Department of Homeland Security: Progress Made in Implementation of Management Functions, but More Work Remains
Published: 2008-04-09T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Department of Homeland Security (DHS) began operations in March 2003 with missions that include preventing terrorist attacks from occurring within the United States, reducing U.S. vulnerability to terrorism, minimizing damages from attacks that occur, and helping the nation recover from any attacks. GAO has reported that the implementation and transformation of DHS is an enormous management challenge. GAO's prior work on mergers and acquisitions found that successful transformations of large organizations, even those faced with less strenuous reorganizations than DHS, can take at least 5 to 7 years to achieve. This testimony addresses (1) the progress made by DHS in implementing its management functions; and (2) key issues that have affected the department's implementation efforts. This testimony is based on GAO's August 2007 report evaluating DHS's progress between March 2003 and July 2007; selected reports issued since July 2007; and GAO's institutional knowledge of homeland security and management issues.
section_title: What GAO Found
paragraphs: Within each of its management areas--acquisition, financial, human capital, information technology, and real property management--DHS has made some progress, but has also faced challenges. DHS has recognized the need to improve acquisition outcomes and taken some positive steps to organize and assess the acquisition function, but continues to lack clear accountability for the outcomes of acquisition dollars spent. The department also has not fully ensured proper oversight of its contractors providing services closely supporting inherently government functions. DHS has designated a Chief Financial Officer and taken actions to prepare corrective action plans for its internal control weaknesses. However, DHS has been unable to obtain an unqualified audit opinion of its financial statements, and for fiscal year 2007 the independent auditor identified significant deficiencies in DHS's internal control over financial reporting. DHS has taken actions to implement its human capital system by, for example, issuing a departmental training plan and human capital operational plan. Among other things, DHS still needs to implement a human capital system linked to its strategic plan, establish a market-based and more performance-oriented pay system, and seek more routine feedback from employees. DHS has taken actions to develop information technology management controls, such as developing an information technology human capital plan and developing policies to ensure the protection of sensitive information. However, DHS has not yet fully implemented a comprehensive information security program or a process to effectively manage information technology investments. DHS has developed an Asset Management Plan and established performance measures consistent with Federal Real Property standards. However, DHS has yet to demonstrate full implementation of its Asset Management Plan or full use of asset management inventory information. Various cross-cutting issues have affected DHS's implementation efforts. For example, DHS has not yet updated its strategic plan and put in place structures to help it manage for results. Accountability and transparency are critical to effectively implementingDHS's management functions. GAO has experienced delays in obtaining access to needed information from DHS, though over the past year, GAO's access has improved. GAO is hopeful that planned revisions to DHS's guidance for working with GAO will streamline our access to documents and officials. DHS's 5 year anniversary provides an opportunity for the department to review how it has matured as an organization. As part of our broad range of work, GAO will continue to assess DHS's progress in addressing high-risk issues. In particular, GAO will continue to assess the progress made by the department in its transformation efforts and whether any progress made is sustainable over the long term.

section_title: Letter
paragraphs: I appreciate the opportunity to appear today to discuss the Department of  Homeland Security’s (DHS) efforts to implement its management  functions. DHS began operations in March 2003 with missions that include  preventing terrorist attacks from occurring within the United States,  reducing U.S. vulnerability to terrorism, minimizing damages from attacks  that occur, and helping the nation recover from any attacks. The  department has initiated and continued the implementation of various  policies and programs to address these missions as well as its  nonhomeland security functions. DHS has also taken a number of actions  designed to integrate its management functions and to transform its  component agencies into an effective cabinet-level department. Prior to  the creation of DHS, we testified on whether the reorganization of  government agencies might better address the nation’s homeland security  needs. At that time, we identified that the nation had a unique opportunity  to create an effective and performance-based organization to strengthen  the nation’s ability to protect its borders and citizens. We noted that the  magnitude of the challenges that the new department would face would  require substantial time and effort to overcome, and that the  implementation of the new department would be extremely complex.
In 2003, we designated the implementation and transformation of DHS as  high risk because it represented an enormous undertaking that would  require time to achieve in an effective and efficient manner. We further  identified that the components that became part of the department already  faced a wide array of existing challenges, and any failure to effectively  carry out its mission would expose the nation to potentially serious  consequences. In designating the implementation and transformation of  DHS as high risk, we noted that building an effective department would  require consistent and sustained leadership from top management to  ensure the needed transformation of disparate agencies, programs, and  missions into an integrated organization. Our prior work on mergers and  acquisitions, undertaken before the creation of DHS, found that successful  transformations of large organizations, even those faced with less  strenuous reorganizations than DHS, can take at least 5 to 7 years to  achieve.
In August 2007, we reported on the progress DHS had made since its  inception in implementing its management and mission functions. We  identified specific actions that DHS was to achieve based on legislation,  homeland security presidential directives, DHS strategic planning  documents, and other sources, and reported on the progress the  department made in implementing these actions.
My testimony today addresses (1) the progress made by DHS in  implementing its management functions in the areas of acquisition,  financial, human capital, information technology, and real property  management; and (2) key issues that have affected the department’s  implementation efforts. My statement is based on the results of our August  2007 report evaluating the extent to which DHS has achieved  congressional and Administration expectations set out for them in its  management and mission areas; selected products we issued on DHS since  July 2007; and our institutional knowledge of homeland security and  various government organizational and management issues. For our  August 2007 report on DHS progress, we conducted our work from  September 2006 to July 2007. In April 2008, we updated this work with  selected reports. We conducted our work in accordance with generally  accepted government auditing standards. Those standards require that we  plan and perform the audit to obtain sufficient, appropriate evidence to  provide a reasonable basis for our findings and conclusions based on our  audit objectives. We believe that the evidence obtained provides a  reasonable basis for our findings and conclusions based on our audit  objectives.
subsections: section_title: Background
paragraphs: In July 2002, President Bush issued the National Strategy for Homeland  Security. The strategy set forth overall objectives to prevent terrorist  attacks within the United States, reduce America’s vulnerability to  terrorism, and minimize the damage and assist in the recovery from  attacks that occur. The strategy further identified a plan to strengthen  homeland security through the cooperation and partnering of federal,  state, local, and private sector organizations on an array of functions. It  also specified a number of federal departments, as well as nonfederal  organizations, that have important roles in securing the homeland, with  DHS having key responsibilities in implementing established homeland  security mission areas. This strategy was updated and reissued in October  2007.
In November 2002, the Homeland Security Act of 2002 was enacted into  law, creating DHS. The act defined the department’s missions to include  preventing terrorist attacks within the United States; reducing U.S.  vulnerability to terrorism; and minimizing the damages, and assisting in  the recovery from, attacks that occur within the United States. The act  further specified major responsibilities for the department, including the  analysis of information and protection of infrastructure; development of  countermeasures against chemical, biological, radiological, and nuclear,  and other emerging terrorist threats; securing U.S. borders and  transportation systems; and organizing emergency preparedness and  response efforts. DHS began operations in March 2003. Its establishment  represented a fusion of 22 federal agencies to coordinate and centralize  the leadership of many homeland security activities under a single  department.
We have evaluated many of DHS’s management functions and programs  since the department’s establishment, and have issued over 400 related  products. In particular, in August 2007, we reported on the progress DHS  had made since its inception in implementing its management and mission  functions. We also reported on broad themes that have underpinned  DHS’s implementation efforts, such as agency transformation, strategic  planning, and risk management. Over the past five years, we have made  over 900 recommendations to DHS on ways to improve operations and  address key themes, such as to develop performance measures and set  milestones for key programs and implement internal controls to help  ensure program effectiveness. DHS has implemented some of these  recommendations, taken actions to address others, and taken other steps  to strengthen its mission activities and facilitate management integration.
section_title: DHS Has Made Progress in Implementing Its Management Functions, but Has Faced Challenges in Its Implementation Efforts
paragraphs: DHS has made progress in implementing its management functions in the  areas of acquisition, financial, human capital, information technology, and  real property management. Overall, DHS has made more progress in  implementing its mission functions—border security; immigration  enforcement; immigration services; and aviation, surface transportation,  and maritime security; for example—than its management functions,  reflecting an initial focus on implementing efforts to secure the homeland.  DHS has had to undertake these critical missions while also working to  transform itself into a fully functioning cabinet department—a difficult  undertaking for any organization and one that can take, at a minimum, 5 to  7 years to complete even under less daunting circumstances. As DHS  continues to mature as an organization, we have reported that it will be  important that it works to strengthen its management areas since the  effectiveness of these functions will ultimately impact its ability to fulfill  its mission to protect the homeland.
Acquisition Management. DHS’s acquisition function includes managing  and overseeing nearly $16 billion in acquisitions to support its broad and  complex missions, such as information systems, new technologies,  aircraft, ships, and professional services. DHS has recognized the need to  improve acquisition outcomes and taken some positive steps to organize  and assess the acquisition function, but continues to lack clear  accountability for the outcomes of acquisition dollars spent. A common  theme in our work on acquisition management is DHS’s struggle to provide  adequate support for its mission components and resources for  departmentwide oversight. DHS has not yet accomplished its goal of  integrating the acquisition function across the department. For example,  the structure of DHS’s acquisition function creates ambiguity about who is  accountable for acquisition decisions because it depends on a system of  dual accountability and cooperation and collaboration between the Chief  Procurement Officer (CPO) and the component heads. In June 2007, DHS  officials stated that they were in the process of modifying the lines of  business management directive, which exempts the Coast Guard and the  Secret Service from complying, to ensure that no contracting organization  is exempt. This directive has not yet been revised.
In September 2007, we reported on continued acquisition oversight issues  at DHS, identifying that the department has not fully ensured proper  oversight of its contractors providing services closely supporting  inherently government functions. The CPO has established a  departmentwide program to improve oversight; however, DHS has been  challenged to provide the appropriate level of oversight and management  attention to its service contracting and major investments, and we  continue to be concerned that the CPO may not have sufficient authority  to effectively oversee the department’s acquisitions. DHS still has not  developed clear and transparent policies and processes for all  acquisitions. Concerns have been raised about how the investment review  process has been used to oversee its largest acquisitions, and the  investment review process in still under revision. We have ongoing work  reviewing oversight of DHS’s major investments which follows-up on our  prior recommendations. Regarding the acquisition workforce, our work  and the work of the DHS IG has found acquisition workforce challenges  across the department; we have ongoing work in this area as well.
Financial Management. DHS’s financial management efforts include  consolidating or integrating component agencies’ financial management  systems. DHS has made progress in addressing financial management and  internal control weaknesses and has designated a Chief Financial Officer,  but the department continues to face challenges in these areas. However,  since its establishment, DHS has been unable to obtain an unqualified or  “clean” audit opinion on its financial statements. For fiscal year 2007, the  independent auditor issued a disclaimer on DHS’s financial statements and  identified eight significant deficiencies in DHS’s internal control over  financial reporting, seven of which were so serious that they qualified as  material weaknesses. DHS has taken steps to prepare corrective action  plans for its internal control weaknesses by, for example, developing and  issuing a departmentwide strategic plan for the corrective action plan  process and holding workshops on corrective action plans. While these are  positive steps, DHS and its components have not yet fully implemented  corrective action plans to address all significant deficiencies—including  the material weaknesses—identified by previous financial statement  audits. According to DHS officials, the department has developed goals  and milestones for addressing these weaknesses in its internal control  over financial reporting. Until these weaknesses are resolved, DHS will not  be in position to provide reliable, timely, and useful financial data to  support day-to-day decision making.
Human Capital Management. DHS’s key human capital management  areas include pay, performance management, classification, labor  relations, adverse actions, employee appeals, and diversity management.   DHS has significant flexibility to design a modern human capital  management system, and in October 2004 DHS issued its human capital  strategic plan. DHS and the Office of Personnel Management jointly  released the final regulations on DHS’s new human capital system in  February 2005. Although DHS intended to implement the new personnel  system in the summer of 2005, court decisions enjoined the department  from implementing certain labor management portions of the system. DHS  has since taken actions to implement its human capital system. In July  2005 DHS issued its first departmental training plan, and in April 2007, it  issued its Fiscal Year 2007 and 2008 Human Capital Operational Plan. This  plan identifies five department priorities—hiring and retaining a talented  and diverse workforce; creating a DHS-wide culture of performance;  creating high-quality learning and development programs for DHS  employees; implementing a DHS-wide integrated leadership system; and  being a model of human capital service excellence. DHS has met some of  the goals identified in the plan, such as developing a hiring model and a  communication plan. However, more work remains for DHS to fully  implement its human capital system. For example, DHS has not yet taken  steps to fully link its human capital planning to overall agency strategic  planning nor has it established a market-based and more performance- oriented pay system. DHS has also faced difficulties in developing and  implementing effective processes to recruit and hire employees. Although  DHS has developed its hiring model and provided it to all components, we  reported in August 2007 that DHS had not yet assessed components’  practices against the model. Furthermore, employee morale at DHS has  been low, as measured by the results of the 2006 U.S. Office of Personnel  Management Federal Human Capital Survey. DHS has taken steps to seek  employee feedback and involve them in decision making by, for example,  expanding its communication strategy and developing an overall strategy  for addressing employee concerns reflects in the survey results. In  addition, although DHS has developed a department-level training  strategy, it has faced challenges in fully implementing this strategy.
Information Technology Management. DHS’s information technology  management efforts should include:    developing and using an enterprise architecture, or corporate blueprint, as  an authoritative frame of reference to guide and constrain system  investments;    defining and following a corporate process for informed decision making  by senior leadership about competing information technology investment  options;    applying system and software development and acquisition discipline and  rigor when defining, designing, developing, testing, deploying, and  maintaining systems;    establishing a comprehensive, departmentwide information security  program to protect information and systems;    having sufficient people with the right knowledge, skills, and abilities to  execute each of these areas now and in the future; and    centralizing leadership for extending these disciplines throughout the  organization with an empowered Chief Information Officer.
DHS has undertaken efforts to establish and institutionalize the range of  information technology management controls and capabilities noted above  that our research and past work have shown are fundamental to any  organization’s ability to use technology effectively to transform itself and  accomplish mission goals. For example, DHS has organized roles and  responsibilities for information technology management under the Chief  Information Officer. DHS has also developed an information technology  human capital plan that is largely consistent with federal guidance and  associated best practices. In particular, we reported that the plan fully  addressed 15 and partially addressed 12 of 27 practices set forth in the  Office of Personnel Management’s human capital framework. However, we  reported that DHS’s overall progress in implementing the plan had been  limited. With regard to information technology investment management,  DHS has established a management structure to help manage its  investments. However, DHS has not always fully implemented any of the  key practices our information technology investment management  framework specifies as being needed to actually control investments.  Furthermore, DHS has developed an enterprise architecture, but we have  reported that major DHS information technology investments have not  been fully aligned with DHS’s enterprise architecture. In addition, DHS has  not fully implemented a comprehensive information security program.  While it has taken actions to ensure that its certification and accreditation  activities are completed, the department has not shown the extent to  which it has strengthened incident detection, analysis, and reporting and  testing activities.
Real Property Management. DHS’s responsibilities for real property  management are specified in Executive Order 13327, “Federal Real  Property Asset Management,” and include the establishment of a Senior  Real Property Officer, development of an asset inventory, and  development and implementation of an asset management plan and  performance measures. In June 2006, the Office of Management and  Budget upgraded DHS’s Real Property Asset Management Score from red  to yellow after DHS developed an Asset Management Plan, developed a  generally complete real property data inventory, submitted this inventory  for inclusion in the governmentwide real property inventory database, and  established performance measures consistent with Federal Real Property  Council standards. DHS also designated a Senior Real Property Officer.  However, in August 2007 we reported that DHS had yet to demonstrate full  implementation of its asset management plan and full use of asset  inventory information and performance measures in management decision  making.
section_title: Cross-cutting Issues Have Hindered DHS’s Implementation Efforts
paragraphs: Our work has identified various cross-cutting issues that have hindered  DHS’s progress in its management areas. We have reported that while it is  important that DHS continue to work to strengthen each of its core  management functions, it is equally important that these key issues be  addressed from a comprehensive, departmentwide perspective to help  ensure that the department has the structure and processes in place to  effectively address the threats and vulnerabilities that face the nation.  These issues include agency transformation, strategic planning and results  management, and accountability and transparency.
Agency Transformation. In 2007 we reported that DHS’s implementation  and transformation remained high risk because DHS had not yet  developed a comprehensive management integration strategy and its  management systems and functions⎯especially related to acquisition,  financial, human capital, and information technology management⎯were  not yet fully integrated and wholly operational. We have recommended,  among other things, that agencies on the high-risk list produce a corrective  action plan that defines the root causes of identified problems, identifies  effective solutions to those problems, and provides for substantially  completing corrective measures in the near term. Such a plan should  include performance metrics and milestones, as well as mechanisms to  monitor progress. In March 2008 we received a draft of DHS’s corrective  action plan and have provided the department with some initial feedback.  We will continue to review the plan and expect to be able to provide  additional comments on the plan in the near future.
Strategic Planning and Results Management. DHS has not always  implemented effective strategic planning efforts, has not yet issued an  updated strategic plan, and has not yet fully developed adequate  performance measures or put into place structures to help ensure that the  agency is managing for results. DHS has developed performance goals and  measures for some of its programs and reports on these goals and  measures in its Annual Performance Report. However, some of DHS’s  components have not developed adequate outcome-based performance  measures or comprehensive plans to monitor, assess, and independently  evaluate the effectiveness of their plans and performance. Since issuance  of our August 2007 report, DHS has begun to develop performance goals  and measures for some areas in an effort to strengthen its ability to  measures its progress in key management and mission areas. We  commend DHS’s efforts to measure its progress in these areas and have  agreed to work with the department to provide input to help strengthen  established measures.
Accountability and Transparency. Accountability and transparency are  critical to the department effectively integrating its management functions  and implementing its mission responsibilities. We have reported that it is  important that DHS make its management and operational decisions  transparent enough so that Congress can be sure that it is effectively,  efficiently, and economically using the billions of dollars in funding it  receives annually. We have encountered delays at DHS in obtaining  access to needed information, which have impacted our ability to conduct  our work in a timely manner. Since we highlighted this issue last year to  this subcommittee, our access to information at DHS has improved. For  example, TSA has worked with us to improve its process for providing us  with access to documentation. DHS also provided us with access to its  national level preparedness exercise. Moreover, in response to the  provision in the DHS Appropriations Act, 2008, that restricts a portion of  DHS’s funding until DHS certifies and reports that it has revised its  guidance for working with GAO. DHS has provided us with a draft  version of its revised guidance. We have provided DHS with comments on  this draft and look forward to continuing to collaborate with the  department.
section_title: Concluding Observations
paragraphs: DHS is now 5 years old, a key milestone for the department. Since its  establishment, DHS has had to undertake actions to secure the border and  the transportation sector and defend against, prepare for, and respond to  threats and disasters while simultaneously working to transform itself into  a fully functioning cabinet department. Such a transformation is a difficult  undertaking for any organization and can take, at a minimum, 5 to 7 years  to complete even under less daunting circumstances.
Nevertheless, DHS’s 5-year anniversary provides an opportunity for the  department to review how it has matured as an organization. As part of  our broad range of work reviewing DHS management and mission  programs, we will continue to assess in the coming months DHS’s progress  in addressing high-risk issues. In particular, we will continue to assess the  progress made by the department in its transformation and information  sharing efforts, and assessing whether any progress made is sustainable  over the long term. Further, as DHS continues to evolve and transform, we  will review its progress and performance and provide information to  Congress and the public on its efforts.
This concludes my prepared statement. I would be pleased to answer any  questions you and the Subcommittee Members may have.
section_title: GAO Contact and Staff Acknowledgments
paragraphs: For further information about this testimony, please contact Norman J.  Rabkin, Managing Director, Homeland Security and Justice, at 202-512- 8777 or rabkinn@gao.gov. Other key contributors to this statement were  Cathleen A Berrick, Anthony DeFrank, Rebecca Gambler, and Thomas  Lombardi.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. It may be reproduced and distributed in its entirety without further  permission from GAO. However, because this work may contain copyrighted images or  other material, permission from the copyright holder may be necessary if you wish to  reproduce this material separately.