Homeland Security: U.S. Visitor and Immigrant Status Indicator Technology Program Planning and Execution Improvements Needed
Published: 2008-12-12T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Department of Homeland Security (DHS) has established a program known as U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT) to collect, maintain, and share information, including biometric identifiers, on certain foreign nationals who travel to and from the United States. By congressional mandate, DHS is to develop and submit an expenditure plan for US-VISIT that satisfies certain conditions, including being reviewed by GAO. GAO's objectives were to (1) determine if the plan satisfies the twelve legislative conditions and (2) provide observations about the plan and management of the program. To accomplish this, GAO assessed the plan and related DHS certification letters against each aspect of each legislative condition and assessed program documentation against federal guidelines and industry standards.
section_title: What GAO Found
paragraphs: The fiscal year 2008 US-VISIT expenditure plan does not fully satisfy any of the eleven conditions required of DHS by the Consolidated Appropriations Act, 2008, either because the plan does not address key aspects of the condition or because what it does address is not adequately supported or is otherwise not reflective of known program weaknesses. More specifically, of the eleven conditions, the plan partially satisfies eight. For example, while the plan includes a listing of GAO recommendations, it does not provide milestones for addressing these recommendations, as required by the act. Further, although the plan includes a certification by the DHS Chief Procurement Officer that the program has been reviewed and approved in accordance with the department's investment management process, and that this process fulfills all capital planning and investment control requirements and reviews established by the Office of Management and Budget, the certification is based on information that pertains to the fiscal year 2007 expenditure plan and fiscal year 2009 budget submission, rather than to the fiscal year 2008 expenditure plan. Moreover, even though the plan provides an accounting of operations and maintenance and program management costs, the plan does not separately identify the program's contractor services costs, as required by the act. With regard to the remaining three legislative conditions, the plan does not satisfy any of them. For example, the plan does not include a certification by the DHS Chief Human Capital Officer that the program's human capital needs are being strategically and proactively managed and that the program has sufficient human capital capacity to execute the expenditure plan. Further, the plan does not include a detailed schedule for implementing an exit capability or a certification that a biometric exit capability is not possible within 5 years. The twelfth legislative condition was satisfied by our review of the expenditure plan. Beyond the expenditure plan, GAO observed that other program planning and execution limitations and weaknesses also confront DHS in its quest to deliver US-VISIT capabilities and value in a timely and cost-effective manner. Concerning DHS's proposed biometric air and sea exit solution, for example, the reliability of the cost estimates used to justify the proposed solution is not clear, the proposed solution would provide less security and privacy than other alternatives, and public comments on the proposed solution raise additional concerns, including the impact the solution would have on the industry's efforts to improve passenger processing and travel. Moreover, the program's risk management database shows that key risks are not being managed. Finally, frequent rebaselining of one of the program's task orders has minimized the significance of schedule variances. Collectively, this means that additional management improvements are needed to effectively define, justify, and deliver a US-VISIT system solution that meets program goals, reflects stakeholder input, minimizes exposure to risk, and provides Congress with the means by which to oversee program execution. Until these steps are taken, US-VISIT program performance, transparency, and accountability will suffer.

section_title: Letter
paragraphs: The Department of Homeland Security (DHS) submitted to Congress on  June 12, 2008, its fiscal year 2008 expenditure plan for the U.S. Visitor and  Immigrant Status Indicator Technology (US-VISIT) program pursuant to  the Consolidated Appropriations Act, 2008. US-VISIT is a governmentwide  program to collect, maintain, and share information on foreign nationals  who enter and exit the United States. The program’s goals are to enhance  the security of U.S. citizens and visitors, facilitate legitimate trade and  travel, ensure the integrity of the U.S. immigration system, and protect the  privacy of visitors to the United States. Currently, US-VISIT entry  capabilities are operating at over 300 land, sea, and air ports of entry;  however, exit capabilities are not yet operating. DHS near-term plans call  for enhancing existing biometric collection, identification, and sharing  capabilities, as well as introducing an exit capability at airports and  seaports.
As required by the appropriations act, we reviewed US-VISIT’s fiscal year  2008 expenditure plan. Our objectives were to (1) determine whether the  plan satisfies the legislative conditions and (2) provide observations about  the plan and management of the program.
On September 15, 2008, we briefed the staffs of the Senate and House  Appropriations Subcommittees on Homeland Security on the results of our  review. This letter summarizes and transmits these results, with the  exception of information that DHS deemed contractor sensitive. A  redacted version of the briefing, including our scope and methodology, is  reprinted in appendix I. In a separate report designated “For Official Use  Only,” we summarize and transmit the full briefing.
We performed this audit from June 2008 to September 2008 in accordance  with generally accepted government auditing standards. Those standards  require that we plan and perform the audit to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe that the evidence obtained  provides a reasonable basis for our findings and conclusions based on our  audit objectives.
subsections: section_title: Compliance with Legislative Conditions
paragraphs: The US-VISIT expenditure plan partially satisfies 8 of the 11 legislative  conditions required of DHS. For example, the plan partially satisfies the  legislative conditions that it    contain a listing of all open GAO and DHS Office of Inspector General  recommendations. Specifically, while the plan did include a listing and  status of our recommendations, it did not provide milestones for  addressing any of the recommendations, as required by the act.  include a certification by the DHS Chief Procurement Officer that the  program was reviewed and approved in accordance with the department’s  investment management process and that this process fulfilled all capital  planning and investment control requirements and reviews established by  the Office of Management and Budget (OMB). While the plan did include  such a certification, it was based on information that pertains to the fiscal  year 2007 expenditure plan and the fiscal year 2009 budget submission,  rather than on the fiscal year 2008 expenditure plan, as required by the act.  include an architectural compliance certification by the Chief Information  Officer that the system architecture of the program is sufficiently aligned  with the information system enterprise architecture of DHS. Specifically,  while the plan did include such a certification, the basis for the  certification was an assessment against the 2007 DHS enterprise  architecture, which is a version that we recently reported to be missing  important US-VISIT architectural content.    provide a detailed accounting of operations and maintenance, contractor  services, and program management costs. While the plan did provide an  accounting of operations and maintenance, and program management  costs, it did not separately identify the program’s contractor costs, as  required by the act.
The plan does not satisfy the remaining three conditions that apply to  DHS. Specifically:    The expenditure plan did not explicitly define how funds are to be  obligated to meet future program commitments, including linking the  planned expenditure of funds to milestone-based delivery of specific  capabilities and services. While the plan linked funding to four broad core  capability areas and associated projects, it did not link this planned use of  funds to milestones, and it did not consistently decompose projects into  specific mission capabilities, services, performance levels, benefits and  outcomes, or program management capabilities.
The expenditure plan did not include a certification by the DHS Chief  Human Capital Officer that the program’s human capital needs are being  strategically and proactively managed and that the program has sufficient  human capital capacity to execute the expenditure plan. While the plan  contained a certification, it only addressed that the human capital plan  reviewed by the Chief Human Capital Officer contained specific initiatives  to address the hiring, development, and retention of program employees  and that a strategy existed to develop indicators to measure the progress  and results of these initiatives. It did not address the implementation of  this plan or whether the current human capital capabilities were sufficient  to execute the expenditure plan.
The expenditure plan did not include a complete schedule for the full  implementation of a biometric exit program or certification that a  biometric exit program is not possible within 5 years. While the plan  contains a very high-level schedule that identifies five broadly defined  tasks and high-level milestones, the schedule did not include, among other  things, decomposition of the program into a work breakdown structure or  sequencing, integrating, or resourcing each work element in the work  breakdown structure.
section_title: Observations on US- VISIT
paragraphs: We are making five observations about US-VISIT relative to its proposed  exit solution, its management of program risks, and its use of earned value  management. These observations are summarized here.
Reliability of cost estimates for air and sea exit alternatives is not clear.
In developing its air and sea exit Notice of Proposed Rule Making (NPRM),  DHS is required to prepare a written assessment of the costs, benefits, and  other effects of its proposal and a reasonable number of alternatives and  to adopt the least costly, most cost-effective, or least burdensome among  them. To accomplish this, it is important that DHS have reliable cost  estimates for its proposed and alternative solutions.
However, the reliability of the estimates that DHS developed is not clear  because (1) DHS documents characterize the estimates as being, by  definition, rough and imprecise, but DHS officials responsible for  developing the estimates stated that this characterization is not accurate;  (2) our analysis of the estimates’ satisfaction of cost estimating best  practices shows that while DHS satisfied some key practices, it did not  fully satisfy others or the documentation provided was not sufficient for us  to determine whether still other practices were met; and (3) data on  certain variables pertaining to airline costs were not available for inclusion  in the estimates, and airlines report that these costs were understated in  the estimates.
DHS reports that the proposed air and sea exit solution provides less  security and privacy than other alternatives.
Adequate security and privacy controls are needed to assure that  personally identifiable information is secured against unauthorized access,  use, disclosure, or retention. Such controls are especially needed for  government agencies, where maintaining public trust is essential. In the  case of US-VISIT, one of its stated goals is to protect the security and  privacy of U.S. citizens and visitors.
DHS’s proposed air and sea exit solution would require air and vessel  carriers to implement and manage the collection of biometric data at the  location(s) of their choice. However, the NPRM states that having carriers  collect the biometric information is less secure than alternatives where  DHS collects the information, regardless of the information collection  point. Similarly, the NPRM states that the degree of confidence in  compliance with privacy requirements is lower when DHS does not  maintain full custody of personally identifiable information.
Public comments on the proposed air and sea exit solution raise a range of  additional concerns.
Ninety-one entities—including the airline, trade, and travel industries, as  well as federal, state, and foreign governments—commented on the air  and sea exit proposal. The comments that were provided raised a number  of concerns and questions about the proposed solution. For example,  comments stated that (1) technical requirements the carriers must meet in  delivering their respective parts of the proposed solution had yet to be  provided; (2) the proposed solution conflicts with air and vessel carrier  passenger processing improvements; (3) the proposed solution is not fully  integrated with other border screening programs involving air carriers;  and (4) stakeholders were not involved in this rulemaking process as they  had been in previous rulemaking efforts.
Risk management database shows that some program risks have not been  effectively managed.
Proactively managing program risks is a key acquisition management  control and, if defined and implemented properly, it can increase the  chances of programs delivering promised capabilities and benefits on time  and within budget. To its credit, the US-VISIT program office has defined a  risk management plan and related process that is consistent with relevant  guidance. However, its own risk database shows that all risks have not  been proactively mitigated. As we have previously reported, not  proactively mitigating risks increases the chances that risks become actual  cost, schedule, and performance problems.
Significance of a task order’s schedule variances have been minimized by  frequent rebaselining.
According to the GAO Cost Assessment Guide, rebaselining should occur  rarely, as infrequently as once in the life of a program or project. Schedule  rebaselining should occur only when a schedule variance is significant  enough to limit its utility as a predictor of future schedule performance.
For task order 7, the prime contractor’s largest task order, the program  office has rebaselined its schedule twice in the last 2 years—first in  October 2006 and again in October 2007. This rebaselining has resulted in  the task order showing a $3.5 million variance, rather than a $7.2 million  variance that would exist without either of the rebaselinings.
section_title: Conclusions
paragraphs: DHS has not adequately met the conditions associated with its legislatively  mandated fiscal year 2008 US-VISIT expenditure plan. The plan does not  fully satisfy any of the conditions that apply to DHS, either because it does  not address key aspects of the condition or because what it does address  is not adequately supported or is otherwise not reflective of known  program weaknesses. Given that the legislative conditions are intended to  promote the delivery of promised system capabilities and value, on time  and within budget, and to provide Congress with an oversight and  accountability tool, these expenditure plan limitations are significant.
Beyond the expenditure plan, other program planning and execution  limitations and weaknesses also confront DHS in its quest to deliver US- VISIT capabilities and value in a timely and cost-effective manner. Most  notably, DHS has proposed a solution for a long-awaited exit capability,  but it is not clear if the cost estimates used to justify it are sufficiently  reliable to do so. Also, DHS has reported that the proposed solution  provides less security and privacy than other alternatives analyzed, and  the proposed solution is being challenged by those who would be  responsible for implementing it. Further, DHS’s ability to measure  program performance and progress, and thus be positioned to address  cost and schedule shortfalls in a timely manner, is hampered by  weaknesses in the prime contractor’s implementation of earned value  management. Each of these program planning and execution limitations  and weaknesses introduce risk to the program.
In addition, DHS is not effectively managing the program’s risks, as  evidenced by the program office’s risk database showing that known risks  are being allowed to go years without risk mitigation and contingency  plans. Overall, while DHS has taken steps to implement a significant  percentage of our prior recommendations aimed at improving  management of US-VISIT, additional management improvements are  needed to effectively define, justify, and deliver a system solution that  meets program goals, reflects stakeholder input, minimizes exposure to  risk, and provides Congress with the means by which to oversee program  execution. Until these steps are taken, US-VISIT program performance,  transparency, and accountability will suffer.
section_title: Recommendations for Executive Action
paragraphs: To assist DHS in planning and executing US-VISIT, we recommend that the  Secretary of Homeland Security direct the department’s Investment  Review Board to review the reasons for the plan’s limitations and address  the challenges and weaknesses raised by our observations about the  proposed air and sea exit solution, risk management, and the  implementation of earned value management, and to report the results to  Congress.
section_title: Agency Comments and Our Evaluation
paragraphs: In written comments on a draft of this report, signed by the Director,  Departmental Audit Liaison Office, and reprinted in appendix II, DHS  concurred with our recommendations and stated that the department’s  Investment Review Board would meet for the purpose of reviewing US- VISIT and addressing our findings and recommendations. Moreover, DHS  commented that our report has prompted the department to modify the  fiscal year 2009 US-VISIT expenditure plan to provide greater visibility into  operations and maintenance and program management expenditures, and  to include milestones and performance targets for planned  accomplishments, mitigation plans, milestones for closing open  recommendations, and results relative to prior year commitments. DHS  also commented that after it received our report for comment, it issued an  interim policy for managing investments, such as US-VISIT, and thus it  disagreed with one of our findings relative to one of the legislative  conditions—namely that DHS’s investment management process is not  sufficiently mature. However, DHS did not provide the policy itself, thus  we were not able to determine whether it addressed our concerns.  Further, the memo states that the policy is draft and that implementation  of the policy, including training, still needs to occur. Thus, while we have  modified our briefing document to reflect the policy’s issuance, we have  not modified our conclusion that DHS’s investment management process  is not sufficiently mature.
We are sending copies of this report to the Chairmen and Ranking  Minority Members of other Senate and House committees and  subcommittees that have authorization and oversight responsibilities for  homeland security. We are also sending copies to the Secretary of  Homeland Security, Secretary of State, and the Director of OMB. Copies of  this report will also be available at no charge on our Web site at  http://www.gao.gov.
If you or your staffs have any questions on matters discussed in this  report, please contact me at (202) 512-3439 or at hiter@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this report. GAO staff who have made  significant contributions to this report are listed in appendix III.
section_title: Appendix I: Briefing for Staff Members of the Subcommittees on Homeland Security, Senate and House Committees on Appropriations
subsections: section_title: Homeland Security: U.S. Visitor and Immigrant Status Indicator Technology Program Planning and Execution Improvements Needed
paragraphs: Briefing for staff members of the Subcommittees on Homeland Security  Senate and House Committees on Appropriations  *This briefing has been amended on page 44 to address DHS comments.
U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT) is a Department of  Homeland Security (DHS) program for collecting, maintaining, and sharing information on  foreign nationals who enter and exit the United States. The goals of US-VISIT are to:  enhance the security of U.S. citizens and visitors,   facilitate legitimate travel and trade,   ensure the integrity of the U.S. immigration system, and   protect the privacy of our visitors.
Pub. L. No. 110-161 (Dec. 26, 2007).   Since fil yer 2002, $2.22 illion has een pproprited for US-VISIT.   Thi the eventh legitively-mndted US-VISIT expenditre pln.
4  control requirements and reviews established by the Office of Management and  Budget (OMB), including Circular A-11, part 7;   a certification by the DHS Chief Information Officer (CIO) that an independent  verification and validation agent is currently under contract for the project;     a certification by the DHS CIO that the system architecture of the program is  sufficiently aligned with the department’s information systems enterprise architecture  to minimize future rework, including a description of all aspects of the architectures  that were and were not assessed in making the alignment determination, the date of  the alignment determination, and any known areas of misalignment, along with the  associated risks and corrective actions to address any such areas;  a certification by the DHS CPO that the plans for the program comply with federal  acquisition rules, requirements, guidelines, and practices, and a description of the  actions being taken to address any areas of noncompliance, the risks associated with  them, along with any plans for addressing these risks and the status of their  implementation;  a certification by the DHS CIO that the program has a risk management process that  regularly identifies, evaluates, mitigates, and monitors risks throughout the system  life cycle, and communicates high-risk conditions to agency and DHS investment  decision makers, as well as a listing of all the program’s high risks, and a status of  efforts to address them;  5   a certification by the DHS Chief Human Capital Officer (CHCO) that the human  capital needs of the program are being strategically and proactively managed, and  that current human capital capabilities are sufficient to execute the plans discussed in  the report;   a complete schedule for the full implementation of a biometric exit program or a  certification that such a program is not possible within 5 years;  a detailed accounting of operations and maintenance, contractor services, and  program management costs associated with the program.
The act also requires that we review this plan. DHS submitted its fiscal year 2008 US- VISIT expenditure plan to the House and Senate Appropriations Subcommittees on  Homeland Security on June 12, 2008. As agreed, our objectives were to (1) determine  whether the plan satisfies the legislative conditions and (2) provide observations about  the plan and management of the program.
A diussed in the cope nd methodology ection of thi riefing (ttchment 1), we ght clrifiction from ff with the Housnd Sente Approprition Committee, Subcommittee on Homelnd Secrity, on thi condition. A  result, the wording of thi  condition has een modified lightly from tht in the ct.
6  To accomplish the first objective, we compared the information provided in the plan with  each aspect of the eleven conditions. Further, for those conditions requiring a DHS  certification, we analyzed documentation, interviewed cognizant officials, and leveraged  our recent work to determine the basis for each certification. We then determined whether  the plan satisfies, partially satisfies, or does not satisfy the conditions based on the extent  to which (1) the plan addresses all aspects of the applicable condition, as specified in the  act or (2) the applicable certification letter contained in the plan (a) addresses all aspects  of each condition, as specified in the act, (b) is sufficiently supported by documented and  verifiable analysis, (c) contains significant qualifications, and (d) is otherwise consistent  with our related findings.
To accomplish the second objective, we analyzed DHS’s Notice of Proposed Rule Making  (NPRM) for Air/Sea Exit, the Regulatory Impact Analysis, Privacy Impact Assessment,  and US-VISIT’s Exit Pilot Report. We also compared available information on the US- VISIT prime contractor’s implementation of earned value management and the program  office’s implementation of risk management to relevant guidance. (See attachment 1 for  more detailed information on our scope and methodology.)
subsections: section_title: Expenditure Plan’s Satisfaction of Legislative Conditions
subsections: section_title: Detiled cconting of the progrm’ progress to dte reltive to tem cabilitieExplicit pln defining how fnd re to e oligted to meet fre progrcommitment, linked to the miletone-based delivery of pecific cabilitie nd erviceLiting of ll open GAO nd OIG recommendtion DHS invetment mgement nd OMB cpitl plnning nd invetment control certifiction y the CPO Independent verifiction nd vlidtion certifiction y the CIO Architectre certifiction y the CIO Acqition certifiction y the CPO Rik mgement certifiction y the CIO Hn Cpitl certifiction y the CHCO Exit implementtion chedle or certifiction tht not possle within 5 ye Detiled cconting of opertion nd mintennce, contrctor ervice, progrm mgement co. Reviewed y GAO
paragraphs: 9   The reliability of DHS Air and Sea Exit cost estimates is not clear for various reasons,  including program officials’ statements that contradict how the department  characterized the estimates in the public documents and supporting documentation  about the estimates’ derivation that we have yet to receive.
The proposed Air and Sea Exit solution, according to DHS, would provide less  security and privacy than other alternatives, because it relies on private carriers to  collect, store, and transmit passenger data.
Comments on the Proposed Air and Sea Exit solution, provided by airlines and  others, raised a number of additional stakeholder concerns, such as conflicts with air  carrier business models and impact on trade and travel.
The program office’s risk database shows that risk mitigation and contingency plans  have not been developed and implemented in a timely fashion for a number of risks,  which increases the chances that known risks will become actual problems.
Significant schedule variances are being minimized by frequent redefinition of  baselines, thus limiting the use of earned value management as a performance  management tool.
section_title: We are recommending that DHS’ Investment Review Board review the reasons for the plan’s limitations and address the challenges and weaknesses raised by our observations about the proposed Air and Sea Exit solution, and the implementation of earned value management and risk management, and to report the results to the Congress.
paragraphs: We provided a draft of this briefing to DHS officials, including the Director of US-VISIT.  While these officials did not state whether they agreed or not with our findings,  conclusions, or recommendations, they did provide a range of technical comments, which  we have incorporated into the briefing, as appropriate. They also sought clarification on  our scope and methodology, which we have also incorporated into the briefing.
The strategic goals of US-VISIT are to enhance the security of U.S. citizens and visitors,  facilitate legitimate travel and trade, ensure the integrity of the U.S. immigration system,  and protect the privacy of our visitors. It is to accomplish these things by:   collecting, maintaining, and sharing biometric and other information on certain foreign  nationals who enter and exit the United States;   identifying foreign nationals who (1) have overstayed or violated the terms of their  admission; (2) can receive, extend, or adjust their immigration status; or (3) should  be apprehended or detained by law enforcement officials;   detecting fraudulent travel documents, verifying traveler identity, and determining  traveler admissibility through the use of biometrics; and   facilitating information sharing and coordination within the immigration and border  management community.
section_title: Overview of History and Status of US-VISIT Increments
paragraphs: As defined in expenditure plans prior to fiscal year 2006, US-VISIT biometric entry and  exit capabilities were to be delivered in four increments.
Increments 1 through 3 were to be interim, or temporary, solutions that would focus  on building interfaces among existing (legacy) systems; enhancing the capabilities of  these systems; and deploying these systems to air, sea, and land ports of entry  (POEs).
Increment 4 was to be a series of yet-to-be-defined releases, or mission capability  enhancements, that were to deliver long-term strategic capabilities for meeting  program goals.
Increments 1 through 3 have produced an entry capability that began operating at  over 300 POEs by 2006. (See the system diagram on the next slide for an overview  of this entry capability; attachment 3 provides further details on each of the systems.)
section_title: Systems Diagram of Entry Capability Operating at Points of Entry
paragraphs: For detil on the process nderlying ech increment nd tem supplying informtion on US-VISIT, ee ttchment 3.
Increment 4 has continued to evolve.
The fiscal year 2006 expenditure plan described increment 4 as the combination of  two projects: (1) Transition to 10 fingerprints in the Automated Biometric Identification  System (IDENT) and (2) interoperability between IDENT and the Federal Bureau of  Investigation’s (FBI) Integrated Automated Fingerprint Identification System (IAFIS).
The fiscal year 2007 expenditure plan combines these two projects with a third  project called Enumeration (developing a single identifier for each individual) into a  larger project referred to as Unique Identity. During fiscal year 2007, the following  Unique Identity efforts were completed.
The Interim Data Sharing Model (iDSM) was deployed. It allows sharing of certain  biometric information between US-VISIT and the FBI, as well as with the Office of  Personnel Management and police departments in Houston, Dallas, and Boston.  The next phase of IDENT/IAFIS interoperability (referred to as Initial Operating  Capability) is to be deployed in October 2008.
The 10-print scanners were deployed to 10 air locations for pilot testing.
Deployment of the scanners to 292 POEs is to begin during fiscal year 2008 and is  to be completed by December 2008.
Also in fiscal year 2007, steps were taken relative to a biometric exit solution.
Exit pilot projects were halted at 12 airports and 2 seaports in May 2007.
Exit radio frequency identification proof-of-concept projects were discontinued at  selected land ports in November 2006.
Planning for an air and sea exit solution based on lessons learned from the pilot  projects was begun, to include studying the costs, impacts, and privacy concerns  of alternative solutions.
The fiscal year 2008 expenditure plan provides additional information on these and other  projects in the context of the program’s four core mission capabilities: (1) providing  identity management and screening services, (2) developing and enhancing biometric  identity collection and data sharing, (3) providing information technology support for  mission services, and (4) enhancing program management. For example, under  developing and enhancing biometric capabilities, the plan allocates $228 million for  further development and deployment of Unique Identity and $13 million for development  of an Air and Sea Exit solution. (See table on next slide).
Rdio freqency technology relie on proximity crd nd crd reder. Rdio freqency device red the informtion contined on the crd when the crd iassed ner the device. The informtion cn contin peronl informtion of the crdholder.
section_title: Summary of Fiscal Year 2008 Expenditure Plan Budget
paragraphs: (dollars in millions)
section_title: Life Cycle Approach for and Status of US-VISIT Projects
paragraphs: US-VISIT projects are subject to the program’s Enterprise Life Cycle Methodology  (ELCM). Within ELCM is a component methodology for managing software-based system  projects, such as Unique Identity and Air/Sea Exit, known as the US-VISIT Delivery  Methodology (UDM). According to version 4.3 of UDM (April 2007), it   applies to both new development and operational projects;   specifies the documentation and reviews that should take place within each of the  methodology’s six phases: plan, analyze, design, build, test, and deploy; and   allows for tailoring to meet the needs and requirements of individual projects, in  which specific activities, deliverables, and milestone reviews that are appropriate for  the scope, risk, and context of the project can be set for each phase of the project.
The chart on the following page shows the status of each US-VISIT project within the life  cycle methodology as of August 2008.
section_title: In May 2004, DHS awarded an indefinite-delivery/indefinite-quantity prime contract to Accenture and its partners for delivering US-VISIT products and services. Thus far,
paragraphs: 20 task orders have been issued against this contract, and their total value is about  $501 million.  11 of these task orders are ongoing, and their total value is about $331 million.
The table on the following slides provides additional information about the ongoing task  orders organized by the four core mission capabilities and projects.
An indefinite delivery/indefinite quantity contrct provide for n indefinite quantity, within ted limit, of supplie or ervicering   fixed period of time. The government chedle deliverie or performnce y plcing order with the contrctor.   Accentre’rtner in thi contrct inclde, mong other, Rytheon Compny, the Titn Corportion, nd SRA Interntionl, Inc.
Totl ve i the reported budget t completion as of My 2008.
Approximate  Value (dollars in  millions)
Develop and enhance biometric identity collection and data sharing capabilities  Biometric oltion delivery  Uniqe Identity  82.5  Plnning, development, nd implementtion of  Uniqe Identity (IDENT/IAFIS integrtion nd  IDENT 10-print)
Approximate  value (dollars in  millions)
Opertion nd mintennce IT ervice   27.7  Mgement of opertion nd mintennce  ctivitie for deployed cabilitie  Informtion technology ervice for  implemented fnctionlity, inclding ecrity  pgrde, tem chnge, etc.
section_title: Overview of DHS Investment Management Process
paragraphs: DHS issued a draft Investment Review Process guide in March 2006 that includes  milestone decision points (MDP) linking five life cycle phases: project initiation (MDP1),  concept and technology development (MDP2), capability development and demonstration  (MDP3), production and deployment (MDP4), and operations and support (MDP5). Under the draft guide, a program sends an investment review request prior to the initial  milestone date. The program is then to be reviewed by the DHS Enterprise Architecture  Board (EAB), Joint Requirements Council and/or Investment Review Board, depending  on such factors as the program’s cost and significance. According to the official from  DHS’s Program Analysis and Evaluation Directorate who is responsible for overseeing  program adherence to the investment control process, the draft guide is being used for all  DHS programs, including US-VISIT. This official also stated that milestone reviews can be  performed concurrently with an expenditure plan review.
In December 2006, the DHS Investment Review Board held an MDP1 review of US- VISIT. Since then, the EAB held an MDP2 review in April 2007, and the EAB is currently  performing an MDP3 review. Neither the Joint Requirements Council nor the Investment  Review Board have reviewed US-VISIT since MDP1.
section_title: Overview of DHS Notice of Proposed Rule Making (NPRM) for Air/Sea Exit
paragraphs: On April 24, 2008, DHS published its NPRM for establishing a biometric exit capability at  commercial air and sea ports. At the same time, it published an Air/Sea Biometric Exit  Regulatory Impact Analysis providing information on the projected costs and benefits of  several alternatives discussed in the proposed rule. Key aspects of the NPRM are  summarized here.
The proposed rule would require aliens who are subject to US-VISIT biometric  requirements on entry at POEs to provide biometric information to commercial  carriers before departing air and sea POEs. The rule also proposed that the biometric  information collected be submitted to DHS within 24 hours of securing the airplane  doors for air travel or departing the seaport. According to the NPRM, these  requirements would not apply to persons departing on certain private or small  carriers.
The proposed rule discussed nine exit alternatives for collecting biometrics: (1) at the  check-in counter by air and vessel carriers, (2) at the check-in counter by DHS, (3) at  the security checkpoint by DHS, (4) at the departure gate by air and vessel carriers,  (5) at the departure gate by DHS, (6) at the check-in counter by air and vessel  carriers with verification at the departure gate, (7) at the check-in counter by DHS  with verification at the departure gate, (8) at the security checkpoint by DHS with 24  verification at the departure gate, and (9) within the sterile area (after passing  through the Transportation Security Administration checkpoint) by DHS.
The following five alternatives were subject to further analysis of costs and benefits.
Proposed Alternative: Air and vessel carriers implement and manage the collection of  biometric data at location(s) of their choice.
Alternative 1: Air and vessel carriers implement and manage the collection of  biometric data at their check-in counter.
Alternative 2: DHS implements and manages the collection of biometric data at the  TSA Security checkpoint.
Alternative 3: DHS implements and manages the collection of biometric data at  location(s) of the air or vessel carrier’s choice.
Alternative 4: DHS implements and manages the collection of biometric data at  kiosks placed in various locations.
Thi oltion wold not pplicable to vessel crrier ecause there re no TSA checkpoint port.
section_title: DHS provided a 60-day comment period for the NPRM. A total of 91 organizations provided 117 comments and supporting documents. These included: 12 air industry associations, 44 air carriers (9 domestic and 35 foreign), 4 vessel industry associations, 1 vessel carrier, 9 commerce associations, 1 congressional committee, 5 foreign governments, and 2 local governments.
paragraphs: 26  Objective 1: Legislative Conditions  Of the 12 legislative conditions pertaining to DHS’s fiscal year 2008 expenditure plan for  US-VISIT, the plan partially satisfies 8 and does not satisfy 3 of them. Our review has  satisfied the remaining condition.
Given that the act’s conditions are designed to help ensure that the program is effectively  managed and that congressional oversight of program can occur, a partially or a not  satisfied condition should be viewed as introducing risk to the program. Each of the  conditions is addressed in detail on the following slides.
27  Objective 1: Legislative Conditions  Condition 1  Condition 1. The plan partially satisfies the legislative condition to include a detailed  accounting of the program’s progress to date relative to system capabilities or services,  system performance levels, mission benefits and outcomes, milestones, cost targets, and  program management capabilities.
As we previously reported, describing how well DHS is progressing relative to US-VISIT  program commitments (e.g., cost, schedule, capabilities, and benefits commitments) that  it has made in previous expenditure plans is essential to permitting meaningful program  oversight and promoting accountability for results.
GAO, Information Technology: Homeland Security Needs to Improve Entry Exit System Expenditure Planning, GAO-03-563  (Washington, D.C.: Jne 9, 2003) nd Homeland Security: Some Progress Made, but Many Challenges Remain on U.S. Visitor and  Immigrant Status Indicator Technology Program, GAO-05-202 (Washington, D.C.: Fe. 23, 2005).
28  Objective 1: Legislative Conditions  Condition 1  for an enhanced Candidate Verification Tool. However, the information presented is not  always sufficient to measure progress. For example,  The fiscal year 2007 plan stated that US-VISIT would begin 10-print pilot deployment  in late 2007 to ten air locations, but the fiscal year 2008 plan only states that DHS  selected a number of pilot locations and evaluated the performance and operational  impacts at those locations. According to program officials, although the plan does not  state the number of locations for the pilot, it was in fact deployed to ten locations, and  this information has been previously provided to the Congress.
The fiscal year 2008 plan describes progress in achieving some, but not all, system  performance levels. For example, the fiscal year 2007 plan cited a target of 1,850  biometric watch list hits for travelers processed at POEs, and the latest plan reports that  the number of these hits was 11,838. However, many of the target measures included in  the fiscal year 2007 plan are not described in the current plan. For example,  The fiscal year 2007 plan cited a target of having biometric information on file for 49  percent of foreign nationals prior to their entering the United States (also referred to  as the “Unique Identity baseline”). However, this measure is not discussed in the  fiscal year 2008 plan.
29  Objective 1: Legislative Conditions  Condition 1   The fiscal year 2007 plan cited a target of 26 days for resolving requests by visitors  to correct their baseline data. However, this measure is not discussed in the fiscal  year 2008 plan.
The fiscal year 2007 plan stated that US-VISIT would establish a baseline of the  number of individuals who were biometrically verified based on 10-print enrollment.  However, this baseline measure is not discussed in the fiscal year 2008 plan.
According to program officials, although these measures are not mentioned in the  expenditure plan, performance data relative to each is in fact collected and monitored.
The fiscal year 2008 plan identifies estimated costs (i.e., funding levels) for each of the  four broad capability areas. In some cases, the broad areas are decomposed and  meaningful detail is provided to understand how the funds will be used. However, in many  cases, capabilities and costs are not decomposed to a level that permits such  understanding and oversight. For example,  The fiscal year 2008 plan states that $7.9 million will be used for the Biometric  Support Center. However, allocations for specific support center capabilities and  services are not provided.
30  Objective 1: Legislative Conditions  Condition 1   The fiscal year 2008 plan states that $72.6 million will be used to update DHS border  and process technology in support of 10-print and IDENT/IAFIS interoperability.  However, the funds are not allocated between the two activities or to major tasks,  products, and services under each activity, such as the completion of initial operating  capability for IDENT/IAFIS integration.
The fiscal year 2008 plan states that $6.4 million will be used for data integrity efforts.
However, the funds are not allocated among specific data integrity activities  described in the plan, such as upgrading the integrity of the system and data to meet  stakeholder needs.
Furthermore, the fiscal year 2007 and 2008 plans use different terminology to describe  categories of spending under the broad capability areas. For example,  The fiscal year 2008 plan shows $5.0 million in fiscal year 2007 funds allocated to  “Information Technology” under the “Comprehensive Biometric Exit Solution—Air and  Sea” project, but the 2007 plan does not identify an “Information Technology”  component to this project, but rather shows $5.0 million being allocated to “Planning  and Design.” 31  Objective 1: Legislative Conditions  Condition 1   The fiscal year 2008 plan shows $1.4 million in fiscal year 2007 funds allocated to  “Law Enforcement and Intelligence” under Biometric Support Services, but the fiscal  year 2007 plan does not identify a Law Enforcement and Intelligence component, but  instead shows $1.4 million being allocated to “Management.”
Objective 1: Legislative Conditions  The plan cites the following benefits relative to the Comprehensive Biometric Exit  Solution – Air and Sea project:  “Provides greater accuracy in recording identity of persons leaving the country,  enables improved assessment by DHS of travelers’ compliance with immigration  laws, and enables DHS to more easily match records across multiple identities or  travel documents.”
However, since these benefits/outcomes are not linked to a baseline measure, and  the amount of the expected improvement is not specified, the proposed benefits are  not meaningful.
The plan cites benefits from sharing biometric data globally, including enabling  countries to redirect the course of an immigration claims or enforcement activity,  improving the accuracy of records through vetting and validation, identifying patterns  of legal and illegal migration, achieving efficiency savings, establishing the identities  of individuals who sought benefits among partner agencies and governments, and  helping to prevent fraud through identity verification of individuals seeking benefits.  However, it does not link any of these benefits to specific baseline measures.
33  Objective 1: Legislative Conditions  Condition 1  The fiscal year 2008 plan cites high-level milestones that are traceable to the prior plan.  However, neither of the plans provides enough specificity to measure progress. For  example:  The fiscal year 2007 plan stated that the first phase of IDENT/IAFIS interoperability  was implemented via the iDSM prototype in 2006. It also identified high-level  activities to design, build, and deploy the initial operating capability for IDENT/IAFIS  interoperability, such as advancing the data sharing architecture and enabling the  assignment of a unique number to each individual. While the fiscal year 2008 plan  states that some of these efforts were completed, neither plan provided specific  milestones to measure progress.
The fiscal year 2007 plan stated that efforts to deploy a biometric exit solution for air  and sea environments would be launched. While the fiscal year 2008 plan states that  US-VISIT developed a Comprehensive Biometric Exit strategy and began planning to  address the air and sea environments, neither plan provided specific milestones to  measure progress.  34  Objective 1: Legislative Conditions    Condition 1   The fiscal year 2008 plan discusses several initiatives to enhance and leverage key  program management capabilities, such as continuing efforts to improve the program’s  use of earned value management, the maturity of software acquisition/ development  processes, and the quality of internal governance. In some cases, the plan cites program  management efforts that can be traced to the fiscal year 2007 plan. For example, the  fiscal year 2007 plan stated that an assessment of the prime contractor’s earned value  management system was to be conducted during fiscal year 2007. According to the fiscal  year 2008 plan, an assessment was completed in June 2007 that identified a number of  weaknesses, a plan of action and milestones was developed to address the weaknesses,  and this plan is to be executed in 2008. (These weaknesses are discussed in detail later  in this briefing.)
However, the fiscal year 2008 plan also identifies program management capability  improvements that are not traceable to prior plan commitments. For example, the fiscal  year 2008 plan states that a Planning, Programming, Budgeting, and Execution process  was developed during fiscal year 2007. However, this effort was not mentioned in the  prior plan as a commitment and thus as a basis for measuring progress.
35  Objective 1: Legislative Conditions  Condition 2  Condition 2. The plan does not satisfy the condition that it include an explicit plan of  action defining how all funds are to be obligated to meet future program commitments,  with the planned expenditure of funds linked to the milestone-based delivery of specific  capabilities, services, performance levels, mission benefits and outcomes, and program  management capabilities.
As we have previously reported, the purpose of the expenditure plan is to provide  Congress with sufficient information to exercise effective oversight of US-VISIT and to  hold DHS accountable for results. As such, the plan should specify planned system  capabilities, schedules, costs, and expected benefits for each of its projects and for its  program management activities.
While the fiscal year 2008 plan links funding to four broad core capability areas and  associated projects, it does not link this planned use of funds to milestones and it does  not consistently decompose projects into specific mission capabilities, services,  performance levels, benefits and outcomes, or program management capabilities.
GAO, Homeland Security: U.S. Visitor and Immigrant Status Program’s Long-standing Lack of Strategic Direction and Management  Controls Needs to Be Addressed, GAO-07-1065 (Washington, D.C.: Ag. 31, 2007).
36  Objective 1: Legislative Conditions  Condition 2  To illustrate, the expenditure plan allocates funding among the program’s four broad core  capability areas. For one of these capability areas, the plan identifies major projects, such  as Unique Identity and Comprehensive Biometric Exit Solution—Air and Sea. These  projects are then decomposed into general functional activities (e.g., project integration  and analysis, and acquisition and procurement), which are then associated with fiscal  year 2007 and 2008 funding. However, these functional activities do not constitute  specific capabilities, services, performance levels, or benefits. Rather, they represent  functions to be performed that presumably will produce such capabilities, services,  performance levels, or benefits.
Similarly, the remaining three core capability areas are also divided into general functional  activities (e.g., biometric support, data integrity, program staffing, data center operations)  that do not constitute capabilities, services, performance levels, or benefits.
Moreover, the funding associated with the broad core capability areas, projects, or  functional activities is not linked to any milestones. For example, the plan states that  $72.6 million of fiscal year 2008 funds will be used to update DHS border and process  technology for 10-print transition and IDENT/IAFIS, but does not state what updates will  be accomplished or by when. The plan also states that $45.1 million will be used to  operate and maintain applications, but does not state what maintenance activities will be  performed and when they will be performed.
37  Objective 1: Legislative Conditions  Condition 3  Condition 3. The plan, including related program documentation and program officials’  statements, partially satisfies the condition that it include a listing of all open GAO and  OIG recommendations related to the program and the status of DHS actions to address  them, including milestones.
We reported in August 2007 that US-VISIT’s progress in implementing our prior  recommendations had been slow, as indicated by the 4-year-old recommendations that  were less than fully implemented. Given that our recommendations focus on fundamental  limitations in the management of US-VISIT, they are integral to DHS’s ability to execute  its expenditure plans, and thus should be addressed in the plans.
Since 2003, GAO has made 44 recommendations to the US-VISIT program. The fiscal  year 2008 plan provides a listing and status of our recommendations. However, the plan  does not provide milestones for addressing these recommendations. The table on the  next slide summarizes our analysis of the status of our recommendations.
GAO-07-1065.
section_title: In addition, the plan does not include two OIG recommendations. According to program officials, this is because these two recommendations were made the same month that the plan was sent to the appropriations committee. (See attachment 4 for more detailed information on the status of our recommendations.)
paragraphs: 39  Objective 1: Legislative Conditions    Condition 4  Condition 4. The plan partially satisfies the condition that it include a certification by the  DHS CPO that (1) the program has been reviewed and approved in accordance with the  department’s investment management process and (2) the process fulfills all capital  planning and investment control requirements and reviews established by the Office of  Management and Budget (OMB), including Circular A-11, part 7.
As we have previously reported, it is important for organizations such as DHS, which  rely heavily on IT to support strategic outcomes and meet mission needs, to adopt and  employ an effective institutional approach to IT investment management. Such an  approach provides agency management with the information needed to ensure that IT  investments cost-effectively meet strategic mission needs and that projects are meeting  cost, schedule, and performance expectations. We have also reported that the capital  investment control requirements and reviews outlined in the OMB Circular A-11, part 7,  are important because they are intended to minimize a program’s exposure to risk, permit  performance measurement and oversight, and promote accountability.
Office of Mgement nd Bdget Circr A-11, Prt 7 eablihe policy for plnning, budgeting, cqition, nd mgement of federl cpitasset.   GAO, Information Technology: DHS Needs to Fully Define and Implement Policies and Procedures for Effectively Managing  Investments, GAO-07-424 (Washington, D.C.: April 27, 2007).   GAO-07-1065.
40  Objective 1: Legislative Conditions    Condition 4  On March 14, 2008, the DHS CPO certified that (1) US-VISIT was reviewed and  approved in accordance with the department’s investment management process and (2)  this process fulfills all capital planning and investment control requirements and reviews  established by OMB, including Circular A-11, part 7.
In support of certifying the first aspect of the condition, the CPO stated that OMB scored  US-VISIT’s fiscal year 2009 budget submission (i.e., budget exhibit 300) a 35 out of a  possible 50 in November 2007. According to OMB, this score means that the submission  has “very few points . . . but still needs strengthening.” In addition, the CPO stated that  the program had been reviewed by the DHS Investment Review Board in December  2006, and that the board had issued a decision memorandum in April 2007 stating that  the fiscal year 2007 expenditure plan met, among other things, OMB capital planning and  investment review requirements and satisfied that aspect of the DHS investment  management process that requires investments to comply with DHS’s enterprise  architecture.
However, this support is not sufficient to fully satisfy the first aspect of the legislative  condition because this condition applies to the fiscal year 2008 expenditure plan, and the  support that the CPO cites does not relate to either the fiscal year 2008 budget  submission or to the fiscal year 2008 expenditure plan. Rather, it pertains to the following  year’s budget submission and the prior year’s plan.
41  Objective 1: Legislative Conditions    Condition 4  In support of certifying the second aspect of the condition, the CPO again cites the fiscal  year 2009 budget submission, which DHS documents show underwent a series of  reviews and revisions before being sent to OMB that raised the department’s scoring of  the submission from a 29 to a 37. According to OMB, a score of 29 means, among other  things, that “much work remains to solidify and quantify” the submission. In certifying to  this aspect, the CPO also stated that his office will continue to oversee US-VISIT through  the department’s emerging investment management process.
However, the cited support is not sufficient to satisfy the legislative condition for two  reasons.
As previously noted, the cited budget submission is for fiscal year 2009 rather than  fiscal year 2008.
GAO-07-424.   GAO, Information Technology Investment: A Framework for Assessing and Improving Process Maturity, GAO-04-394G (Washington,  D.C.: Mrch 2004).
42  Objective 1: Legislative Conditions    Condition 4  and investment control requirements. In particular, we reported that:   DHS’s process (policies and procedures) for project-level management do not  include all key elements, such as specific criteria or steps for prioritizing and  selecting new investments.
DHS has not fully implemented the practices needed to control investments—at  the project level or at the portfolio level, including regular project-level reviews by  the DHS Investment Review Board.
DHS’s process does not identify a methodology with explicit decision-making  criteria to determine an investment’s alignment with the DHS enterprise  architecture.
43  Objective 1: Legislative Conditions    Condition 4  In its comments on a draft of this report, DHS disagreed that its investment management  process is not sufficiently mature, stating that on November 7, 2008 it issued an interim  operational policy for investment control that addresses the limitations that we reported in  April 2007. However, because DHS’s comments only provided the memo that issued the  interim policy, and not the policy itself, we have yet to review it to determine whether it  addresses the above limitations. Also, the memo describes the interim policy as a  “resulting draft” that is the product of an “informal staffing process” and that changes will  be made to “the policy prior to completing this process.” Moreover, implementation of the  policy, including training on its implementation, still needs to occur. Therefore, we  continue to view DHS’s investment management process as not sufficiently mature.
44  Objective 1: Legislative Conditions  Condition 5  Condition 5. The plan partially satisfies the condition that it include a certification by the  DHS CIO that an independent verification and validation (IV&V) agent is currently under  contract.
As we have previously reported, IV&V is a recognized best practice for large and  complex system development and acquisition programs, like US-VISIT, as it provides  management with objective insight into the program’s processes and associated work  products.
On February 25, 2008, the former DHS Acting CIO conditionally certified that the program  has an IV&V agent under contract. However, this certification was qualified to recognize  that the contract only provided for IV&V services relative to testing system applications  (i.e., it did not extend to other key program activities). Accordingly, the certification was  made conditional on the program office providing an update on its efforts to award a  contract for program-level IV&V by April 15, 2008. According to program officials, they are  in the process of evaluating a program-wide IV&V contract proposal and plan to award a  contract in September 2008.
GAO, Homeland Security: First Phase of Visitor and Immigration Status Program Operating, but Improvements Needed, GAO-04- 586 (Washington, D.C.: My 11, 2004).
45  Objective 1: Legislative Conditions  Condition 6  Condition 6. The plan partially satisfies the condition that it include a certification by the  DHS CIO that the program’s system architecture is sufficiently aligned with the  department’s enterprise architecture (EA), including a description of all aspects of the  architectures that were and were not assessed in making the alignment determination,  the date of the alignment determination, and any known areas of misalignment, along with  the associated risks and corrective actions to address any such areas.
According to federal guidelines and best practices, investment compliance with an EA  is essential for ensuring that new and existing systems are defined, designed, and  implemented in a way that promotes integration and interoperability and minimizes  overlap and redundancy, thus optimizing enterprisewide efficiency and effectiveness. A  compliance determination is not a one-time event that occurs when an investment begins,  but rather occurs throughout an investment’s life cycle as changes to both the EA and the  investment’s architecture are made. Within DHS, the EAB, supported by the Enterprise  Architecture Center of Excellence, is responsible for ensuring that system investments  demonstrate adequate technical and strategic compliance with the department’s EA.
Chief Informtion Officer Concil, A Practical Guide to Federal Enterprise Architecture, Verion 1.0, Feuary 2001.   GAO, Information Technology: A Framework for Assessing and Improving Enterprise Architecture Management (verion 1.1), GAO- 03-584G (Washington, D.C.: April 2003).
46  Objective 1: Legislative Conditions  Condition 6  In early 2008, the DHS Acting CIO certified that the US-VISIT system architecture was  aligned with the DHS EA based on an assessment of the program’s alignment to the 2007  version of DHS’s EA, which was conducted by the EAB in support of the program’s MDP2  review.
Consistent with the legislative condition, the fiscal year 2008 expenditure plan includes  the former Acting CIO’s certification, the date of the board’s conditional approval of  architectural alignment for MDP2 (September 27, 2007) and the date of the certification  (February 25, 2008). It also includes areas of misalignment and corrective actions to  address the identified areas. Specifically, it identifies such areas of misalignment as   US-VISIT requirements and products to support 10-print solution not having been  defined and included in the 2007 EA technical reference model, and   US-VISIT data standards not having been vetted with the DHS Enterprise Data  Management Office for compliance.
It states that corrective actions to address these areas were completed in September  2007, and that no outstanding MDP2 conditions remain. However, the certification does not fully satisfy the legislative conditions for three reasons.  47  Objective 1: Legislative Conditions  Condition 6  First, the basis for the certification is an assessment against the 2007 EA, which is a  version that we recently reported to be missing important US-VISIT architectural content.Further, while DHS recently issued a 2008 version of its EA, it does not address these  content shortfalls. The following are examples of the missing architecture content:   US-VISIT’s representation in this version’s business model—which associates the  department’s business functions with the organizations that support and/or  implement them—does not align US-VISIT with certain business functions (e.g.,  verify identity and establish identity) that the program office has identified as a critical  part of its mission.
US-VISIT business rules and requirements are not included in this version’s business  model. Business rules are important because they explicitly translate business  policies and procedures into specific, unambiguous rules that govern what can and  cannot be done. As such, they facilitate the consistent implementation of policies and  procedures.
US-VISIT’s baseline and target performance goals (e.g., for transaction volume) are  not reflected in this version.
GAO, Homeland Security: Strategic Solution for US-VISIT Program Needs to Be Better Defined, Justified, and Coordinated, GAO- 08-361 (Washington, D.C.: Fe. 29, 2008).
48  Objective 1: Legislative Conditions  Condition 6  in the 2007 EA. For example, it erroneously identifies two US-VISIT component  systems as being owned by two other DHS entities.
All US-VISIT system interfaces are not included in the 2007 EA’s system reference  model. For example, it does not identify key interfaces between the IDENT, Advance  Passenger Information System (APIS), Arrival and Departure Information System  (ADIS), and Treasury Enforcement Communications System. Additionally, it does not  identify the interface between IDENT and the Global Enrollment System, even  though US-VISIT officials confirmed that the interface exists and is operating.
Second, the department lacks a defined methodology for determining an investment’s  compliance with its EA, including explicit steps and criteria. According to federal  guidance, such a methodology is important because the benefits of using an EA cannot  be fully realized unless individual investments are defined, designed, and developed in a  way that avoids duplication and promotes interoperability. However, we reported in April  2007 that DHS does not have such a methodology. Without this methodology and  verifiable documentation demonstrating its use in making compliance determinations, the  basis for concluding that a program sufficiently complies with any version of the 2007 EA  will be limited.
GAO-07-424.
49  Objective 1: Legislative Conditions  Condition 6  Third, the certification attachment includes a description of what was assessed to provide  the basis for the compliance certification. For example, the attachment states that the  board “evaluated the program’s ability to support the Department’s line of business and  strategic goals; their alignment to a DHS Office of the CIO portfolio; the data, data  objects, and data entity that encompass the investment; the technology leveraged to  deliver capabilities and functions by the program; and compliance with information  security, Section 508, and screening coordination.” However, the descriptions do not link  directly to key 2007 EA artifacts. For example, it aligns US-VISIT’s data entities (e.g.,  Watch List and Warrants) to the data object “Record”. The 2007 EA, however, does not  define that data object. Moreover, those aspects of the architectures that were not  assessed are not identified, such as the business rules and enterprise security  architecture.
50  Objective 1: Legislative Conditions  Condition 7  Condition 7. The plan partially satisfies the condition that it include a certification by the  DHS CPO that the plans for the program comply with federal acquisition rules,  requirements, guidelines and practices, and a description of the actions being taken to  address any areas of noncompliance, the risks associated with them, along with any  plans for addressing these risks, and the status of their implementation.
As we have previously reported, federal IT acquisition requirements, guidelines, and  management practices provide an acquisition management framework that is based on  the use of rigorous and disciplined processes for planning, managing, and controlling the  acquisition of IT resources. If implemented effectively, these processes can greatly  increase the chances of acquiring software-intensive systems that provide promised  capabilities on time and within budget.
GAO-07-1065.
51  Objective 1: Legislative Conditions  Condition 7  practices. In addition, the CPO stated that DHS's Office of Procurement Operations had  conducted self-assessments of US-VISIT-related contracts in fiscal years 2006 and 2007,  and that these assessments had not identified any areas of non-compliance that required  risk mitigation.
However, the cited support is not sufficient to fully satisfy the legislative condition because  the condition applies to the fiscal year 2008 expenditure plan, while the support that is  cited pertains to the fiscal year 2007 expenditure plan and assessments that were  completed in fiscal years 2006 and 2007.  52  Objective 1: Legislative Conditions  Condition 8  Condition 8. The plan partially satisfies the condition that it include (1) a certification by  the DHS CIO that the program has a risk management process that regularly identifies,  evaluates, mitigates, and monitors risks throughout the system life cycle and  communicates high-risk conditions to department investment decision makers, as well as  (2) a listing of all the program’s high risks and the status of efforts to address them.
As we have previously reported, proactively managing program risks is a key acquisition  management control, and if defined and implemented properly, it can increase the  chances of programs delivering promised capabilities and benefits on time and within  budget.
On February 25, 2008, the former DHS Acting CIO certified that US-VISIT had a sufficient  risk management process in place, adding that this process satisfied all process-related  aspects of the legislative condition. In doing so, the then Acting CIO relied on an  assessment of a range of US-VISIT risk management documents, including a policy, plan,  periodic listings of high risks and related status reports, and communications with  department decision makers.
GAO, DOD Business Systems Modernization: Key Marine Corps System Acquisition Needs to Be Better Justified, Defined, and  Managed, GAO-08-22 (Washington, D.C.: Jly. 28, 2008).
53  Objective 1: Legislative Conditions  Condition 8  However, the certification does not fully satisfy the legislative condition. Our analysis of  the same risk management documents that the certification is based on revealed key  weaknesses:  The US-VISIT risk management plan is not being effectively implemented, which is  also a weakness that we reported in February 2006. For example, of the 33 high  risks identified as being in or past the handling phase of the risk management  process in the February 6, 2008 risk inventory, 8 (about 24 percent) did not have a  mitigation plan, and 19 (about 58 percent) did not have a contingency plan.  Moreover, considerable time has passed without such plans being developed, in  some cases more than 3 years. According to the risk management plan, mitigation  and contingency plans should be developed for all high and medium risks once they  have reached the handling phase of the risk management process. (This weakness  is discussed in greater detail later in this briefing.)
GAO, Homeland Security: Recommendations to Improve Management of Key Border Security Program Needs to Be Implemented, GAO-06-296 (Washington, D.C.: Fe. 14, 2006).   The US-VISIT Rik Mgement Plepte the rik mgement process into five tep. The forth tep—rik hndling—i the  process of electing nd implementing repon to identified nd prioritized ri.
54  Objective 1: Legislative Conditions  Condition 8   The US-VISIT process for managing risk does not contain thresholds for elevating  risks beyond the program office. Moreover, program officials told us that an update to  this process that is currently in draft does not include such thresholds. Without  thresholds, it is unlikely that senior DHS officials will become aware of those risks  requiring their attention. In this regard, we reported in February 2006 that the  thresholds for elevating risks to department executives that were in place were not  being applied. In August 2007, we reported that these thresholds had been  eliminated and that no risks had been elevated to department executives since  December 2005. During the following 32 months, only one risk was elevated beyond  the program office.
GAO-06-296.
GAO-07-1065.
55  Objective 1: Legislative Conditions  Condition 9  Condition 9. The plan does not satisfy the condition that it include a certification by the  DHS Chief Human Capital Officer that the human capital needs of the program are being  strategically and proactively managed, and that current human capital capabilities are  sufficient to execute the plans discussed in the report.
As we have previously reported, strategic management of human capital is both a best  practice and a provision in federal guidance. Among other things, it involves proactive  efforts to understand an entity’s future workforce needs, existing workforce capabilities,  and the gap between the two and charting a course of action to define how this gap will  be continuously addressed. By doing so, agencies and programs can better ensure that  they have the requisite human capital capacity to execute agency and program plans.
On March 6, 2008, the DHS Chief Human Capital Officer certified that the US-VISIT  human capital strategic plan provides specific initiatives to address the hiring,  development, and retention of program employees, and that a strategy exists to develop  indicators to measure the progress and results of these initiatives.
However, this certification does not satisfy the legislative condition for two reasons.
GAO-07-1065.
56  Objective 1: Legislative Conditions  Condition 9   The certification does not address the strategic plan’s implementation, which is  important because just having a human capital strategic plan does not constitute  strategic and proactive management of the program’s human capital.
The certification does not address whether the current human capital capabilities are  sufficient to execute the expenditure plan. For example, it does not recognize that  US-VISIT is under staffed. We reported in August 2007 that the program office had  21 vacancies and had taken the interim step to address this shortfall by temporarily  assigning other staff to cover the vacant positions, and planned to fill all the positions  through aggressive recruitment. As of July 2008, the program office reported having  23 vacancies, including vacancies in leadership positions, such as the program’s  deputy director. Since then, the program office reports that it has filled nine of these  vacancies.
GAO-07-1065.
57  Objective 1: Legislative Conditions  Condition 10  Condition 10. The plan does not satisfy the condition that it include a complete  schedule for the full implementation of a biometric exit program or a certification that such  a program is not possible within 5 years.
As we stated in our June 2007 testimony, a complete schedule for the full deployment of  an exit capability would specify, at a minimum, what work will be done, by what entities,  and at what cost to define, acquire, deliver, deploy, and operate expected system  capabilities. A complete schedule is essential to ensuring that the solution is developed  and implemented effectively and efficiently.
The fiscal year 2008 plan does not contain either a complete schedule for fully  implementing biometric exit capabilities at air, sea, and land POEs, or a statement that  this cannot be completed within a 5-year time frame. Rather, the plan contains a very  high-level schedule that only identifies five broadly-defined tasks, and a date by which  each is to be completed, as shown in the table on the following slide.
GAO, Homeland Security: Prospects for Biometric US-VISIT Exit Capability Remains Unclear, GAO-07-1044T (Washington, D.C.:  Jne 28, 2007).
section_title: Such high-level milestones do not constitute a “complete schedule for the full implementation of a biometric exit program,” as requested by the act, because they are not supported by the kind of verifiable analysis and documentation that we have previously reported as necessary for a reliable program schedule. For example, these milestones do not include (1) decomposition of the program into a work breakdown structure; (2) sequencing, integration, and resourcing of each work element in the work breakdown structure; and (3) identification of the critical path through the schedule of linked work elements.
paragraphs: 59  Objective 1: Legislative Conditions  Condition 11  Condition 11. The plan partially satisfies the condition that it include a detailed  accounting of operation and maintenance, contractor services, and program management  costs associated with the program.
As we have previously reported, the purpose of the expenditure plan is to provide  Congress with sufficient information to exercise effective oversight of US-VISIT and to  hold DHS accountable for results. To accomplish this, the act sought specific information  relative to planned US-VISIT spending for operations and maintenance, contractor  services, and program management.
A diussed in the cope nd methodology ection of thi riefing (ttchment 1), we ght clrifiction from ff with the Housnd Sente Approprition Committee, Subcommittee on Homelnd Secrity, on thi condition. A  result, the wording of thi  condition has een modified lightly from tht in the ct.
60  Objective 1: Legislative Conditions  Condition 11  The fiscal year 2008 plan provides a decomposition of program operations and  maintenance costs according to functional areas of activity, such as operations and  maintenance of system applications, data center operations, network/data  communications, and IT services. While this decomposition does satisfy the condition, it  nevertheless could be more informative if the costs were associated with specific  capabilities, systems, and services, such as the cost to operate and maintain ADIS,  IDENT, and iDSM.
The fiscal year 2008 plan does not separately identify the program’s costs for contractor  services. According to program officials, such services are embedded in other cost  categories, such as Program Staffing (which is a combination of government and  contractor staff), Prime Integrator, and Project Integration and Analysis. The one  exception is for the Provide Identity Management and Screening Services broad core  capability area, which identifies $15.8 million in contractor services.
61  Objective 1: Legislative Conditions  Condition 11  The fiscal year 2008 plan states that program management costs will total $115.2 million,  and allocates them to items such as program staffing ($46.2 million), planning and  logistics ($14.3 million), prime integrator ($33.5 million), and working capital and  management reserve ($ 21.2 million). It also describes a number of program  management related initiatives, such as maturing program monitoring and control  processes, developing strategic plans and related policies, conducting public information  dissemination and outreach, and strengthening human capital management and  stakeholder training.
However, it does not allocate the $115.2 million to these initiatives. For example, the plan  does not describe what portion of the $115.2 million will be used to develop criteria for  estimating life cycle costs, which is one effort within the maturing program processes  initiative, or to properly align program management staffing to tasks and rewrite position  descriptions, which are efforts within strengthening human capital management. In  addition, the $115.2 million does not include $11.6 million in contractor program  management support provided to specific projects, such as Air and Sea Exit. As a result,  total cost allocated to program management in fiscal year 2008 is $126.8 million, which is  similar to the program management costs we reported in the fiscal year 2006 and 2007 62  Objective 1: Legislative Conditions  Condition 11  expenditure plans.  As we previously reported, these levels of program management  costs represented a sizeable portion of the US-VISIT planned spending, but were not  adequately justified.
GAO, Homeland Security: Planned Expenditures for U.S. Visitor and Immigrant Status Program Need to be Adequately Defined and  Justified, GAO-07-278 (Washington, D.C.: Fe. 14, 2007).
63  Objective 1: Legislative Conditions  Condition 12  Condition 12. We have reviewed the plan, thus satisfying the condition. Our review was  completed on September 15, 2008.
section_title: Observation 1: Reliability of DHS Air and Sea Exit cost estimates is not clear.
paragraphs: In developing its Air and Sea Exit NPRM, DHS is required to prepare a written  assessment of the costs, benefits, and other effects of its proposal and a reasonable  number of alternatives, and to adopt the least costly, most cost-effective, or least  burdensome among them. To accomplish this, it is important that DHS have reliable cost  estimates for its proposed and alternative solutions.
section_title: DHS Documents and Program Officials Statements Characterizing the Nature of the Estimates Are Not Consistent
paragraphs: As noted earlier in this briefing, the NPRM and regulatory impact analysis cite the  estimated costs of each of the five alternatives that were analyzed. For example, the  impact analysis states that the estimated cost of the proposed solution is $3.6 billion.  Moreover, this analysis states that each of the cost estimates are “rough order of  magnitude” estimates, meaning that they are by definition rough and imprecise, to the  point of being potentially understated by as much as 100 percent, and overstated by as  much as 50 percent. Restated, this means that the estimated cost of the proposed  solution could be anywhere from $1.8 billion to $7.2 billion. According to DHS’s analysis,  these broad cost risk ranges were used to reflect the degree to which Air and Sea Exit  has been defined, including the assumptions that had to be made about airline solution  configurations in the absence of airline data.
According to GAO’s Cost Estimating Guide, rough order of magnitude estimates are used  when few details are available about the alternatives, and they should not be considered  budget-quality cost estimates. Accordingly, they should not be viewed as sufficiently  credible, accurate, or comprehensive to be considered reliable for making informed  choices among competing investment options.
section_title: Notwithstanding the regulatory impact analysis’ characterization of the cost estimates as rough order of magnitude estimates, program officials responsible for deriving the estimates stated that the estimates were “mislabeled” in the analysis, and thus the risk ranges for the estimates are overstated. They added that the estimates should have been characterized as parametric and partial engineering estimates, which would have produced much smaller risk ranges.
paragraphs: Available Documentation Shows Some Estimating Best Practices Were Met, While  Others Were Not  GAO’s Cost Estimating Guide identifies four characteristics of reliable cost estimates and  associates a number of estimating best practices with each characteristic. The four  characteristics of reliable cost estimates are that they are well-documented, credible,  comprehensive, and accurate.
The cost estimates for the Air and Sea Exit alternatives satisfied a number of the best  practices in GAO’s Cost Estimating Guide. For example, the estimate’s purpose and  scope are clearly defined, the cost team included experienced cost analysts, and the cost  estimate included a description of the cost estimation process, data sources, and  methods.
section_title: However, these cost estimates did not satisfy other best practices in our guide. For example, the cost estimate was not compared to an independent estimate and a technical baseline was not developed to provide the underlying basis for this estimate. These are important because the technical baseline provides a detailed technical, program, and schedule description of the system to be developed, and thus is the basis for the program and independent cost estimates. Additionally, an independent estimate provides an unbiased check on the reliability of the program’s estimate.
paragraphs: Moreover, we have yet to receive documentation from DHS relative to other best  practices cited in the guide. For example, the guide recognizes the importance of  performing risk analyses that allow for risks to be examined across the work breakdown  structure so that the uncertainties associated with individual work elements can be  determined, and risk levels can be assigned to each. According to the regulatory impact  analysis, a standard level 5 risk range (50 percent below to 100 percent above) was used  with the cost estimates because a comprehensive risk analysis had not been done.  Program officials told us, however, that a risk analysis was performed, but we have yet to  receive it. Further, we have yet to receive evidence showing that all relevant costs were  addressed, such as the cost of spare, refreshed, and updated equipment and technology.
section_title: Estimates May Not Include Major Cost Elements
paragraphs: The regulatory impact analysis states that data on several variables were not available for  inclusion in the analysis, including estimates for burden to carriers and travelers. Of the  56 airlines and airline associations that provided comments on the NPRM, 21 commented  that DHS’s cost estimate for its proposed solution was understated because it did not  adequately reflect the burden to carriers. In particular, the International Air Transport  Association commented that the proposed solution could cost the air carriers as much as  $12.3 billion over 10 years. According to this association, its estimate was developed in  collaboration with airlines, network service providers, and hardware manufacturers. The  association attributed the understatement of DHS’s estimate to its omission of relevant  costs for data transmission, secure networks, and secure data warehouses. Specifically, it  stated that   transmission requirements for biometric data would be between 350 and 800  times  greater that what the airlines currently use for the transmission of biographic and  manifest text data (between 31 and 128 megabytes of information for each  international flight versus about 100 kilobytes currently transferred);  69  Objective 2: Observations  1: Reliability of Air nd S Exit Cot Etimte Not Cle secure networks required for transmission of biometric data would need to be  installed between the airports and the airlines’ departure control systems because  they currently do not exist (estimated to cost about $150 million over 10 years); and   secure data warehouses for biometric data storage would need to be installed to  store the data prior to transmission to DHS (estimated to cost about $1 billion to  operate over 10 years).
In addition, United Airlines commented that its start-up costs would be about $21.8  million. It also commented that DHS’s cost estimate does not include the cost of  additional traveler burden, which they estimated to be about $30 per hour. According to  United Airlines, passenger time is potentially the highest cost element with as many as 50  million persons being affected by queuing, congested space, and flight delays. DHS’s  regulatory impact analysis acknowledges the omission of the cost of additional travel  burden and the impact on the cost to each carrier’s business processes.
Further, Air Canada Jazz, a regional airline, commented that because the requirement for  airline personnel to collect biometric data is beyond the scope of duties outlined in current  collective agreements, it would have to renegotiate its agreements to add these duties.
section_title: Observation 2: DHS reports that proposed solution would provide less security and privacy than other alternatives.
paragraphs: Adequate security and privacy controls are needed to assure that personally identifiable  information is secured against unauthorized access, use, disclosure, or retention. Such  controls are especially needed for government agencies, where maintaining public trust is  essential. In the case of US-VISIT, one of its stated goals is to protect the security and  privacy of U.S. citizens and visitors.
However, DHS's proposed solution would have more privacy and security risks than  alternative solutions. According to the NPRM, having carriers collect the biometric  information is less secure than alternatives where DHS collects the information,  regardless of the information collection point. Moreover, it states that information that is in  the sole custody of one entity (e.g., DHS) is less likely to be compromised than  information passed from private carriers to DHS. Similarly, the NPRM states that the  degree of confidence in compliance with privacy requirements is lower when DHS does  not maintain full custody of personally identifiable information.
section_title: including inadequate information security and data integrity, and it concludes that this could impact travelers in several ways, such as travel inconveniences, subsequent denial of admission to the United States based on faulty data, or misuse of personally identifiable information. In fact, the privacy impact assessment rated misuse of personally identifiable information as a high risk under the proposed solution due to the serious impact that misuse of personally identifiable information would have on both the individual traveler and the integrity of US-VISIT.
paragraphs: According to the NPRM, these privacy and security risks will be addressed in two ways. First, DHS will require carriers to ensure that their systems and transmission methods of  biometric data meet DHS technical, security and privacy requirements to be established  in guidance and issued in conjunction with the final rule.  However, it is unclear how DHS  will ensure that the guidance is effectively implemented. Second, when the data are  received by DHS, the NPRM states that it will be protected in accordance with a robust  privacy and security program. However, we recently reported that the systems  supporting US-VISIT have significant information security weaknesses that place  sensitive and personally identifiable information at increased risk of unauthorized and  possibly undetected disclosure and modification, misuse, and destruction.
GAO, Information Security: Homeland Security Needs to Immediately Address Significant Weaknesses in Systems Supporting the  US-VISIT Program, GAO-07-870 (Washington, D.C.: Jly 13, 2007).
section_title: Observation 3: Public comments on the NPRM raise a range of additional concerns
paragraphs: As noted earlier, 91 entities, including the airline, trade, and travel industries, and federal,  state, and foreign governments, commented on the Air and Sea Exit proposal. In addition  to the comments discussed earlier relative to the reliability of the cost estimates and the  security and privacy implications of a carrier-implemented solution, a number of other  comments were provided that raise further concerns and questions about the proposed  solution. Specifically, the entities provided the following comments:   According to some carriers, DHS has yet to provide technical requirements for the  carriers to meet in delivering their respective parts of the proposed solution. In  particular, the NPRM stated that carriers will be required to comply with the DHS  Consolidated User’s Guide. However, they stated that this guide does not define, for  example, how biometric images are to be incorporated into the existing message  format used for APIS transmissions. Similarly, the NPRM states that all biometric  data transmissions would be bound by existing regulations, including the FBI’s  Criminal Justice Information Services Electronic Transmission Specifications. However, carriers stated that these specifications had not been made available.
section_title: According to some of the carriers, DHS’s proposed solution conflicts with air and
paragraphs: vessel carrier passenger processing improvements. Requiring passenger-agent  contact goes against recent simplifications to carriers’ business models in which new  technologies are being introduced to eliminate time-consuming passenger-agent  interactions. For example, most airlines and cruise ships allow passengers to confirm  arrival and check-in online prior to entering the airport or sea terminal, or to check in  and print a boarding pass at a kiosk. These carriers commented that the passenger- agent contact required under the NPRM is at odds with this evolution in business  processes and will slow down the travel process, delay flights, and make air and sea  ports more crowded. According to one carrier’s estimates, the proposed solution will  add 1 to 2 minutes processing time per passenger, which will collectively add an  estimated 3 to 5 hours per flight. While the regulatory impact analysis projected flight  delays to be less lengthy, it nevertheless acknowledged that most travelers would be  delayed by about 50 minutes. A number of entities said that such significant delays  will cause foreign travelers to vacation elsewhere.
section_title: According to several airlines and airline associations, DHS’s proposed solution is not
paragraphs: fully integrated with other border screening programs involving air carriers. DHS has  recently issued proposed or final rules for four DHS programs, and each of these  require or propose requiring carriers to collect and transmit additional data in 2008  and 2009. As such, these organizations viewed the four as duplicative (require very  similar data) and inefficient (use different transmission methods), and claimed that  DHS’ sequential introduction of these programs will require carriers to undertake  separate and repeated system development and employee training efforts that will  impact their operations.
According to several carriers, DHS did not involve the stakeholders in this rulemaking  process as it had in previous rulemaking efforts.  Carriers stated that for US-VISIT  entry and the Advance Passenger Information System-Quick Query, which is about  to be deployed, they were involved in developing a solution, but for US-VISIT exit,  they were not.
There the Air/S Exit, Secre Flight, the Electronic Trvel Athoriztion Stem, nd the Advnce Passenger Informtion  Stem-Qick Qery.
section_title: Observation 4: US-VISIT risk management database shows that some risks have not been effectively managed
paragraphs: Proactively managing program risks is a key acquisition management control and, if  defined and implemented properly, it can increase the chances of programs delivering  promised capabilities and benefits on time and within budget. To its credit, the program  office has defined a risk management plan and related process that is consistent with  relevant guidance. However, its own risk database shows that not all risks have been  proactively mitigated. As we have previously reported, not proactively mitigating risks  increases the chances that risks become actual cost, schedule, and performance  problems.
GAO-06-296   OMB, Circular No. A-11, Part 7 Supplement - Capital Programming Guide, 2006, http://www.whitehouse.gov/om/circ/11/  crrent_yer/_11_2006.pdf (ccessed Jne 16, 2008) nd Softwre Engineering Intitte, CMMI for Acquisition, Verion 1.2,  CMU/SEI-2007-TR-017 (Pittsburgh, PA; Novemer 2007).
section_title: identifying, analyzing, and mitigating risks; and (4) periodically examining the status of identified risks and their mitigation. The US-VISIT Risk Management Plan defines a five- step process for managing program risks, as illustrated in the figure.
paragraphs: Within each of these steps, the plan defines a number of activities that are consistent with  federal guidance and related best practices. For example,  In the preparation phase, each project office is to develop a strategy for managing  risk that includes, among other things, the scope of the project risks to be addressed  and the risk management tools to be used.
In the risk identification phase, risks are to be identified in as much detail as possible  and a risk owner is to be designated.
In the risk analysis phase, the estimated probability of occurrence and impact on the  program or project of each risk is to be determined and used to assign a priority  (high, medium, or low).
section_title: In the risk handling phase, detailed mitigation and contingency plans are to be
paragraphs: prepared for all medium-and-high priority risks as early as possible.
In the risk monitoring phase, the status of risk mitigation and contingency plans is to  be tracked, and decisions are to be reached as to whether to close a risk or to  designate it as a realized issue (i.e., actual problem).
section_title: Further, many of these risks had not had mitigation and/or contingency plans developed in a time frame that can be considered either “as early as possible” or timely. In fact, some risks had been open for over 3 years without having such plans. For example, of the six risks in the monitoring phase without at least one of the two required plans, one risk had been open for 1212 days (about 3 years and 3 months) without a mitigation plan, and the median number of days that risks in this phase had gone without one or both of these plans was 178 (about 6 months). The chance of risks becoming actual problems and impacting the program is increased by not having mitigation and contingency plans. This is evident by the fact that of the 11 high risks that the program office reported at the time as having become realized issues (actual problems), all were missing mitigation and/or contingency plans, and the median number of days these 11 had gone without these plans was 299 (see table below).
paragraphs: Days the risk has been open (as of February 6, 2008)
Management step  Hndle (6 ri)  Monitor (6 ri)  Relized (11 ri)
section_title: Our analysis of a more recent risk listing confirmed that this pattern has continued. Specifically, the July 3, 2008, risk listing contained 34 high-priority risks, of which none were in the analysis phase, 10 were in the handling phase, 12 were in the monitoring phase, and 12 were now realized and became program issues. However, 6 of the 12 risks in the monitoring phase, for example, did not have contingency plans and 3 of these 6 did not have mitigation plans. Moreover, some of the risks in either the monitoring phase or the realized phase have not had mitigation and/or contingency plans for more than 3½ years (see table below).
paragraphs: Days the risk has been open (as of July 3, 2008)
Management step  Hndle (7 ri)  Monitor (6 ri)  Relized (11 ri)
section_title: The absence of timely risk mitigation and contingency planning is exacerbated by the fact that these are high risks which, according to the Risk Management Plan, means that there is at least a 41 percent chance they will significantly affect critical cost, schedule, and performance baselines. By not effectively managing key program risks, the program office is unnecessarily increasing its chances of experiencing actual cost, schedule, and performance problems, and will be less likely to be able to deliver system capabilities on time and within budget.
section_title: Observation 5: Significance of task order 7 schedule variances have been minimized by frequent rebaselining
paragraphs: According to the GAO Cost Assessment Guide, rebaselining should occur very rarely, as  infrequently as once in the life of a program or project and only when a schedule variance  is significant enough to limit its utility as a predictor of future schedule performance.
For task order 7, the largest task order, which provides for development and deployment  of new capabilities (e.g., Unique Identity and Biometric Solutions Delivery) the program  office has rebaselined its schedule twice in the last 2 years—first in October 2006, when  the task order had a negative schedule variance of $958,216, and then in October 2007,  when the negative schedule variance for Unique Identity and Biometric Solutions was  $4.1 million. Since this last rebaselining, the program office reports a negative variance  through May 2008 of $3.5 million. Without the rebaselinings, this would have amounted to  a $7.2 million schedule variance. The graphic on the next slide shows the cumulative  schedule variance with and without the rebaselining.
GAO, Cost Assessment Guide: Best Practices for Estimating and Managing Program Costs, Exposure Draft, GAO-07-1134SP.  (Washington, D.C.:Jly 2007).
Task order 7 has pproximte ve of $141 million.
Cumulative Schedule Variance, TO7 (Biometric Solutions + Unique  ID)
section_title: As the graphic shows, frequent rebaselining does not adequately disclose the potential extent of the shortfall in meeting the baseline. Given that EVM reporting is to alert management to magnitude and significance of potential problems sooner rather than later, this practice does not adequately support informed program decision making. Moreover, it is an indicator of the limitations in the baselines being set. According to program officials, these schedule variances are due to (1) increases in scope of the work, such as the addition of new requirements and (2) underestimating the complexity and difficulty of the work to be completed (i.e., limitations in the schedule baseline).
paragraphs: 84  DHS has not adequately met the conditions associated with its legislatively mandated  fiscal year 2008 US-VISIT expenditure plan. The plan does not fully satisfy any of the  conditions that apply to DHS, either because it does not address key aspects of the  condition or because what it does address is not adequately supported or is otherwise not  reflective of known program weaknesses. Given that the legislative conditions are  intended to promote the delivery of promised system capabilities and value, on time and  within budget, and to provide Congress with an oversight and accountability tool, these  expenditure plan limitations are significant.
Beyond the expenditure plan, other program planning and execution limitations and  weaknesses also confront DHS in its quest to deliver US-VISIT capabilities and value in a  timely and cost-effective manner. Most notably, DHS has proposed a solution for a long- awaited exit capability, but it is not clear if the cost estimates used to justify it are  sufficiently reliable to do so. DHS has reported itself that the proposed solution provides  less security and privacy than other alternatives analyzed, and the proposed solution is  being challenged by those responsible for implementing it. Further, DHS’s ability to  measure program performance and progress, and thus be positioned to address cost and  schedule shortfalls in a timely manner, is hampered by weaknesses in the prime  contractor’s implementation of EVM. Each of these program planning and execution  limitations and weaknesses introduce risk to the program.
In addition, DHS is not effectively managing the program’s risks, as evidenced by the  program office’s risk database showing that known risks are being allowed to go years  without risk mitigation and contingency plans. Overall, while DHS has taken steps to  implement a significant percentage of our prior recommendations aimed at improving  management of US-VISIT, additional management improvements are needed to  effectively define, justify, and deliver a system solution that meets program goals, reflects  stakeholder input, minimizes exposure to risk, and provides Congress with the means by  which to oversee program execution. Until these steps are taken, US-VISIT program  performance, transparency, and accountability will suffer.
To assist DHS in planning and executing US-VISIT, we recommend that the Secretary of  Homeland Security direct the department’s Investment Review Board to immediately hold  a review of the US-VISIT program that, at a minimum, addresses   The reasons for the fiscal year 2008 expenditure plan not fully addressing each of the  legislative conditions and corrective action to ensure that this does not occur for  future expenditure plans;   The adequacy of the basis for any future Air and Sea Exit solution, including the  reliability of cost estimates, implication of privacy and security issues, and addressing  key concerns raised in comments to the proposed rule;   The weaknesses in the program’s implementation of risk management, and  The weaknesses in the prime contractor’s implementation of earned value  management, including the limitations in the quality of the schedule baselines and  the schedule variance measurements.
We further recommend that the Secretary of Homeland Security report the results of this  Investment Review Board review to Congress.
87  Agency Comments and Our Evaluation  We provided a draft of this briefing to DHS officials, including the Director of US-VISIT. In  their oral comments on the draft, these officials did not state whether they agreed or not  with our findings, conclusions, or recommendations. They did, however, provide a range  of technical comments, which we have incorporated in the briefing, as appropriate. They  also sought clarification on our scope and methodology, which we have also incorporated  in the briefing.
section_title: Our objectives were to (1) determine whether the plan satisfies the legislative conditions specified in the fiscal year 2008 Consolidated Appropriations Act, and (2) provide observations about the expenditure plan and management of US-VISIT. Information on scope and methodology for each objective follows:
paragraphs: A greed, ocope of work focused on the pln delivered to the Housnd Sente Approprition Committee.
section_title: For condition 3, we reviewed and analyzed information in the fiscal year 2008
section_title: To accomplish conditions 4, 5, 6, 7, 8, and 9 of objective 1 we determined whether the plan satisfies, partially satisfies, or does not satisfy the conditions based on the extent to which the applicable certification letter contained in the plan (a) addresses all aspects of each condition, as specified in the act, (b) is sufficiently supported by documented and verifiable analysis, (c) contains significant qualifications, and (d) is otherwise consistent with our related findings.
paragraphs: For condition 4, we reviewed the DHS certification and supporting documentation for  US-VISIT’s capital planning and investment controls, including US-VISIT’s most  recent OMB submission and documents related to the milestone decision point 1 and  2 approvals, to determine whether a sufficient basis existed for the certification;   For condition 5, we reviewed the DHS certification for the independent verification  and validation agent and analyzed supporting documentation, such as DHS’s  assessment of US-VISIT’s independent verification and validation efforts, to  determine whether a sufficient basis existed for the certification;  For condition 6, we reviewed the DHS certification that the US-VISIT architecture is  sufficiently aligned with the DHS EA, and assessed supporting documentation,  including US-VISIT program documents against the DHS EA 2007, and criteria in  DHS’s Investment Review Process and DHS’s EA Governance Process Guide to 91  Attachment 1  Scope nd Methodology  determine whether a sufficient basis existed for the certification;   For condition 7, we reviewed the DHS certification that the plans for the US-VISIT  program comply with federal acquisition rules, guidelines, and practices, and  analyzed supporting documentation, such as DHS’s assessment of US-VISITs  contracts, to determine whether there was a sufficient basis for the certification;  For condition 8, we reviewed the DHS certification that US-VISIT have a risk  management process that identifies, evaluates, mitigates, and monitors risks  throughout the life cycle, and communicates high risks to the appropriate managers  at the US-VISIT program and DHS levels.  We also analyzed the most current US- VISIT risk management plan, risk lists, and risk meeting minutes, to determine  whether there was a sufficient basis for the certification; and  For condition 9, we reviewed the DHS certification that the human capital needs of  the US-VISIT program were being strategically and proactively managed, and  analyzed supporting documentation, such as US-VISIT’s Human Capital Strategic  Plan, to determine whether there was a sufficient basis for the certification.
section_title: To accomplish our second objective, we reviewed the fiscal year 2008 plan and other available program documentation related to US-VISIT’s plans for deploying an biometric exit capability, US-VISIT’s use of earned value management, and US-VISIT’s implementation of risk management. In doing so, we examined planned and completed actions and steps, including program officials' stated commitments to perform them. For earned value management, we reported data provided by the contractor to US-VISIT that is verified by US-VISIT. To assess its reliability, we reviewed relevant documentation and interviewed the system owner for the earned value data. More specifically, we addressed US-VISIT efforts to:
paragraphs: We did not ttempt to vlidte the comment.
For observtion 6, we used the Uniqe ID nd Biometric Soltion Delivery subas of task order 7.  Thee tas covered 98  percent of the totl ve of task order 7 nd the remining 2 percent were relted to subasssued in fil yer 2008.
93  Attachment 1  Scope nd Methodology   define and implement a risk management process that addresses the identification,  analysis, evaluation, and monitoring of risks by reviewing the risk management  policy, risk management plan, active and high risk lists, risk meeting minutes, and a  risk elevation memorandum.
Additionally, in February 2007, we reported that the system that US-VISIT uses to  manage its finances (U.S. Immigration and Customs Enforcement’s Federal Financial  Management System) has reliability issues. In light of these issues, the US-VISIT Budget  Office tracks program obligations and expenditures separately using a spreadsheet and  comparing this spreadsheet to the information in Federal Financial Management System.  Based on a review of this spreadsheet, there is reasonable assurance that the US-VISIT  budget numbers being reported by Federal Financial Management System are accurate.
For DHS-provided data that our reporting commitments did not permit us to substantiate,  we have made appropriate attribution indicating the data’s source.
section_title: Homeland Security: Strategic Solution for US-VISIT Program Needs to Be Better
paragraphs: Defined, Justified, and Coordinated. GAO-08-361. Washington, D.C.: February 29,  2008.
Homeland Security: U.S. Visitor and Immigrant Status Program’s Long-standing Lack  of Strategic Direction and Management Controls Needs to be Addressed. GAO-07- 1065. Washington, D.C.: August 31, 2007.
Homeland Security: DHS Enterprise Architecture Continues to Evolve But  Improvements Needed. GAO-07-564. Washington, D.C.: May 9, 2007.
Homeland Security: US-VISIT Program Faces Operational, Technological, and  Management Challenges. GAO-07-632T.  Washington D.C.: March 20, 2007.
Homeland Security: US-VISIT Has Not Fully Met Expectations and Longstanding  Program Management Challenges Need to Be Addressed. GAO-07-499T.  Washington, D.C.: February 16, 2007.
Homeland Security: Planned Expenditures for U.S. Visitor and Immigrant Status  Program Need to Be Adequately Defined and Justified. GAO-07-278. Washington,  D.C.: February 14, 2007.
Border Security: US-VISIT Program Faces Strategic, Operational, and Technological  Challenges at Land Ports of Entry. GAO-07-378T.  Washington, D.C.: January 31,  2007.
section_title: Border Security: US-VISIT Program Faces Strategic, Operational, and Technological
paragraphs: Challenges at Land Ports of Entry. GAO-07-248. Washington, D.C.: December 6,  2006.
Homeland Security: Contract Management and Oversight for Visitor and Immigrant  Status Program Need to Be Strengthened. GAO-06-404. Washington, D.C.: June 9,  2006.
Homeland Security: Progress Continues, but Challenges Remain on Department’s  Management of Information Technology. GAO-06-598T. Washington, D.C.: March  29, 2006.
Homeland Security: Recommendations to Improve Management of Key Border  Security Program Need to Be Implemented. GAO-06-296. Washington, D.C.:  February 14, 2006.
Homeland Security: Visitor and Immigrant Status Program Operating, but  Management Improvements Are Still Needed. GAO-06-318T. Washington, D.C.:  January 25, 2006.
Information Security: Department of Homeland Security Needs to Fully Implement Its  Security Program. GAO-05-700. Washington, D.C.: June 17, 2005.
Information Technology: Customs Automated Commercial Environment Program  Progressing, but Need for Management Improvements Continues. GAO-05-267.
Washington, D.C.: March 14, 2005.
Homeland Security: Some Progress Made, but Many Challenges Remain on U.S.
Visitor and Immigrant Status Indicator Technology Program. GAO-05-202.  Washington, D.C.: February 23, 2005.
Border Security: State Department Rollout of Biometric Visas on Schedule, but  Guidance Is Lagging. GAO-04-1001. Washington, D.C.: September 9, 2004.
Border Security: Joint, Coordinated Actions by State and DHS Needed to Guide  Biometric Visas and Related Programs. GAO-04-1080T. Washington, D.C.:  September 9, 2004.
Homeland Security: First Phase of Visitor and Immigration Status Program  Operating, but Improvements Needed. GAO-04-586. Washington, D.C.: May 11,  2004.
Homeland Security: Risks Facing Key Border and Transportation Security Program  Need to Be Addressed. GAO-04-569T. Washington, D.C.: March 18, 2004.
Homeland Security: Risks Facing Key Border and Transportation Security Program  Need to Be Addressed. GAO-03-1083. Washington, D.C.: September 19, 2003.
Information Technology: Homeland Security Needs to Improve Entry Exit System  Expenditure Planning. GAO-03-563. Washington, D.C.: June 9, 2003.
section_title: Description of the processes underlying each increment and the systems that provide information to US-VISIT.
paragraphs: Increment 1 processes—Increment 1 includes the following five processes at air and  sea ports of entry (POE): pre-entry, entry, status management, exit, and analysis, which  are depicted in the graphic below.
section_title: Pre-entry processing begins with initial petitions for visas, grants of visa status, or the issuance of travel documentation. When a foreign national applies for a visa at a U.S. consulate, biographic and biometric data are collected and shared with border management agencies. The biometric data are transmitted from the Department of State (State) to the Department of Homeland Security (DHS), where the fingerprints are run against the Automated Biometric Identification System (IDENT) to verify identity and to run a check against the biometric watch list. The results of the biometric check are transmitted back to State. A “hit” response prevents State’s system from printing a visa for the applicant until the information is cleared by a consular officer. Pre-entry also includes transmission by commercial air and sea carriers of crew and passenger manifests before arriving in the United States. These manifests are transmitted through the Advance Passenger Information System (APIS). The APIS lists are run against the biographic lookout system and identify those arrivals who have biometric data available. In addition, POEs review the APIS list in order to identify foreign nationals who need to be scrutinized more closely.
paragraphs: US-VISIT irrently tritioning from nning only the right nd left index finger to nning ll 10 finger.   8 U.S.C. § 1221().
section_title: Entry process:
paragraphs: When the foreign national arrives at a primary POE inspection booth, the inspector, using  a document reader, scans the machine-readable travel documents. APIS returns any  existing records on the foreign national to the CBP primary inspection workstation screen,  including manifest data matches and biographic lookout hits. When a match is found in  the manifest data, the foreign national’s name is highlighted and outlined on the manifest  data portion of the screen.
Biographic information, such as name and date of birth, is displayed on the bottom of the  computer screen, as well as the photograph from State’s Consular Consolidated  Database. The inspector at the booth scans the foreign national’s fingerprints and takes a  digital photograph. This information is forwarded to the IDENT database, where it is  checked against stored fingerprints in the IDENT lookout database.
The new 10-print process will o integrte thi informtion with mnifet d o tht it i ll repreented on one creen.
section_title: If no prints are currently found in IDENT, the foreign national is enrolled in US-VISIT (i.e., biographic and biometric data are entered). If the foreign national’s fingerprints are already in IDENT, the system performs a match (a comparison of the fingerprints captured during the primary inspection to the ones on file) to verify that the person submitting the fingerprints is the person on file. If the system finds a mismatch of fingerprints or a watch list hit, the foreign national is sent to an inspection booth for further screening or processing.
paragraphs: While the system is checking the fingerprints, the inspector questions the foreign national  about the purpose of his or her travel and length of stay. The inspector adds the class of  admission and duration of stay information into the Treasury Enforcement  Communications System (TECS), and stamps the “admit until” date on the Form I-94.  If the foreign national is ultimately determined to be inadmissible, the person is detained,  lookouts are posted in the databases, and appropriate actions are taken.
Within 2 hours after a flight lands and all passengers have been processed, TECS is to  send the Arrival and Departure Information System (ADIS) the records showing the class  of admission and the “admit until” dates that were modified by the inspector.
section_title: Status management process:
paragraphs: The status management process manages the foreign national’s temporary presence in  the United States, including the adjudication of benefits applications and investigations  into possible violations of immigration regulations.
Commercial air and sea carriers transmit departure manifests electronically for each  departing passenger. These manifests are transmitted through APIS and shared with  ADIS. ADIS matches entry and exit manifest data to ensure that each record showing a  foreign national entering the United States is matched with a record showing the foreign  national exiting the United States. ADIS maintains a status indicator for each traveler and  computes the number of overstay days a visitor remains beyond their original entry  duration.
ADIS also provides the ability to run queries on foreign nationals who have entry  information but no corresponding exit information.
ADIS receives status information from the Computer Linked Application Information  Management System and the Student and Exchange Visitor Information System on  foreign nationals.
section_title: Exit process:
paragraphs: The exit process includes the carriers’ electronic submission of departure manifest data to  APIS. This biographic information is passed to ADIS, where it is matched against entry  information.
An ongoing analysis capability is to provide for the continuous screening against watch  lists of individuals enrolled in US-VISIT for appropriate reporting and action. As more  entry and exit information becomes available, it is to be used to analyze traffic volume  and patterns as well as to perform risk assessments. The analysis is to be used to  support resource and staffing projections across the POEs, strategic planning for  integrated border management analysis performed by the intelligence community, and  determination of travel use levels and expedited traveler programs.
section_title: Increment 2B and Increment 3 processes—
paragraphs: Increments 2B and 3 deployed US-VISIT entry processing capabilities to land POEs.  These two increments are similar to Increment 1 (air and sea POEs), with several  noteworthy differences.
No advance passenger information is available to the inspector before the traveler  arrives for inspection.
Travelers subject to US-VISIT are processed at secondary inspection, rather than at  primary inspection.
Inspectors’ workstations use a single screen, which eliminates the need to switch  between the TECS and IDENT screens.
Form I-94 data are captured electronically. The form is populated by data obtained  when the machine-readable zone of the travel document is swiped. If visa information  about the traveler exists in the Datashare database, it is used to populate the form.  Fields that cannot be populated electronically are manually entered. A copy of the  completed form is printed and given to the traveler for use upon exit.
No electronic exit information is captured.
Dasre inclde  extrct from Ste’ Consur Conolidted Dabastem nd inclde the visa photogrph,  iogrphicl d, nd the fingerprint identifiction ner assigned when  nonimmigrnt pplie for  visa.
section_title: Component systems
paragraphs: US-VISIT Increments 1 through 3 include the interfacing and integration of existing  systems and, with Increment 2C, the creation of a new system. The three main existing  systems are as follows: Arrival and Departure Information System (ADIS) stores   non-citizen traveler arrival and departure data received from air and sea carrier   arrival data captured by CBP officers at air and sea POEs,  Form I-94 issuance data captured by CBP officers at Increment 2B land POEs,  Form I-94 data captured at air and sea ports of entry, and   status update information provided by the Student and Exchange Visitor Information  System (SEVIS) and the Computer Linked Application Information Management  System (CLAIMS 3) (described on the next slide).
105    Attachment 3  Detiled Decription of Increment nd Component Stem  ADIS provides biographic identity record matching, query, and reporting functions.
The passenger processing component of the Treasury Enforcement Communications  System (TECS) includes two systems:  Advance Passenger Information System (APIS) captures arrival and departure  manifest information provided by air and sea carriers, and   Interagency Border Inspection System (IBIS) maintains lookout data and interfaces  with other agencies’ databases.
CBP officers use these data as part of the admission process. The results of the  admission decision are recorded in TECS and ADIS.
section_title: The Automated Biometric Identification System (IDENT) collects and stores biometric data on foreign visitors, including data such as
paragraphs: Federal Bureau of Investigation information on all known and suspected terrorists,  all active wanted persons and warrants, and previous criminal histories for visitors  from high-risk countries;  DHS Immigration and Customs Enforcement information on deported felons and sex   DHS information on previous criminal histories and previous IDENT enrollments.
Informtion from the Federl Breau of Invetigtion inclde fingerprint from the Integrted Atomted Fingerprint Identifiction Stem.
107    Attachment 3    Detiled Decription of Increment nd Component Stem  US-VISIT also exchanges biographic information with other DHS systems, including  SEVIS and CLAIMS 3:   SEVIS is a system that contains information on foreign students and  CLAIMS 3 is a system that contains information on foreign nationals who request  benefits, such as change of status or extension of stay.
Some of the systems involved in US-VISIT, such as IDENT and ADIS, are managed by  the program office, while some systems are managed by other organizational entities  within DHS. For example:   TECS is managed by CBP,   SEVIS is managed by Immigration and Customs Enforcement, and  CLAIMS 3 is under United States Citizenship and Immigration Services.
section_title: US-VISIT also interfaces with other, non-DHS systems for relevant purposes, including watch list (i.e. lookout) updates and checks to determine whether a visa applicant has previously applied for a visa or currently has a valid U.S. visa. In particular, US-VISIT receives biographic and biometric information from State’s Consular Consolidated Database as part of the visa application process, and returns fingerscan information and watch list changes. IDENT also receives data from FBI’s IAFIS fingerprint system.
paragraphs: Wtch lit d rce inclde DHS’ Custom nd Border Protection nd Immigrtion nd Custom Enforcement; the Federl  Breau of Invetigtion; legcy DHS tem; the U.S. Secret Service; the U.S. Coast Guard; the Internl RevenService; the Drg  Enforcement Agency; the Breau of Alcohol, Tobacco, & Firerm; the U.S. M Service; the U.S. Office of Foreign Asset  Control; the Ntionl Guard; the Treasury Inpector Generl; the U.S. Deprtment of Agricltre; the Deprtment of Defene Inpector Generl; the Royl Cdin Monted Police; the U.S. Ste Deprtment; Interpol; the Food nd Drg Adminitrtion; the Finncil Crime Enforcement Network; the Breau of Engrving nd Printing; nd the Deprtment of Justice Office of Specil Invetigtion.
1. Develop nd pprove complete tet pl  efore teting egin. Thee pl,   minimm, hold (1) pecify the tet  environment, inclding tet eqipment,  oftwre, mteril, nd necessary trining; (2)  decrie ech tet to e performed, inclding  tet control, inp, nd expected otp; (3)  define the tet procedre to e followed in  condcting the te; nd (4) provide  trceability etween tet cas nd the  reqirement to e verified y the  teting.(GAO-04-586)  Implement effective configtion  mgement prctice, inclding eablihing   US-VISIT chnge control rd to mge  nd overee tem chnge. (GAO-04-586)
Partially Implemented: The progrm office has developed nd  pproved tet pl for vrious tem component, such as the  US-VISIT/IDENT Prodct Integrtion nd the Unified IDENT  Release 2 Component/Assemly. Oly of thee pl  how tht they (1) pecified the tet environment, inclding tet  eqipment, oftwre, mteril, nd necessary trining; (2)  decried ech tet to e performed, inclding tet control, inp,  nd expected otp; (3) defined tet procedre to e followed in  condcting te; nd (4) provided trceability etween tet cas  nd the reqirement to e verified y the teting. However, we  were able to verity tht thee pl were pproved prior to  teting. Implemented: The progrm office has developed  configtion  control rd tht i reponle for, mong other thing, to  mge nd overee tem chnge. The office has o  developed  configtion mgement plnd egn  implementing prctice pecified in the pln. For exmple,  project  level configtion mgement pln was developed for Uniqe  Identity nd  chnge control reqsubmitted nd pproved y  the rd.
3. Develop  pln, inclding explicit tas nd  miletone, for implementing ll of or open  recommendtion, inclding thoe provided in  thi report. The plhold provide for  periodic reporting to the Secretry nd Under  Secretry on progress in implementing thi  pln. The Secretry hold report thi  progress, inclding reason for del, in ll  fre US-VISIT expenditre pl. (GAO-04-586)
Partially Implemented: US-VISIT audit coordintion nd reoltion  i governed y formaudit gidnce nd coordinted throgh n  Integrted Project Tem. The tem has developed  pln tht  incldeas nd miletone for implementing GAO  recommendtion. The plo provide for the periodic reporting  to the Secretry nd Under Secretry. Frther, the us of effort  to ddress er of GAO recommendtionas een inclded  in recent US-VISIT expenditre pl, lthogh reason for del  in implementing them hve not.
4. Flly nd explicitly dicloe in ll fre  expenditre pl how well DHS  progressing int the commitment tht it  mde in prior expenditre pl.       (GAO- 05-202) 5. Reassss it pl for deploying n exit  ability to ensure tht the cope of the exit  pilot provide for dequate evuation of  lterntive oltion nd etter ensure tht  the exit oltion elected i in the t interet  of the progrm. (GAO-05-202)
Partially Implemented: A diussed erlier in thi riefing, while  the fil yer 2008 expenditre pln provide ome informtion on  how well DHS progressing int commitmentde in the  fil yer 2007 expenditre pln, it doe not flly nd explicitly  dicloe how well it i progressing inll previous  commitment, nd it decri progress in reas not committed to in  the prior yer’ pln. Implemented: The progrm office has reassssed it pl for  deploying n exit cability.  A  result of thassssment, the  progrm office dicontined the US-VISIT exit pilot in My 2007.
6. Develop nd implement process for  ging the ccity of the US-VISIT  tem. (GAO-05-202)  7. Follow effective prctice for etimting the  co of fre increment. (GAO-05-202)  8. Mke ndernding the reltionhip nd  dependencie etween the US-VISIT nd  ACE progr  priority mtter, nd report  periodiclly to the Under Secretry on  progress in doing o. (GAO-05-202)
Implemented: The progrm has developed city mgement  hndook tht provideidnce for mging tem ccity nd  has incorported the ctivitie to e performed into it Universal  Delivery Method. Frther, the progrm office has egn  implementing thiidnce. For exmple, it has developed US- VISIT/IDENT business nd ervice ccity baseline.  Partially Implemented: According to the progrm office, they hve  (1) eablihed  Cot Process Action Tem, (2) defined cot  etimtion nd ly prctice nd process, (3) developed  process for developing oth progrm life cycle cot etimte nd  Independent Government Cot Etimte, nd (4) condcted  elf- assssment of the progrm’ cot etimting prctice int  gideline from the Softwre Engineering Intitte. However, the  progrm office has yet to provide docmenttion demontrting tht  it i implementing it defined cot etimtion prctice. Implemented: The progrm office has een working with the DHS  Screening nd Coordintion Office to, mong other prioritie;  develop  greter ndernding etween US-VISIT nd other  progr, inclding ACE. Frther, ecause the progrm i no longer  orgniztionlly within the Office of the Under Secretry, reporting  on progress to the Under Secretry i no longer wrrnted. Inted,  the Screening nd Coordintion Office, which report directly to the  Secretry nd Depty Secretry, i re of progress in thi re.
9. Explore lterntive me of oining ndernding of the fll impct of US-VISIT  ll lnd POE, inclding it impct on  workforce level nd fcilitie; thelterntive hold inclde surveying the ite  tht were not prt of the previous assssment.  (GAO-06-296)
Implemented: The progrm office reassssed it pl for  deploying n exit cability to lnd POE, nd as  result,  dicontined the demontrtion project in Novemer 2006.
10.For ech US-VISIT contrct ction tht the  progrm mge directly, eablind  mintin  pln for performing the contrctor  overight process, as pproprite. (GAO-06- 404) 11.Develop nd implement prctice for  overeeing contrctor work mged y other  gencie on the progrm office’ ehlf,  inclding (1) clerly defining role nd  reponilitie for oth the progrm office nd  ll gencieging US-VISIT-relted  contrct; (2) hving crrent, reliable, nd  timely informtion on the fll cope of contrct  ction nd ctivitie; nd (3) defining nd  implementing tep to verify tht deliverable  meet reqirement. (GAO-06-404)
Implemented: For contrct ction tht the progrm mge  directly, nd where it i pproprite for the progrm office to overee  contrctor ctivitie, the progrm office hasablihed nd  mintin n overight pln. For exmple, the progrm office has  developed individual overight pl for 10-Print, Uniqe Identity,  Interim D Sring Model, nd Independent Tend Support  Evuation Service. Ech individual overight pln decri the  role, reponilitie, nd authoritie involved in condcting  contrct dminitrtion nd overight of the contrct ction.  Implemented: The progrm office has developed nd implemented  prctice for overeeing contrctor work mged y other  gencie on the progrm office’ ehlf. Specificlly, it has  developed  contrctor dminitrtion mgement pln tht  inclde (1) clerly defining role nd reponilitie for oth the  progrm office nd ll gencieging US-VISIT-relted contrct; (2) hving crrent, reliable, nd timely informtion on the  fll cope of contrct ction nd ctivitie; nd (3) defining nd  implementing tep to verify tht deliverable meet reqirement.
12.Reqire, throgh greement, thgencie  ging contrct ction on the progrm  office’ ehlf implement effective contrct  mgement prctice content with  cqition gidnce for ll US-VISIT contrct  ction, inclding  minimm, (1)  eablihing nd mintining  pln for  performing contrct mgement ctivitie;  (2) assigning reponility nd authority for  performing contrct overight; (3) trining the  people performing contrct overight; (4)  docmenting the contrct; (5) verifying tht  deliverable satify reqirement; (6)  monitoring contrctor-relted rik; nd (7)  monitoring contrctor performnce to ensure  tht the contrctor i meeting chedle, effort,  cot, nd technicl performnce  reqirement.  (GAO-06-404)
Implemented: The progrm office has mended the lnguage used  in it intergency greement (IAA) to reqire gencie tht mge  contrct ction on the progrm’ ehlf to implement certin  prctice deigned to trengthen contrct mgement nd  overight. Thee reqirement re pecified in the My 2007 US- VISIT Contrct Adminitrtion Mgement Plnd hve een  inclded in ech of the IAA. Specificlly, ech IAA pecifie tht  the gent gency i to (1) eablind mintin  pln for  performing contrct mgement ctivitie; (2) deignte   contrcting officer nd contrcting officer’ technicl repreenttive  to mge ll contrctuaction; (3) trin the people performing  contrct overight, (4) docment the contrct; (5) verify tht  deliverable satify reqirement; (6) monitor contrctor-relted rik;  nd (7) monitor contrctor performnce to ensure tht the contrctor  i meeting chedle, effort, cot, nd technicl performnce  reqirement.
13.Reqire DHS nd non-DHS gencie thge contrct on ehlf of US-VISIT to  (1) clerly define nd delinete the US-VISIT  work from non-US-VISIT work as performed  y contrctor; (2) record, t the contrct  level, mont eing illed nd expended on  US-VISIT-relted work o tht thee ce  trcked nd reported eptely from mont  not for US-VISIT prpo; nd (3) determine  if they hve received reimbuement from the  progrm for pyment not relted to US-VISIT  work y contrctor, nd, if o, refnd to the  progrny mont received in error. (GAO- 06-404)
Partially Implemented: The progrm office report tht it has  egn effort to eablih the process thre to (1) ensure thoth DHS nd non-DHS gencie tht mge contrct on ehlf  of the progrm clerly define nd delinete the US-VISIT work from  non-US-VISIT work performed y contrctor, (2) record, t the  contrct level, mont eing illed nd expended on US-VISIT- relted work o tht thee ce trcked nd reported eptely  from mont not for US-VISIT prpo; nd (3) determine if they  hve received reimbuement from the progrm for pyment not  relted to US-VISIT work y contrctor, nd, if o, refnd to the  progrny mont received in error; however, they hve yet to  demontrte tht thee process re in plce nd eing used ll  DHS nd non-DHS gencie.
14.Ensure tht pyment to contrctor re  timely nd in ccordnce with the Prompt  Pyment Act. (GAO-06-404)  15.Improve exiting mgement control for  identifying nd reporting compter processing  nd other opertionl prolem as they rit lnd POE nd ensure tht thee control  re contently dminitered. (GAO-07-248)
Partially Implemented: The progrm office report tht it has  egn effort to eablih the control needed to ensure tht  pyment to contrctor re mde timely nd in ccordnce with the  Prompt Pyment Act.  Not Implemented: DHSas yet to implement improved  mgement control for identifying nd reporting compter  processing nd other opertionl prolem as they rit lnd  POE or to implement  method for ensuring tht thee control re  contently dminitered.
16.Develop performnce measure for assssing  the impct of US-VISIT opertion pecificlly  t lnd POE. (GAO-07-248)
Not Implemented: DHSas yet to develop performnce measure  for assssing the impct of US-VISIT opertion t lnd POE.
17.A DHS finlize the torily mndted  report decriing  comprehenive iometric  entry nd exit tem for US-VISIT, tht it  inclde, mong other thing, informtion on  the co, enefit, nd feasility of deploying  iometric nd noniometric exit cabilitie t  lnd POE.      (GAO-07-248)
Not Implemented: DHS report tht it has recently egn to  develop the torily mndted report, nd deprtment offici  said tht they expect to issue it in erly 2009. DHS offici ted  tht they expect it to inclde informtion on co, enefit, nd  feasility of iometric nd noniometric exit cabilitie t lnd  POE.
18.A DHS finlize the torily mndted  report decriing  comprehenive iometric  entry nd exit tem for US-VISIT, tht it  inclde, mong other thing,  diussion of  how DHS intend to move from   noniometric exit cability, such as the  technology crrently eing teted, to  reliable  iometric exit cability tht meet tory  reqirement. (GAO-07-248)
Not Implemented: DHSas recently egn to develop the  torily mndted report, nd deprtment offici ted tht it i  to e issued in erly 2009. DHS offici ted tht they expect it to  inclde  diussion on how it intend to move to  iometric exit  cability t lnd port of entry.
19.A DHS finlize the torily mndted  report decriing  comprehenive iometric  entry nd exit tem for US-VISIT, tht it  inclde, mong other thing,  decription of  how DHS expect to lign emerging lnd  order ecrity inititive with US-VISIT nd  wht fcility or fcility modifiction wold e  needed to ensure tht technology nd  process work in hrmony. (GAO-07-248)
Not Implemented: DHSas recently egn to develop the  torily mndted report, nd deprtment offici ted tht it i  to e issued in erly 2009. DHS offici ted tht they expect it to  how how US-VISIT i to lign with emerging lnd order inititive  as well as wht fcility modifiction wold e needed to ensure tht  technology nd process work in hrmony.
Not Implemented: Progrm offici ted tht they periodiclly  rief authoriztion nd pproprition committee on nge of  progrm ri, inclding thoassocited with not hving flly  satified ll expenditre pln legitive condition, reason why  they were not satified, nd tep eing tken to mitigte thee  ri.  However, they did not provide ny verifiable evidence tht  thee mtter were diussed, nd ff with the Housnd Sente  pproprition committee tht focus on US-VISIT told us tht they  re not re of such riefing in which thee mtter were  diussed. Implemented: The progrm office has limited plnned expenditre  in exit pilot nd demontrtion project y reassssing it pl  nd dicontining the exit pilot in My 2007 nd the demontrtion  project in Novemer 2006. demontrtion project ntil such invetment  re economiclly justified nd ntil ech  invetment has  well-defined evuation pln.  The project hold e justified on the bas  of co, enefit, nd ri, nd the  evuation pl hold define wht i to chieved nd hold inclde  pln of ction  nd miletone nd measure for  demontrting chievement of pilot nd  project go nd deired otcome. (GAO- 07-278)
22.Work with the DHS Enterprie Architectre  Bord to identify nd mitigte progrm ri  associted with inveting in new US-VISIT  cabilitie in the absence of  DHS-wide  opertionnd technologicl context for the  progrm. Thee ri hold reflect the  absence of flly defined reltionhip nd  dependencie with relted order ecrity nd  immigrtion enforcement progr. (GAO-07- 278)
Not Implemented: The progrm office provided DHS Enterprie  Architectre Bord meeting meeting.  However, none of the  meeting minte provided contined informtion on identifying nd  mitigting progrm ri associted with inveting in new US-VISIT  cabilitie in the absence of  DHS-wide technologicl context for  the progrm.
23.Limit plnned expenditre for progrgement-relted ctivitie ntil such  invetment re economiclly justified nd  hve well-defined pl detiling wht i to chieved,  pln of ction nd miletone,  nd measure for demontrting progress nd  chievement of deired otcome. (GAO-07- 278) 24.The Secretry of DHS report to the  deprtment’ authoriztion nd pproprition  committee on it reason for not flly  ddressing it expenditre pln legitive  condition nd or prior recommendtion. (GAO-07-1065)
Not Implemented: The progrm office has yet to provide either n  economic justifiction or well-defined pl for it progrm  mgement-relted ctivitie detiling wht i to chieved nd  inclding  pln of ction nd miletone nd measure for  demontrting progress nd chievement of deired otcome.  Moreover, the mont of fnding for progrm mgement in  FY2008 remin t the level mentioned in FY2006 expenditre pln,  which was the bas for thi recommendtion.  Not Implemented: Progrm offici ted tht they periodiclly  rief authoriztion nd pproprition committee on progrm- relted issu, inclding reason for not hving flly satified ll  expenditre pln legitive condition nd GAO recommendtion.  However, they did not provide ny verifiable evidence tht thee  mtter were diussed, nd ff with the Housnd Sente  pproprition committee tht focus on US-VISIT told us tht they  re not re of such riefing in which thee mtter were  diussed.
25.Develop  pln for  comprehenive exit  ability, which inclde,  minimm,   decription of the cability to e deployed,  the cot of developing, deploying nd  operting the cability, identifiction of key  keholder nd their repective role nd  reponilitie, key miletone, nd  measuable performnce indictor. (GAO- 08-361) 26.Develop ly of co, enefit, nd  ri for propoed exit oltion efore lrge  su of money re committed on thooltion, nd use the ly in electing  the finoltion. (GAO-08-361)  27.Direct the pproprite DHSrtie involved in  defining, mging, nd coordinting  reltionhip cross the deprtment’ order  nd immigrtion mgement progr to  ddress the progrm collabortion  hortcoming identified in thi report, such aslly defining the reltionhip etween US- VISIT nd other immigrtion nd order  mgement progr nd, in doing o, to  employ the collabortion prctice diussed  in thi report. (GAO-08-361)
Partially Implemented: DHS recently issued  notice of propoed  rlemking for implementing n exit cability ir nd  POE.  Thi notice provide  high-level decription of  propoed Air nd  S Exit oltion, nd n etimte of the cot to develop, deploy,  nd operte the oltion.  Frther, it decri the role nd  reponilitie of key keholder, such as ir nd rrier,  nd et ome performnce indictor, such as when passenger  iometric re to e trmitted to DHS. However, as diussed in  thi riefing, thi propoed oltion r er of qtion  tht need to e reolved. Partially Implemented: A noted erlier in thi riefing, DHS’ Air  nd S Exit regtory impct ly lyzed the co nd  enefit of the propoed oltion nd folterntive, nd DHS  used thi ly in propoing it exit oltion. However, the cot  etimte tht were used in thi ly were not sufficiently  reliable to justify the propoed oltion. Partially Implemented: DHSas yet to direct ll of the pproprite  prtie involved in defining, mging, nd coordinting  reltionhip cross the deprtment’ order nd immigrtion  mgement progr to ddress the progrm collabortion  hortcoming identified in thi report nd, in doing o, to employ the  collabortion prctice diussed in thi report. Specificlly, while  US-VISIT has egn to coordinte with pecific order nd  immigrtion mgement progr such as the Secre Border  Inititive nd Wetern Hemiphere Trvel Inititive.
section_title: Appendix II: Comments from the Department of Homeland Security
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: Staff Acknowledgments
paragraphs: In addition to the individual named above, Tonia Johnson (Assistant  Director), Bradley Becker, Season Dietrich, Neil Doherty, Jennifer Echard,  Elena Epps, Nancy Glover, Rebecca LaPaze, Anjalique Lawrence, Anh Le,  Emily Longcore, Lee McCracken, Freda Paintsil, Karl Seifert, and Jeanne    Sung made key contributions to this report.