Homeland Security: Observations on DHS's Oversight of Major Acquisitions and Efforts to Match Resources to Needs
Published: 2013-09-19T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: GAO has highlighted DHS acquisition management issues on its high-risk list, and over the past several years, GAO's work has identified significant shortcomings in the department's ability to manage an expanding portfolio of major acquisitions. It is important for DHS to address these shortcomings because the department invests extensively in acquisition programs to help it execute its many critical missions. DHS is acquiring systems to help secure the border, increase marine safety, enhance cyber security, and execute a wide variety of other operations. In 2011, DHS reported to Congress that it planned to ultimately invest $167 billion in its major acquisition programs. In fiscal year 2013 alone, DHS reported it was investing more than $9.6 billion.
This statement discusses (1) DHS's acquisition policy and how it has been implemented; and (2) DHS's mechanisms for managing emerging affordability issues. The statement is based on GAO's prior work on DHS acquisition management and leading commercial companies' knowledge-based approach to managing their large investments. It also reflects observations from ongoing work for this subcommittee. For that work, GAO is reviewing key documentation, and interviewing headquarters and component level acquisition and financial management officials.
section_title: What GAO Found
paragraphs: GAO has previously established that the Department of Homeland Security's (DHS) acquisition policy reflects many sound program management practices intended to mitigate the risks of cost growth and schedule slips. The policy largely reflects the knowledge-based approach used by leading commercial firms, which do not pursue major investments without demonstrating, at critical milestones, that their products are likely to meet cost, schedule, and performance objectives. DHS policy requires that important acquisition documents be in place and approved before programs are executed. For example, one key document is an acquisition program baseline, which outlines a program's expected cost, schedule, and the capabilities to be delivered to the end user. However, in September 2012, GAO found that the department did not implement the policy consistently, and that only 4 of 66 programs had all of the required documents approved in accordance with DHS's policy. GAO made five recommendations, which DHS concurred with, identifying actions DHS should take to mitigate the risk of poor acquisition outcomes and strengthen management activities. Further, GAO reported that the lack of reliable performance data hindered DHS and congressional oversight of the department's major programs. Officials explained that DHS's culture had emphasized the need to rapidly execute missions more than sound acquisition management practices. GAO also reported that most of the department's major programs cost more than expected, took longer to deploy than planned, or delivered less capability than promised. DHS has taken steps to improve acquisition management, but as part of its ongoing work, GAO found that DHS recently waived documentation requirements for 42 programs fielded for operational use since 2008. DHS explained it would be cost prohibitive and inefficient to recreate documentation for previous acquisition phases. GAO plans to obtain more information on this decision and its effect on the management of DHS's major acquisitions. DHS's July 2013 status assessment indicated that, as of the end of fiscal year 2012, many major programs still face cost and schedule shortfalls. DHS expects to provide another update in the near future.
In December 2012, DHS's Chief Financial Officer reported that the department faced a 30 percent gap between expected funding requirements for major acquisition programs and available resources. DHS has efforts underway to develop a more disciplined and strategic approach to managing its portfolio of major investments, but the department has not yet developed certain policies and processes that could help address its affordability issues. In September 2012, GAO reported that DHS largely made investment decisions on a program-by-program and component-by-component basis and did not have a process to systematically prioritize its major investments. In GAO's work at the Department of Defense, it has found this approach hinders efforts to achieve a balanced mix of programs that are affordable and feasible and that provide the greatest return on investment. DHS's proposed Integrated Investment Life Cycle Model (IILCM) is intended to improve portfolio management by ensuring mission needs drive investment decisions. For example, a high-level oversight body would identify potential trade-offs among DHS's component agencies. GAO has recommended such an oversight body for several years. Full implementation of the IILCM may be several years away. GAO will continue to assess the department's progress in its ongoing work.
section_title: What GAO Recommends
paragraphs: GAO is not making any new recommendations in this statement. It has made numerous recommendations in its prior work to strengthen acquisition management, and DHS is taking steps to address them.

section_title: Letter
paragraphs: Thank you for the opportunity to discuss acquisition management at the  Department of Homeland Security (DHS), as well as to discuss some  lessons learned from our prior work comparing the Department of  Defense’s (DOD) acquisition practices to those of leading commercial  companies. As you know, we have highlighted DHS acquisition  management issues in our high-risk list since 2005. Over the past  several years, our work has identified significant shortcomings in the  department’s ability to manage an expanding portfolio of major  acquisitions, and in response to our recommendations, DHS has taken  steps to improve acquisition management. We believe it is important for  DHS to continue to address these shortcomings because the department  invests extensively in acquisition programs to help it execute its many  critical missions. DHS and its underlying components are acquiring  systems to help secure the border, increase marine safety, screen  travelers, enhance cyber security, improve disaster response, and  execute a wide variety of other operations. In 2011, DHS reported to  Congress that it planned to ultimately invest $167 billion in its major  acquisition programs. In fiscal year 2013 alone, DHS reported it planned  to spend more than $9.6 billion on these programs.
My statement today draws from our prior work on DHS acquisition  management and leading commercial companies’ approach to managing  their large investments, work we have done in the context of DOD’s  approach to managing its large acquisitions. The statement also includes observations from our ongoing review of DHS’s acquisition funding  process, which we are conducting at the request of this subcommittee.  This statement discusses (1) DHS’s acquisition policy and how it has  been implemented; and (2) DHS’s mechanisms for managing emerging  affordability issues. For our prior work, we surveyed all 77 major  acquisition program offices that DHS identified in 2011 and achieved a 92  percent response rate. We also reviewed all available department-level  acquisition decisions from November 2008 to April 2012 and interviewed  acquisition officials at DHS headquarters and components. To determine  the extent to which DHS has policies in place to effectively manage  individual acquisition programs, as well as the department’s acquisition  portfolio as a whole, we compared our key acquisition management  practices to DHS acquisition policy, and identified the extent to which  DHS has implemented its policy. More detailed information on our scope  and methodology for our prior work can be found in the relevant reports.  To support our ongoing audit, from March to September 2013, we  reviewed key documentation and interviewed acquisition and financial  management officials at DHS headquarters and components to  understand DHS’s affordability issues and the department’s plans to  address these issues. We are also following up on prior  recommendations.
The work underlying this statement was conducted in accordance with  generally accepted government auditing standards. Those standards  require that we plan and perform the audit to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe that the evidence obtained  provides a reasonable basis for our findings and conclusions based on  our audit objectives.
subsections: section_title: Background
paragraphs: DHS Acquisition Management Directive 102-01 (MD 102) and an  accompanying instruction manual establish the department’s policies and  processes for managing major acquisition programs. While DHS has had  an acquisition management policy in place since October 2004, the  department issued the initial version of MD 102 in 2008.leaders in the department are responsible for acquisition management  functions, including managing the resources needed to fund major  programs.
DHS’s Chief Acquisition Officer—currently the Under Secretary for  Management (USM)—is responsible for the management and   oversight of the department’s acquisition policies and procedures.
The Acquisition Decision Authority is responsible for approving the  movement of programs through the acquisition life cycle at key  milestone events. The USM or Deputy Secretary serve as the  decision authority for programs with life cycle cost estimates of $1  billion or greater, while the cognizant component acquisition executive  may serve as the decision authority for a program with a lower cost  estimate.
The DHS Acquisition Review Board (ARB) supports the Acquisition  Decision Authority by reviewing major acquisition programs for proper  management, oversight, accountability, and alignment with the  department’s strategic functions at the key acquisition milestones and  other meetings as needed.
The ARB is supported by the Office of Program Accountability and  Risk Management (PARM), which reports to the USM and is  responsible for DHS’s overall acquisition governance process. In  March 2012, PARM issued its first Quarterly Program Accountability  Report (QPAR), which provided an independent evaluation of major  programs’ health and risks. Since that time, PARM has issued two  additional QPARs, most recently in July 2013, and plans to issue a  fourth by the end of September 2013. PARM also prepares the  Comprehensive Acquisition Status Reports, which are to be submitted  to the appropriations committees with the President’s budget proposal  and updated quarterly.
The Office of Program Analysis and Evaluation (PA&E), within the  Office of the Chief Financial Officer, is responsible for advising the  USM, among others, on resource allocation issues. PA&E also  oversees the development of the Future Years Homeland Security  Program (FYHSP). The FYHSP is DHS’s 5-year funding plan for  programs approved by the Secretary that are to support the  department’s strategic plan.
section_title: Sound Acquisition Management Policy Has Not Been Implemented Consistently and Many Programs Have Performed Poorly
paragraphs: DHS acquisition policy reflects many key program management practices  intended to mitigate the risks of cost growth and schedule slips.  However, we previously found that the department did not implement the  policy consistently. Officials explained that DHS’s culture emphasized the  need to rapidly execute missions more than sound acquisition  management practices, and we found that senior leaders did not bring to  bear the critical knowledge needed to accurately track program  performance. Most notably, we found that most programs lacked  approved acquisition program baselines, which are critical management  tools that establish how systems will perform, when they will be delivered,  and what they will cost. We also reported that most of the department’s  major programs were at risk of cost growth and schedule slips as a result.
subsections: section_title: DHS Acquisition Policy Generally Reflects Key Program Management Practices Identified at Commercial Organizations
paragraphs: In our past work examining DOD weapon acquisition issues and best  practices for product development, we have found that leading  commercial firms pursue an acquisition approach that is anchored in  knowledge, whereby high levels of product knowledge are demonstrated  by critical points in the acquisition process. While DOD’s major  acquisitions have unique aspects, our large body of work in this area has  established knowledge-based principles that can be applied to  government agencies and can lead to more effective use of taxpayer  dollars.
A knowledge-based approach to capability development allows  developers to be reasonably certain, at critical points in the acquisition life  cycle, that their products are likely to meet established cost, schedule,  and performance objectives. This knowledge provides them with  information needed to make sound investment decisions. Over the past  several years, our work has emphasized the importance of obtaining key  knowledge at critical points in major system acquisitions and, based on  this work, we have identified eight key practice areas for program  management. These key practice areas are summarized in table 1, along  with our assessment of DHS’s acquisition policy.
As indicated in table 1, DHS acquisition policy establishes several key  program-management practices through document requirements. MD 102  requires that major acquisition programs provide the ARB documents  demonstrating the critical knowledge needed to support effective decision  making before progressing through the acquisition life cycle. Figure 1  identifies acquisition documents that must be approved at the department  level and their corresponding key practice areas.
DHS acquisition policy has required these documents since November  2008, but in September 2012, we reported that the department generally  had not implemented this policy as intended, and had not adhered to key  program management practices. For example, we reported that DHS had  only approved 4 of 66 major programs’ required documents in  accordance with the policy. See figure 2.
In September 2012, we reported that DHS leadership had, since 2008,  formally reviewed 49 of the 71 major programs for which officials had  responded to our survey. Of those 49 programs, DHS permitted 43  programs to proceed with acquisition activities without verifying the  programs had developed the knowledge required under MD 102.  Additionally, we reported that most of DHS’s major acquisition programs  lacked approved acquisition program baselines, as required. These  baselines are critical tools for managing acquisition programs, as they are  the agreement between program-, component-, and department-level  officials, establishing how systems will perform, when they will be   Officials from half of the eight  delivered, and what they will cost.components’ acquisition offices we spoke with, as well as PARM officials,  noted that DHS’s culture had emphasized the need to rapidly execute  missions more than sound acquisition management practices. PARM  officials explained that, in certain instances, programs were not capable  of documenting knowledge, while in others, PARM lacked the capacity to  validate that the documented knowledge was adequate.
As a result, we reported that senior leaders lacked the critical knowledge  needed to accurately track program performance, and that most of the  department’s major programs were at risk of cost growth and schedule  slips. We also reported that DHS’s lack of reliable performance data not  only hindered its internal acquisition management efforts, but also limited  congressional oversight. We made five recommendations to the  Secretary of Homeland Security at that time, identifying specific actions  DHS should take to mitigate the risk of poor acquisition outcomes and  strengthen the department’s investment management activities. DHS  concurred with all five recommendations, and is taking steps to address  them, most notably through policy updates.
Since that time, we have continued to assess DHS’s acquisition  management activities and the reliability of the department’s performance  data. We currently have a review underway for this subcommittee  assessing the extent to which DHS is executing effective executive  oversight and governance (including the quality of the data used) of a  major effort to modernize an information technology system, TECS.  TECS is a major border enforcement system used for preventing  terrorism, providing border security and law enforcement information  about people who are inadmissible or may pose a threat to the security of  the United States. We are (1) determining the status of the modernization  effort, including what has been deployed and implemented to date, as  well as the extent to which the modernization is meeting its cost and  schedule commitments, including the quality of schedule estimates; and  (2) assessing requirements management and risk management practices.  We plan to issue our report in early November.
According to DHS officials, its efforts to implement the department’s  acquisition policy were complicated by the large number of programs  initiated before the department was created, including 11 programs that  PARM officials told us in 2012 had been fielded and were in the  sustainment phase when MD 102 was signed.work, we found that, in May 2013, the USM waived the acquisition  documentation requirements for 42 major acquisition programs that he  identified as having been already fielded for operational use when MD  102 was issued in 2008. In a memo implementing the waiver, the USM  explained that it would be cost prohibitive and inefficient to recreate  documentation for previous acquisition phases. However, he stated that  the programs will continue to be monitored, and that they must comply  with MD 102 if any action is taken that materially impacts the scope of the  current program, such as a major modernization or new acquisition. We  plan to obtain more information on this decision and its effect on the  department’s management of its major acquisitions.
section_title: Most DHS Major Acquisition Programs Have Experienced Cost Overruns or Schedule Delays
paragraphs: In September 2012, we reported that most of DHS’s major acquisition  programs cost more than expected, took longer to deploy than planned,  or delivered less capability than promised. We reported that these  outcomes were largely the result of DHS’s lack of adherence to key  knowledge-based program management practices. As part of our ongoing  work, we analyzed a recent PARM assessment that suggests many of the  department’s major acquisition programs are continuing to struggle. In its  July 2013 quarterly program assessment, PARM reported that it had  assessed 112 major acquisition programs. PARM reported that 37  percent of the programs experienced no cost variance at the end of fiscal  year 2012, but it also reported that a large percentage of the programs  were experiencing cost or schedule variances at that time. See table 2.
However, as we reported in September 2012, DHS acquisition programs  generally did not have the reliable cost estimates and realistic schedules  needed to accurately assess program performance. We will continue to  track DHS’s efforts to improve the quality of its program assessments  moving forward.
section_title: DHS Is in Early Stages of Developing a Portfolio Management Approach to Mitigate Gap Between Resources and Needs
paragraphs: We have previously reported that cost growth and schedule slips at the  individual program level complicated DHS’s efforts to manage its  investment portfolio as a whole. When programs encountered setbacks,  the department often redirected funding to troubled programs at the  expense of others, which in turn were more likely to struggle. DHS’s Chief  Financial Officer recently issued a memo stating that DHS faced a 30  percent gap between funding requirements for major acquisition  programs and available resources. DHS has efforts underway to develop  a more disciplined and strategic portfolio management approach, but the  department has not yet developed key portfolio management policies and  processes that could help the department address its affordability issues,  and DHS’s primary portfolio management initiative may not be fully  implemented for several years.
subsections: section_title: The DHS Major Acquisition Portfolio Is Unaffordable
paragraphs: In September 2012, we noted that DHS’s acquisition portfolio may not be  affordable. That is, the department may have to pay more than expected  for less capability than promised, and this could ultimately hinder DHS’s  day-to-day operations.DHS’s Chief Financial Officer issued an internal memo in December  2012, shortly after our report was issued, stating that the aggregate 5- year funding requirements for major acquisitions would likely exceed  available resources by approximately 30 percent. This acknowledgment  was a positive step toward addressing the department’s challenges, in  that it clearly identified the need to improve the affordability of the  department’s major acquisition portfolio. Additionally, the Chief Financial  Officer has required component senior financial officers to certify that they  have reviewed and validated all current-, prior-, and future-year funding  information presented in ARB materials, and ensure it is consistent with  the FYHSP. Additionally, through our ongoing work, PA&E officials told us  that the magnitude of the actual funding gap may be even greater than  suggested because only a small portion of the cost estimates that  informed the Chief Financial Officer’s analysis had been approved at the  department level, and expected costs may increase as DHS improves the  quality of the estimates. This is a concern we share. While holding  components accountable is important, without validated and department- approved documents—such as acquisition program baselines and life  cycle cost estimates—efforts to fully understand and address the  department’s overall funding gap will be hindered.
section_title: DHS Policy and Process Initiatives Are Intended to Improve Portfolio Management Efforts and Help Address Affordability Issues
paragraphs: In September 2012, we reported that DHS largely made investment  decisions on a program-by-program and component-by-component basis.  DHS did not have a process to systematically prioritize its major  investments to ensure that the department’s acquisition portfolio was  consistent with anticipated resource constraints. In our work at DOD, we  have found this approach hinders efforts to achieve a balanced mix of  programs that are affordable and feasible and that provide the greatest  return on investment.
In our past work focused on improving weapon system acquisitions, we  found that successful commercial companies use a disciplined and  integrated approach to prioritize needs and allocate resources. As a result, they can avoid pursuing more projects than their resources can  support, and better optimize the return on their investment. This  approach, known as portfolio management, requires companies to view  each of their investments as contributing to a collective whole, rather than  as independent and unrelated.
With an enterprise perspective, companies can effectively (1) identify and  prioritize opportunities, and (2) allocate available resources to support the  highest priority—or most promising—investment opportunities. Over the  past several years, we have examined the practices that private and  public sector entities use to achieve a balanced mix of new projects, and  based on this work, we have identified key practice areas for portfolio  management. One I would like to highlight today is that investments  should be ranked and selected using a disciplined process to assess the  costs, benefits, and risks of alternative products to ensure transparency  and comparability across alternatives.
In this regard, DHS established the Joint Requirements Council (JRC) in  2003, to identify crosscutting opportunities and common requirements  among DHS components and help determine how DHS should use its  resources. But the JRC stopped meeting in 2006 after the chair was  assigned to other duties within the department. In 2008, we  recommended that it be reinstated, or that DHS establish another joint  requirements oversight board, and DHS officials recognized that  strengthening the JRC was a top priority. Through our ongoing work, we  have identified that DHS recently piloted a Capabilities and Requirements  Council (CRC) to serve in a similar role as the JRC. The CRC began  reviewing a portfolio of cyber capabilities in the summer of 2013. The pilot  is intended to inform the department’s fiscal year 2015 budget request;  therefore, it is too soon to assess the outcomes of this new oversight  body. It is also unknown at this time how DHS will sustain the CRC over  time or what its outcomes will be.
In addition to private and public sector practices, which we discuss above,  our prior work at DOD has identified an oversight body similar to the  CRC’s expected function. The Joint Requirements Oversight Council  (JROC) has a number of statutory responsibilities related to the  identification, validation, and prioritization of joint military requirements.
This body, which has been required by law since 1997, and its supporting  organizations review requirements documents several times per year,  prior to major defense acquisition programs’ key milestones. Through  these reviews, proposed acquisition programs are scrutinized prior to  their initiation and before decisions are made to begin production. The  JROC also takes measures to help ensure the programs are affordable.  In 2011, we reported that the JROC required the military services to show  that their proposed programs were fully funded before it validated  requirements for five of the seven proposed programs we reviewed. The  two other proposed programs were funded at more than 97 and 99  percent, respectively. This full funding requirement is similar to the  funding certification requirement DHS’s CFO established in December  2012. While some DOD acquisition programs continue to experience cost  growth and schedule delays, as identified in our annual report on weapon  systems acquisitions, the department does have in place mechanisms  that DHS could adopt to improve the affordability of its acquisition  portfolio, and put its acquisition programs in a better position to achieve  successful outcomes.
In September 2012, we reported that the CRC is one of several new  councils and offices that DHS would establish as part of its Integrated  Investment Life Cycle Model (IILCM), which is intended to improve  portfolio management at DHS through the identification of priorities and  capability gaps. This model, which the department proposed in January  2011, would provide a framework for information to flow between councils  and offices responsible for strategic direction, requirements development,  resource allocation, and program governance. DHS explained that the  IILCM would ensure that mission needs drive investment decisions.
While the IILCM, as envisioned, could improve DHS management  decisions by better linking missions to acquisition outcomes, our ongoing  work indicates that its full implementation may be several years away.  From January 2011 to June 2012, the schedule for initiating IILCM  operations slipped by a year, and in May 2013, a DHS official responsible  for the IILCM told us he was unsure when the IILCM would be fully  operational. We also found that some component acquisition officials are  not aware of how the IILCM would apply to their own acquisition  portfolios. Some of the officials we interviewed told us that DHS  leadership needs to conduct more outreach and training about the IILCM  and how it is expected to work, and a DHS headquarters official told us  that the department is in the process of implementing an initial  department-wide IILCM communications strategy. We will continue to  assess the department’s progress in implementing what it views as a very  important management model.
Chairman Duncan, Ranking Member Barber, and Members of the  Subcommittee, this completes my prepared statement. I would be  pleased to respond to any questions that you may have at this time.
section_title: GAO Contact and Staff Acknowledgments
paragraphs: If you or your staff have any questions about this testimony, please  contact Michele Mackin at (202) 512-4841 or MackinM@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this statement. GAO staff who made key  contributions to this testimony include Katherine Trimble (Assistant  Director), Nate Tranquilli, Steve Marchesani, Mara McMillen, and Sylvia  Schatz.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.