Homeland Security: Better Management Practices Could Enhance DHS's Ability to Allocate Investigative Resources
Published: 2006-03-28T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Immigration and Customs Enforcement's (ICE) mission is to prevent terrorist attacks within the United States and reduce the vulnerability of the United States to terrorism while ensuring its mandated customs, immigration, and federal protective enforcement functions are not diminished. The ICE Office of Investigations (OI) supports that mission by investigating customs and immigration violations. This testimony addresses the following key questions that were answered in GAO-06-48SU , a restricted report issued with the same title: (1) What structure and activities has OI adopted to address its mission? (2) In fiscal year 2004 and the first half of fiscal year 2005, how did OI use its investigative resources to achieve its goals? (3) How does OI ensure that its resource use contributes to its ability to prevent the exploitation of systemic vulnerabilities in customs and immigration systems?
section_title: What GAO Found
paragraphs: OI's organizational structure and investigative activities reflect those of its legacy agencies--the U.S. Customs Service and the Immigration and Naturalization Service--and include activities to prevent terrorism. OI retained responsibility for enforcing customs and immigration laws, and its field structure was created by relying on the strategic priorities of its legacy agencies to determine the composition and locations of field offices. Senior OI officials said that OI seeks to accomplish its homeland security mission by focusing on cases that seem to have a connection to national security. Data from ICE's case management system indicate that its investigative activities generally relate to legacy missions, with about half of OI resources during fiscal year 2004 and the first half of 2005 used for cases related to drugs, financial crimes, and general alien investigations--investigations unlikely to contain a nexus to national security. Overall, between 10 and 15 percent of investigative resources were used for investigations considered to have a link to national security. OI's current method of tracking these cases captures data about the cases where a nexus to national security is assumed due to the nature of the violation, primarily investigations of munitions control, illegal exports, visa violations, and terrorism. Additionally, the equivalent of about 400 of its 5,600 special agents worked full time to identify incarcerated aliens who were eligible for removal from the United States, a function that does not require the skills and training of criminal investigators. ICE plans to free investigators for more appropriate duties by shifting these functions to other ICE units and to study whether other functions could be shifted to employees in a noninvestigatory job series. To make resource use decisions in pursuit of OI's goal to prevent the exploitation of systemic vulnerabilities in customs and immigration systems, OI primarily relies on the judgment of staff in its major field offices, in addition to national programs developed in headquarters that are implemented in multiple field offices. Although GAO found no evidence that OI has failed to investigate any national security-related lead that came to its attention, applying a risk management approach to determine what types of customs and immigration violations represent the greatest risks for exploitation by terrorists and other criminals could provide OI with greater assurance that it is focusing on preventing violations with the greatest potential for harm, while striking a balance among its various objectives. OI has taken some initial steps to introduce principles of risk management into its operations, but has not conducted a comprehensive risk assessment of the customs and immigration systems to determine the greatest risks for exploitation, nor has OI analyzed all relevant data to inform the evaluation of alternatives and allow risk-based resource allocation decisions. OI also lacks outcome-based performance goals that relate to its objective of preventing the exploitation of these systemic vulnerabilities. Finally, OI does not have sufficient systems to help ensure ongoing monitoring and communication of vulnerabilities discovered during its investigations.

section_title: Letter
paragraphs: I am pleased to be here today to share our views on the progress the  Department of Homeland Security’s (DHS), U.S. Immigration and Customs  Enforcement (ICE) Office of Investigations (OI) has made in pursuing its  homeland security mission. OI was formed in March 2003, mainly from  legacy INS and Customs investigative components. OI is responsible for  conducting investigations covering a broad array of national security,  financial, and smuggling violations, including illegal arms exports,  financial crimes, trade violations, human trafficking, narcotics smuggling,  child pornography/exploitation, and immigration fraud. OI is also  responsible for conducting investigations aimed at protecting critical  infrastructure industries. This testimony is an unrestricted version of our  recent Law Enforcement Sensitive report we did for this subcommittee  entitled HOMELAND SECURITY: Better Management Practices Could  Enhance DHS’s Ability to Allocate Investigative Resources. In my  testimony today, I will discuss the following topics:    What structure and activities has OI adopted to address its mission?
How did OI use its investigative resources in fiscal year 2004 and the  first half of fiscal year 2005?
How does OI ensure that its resource use contributes to its ability to  prevent the exploitation of systemic vulnerabilities in customs and  immigration systems?
To identify OI’s structure and the activities it uses to address its mission  we met with OI officials and reviewed documents used to support  organizational decisions. To determine how OI used its investigative  resources to address its goals, we analyzed case management data that  showed the types of investigations performed nationally between October  2003 and March 2005—the most recent period for which comparable data  were available. In addition, we interviewed the management staff of OI  and the special agents-in-charge (SAC) at 7 of the 26 ICE OI field offices to  learn how they set investigative priorities and allocate human resources to  investigations. We selected the special agent-in-charge offices based on  their size (the number of agents) and location, seeking to include a variety  of offices representing differing investigative focuses. Because our sample  was a nonprobability sample, the opinions of these special agents-in- charge cannot be projected beyond those interviewed. We also collected  and analyzed data specific to the 7 offices we visited. We assessed the  reliability of the investigative resource data—the hours spent on different  types of investigations—by reviewing the internal controls of the case  management system and through interviews with knowledgeable OI staff  about these controls and the quality assurance procedures in place to  ensure data reliability. We determined the investigative resource data were  sufficiently reliable for our purposes. We determined how OI ensures that  its resource use contributes to its ability to prevent the exploitation of  systemic vulnerabilities in customs and immigration systems using  information collected during interviews with OI officials, including the  special-agents-in-charge and by examining documents used to support  organizational decisions. We evaluated OI’s current approach to resource  allocation decision making by comparing this information with the  standards for internal control in the federal government and to the risk  management approach that we have advocated in our prior work.
subsections: section_title: Background
paragraphs: ICE is the largest investigative arm of DHS. ICE is composed of four  offices: (1) Investigations, (2) Intelligence, (3) Detention and Removal  Operations (DRO), and (4) the Federal Protective Service. As of  September 2005, OI had more than 5,600 special agents; about 94 percent  of these are assigned to 26 major field offices, headed by Special Agents- in-Charge (SAC), and OI’s foreign attaché offices. These offices and their  subordinate units were created using the immigration and customs staff  and locations in existence at the time ICE was formed.
At headquarters ICE, OI is divided into five divisions as shown in figure 1.  Three of the five divisions—National Security, Finance and Trade, and  Smuggling and Public Safety—were created to incorporate the core  missions and functions of legacy immigration and customs investigations.  These divisions and the units within them are to provide a functional line  of communication from the Director of OI to the groups in the SAC offices  that conduct investigations. Divisions and units within OI headquarters  also develop and manage special programs that are implemented in  multiple field offices. For example, Project Shield America is a National  Security Division program where OI conducts outreach to private sector  companies to prevent the illegal export of sensitive U.S. munitions and  strategic technology. The Cornerstone program in the Financial and Trade  Division is a similar outreach program to the financial industry. Operation  Community Shield is a national law enforcement initiative that is designed  to bring all of ICE’s immigration and customs-related law enforcement  powers to bear in the fight against violent street gangs.
The Investigative Services Division provides direct forensic, undercover,  and other operational support to OI investigations carried out by the three  core divisions, and the Mission Support Division provides policy guidance  and services to facilitate executive oversight.
Oversees programs designed to identify,  with the financial community to identify  disrupt, and dismantle organizations  and eliminate potential vulnerabilities  in the nation’s financial infrastructure.
subsections: section_title: Carryover Organizational Structure and Investigative Activities from Legacy Agencies Affect OI’s Investigative Focus
paragraphs: The headquarters and field organizational structures adopted by OI reflect  the legacy functions of the customs and immigration services—e.g. drug  investigations, human smuggling, and commercial fraud—and include  activities to prevent terrorism within this structure. In April 2005, ICE  completed an interim strategic plan that established as its mission to  prevent terrorist attacks within the United States and reduce the  vulnerability of the United States to terrorism while ensuring all of its  mandated trade, immigration, and federal protective functions are not  diminished. According to ICE officials, the national security objectives are  not accomplished through any particular type or category of investigation.  Instead, these objectives are addressed by examining investigations on a  case-by-case basis and determining the relationship of any single case to  national security. For example, although OI has the authority to investigate  any employer that might have violated laws that regulate alien  employment eligibility, OI instructs investigators to focus on employers at  critical infrastructure sites.
When ICE was created, it retained responsibility for enforcing the customs  and immigration laws that were the purview of its legacy agencies. These  include criminal statutes addressing the illegal import and export of drugs,  weapons, child pornography, stolen antiquities, and other contraband, as  well as alien smuggling, human trafficking, and the international  laundering and smuggling of criminal proceeds. OI also is responsible for  legacy customs enforcement of certain intellectual property and trade- related commercial fraud statutes and legacy immigration enforcement of  laws prohibiting document fraud, benefit fraud, illegal entry into the  United States or violations of the terms and conditions of entry, and  employment without authorization. OI’s field structure was created by  merging the existing Customs and INS field offices located primarily in  cities near major ports of entry. In addition, ICE relied on the strategic  priorities of the legacy agencies to determine the composition and  locations of SAC offices—for example, high-volume smuggling corridors,  proximity to state and federal prisons, and significant money laundering  infrastructure.
There are some long-standing functions of the legacy agencies that OI  continues to perform, which also drive some of the types of investigative  activities that are conducted. For example, OI has continued the legacy  Customs practice of responding to violations concerning seized drugs or  merchandise or detained persons uncovered at ports of entry by Customs  and Border Protection (CBP) inspectors. U.S. Customs had historically  been involved with helping to implement the President’s National Drug  Control Strategy. Consistent with this involvement, DHS now receives  funding specifically to support activities related to the strategy. A senior  OI official said OI will continue to be responsible for performing a  significant level of drug investigations because there simply is no other  agency available to conduct the large number of border-related drug  investigations U.S. Customs has historically performed and that are now  carried out by OI. Another carryover function that OI now performs is the  legacy INS practice of identifying aliens incarcerated in prisons and jails  that are eligible for removal from the United States.
section_title: OI Investigative Resources Were Used for Investigations Related to Its Legacy Missions, but Most Were Not Considered to Have a National Security Nexus
paragraphs: Between 10 and 15 percent of investigative hours were classified by OI as  having a direct nexus to national security. Although there is no firm  standard for how OI should distribute its investigative resources, ICE’s  interim strategic goals and objectives place a strong emphasis on national  security-related activities. According to OI, the majority of the national  security-related investigative hours were charged in a few case categories  related to munitions control, illegal exports, compliance enforcement of  visa violations, and terrorism. Most of the investigative hours within those  case types that consumed roughly half of OI resources—drugs, financial,  and general alien—were rarely classified as having a direct nexus to  national security. In its fiscal year 2007 budget justification, DHS  requested funds to increase the level of resources dedicated to visa  compliance enforcement by more than 40 percent through the addition of  over 50 special agent and support staff dedicated to these types of  investigations.
Roughly half of OI investigative resources during fiscal year 2004 and the  first half of fiscal year 2005 were used for cases related to drugs, financial  crimes, and general alien violations. The resource use in the other case  categories pertains to investigations of a variety of customs and  immigration violations including commercial fraud, general smuggling,  human smuggling and trafficking, identity fraud, document fraud, and  worksite enforcement. None of the investigative categories that apply to  these violations individually accounted for more than 8 percent of  investigative resource use during the period under study. In most  instances these other case categories accounted for 5 percent or less of  resource use.
Moreover, with regard to general alien investigations, the equivalent of  about 400 OI investigators performed, as a central part of their daily  duties, functions that are noninvestigative in nature (i.e., not consistent  with the position description of a criminal investigator as defined by the  Office of Personnel Management.) According to OI officials, some of these  noninvestigative activities were formerly performed by legacy INS  investigators and include identifying incarcerated criminal aliens who are  eligible for removal, an ICE responsibility, and responding to state and  local police agencies that have apprehended illegal aliens. According to  ICE’s interim strategic plan, ICE plans to shift this duty to ICE’s Office of  Detention and Removal Operations (DRO). A DRO official told us DRO  planned to take over this role from OI incrementally by first assuming  responsibility for this activity in several major metropolitan areas in   2005 and 2006.
OI investigators also perform worksite enforcement, which according to  the OI Deputy Assistant Director responsible for this function, includes  activities that might be more economically performed by noninvestigatory  staff. This function—verifying that employees at critical and noncritical  worksites are eligible to work in the United States—was described by OI  officials as a compliance function that is not clearly aligned with the  criminal investigator job description. Since the late 1990s, the level of  investigative resources legacy INS and then ICE dedicated to this function  has decreased. Since the terrorist attacks of September 11, 2001, INS and  ICE have concentrated worksite investigative resources at critical  infrastructure facilities. In its fiscal year 2007 budget justification, DHS  requested funds to support the addition of 206 positions—171 of which are  special agents—to conduct worksite enforcement. If these resources are  approved and used for worksite enforcement, this would increase OI’s  worksite enforcement effort significantly compared to what was done in  fiscal year 2005.
The fiscal year 2006 Department of Homeland Security Appropriations  Conference Report directs ICE to submit a plan for the expanded use of  immigration enforcement agents to focus on civil and administrative  violations, raising the possibility that additional noninvestigative duties  may be shifted from OI investigators, making them available for criminal  investigations.
subsections: section_title: OI Places Priority on National Security Investigations, but Key Management Practices Could Enhance OI’s Resource Allocation Decision-Making
paragraphs: OI tries to ensure that its resources contribute to the prevention of the  exploitation of systemic vulnerabilities in customs and immigration  systems by making most investigative resource use decisions in OI’s major  field offices, based on the judgment of the agents in charge, with priority  on investigating national security-related cases that arise. Although we  found no evidence that OI has failed to investigate any national security- related lead that came to its attention, applying a risk management  approach to proactively determine what types of customs and immigration  violations represent the greatest risks for exploitation by terrorists and  other criminals could provide OI with greater assurance that it is focusing  most intensely on preventing those violations with the greatest potential  for harm while striking an appropriate balance among its various  objectives. According to the Standards for Internal Control in the Federal  Government, one of the foundational components of a good control  environment is risk assessment—including the assessment of risks,  estimation of their significance, the likelihoods of their occurrence, and  decisions about how to respond to them.
OI has taken some initial steps to introduce principles of risk management  into its operations—for example, encouraging its field managers to think  about violations in terms of vulnerabilities to the customs and immigration  systems. In addition, OI classifies each investigation using the numeric  designations 1, 2, and 3, with class 1 indicating the highest relative  importance within that category of investigation. However, it has not  conducted a comprehensive risk assessment of the customs and  immigration systems to determine the greatest risks for exploitation or  analyzed these data to provide information to evaluate alternative  investigative strategies and allow OI to make risk-based resource  allocation decisions. Such a system could provide OI with greater  assurance that it is striking an appropriate balance among its various  objectives while focusing most intensely on preventing those violations  with the greatest potential for harm.
Application of a risk management approach by OI involves a risk  assessment that would provide information in three areas: (1) threat— what strategic intelligence and experience suggest about how customs and  immigration systems might be exploited by terrorists and other criminals;  (2) vulnerabilities—the ways that customs and immigration systems are  open to exploitations and the kinds of protections that are built into these  systems; and (3) consequence—the potential results of exploitation of  these systems, including the most dire prospects. For example, ICE’s  strategic goal to prevent the unlawful movement across U.S. borders of  people, money, and materials, includes as one of its strategies giving  highest priority to closing those vulnerabilities that pose the greatest  threat to our national security. However, OI has not performed a risk  assessment to determine which vulnerabilities pose the greatest threat so  that it can direct resources to those investigations that best address these  vulnerabilities. Figure 2 demonstrates how the risk assessment and  investigator’s judgment would combine to inform case selection and  resource allocation.
ICE has begun to incorporate elements of risk management into its  resource allocation decision making. OI has several ongoing programs  within its National Security Division designed to identify and mitigate  national security threats. One is Project Shield America, where special  agents conduct outreach to the export industry to educate these  businesses about U.S. export laws and to solicit their assistance in  preventing the illegal foreign acquisition of their products. OI also uses the  Threat Analysis Unit and Compliance Enforcement Unit within the  National Security Division to screen nonimmigrant students, exchange  students, and other visitors for the purpose of identifying potential  national security threats. The value of risk management goes beyond these  types of resource allocation, however. Specifically, a more comprehensive  risk management approach would enable OI to better ensure that its  resources are effectively and efficiently applied to its national security and  other missions by giving it a foundation for determining how resources  might be best distributed within and across investigation types, for  example, (1) how to best allocate its resources among case categories  (e.g., visa violations, drug smuggling, and financial crimes); (2) the  appropriate level of investment in national-security related investigations;  and (3) the appropriate mix of case classifications within each category  (i.e., the three-level classification of cases based on relative importance).
Effective risk management also requires outcome-based performance  measures and goals. We found OI lacks outcome-based performance goals  to monitor the full range of its efforts to prevent the systemic  vulnerabilities that allow terrorists and other criminals to endanger the  United States. Performance goals—consisting of a target (acceptable level  of performance) and a measure (a means to assess the performance  level)—are an essential management tool in managing programs for  results. In addition, our Standards for Internal Control in the Federal  Government and the Office of Management and Budget call for agencies to  have performance measures and indicators that are linked to mission,  goals, and objectives to allow for comparisons to be made among different  sets of data (for example, desired performance against actual  performance) so that corrective actions can be taken if necessary.
Currently, OI relies primarily upon statistics related to investigative  resource use—such as arrests, seizures, and convictions—to monitor  performance. In fact, ICE reports only one output performance measure  for OI on the DHS Performance and Accountability Report—the  percentage of investigations that result in an enforcement action (e.g., an  arrest, conviction, or fine). Measuring the percentage of investigations that  result in enforcement action provides only an indirect indicator of success  in preventing systemic vulnerabilities that allow terrorists and other  criminals to endanger the United States. Among other things, it lacks the  ability to reflect successes of OI’s programmatic activities that are  designed to deter the exploitation of systemic vulnerabilities before a  crime is committed—for example, a measure of the outcomes of actions  taken to close or control identified vulnerabilities. Without outcome-based  performance goals, it is difficult for OI to gauge the effectiveness of its  operational activities and to use this information to assess what types of  corrective actions might be required—such as changes to programs or  work processes in order to better align activities with strategic objectives.
Finally, OI does not have sufficient systems to help ensure ongoing  monitoring and communication of vulnerabilities discovered during its  investigations. These controls could enhance OI’s ability to take action to  eliminate those vulnerabilities or to recommend mitigation practices to  entities that control the applicable customs or immigration system.  Standards for Internal Control in the Federal Government calls for  agencies to establish monitoring and communication systems that assess  the quality of performance over time and ensure that findings of  deficiencies are corrected and result in improvements to the process. OI  officials said they are trying to use Cornerstone—a program to identify  and reduce systemic vulnerabilities in financial systems—as a model for  creating such a feedback loop (see fig. 3). Cornerstone was created by ICE  to encourage coordination with the financial industry. OI officials in  headquarters and field offices conduct outreach to the private sector and  partner with private industry as well as with state and other federal law  enforcement and regulatory agencies. The private sector provides ICE  with information regarding the vulnerabilities it has observed, and ICE  uses this information to develop criminal investigations. ICE also  disseminates information on vulnerabilities to financial sector  stakeholders through the Cornerstone Report. When vulnerabilities are  identified that cannot be addressed by the private sector alone, ICE  officials told us that a joint law enforcement and regulatory approach is  utilized to eliminate or minimize vulnerabilities.
With the exception of the Cornerstone program for financial  investigations, OI does not have a complete system in place to help ensure  that information gained during the course of investigations feeds back into  the operations of other DHS components, other federal agencies, state and  local partners, and relevant private sector entities to proactively reduce  the vulnerabilities that facilitate violations. OI has taken initial steps to  apply parts of the Cornerstone approach to all its investigative areas. For  example, Project Shield America uses the same outreach techniques to the  export sector as Cornerstone does to the financial sector, without the  emphasis on changing policies and practices to reduce identified  vulnerabilities. However, OI officials told us that OI does not have a  process to help ensure that action is taken to mitigate the risks from the  vulnerability identified during the course of its investigations across all  SACs. A systemwide process for capturing the information and ensuring  that OI takes appropriate actions in response to information, extending  beyond financial crimes, would better support its ability to reduce  vulnerabilities in immigration and customs systems by allowing OI to  monitor the progress of efforts to reduce vulnerabilities and the  identification of those involved in these efforts. Such a process is  especially important for OI, since so many of its operations are  collaborative, and the vulnerabilities identified through its investigations  may require legal or policy changes that are controlled by external  stakeholders.
section_title: Conclusions
paragraphs: Although OI, as the primary investigative agency of the Department of  Homeland Security states that it places priority on national security, from  a practical standpoint, it is focused on enforcing all laws and regulations  governing the customs and immigration systems. Before the creation of  the DHS, these efforts, carried out by legacy INS and U.S. Customs service  had a limited relation to national security—and indeed even since  becoming a part of DHS, cases considered to be directly related to national  security have demanded a relatively small portion of OI’s resources.  Particularly considering its wide-ranging mission, a more comprehensive  risk management approach could provide OI with better information to  evaluate its alternatives and balance its resource allocations most  effectively across the broad array of violations it is responsible for  investigating. Although OI has applied some of the principles of risk  management to its operations, applying a comprehensive risk management  approach would provide a stronger evidence-based foundation to help it  ensure that its resource allocation best supports its ability to prevent those  systematic vulnerabilities with the most potential to endanger the United  States. Specifically, a more comprehensive risk management approach  would enable OI to better ensure that its resources are effectively and  efficiently applied to its national security and other missions by giving it a  foundation for determining how resources might be best distributed within  and across investigation types, for example, (1) how to best allocate its  resources among case categories (e.g., visa violations, drug smuggling, and  financial crimes), (2) the appropriate level of investment in national- security related investigations, and (3) the appropriate mix of case  classifications within each category (i.e., the three-level classification of  cases based on relative importance).
Lacking OI-wide outcome-based performance goals to assess its ability to  prevent the exploitation of systematic vulnerabilities in customs and  immigration systems that allow terrorists and other criminals to endanger  the United States makes it difficult for OI to evaluate the results of its  efforts in light of that objective. In addition, this lack may promote a  tendency for OI to stay in the functional mindset of its legacy agencies. In  particular, using data like the number of arrests, fines, drug and other  seizures, prosecutions, and convictions gives OI some ability to assess the  outputs of its activities. However, relying primarily on this type of  performance data may make it more difficult for OI to determine if it  should alter its investigative focus because favorable outputs (e.g., high  numbers of arrests) tend to reinforce the current focus whether or not it is  helping accomplish the ICE mission. Without outcome-based performance  goals that are tied to ICE’s mission and objectives, the agency will lack a  sufficient basis for assessing the alignment of resources that might offer  the greatest contribution to this broad mission. Developing measures that  can meaningfully gauge performance related to an expansive deterrence  mission like ICE’s is not an easy task. However, armed with information  about the relative risk to the customs and immigration systems, OI could  be in a better position to measure its performance and make resource use  decisions based on the potential to mitigate the most crucial identified  risks.
Finally, a critical part of the ICE mission is to reduce the vulnerability of  the United States to terrorism. OI’s Cornerstone program and efforts to  extend this approach to other investigative areas are intended to reduce  vulnerabilities by feeding lessons learned from criminal investigations  back into the organization’s systems and practices. However, these efforts  do not include sufficient monitoring and communication systems to  ensure that information is systematically fed back and that it consistently  results in corrective actions. A feedback process that includes processes  and procedures (for example, clearly established lines of reporting and  authority and documented protocols) to help ensure that vulnerabilities OI  uncovers during its investigations will result in mitigation measures or in  recommendations for such measures to entities responsible for the  applicable system would enhance OI’s ability to reduce vulnerabilities in  customs and immigration systems.
section_title: Recommendations
paragraphs: To put OI in a better position to allocate its investigative resources in a  manner that maximizes their contribution to the achievement of ICE’s  mission, we recommended that the Secretary of Homeland Security direct  the Assistant Secretary of ICE to take the following three actions:    Conduct comprehensive threat, vulnerability, and consequence risk  assessments of the customs and immigration systems to identify the  types of violations with the highest probability of occurrence and most  significant consequences in order to guide resource allocation for OI  national programmatic activity and to expand the available information  upon which SACs base their decisions to open new cases.
On the basis of the results of the risk assessment, develop outcome- based performance goals (measures and targets) that reflect the  contribution of various investigative activities to ICE’s mission and  objectives and develop a reliable method for tracking national security- related activity and classification criteria for the case management  system that express the contributions of each investigation.
Develop an OI-wide system to monitor and communicate the more  significant vulnerabilities in customs and immigration systems that are  identified during the course of OI investigations. This process should  include a method to mitigate the vulnerability internally or to ensure  that the vulnerability and associated mitigation recommendations are  communicated to external stakeholders with responsibility for the  applicable system.
In response to our first recommendation, DHS agreed risk management is  a valuable tool to establish priorities in a multiple threat environment and  said ICE intends to take a broader, component-wide approach to assessing  risk. DHS agreed that the ICE Office of Investigations resource decisions  should be based on priorities derived from a strategic-planning process in  which directors and unit managers from all ICE OI program areas  participate, including mission support. DHS said priorities set forth in the  strategic plan should be reviewed annually, revised as necessary, and  communicated to each SAC.
While DHS agreed with our second recommendation, it said that ICE  needs to maintain the flexibility to develop performance goals that reflect  its mission and may not necessarily be measurable in an outcome-based  manner. DHS said the Office of Management and Budget has  acknowledged that for certain activities (e.g., law enforcement) “outcome- oriented” performance measures may be difficult to identify and  performance may be tracked by using a variety of output as well as  qualitative measures. DHS said each division within OI uses standard law  enforcement statistics covering all of its program units that can be shared,  understood, and compared over the years, including arrests, indictments  and convictions, broken out by category. We agree that developing  outcome-based performance measures for law enforcement activities can  be difficult and that some output measures can be beneficial. However, we  continue to believe that where possible OI should seek to develop  outcome-based performance measures that would better demonstrate the  value of its efforts. OI needs to allocate resources to the types of  investigations that have the best chance of mitigating potential  vulnerabilities in customs and immigration systems to terrorism.
With regard to our third recommendation, DHS said that OI headquarters’  program managers regularly communicate with the SAC offices to obtain  feedback on significant cases and identified vulnerabilities. This  information is documented in reports that are transmitted two times a day  to both the OI and DHS leadership. A weekly report also is prepared that  summarizes the significant cases of the week. DHS said that OI has  established designated liaisons to both U.S. Citizenship and Immigration  Services and CBP and they communicate specific vulnerabilities and  threats. While these efforts are useful, our recommendation envisions a  more comprehensive strategy to identify and mitigate vulnerabilities in  customs and immigration systems and processes. We are encouraged that  OI intends to continue to expand such outreach and partnership efforts. In  implementing our recommendation, we believe that OI should obtain and  use feedback from all relevant governmental and nongovernmental  organizations in its efforts to mitigate potential vulnerabilities.
Mr. Chairman, this concludes my statement.  I would be pleased to  respond to any questions that you or other members of the Subcommittee  may have at this time.
section_title: GAO Contacts and Staff Acknowledgments
paragraphs: For further information about this testimony, please contact Richard Stana  at 202-512-8777.
Other Key contributors to this statement were Michael Dino and Tony  DeFrank.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. It may be reproduced and distributed in its entirety without further  permission from GAO. However, because this work may contain copyrighted images or  other material, permission from the copyright holder may be necessary if you wish to  reproduce this material separately.