Department of Homeland Security: Billions Invested in Major Programs Lack Appropriate Oversight
Published: 2008-11-18T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In fiscal year 2007, the Department of Homeland Security (DHS) obligated about $12 billion for acquisitions to support homeland security missions. DHS's major investments include Coast Guard ships and aircraft; border surveillance and screening equipment; nuclear detection equipment; and systems to track finances and human resources. In part to provide insight into the cost, schedule, and performance of these acquisitions, DHS established an investment review process in 2003. However, concerns have been raised about how well the process has been implemented--particularly for large investments. GAO was asked to (1) evaluate DHS's implementation of the investment review process, and (2) assess DHS's integration of the investment review and budget processes to ensure major investments fulfill mission needs. GAO reviewed relevant documents, including those for 57 DHS major investments (investments with a value of at least $50 million)--48 of which required department-level review through the second quarter of fiscal year 2008; and interviewed DHS headquarters and component officials.
section_title: What GAO Found
paragraphs: While DHS's investment review process calls for executive decision making at key points in an investment's life cycle--including program authorization--the process has not provided the oversight needed to identify and address cost, schedule, and performance problems in its major investments. Poor implementation of the process is evidenced by the number of investments that did not adhere to the department's investment review policy--of DHS's 48 major investments requiring milestone and annual reviews, 45 were not assessed in accordance with this policy. At least 14 of these investments have reported cost growth, schedule slips, or performance shortfalls. Poor implementation is largely the result of DHS's failure to ensure that its Investment Review Board (IRB) and Joint Requirements Council (JRC)--the department's major acquisition decision-making bodies--effectively carried out their oversight responsibilities and had the resources to do so. Regardless, when oversight boards met, DHS could not enforce IRB and JRC decisions because it did not track whether components took actions called for in these decisions. In addition, many major investments lacked basic acquisition documents necessary to inform the investment review process, such as program baselines, and two out of nine components--which manage a total of 8 major investments--do not have required component-level processes in place. DHS has begun several efforts to address these shortcomings, including issuing an interim directive, to improve the investment review process. The investment review framework also integrates the budget process; however, budget decisions have been made in the absence of required oversight reviews and, as a result, DHS cannot ensure that annual funding decisions for its major investments make the best use of resources and address mission needs. GAO found almost a third of DHS's major investments received funding without having validated mission needs and requirements--which confirm a need is justified--and two-thirds did not have required life- cycle cost estimates. At the same time, DHS has not conducted regular reviews of its investment portfolios--broad categories of investments that are linked by similar missions--to ensure effective performance and minimize unintended duplication of effort for investments. Without validated requirements, life-cycle cost estimates, and regular portfolio reviews, DHS cannot ensure that its investment decisions are appropriate and will ultimately address capability gaps. In July 2008, 15 of the 57 DHS major investments reviewed by GAO were designated by the Office of Management and Budget as poorly planned and by DHS as poorly performing.

section_title: Letter
paragraphs: Since it was established in 2003, the Department of Homeland Security  (DHS) has been responsible for integrating 22 federal agencies with  disparate missions into one department. In fiscal year 2007, DHS obligated  about $12 billion for acquisitions to support homeland security missions  including responding to threats and hazards to the nation and ensuring  safe and secure borders. DHS components and offices sponsor  investments, and this portfolio includes Coast Guard ships and aircraft;  border surveillance and screening equipment; nuclear detection  equipment; and systems to track finances and human resources. DHS  plans to spend over $60 billion to acquire and sustain such investments.
To help ensure these broad and complex acquisitions achieve the  department’s national security mission, DHS established two key  processes in 2003: investment review and budgeting. Where the budget  process is used to allocate resources for DHS acquisitions, the investment  review process is intended to provide departmental insight at key points in  an investment’s life cycle to assess the cost, schedule, and performance of  these acquisitions. However, concerns have been raised about how well  the investment review process has been defined and implemented— particularly for large investments—to achieve successful acquisition  outcomes. Weaknesses in the investment review process can have a  rippling effect on the budget process because these reviews are expected  to inform annual funding decisions for major investments. Since 2005,  DHS has been revising the investment review process and identified  completing this effort as a priority in its 2008 high-risk management plan.
Over this period, we have made a series of recommendations to DHS  aimed at strengthening its investment review process.
Because of the large commitment of resources for these investments, you  asked us to (1) evaluate DHS’s implementation of the investment review  process, and (2) assess DHS’s integration of the investment review and  budget processes to ensure major investments fulfill mission needs.
To conduct our work, we reviewed relevant GAO and DHS Inspector  General reports and DHS documents, such as management directives and  investment oversight guidance provided to components. We reviewed  decision memos and investment documents for all 57 level 1 and level 2  major investments identified by DHS. We specifically determined the level  of oversight provided for 48 of these major investments—those that  required department-level review from fiscal year 2004 through the second  quarter of fiscal year 2008. We compared DHS budget practices with GAO  and Office of Management and Budget (OMB) guidance on capital  programming principles. We also interviewed representatives of the Chief  Procurement Office (CPO), Chief Financial Office (CFO) and Chief  Information Office as well as nine DHS components and offices that  manage major investments. We conducted this performance audit from  September 2007 until November 2008 in accordance with generally  accepted government auditing standards. Those standards require that we  plan and perform the audit to obtain sufficient, appropriate evidence to  provide a reasonable basis for our findings and conclusions based on our  audit objectives. We believe that the evidence obtained provides a  reasonable basis for our findings and conclusions based on our audit  objectives. See appendix I for additional information on our scope and  methodology.
subsections: section_title: Background
paragraphs: DHS invests in a wide array of complex acquisitions to achieve its national  security mission. DHS components and offices sponsor investments to  address mission capability gaps and are the end-users of the developed  acquisitions. DHS has stated that the Undersecretary for Management, as  the Chief Acquisition Officer, is responsible for acquisition policy. The  purpose of DHS’s investment review and budget processes are to provide  oversight of these major investments. Specifically, DHS established the  investment review process in 2003 to help protect its major investments by  providing departmental oversight of major investments throughout their  life cycles and to help ensure that funds allocated for investments through  the budget process are being spent wisely, efficiently, and effectively. In  2005, we reported that this process adopted many acquisition best  practices that, if applied consistently, could help increase the chances for  successful outcomes. However, we noted that incorporating additional  program reviews and knowledge deliverables into the process could better  position DHS to make well-informed decisions. In 2007, we further  reported that DHS had not fully defined and documented policies and  procedures for investment management or fully implemented key  practices needed to control its information technology (IT) investments.
To strengthen DHS’s investment management capability, we  recommended that the department fully define and document project and  portfolio-level policies and procedures and implement key control  processes. In addition to the investment review process, the DHS budget  process serves as the framework for decision making for ongoing and  future DHS programs. The framework is cyclic, consisting of planning,  programming, budgeting, and execution phases that examine existing  program funding and link the funding to program performance to ensure  funds are expended appropriately and that they produce the expected  results and benefits.
The investment review process framework manages investment risk by  developing an organized, comprehensive, and iterative approach to  identifying; assessing; mitigating; and continuously tracking, controlling,  and documenting risk tailored to each project. The investment review  process has four main objectives: (1) identify investments that perform  poorly, are behind schedule, are over budget, or that lack capability, so  officials can identify and implement corrective actions; (2) integrate  capital planning and investment control with resource allocation and  investment management; (3) ensure that investment spending directly  supports DHS’s mission and identify duplicative efforts for consolidation;  and (4) ensure that DHS conducts required management, oversight,  control, reporting, and review for all major investments. The process  requires event-driven decision making by high-ranking executives at a  number of key points in an investment’s life cycle. The investment review  process provides guidance to components for all DHS investments, but it  requires formal department-level review and approval only for major  investments—those that are categorized as level 1 or 2 (see table 1).
The investment review process has two types of reviews: programmatic  and portfolio. Programmatic reviews are held at specific milestones and  require documentation and discussion commensurate with the  investment’s life cycle phase. These reviews contribute to the investment  review goal of identifying investments that perform poorly, are behind  schedule, are over budget, or that lack capability so officials can identify  and implement corrective actions. Portfolio reviews are designed to  identify efforts for consolidation and mission alignment by monitoring and  assessing broad categories of investments that are linked by similar  missions to ensure effective performance, minimization of overlapping  functions, and proper funding. The IRB and JRC are responsible for  reviewing, respectively, level 1 and level 2 investments at key milestone  decision points, but no less than annually, and provide strategic guidance  (see table 2). In addition to requiring department-level review, DHS policy  directs component heads to conduct appropriate management and  oversight of investments and establish processes to manage approved  investments at the component level.
The investment review process has three broad life cycle stages, covering  five investment phases and four decision points or milestones (see fig. 1).  In the preacquisition stage, gaps are to be identified and capabilities to  address them defined. In the first phase of the acquisition stage—concept  and technology development—requirements are to be established and  alternatives explored. In the next phase—capability development and  demonstration—prototypes are to be developed. In the final acquisition  phase, the assets are produced and deployed. With the high dollar  thresholds and inherent risk of level 1 and level 2 investments, IRB or JRC  approval at milestone decision points is important to ensure that major  investment performance parameters and documentation are satisfactorily  demonstrated before the investment transitions to the next acquisition  phase. IRB and JRC milestone reviews are not required once an  investment reaches the sustainment phase.
As designed, knowledge developed during each investment phase is to be  captured in key documents and is to build throughout the investment life  cycle. Performing the disciplined analysis required at each phase is critical  to achieving successful outcomes. The main goals of the first investment  phase, program initiation, are to determine gaps in capabilities and then  describe the capabilities to fill the gap—this information is then captured  in the mission needs statement. If the mission needs statement is  approved, the investment then moves to the concept and technology  development phase, which focuses both on setting requirements and  important baselines for managing the investment throughout its life cycle.  A key step in this phase is translating needs into specific operational  requirements, which are captured in the operational requirements  document. Operational requirements provide a bridge between the  functional requirements of the mission needs statement and the detailed  technical requirements that form the basis of the performance  specifications, which will ultimately govern development of the system.  Once the program has developed its operational requirements document,  it then uses these requirements to inform the development of its  acquisition program baseline, a critical document that addresses the  program’s critical cost, schedule, and performance parameters and is  expressed in measurable terms. See figure 2 for a description of the  documents.
The department’s budget policy has two main objectives: (1) articulate  DHS goals and priorities, and (2) develop and implement a program  structure and resource planning to accomplish DHS goals. DHS uses the  process to determine investment priorities and allocate resources each  year. The budget process emphasizes the importance of ensuring  investments expend funds appropriately and that investment performance  produces the expected benefits or results. IRB decisions and guidance  regarding new investments are to be reflected to the extent possible in any  iteration of the budget as appropriate. The Office of the Chief Financial  Officer (CFO) manages the budget process.
section_title: Lack of Adherence to the Investment Review Process Led to Oversight Being Seldom Applied to Support Successful Acquisition Outcomes
paragraphs: DHS has not effectively implemented or adhered to its investment review  process due to a lack of involvement by senior officials as well as limited  resources and monitoring; consequently, DHS has not identified and  addressed cost, schedule, and performance problems in many major  investments. Poor implementation largely rests on DHS’s inability to  ensure that the IRB and JRC effectively carried out their oversight  responsibilities. Of 48 major investments requiring department-level  review, 45 were not reviewed in accordance with the department’s  investment review policy, and 18 were not reviewed at all. In the absence  of IRB and JRC meetings, investment decisions were reached outside of  the required review process. Moreover, when IRB meetings were held,  DHS did not consistently enforce decisions that were reached because the  department did not track whether components and offices took the  actions required by the IRB. In addition, 27 major investments have not  developed or received DHS approval for basic acquisition documents  required to guide and measure the performance of program activities—and  the investment review process. Of those, over a third reported cost,  schedule, or performance breaches in fiscal year 2007 and second quarter  fiscal year 2008. According to DHS representatives, acquisition  management practices are still new to many components, and we found 24  investments lacked certified program managers needed to develop basic  acquisition documents. We found that two out of nine components do not  have required component-level review processes to adequately manage  their major investments. DHS has recognized these deficiencies and began  efforts in 2007 to clarify and better adhere to the investment review  process.
subsections: section_title: Most Major Investments Lacked Required Departmental Reviews and Many of Those Exceeded Cost Estimates
paragraphs: Of DHS’s 48 major investments requiring department-level review between  fiscal year 2004 and the second quarter of fiscal year 2008, only three had  all milestone and annual reviews. Of the 39 level 1 investments requiring  IRB review and approval to proceed to the next acquisition phase, as of  March 2008, 18 have never been reviewed by the IRB—4 of which have  already reached production and deployment. The remaining 21 level 1  investments received at least one milestone or annual review through the  investment review process. None of the 9 level 2 investments had JRC  review and approval. DHS policy provides that its major investments be  reviewed no less than yearly. However, in fiscal year 2007, the most  recent year for which data were available, only 7 of the 48 required annual  reviews were conducted. As a result, DHS lacked the information needed  to address cost, schedule, and performance deficiencies—a problem we  identified with over one-third of DHS’s major investments between fiscal  year 2007 and the second quarter of fiscal year 2008. In our prior work on  the Department of Defense (DOD), we found that when such reviews are  skipped or not fully implemented, programs build momentum and move  toward product development with little if any early department-level  assessment of the costs and feasibility. Committing to programs before  they have this knowledge contributes to poor cost, schedule, and  performance outcomes.
DHS level 1 investments that were never reviewed through the IRB  process include some of the department’s largest investments with  important national security objectives. For example, the Federal  Emergency Management Agency’s (FEMA) Consolidated Alert and  Warning System, which has estimated life-cycle costs of $1.6 billion,  includes programs to update the Emergency Alerting System and other  closely related projects. In 2007, we reported that FEMA faces technical,  training, and funding challenges to develop an integrated alert and warning  system. Customs and Border Protection’s (CBP) Secure Freight Initiative,  which has estimated life-cycle costs of $1.7 billion, is designed to test the  feasibility of scanning 100 percent of U.S.-bound cargo containers with  nonintrusive equipment and radiation detection equipment at foreign  seaports. Earlier this year, we reported that the Secure Freight Initiative  faces a number of challenges, including measuring performance outcomes,  logistical feasibility of some aspects of the investment, and technological  issues. While these two investments are still in the concept and  technology development phase, other major investments that have not  been reviewed are even further along in the investment life cycle—when  problems become more costly to fix. For example, CBP’s Western  Hemisphere Travel Initiative, with estimated life-cycle costs of $886  million, is in capability development and demonstration. The investment  aims to improve technologies to identify fraudulent documentation at U.S.  ports of entry. We recently reported that because key elements of planning  for the investment’s management and execution remain uncertain, DHS  faces challenges deploying technology, and staffing and training officers to  use it.
Reviews of the 9 level 2 investments—those with acquisition costs  between $50 million and $100 million, or $100 million to $200 million for  information technology—were similarly lacking. While the JRC met  periodically between fiscal years 2004 and 2006, senior officials stated that  it did not make approval decisions about any level 2 investments. As a  result, investments such as the following—which are all now in the  operations and support phase—were not reviewed and approved by the  JRC:    FEMA’s Total Asset Visibility, which has $91 million in estimated life-cycle  costs, aims to improve emergency response logistics in the areas of  transportation, warehousing, and distribution.
Transportation and Security Administration’s (TSA) Hazardous Threat  Assessment Program, which has $181 million in estimated life-cycle costs,  was developed to perform a security threat assessment on applicants for  licenses to transport hazardous materials.
The National Protection and Programs Directorate’s National Security and  Emergency Preparedness investment, which has $1.8 billion in estimated  life-cycle costs, aims to provide specially designed telecommunications  services to the national security and emergency preparedness  communities in the event of a disaster if conventional communication  services are ineffective.
During 2006, the JRC stopped meeting altogether after the chair was  assigned to other duties within the department. DHS representatives  recognized that since the JRC stopped meeting in 2006, there has been no  direction for requirements or oversight of level 2 investments at the  department level and that strengthening the JRC is a top priority. In the  meantime, oversight of level 2 investments has devolved to the  components.
Without the appropriate IRB and JRC milestone reviews, DHS loses the  opportunity to identify and address cost, schedule, and performance  problems and, thereby, minimize program risk. Fourteen of the  investments that lacked appropriate review through IRB and JRC  oversight experienced cost growth, schedule delays, and  underperformance—some of which was substantial. At least 8 investments  reported cost growth between fiscal year 2007 and the second quarter of  fiscal year 2008 (see table 3). Other programs experienced schedule delays  and underperformance. For example, CBP’s Automated Commercial  Environment program reported a 20 percent performance shortfall in the  first quarter of fiscal year 2008. Moreover, we reported in July 2008 that  the Coast Guard’s Rescue 21 program changed its acquisition baseline or  cost, schedule, and performance goals four times resulting in a total 182  percent cost growth and 5-year schedule slip.
DHS has acknowledged that the IRB and JRC have not conducted  oversight in accordance with DHS policy—largely because the process has  depended on direct involvement and availability of high-level leadership as  well as a lack of sufficient staff resources to organize the review meetings.  According to DHS representatives, the Deputy Secretary was unavailable  to commit to the time required to conduct reviews of all investments, so  only some major investments were reviewed. Our prior work shows that  this problem existed from the start. For example, in 2004, we reported that  DHS was having difficulty bringing all of its information technology  programs before the IRB in a timely manner. We reported in 2005 that key  stakeholders, such as the Chief Procurement Officer, did not receive  materials in time to conduct a thorough review and provide meaningful  feedback prior to investment review meetings and recommended that DHS  ensure that stakeholders, including CPO officials, have adequate time to  review investment submissions and provide formal input to decision- making review boards. Moreover, in 2007, we reported that DHS  investment boards did not conduct regular investment reviews and control  activities were not performed consistently across projects. DHS Chief  Procurement Office and Chief Financial Office representatives added that  the process was not adequately staffed to conduct annual reviews of  investments as required by the investment review policy. We have  previously recommended that DHS provide adequate resources, including  people, funding, and tools, for oversight of major investments. A 2007  DHS assessment of 37 major investments found that many investments are  awaiting senior management review. For example, FEMA’s major  investment, the flood map modernization program, requested a key  investment review decision meeting in 2004 that was subsequently  scheduled and cancelled in 2006. As a result, the program proceeded from  development to operations and support without IRB review or approval.
Because of these limitations, alternative approaches to obtaining decisions  were adopted. Numerous officials reported that rather than going through  the formal investment review process, in some cases DHS component  officials began to seek approval directly from the Deputy Secretary. For  example, in November 2006, the DHS Inspector General reported on the  CBP’s Secure Border Initiative program, noting that the investment  oversight processes were sidelined in the urgent pursuit of SBInet’s  aggressive schedule and that the IRB and JRC processes were bypassed  and key decisions about the scope of the program and the acquisition  strategy were made without rigorous review and analysis or  transparency. DHS officials indicated that some decisions were very  informal, based on conversations with the Deputy Secretary and without  input from other IRB members. In such cases, the investment review  process was bypassed, including consideration of supporting reviews and  recommendations. DHS CPO and CFO representatives said they did not  always know whether a decision had been made through this informal  process.
section_title: Many Programs Lack Required Cost, Schedule, and Performance Data Critical to Informing Investment Decisions
paragraphs: DHS investment review policy requires programs to develop specific  documentation that captures key knowledge needed to make informed  investment decisions. This approach is similar to DOD’s, which requires  adequate knowledge at critical milestones to reduce the risk associated  with each phase of the investment’s life cycle and enable program  managers to deliver timely, affordable, quality products. GAO’s work on  commercial best practices for major acquisitions has demonstrated that  this approach, if effectively implemented, can significantly improve  program outcomes. Our prior work has found that inadequate attention  to developing requirements results in requirements instability, which can  ultimately cause cost escalation, schedule delays, and fewer end items.
Many major DHS investments do not have basic acquisition information  required by investment review policy to guide and measure the  performance of program activities and the investment review process. In  particular, mission needs statements, operational requirements  documents, and acquisition program baselines establish capability gaps,  requirements needed to address gaps, and cost, schedule, and  performance parameters, respectively. As of March 2008, of the 57 level 1  and 2 investments, 34 were in a phase that required all three documents,  but 27 did not have or only provided an unapproved draft of one or more  of these documents (see appendix III for the investments lacking these  approved documents). Of the 27 investments, we found that over a third  reported cost, schedule, or performance breaches between fiscal year 2007  and second quarter fiscal year 2008. For example, the Infrastructure  Transformation program, which did not have an approved operational  requirements document or acquisition program baseline, reported being  up to 19 percent behind schedule in 2007. In another instance, the  Immigration and Customs Enforcement (ICE) Detention and removal  modernization program, which also lacked an approved operational  requirements document and acquisition program baseline, reported  schedule slippage of about 20 percent. Without required development and  review of key acquisition data, DHS cannot be sure that programs have  mitigated risks to better ensure good outcomes.
CPO representatives explained that department acquisition management  practices are new to many DHS components. For most investments, CPO  representatives said that program managers were not familiar with basic  acquisition documents and investment oversight staff had to work with  program managers to help them develop these documents prior to  investment reviews. In addition, we found that in fiscal year 2007, 24 major  investments did not have program managers certified by DHS as having  the required knowledge and skills to oversee complex acquisition  programs. Moreover, other factors such as pressure to get programs up  and running, additional external requirements, and technological  challenges also impact the ability to successfully manage acquisitions to  support good acquisition outcomes. At the same time, some component  officials said that they received insufficient and inconsistent guidance  regarding what information should be included in key acquisition  documents. This issue is long-standing. For example, we reported in 2005  that because of the small number of department oversight staff, only  limited support was provided to programs to assist them in completing  their submissions for oversight reviews. In addition, component officials  told us that key acquisition documents are sometimes approved at the  component level but are not reviewed and approved at the department  level. For example, TSA officials indicated that documents needed for the  Secure Flight and Passenger Screening Programs were approved by TSA  and submitted to DHS for approval, but no action was taken to review and  approve them.
section_title: Major Investments Move Forward without Addressing Deficiencies Identified in Reviews
paragraphs: The investment reviews that have been conducted have not always  provided the discipline needed to help ensure programs achieve cost,  schedule, and performance goals—even when a review identified  important deficiencies in an acquisition decision memorandum. DHS has  not routinely followed up on whether specific actions required by  acquisition decision memorandums to mitigate potential risks have been  implemented.
The IRB issued a 2004 acquisition decision memorandum approving the  U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT)—a  program that aims to facilitate travel and trade—to move into the  capability development and demonstration phase although the IRB found  the investment’s cost, schedule, and performance risk to be high. The  memorandum stated that more clarity was needed on the program’s end- state capability, benefits related to life-cycle costs, and how it planned to  transition to the operations and support phase. We reported that in 2006  DHS had yet to develop a comprehensive plan describing what the end- state capability would be, and how, when, and at what cost it would be  delivered. In a 2006 decision memorandum, the IRB again instructed US-  VISIT to address the end-state capability, by requiring a comprehensive  affordable exit plan for airports, seaports, and landports. We subsequently  reported that, as of October 2007, US-VISIT had yet to establish critical  investment management processes, such as effective project planning,  requirements management, and financial management, which are required  to ensure that program capabilities and expected mission outcomes are  delivered on time and within budget. In addition, DHS had not developed  capability for the other half of US-VISIT, even though it had allocated  about one-quarter of a billion dollars to this effort.
In a May 2006 decision memorandum, the IRB directed the Cargo  Advanced Automated Radiography System investment to develop within 6  months an acquisition program baseline, a concept of operations, and an  operational requirements document. It also called for the investment to be  reviewed annually. As of the second quarter of fiscal year 2008, a baseline  and the concept of operations had been drafted, according to program  officials. However, an operational requirements document had not been  developed even though a $1.3 billion contract had been awarded for the  investment. In addition, the Cargo Advanced Automated Radiography  System investment had not yet received a follow-on review by the IRB. In  another example, in a December 2006 decision memorandum, the IRB  directed ICE’s major investment Automation and Modernization to update  its acquisition program baseline, its cost-benefit analysis and its life-cycle  cost analysis. Automation and Modernization has since updated its  acquisition program baseline, but its cost analyses were last updated in  2005.
Current and former CPO and CFO representatives noted that staffing has  not been sufficient to review investments in a timely manner and conduct  follow-up to ensure decisions are implemented. They indicated that  support was needed to undertake a number of functions, including:  designing the investment review process, collecting and reviewing  investment documentation, preparing analyses to support investment  decisions, and organizing review meetings, as well as conducting follow-up  for major investments. According to DHS representatives, from 2004 to  2007 there were four full-time equivalent DHS employees plus support  from four contractors to fulfill those responsibilities. Many acquisition  decision memos provided specific deadlines for components to complete  action items, but according to CPO and CFO representatives IRB action  items were not tracked. Without follow-up, the IRB did not hold  components and major investment program offices accountable for  addressing oversight concerns.
section_title: Component-Level Review Processes Are Not Fully Developed to Ensure That Major Investments Receive Oversight
paragraphs: DHS’s investment review process requires that component heads establish  processes and provide the requisite resources to manage approved  investments adequately. Component heads are also responsible for  approving all level 3 and level 4 investments and ensuring they comply  with DHS investment review submission requirements. In the absence of  sufficient review at the department level, well-designed component-level  processes are particularly critical to ensuring that investments receive  some level of oversight. For example, CBP and TSA officials reported that  they relied on their component investment review processes to ensure  some level of oversight when the department did not review their  investments. However, for the nine components we reviewed, two did not  have a process in place and others had processes that were either in  development or not focused on the entire investment life cycle. For  example, the Domestic Nuclear Detection Office and the National  Protection and Programs Directorate did not have a formal investment  review process, meaning that in the absence of an IRB or JRC review, their  eight major investments received no formal review. While FEMA has a  process to manage contract-related issues, its review process does not  currently address the entire investment life cycle. According to CPO  representatives, the department is working with components to ensure  that components have a process in place to manage investments and to  have them designate an acquisition officer who is accountable for major  investments at the component level.
section_title: Gaps in Oversight Have Prompted DHS to Clarify the Investment Review Process
paragraphs: DHS has acknowledged that the investment review process has not been  fully implemented. In fact, the process has been under revision since 2005.  DHS has begun to make improvements to the planning, execution, and  performance of major investments as initial steps to clarify and better  adhere to the investment review process. To gain an understanding and  awareness of DHS’s major investments, in 2007 during the course of our  review, the Undersecretary for Management undertook an assessment of  37 major investments conducted under the CPO’s direction. The  assessment identified a range of systemic weaknesses in the  implementation of its investment review process and in the process itself.  The DHS assessment found    many level 1 investments await leadership decisions;    acquisition decision memos lack rigor;    a lack of follow-up and enforcement of oversight decisions;   inadequate technical support at the investment level; and    unclear accountability for acquisitions at the component level.
Many of the deficiencies identified are consistent with our findings. For  example, the DHS assessment of Citizenship and Immigration Services  (CIS) found that investments were either missing, or using draft or  unsigned versions of key investment management documents, limiting  DHS’s ability to measure the investments’ performance. In one case, DHS  found that the Verification Information Systems investment is poorly  defined. In another case, DHS reported that CIS’s investment  Transformation was using draft and unsigned acquisition documents,  including its mission needs statement, acquisition plan, and acquisition  program baseline. In 2007, we reported that: CIS had not finalized its  acquisition strategy for Transformation and cost estimates therefore  remain uncertain, plans do not sufficiently discuss enterprise architecture  alignment and expected project performance, and these gaps create risks  that could undermine Transformation’s success as it begins to implement  its plans. In addition, DHS found that CIS’s investment Customer Service  Web Portal did not have key investment management documents and that  the investment’s performance cannot be adequately assessed. Similarly,  DHS found that CIS’s investment Integrated Document Production did not  have performance measures or documentation that performance metrics  have been implemented to measure program cost, schedule, and  performance execution.
To address the findings of its 2007 review, DHS is taking steps to reiterate  the DHS investment review policy and establish a more disciplined and  comprehensive investment review process. Beginning in February 2008,  interim policies were issued by the Undersecretary for Management to  improve management of major investments pending release of a new  investment review management directive. Specifically, the Undersecretary  for Management issued a memorandum in February 2008 on initiating  efforts to improve the quality of acquisition program baselines for level 1  investments, and another in July 2008 on improving life-cycle cost  estimating for major investments. To help address the backlog of  investments awaiting review, the CPO has begun to review and issue  acquisition decision memorandums for each level 1 program. As of August  2008, acquisition decision memorandums had been completed for three  programs. The memorandums indicate documentation that must be  completed, issues that must be addressed, and related completion dates  before investment approval is given. The memorandums also identify any  limits or restrictions on the program until those actions are completed.  Further, the Undersecretary for Management signed an interim acquisition  management directive in November 2008 to improve acquisition  management and oversight pending results from a formal DHS executive  review.
section_title: DHS’s Investment Review and Budget Processes Are Not Integrated to Help Ensure That Major Investments Maximize Resources to Meet Mission Needs
paragraphs: DHS’s annual budget process for funding major investments has not been  appropriately informed by the investment review process—largely  because the IRB seldom conducts oversight reviews and when it has, the  two processes have not been aligned to better ensure funding decisions  fulfill mission needs. While DHS’s investment review framework integrates  the two processes—an approach similarly prescribed by GAO and OMB  capital planning principles—many major investments received funding  without determining that mission needs and requirements were justified.  In addition, two-thirds of DHS major investments did not have required  life-cycle cost estimates, which are essential to making informed budget  and capital planning decisions. At the same time, DHS has not conducted  regular reviews of its investment portfolios—broad categories of  investments—to ensure effective performance and minimize unintended  duplication of effort for proposed and ongoing investments. In July 2008,  more than one-quarter of DHS’s major investments were designated by  OMB as poorly planned and by DHS as poorly performing. The DHS  Undersecretary for Management has said that strengthening the links  between investment review and budget decisions is a top priority.
subsections: section_title: GAO and OMB Capital Planning Principles Emphasize an Integrated Investment Approach to Manage Risk and Costs
paragraphs: OMB and GAO capital planning principles underscore the importance of a  disciplined decision making and requirements process as the basis to  ensure that investments succeed with minimal risk and lowest life-cycle  cost. This process should provide agency management with accurate  information on acquisition and life-cycle costs, schedules, and  performance of current and proposed capital assets. The OMB Capital  Programming Guide also stresses the need for agencies to develop  processes for making investment decisions that deliver the right amount of  funds to the right projects.
In addition, OMB and GAO guidance provide that an investment review  policy should seek to use long-range planning and a disciplined, integrated  budget process for portfolio management to achieve performance goals at  the lowest life-cycle cost and least risk to the taxpayer and the  government. Investment portfolios are integrated, agencywide collections  of investments that are assessed and managed collectively based on  common criteria. Managing investments as portfolios is a conscious,  continuous, and proactive approach to allocating limited resources among  an organization’s competing initiatives in light of the relative benefits  expected from these investments. Our prior work at DOD has shown that  fragmented decision-making processes do not allow for a portfolio  management approach to make investment decisions that benefit the  organization as a whole. The absence of an integrated approach can  contribute to duplication in programs and equipment that does not operate  effectively together.
GAO best practices work also emphasizes that (1) a comprehensive  assessment of agency needs should be conducted, (2) current capabilities  and assets should be identified to determine if and where a gap may lie  between current and needed capabilities, and (3) a decision about how  best to meet the identified gap should be evaluated. The approved mission  needs statement must support the need for a project before the project can  proceed to the acquisition phase. OMB guidance states that in creating  capital plans, agencies should identify a performance gap between the  existing portfolio of agency assets and the mission need that is not filled  by the agency’s asset portfolio. Moreover, best practices indicate that  investment resources should match valid requirements before approval of  investments.
section_title: DHS Budget Decisions for Major Investments Have Generally Not Been Informed by Mission Needs and Life-Cycle Cost Estimates
paragraphs: The DHS investment review process calls for IRB decisions and program  guidance regarding new investments to be reflected to the extent possible  in the budget. The DHS budget process consists of overlapping planning,  programming, budgeting, and execution phases that examine existing  program funding and link funding to program performance to ensure funds  are expended appropriately and produce the expected results and benefits  (see fig. 3).
Annually, components submit resource allocation proposals for major  investments to the CFO for review in March and, in turn, resource  allocation decisions are provided to components in July. According to  CFO representatives, information from investment oversight reviews  would be useful to inform investment annual resource allocation  decisions. CFO representatives explained that the CFO sought to align  resource allocation decisions with the IRB approvals in 2006, but this was  not possible because of the erratic investment review meeting schedule.  As a result, a number of CFO and CPO representatives confirmed that  funding decisions for major investments have not been contingent upon  the outcomes of the investment review process.
One of the primary functions of the IRB is to review and approve level 1  investments for formal entry into the annual budget process. However, we  found that 18 of DHS’s 57 major investments did not have an approved  mission needs statement—a document that formally acknowledges that  the need is justified and supported. Specifically, the statement summarizes  the investment requirement, the mission or missions that the investment is  intended to support, the authority under which the investment was begun,  and the funding source for the investment. As such, approval of the  mission needs statement is required at the earliest stages of an investment.  Lacking information on which major investments have validated mission  needs, the CFO has allocated funds for major investments for which a  capability gap has not been established. We reported in 2007 that DHS  risked selecting investments that would not meet mission needs in the  most cost-effective manner. The 18 investments that lacked an approved  mission needs statement accounted for more than half a billion dollars in  estimated fiscal year 2008 appropriations (see table 4).
In addition, two thirds of major investment budget decisions were reached  without a life-cycle cost estimate. A life-cycle cost estimate provides an  exhaustive and structured accounting of all resources and associated cost  elements required to develop, produce, deploy, and sustain a particular  program. Life-cycle costing enhances decision making, especially in early  planning and concept formulation of acquisition and can support  budgetary decisions, key decision points, milestone reviews, and  investment decisions. GAO and OMB guidance emphasize that reliable  cost estimates are important for program approval and continued receipt  of annual funding. DHS policy similarly provides that life-cycle cost  estimates are essential to an effective budget process and form the basis  for annual budget decisions. However, 39 of the 57 level 1 and level 2  major DHS investments we reviewed did not have a life-cycle cost  estimate. Moreover, DHS’s 2007 assessment of 37 major investments also  found investments without life-cycle cost estimates and noted poor cost  estimating as a systemic issue. Without such estimates, DHS major  investments are at risk of experiencing cost overruns, missed deadlines,  and performance shortfalls. Cost increases often mean that the  government cannot fund as many programs as intended. To begin to  address this issue, the DHS Undersecretary for Management issued a  memo in July 2008 initiating an effort to review and improve the credibility  of life-cycle cost estimates for all level 1 investments prior to formal  milestone approval.
section_title: Lack of Portfolio Reviews Increases Risk of Duplication in DHS’s Major Investments
paragraphs: The JRC is responsible for managing the department’s level 1 and level 2  major investment portfolios and making portfolio-related  recommendations to the IRB. Managing investments as portfolios is a  continuous and proactive approach to allocating finite resources among an  organization’s competing initiatives in light of the relative benefits  expected from these investments. Taking a portfolio perspective allows an  agency to determine how its collective investments can optimally address  its strategic goals and objectives. As part of this responsibility, the JRC is  expected to identify crosscutting opportunities and overlapping or  common requirements and determine how best to ensure that DHS uses its  finite resources wisely in those areas. Specifically, the JRC reviews  investments to identify duplicative mission capabilities and to assess  redundancies. While a certain amount of redundancy can be beneficial,  our prior work has found that unintended duplication indicates the  potential for inefficiency and waste. The Enterprise Architecture Board  supports the JRC by overseeing the department’s enterprise architecture  and performing technical reviews of level 1 and level 2 IT investments. In  2007, we reported that DHS did not have an explicit methodology and  criteria for determining program alignment to the architecture. We  further reported that DHS policies and procedures for portfolio  management had yet to be defined, and as a result, control of the  department’s investment portfolios was ad hoc.
When it met regularly, the JRC played a key role in identifying several  examples of overlapping investments, including passenger screening  programs. Specifically, in March 2006, the JRC identified programs that  had potential overlaps, including TSA’s Secure Flight, TSA’s Registered  Traveler, and CBP’s Consolidated Registered Traveler programs, yet the  programs lacked coordination and were struggling with interoperability  and information sharing. Because the JRC stopped meeting soon  thereafter, DHS may have missed opportunities to follow up on these  cases or identify further cases of potential overlap. In 2007, we reported  that while TSA and CBP had begun coordinating efforts, they had yet to  align their passenger prescreening programs to identify potential overlaps  and minimize duplication. We recommended that DHS take additional  steps and make key policy and technical decisions that were necessary to  more fully coordinate these programs. TSA and CBP have since worked  with DHS to develop a strategy to align regulatory policies and coordinate  efforts to facilitate consistency across their programs. In another case,  we reported that CIS’s Transformation investment has been conducted in  an ad hoc and decentralized manner, and, in certain instances, is  duplicative with other IT investments.
DHS’s 2007 assessment of 37 major investments also identified potential  overlap and duplication of effort between investments. Overall the review  found that limited communication and coordination across components  led to overlapping DHS programs. For example, DHS found that the CIS  Verification Information System had potential duplication of requirements  implementation with National Protection and Program Directorate’s U.S.
Computer Emergency Readiness Team investment. In another instance,  DHS found the CIS Integrated Document Production investment had an  unclear relationship to other DHS credentialing investments.
section_title: Limited DHS Investment Oversight Has Led OMB to Designate Many DHS Programs as Poorly Planned and Poorly Performing
paragraphs: OMB requires all agencies including DHS to submit program justification  documents for major investments to inform both quantitative decisions  about budgetary resources consistent with the administration’s program  priorities, and qualitative assessments about whether the agency’s  programming processes are consistent with OMB policy and guidance. To  help ensure that investments of public resources are justified and that  public resources are wisely invested, OMB began using a Management  Watch List in the President’s fiscal year 2004 budget request as a means to  oversee the justification for and planning of agencies’ information  technology investments. This list was derived based on a detailed review  of each investment’s Capital Asset Plan and Business Case. In addition,  OMB has established criteria for agencies to use in designating high-risk  projects that require special attention from oversight authorities and the  highest levels of agency management. These projects are not necessarily at  risk of failure, but may be on the list because of one or more of the  following four reasons:    The agency has not consistently demonstrated the ability to manage  complex projects.
The project has exceptionally high development, operating, or  maintenance costs, either in absolute terms or as a percentage of the  agency’s total portfolio.
The project is being undertaken to correct recognized deficiencies in the  adequate performance of an essential mission program or function of the  agency, a component of the agency, or another organization.
Delay or failure of the project would introduce for the first time  unacceptable or inadequate performance or failure of an essential mission  function of the agency, a component of the agency, or another  organization.
According to DHS officials, without input from investment oversight  reviews, a limited budget review of program justification documents prior  to OMB submittal can be the only oversight provided for some DHS major  investments. CFO representatives told us that in the absence of investment  review decisions, they rely on the best available information provided by  program managers in order to determine if funding requests are  reasonable. As a result, major investment programs can proceed  regardless of whether the investment has received the appropriate IRB  review or has required acquisition documents.
We reported that as of July 2008, 15 DHS major investments are on both  the OMB Management Watch List and list of high-risk projects with  shortfalls, meaning that they are both poorly planned and poorly  performing. According to DHS officials, the funding, programming, and  budget execution process is not integrated into the requirements and  acquisition oversight process and the DHS Undersecretary for  Management has said that strengthening these processes is a top priority.
section_title: Conclusions
paragraphs: The challenges DHS faces in implementing its investment review process  are long-standing and have generally resulted in investment decisions that  are inconsistent with established policy and oversight. Concurrent with  this lack of oversight are acquisition programs worth billions of dollars  with cost, schedule, and performance deficiencies. Weaknesses in some  component management practices compound the problem leaving  investments with little to no scrutiny or review. While the department’s  process has been under revision since 2005, DHS has begun new efforts to  clarify and better adhere to the investment review process. Without  validating mission needs, requirements, and program baselines including  costs, as well as identifying duplicative efforts and monitoring progress,  DHS cannot appropriately manage investments and inform the budget  process. Until DHS aligns oversight of major investments with annual  budget decisions, the department is at risk of failing to invest in programs  that maximize resources to address capability gaps and ultimately help  meet critical mission needs.
section_title: Recommendations for Executive Action
paragraphs: We recommend that the Secretary of Homeland Security direct the  Undersecretary for Management to take the following five actions to better  ensure the investment review process is fully implemented and adhered to:    Establish a mechanism to identify and track on a regular basis new and  ongoing major investments and ensure compliance with actions called for  by investment oversight boards.
Reinstate the JRC or establish another departmental joint requirements  oversight board to review and approve acquisition requirements and  assess potential duplication of effort.
Ensure investment decisions are transparent and documented as required.    Ensure that budget decisions are informed by the results of investment  reviews including IRB approved acquisition information and life cycle cost  estimates.  Identify and align sufficient management resources to implement oversight  reviews in a timely manner throughout the investment life cycle.
To improve investment management, we recommend that the Secretary of  Homeland Security direct component heads to take the following two  actions:    Ensure that components have established processes to manage major  investments consistent with departmental policies.
Establish a mechanism to ensure major investments comply with  established component and departmental investment review policy  standards.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DHS for review and comment. In  written comments, the department generally concurred with our findings  and recommendations, citing actions taken and efforts under way to  improve the investment review process. The department’s comments are  reprinted in appendix II. DHS components also provided technical  comments which we incorporated as appropriate and where supporting  documentation was provided. In addition, several DHS components and  offices reported additional progress since the time of our review to ensure  their major investments comply with departmental policies.
DHS is taking important steps to strengthen investment management and  oversight. After being under revision since 2005, DHS issued a new interim  management directive on November 7, 2008, that outlines a revised  acquisition and investment review process. DHS also cited two new offices  within the Chief Procurement Office that were established to provide  better acquisition management and oversight; recently completed program  reviews; and plans to revise training, standards, and certification  processes for program managers. While many of these efforts are noted in  our report, investment management and oversight has been an ongoing  challenge since the department was established, and continued progress  and successful implementation of these recent efforts will require  sustained leadership and management attention.
DHS stated that the new interim acquisition management directive will  address many of our recommendations; however, our work has found that  DHS has not fully implemented similar steps in the past. For example, in  response to our first recommendation, to establish a mechanism to  identify and track on a regular basis new and ongoing major investments  and ensure compliance with actions called for by investment review board  decisions, DHS’s new interim directive requires major programs to  participate in an acquisition reporting process. While DHS is in the process  of implementing a Next Generation Periodic Reporting System, it is too  soon to tell whether this system will be successfully implemented. DHS’s  first-generation periodic reporting system was never fully implemented,  making it difficult for the department to track and enforce investment  decisions.
In response to our second recommendation, to reinstate the JRC or  establish another departmental joint requirements oversight board to  review and approve acquisition requirements and assess potential  duplication of effort, DHS stated it has already developed a new Strategic  Requirements Review process to assess capability needs and gaps;  completed pilots; and briefed senior leadership. According to DHS’s new  interim acquisition management directive, the results of this process are to  be validated by the JRC, which is still in the process of being established  and for which no timeline was provided. Further, as we found in this  report, when the JRC was previously established in 2004, it was never fully  implemented due to a lack of senior management officials’ involvement.
In response to our third recommendation, that DHS ensure investment  decisions are transparent and documented as required, DHS stated that its  new interim acquisition management directive already implements this by  requiring acquisition documentation for each acquisition decision event  and capturing decisions and actions in acquisition decision  memorandums. DHS also reported that it has conducted eight Acquisition  Review Board meetings with documented Acquisition Decision  Memorandums. While this progress is notable, our work has found that  since 2004, DHS’s investment review board has not been able to effectively  carry out its oversight responsibilities and keep pace with investments  requiring review due to a lack of senior officials’ involvement as well as  limited monitoring and resources. It is too soon to tell whether DHS’s  latest efforts will be sustained to ensure investments are consistently  reviewed as needed.
Regarding our fourth recommendation, that the department ensure budget  decisions are informed by the results of investment reviews, the new  interim management directive creates a link between the budget and  requirements processes and describes interfaces with other investment  processes. While this process is more clearly established in the new  directive, its implementation will be evidenced in the documents produced  during upcoming budget cycles. We found in this report that the previous  investment review process also highlighted links to the budget and other  investment processes, yet the results of oversight reviews did not  consistently inform budget decisions.
In response to our fifth recommendation, to identify and align sufficient  management resources to implement oversight reviews in a timely manner  throughout the investment life cycle, DHS stated that it has partially  implemented the recommendation by establishing a senior executive–led  Acquisition Program Management Division within the Office of the CPO  and plans to increase staffing from its current level of 12 experienced  acquisition and program management specialists to 58 by the end of fiscal  year 2010. Creating a new division to manage oversight reviews is a  positive step; however, we have found that DHS has been challenged to  provide sufficient resources to support its acquisition oversight function  and the CPO’s office has had difficulty filling vacancies in the past.
Regarding our two recommendations to improve investment management  at the component level, DHS noted that the new interim management  directive requires components to align their internal policies and  procedures by the end of the third quarter of fiscal year (June) 2009. In  addition, DHS plans to issue another management directive which will  instruct component heads to create component acquisition executives in  their organizations to be responsible for the implementation of  management and oversight of component acquisition processes. If fully  implemented, these steps should help to ensure that components have  established processes to manage major investments. DHS further noted  that establishment of the Acquisition Program Management Division, the  new interim acquisition management directive, reestablishment of the  acquisition review process, and other steps work together to ensure major  investments comply with established component and departmental  investment review policy standards. To implement this recommendation,  the new component acquisition executives will need to be in place and  successfully implement and ensure compliance with the new processes.
DHS will continue to face ongoing challenges to implementing an effective  investment review process identified in this report and highlighted in the  department’s Integrated Strategy for High Risk Management. For example,  consistent with our findings, the strategy cites challenges to ensuring  availability of leadership to conduct investment reviews; timely collection  and assessment of program data; and sufficient staff to support the  investment review process. Sustained leadership focus will be even more  critical to implement changes and maintain progress on acquisition  management challenges as the department undergoes its first executive  branch transition in 2009.
As agreed with your offices, unless you publicly announce the contents of  this report, we plan no further distribution for 30 days from the report  date. At that time, we will send copies of this report to interested  congressional committees and the Secretary of Homeland Security. We  will also make copies available to others upon request. In addition, the  report will be available at no charge on GAO’s Web site at  http://www.gao.gov.
If you or your staff have questions regarding this report, please contact me  at (202) 512-4841 or huttonj@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. Principal contributors to this report were Amelia Shachoy,  Assistant Director; William Russell; Laura Holliday; Nicole Harkin; Patrick  Peterson; Karen Sloan; Marie Ahearn; and Kenneth Patton.
section_title: Appendix I: Scope and Methodology
paragraphs: Our objectives were to: (1) evaluate DHS’s implementation of the  investment review process, and (2) assess DHS’s integration of the  investment review and budget processes to ensure major investments  fulfill mission needs.
To assess how the investment review process has been implemented, we  reviewed the DHS Investment Review Process management directive and  corresponding handbook to determine which major investments required  DHS review. In doing so, we focused on determining such key factors as  how frequently major investments required oversight reviews and what  documents such as mission need statements and acquisition program  baselines are required to be approved by DHS executive review boards.  We included in our analyses 57 level 1 and level 2 investments that DHS  identified for fiscal year 2008. We determined the level of oversight  provided to 48 of these major investments—those that required  department-level review from fiscal year 2004 through the second quarter  of fiscal year 2008. We also interviewed representatives of the Chief  Procurement Office (CPO), Chief Financial Office (CFO), and Chief  Information Office as well as nine DHS components and offices that  manage major investments. We then collected investment review and  program documents for each major investment and compared the  information to investment review policy requirements. We also reviewed  acquisition decision memorandums from fiscal year 2004 through the  second quarter of fiscal year 2008. Based on the decision memos and  investment information, we determined how many investments had been  reviewed in accordance with DHS policy from fiscal year 2004 through the  second quarter of fiscal year 2008. We also reviewed prior GAO reports on  DHS programs as well as commercial best practices for acquisition. We  reviewed DHS documents such as interim policy memos and guidance and  interviewed CPO staff regarding planned revisions to the investment  review process. We also compared our findings with a 2007 DHS internal  assessment of 37 major investments. In addition, we reviewed available  DHS periodic reports on major investments as well as component  operational status reports to identify instances of cost growth, schedule  slips, and performance shortfalls for major investments and to determine  the status of program manager certification in fiscal year 2007 through the  second quarter of fiscal year 2008. This information is self-reported by  DHS major program offices and all programs did not always provide  complete information, and we did not independently verify information in  these reports.
To assess the integration of investment review and the budget process, we  reviewed DHS management directives for the investment review and the  planning, programming, budgeting, and execution process as well as  corresponding guidance. We also interviewed representatives from the  Chief Procurement Office and Chief Financial Office to discuss how the  processes have been integrated since 2004. We used investment data and  acquisition documents from each major investment program to determine  which had required life-cycle cost estimates and other documents such as  a validated mission need statements. We also reviewed fiscal year 2009  DHS budget justification submissions to OMB. We compared DHS budget  practices with GAO and Office of Management and Budget (OMB)  guidance on capital programming principles. In addition, we reviewed  relevant GAO reports.
We conducted this performance audit from September 2007 until  November 2008 in accordance with generally accepted government  auditing standards. Those standards require that we plan and perform the  audit to obtain sufficient, appropriate evidence to provide a reasonable  basis for our findings and conclusions based on our audit objectives. We  believe that the evidence obtained provides a reasonable basis for our  findings and conclusions based on our audit objectives.
section_title: Appendix II: Comments from the Department of Homeland Security
section_title: Appendix III: Key Acquisition Documents by Major Investment
paragraphs: Mission needs statements, operational requirements documents, and  acquisition program baselines establish capability gaps, requirements  needed to address those gaps, and cost, schedule, and performance  parameters, respectively. Of the 57 DHS level 1 and 2 investments, 34 were  in an acquisition phase that required all three documents; 27 either did not  develop the document or only provided an unapproved draft of one or  more of these documents (see table 5). Some major investment programs  provided acquisition program baselines approved at the component level  that were submitted but did not receive department review and approval.
section_title: Appendix IV: Department of Homeland Security Investments Reviewed by GAO
paragraphs: Appendix IV: Department of Homeland  Security Investments Reviewed by GAO Provides fusion and visualization of information to create timely and accurate situational  awareness reports for the Secretary of Homeland Security, the White House, and other users  to detect, deter, and prevent terrorist activities  Homeland Security Information System   Facilitates information sharing and collaboration across DHS and its partners; enables real- time sharing of threat information for tactical first-responder support; and supports decision  making in a real time secure environment.
Designed to support processing of applications and petitions, capture fees and provide funds  control, provide case status and support, and record the results of the adjudication of each  application and petition.
Established to provide: naturalization processing, interface with associated databases,  improved accuracy, and more timely and accurate information to the public.
Provides resources for all web development and maintenance activities.  Includes web content  management, development of web based transactions with Citizenship and Immigration  Services customers and staff, web site maintenance, and web site hosting.
Provides integrated card production system printers’ hardware and software, operational  contract support, and facilities required to print secure cards granting immigration privileges or  benefits to applicants.
A system to allow all new immigration benefits applications and petitions to be filed  electronically through a Citizenship and Immigration Services Internet web-based portal.   Citizenship and Immigration Services will have a more comprehensive view of the customer  and any potentially fraudulent transactions; improved audit functionality and record  management; better resource management; and increased sharing of information within DHS  and with other agency partners such as Justice and State.
Supports the Systematic Alien Verification for Entitlements Program by providing automated  status-verification information to federal, state, and local benefit-granting and entitlement  agencies, and the E-Verify program by allowing participating employers to verify their new  employees are authorized to work in the United States.
Aims to replace and modernize most of the Coast Guard’s fleet of offshore cutters, boats,  aircraft, and command and control systems over 25 years.
Supports incident response, contingency planning, violation reporting and processing, vessel  casualty investigation and analysis, vessel documentation, user fee collection, analysis of  mission performance, monitoring of program effectiveness.
Will implement a nationwide system for tracking and exchanging information with identification  system equipped vessels operating in or approaching U.S. waters to improve homeland  security and enhance Coast Guard and DHS operational mission performance.
Command, control and communication system that improves mission execution in coastal  zones. Essential to meet Search and Rescue program goals. Results in improved response to  distress calls and better coordination and interoperability with other government agencies and  first responders.
Intended to replace the aging 41-foot utility boats and other large non-standard boats with  assets more capable of meeting all of the Coast Guard multi-mission operational   requirements.
A collection of systems or applications used to provide vessel logistics information  management capacity to the Coast Guard.
Customs and Border Protection (CBP)
Automated Commercial Environment   Web-based import and export system that consolidates seven systems into one portal. It will  provide advanced technology and information to decide, before a shipment reaches U.S.  borders, what cargo should be targeted, and what cargo should be expedited.
Intranet-based enforcement and decision support tool that is the cornerstone for all CBP  targeting efforts. CBP uses the system to improve the collection, use, analysis, and  dissemination of information to target, identify, and prevent potential terrorists and terrorist  weapons from entering the United States and identify other violations and violators of U.S.  law.
Will build additional facilities to meet the needs of CBP’s expansion of its Border Patrol agent  staffing. The recent addition of more agents and technology into enforcement activities has  exceeded existing facility capacity.
Framework used by trusted traveler programs for registering enrollees and performing  identification and validation using automated systems.
Technologies support the interdiction of weapons of mass destruction and effect, contraband,  and illegal aliens being smuggled across the United States border, while having a minimal  impact on the flow of legitimate commerce.
Aims to integrate technology and tactical infrastructure into a comprehensive border security  suite. This system will improve agent ability to respond to illegal activity and help DHS  manage, control, and secure the border.
Phase I will deploy next-generation technology and integrated systems to scan maritime  containers for radiation or other special nuclear material.
Will help develop an integrated and coordinated air and marine force to detect, interdict and  prevent acts of terrorism arising from unlawful movement of people, illegal drugs and other  contraband toward or across the borders of the United States. The goal is to modernize and  standardize the existing CBP air and marine fleets and will require a specific number of  primary and secondary air and marine locations and additional personnel to meet growing  needs.
Consolidated business case between CBP and ICE that will modernize: subject record  “watch list” processing, inspection support at ports of entry, as well as case management.
Western Hemisphere Travel Initiative   Will fulfill the regulatory requirement to develop and implement a system to verify that U.S.  and non-U.S. citizens present an authorized travel document denoting identity and  citizenship when entering the United States.
Provides a state-of-the-art, flexible, secure through security certification and accreditation,  classified, collateral, integrated, and centrally managed enterprise wide-area network.
Includes the consolidated DHS IT infrastructure environments which support the cross- organizational missions of protecting the homeland from a myriad of threats. These IT  infrastructure investments are critical to providing a foundation in which information can be  disseminated and shared across all DHS components, including external customers and  intelligence partners, in a secure, cost effective, and efficient manner.
Aims to achieve compliant financial management services and optimize financial  management operations across the diverse systems cobbled together in 2003 when DHS  was created from 22 agencies and over 200,000 people.
Aims to improve and consolidate DHS’s vast array of payroll and personnel systems.  It will  provide DHS with a common flexible suite of human resource business systems.
Its systems will develop, procure, and deploy current and next generation passive cargo  portal units at the nation’s borders.
Will deliver an advanced imaging system that will automatically detect high density material,  detecting shielding that could be used to hide special nuclear material and highly enriched  uranium or weapons grade plutonium. The system aims to improve throughput rates  providing more effective scanning of a higher portion of cargo at the nation’s ports of entry.
An integrated system to collect, analyze and distribute status, alarms, alert, and spectral data  from all radiation portal monitors and equipment deployed at the Federal, State, Local, Tribal  and international levels.
Federal Emergency Management Agency (FEMA)
Consolidated Alert & Warning System   Provides the president, governors, mayors, tribal leadership with the ability to speak to the  American people in the event of a national emergency by providing an integrated, survivable,  all-hazards public alert and warning system that leverages all available technologies and  transmission paths. It will also provide "situation awareness" to the public and leadership at  multiple levels of government in an emergency.
Provides information exchange delivery mechanisms through a portal for disaster  information, an information exchange backbone, and data interoperability standards.
Established a technology-based, cost effective process for updating, validating, and  distributing flood risk data and digitalized flood maps throughout the Nation.
Provides inspection staff and logistics at a moment’s notice to any Presidentially declared  disaster. The state of readiness is 24 hours a day, 7 days a week, 365 days a year.
Provides FEMA, emergency support function partners, and state decision makers with  visibility of disaster relief assets and shipments to help ensure that the right assets are  delivered in the right quantities to the right locations at the right time.
Immigration and Customs Enforcement (ICE)
Aims to satisfy three fundamental requirements: 1) house a growing population of illegal  aliens, 2) provide appropriate conditions of confinement and 3) maintain its facility  infrastructure. These requirements must be met through a series of design and build actions  that begin with establishing facility infrastructure, continue with establishing detention  capacity and culminate in building secure housing facilities.
IT modernization and automation initiative that serves as the principal ICE program to:  enhance ICE’s technology foundation, maximize workforce productivity, secure the IT  environment, and improve information sharing across ICE and DHS.
Detention and Removal Modernization   Will provide operations management and field personnel the technical tools necessary to  apprehend, detain, and remove illegal aliens in a cost-effective manner.
Web-based system that manages data on schools, program sponsors, foreign students,  exchange visitors, and their dependents during their approved participation in the U.S.  education system so that only legitimate visitors enter the US.
Survivable network connecting DHS with sectors that restore the infrastructure: electricity, IT  and communications; states' homeland security advisors; and sector-specific agencies and  resources for each critical infrastructure sector.
Collects, catalogs and maintains standardized and quantifiable, risk-related infrastructure  information to enable the execution of national risk management and for prioritizing the data  for use by DHS partners.
Aims to provide specially designed telecommunications services to the national security and  emergency preparedness user community during natural or man-made disasters when  conventional communications services are ineffective. These telecommunication services are  used to coordinate response and recovery efforts and, if needed, to assist with facilitating the  reconstitution of the government.
Combines the capabilities of four existing investments to form a fully integrated IT system  that will help fulfill the organization’s mission to collect, analyze, and respond to cyber  security threats and vulnerabilities pursuant to its mission and authorities.
Program is to collect, maintain, and share information, including biometric identifiers, on  foreign nationals to determine whether an individual (1) should be prohibited from entering  the United States; (2) can receive, extend, change, or adjust immigration status; (3) has  overstayed or otherwise violated the terms of admission; (4) should be apprehended or  detained for law enforcement action; or (5) needs special protection/attention (e.g.,  refugees). The vision of the US-VISIT Program is to deploy end-to-end management of data  on foreign nationals covering their interactions with U.S. immigration and border  management officials before they enter, when they enter, while they are in the U. S., and  when they exit.
Information Technology investment with a mission of providing early detection and  characterization of a biological attack on the United States.
National Bio and Agro-Defense Facility   Infrastructure investment to support the Science and Technology Chemical and Biological  Division program, which provides the technologies and systems needed to anticipate, deter,  detect, mitigate, and recover from possible biological attacks on this nation’s population,  agriculture or infrastructure. The program operates laboratories and biological detection  systems and conducts research.
Infrastructure investment to support the Science and Technology Chemical and Biological  Division program, a key component in implementing the Presidents National Strategy for  Homeland Security by addressing the need for substantial research into relevant biological  and medical sciences to better detect, and mitigate the consequences of biological attacks  and to conduct risk assessments. The program operates laboratories and biological detection  systems and conducts research.
Transportation Security Administration (TSA)
Implements a national checked-baggage screening system to protect against criminal and  terrorist threats, while minimizing transportation industry and traveling public burdens.
An airborne communication system of systems (air-to-ground, ground-to-air, air-to-air and  intra-cabin) that will give Air Marshall and other Law Enforcement Officers access to wireless  communications and the ability to share information while in flight.
System to manage the schedules of federal air marshals given the flights available (~25,000  per day) and the complexities of last minute changes due to flight cancellations.
Hazmat Threat Assessment Program   Leverages existing intelligence data to perform threat assessments on commercial truck  drivers who transport hazardous materials to determine threat status to transportation  security.
Provides the resources required to deploy and maintain passenger screening and carry-on  baggage screening equipment and processes at approximately 451 airports nationwide in  order to minimize the risk of injury or death of people or damage of property due to hostile  acts of terrorism.
Will strengthen the security of the nation’s transportation systems by creating, implementing,  and operating a threat-based watch list matching capability for approximately 250 million  domestic air carrier passengers per year.
Will improve security by establishing a system-wide common secure biometric credential,  used by all transportation modes, for personnel requiring unescorted physical and/or logical  access to secure areas of the trans system.
Provides common environment for hosting applications; integrated data infrastructure;  content; and a collection of shared services.