Department of Homeland Security: Progress Made, but Work Remains in Strengthening Acquisition and Other Management Functions
Published: 2016-03-16T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In 2003, GAO designated implementing and transforming DHS as high risk because the failure to address risks associated with transforming 22 agencies into one department could have serious consequences for U.S. national and economic security. While challenges remain, DHS has made considerable progress. As a result, in 2013 GAO narrowed the scope of the high-risk area to focus on strengthening and integrating DHS management functions (human capital, acquisition, financial, and information technology). This statement discusses DHS's progress and actions remaining in addressing these functions with a focus on acquisition management. In fiscal year 2015 alone, DHS reported that it planned to spend approximately $7.2 billion on its major acquisition programs to help execute its many critical missions. This statement is based on GAO's 2015 high-risk update, GAO products from 2005 through 2016, and selected updates from ongoing work. To conduct past and ongoing work we reviewed key documents such as DHS strategies and interviewed agency officials.
section_title: What GAO Found
paragraphs: The Department of Homeland Security's (DHS) efforts to strengthen and integrate its management functions have resulted in it meeting three and partially meeting two of GAO's criteria for removal from the high-risk list (see table).
For example, DHS has established a plan for addressing the high-risk area and a framework for monitoring its progress in implementing the plan. However, DHS needs to show additional results in other areas, including demonstrating the ability to achieve sustained progress across 30 outcomes that GAO identified and DHS agreed were needed to address the high-risk area. As of March 2016, DHS had fully addressed 10 of these outcomes but work remained in 20.
GAO has reported on DHS's acquisition management for over 10 years. The department has struggled to effectively manage its major programs, including ensuring that all major acquisitions had approved baselines and that they were affordable. GAO has noted significant progress in recent reviews (see table). This progress is largely attributable to sustained senior leadership attention.
Source: GAO analysis of DHS documents, interviews, and prior GAO reports. | GAO-16-507T
To ensure that recent efforts are sustained, the department must continue to implement its sound acquisition policy consistently and effectively across all components. GAO has made numerous recommendations in this regard, which DHS has concurred with and is taking actions to implement.
section_title: What GAO Recommends
paragraphs: This testimony contains no new recommendations. GAO has made about 2,400 recommendations to DHS since 2003 to strengthen management efforts, among other things. DHS has implemented more than 70 percent of these recommendations, including those related to acquisition management, and has actions under way to address others.

section_title: Letter
paragraphs: Thank you for the opportunity to discuss the Department of Homeland  Security’s (DHS) ongoing efforts to strengthen and integrate its  management functions. In the 13 years since the department’s creation,  DHS has implemented key homeland security operations, achieved  important goals and milestones, and grown to more than 240,000  employees and approximately $66 billion in budget authority. We have  issued hundreds of reports addressing the range of DHS’s missions and  management functions, and our work has identified gaps and  weaknesses in the department’s operational and implementation efforts,  as well as opportunities to strengthen their efficiency and effectiveness.  Since 2003, we have made approximately 2,400 recommendations to  DHS to strengthen program management, performance measurement  efforts, and management processes, among other things. DHS has  implemented more than 70 percent of these recommendations and has  actions under way to address others.
We also report regularly to Congress on government operations that we  identified as high risk because of their increased vulnerability to fraud,  waste, abuse, and mismanagement, or the need for transformation to  address economy, efficiency, or effectiveness challenges. In 2003, we  designated implementing and transforming DHS as high risk because  DHS had to transform 22 agencies—several with major management  challenges—into one department, and failure to address associated risks  could have serious consequences for U.S. national and economic  security. Given the significant effort required to build and integrate a  department as large and complex as DHS, our initial high-risk designation  addressed the department’s initial transformation and subsequent  implementation efforts, to include associated management and  programmatic challenges.
Since 2003, the focus of the Implementing and Transforming DHS high- risk area has evolved in tandem with DHS’s maturation and evolution. In  September 2011, we reported in our assessment of DHS’s progress and  challenges 10 years after the terrorist attacks of September 11, 2001  (9/11) that the department had implemented key homeland security  operations and achieved important goals in many areas to create and  strengthen a foundation to reach its potential.However, we also reported  that continuing weaknesses in DHS’s management functions had been a  key theme affecting the department’s implementation efforts. While  challenges remain for DHS across its range of missions, the department  has made considerable progress in transforming its original component  agencies into a single cabinet-level department and positioning itself to  achieve its full potential. As a result, in our 2013 high-risk update, we  narrowed the scope of the high-risk area to focus on strengthening DHS  management functions (acquisition, information technology , financial,  and human capital), and changed the name from Implementing and  Transforming DHS to Strengthening DHS Management Functions to  reflect this focus. We also reported in our 2013 update that the  department needs to demonstrate continued progress in implementing  and strengthening key management initiatives and addressing corrective  actions and outcomes in order to mitigate the risks that management  weaknesses pose to mission accomplishment and the efficient and  effective use of the department’s resources.
Acquisition management has been a key area of concern. Each year,  DHS invests billions of dollars in its major acquisition programs to help  execute its many critical missions. In fiscal year 2015 alone, DHS  reported that it planned to spend approximately $7.2 billion on these  acquisition programs, and the department expects it will ultimately invest  more than $180 billion in them. We have reported on DHS acquisition  management issues since shortly after the department was established;  our first report dates from 2005. Our work since then has identified  significant shortcomings in the department’s ability to manage its portfolio  of major acquisitions. More recently, we have found that the  department’s senior leadership has taken sound actions that have led to  improvements, although more needs to be done to ensure that DHS is  well-positioned to effectively manage its major acquisition programs.
In November 2000, we published our criteria for removing areas from the  high-risk list. Specifically, agencies must have (1) a demonstrated strong  commitment and top leadership support to address the risks; (2) a  corrective action plan that identifies the root causes, identifies effective  solutions, and provides for substantially completing corrective measures  in the near term, including but not limited to steps necessary to implement  solutions we recommended; (3) the capacity (that is, the people and other  resources) to resolve the risks; (4) a program instituted to monitor and  independently validate the effectiveness and sustainability of corrective  measures; and (5) the ability to demonstrate progress in implementing  corrective measures.
DHS’s progress and actions remaining in strengthening and  integrating its management functions, and further details on DHS’s efforts to strengthen acquisition management  and key efforts that remain to be completed.
This statement is based on GAO’s 2015 high-risk update report, our body  of work on DHS acquisition management, which spans over 10 years and  much of which was performed in response to requests by this committee,  as well as other reports and testimonies we issued from March 2005  through February 2016. For the past products, among other things, we  analyzed DHS strategies and other documents related to the  department’s efforts to address the Strengthening DHS Management  Functions high-risk area, reviewed our past reports issued since DHS  began its operations in March 2003, and interviewed DHS officials. More  detailed information on the scope and methodology of our prior work can  be found within each specific report. This statement is also based on  analyses from our ongoing assessment of DHS’s efforts to strengthen  and integrate its management functions since February 2015. We expect  to report our final results from this work in our 2017 high-risk update. For  our analyses, among other things, we analyzed DHS documentation,  such as departmental guidance and plans, and met with DHS officials,  including the Under Secretary for Management and other senior officials,  to discuss DHS’s efforts to address the Strengthening DHS Management  Functions high-risk area. On January 29, 2016, DHS provided us with an  updated version of its Integrated Strategy for High Risk Management. We  plan to analyze this update as part of our ongoing assessment of DHS’s  progress in addressing the Strengthening DHS Management Functions  high-risk area.
We conducted the work on which this statement is based from March  2004 through March 2016 in accordance with generally accepted  government auditing standards. Those standards require that we plan  and perform the audit to obtain sufficient, appropriate evidence to provide  a reasonable basis for our findings and conclusions based on our audit  objectives. We believe that the evidence obtained provides a reasonable  basis for our findings and conclusions based on our audit objectives.
subsections: section_title: DHS Has Made Progress in Strengthening Its Management Functions, but Considerable Work Remains
subsections: section_title: DHS Progress in Meeting Criteria for Removal from the High-Risk List
paragraphs: DHS’s efforts to strengthen and integrate its management functions have  resulted in progress addressing our criteria for removal from the high-risk  list. In particular, in our February 2015 high-risk update report, we found  that DHS had met two criteria and partially met the remaining three  criteria. DHS subsequently met an additional criterion—establishing a  framework for monitoring progress—and therefore as of March 2016, has  met three criteria and partially met the remaining two criteria, as shown in  table 1.
Leadership commitment (met). We found in our 2015 report and have  observed over the last year that the Secretary and Deputy Secretary of  Homeland Security, the Under Secretary for Management at DHS, and  other senior officials have continued to demonstrate exemplary  commitment and top leadership support for addressing the department’s  management challenges. Additionally, they have taken actions to  institutionalize this commitment to help ensure the long-term success of  the department’s efforts. For example, in April 2014, the Secretary of  Homeland Security issued a memorandum entitled Strengthening  Departmental Unity of Effort, committing to, among other things,  improving DHS’s planning, programming, budgeting, and execution  processes through strengthened departmental structures and increased  capability. Senior DHS officials, including the Deputy Secretary and  Under Secretary for Management, have also routinely met with us over  the past 7 years to discuss the department’s plans and progress in  addressing this high-risk area, most recently in February 2016.  Throughout this time, we provided specific feedback on the department’s  efforts. We concluded in our 2015 report and continue to believe that it  will be important for DHS to maintain its current level of top leadership  support and commitment to ensure continued progress in successfully  executing its corrective actions through completion.
Action plan (met). We found that DHS has established a plan for  addressing this high-risk area. Specifically, in a September 2010 letter to  DHS, we identified and DHS agreed to achieve 31 actions and outcomes  that are critical to addressing the challenges within the department’s  management areas and in integrating those functions across the  department. In March 2014, we updated the actions and outcomes in  collaboration with DHS to reduce overlap and ensure their continued  relevance and appropriateness. These updates resulted in a reduction  from 31 to 30 total actions and outcomes. Toward achieving the actions  and outcomes, DHS issued its initial Integrated Strategy for High Risk  Management in January 2011 and has since provided updates to its  strategy in nine later versions, most recently in January 2016. The  integrated strategy includes key management initiatives and related  corrective actions plans for addressing DHS’s management challenges  and the actions and outcomes we identified. For example, the January  2016 strategy update includes an initiative focused on financial systems  modernization and an initiative focused on IT human capital  management. These initiatives support various actions and outcomes,  such as modernizing the U.S. Coast Guard’s financial management  system and implementing an IT human capital strategic plan,  respectively. We concluded in our 2015 report and continue to believe  that DHS’s strategy and approach to continuously refining actionable  steps to implementing the outcomes, if implemented effectively and  sustained, should provide a path for DHS to be removed from our high- risk list.
Capacity (partially met). In October 2014, DHS identified that it had  resources needed to implement 7 of the 11 initiatives the department had  under way to achieve the actions and outcomes, but did not identify  sufficient resources for the 4 remaining initiatives. In addition, our prior  work has identified specific capacity gaps that could undermine  achievement of management outcomes. For example, in April 2014, we  reported that DHS needed to increase its cost-estimating capacity and  that the department had not approved baselines for 21 of 46 major  acquisition programs. These baselines—which establish cost, schedule,  and capability parameters—are necessary to accurately assess program  performance. Thus, in our 2015 report, we concluded that DHS needs to  continue to identify resources for the remaining initiatives; work to  mitigate shortfalls and prioritize initiatives, as needed; and communicate  to senior leadership critical resource gaps. In its January 2016 strategy  update, DHS stated that the department had addressed capacity  shortcomings it previously identified and self-assesses the capacity  criterion as fully met. We are analyzing DHS’s capacity to resolve risks as  part of our ongoing assessment of the department’s progress in  addressing the Strengthening DHS Management Functions high-risk area  and will report on our findings in our 2017 high-risk update.
Monitoring (met). In our 2015 report we found that DHS established a  framework for monitoring its progress in implementing the integrated  strategy it identified for addressing the 30 actions and outcomes. In the  June 2012 update to the Integrated Strategy for High Risk Management,  DHS included, for the first time, performance measures to track its  progress in implementing all of its key management initiatives. DHS  continued to include performance measures in its October 2014 update.  However, in our 2015 report we also found that DHS could strengthen its  financial management monitoring efforts and thus concluded that the  department had partially met the criterion for establishing a framework to  monitor progress. In particular, according to DHS officials, as of  November 2014, they were establishing a monitoring program that would  include assessing whether financial management systems modernization  projects for key components that DHS plans to complete in 2019 are  following industry best practices and meet users’ needs. However, DHS  had not yet entered into a contract for independent verification and  validation services in connection with its efforts to establish this program.  Effective implementation of these modernization projects is important  because, until they are complete, the department’s current systems will  not effectively support financial management operations. DHS  subsequently entered into a contract for independent verification and  validation services that should help ensure the financial management  systems modernization projects meet key requirements. As a result, we  currently assess DHS to have met the framework to monitor progress  criterion. As we concluded in our 2015 report and continue to believe,  moving forward, DHS will need to closely track and independently  validate the effectiveness and sustainability of its corrective actions and  make midcourse adjustments, as needed.
Demonstrated progress (partially met). We found in our 2015 report  that DHS had made important progress in strengthening its management  functions, but needed to demonstrate sustainable, measurable progress  in addressing key challenges that remain within and across these  functions. In particular, we found that DHS had implemented a number of  actions demonstrating the department’s progress in strengthening its  management functions. For example, DHS had strengthened its  enterprise architecture program (or blueprint) to guide and constrain IT  acquisitions and obtained a clean opinion on its financial statements for 2  consecutive years, fiscal years 2013 and 2014. DHS has continued to  demonstrate important progress over the last year by, for example,  obtaining a clean opinion on its financial statements for a third  consecutive year. However, we also found in our 2015 report that DHS  continued to face significant management challenges that hindered the  department’s ability to accomplish its missions. For example, DHS did not  have the acquisition management tools in place to consistently  demonstrate whether its major acquisition programs were on track to  achieve their cost, schedule, and capability goals. In addition, DHS did  not have modernized financial management systems, which affected its  ability to have ready access to reliable information for informed decision  making. Over the last year DHS has continued to take actions to address  these challenges but they persist, as discussed in more detail below. As  we concluded in our 2015 report, addressing these and other  management challenges will be a significant undertaking that will likely  require several years, but will be critical for the department to mitigate the  risks that management weaknesses pose to mission accomplishment.
section_title: DHS Progress in Achieving Key High-Risk Actions and Outcomes
paragraphs: Key to addressing the department’s management challenges is DHS  demonstrating the ability to achieve sustained progress across the 30  actions and outcomes we identified and DHS agreed were needed to  address the high-risk area. Achieving sustained progress across the  actions and outcomes, in turn, requires leadership commitment, effective  corrective action planning, adequate capacity (that is, the people and  other resources), and monitoring the effectiveness and sustainability of  supporting initiatives. The 30 actions and outcomes address each  management function (acquisition, IT, financial, and human capital) as  well as management integration. For example, one of the outcomes  focusing on acquisition management  is validating required acquisition  documents in accordance with a department-approved, knowledge-based  acquisition process, and the outcomes focusing on financial management  include sustaining clean audit opinions for at least 2 consecutive years on  department-wide financial statements and internal controls.
We found in our 2015 report that DHS had made important progress  across all of its management functions and significant progress in the  area of management integration. In particular, DHS had made important  progress in several areas to fully address 9 actions and outcomes, 5 of  which it had sustained as fully implemented for at least 2 years. For  instance, DHS fully met 1 outcome for the first time by obtaining a clean  opinion on its financial statements for 2 consecutive years and sustained  full implementation of another outcome by continuing to use performance  measures to assess progress made in achieving department-wide  management integration. Since our 2015 update, DHS fully addressed  another outcome as a result of actions it has taken to improve the  maturity of its system acquisition management practices, leaving  additional work to fully address the remaining 20 outcomes. As of March  2016, DHS has also mostly addressed an additional 7 actions and  outcomes—3 since our 2015 report—meaning that a small amount of  work remains to fully address them.
We also found in our 2015 report and continue to observe, that  considerable work remains, however, in several areas for DHS to fully  achieve the remaining actions and outcomes and thereby strengthen its  management functions. Specifically, as of March 2016, DHS has partially  addressed 9 and initiated 4 of the actions and outcomes. As previously  mentioned, addressing some of these actions and outcomes, such as  modernizing the department’s financial management systems, are  significant undertakings that will likely require multiyear efforts. Table 2  summarizes DHS’s progress in addressing the 30 actions and outcomes  as of March 2016, and is followed by selected examples.
Acquisition management. DHS has fully addressed 1 of the 5  acquisition management outcomes, mostly addressed 2 outcomes,  partially addressed 1 outcome, and initiated actions to address the  remaining outcome. For example, DHS has taken a number of actions to  fully address establishing effective component-level acquisition capability.  These actions include initiating (1) monthly Component Acquisition  Executive staff forums to provide guidance and share best practices and  (2) assessments of component policies and processes for managing  acquisitions. DHS has also continued to make progress addressing the  outcome on validating required acquisition documents in a timely manner.  Specifically, the Under Secretary for Management provided direction to  the components on submitting the outstanding documentation. We will  continue to assess DHS’s progress on this outcome. In addition, DHS has  conducted staffing analysis reports that quantify gaps in acquisition  personnel by position. Moving forward, DHS must develop and implement  a plan for filling key vacant positions identified through its staffing analysis  reports. Further, DHS should continue to improve its acquisition program  management by effectively using the Joint Requirements Council, which it  reinstated in June 2014, to identify and eliminate any unintended  redundancies in program requirements, and by demonstrating that major  acquisition programs are on track to achieve their cost, schedule, and  capability goals.
IT management. DHS has fully addressed 3 of the 6 IT management  outcomes, mostly addressed another 2, and partially addressed the  remaining 1. For example, DHS has finalized a directive to establish its  tiered governance and portfolio management structure for overseeing and  managing its IT investments, and annually reviews each of its portfolios  and the associated investments to determine the most efficient allocation  of resources within each of the portfolios. The department has also made  progress in implementing its IT Strategic Human Capital Plan for fiscal  years 2010 through 2012. However, in January 2015 DHS shifted its IT  paradigm from acquiring assets to acquiring services, and acting as a  service broker (i.e., an intermediary between the purchaser of a service  and the seller of that service). According to DHS officials in May 2015,  this paradigm change will require a major transition in the skill sets of  DHS’s IT workforce, as well as the hiring, training, and managing of staff  with those new skill sets; as such, this effort will need to be closely  managed in order to succeed. Additionally, we found that DHS continues  to take steps to enhance its information security program. However, while  the department made progress in remediating findings from the previous  year, in November 2015, the department’s financial statement auditor  designated deficiencies in IT systems controls as a material weakness for  financial reporting purposes for the 12th consecutive year. This  designation was due to flaws in security controls such as those for access  controls, configuration management, segregation of duties, and  contingency planning. Thus, DHS needs to remediate this longstanding  material weakness. Information security remains a major management  challenge for the department.
Financial management. DHS has fully addressed 2 financial  management outcomes, partially addressed 3, and initiated 3. Most  notably, DHS received a clean audit opinion on its financial statements for  3 consecutive years, fiscal years 2013, 2014, and 2015, fully addressing  2 outcomes. In addition, in November 2015, DHS’s financial statement  auditors reported that one of four material weaknesses in its internal  controls over financial reporting had been reduced to a significant  deficiency in connection with its remediation efforts. However, the  remaining material weaknesses reported by DHS auditors continue to  hamper DHS’s ability to establish effective internal control over financial  reporting and comply with financial management system requirements.  DHS continues to make progress on three multi-year projects to  modernize selected components’ financial management systems.  According to its January 2016 strategy update, DHS has made the most  progress on its U.S. Coast Guard modernization project; whereas  additional planning and discovery efforts need to be completed on its  projects to modernize Federal Emergency Management Agency and U.S.  Immigration and Customs Enforcement financial management systems  before DHS will be in a position to implement modernized solutions for  these components and their customers. Without sound controls and  systems, DHS faces long-term challenges in sustaining a clean audit  opinion on its financial statements and in obtaining and sustaining a clean  opinion on its internal control over financial reporting, and ensuring its  financial management systems generate reliable, useful, and timely  information for day-to-day decision making as a routine business  operation.
Human capital management. DHS has fully addressed 1 human capital  management outcome, mostly addressed 3, and partially addressed the  remaining 3. For example, the Secretary of Homeland Security signed a  human capital strategic plan in 2011 that DHS has since made sustained  progress in implementing, fully addressing this outcome. DHS also has  actions under way to identify current and future human capital needs, an  outcome it mostly addressed since our 2015 report due to progress  implementing its Workforce Planning Model. However, DHS has  considerable work ahead to improve employee morale. For example, the  Office of Personnel Management’s 2015 Federal Employee Viewpoint  Survey data showed that DHS ranked last among 37 large federal  agencies in all four dimensions of the survey’s index for human capital  accountability and assessment. Further, the survey data showed that  DHS’s scores continued to decrease in three index dimensions (job  satisfaction, leadership and knowledge management, and results-oriented  performance culture) and remained constant in the fourth dimension  (talent management). DHS has developed plans for addressing its  employee satisfaction problems, but as we previously recommended,  DHS needs to continue to improve its root-cause analysis efforts related  to these plans.
DHS has also developed and implemented mechanisms to assess  training programs but could take additional actions. For example, in  September 2014, we found that DHS had implemented component- specific and department-wide training programs and that the five DHS  components in our review all had documented processes to evaluate their  training programs. However, to fully achieve this outcome, DHS also  needs to, among other things, issue department-wide policies on training  and development and strengthen its learning management capabilities. In  February 2016, we reported that DHS had initiated the Human Resources  Information Technology (HRIT) investment in 2003 to address issues  presented by its human resource environment, which with respect to  learning management, included limitations resulting from nine disparate  learning management systems that did not exchange information. DHS  established the Performance and Learning Management System  (PALMS) program to provide a system that will consolidate DHS’s nine  existing learning management systems into one system and enable  comprehensive training reporting and analysis across the department,  among other things. However, in our February 2016 report we found that  selected PALMS capabilities had been deployed to headquarters and two  components, but full implementation at four components was not planned,  leaving uncertainty about whether the PALMS system would be used  enterprise-wide to accomplish these goals. We further found that DHS did  not fully implement effective acquisition management practices and  therefore was limited in monitoring and overseeing the implementation of  PALMS and ensuring that the department obtains a system that improves  its learning management weaknesses, reduces duplication, and delivers  within cost and schedule commitments. We made 14 recommendations to  DHS to, among other things, address HRIT’s poor progress and  ineffective management. DHS concurred with all 14 recommendations  and provided estimated completion dates for implementing each of them.
Management integration. DHS has sustained its progress in fully  addressing 3 of 4 outcomes we identified and they agreed are key to the  department’s management integration efforts. For example, in January  2011, DHS issued an initial action plan to guide its management  integration efforts—the Integrated Strategy for High Risk Management.  Since then, DHS has generally made improvements to the strategy with  each update based on feedback we provided. DHS has also shown  important progress in addressing the last and most significant  management integration outcome—to implement actions and outcomes in  each management area to develop consistent or consolidated processes  and systems within and across its management functional areas—but, as  we concluded in our 2015 update, considerable work remains. For  example, the Secretary’s April 2014 Strengthening Departmental Unity of  Effort memorandum highlighted a number of initiatives designed to allow  the department to operate in a more integrated fashion. Further, in its  January 2016 update, DHS reported that in August 2015 the Under  Secretary for Management identified four integrated priority areas to bring  focus to strengthening integration among the department’s management  functions. According to DHS’s January 2016 update, these priorities— which include, for example, strengthening resource allocation and  reporting ability and developing and deploying secure technology  solutions—each have stretch goals and milestones that are monitored by  integrated teams led by senior DHS officials. However, given that these  management integration initiatives are in the early stages of  implementation, it is too early to assess their impact.
We concluded in our 2015 report and continue to believe that in the  coming years, DHS needs to continue implementing its Integrated  Strategy for High Risk Management and show measurable, sustainable  progress in implementing its key management initiatives and corrective  actions and achieving outcomes. In doing so, it will be important for DHS  to maintain its current level of top leadership support and sustained  commitment to ensure continued progress in executing its corrective  actions through completion;  continue to implement its plan for addressing this high-risk area and  periodically report its progress to us and Congress; identify and work to mitigate any resource gaps and prioritize  initiatives as needed to ensure it can implement and sustain its  corrective actions; closely track and independently validate the effectiveness and  sustainability of its corrective actions and make midcourse  adjustments as needed; and make continued progress in achieving the 20 actions and outcomes it  has not fully addressed and demonstrate that systems, personnel,  and policies are in place to ensure that results can be sustained over  time.
We will continue to monitor DHS’s efforts in this high-risk area to  determine if the actions and outcomes are achieved and sustained over  the long term.
section_title: DHS Continues to Strengthen Acquisition Management, Though Key Efforts Need to Be Completed
paragraphs: Each year, DHS invests billions of dollars in its major acquisition  programs to help execute its many critical missions. In fiscal year 2015  alone, DHS reported that it planned to spend approximately $7.2 billion  on these acquisition programs, and the department expects it will  ultimately invest more than $180 billion in them. DHS and its underlying  components are acquiring systems to help secure the border, increase  marine safety, screen travelers, enhance cyber security, improve disaster  response, and execute a wide variety of other operations. Each of DHS’s  major acquisition programs generally costs $300 million or more and  spans multiple years.
To help manage these programs, DHS has established an acquisition  management policy that we found in September 2012 to be generally  sound, in that it reflects key program management practices. However,  we also have found that DHS has lacked discipline in managing its  programs according to this policy, and that many acquisition programs  have faced a variety of challenges. These challenges can contribute to  poor acquisition outcomes, such as cost increases or the risk of end  users—such as border patrol agents or first responders in a disaster— receiving technologies that do not work as expected.
Reflecting the shortcomings we have identified since 2005, we have  made 64 recommendations to DHS on acquisition management issues;  42 of which have been implemented. Our findings also formed the basis  of the five acquisition management outcomes identified in the high risk  list, which DHS continues to address. As detailed below, DHS has fully  addressed one outcome, mostly addressed two outcomes, partially  addressed one outcome, and initiated efforts to address the final  outcome.
Outcome 1: Validate required acquisition documents in a timely  manner (mostly addressed);
Outcome 2: Establish effective component level acquisition capability  (fully addressed);
Outcome 3: Establish and effectively operate the Joint Requirements  Council (partially addressed);
Outcome 4: Assess and address whether appropriate numbers of  trained acquisition personnel are in place at the department  component levels (mostly addressed); and
Outcome 5: Demonstrate that major acquisition programs are on track  to achieve their cost, schedule, and capability goals (initiated).
subsections: section_title: 2005 to 2008: A Decentralized Acquisition Management Structure Hampered Early Oversight Efforts
paragraphs: In March 2005, we reported that a lack of clear accountability was  hampering DHS’s efforts to integrate the acquisition functions of its  numerous organizations into an effective whole. We found that DHS  remained a collection of disparate organizations, many of which were  performing functions with insufficient oversight, giving rise to an  environment rife with challenges. For example, the Chief Procurement  Officer had been delegated the responsibility to manage, administer, and  oversee all acquisition activity across DHS, but in practice enforcement of  these activities was spread throughout the department with unclear  accountability. We concluded that unless DHS’s top leaders addressed  these challenges, the department was at risk of continuing to exist with a  fragmented acquisition organization that provided stopgap, ad hoc  solutions.
In November 2008, we found that billions invested in major acquisition  programs continued to lack appropriate oversight. While the acquisition  review process DHS had in place at the time of our review called for  executive decision making at key points in an acquisition program’s life  cycle, the process had not provided the oversight needed to identify and  address cost, schedule, and performance problems in its major  investments. Poor implementation of the process was evidenced by the  number of programs that did not adhere to the department’s acquisition  review policy—of DHS’s 48 major programs requiring milestone and  annual reviews, 45 were not assessed in accordance with this policy.  Furthermore, at least 14 of these programs had reported cost growth,  schedule slips, or performance shortfalls. We found that poor  implementation was largely the result of DHS’s failure to ensure that the  department’s major acquisition decision-making bodies effectively carried  out their oversight responsibilities and had the resources to do so. For  example, although a Joint Requirements Council had been responsible  for managing acquisition investment portfolios and validating  requirements, the council had not met since 2006.
We also found in November 2008 that acquisition program budget  decisions had been made in the absence of required oversight reviews  and, as a result, DHS could not ensure that annual funding decisions for  its major investments made the best use of resources and addressed  mission needs. We found almost a third of DHS’s major investments  received funding without having validated mission needs and  requirements—which confirm a need is justified—and two-thirds did not  have required life-cycle cost estimates. Without validated requirements,  life-cycle cost estimates, and regular portfolio reviews, DHS cannot  ensure that its investment decisions are appropriate and will ultimately  address capability gaps. In July 2008, 15 of the 57 DHS major  investments we reviewed were designated by the Office of Management  and Budget as poorly planned and by DHS as poorly performing. Among  other things, we recommended that DHS reinstate the Joint  Requirements Council or establish another departmental joint  requirements oversight board to review and approve acquisition  requirements and assess potential duplication of effort.
section_title: 2008 to 2012: DHS Established, but Did Not Consistently Implement, a Sound Acquisition Policy
paragraphs: In November 2008, DHS issued the initial version of Acquisition  Management Directive 102-01—the policy in effect today—in an effort to  establish an acquisition management system that effectively provides  required capability to operators in support of the department’s missions.  DHS Acquisition Management Directive 102-01 and DHS Instruction  Manual 102-01-001, which includes 12 appendixes, establish the  department’s policies and processes for managing these major  acquisition programs. In September 2012 we found that these documents  reflect many key program management practices that could help mitigate  program risks. Table 3 presents our 2012 assessment of the policy.
However, in September 2012 we also found that DHS had not  consistently met the policy’s requirements. At the time of our 2012 review,  the department had only verified that 4 of 66 programs documented all of  the critical knowledge the policy requires to proceed with acquisition  activities. See figure 1.
In 2012, most major programs lacked reliable cost estimates, realistic  schedules, and agreed-upon baseline objectives, limiting DHS  leadership’s ability to effectively manage those programs and provide  information to Congress. As a result, we were only able to gain insight  into the magnitude of the cost growth for 16 of 77 programs we reviewed,  but we found that their aggregate cost estimates had increased by 166  percent.
Additionally, we found that nearly all of the DHS program managers we  surveyed in 2012 reported their programs had experienced significant  challenges. Sixty-eight of the 71 respondents reported they experienced  funding instability, faced workforce shortfalls, or their planned capabilities  changed after initiation, and most survey respondents reported a  combination of these challenges.
section_title: 2012 to 2015: DHS Continued to Strengthen Acquisition Management, Which Highlighted Remaining Issues
paragraphs: DHS has concurred with and presented plans for addressing all of the  acquisition management recommendations that we have addressed to  the Secretary since September 2012, the implementation of which will  enhance acquisition management. For example, in April 2014, we found  that the department’s Acquisition Review Board rarely directed programs  to make tradeoffs for affordability. We recommended that this board  assess program-specific tradeoffs at all of its meetings, particularly in light  of the fact that the department had identified a 30-percent gap between  the 5-year funding needed for its major acquisitions and the actual  resources expected to be available. DHS has since implemented this  recommendation.
Furthermore, in reviews completed in March, April, and October of 2015,  we found that DHS had taken steps to improve oversight of its major  acquisition programs and that it had begun to implement its 2008  acquisition policy more consistently. Many of DHS’s recent actions  correspond to the high risk outcomes, as shown in the table 4.
DHS faced a unique challenge when it was formed—merging 22 separate  entities into a single department—which included integrating the  acquisition functions of its numerous organizations into an effective  whole. The department is to be commended for the efforts its leadership  has taken to address the acquisition management shortcomings we have  identified over the past 10 years. However, in our April 2015 review, we  continued to find enduring challenges to acquisition programs, such as:
Staffing shortfalls—DHS reported that 21 of the 22 programs we  reviewed faced program office workforce shortfalls pertaining to such  positions as program managers, systems engineers, and logisticians.
Program funding gaps—we found that 11 of the 22 programs we  reviewed faced funding gaps (projected funding vs. estimated costs)  of 10 percent or greater, including five programs that faced gaps of 30  percent or greater.
Inconsistencies in how components were implementing the  department’s acquisition management policy—for example, we found  that the funding plans for Coast Guard programs continued to be  incomplete, in that they did not account for all of the operations and  maintenance funding the Coast Guard planned to allocate to its major  acquisition programs. These gaps in information reduce the value of  the funding plans presented to Congress and obscure the affordability  of Coast Guard acquisition programs.
Further, as we noted in our most recent high risk update, the department  has additional work to do to fully address the remaining acquisition  management outcomes. To address these issues, we have, among other  things, recommended that DHS assess program-specific affordability  tradeoffs at all acquisition review meetings and ensure that funding plans  submitted to Congress are comprehensive and clearly account for all  operations and maintenance funding that DHS plans to allocate to its  programs. DHS concurred with these recommendations and is taking  actions to implement them. For example, DHS established that  department leadership would, during all acquisition program reviews,  specifically address affordability issues and make explicit tradeoffs as  necessary, and DHS officials told us that DHS leadership is discussing  affordability at all program reviews to help ensure adequate funding  exists. Additionally, DHS has continued to obtain department-level  approval for program baselines as needed, and has initiated efforts to  improve the quality of acquisition data reported by components.
To ensure that recent efforts are sustained, the department must continue  to implement its sound acquisition policy consistently and effectively  across all components. We continue to track DHS’s progress through  ongoing reviews of the Joint Requirements Council, non-major program  acquisitions, and our annual assessment of major acquisition programs,  in addition to our high risk updates.
Chairman Johnson, Ranking Member Carper, and members of the  committee, this completes our prepared statement. We would be happy to  respond to any questions you may have at this time.
section_title: GAO Contact and Staff Acknowledgments
paragraphs: For further information about this testimony, please contact Rebecca  Gambler at (202) 512-8777 or gamblerr@gao.gov or Michele Mackin at  (202)-512-4841 or mackinm@gao.gov. In addition, contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this statement. Individuals making key contributions to  this statement include Larry Crosland, Jennifer Kamara, James Kernen,  Emily Kuhn, Elizabeth Luke, Valerie Freeman, David Lysy, Taylor  Matheson, Shannin O’Neill, Lindsay Taylor, Nathan Tranquilli, Katherine  Trimble, and Shaunyce Wallace. Key contributors for the previous work  that this testimony is based on are listed in each product.
section_title: Related GAO Products
paragraphs: Homeland Security: Weak Oversight of Human Resources Information  Technology Investment Needs Considerable Improvement. GAO-16- 407T. Washington, D.C.: February 25, 2016.
Homeland Security: Oversight of Neglected Human Resources  Information Technology Investment Is Needed. GAO-16-253.  Washington, D.C.: February 11, 2016.
Immigration Benefits System: Better Informed Decision Making Needed  on Transformation Program. GAO-15-415. Washington, D.C.: May 18,  2015.
Homeland Security Acquisitions: Major Program Assessments Reveal  Actions Needed to Improve Accountability. GAO-15-171SP. Washington,  D.C.: April 22, 2015.
Homeland Security Acquisitions: DHS Should Better Define Oversight  Roles and Improve Program Reporting to Congress. GAO-15-292.  Washington, D.C.: March 12, 2015.
Department of Homeland Security: Progress Made, but More Work  Remains in Strengthening Management Functions. GAO-15-388T.  Washington, D.C.: February 26, 2015.
DHS Training: Improved Documentation, Resource Tracking, and  Performance Measurement Could Strengthen Efforts. GAO-14-688.  Washington, D.C.: September 10, 2014.
Department of Homeland Security: Progress Made; Significant Work  Remains in Addressing High-Risk Areas. GAO-14-532T. Washington,  D.C.: May 7, 2014.
Homeland Security Acquisitions: DHS Could Better Manage Its Portfolio  to Address Funding Gaps and Improve Communications with Congress.  GAO-14-332. Washington, D.C.: April 17, 2014.
Department of Homeland Security: DHS’s Efforts to Improve Employee  Morale and Fill Senior Leadership Vacancies. GAO-14-228T.  Washington, D.C.: December 12, 2013.
DHS Financial Management: Continued Effort Needed to Address  Internal Control and System Challenges. GAO-14-106T. Washington,  D.C.: November 15, 2013.
Information Technology: Additional OMB and Agency Actions Are Needed  to Achieve Portfolio Savings. GAO-14-65. Washington, D.C.: November  6, 2013.
DHS Financial Management: Additional Efforts Needed to Resolve  Deficiencies in Internal Controls and Financial Management Systems.  GAO-13-561. Washington, D.C.: September 30, 2013.
Information Technology: Additional Executive Review Sessions Needed  to Address Troubled Projects. GAO-13-524. Washington, D.C.: June 13,  2013.
Department of Homeland Security: Taking Further Action to Better  Determine Causes of Morale Problems Would Assist in Targeting Action  Plans. GAO-12-940. Washington, D.C.: September 28, 2012.
Homeland Security: DHS Requires More Disciplined Investment  Management to Help Meet Mission Needs. GAO-12-833. Washington,  D.C.: September 18, 2012.
Department of Homeland Security: Billions Invested in Major Programs  Lack Appropriate Oversight. GAO-09-29. Washington, D.C.: November  18, 2008.
Homeland Security: Successes and Challenges in DHS’s Efforts to  Create an Effective Acquisition Organization. GAO-05-179. Washington,  D.C.: March 29, 2005.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.