plans should be developed for any  products that do not pass their review or test; and action items should be  identified, documented, and tracked to closure.
Monitor risks involving the contractor and take corrective actions  as necessary. Risks should be identified and categorized (e.g., risk  likelihood or risk consequence) and then analyzed according to these  assigned categories.
Conduct technical reviews with the contractor. Reviews should  ensure that technical commitments are being met in a timely manner and  should verify that the contractor’s interpretation and implementation of  the requirements are consistent with the project’s interpretation.
Conduct management reviews. Reviews should address critical  dependencies, project risks involving the contractor, and the contract  schedule and budget.
section_title: US-VISIT Established and Implemented Key Controls for Contracts That It Managed Directly, but It Did Not Have Controls for Overseeing Contracts Managed by Others or for Effective Financial Management
paragraphs: Given the US-VISIT program’s dependence on contracting, it is extremely  important for the program office to effectively manage and oversee its  contracts via the establishment and implementation of key contractor  management and oversight controls. To its credit, the program office  established and implemented most of the key practices associated with  effectively managing nonfinancial contractor activities for those contracts  that it directly manages. In particular, it established policies and  procedures for implementing all but one of the key practices that we  reviewed, and it implemented many of these practices—including  assigning responsibilities and training key personnel involved in  contractor management activities, verifying that contractor deliverables  satisfied established requirements, and monitoring the contractor’s cost  and schedule performance for the task orders that we reviewed. In doing  so, the program has increased the chances that program deliverables and  associated mission results will be produced on time and within budget.
However, the program office did not effectively oversee US-VISIT–related  contract work performed on its behalf by other DHS and non-DHS  agencies, and these agencies did not always establish and implement the  full range of controls associated with effective management of their  respective contractor activities. Without effective oversight, the program  office cannot adequately ensure that program deliverables and associated  mission results will be produced on time and within budget.
Further, the program office and other agencies did not implement effective  financial controls. The program office and other agencies managing US- VISIT–related work were unable to reliably report the scope of contracting  expenditures. In addition, some agencies improperly paid and accounted  for related invoices, including making a duplicate payment and making  payments for non-US-VISIT services from funds designated for US-VISIT.  Without effective financial controls, DHS cannot reasonably ensure that  payments made for work performed by contractors are a proper and  efficient use of resources.
According to the US-VISIT program official responsible for contract  matters, the program office has initially focused on contracts that it  manages directly. For US-VISIT contracts managed by other agencies, the  program office has decided to rely on those agencies to manage the  contracts and associated financial matters. In addition, it has decided to  rely on another agency for financial management support of the program  office.
subsections: section_title: Program Office Established and Implemented Key Contractor Management Practices
paragraphs: The US-VISIT program office is responsible and accountable for meeting  program goals and ensuring that taxpayer dollars are expended effectively,  efficiently, and properly. Within the program office, APMO is responsible  for establishing and maintaining disciplined acquisition and program  management processes to ensure the efficient support, oversight, and  control of US-VISIT program activities. Accordingly, it is important that  APMO establish and implement effective contractor management controls.
As mentioned previously, federal regulations and acquisition management  guidance identify effective contractor management as a key activity and  describe a number of practices associated with this activity, including  (among other things) establishing policies and procedures for contractor  management, defining responsibilities and authorities, providing training,  verifying and accepting deliverables, and monitoring contractor  performance. These general practices often consist of more detailed  subpractices. Appendix III lists the practices and associated subpractices,  as well as the extent to which they were performed on each of the contract  actions that we reviewed.
For contracts that it directly managed, APMO established policies and  procedures for all but one of the key nonfinancial practices associated  with effective contractor management. For example, it established policies  and procedures for performing almost all contractor management  activities (practices) through its Contract Administration and Management  Plan. This programwide plan, in conjunction with its Acquisition  Procedures Guide Deskbook, defines the methodology and approach for  performing contractor management for all contracts and task orders  managed by APMO. However, it neither established polices and  procedures for having a plan for overseeing individual contract actions,  nor actually developed such a plan. Instead, APMO relied on its  programwide polices and procedures for performing contract management  activities and to define what and how it actually implemented them.  However, without a plan for specific contracting actions, the program  office cannot be assured that contract management activities will be  implemented for each contracting action.
Table 2 shows the extent to which APMO, in its documented policies and  procedures, requires that the critical contractor management practices be  performed; this is shown under the heading “practice established?” Under  “practice implemented?” the table also shows the extent to which APMO  had actually implemented such practices for those contracting actions that  we reviewed, regardless of any documented requirement.
APMO also implemented the aforementioned policies and procedures that  it established for each of the contracting actions that we reviewed. For  example, APMO implemented all of the key subpractices associated with  verifying and accepting contract deliverables. Specifically, APMO defined  acceptance procedures, verified that deliverables satisfied their  requirements, documented the results of the review, developed a plan for  addressing deliverable deficiencies, and tracked those issues to closure.  With respect to one program support task order, for example, a designated  US-VISIT team reviewed a project plan delivered by the contractor and  returned it with a “conditionally acceptable” letter; this letter stated that  the comments included were to be incorporated into the plan and assigned  a date that the revised plan was due back. The contractor resubmitted the  plan by the assigned date, and the contracting officer’s technical  representative (COTR) accepted it. Throughout the process, APMO  tracked the status of this deliverable by means of a database designed to  track and update the status of deliverables owed to US-VISIT by its  contractors. The database included such information as current document  status and when the revised document was due back to the program  office.
APMO also implemented all critical subpractices associated with  contractor technical and management review activities. For example,  APMO required that the prime contactor provide monthly cost  performance reports that compared actual with budgeted cost and  addressed critical dependencies. For example, one report noted that  schedule and costs were impacted by a change in resources. In the report,  the contractor proposed a corrective action and resolution date. APMO  staff analyzed these reports and, according to APMO officials, distributed  the analysis results to program office management for informational  purposes (the results focused on the causes of and planned corrective  actions for the most noteworthy cost and schedule variances). The  information contained in the monthly reports was also discussed at  quarterly programwide management reviews, which included contractor  personnel. In addition to management issues, these reviews addressed  technical issues such as deliverable status and requirements.
The quarterly reviews were also used to evaluate the contractor’s overall  performance, as well as the contractor’s performance on each task order  active during that reporting period. The task orders that we examined  were among those reviewed in this way. For each task order, the quarterly  reviews included an assessment of schedule, cost and funding, technical  performance, staffing, and risks. For example, the information presented  on one task order that we reviewed reported that all of these categories  were on track and were forecast to remain on track. During these  reviews, technical requirements for each of the task orders were discussed  among stakeholders, contractor personnel, and management to ensure a  common understanding of those requirements and the status of their  implementation. The results of these reviews were documented, and key  discussion topics and a list and status of action items were identified. The  action items were assigned due dates and were assigned to US-VISIT, the  contractor, or specific individuals. In some cases, an action item identified  a specific task order, such as a request to restructure a staffing report on a  program management task order (in order to more accurately portray the  level of contractor staffing). In the case of the staffing report, it was  assigned to a contractor for action. Updated status of open items was also  provided.
According to APMO’s acquisition policy, the office established and  implemented these contractor management practices to establish a  standard approach for conducting contract activities and to ensure that  US-VISIT contracts continue to be managed in accordance with relevant  laws, regulations, policies, and acquisition requirements. In doing so, the  program has increased the chances that program deliverables and  associated mission results will be produced on time and within budget.
section_title: The Program Office Did Not Effectively Oversee US-VISIT–Related Contracts Managed by Other Agencies
paragraphs: The US-VISIT program office’s APMO is responsible for the program’s  contract-related matters. That means that APMO should, among other  things, effectively oversee contracts being managed by others on the  program’s behalf. However, the program office did not establish and  implement effective controls for overseeing US-VISIT–related contracts  being managed by others. Specifically, the program office did not know  the full range of US-VISIT–related contract actions that had been  completed and were under way, and it had not performed key practices  associated with gaining visibility into and understanding of contractor  performance in meeting the terms of these contracts. This oversight gap is  exacerbated by the fact that the other agencies did not always establish  and implement the full range of controls associated with effective  management of their contractor activities. For example, these agencies did  not always implement effective controls for ensuring that contractor  deliverables satisfy established requirements. Without effective oversight  of all US-VISIT–related contracts, the program office is increasing the risk  that program goals and outcomes will not be accomplished on time and  within budget.
subsections: section_title: US-VISIT’s Oversight of Other Agencies’ Contracting Activities Has Been Informal and Inconsistent
paragraphs: To effectively oversee program-related contracts being managed by others,  it is important for a program office to, at a minimum, depending on the  nature of the contract, (1) define the roles and responsibilities for both  itself and the entities it relies on to manage the contracts, (2) know the full  range of such contract work that has been completed and is under way,  and (3) define and implement the steps it will take to obtain visibility into  the degree to which contract deliverables meet program needs and  requirements, which underpin the program goals and outcomes.
However, the US-VISIT program office did not effectively perform the  following oversight activities for contracts that are being managed by  other agencies:  Defining roles and responsibilities. The program office did not define  and document program office roles and responsibilities for overseeing the  contractor work managed by other agencies and did not define the roles  and responsibilities of the agencies managing US-VISIT–related contracts.  According to the APMO Director, the roles and responsibilities were  defined in IAAs between these agencies and the program office. However,  the IAAs generally did not define roles and responsibilities. For example,  US-VISIT provided us with 12 agreements for the agencies that we  reviewed, and only one of them described roles and responsibilities for  either APMO or the agency managing the contract work. Although  responsibilities were identified, they were at a high level and the same for  both the program office and the agency managing the contractor.  Specifically, the IAA states that the US-VISIT COTR or point of contact and  the servicing agency program office are responsible for technical oversight  of the specified product or service identified in the statement of work.  However, the IAA does not identify any specific contract oversight  practices to be performed. According to the APMO Director, the program  office did not define roles and responsibilities because the office is  relatively new, and most efforts have been focused on developing policies  and procedures for managing contracts that it directly controls.
As noted earlier, we have previously reported that the use of IAAs is a  high-risk approach to contracting. Although these contract vehicles can  offer benefits of improved efficiency and timeliness, effective management  of IAAs is challenging. Accordingly, we concluded that the use of IAAs  requires, among other things, that the issuing agency clearly define roles  and responsibilities for conducting contractor management and oversight.
Knowing the full range of contract work. The program office was not  able to provide us with a complete list of US-VISIT–related contract  actions. Instead, US-VISIT told us that we needed to obtain a list of actions  from each of the DHS and non-DHS agencies that managed the contract  work. Once we compiled the list of contracting actions provided to us by  the other agencies, the Director told us that no one in the program office  could verify that the list was complete and correct. The Director further  stated that APMO is not responsible for overseeing contracts managed  outside the program office.
Defining and implementing the steps to verify that deliverables  meet requirements. According to DHS’s directive on IAAs, the issuing  agency (US-VISIT, in this case) is to, among other things, monitor the  performance of the servicing agency and/or contractor; the directive also  assigns responsibility for monitoring performance to the program office  (or program point of contact) and the contracting officer. The contracting  officer responsible for US-VISIT’s IAAs told us that he relied on the  program office’s designated points of contact to conduct oversight of  those IAAs. However, the program office did not define any specific  performance monitoring activities. As a result, oversight activities  performed have been informal and inconsistent. For example, on the  AERC contracts, the Facilities and Engineering Budget Officer held  weekly teleconferences with AERC to discuss project progress and  contract issues, and concerns on an exception basis. However, these  meetings were not documented; in other words, any follow-up on open  issues and tracking to closure was handled informally. On the CBP  contract actions, the US-VISIT Deputy Chief Information Officer (or one of  his representatives) attended most, but not all, of the system development- milestone progress reviews related to US-VISIT work, and held ad hoc  discussions with a CBP program manager to discuss funding and work  status. On air/sea exit, the US-VISIT Director of Implementation relied on  weekly meetings with TSA and the contractor to keep apprised of project  status. However, he relied on a representative from US-VISIT Mission  Operations to certify that testing on air/sea exit was completed in a  satisfactory manner, and neither he nor a member of his team reviewed  the results themselves. According to the Director of APMO, specific  activities to monitor contracts managed by other agencies have not been  established because the program office’s efforts to date have focused on  developing policies and procedures for contracts that the program office  manages directly.
Without clearly defined roles and responsibilities, as well as defined  oversight activities for ensuring successful completion of the work across  all US-VISIT–related contract activities, the program office cannot be  adequately assured that required tasks are being satisfactorily completed.
section_title: Agencies Managing US-VISIT– Related Contractors Did Not Establish and Implement Key Contractor Management Practices
paragraphs: As mentioned previously, acquisition management guidance identifies  effective contractor management as a key activity and describes a number  of practices associated with this activity, including (among other things)  establishing policies and procedures for contractor management, defining  responsibilities and authorities, providing training, verifying and accepting  deliverables, and monitoring contractor performance. As mentioned  earlier, these practices often consist of more detailed subpractices;  appendix III provides further details on the practices, subpractices, and  agency performance of these on each of the contract actions we reviewed.
Table 3 shows the extent to which agencies, in their documented policies  or procedures, require that the critical contractor management practices  be performed (see columns under “practice established?”); it also shows  (under “practice implemented?”) the extent to which agencies had actually  implemented such practices for the contracting actions that we reviewed,  regardless of any documented requirement.
As table 3 shows, agencies’ establishment and implementation of the key  contractor management practices for US-VISIT–related contracts have  been uneven.
All of the agencies had established policies or procedures for performing  some of the key contractor management practices. Only CBP, however,  had established policies and procedures for some aspect of all the key  practices, while GSA and AERC had established procedures for about half  of the key practices.
Nevertheless, most of the agencies at least partially implemented most of  the practices, even though they did not establish written procedures for  doing so. For example, although three of the agencies did not establish  documented policies or procedures for conducting technical and  management reviews with the contractor, two of them implemented some  aspects of the practice.
All Agencies Established Some Policies and Procedures for  Contractor Management Activities  Contractor management policies and procedures define the organization’s  expectations and practices for managing contractor activities. All of the  agencies (DHS and non-DHS) had established polices or procedures for  governing some key contractor management practices. For example,  CBP’s Systems Development Life Cycle, augmented by its Office of  Information Technology Project Manager’s Guidebook, defines policies  and procedures for assigning responsibilities and authorities for key  contracting personnel and training those people responsible for  implementing contractor management activities. Among other things,  these documents provide descriptions of the duties of the contracting  officer, the project manager, and COTR. The documents also require all  affected agencies to train the members of their groups in the objectives,  procedures, and methods for performing contractor management  activities. CBP guidance also addresses contractor management  procedures, including verifying and accepting deliverables, monitoring  contract risk and taking corrective action, and conducting various reviews  with the contractor.
Other agencies, such as GSA and AERC, have established fewer  procedures for contractor management. For example, GSA had not  established procedures for three practices: (1) establishing and  maintaining a plan for performing contractor oversight, (2) conducting  technical reviews with the contractor, and (3) conducting management  reviews with the contractor. According to GSA officials, they have not  documented their oversight process in order to allow for as much  flexibility as possible in performing the process. Further, they said they  relied on the professional expertise of the contracting officer’s  representative (COR) and/or COTR to ensure the technical accuracy of  work produced by a contractor.
Without established policies and procedures for contractor management,  the organizations responsible for managing US-VISIT–related contracts  cannot adequately ensure that these vital contractor management  activities are performed.
Agencies’ Implementation of Key Practices Was Uneven  Implementation of key practices in the contracting actions that we  reviewed was uneven. As table 3 shows, one practice—assigning  responsibilities and authorities—was implemented by all agencies. Other  key practices were only partially implemented or not implemented by all  agencies. The following discussion provides selected examples.
Most agencies implemented training of contractor management  personnel. Training the personnel performing or supporting contractor  management activities helps to ensure that these individuals have the  necessary skills and expertise to adequately perform their responsibilities.
Most of the agencies had trained some of the key contracting officials  responsible for the contracting actions that we reviewed and were able to  produce documentation of that training. For example, CBP relied on a  DHS-mandated training program to train its key contract personnel.  However, that program was not established until March 2004 for  contracting officers and December 2004 for COTRs, and so it did not apply  to all the contracting actions that we reviewed. Before these programs  were established, CBP relied on the previously existing qualifications of its  contracting personnel. However, it provided training documentation for  only some of the key contracting personnel for the contracting actions that  we reviewed.
With respect to non-DHS agencies, AERC and GSA records showed that  contracting personnel had completed contracting-related training for the  contracting actions that we reviewed.
Most agencies did not implement all key practices for verifying and  accepting contract deliverables. Verifying that contract deliverables  satisfy specified requirements provides an objective basis to support a  decision to accept the product. Verification depends on the nature of the  deliverable and can occur through various means, such as reviewing a  document or testing software. Effectively verifying and accepting contract  deliverables includes, among other things, (1) defining procedures for  accepting deliverables; (2) conducting deliverable reviews or tests in order  to ensure that the acquired product satisfies requirements;  (3) documenting the results of the acceptance review or test;  (4) establishing an action plan for any deliverables that do not pass the  acceptance review or test; and (5) identifying, documenting, and tracking  action items to closure.
All agencies implemented some (but not all) of the key practices  associated with verifying and accepting contract deliverables. The  following two examples from CBP and TSA illustrate this.
CBP implemented most of the subpractices associated with this practice.
For one contracting action reviewed (software development for Increment  2B functionality), CBP defined acceptance (testing) procedures,  conducted the tests to verify that the deliverables satisfied the  requirements, and documented the results. However, it did not develop an  action plan to identify, document, and track unresolved action items to  closure. Further, CBP accepted the deliverable before verifying that it had  satisfied the requirements. Specifically, test results were presented at a  production readiness review (one of the progress reviews called for in  CBP’s system development life cycle) on November 4, 2004. The review  meeting included a US-VISIT stakeholder representative who signed off on  the test results, indicating that US-VISIT accepted the deliverable and  concurred that it was ready to operate in a production environment.  However, the test analysis report highlighted several issues that called this  conclusion into question. For example, the report stated that testing  continued after the review (through November 8, 2004), and the report  identified 67 issues at severity level 2, which CBP defines as a function  that does not work and whose failure severely impacts or degrades the  system. The report further stated that some test cases were delayed and  subject to further testing. CBP could not provide any documentation that  these open issues were resolved or that the test cases were executed.
Further, the COTR told us that CBP did not define specific acceptance  standards, such as the number and severity of defects permissible for  acceptance. Instead, acceptance of the deliverable was subjectively based  on the COTR’s assessment of whether the software could provide critical  functionality.
For another contract action (Increment 1 hardware and software  installation at ports of entry), CBP did not verify that the equipment was  installed according to contract requirements. We were told by both the  CBP Director of Passenger Systems (who was involved with much of the  US-VISIT work) and the contract task monitor that the formal process for  verifying and accepting contract deliverables consisted of a site-specific  deployment checklist that recorded acceptance of deployment at each  port. Acceptance required a signature from a government employee, a  date, and an indication of deployment status (the two options for this  status were (1) that the equipment was installed and operational or  (2) that it was not installed, along with a description of reasons why it was  not). However, as shown in table 4, not all checklists that we reviewed  were signed or indicated that the equipment was installed and operational,  and CBP could not provide documentation on how the identified issues  were resolved. Further, although the deliverable was deployed to 119 sites,  CBP provided checklists for 102 sites and was unable to provide them for  the other 17 sites.
TSA implemented three of the practices associated with verifying and  accepting deliverables—defining acceptance procedures, verifying that  deliverables satisfy requirements, and documenting the results of the tests.
Specifically, TSA tested the air/sea exit software and hardware, and  developed a test plan that included test procedures and a traceability  matrix. It also documented the test results in a test analysis report that  noted that the software was ready for deployment because of the low  severity of identified deficiencies. The report included, among other  things, a list of system deficiencies identified during testing. The report  also included copies of documents provided to a US-VISIT technical  representative: a test problem report, a summary of testing defects, and a  document indicating that the contractor had approved the test analysis.  However, TSA did not provide evidence that the deficiencies were  managed and tracked to closure. TSA officials told us that open issues  were tracked informally via twice-weekly meetings with a US-VISIT  representative, TSA personnel, and contactor staff. Although these  meetings were documented, the minutes did not provide any evidence of  testing issues being discussed. According to program officials, this was  due to the short development time frame (about 4 months) and the need to  bypass traditional TSA milestone reviews in order to ensure that the  product was delivered on time.
Without adequately verifying that contract deliverables satisfy  requirements before acceptance, an organization cannot adequately know  whether the contractor satisfied the obligations of the contract and  whether the organization is getting what it has paid for.
Most agencies performed contractor technical and management  reviews. Monitoring contractor performance is essential for  understanding the contractor’s progress and taking appropriate corrective  actions when the contractor’s performance deviates from plans. Such  monitoring allows the acquiring organization to ensure that the contractor  is meeting schedule, effort, cost, and technical performance requirements.  Effective monitoring activities include conducting reviews in which  budget, schedule, and critical dependencies are assessed and documented,  and the contractor’s implementation and interpretation of technical  requirements are discussed and confirmed.
Three of the four agencies implemented some contractor review activities,  including, among other things, addressing technical requirements progress  against schedule and costs through regular meetings with the contractor.
For example, TSA conducted weekly reviews with the contractor to  discuss the status of contract performance; material prepared for some of  these weekly meetings indicated that topics discussed were “actual dollars  expended” versus “budget at project completion,” projected and actual  schedule versus baseline, anticipated product delivery dates against  planned due dates, and issues and risks. As another example, CBP held  weekly documented meetings with its contractor to discuss open issues,  the status of the project, and the current stage of the systems development  life cycle. Additionally, CBP milestone reviews addressed project  schedule, budget, and risk, some of which could be traced to specific  contracts.
In contrast, AERC did not document the monitoring of contractor  performance during the performance period of the contract. Instead, to  document contractor performance, it relied solely on end-of-contract  evaluations required by the FAR.
section_title: Program Office and Other Agencies’ Contract Management Was Impaired by Financial Management Weaknesses
paragraphs: Financial management weaknesses at both the program office and the  other agencies impaired their ability to adequately manage and oversee  US-VISIT–related contracting activities. Specifically, well-documented,  severe financial management problems at DHS (and at ICE in particular)  affected the reliability and effectiveness of accounting for the US-VISIT  program. Accordingly, the program office and the other DHS agencies  were unable to provide accurate, reliable, and timely accounts for billings  and expenditures made for contracts related to US-VISIT. In addition, a  number of invoice payments were improperly paid and accounted for.
subsections: section_title: Serious DHS Financial Management Problems Affected the Quality of Financial Data for US-VISIT Contracts
paragraphs: DHS’s financial management problems are well-documented. When the  department began operations in 2003, one of the challenges we reportedwas integrating a myriad of redundant financial management systems and  addressing the existing financial management weaknesses inherited by the  department. Since that time, DHS has undergone three financial statement  audits and has been unable to produce fully auditable financial statements  for any of the audits.In its most recent audit report, auditors reported 10  material weaknesses and 2 reportable conditions.
Among the factors contributing to DHS’s inability to obtain clean audit  opinions were serious financial management challenges at ICE, which  provides accounting services for several other DHS agencies, including the  US-VISIT program. For fiscal years 2004 and 2005, auditors reported that  financial management and oversight at ICE was a material weakness,  principally because its financial systems, processes, and control activities  were inadequate to provide accounting services for itself and other DHS  agencies. According to the auditors, ICE did not adequately maintain its  own accounting records or the accounting records of other DHS agencies,  including US-VISIT. The records that were not maintained included  intradepartmental agreements and transactions, costs, and budgetary  transactions. These and other accounts required extensive reconciliation  and adjustment at year-end, which ICE was unable to complete. In  addition, in fiscal year 2005, ICE was unable to establish adequate internal  controls that reasonably ensured the integrity of financial data and that  adhered to our Standards for Internal Control in the Federal  Government; the Chief Financial Officer of ICE also issued a statement of  “no assurance” on internal control over financial reporting.
These systemic financial challenges impaired the US-VISIT program’s  contract management and oversight. As the accounting service provider  for the US-VISIT program, ICE is responsible for processing and recording  invoice payments both for contractors working directly for the program  and for the work ICE procures on the program’s behalf. However, because  of its financial problems, the reliability of the financial information  processed by ICE as the accounting-services provider for the program  office was limited. Further, ICE was unable to produce detailed, reliable  financial information regarding the contracts it managed on behalf of US- VISIT.
section_title: Program Office and Other DHS Agencies Did Not Adequately Track Billings and Expenditures
paragraphs: Of the DHS agencies we reviewed, the program office and two others  managing US-VISIT–related contracts on the program’s behalf did not  track contract billings and expenditures in a way that was accurate,  reliable, and useful for contract oversight and decision making.  Specifically, the amounts reportedly billed were not always reliable, and  expenditures for US-VISIT were not always separately tracked.
Our Standards for Internal Control in the Federal Government identifies  accurate recording of transactions and events as an important control  activity. In addition, the standards state that pertinent financial  information should be identified, captured, and distributed in a form that  permits people to perform their duties effectively. In order for people to  perform their duties effectively, they need access to information that is  accurate, complete, reliable, and useful for oversight and decision making.  In the case of US-VISIT, expenditures and billings made for US-VISIT– related contracts should be tracked by the program office and the agencies  managing the contracts on the program office’s behalf, and controls  should be in place to ensure that the information is reliable, complete, and  accurate. Furthermore, in order for the information to be useful for  oversight and decision making, billings and expenditures made for US- VISIT work should be separately tracked and readily identifiable from  other billings and expenditures. Separately accounting for program funds  is an important budgeting and management tool, especially when those  funds are reimbursed by another agency for a program-specific purpose,  as was the case for US-VISIT. Finally, according to our internal control  standards and more specifically, our Internal Control Management and  Evaluation Tool, information should be available on a timely basis for  effective monitoring of events, activities, and transactions.
The Amounts Reportedly Billed on US-VISIT–Related Contracts  Are Nor Reliable  Because effective internal controls were not in place, the reliability of US- VISIT–related billings by DHS agencies was questionable. First, the  program office could not verify the scope of completed and ongoing  contracting actions. Second, for the contracting actions that were  reported, not all agencies provided billing information that was reliable.
The program office did not track all contracting activity and thus could not  provide a complete list of contracting actions. In the absence of a  comprehensive list, we assembled a list of contracting actions from the  program office and from each of the five agencies responsible for  contracting for US-VISIT work. However, the APMO Director did not know  whether the list of contracting actions was valid.
In addition, to varying degrees, other DHS agencies could not reliably  report to us what had been invoiced on the US-VISIT–related contracts  they managed. In particular, ICE’s substantial financial management  challenges precluded it from providing reliable information on amounts  invoiced against its contracts. Its inability to provide us with key financial  documents for US-VISIT–related contracts illustrated its challenges. Over  a period of 9 months, we repeatedly requested that ICE provide various  financial documents, including expenditure listings, invoice  documentation, and a list of all contracting actions managed on behalf of  US-VISIT. However, it did not provide complete documentation in time to  be included in this report. In particular, ICE was not able to provide  complete and reliable expenditures to date. It did provide a list of US- VISIT–related contracting actions, but it did not include the amounts  invoiced on those contracting actions, and program office staff noted  several problems with ICE’s list, including several contracts that were  likely omitted. A comparable list provided by the DHS Office of the Chief  Procurement Officer showed ICE’s invoiced amounts, but the contracting  actions on this list differed from those provided by ICE. Without accurate  tracking of financial information related to US-VISIT contracts, the full  scope of contracting and spending on the program cannot be known with  reasonable certainty. This limitation introduces the increased possibility of  inefficiencies in spending, improper payments, and poor management of  limited financial resources.
For CBP, a list of contacting actions provided by program officials  included discrepancies that raised questions about the accuracy both of  the list and of the invoiced amounts. First, the task order number of a 2002  contracting action changed during our period of review, and CBP initially  reported the task order as two different contracting actions—one issued in  2002 and another issued in 2004. Second, the task order was for services  performed bureauwide, not just for US-VISIT, and from the contract  documentation it was not discernable which work was specific to US- VISIT. Such discrepancies suggest that the amount invoiced specifically to  US-VISIT was not accurate. Finally, our summation of all the invoices,  through March 31, 2005, on this contracting action totaled about $8.8  million, which was about $1.3 million more than the total invoiced amount  that CBP had reported. This discrepancy indicated that CBP was not  adequately tracking funds spent for US-VISIT on this contracting action,  which increased the risk that the program was improperly reimbursing  CBP on this contract. No such discrepancy existed between reported and  actual invoiced amounts on the 2003 and 2004 CBP contracting actions we  reviewed.
TSA was able to provide accurate billing information on the one US-VISIT– related contracting action that it managed, but delays in invoicing on this  contracting action increase the risk of future problems. As of February  2005, development on the TSA contract action was finished, and the  contract had expired. However, from April 2005 through February 2006  (the latest date available), TSA reported that it continued to receive and  process about $5 million in invoices, and that the contractor can still bill  TSA for prior work performed for up to 5 years after expiration of the  contract. According to TSA, the contractor estimated (as of February  2006) that it would be sending TSA an additional $2 million in invoices to  pay for work already completed. TSA officials could not explain this delay  in invoicing. Such a significant lag between the time in which work is  completed and when it is billed can present a challenge to the proper  review of invoices.
DHS Agencies Did Not Always Separately Track Expenditures  Made to Contractors for US-VISIT Work  ICE did not track expenditures made to contractors for US-VISIT work  separately from other expenditures, and CBP experienced challenges in its  efforts to do so. Reliable, separate tracking of such expenditures is an  important internal control for ensuring that funds are being properly  budgeted and that the program office is reimbursing agencies only for  work performed in support of the program.
In the case of ICE, its financial management system did not include unique  codes or any other means to reliably track expenditures made for US- VISIT–related contracts separately from non-US-VISIT expenditures. As a  result, ICE did not have reliable information on what it spent for the  program, which means that it could have requested improper  reimbursements from the program office. More specifically, the most  detailed list ICE could provide of its US-VISIT–related payments was by  querying its financial management system by contract number, which  provided all payments under the contract number. However, each  contract’s scope of work is generally broad and includes work throughout  ICE, not just for US-VISIT. Thus, this method would not give an accurate  picture of what expenditures ICE had made for US-VISIT–related work.
In the case of CBP, it began using coding in its financial management  system to separately track US-VISIT obligations and expenditures  beginning in fiscal year 2003, when CBP first received funding for US- VISIT. At that time, CBP tracked all US-VISIT expenditures under a single  project code. However, between fiscal years 2003 and 2004, CBP  underwent a system conversion that interrupted its tracking of US-VISIT– related funds, which made it challenging to separately report US-VISIT– related expenditures. During this time, several changes were made to the  codes used to track US-VISIT information. When we requested a listing of  the US-VISIT–related expenditures by CBP, it took several weeks for CBP  finance center staff to document the financial management system coding  changes and produce a reasonably complete listing of the US-VISIT– related expenditures that CBP made during the system conversion. In  fiscal years 2004 and 2005, CBP again began tracking all US-VISIT–related  expenditures separately under a single budget code. Thus, in the future,  the tracking and reporting of US-VISIT expenditures by CBP should be  more timely and reliable.
section_title: Several Payments to Contractors for US-VISIT Work Were Improperly Paid and Accounted for
paragraphs: Although the program office and the agencies—both DHS and others— doing work on its behalf usually documented approval of contractor  invoices before payment, a number of invoices were improperly paid and  accounted for, resulting in a potential loss of funds control and, in one  case, a duplicate payment on an invoice of over $3 million. Our Internal  Control Management and Evaluation Tool states that transactions and  events need to be appropriately classified and that pertinent information is  to be identified and captured in the right form.
Overpayments occurred as a result of two kinds of errors: on one occasion  a duplicate payment was made, and on several other occasions incorrect  balances were paid.
A duplicate payment was made on an invoice for over $3 million. APMO  had sent an authorization for payment in full on the invoice to its finance  center. Then, 1 month later, APMO sent another authorization for payment  in full on the same invoice. The second payment was later noticed, and the  contractor refunded the amount.
The other set of overpayments, although small in dollar value, exemplify a  significant breakdown in internal control. Invoices billed to AERC on a  fiscal year 2005 contract listed the current amount billed on the invoice, as  well as a cumulative balance; the cumulative balance included invoice  payments that AERC had already made, but that had not been recorded by  the contractor when the next invoice was generated. On several of the  invoices, AERC mistakenly paid the higher cumulative balance when the  current amount should have been paid. As a result, AERC overpaid the  vendor by about $26,600. Moreover, it was the contractor that first  reported this overpayment in September 2005 and refunded the  overpayment amount to AERC. According to DHS officials, the US-VISIT  program office had independently identified the overpayment in  November 2005 and requested clarification from AERC the following day.
Also at APMO, two questionable payments were made that arose from the  overriding of controls created for the prime US-VISIT contract. The prime  contract has been implemented through 12 task orders with multiple  modifications that either increased funding or made other changes to the  contract terms. To account for the obligations made on each task order,  the program’s Office of Budget and Finance created separate tracking  codes in the financial system for each task order and sometimes for each  modification of a task order. The separate tracking of each obligation is a  good control for tracking and controlling spending against task order  funds. However, APMO overrode this control when it instructed the  finance center to pay two invoices—one for about $742,000 and one for  about $101,000—out of the wrong account: that is, with funds for task  orders other than those for which the invoices were billed. APMO did not  provide any justification for payment with funds from the improper  account. Our Internal Control Management and Evaluation Tool states  that any intervention or overriding of internal controls should be fully  documented as to the reasons and specific actions taken.
CBP also inappropriately paid for work unrelated to US-VISIT out of funds  designated for US-VISIT. For a 2003 contracting action that we reviewed,  invoices included a significant amount in travel billings. However, several  travel vouchers that accompanied these invoices were for work unrelated  to US-VISIT. For example, terms like “Legacy ag/legacy Customs  unification,” “Agriculture Notes Installation,” and “Agriculture AQI” were  indicated on the vouchers. CBP confirmed that these vouchers were billed  to US-VISIT in error. Additionally, other vouchers included descriptions  that were vague and not clearly related to any specific program (e.g.,  emergency hardware replacement), and thus it was not clear that the work  being billed was related to the program. Along with the travel expenses,  the labor hours associated with the above vouchers were also being billed  to the program. This circumstance calls into question not only whether or  not the travel charges were inappropriately classified as US-VISIT work,  but also whether the time that these employees were charging was  inappropriately classified, and thus improperly paid.
On one CBP contracting action, some charges that were not related to US- VISIT may have been reimbursed by the program office. The contracting  action in question was a 2002 action for CBP-wide disaster recovery  services, and thus not all charges were directly related to the US-VISIT  program. On this task order, CBP expended about $1.28 million from  program-designated funds on items that were not clearly specified as US- VISIT work on the invoices. Of that amount, about $43,000 could be  attributed to a contract modification specific to the program. However,  CBP stated that one invoice for about $490,000 included in this $1.28  million was paid from the program’s funds to correct two payments for  earlier US-VISIT invoices that were erroneously made from nonprogram  funds. We also found about $771,000 of invoice dollars that were specified  as US-VISIT work, but that were not on the CBP-provided expenditure  reports for program funds.
As a result of these various discrepancies, the US-VISIT program may have  reimbursed CBP for work that was not done on its behalf. Also, the  program official responsible, under DHS policy, for monitoring the CBP  contracts related to US-VISIT told us that he had not been reviewing  invoices on IPAC reimbursement requests from CBP, even though such  reviews are required by DHS policy.
In addition, on the 2003 CBP contracting action that we reviewed, many of  the travel vouchers included first-class flights taken by contract personnel,  although (with few exceptions) purchase of first-class travel is not allowed  for travel on cost-reimbursable type contracts. However, travel  documentation indicated first-class travel on numerous instances with no  explanation or justification of the first-class travel or documentation to  indicate that CBP had requested any explanation. CBP officials noted that  some frequent fliers are automatically upgraded when purchasing a full- fare flight. Although this is a reasonable explanation, CBP provided no  documentation showing that it completed any inquiry or research at the  time it was invoiced to determine if first-class travel was being purchased  or if upgrades were being given, and invoice documentation did not clarify  this. Further, in several instances, complete documentation was not  provided for the costs of all airline travel expenses.
A final concern regarding payments to contractors is raised by the fact that  several of the agencies made late payments on invoices. Under the Prompt  Payment Act, the government must pay interest on invoices it takes over  30 days to pay. Not only do these interest payments deplete funds  available for US-VISIT, but excessive late invoice payments are also a  signal that the contract payment oversight process is not being effectively  managed. CBP and TSA experienced agencywide increases in contract  prompt-payment interest. CBP reported that in fiscal year 2004, the year  that it converted to a new accounting system, prompt pay interest  accounted for 7.66 percent of all payments, a sharp increase from the prior  year’s frequency rate of 1.74 percent. In fiscal year 2005, the rate of  interest payments at CBP receded to 1.80 percent of total payments.
APMO also paid substantial amounts in prompt payment interest.  According to DHS’s auditors, ICE, which provides US-VISIT payment  services, had not established internal controls to ensure that invoices were  paid in a timely manner. For the invoices that we reviewed, prompt- payment interest was paid on approximately 26 percent of the prime  contract invoices that we reviewed, representing over $27,000 in  payments. In addition, we could not verify that the proper amount of  interest was paid because information in the ICE financial management  system was incorrect. For example, in many instances, important dates  used for determining prompt-pay interest were entered incorrectly, or the  dates in the system could not be validated based on invoice  documentation provided. A program official told us that certain program  staff have recently been granted read-only access to ICE’s financial  management system to monitor invoice payments. If the program office  effectively uses this increased oversight ability, it could reduce the number  of prompt-payment violations as well as reduce other improper contract  payments made by the program office.
section_title: Conclusions
paragraphs: Contractors have played, and will continue to play, a major role in  delivering US-VISIT capabilities, including technology, facilities, and  people. Therefore, the success of the program depends largely on how  well DHS manages and oversees its US-VISIT–related contracts.  Establishing and implementing effective contractor management and  oversight controls, including financial management controls, can greatly  increase the department’s ability to manage and oversee US-VISIT–related  contracts. However, the department’s management and oversight of US- VISIT–related contracts are not yet at the level that they need to be to  adequately ensure, for example, that contract deliverables satisfy program  requirements, that cost and schedule commitments are met, that program  outcomes are achieved, that funds are not overspent and improperly  reimbursed, and that payments are made in a proper and timely manner.
Although the program office has generally established and implemented  key contractor management controls on those contracts that it manages  directly, it has not adequately overseen US-VISIT–related contracts that  were managed by other DHS and non-DHS agencies. According to program  office officials, this is because they have initially focused on those  contracts that they manage directly. However, this narrow focus raises  concerns because the agencies managing contracts on the program office’s  behalf have not implemented the full range of management controls  needed to have a full, accurate, reliable, and useful understanding of the  scope of contract activities and performance.
Moreover, none of the US-VISIT contracts that we reviewed have been  subject to important financial management controls. As previous audits  have shown, DHS suffers from numerous material weaknesses in financial  management, some of which are directly related to ICE (the DHS  component that provides financial management services to the program  office). These weaknesses have contributed to the program’s inability to  know the full scope of contract activities and fully account for  expenditures, among other things. By impairing the reliability and  effectiveness of accounting for US-VISIT contracts, these weaknesses have  diminished the program’s ability to effectively manage and oversee work  performed by contractors—work that is essential for the program to  achieve its goals.
Until DHS addresses these contract management and oversight  weaknesses, the US-VISIT program will remain at risk of not delivering  required capabilities and promised benefits on time and within budget, and  it will be vulnerable to financial mismanagement.
section_title: Recommendations for Executive Action
paragraphs: Given the US-VISIT program’s mission importance, size, and heavy  reliance on contractor assistance, we recommend that the Secretary of  Homeland Security direct the US-VISIT Program Director to take the  following five actions to strengthen contract management and oversight,  including financial management:    For each US-VISIT contract action that the program manages directly,  establish and maintain a plan for performing the contractor oversight  process, as appropriate.
Develop and implement practices for overseeing contractor work  managed by other agencies on the program office’s behalf, including  (1) clearly defining roles and responsibilities for both the program office  and all agencies managing US-VISIT–related contracts; (2) having current,  reliable, and timely information on the full scope of contract actions and  activities; and (3) defining and implementing steps to verify that  deliverables meet requirements.
Require, through agreements, that agencies managing contract actions on  the program office’s behalf implement effective contract management  practices consistent with acquisition guidance for all US-VISIT contract  actions, including, at a minimum, (1) establishing and maintaining a plan  for performing contract management activities; (2) assigning responsibility  and authority for performing contract oversight; (3) training the people  performing contract oversight; (4) documenting the contract; (5) verifying  that deliverables satisfy requirements; (6) monitoring contractor-related  risk; and (7) monitoring contractor performance to ensure that the  contractor is meeting schedule, effort, cost, and technical performance  requirements.
Require DHS and non-DHS agencies that manage contracts on behalf of  the program to (1) clearly define and delineate US-VISIT work from non- US-VISIT work as performed by contractors; (2) record, at the contract  level, amounts being billed and expended on US-VISIT–related work so  that these can be tracked and reported separately from amounts not for  US-VISIT purposes; and (3) determine if they have received  reimbursement from the program for payments not related to US-VISIT  work by contractors, and if so, refund to the program any amount received  in error.
Ensure that payments to contractors are timely and in accordance with the  Prompt Payment Act.
section_title: Agency Comments and Our Evaluation
paragraphs: We received written comments on a draft of this report from DHS, which  were signed by the Director, Departmental GAO/IG Liaison Office, and are  reprinted in appendix II. We also received comments from the Director of  AERC and the Assistant Commissioner for Organizational Resources,  Public Buildings Service, GSA. Both the Department of Defense audit  liaison and the GSA audit liaison requested that we characterize these as  oral comments.
In its written comments, DHS stated that although it disagreed with some  of our assessment, it agreed with many areas of the report and concurred  with our recommendations and the need for improvements in US-VISIT  contract management and oversight. The department disagreed with  certain statements and provided additional information about three  examples of financial management weaknesses in the report. Summaries  of DHS’s comments and our response to each are provided below.
The department characterized as misleading our statements that US-VISIT  (1) depended on other agencies to manage financial matters for their  respective contracts and (2) relied on another agency for US-VISIT’s own  financial management support. With respect to the former, DHS noted that  the decision to use other agencies was based on the nature of the services  that were required, which it said were outside the scope of the program  office’s areas of expertise. We understand the rationale for the decision to  use other agencies, and the statement in question was not intended to  suggest anything more than that such a decision was made. We have  slightly modified the wording to avoid any misunderstanding.
With respect to its own financial management, DHS said that for us to  declare that US-VISIT depended on another agency for financial  management support without identifying the agency and the system, in  combination with our acknowledging that we did not examine the  effectiveness of this unidentified system, implies that our report’s scope is  broader than what our congressional clients asked us to review. We do not  agree. First, our report does identify ICE as the agency that the program  office relies on for financial management support. Second, although we  did not identify by name the ICE financial management system, we did  describe in detail the serious financial management challenges at ICE,  which have been reported repeatedly by the department’s financial  statement auditors and which have contributed to the department’s  inability to obtain a clean audit opinion. Moreover, we fully attributed  these statements about these serious challenges to the auditors.
The department said that our statement regarding the purpose of the  contracts managed by AERC needed to be clarified, stating that our report  reflects the scope of the two contract actions reviewed and not the  broader scope of services under the interagency agreement. We agree that  the description of AERC services in our report is confined to the scope of  the two contract actions that we reviewed. This is intentional on our part  since the scope of our review did not extend to the other services. We  have modified the report to clarify this.
The department provided additional information about three examples of  invoice discrepancies and improper payments cited in the report,  including reasons why they occurred. Specifically, the department said  that the reason that CBP reported a 2002 contracting action as also a 2004  contracting action was because of the concurrent merger of CBP within  DHS and the implementation of CBP’s new financial system. It further  stated that the reason that US-VISIT made a duplicate payment to the  prime contractor was, at least partially, due to poor communication  between US-VISIT and its finance center. Regarding two other duplicate  payments, DHS stated that while the cause of the duplicate payments is  not completely clear from the available evidence, both are almost certainly  errors resulting from processes with significant manual components, as  opposed to deliberate control overrides, since adequate funds were  available in the correct accounts for each case. The department also noted  that communications may have also contributed to one of these two  duplicate payments. We do not question the department’s reasons or the  additional information provided for the other payments, but neither  changes our findings about the invoice discrepancies and improper  payments.
The department stated that although the contractor initially identified the  AERC overpayment on September 13, 2005, the US-VISIT program office  independently identified the billing discrepancy on November 1, 2005, and  requested clarification from AERC the following day. The department  further stated that because we describe the overpayment example in the  report as being a small dollar value, we should have performed a  materiality test in accordance with accounting principles in deciding  whether the overpayment should be disclosed in a public report.  We do not dispute whether the US-VISIT program independently identified  the overpayment in question. Our point is that an invoice overpayment  occurred because adequate controls were not in place. In addition, while  we agree that materiality is relevant to determining whether to cite an  example of an improper payment, another relevant consideration to  significance is the frequency of the error. Our decision to disclose this  particular overpayment was based on our judgment regarding the  significance of the error as defined in generally accepted government  auditing standards. It is our professional judgment that this overpayment  is significant because of the frequency with which it occurred. Specifically,  of the eight invoices that we reviewed, four were improperly paid.
In oral comments, the Director of AERC questioned the applicability of the  criteria we used to evaluate AERC contract management practices and our  assessment of its process for verifying and accepting deliverables. Despite  these disagreements, he described planned corrective actions to respond  to our findings.
The Director stated in general that the Capability Maturity Model  Integration (CMMI)® model was not applicable to the contracts issued by  the Corps of Engineers, and in particular that a contract oversight plan  was not applicable to the two contract actions that we reviewed. In  addition, the Director commented that AERC’s practices were adequate to  deal appropriately with contractor performance issues had these been  raised. Nonetheless, to address this issue, the Director stated that AERC  would require the US-VISIT program office to submit an oversight plan  describing the project’s complexity, milestones, risks, and other relevant  information, and it would appoint qualified CORs or COTRs to implement  the plans and monitor contractor performance.
We disagree with AERC’s comments on the applicability of our criteria.  Although the CMMI model was established to manage IT software and  systems, the model’s practices are generic and therefore applicable to the  acquisition of any good or service. Specifically, the contractor  management oversight practices discussed in this report are intended to  ensure that the contractor performs the requirements of the contract, and  the government receives the services and/or products intended within cost  and schedule. We also do not agree that the contract actions in question  did not warrant oversight plans. Although the content of oversight plans  may vary (depending on the type, complexity, and risk of the acquisition),  each acquisition should have a plan that, at a minimum, describes the  oversight process, defines responsibilities, and identifies the contractor  evaluations and reviews to be conducted. Since the chances of effective  oversight occurring are diminished without documented plans, we support  the program manager’s commitment to require these plans in the future.
Regarding an overpayment discussed in our report, the Director indicated  that this problem was resolved as described in DHS’s comments, and that  in addition, AERC has procedures and controls to prevent the government  from paying funds in excess on a firm-fixed price contract such as the one  in question. Nonetheless, the Director described plans for strengthening  controls over contract progress payments and invoices, including having  trained analysts review all invoices and ensuring that a program/project  manager has reviewed the invoices and submitted written authorization to  pay them. The Director also stated that AERC has an established process  for controlling and paying invoices, which provides for verifying and  accepting deliverables. We do not consider that the AERC process was  established because although AERC officials described it to us, it was  neither documented nor consistently followed. For example, one  contracting action that we reviewed had three invoices that did not have a  signature or other documentation of approval, even though such approval,  according to AERC, is a required part of the process.
In oral comments, the GSA Assistant Commissioner disagreed with the  applicability of certain of the criteria that we used in our assessment, as  well as with our assessment that these and other criteria had not been met.  For example, the Assistant Commissioner stated that regulations or  policies do not require GSA to establish and maintain a plan for  performing the contract oversight process, that its current practices and  documents (such as the contract statement of work and COR/COTR  delegation letters) in effect establish and maintain such a plan, that GSA  documented the oversight process and results to the extent necessary to  ensure contractor performance, and that GSA had established a  requirement to conduct contractor reviews. Although, as we state in our  report, GSA policies do not include a requirement for an oversight plan,  we still believe that it is appropriate to evaluate GSA against this practice  (which is consistent with sound business practices and applies to any  acquisition), and that GSA’s processes and activities did not meet the  criteria for this practice and ensure effective oversight of the contracts.  We did not find that the delegation letters and contract statements of work  were sufficient substitutes for such plans, because, for example, they do  not consistently describe the contractor oversight process or contractor  reviews. Further, the inclusion of a requirement for contractor reviews in  some contracts/statements of work does not constitute agencywide  policies and procedures for performing reviews on all contracts.
GSA also provided further descriptions of its financial management  controls and oversight processes and activities, but these descriptions did  not change our assessment of GSA’s financial management controls or the  extent to which the oversight processes and activities satisfy the practices  that we said were not established or not consistently implemented.  Among these descriptions was information on an automated tool that GSA  provided its contracting officers; however, this tool was not used during  the period under review. GSA also provided certain technical comments,  which we have incorporated in our report, as appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to the  Chairmen and Ranking Minority Members of the Senate and House  Appropriations Committees, as well as to the Chairs and Ranking Minority  Members of other Senate and House committees that have authorization  and oversight responsibility for homeland security. We will also send  copies to the Secretary of Homeland Security, the Secretary of Defense,  the Administrator of GSA, and the Director of OMB. Copies of this report  will also be available at no charge on our Web site at http://www.gao.gov.
Should your offices have any questions on matters discussed in this report,  please contact Randolph C. Hite at (202) 512-3439 or at hiter@gao.gov, or  McCoy Williams at (202) 512-9095 or at williamsm1@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this report. Key contributors to this report are  listed in appendix IV.
section_title: Appendix I: Objective, Scope, and Methodology
paragraphs: Our objective was to determine whether the Department of Homeland  Security (DHS) has established and implemented effective controls for  managing and overseeing contracts related to the U.S. Visitor and  Immigrant Status Indicator Technology (US-VISIT) program. To address  our objective, we assessed the implementation of key contractor  management controls at the program office and at other DHS and non- DHS agencies responsible for managing US-VISIT–related contracts. We  also evaluated the program office’s oversight of US-VISIT–related  contracts managed by these other organizations. Finally, we reviewed  internal control processes and procedures in place over contract financial  management.
Besides the US-VISIT program office, the organizations within DHS that  we identified as having responsibility for managing US-VISIT–related  contracts were    Customs and Border Protection (CBP),  the Transportation Security Agency (TSA), and Immigration and Customs Enforcement (ICE).
The non-DHS agencies performing work in support of US-VISIT were  the General Services Administration (GSA) and the Army Corps of Engineers Architect-Engineer Resource Center (AERC).
Contract management controls: To assess key contract management  controls and implementation of those controls at US-VISIT and other  agencies responsible for managing US-VISIT–related contracts, we  identified leading public and private sector practices on contract  management, such as those prescribed by the Federal Acquisition  Regulation (FAR) and Carnegie Mellon University’s Software Engineering  Institute, which publishes the Capability Maturity Model Integration.  US-VISIT officials identified the contracts being managed by the program,  all within the Acquisition Program Management Office (APMO). To  evaluate the management of the program’s contracts, we assessed APMO’s  and other agencies’ documented policies against the leading practices that  we identified. We also determined the extent to which those policies were  applied to specific contracting actions and determined the extent to  which, if any, other formal or otherwise established practices were used to  manage or oversee the specific contract actions. We also discussed any  variances with agency officials to determine the reasons why those  variances existed.
In determining the extent to which practices/subpractices were judged to  be established/implemented, we categorized them into one of the  following:    not established/implemented.
We judged whether the practice was established, partially established, or  not established depending on whether the agency had documented  policies and procedures addressing the practice and all, some, or none of  the subpractices (where applicable). We judged whether a practice was  implemented, partially implemented, or not implemented on the basis of  documentation demonstrating that the practice and all, some, or none of  the subpractices (where applicable) had been implemented for the  contracting actions that we reviewed.
We judged that an agency had “partially established” the requirement for a  practice or subpractice if the agency relied only on the FAR requirement  to perform this activity, but did not establish a process (i.e., documented  procedures) for how the FAR requirement was to be met.
We judged that an agency had “partially implemented” a practice or  subpractice if it had implemented some, but not all, facets of the practice  (including its own related requirements for that practice).
To select specific contracting actions for review, we analyzed  documentation provided by the program and by the DHS and non-DHS  agencies responsible for managing US-VISIT–related contracts, to identify  all contracting work performed in support of the program.
Program officials were unable to validate the accuracy, reliability, and  completeness of the list of contracting actions. Therefore, we did not  perform a statistical sampling of the identified contracting actions. Rather,  we judgmentally selected from each agency one contracting action for US- VISIT–related work awarded in each fiscal year from March 1, 2002,  through March 31, 2005, focusing on service-based contracts. Thus, fiscal  years 2002 through 2005 were each reviewed to some extent. Not all  organizations awarded contracting actions in every fiscal year covered  under our review, in which case an action was not selected for that fiscal  year for that organization. The contracting actions selected from ICE were  excluded in our analysis of the implementation of management and  financial controls because of delays in receiving contract-specific  documentation. One program management contract that was reported to  us by US-VISIT was transferred to the program from ICE shortly before the  end of our review period, and so we were unable to determine, because of  the issues with ICE identified above, what management activities were  performed on the contract.
For each selected contracting action, we reviewed contract  documentation, including statements of work, project plans, deliverable  reviews, and other contract artifacts, such as contractor performance  evaluations. We then compared documentary evidence of contract  management activity to leading practices and documented policies, plans,  and practices. Finally, we determined what, if any, formal or established  oversight practices were in existence at the contract level.
Table 5 shows the judgmental selection of contract actions that were  reviewed for each agency, including APMO.
Contract oversight controls: To assess the program’s oversight of  program-related contracts, we used DHS guidance pertaining to intra- and  intergovernmental contracting relationships, as well as practices for  oversight developed by us. We met with program office officials to  determine the extent to which the program office oversaw the  performance of US-VISIT–related contracts and identified the  organizations performing work in support of the program (as listed  earlier). We met with these organizations to determine the extent to which  the program office interacted with them in an oversight capacity.
Financial management controls: To assess internal control processes  and procedures in place over contract financial management, we reviewed  authoritative guidance on contract management found in the following:    our Policy and Procedures Manual for Guidance of Federal Agencies,  Title 7—Fiscal Guidance;   Office of Management and Budget (OMB) Revised Circular A-123,  Management’s Responsibility for Internal Control; and   OMB Revised Circular A-76, Performance of Commercial Activities.
We also reviewed DHS’s performance and accountability reports for fiscal  years 2003, 2004, and 2005, including the financial statements and the  accompanying independent auditor’s reports, and we reviewed other  relevant audit reports issued by us and Inspectors General. We  interviewed staff of the independent public accounting firm responsible  for auditing ICE and the DHS bureaus for which ICE provides accounting  services (including US-VISIT).
We obtained the congressionally approved budgets for US-VISIT work and  other relevant financial information. For each of the contracting actions  selected for review, listed above, at US-VISIT, AERC, GSA, CBP, and TSA,  we obtained copies of available invoices and related review and approval  documentation. We reviewed the invoice documentation for evidence of  compliance with our Standards for Internal Control in the Federal  Government and Internal Control Management and Evaluation Tool.Specifically, we reviewed the invoices for evidence of the performance of  certain control activities, including the following: review and approval  before payment by a contracting officer, contracting officer’s technical  representative, and other cognizant officials; reasonableness of expenses  billed (including travel) and their propriety in relation to US-VISIT;  payment of the invoice in the proper amount and to the correct vendor;  payment of the invoice from a proper funding source; and payment of the  invoice within 30 days as specified by the Prompt Payment Act. We also  reviewed the invoices for compliance with requirements of the specific  contract provisions for which they were billed. We did not review invoice  documentation for the selected contracting actions managed by ICE,  because ICE did not provide us with invoice documentation for all  requested contracts in time to meet fieldwork deadlines.
We also obtained copies of invoices paid through July 2005 and available  payment review and approval documentation on the prime contract from  the ICE finance center. We reviewed this documentation for evidence of  execution of internal controls over payment approval and processing. In  addition, we performed data mining procedures on the list of payments  from APMO for unusual or unexpected transactions. Based on this  analysis, we chose a judgemental selection of payments and reviewed their  related invoice and payment approval documentation.
We interviewed agency officials involved with budgeting, financial  management, contract oversight, and program management at the program  office, ICE, CBP, TSA, AERC, and GSA. We obtained and reviewed DHS  and US-VISIT policies, including  the DHS Acquisition Manual;    US-VISIT Contract Management and Administration Plan;    US-VISIT Acquisition Procedures Guide (APG-14)—Procedures for Invoice    DHS Management Directive 0710.1 (Reimbursable Agreements); and    CBP and ICE’s standard operating procedures regarding financial  activities.
We also interviewed representatives from the prime contractor to  determine how they track certain cost information and invoice the  program. In addition, we observed how requisitions and obligations are set  up in the financial management system used by the program.
We observed invoice processing and payment procedures at the CBP and  ICE finance centers, the two major finance centers responsible for  processing payments for program-related work. From the CBP finance  center, we obtained data on expenditures for US-VISIT–related work made  by CBP from fiscal year 2003 through fiscal year 2005. From the ICE  finance center, which processes payments for the program office, we  obtained a list of payments made by US-VISIT from August 2004 through  July 2005. We did not obtain this level of detail for expenditures at AERC  and GSA because these agencies are external to DHS; therefore we do not  report on the reliability of expenditure reporting by either agency.
From ICE’s finance center, we also obtained and reviewed a list of Intra- governmental Payment and Collection system transactions paid by the US- VISIT program office to its federal trading partners through September 30,  2005. We requested a list of expenditures on program-related contracts  managed by ICE; however, ICE was unable to provide a complete, reliable  list. Officials at ICE’s Debt Management Center, however, did provide a list  of ICE’s interagency agreements related to US-VISIT.
In assessing data reliability, we determined that the available data for this  engagement were not sufficiently reliable for us to conduct statistical  sampling or to base our conclusions solely on the data systems used by the  program and other agencies managing US-VISIT–related contracts.  Specifically, the contracting actions managed by the program office and  these agencies were self-reported and could not be independently  validated. Further, recent audit reports found that the financial system  used by the program office and ICE was unreliable, and because of the  system, among other reasons, the auditors could not issue an opinion on  DHS’s fiscal year 2004 and 2005 financial statements. Our conclusions,  therefore, are based primarily on documentary reviews of individual  contracting actions and events, and our findings cannot be projected in  dollar terms to the whole program.
We conducted our work at    DHS finance centers in Dallas, Texas and Indianapolis, Indiana;    CBP facilities in Washington, D.C., and Newington, Virginia;  ICE facilities in Washington, D.C.;   TSA facilities in Arlington, Virginia;  the US-VISIT program offices in Rosslyn, Virginia; and   GSA and AERC facilities in Ft. Worth, Texas.
Our work was conducted from March 2005 through April 2006, in  accordance with generally accepted government auditing standards.
section_title: Appendix II: Comments from the Department of Homeland Security
section_title: Appendix III: Detailed Agency Evaluations
subsections: section_title: Staff Acknowledgments
paragraphs: In addition to the contacts named above, the following people made key  contributions to this report: Deborah Davis, Assistant Director; Casey  Keplinger, Assistant Director; Sharon Byrd; Shaun Byrnes; Barbara Collier;  Marisol Cruz; Francine Delvecchio; Neil Doherty; Heather Dunahoo; Dave  Hinchman; James Houtz; Stephanie Lee; David Noone; Lori Ryza; Zakia  Simpson; and Charles Youman.