Homeland Security Acquisitions: Identifying All Non-Major Acquisitions Would Advance Ongoing Efforts to Improve Management
Published: 2017-04-13T00:00:00

Fast Facts:
The Department of Homeland Security purchases many systems—such as for nuclear detection and search and rescue—that help it execute critical missions. And, while it has improved its management of major acquisitions, its non-major acquisitions (generally those that cost less than $300 million) haven't received as much attention—though DHS did make improvements during the course of our audit.
We found that DHS planned to spend more than $6 billion on non-major acquisitions in fiscal year 2016, but could not successfully identify them all. We recommended that DHS establish time frames to identify all its non-major acquisitions.

Highlights:
section_title: Why GAO Did This Study
paragraphs: Each year, DHS acquires a wide array of systems intended to help its component agencies execute their many critical missions. GAO has previously reported that DHS's process for managing its major acquisitions is maturing. However, non-major acquisitions (generally those with cost estimates of less than $300 million) are managed by DHS's component agencies and have not received as much oversight. Recently GAO reported on a non-major acquisition that was executed poorly, limiting DHS's ability to address human capital weaknesses.
GAO was asked to examine DHS's management of non-major acquisitions. This report assesses: (1) the extent to which component leadership is effectively overseeing non-major acquisitions; and (2) the extent to which DHS headquarters has helped components establish effective management controls for non-major acquisitions.
GAO reviewed policy and component guidance, and interviewed officials from DHS headquarters and 11 components responsible for managing non-major acquisitions. GAO also traced non-major acquisition data from DHS's central acquisition data system to source documents to assess data reliability.
section_title: What GAO Found
paragraphs: The Department of Homeland Security's (DHS) component agencies—such as the U.S. Coast Guard and Customs and Border Protection—lack the information needed to effectively oversee their non-major acquisitions because they cannot confidently identify all of them. They identified over $6 billion in non-major acquisitions; however, GAO found 8 of the 11 components could not identify them all. Several officials indicated that their focus had been on major acquisitions historically, and they had not turned their attention to non-major acquisitions until more recently. Many component officials said they were still in the process of identifying all of these acquisitions, but it was unclear when they would complete these efforts. DHS headquarters had not established time frames for components to do so, which may have resulted in components losing traction in their efforts. Federal internal controls standards establish that management should obtain relevant data from reliable sources in a timely manner. Another key challenge involves the use of baselines, which establish a program's critical cost, schedule, and performance parameters. Component officials identified 38 non-major acquisitions that were active at the start of fiscal year 2017 (as opposed to acquisitions that have been delivered to end users and are considered to be non-active). GAO found that most of the active non-major acquisitions (23 of 38) did not have approved baselines, and that the value of the acquisitions without baselines constituted nearly half of the total value of the active acquisitions.
At the beginning of fiscal year 2017, some components did not require approved baselines. However, in response to GAO's preliminary findings, in February 2017, DHS required component leadership to approve baselines for non-major acquisitions, which should help components oversee them more effectively.
DHS headquarters is taking steps to help components establish more effective management controls for non-major acquisitions. In 2015, DHS headquarters officials established a process to review them annually. In February 2017, in response to GAO's preliminary findings, DHS established that components shall use the annual reviews to assess the extent to which non-major acquisitions are on track to meet cost, schedule, and performance parameters from approved baselines. DHS leadership has also established ongoing reporting requirements for non-major acquisitions. All components have started entering non-major acquisition data into DHS's central acquisition information system, and headquarters officials are taking steps to improve the reliability of these data.
section_title: What GAO Recommends
paragraphs: GAO recommended that DHS headquarters establish time frames for components to identify all non-major acquisitions. DHS concurred with GAO's recommendation and directed components to identify all non-major acquisitions by October 31, 2017.

section_title: Letter
paragraphs: Each year, the Department of Homeland Security (DHS) acquires a wide  array of systems intended to help its component agencies execute their  many critical missions. These systems include those that help Customs  and Border Protection (CBP) secure the border, the Federal Emergency  Management Agency (FEMA) register disaster survivors for assistance,  and the U.S. Coast Guard (USCG) perform search and rescue missions.  We have previously concluded that DHS’s process for managing its major  acquisitions—those assets with total costs of $300 million or more—is  maturing. For example, earlier this year we found that DHS had approved  cost, schedule, and performance baselines for all major acquisitions that  we reviewed. However, many mission critical capabilities are provided by  smaller dollar value, or non-major acquisitions, which are generally  managed by individual components of DHS, including CBP, FEMA, and  USCG. We have previously reported on the management challenges  facing one non-major acquisition at DHS. Specifically, in 2016 we found  that the DHS Performance and Learning Management System—a key  element of DHS’s Human Resources Information Technology  investment—had experienced schedule slippages, management turnover,  and other challenges that limited DHS’s ability to address human capital  weaknesses.
You asked us to examine DHS’s management of non-major acquisitions.  This review addresses both the components’ management of these  acquisitions as well as the department’s oversight role. Specifically, this  report assesses (1) the extent to which component leadership is  effectively overseeing non-major acquisitions and (2) the extent to which  DHS headquarters has helped components establish effective  management controls for non-major acquisitions.
To identify the extent to which component leadership is effectively  overseeing non-major acquisitions, we reviewed department and  component policy, guidance, and key acquisition documents, such as  acquisition program baselines; and interviewed department and  component officials. In an effort to identify all non-major acquisitions at  DHS, we asked officials from DHS’s Office of Program Accountability and  Risk Management (PARM), who are responsible for overseeing the  department’s acquisitions, to identify the DHS components that manage  non-major acquisitions. The 11 DHS component offices and agencies we  reviewed are:
Customs and Border Protection,
Domestic Nuclear Detection Office (DNDO),
Federal Emergency Management Agency,
Federal Law Enforcement Training Centers,  Immigration and Customs Enforcement,
National Protection and Programs Directorate (NPPD),
Office of the Chief Information Officer (OCIO),
Transportation Security Administration,
U.S. Citizenship and Immigration Services (USCIS),
U.S. Coast Guard, and
U.S. Secret Service (USSS).
We developed and sent a data collection instrument to each component,  asking them to identify all non-major acquisitions and report basic  acquisition information such as capability description, total acquisition  cost, and full operational capability (FOC) date. In addition, we asked for  supporting documentation, such as acquisition program baselines, for all  active acquisitions as of October 1, 2016. To assess the reliability of the  data provided by components, we reviewed the data to identify outliers,  missing data and other potential errors, requested clarification from  component officials, and compared the data to source documents when  available. Based on this assessment, we determined that the population  of current non-major acquisitions and their associated acquisition costs  could not be reliably determined. However, we determined that the data  were sufficiently reliable to identify the minimum number of these  acquisitions, and the general magnitude of the minimum acquisition costs  associated with active non-major acquisitions. For those acquisitions that  components could identify, we found issues with the reliability of data  components provided as further discussed in the report. To assess the  reliability of the non-major acquisition data in DHS’s Investment  Evaluation, Submission, & Tracking (INVEST) system, which is the  department’s central acquisition information system, we traced data from  the system to source documents. We found the data in INVEST not to be  sufficiently reliable for our purposes of reporting on the universe of non- major acquisitions, as further discussed in this report.
To identify the extent to which DHS headquarters has helped components  establish effective management controls for non-major acquisitions, we  reviewed department policy and guidance; assessed current and planned  oversight mechanisms; identified circumstances that trigger increased  headquarters oversight; and interviewed officials from PARM as well as  component officials. Appendix I provides detailed information on our  scope and methodology.
We conducted this performance audit from February 2016 to April 2017 in  accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: DHS’s acquisition management policy, commonly referred to as MD-102,  as implemented by the DHS Instruction Manual, establishes two  overarching categories of acquisitions: acquisitions of capital assets— such as information technology (IT) systems or aircraft—and acquisitions  of services—such as those provided by security guards and emergency  responders. For each acquisition type, acquisitions are further  categorized as major or non-major based on expected cost. An  acquisition’s major or non-major status determines who acts as the  Acquisition Decision Authority (ADA), the individual responsible for  management and oversight of the acquisition. DHS policy established the  DHS Chief Acquisition Officer as the ADA for major acquisitions and the  Component Acquisition Executive (CAE)—the senior acquisition official  within the component—as the ADA for all non-major acquisitions. CAEs  have overarching responsibility for the acquisition cost, schedule, risk,  and system performance of the component’s acquisition portfolio and are  responsible for ensuring that appropriate acquisition planning takes place.  According to the DHS Instruction Manual, the CAEs are required to  establish component-specific non-major acquisition policies and guidance  that support the “spirit and intent” of department acquisition policies.  CAEs establish unique processes for managing their components’ non- major acquisitions. Components that do not have CAE-approved policies  for non-major acquisition management are required to follow MD-102 and  the Instruction until those policies are developed. Figure 1 illustrates the  decision authority and thresholds for major and non-major acquisitions.
DHS acquisition policy establishes an acquisition lifecycle framework that  includes a series of five acquisition decision events. These acquisition  decision events provide the ADA an opportunity to assess whether an  acquisition meets certain requirements and is ready to proceed through  the lifecycle phases. Figure 2 depicts the five acquisition decision events  and the four phases of the acquisition lifecycle.
As part of an acquisition decision event for a major acquisition, the ADA  reviews and approves key acquisition documents, such as an acquisition  program baseline. An acquisition program baseline establishes an  acquisition’s critical cost, schedule, and performance parameters.  Baselines are useful management tools that can help leadership (1)  understand of the scope of an acquisition, (2) assess how well the  acquisition is being executed, and (3) secure adequate funding. For non- major acquisitions, each CAE has flexibility in deciding how his or her  component will apply the acquisition lifecycle framework and the types of  documentation that will be required at each acquisition decision event.  The Instruction grants the components flexibility when managing non- major acquisitions.
Within DHS headquarters, PARM is the lead office responsible for  overseeing the department’s acquisition processes. PARM has a direct  management role with major acquisitions and less oversight of non-major  acquisitions. For non-major acquisitions, PARM’s role is to ensure CAEs  are overseeing their components’ acquisitions appropriately, and facilitate  component efforts to report acquisition information using DHS’s INVEST  system, among other things. The INVEST system is a central repository  for data on DHS acquisitions and investments, such as budget, schedule,  and performance information. INVEST data are used to oversee both  major and non-major acquisitions and to satisfy internal and external  reporting requirements.
section_title: Component Officials Identified Billions in Non-Major Acquisitions, but Most Could Not Confidently Identify the Full Scope
paragraphs: DHS’s component agencies lack the information needed to effectively  oversee their non-major acquisitions because they cannot confidently  identify all of them. They identified over $6 billion in non-major  acquisitions; however, we found 8 of the 11 components could not identify  all of their non-major acquisitions and we found that the data that 9  components provided for these acquisitions were unreliable. Several  officials indicated that their focus had been on major acquisitions  historically, and they had not turned their attention to non-major  acquisitions until more recently. Many component officials said they were  still in the process of identifying all of their non-major acquisitions, but it  was unclear when they would complete these efforts. DHS headquarters  had not established time frames for components to do so, which may  have resulted in components losing traction in their efforts. Federal  internal controls standards establish that management should obtain  relevant data from reliable sources in a timely manner. Another key  challenge involves the use of baselines, which establish a program’s  critical cost, schedule, and performance parameters. Component officials  identified 38 non-major acquisitions that were active at the start of fiscal  year 2017 (as opposed to acquisitions that have been delivered to end  users and are considered to be non-active). We found that most of the  active non-major acquisitions (23 of 38) did not have approved baselines,  and that the value of the acquisitions without baselines constituted nearly  half of the total value of the active acquisitions. At the beginning of fiscal  year 2017, some components did not require approved baselines.  However, in response to our preliminary findings, in February 2017, DHS  required component leadership approve baselines for non-major  acquisitions, which should help components oversee them more  effectively.
subsections: section_title: Components Reported That They Plan to Spend More Than $6 Billion on Their Non-Major Acquisitions
paragraphs: Component officials identified 38 non-major acquisitions, valued at  greater than $6 billion, that were active as of the start of fiscal year 2017.  We define acquisitions to be active when they have entered the obtain  phase of the acquisition lifecycle and have not yet achieved FOC. Of the  reported 38 active acquisitions, 36 were capital asset acquisitions with a  total value exceeding $6 billion. The remaining two active acquisitions  were services acquisitions with combined annual expenditures of $19  million in 2016. Across DHS, components identified a total of 255 non- major acquisitions in all phases of the acquisition lifecycle.
DHS’s non-major acquisitions encompass diverse systems and  capabilities that address critical mission needs including immigration  services, law enforcement, and disaster response. For example, non- major acquisitions include USCG response boats that perform law  enforcement and search and rescue missions; CBP’s Mobile Video  Surveillance System, which identifies and detects illegal incursions into  areas that have gaps in coverage from other surveillance systems; and  DNDO’s Human Portable Tripwire, a small, wearable system that can  detect radiological threats. Figure 3 depicts these three acquisitions.
Acquisition management efforts have the greatest impact on active  acquisitions. When an acquisition is considered active, managers  develop, test, and evaluate the extent to which the acquired capability can  meet DHS mission needs, and adhere to critical cost, schedule, and  performance parameters. By comparison, acquisition management  activities have less impact on acquisitions that have reached FOC  because these acquisitions have passed key decision events in the  acquisition lifecycle. Meanwhile, we define acquisitions that are very early  in the acquisition life cycle, i.e. in the need or analyze/select phases, to  be pre-active. Pre-active acquisitions do not yet have critical cost,  schedule, and performance parameters because component officials  have not yet agreed on what they want, when they want it, or how much  they want to spend. Figure 4 depicts the number of non-major  acquisitions component officials identified by acquisition lifecycle phase.
About 74 percent of the non-major acquisitions that component  officials identified (189 of 255) had reached FOC at the start of fiscal  year 2017, and components were operating and maintaining them  until disposal. Although officials indicated these acquisitions were no  longer active and had already passed all of their major acquisition  decision events, it is still important for DHS to understand the scope of  these acquisitions because up to 70 percent of an acquisition’s total  life cycle costs can occur after FOC.
About 11 percent of the non-major acquisitions that component  officials identified (28 of 255) are in the pre-active phases of the  acquisition lifecycle. During these phases, program managers identify  a mission need that justifies investment in a new acquisition and  evaluate alternative options to meet that need.
section_title: Component Officials Could Not Identify All Non-Major Acquisitions, and Data Are Unreliable
paragraphs: DHS component officials identified 255 non-major acquisitions across  DHS, but officials from most of the components (8 of 11) also reported to  us that they were not confident that they had accounted for all of their  non-major acquisitions. However, these officials also told us they were  working to improve their ability to identify their non-major acquisitions  going forward. In the view of some officials, the problems lie primarily in  tracking the non-active acquisitions, rather than those that are still active.  Even when component officials could identify these acquisitions, we  found that the data they provided were often unreliable. The data  reliability issues often involved the type of information included in  acquisition baselines, specifically cost, schedule, and capability  information.
subsections: section_title: Most Components Could Not Identify All of Their Non-Major Acquisitions
paragraphs: We spoke with officials from 11 components to get their perspective on  whether they were able to accurately identify the full scope of their non- major acquisitions. Officials from 8 of the 11 DHS components told us  they could not identify all of their non-major acquisitions. These officials  were able to provide data on some acquisitions, but they were not  confident that they had identified all of them. Officials from 3 of the 8  components stated that they were more confident in their ability to identify  all active acquisitions but were less sure that the full scope of post-FOC  acquisitions were identified. Component officials offered two reasons for  the lack of confidence in the data:  1.  Historically, managing non-major acquisitions has been a relatively  low priority when compared to managing major acquisitions or other  component activities.  2.  The components lack effective procedures for identifying those  acquisitions.
Officials from all of the components we reviewed indicated that they are  working to improve their management of non-major acquisitions for a  variety of reasons, including to improve their ability to monitor acquisition  cost growth and other acquisition performance metrics.
Competing priorities: Officials from 6 components indicated that  managing non-major acquisitions has historically been a lower priority  than managing major acquisitions or other component activities. For  example, CBP officials reported that since 2011, CBP’s CAE staff has  focused on bringing major acquisitions into compliance with DHS  acquisition policy. It took CBP until 2016 to baseline all of its Level 1  acquisitions. In 2014, CBP officials turned their attention to non-major  acquisitions. They began to identify their non-major acquisitions, and  worked to understand their purpose, status, and the CBP offices they  support. According to CBP officials, these efforts are ongoing.
Similarly, following the issuance of MD-102 in 2008, FEMA focused  on managing major acquisitions before placing an emphasis on non- major acquisition management in 2015. According to component  officials, FEMA is now developing a more robust management  process for non-major acquisitions. They said that the first step toward  increasing the management rigor for these acquisitions is to  accurately identify them.
Ineffective procedures: Officials from 2 components stated that they  lack effective procedures for identifying non-major acquisitions. USCG  and USCIS officials acknowledged that their procedures for identifying  these acquisitions need improvement. Specifically, a USCG official  told us that USCG procedures do not always successfully distinguish  IT acquisitions from non-acquisition activities. According to the official,  many non-major IT acquisition activities may be occurring, but the  USCG acquisition support staff may not be aware of them. USCG  officials said that the component has approximately 400-500 IT  investments to assess to determine whether they should be identified  as acquisitions. As a result, USCG may be underreporting the dollar  value of non-major acquisitions. According to USCG officials, the  process of identifying all such acquisitions is underway.
Additionally, a senior USCIS official stated that his component’s  method for identifying its smaller non-major acquisitions needs  improvement. USCIS combines its smallest acquisitions—those  valued at less than $50 million—into a single acquisition, aligns each  combined acquisition to specific offices within USCIS, such as the  Office of Information Technology, and tracks each combined  acquisition as a single acquisition. Using this approach, USCIS may  be underreporting the number of non-major acquisitions, as multiple  acquisitions may be counted as one, and the CAE may be missing  opportunities to influence the acquisitions at key decision events. To  improve tracking of these acquisitions, the official told us that USCIS  is evaluating each individual acquisition to determine if it is active, and  if it should be managed as a stand-alone acquisition. In addition,  according to USCIS officials, USCIS has recently revised its non- major acquisition policy, which will change the acquisition tracking  requirement. This revision is expected to be finalized in 2017.
DHS component officials told us that they were working to improve their  ability to identify non-major acquisitions. For example, officials from 4  components stated that they were using new guidance provided in a 2016  update to the DHS Instruction Manual to more consistently categorize all  acquisitions as (1) capital acquisitions, (2) service acquisitions, or (3)  simple procurements. The guidance includes a series of yes-or-no  questions that acquisition officials answer to categorize a particular  acquisition. Component officials said these categorizations are helping  them identify all of the non-major acquisitions in their respective  portfolios. For example, FEMA officials said they have used the new  guidance to determine whether acquisitions considered procurements  should actually be managed as non-major acquisitions. Officials from the  other components reported efforts such as updating component policies  and performing ongoing reviews to identify which activities are  acquisitions. However, it was unclear when these various efforts to  identify the full scope of all non-major acquisitions would be complete  because no timelines had been established by DHS headquarters, which  may have resulted in components losing traction in their efforts. Federal  internal controls standards establish that management should obtain  relevant data from reliable sources in a timely manner. Until components  have identified all of their non-major acquisitions, they cannot effectively  manage their acquisition portfolios or apply the level and type of oversight  that complies with department policy. Having an established time frame  should help ensure that the actions underway are seen to completion.
section_title: Most Components Provided Data with Reliability Issues
paragraphs: In addition to the components’ inability to identify all non-major  acquisitions, our analysis and information received from component  officials identified a number of data reliability issues. Specifically, our  analysis found that the data provided by 8 of the 11 components were not  complete. For example, several life cycle cost estimates did not include  government personnel costs. In addition, most of the components that  reported active acquisitions could not provide approved baselines  supporting the data they provided, in part because some components did  not require approved baselines. Officials from 6 components also  acknowledged they have issues with data reliability, specifically with  accuracy and completeness, which could hinder their CAEs’ ability to  manage non-major acquisitions in accordance with DHS acquisition  policy.
Our analysis of all non-major acquisition data provided by the DHS  components found that the data were complete for over 60 percent of the  acquisitions reported and that data for active acquisitions had fewer  issues with incomplete data than acquisitions that were post-FOC. In  responding to our requests for information, 5 components did not provide  a complete FOC date or cost information for at least one of their active  non-major acquisitions. Although the components have different  requirements for documenting such information, key acquisition  management best practices recommend that all acquisitions have well  defined requirements and establish realistic cost and schedule  estimates. Table 1 describes the data reliability issues that we identified  in the component-reported non-major acquisition data.
Cost, schedule, and capability information are basic acquisition data that  would be included in an acquisition baseline, and we have previously  found that these types of information help senior leadership manage  acquisitions more effectively. However, most of the components that  reported active acquisitions could not provide approved baselines for all  of their non-major acquisitions since not all of them were required to  provide approved baselines.
In addition to the completeness issues we identified, officials from 6  components acknowledged that they have issues with data reliability,  specifically with accuracy and completeness.
Accuracy: Officials from 5 components reported issues with the  accuracy of the non-major acquisition data they provided. Data  accuracy refers to the extent that recorded data reflect the actual  underlying information. For example, DNDO officials stated they did  not have full confidence in 20 percent of the acquisition data they  reported because most DNDO non-major acquisitions were not  required to have program baselines. Instead, DNDO is using rough  order of magnitude cost estimates for these acquisitions, which they  acknowledged are inherently inaccurate.
Completeness: Officials from 3 of the 6 components also told us that  their non-major acquisitions data were incomplete. Data  completeness refers to the extent that relevant records are present— an issue addressed in the scope discussion above—and that the  fields in each record are populated appropriately. For example, FEMA  officials said that they had limited cost value data for non-major  acquisitions because many of these acquisitions have not had formal  life cycle cost estimates, and that improvements to their non-major  acquisitions data are required in order to provide such estimates.
Table 2 lists the components we reviewed, whether we identified data  reliability issues—specifically incomplete data—in the non-major  acquisition data reported by the components, and whether component  officials self-identified data reliability issues in that data. For 9  components, we identified data reliability issues through our analysis,  component officials identified data reliability issues themselves, or both.
section_title: As Authorized, Components Use a Variety of Processes to Manage Non-Major Acquisitions, but Few Consistently Track against Baselines
paragraphs: In accordance with the CAE responsibilities outlined in the DHS  Instruction Manual, CAEs have developed a variety of processes to  maintain and report data on non-major acquisitions. For example, USCG  officials reported using the INVEST system and three of their own  systems to track and report data on non-major acquisitions. They told us  their non-major acquisition data and corresponding documentation is  regularly compiled and CAE staff review it every month. Meanwhile, CBP  officials reported using a less centralized approach. CBP officials track  non-major acquisition data in two department-level systems and multiple  component-level systems, including several Microsoft Excel spreadsheets  and Microsoft Access databases. CBP officials reported that their  component lacks a systematic data review process, and that they had to  manually aggregate their data to respond to our queries.
Additionally, components’ policies for managing non-major acquisitions  vary. For example, at the start of fiscal year 2017, 7 components had  policies in place requiring component leadership to approve program  baselines for active non-major acquisitions. However, the 4 other  components did not. Our prior work and DHS acquisition policy  emphasize the importance of the critical cost, schedule, and performance  parameters that a baseline provides. As our work showed in 2012, the  baseline is a critical tool for managing an acquisition. First, it is an  agreement between program-, component-, and department-level officials  establishing what the capabilities being acquired should cost, when they  should be delivered, and how they should perform. DHS acquisition policy  for major acquisitions requires that the ADA approve a program’s  baseline before it initiates design and development activities, and this  baseline then serves as a performance management tool to monitor and  measure an acquisition’s execution. Second, baselines can help  acquisition leaders secure funding needed for programs to meet critical  cost, schedule, and performance parameters. If a program is not fully  funded, a baseline can help leaders identify the trade-offs needed to fund  the program with existing resources. Our prior work has demonstrated  that resources, including time and funding, should be consistent with  performance requirements. For major programs, the ADA confirms the  program is fully resourced through the next 5 years when the ADA  approves the program’s baseline.
At the start of fiscal year 2017, the majority of DHS’s active non-major  acquisitions did not have component-approved baselines, though 3  components—NPPD, USCG, and USSS—did have baselines for all of the  active non-major acquisitions they identified. Across the 11 components,  over half of the reported active non-major acquisitions (23 of 38) did not  have approved baselines, including both of the active services  acquisitions. The baselines provided by the components for the remaining  15 acquisitions varied in length and detail, but each included the cost,  schedule, and performance parameters needed to monitor a program  over time. Some components provided other types of acquisition  documentation, such as an Operational Requirements Document or Test  and Evaluation Master Plan. However, in each case, we determined that  the documents submitted did not effectively define the acquisitions by  linking their cost, schedule, and performance parameters. As such, we  did not consider these documents to represent a baseline. Figure 5  shows the number of active non-major acquisitions and the number of  component-approved baselines at each component.
We found that the 21 capital acquisitions without CAE-approved  baselines constituted a 47 percent share ($3.0 billion) of the  approximately $6.4 billion components reported as the total value of their  non-major capital acquisitions. Figure 6 shows the value of non-major  acquisitions with CAE-approved baselines and the value of those without  CAE-approved baselines.
Component officials offered a variety of reasons why their CAEs had not  approved baselines for non-major acquisitions. For example, they said  that (1) the baselines for these acquisitions have been a relatively low  priority and were therefore still pending development or approval; (2) their  components chose not to require program baselines for non-major  acquisitions; or (3) while the component requires baselines for future non- major acquisitions, the acquisitions were initiated prior to the  establishment of that requirement.
However, this situation is likely to change, given that, in February 2017,  DHS issued a new policy specifically focused on managing non-major  acquisitions. In response to our preliminary findings, during the course of  our audit, the Under Secretary for Management included in this policy a  requirement that component leadership approve baselines for these  acquisitions. This new requirement should help components execute  their acquisitions more effectively. Specifically, as identified above, CAEs  are likely to: (1) accurately understand the size of their portfolio; (2) have  adequate knowledge about execution against cost, schedule and  performance parameters when making acquisition decisions; and (3)  secure the funding the acquisition needs to meet those parameters.  Establishing a program baseline need not be a significant program  burden. Baselines should reflect basic, existing acquisition information in  a format that is effective for component management.
section_title: DHS Headquarters Has Recently Increased Focus on Non-Major Acquisitions, and New Policy May Help Ensure More Effective Management
paragraphs: DHS headquarters officials have increased their focus on non-major  acquisitions, and a new policy may help DHS’s component agencies  establish effective management controls, particularly by helping ensure  the new baseline policy is implemented. In 2015, DHS headquarters  officials established an annual review process for non-major acquisitions  with life cycle cost estimates greater than $50 million, and they now plan  to use this process to ensure that components are assessing acquisition  performance against approved cost, schedule and performance  baselines. DHS leadership has also added new reporting requirements  for these acquisitions, and, in response, all components have started  entering non-major acquisition data into INVEST, DHS’s central  acquisition information system. The data component officials entered into  INVEST during 2016 were unreliable, but headquarters officials are taking  steps to improve the reliability of this data. Further, DHS headquarters  officials have defined roles and responsibilities for managing non-major  acquisitions, hired an oversight official specifically responsible for these  acquisitions, and elevated selected non-major acquisitions for  department-level oversight.
subsections: section_title: PARM Plans to Use Annual Reviews to Ensure Components Are Managing Non-Major Acquisitions Appropriately
paragraphs: MD-102 establishes that the Executive Director of PARM should ensure  CAEs are overseeing their components’ non-major acquisitions  appropriately. Specifically, the policy states that the Executive Director  shall review CAE governance activities and monitor the performance of  non-major acquisitions. To this end, PARM has implemented a series of  annual reviews of components’ non-major acquisitions with a life cycle  cost greater than $50 million that have not yet achieved FOC. According  to our analysis, the $50 million threshold provides PARM insight into the  bulk of the resources components plan to allot to these acquisitions.  Components valued 21 of their 38 reported active non-major acquisitions  at more than $50 million, and these acquisitions account for  approximately 95 percent—$6.1 billion—of the roughly $6.4 billion  components reported as the total value of their active non-major  acquisitions.
PARM initiated these reviews in 2015, and, during the first round, officials  said they reviewed the components’ non-major acquisition policies in an  effort to determine whether these policies aligned with departmental  guidance. PARM officials also said the components provided updates on  the acquisitions’ costs, key milestones, and capabilities.
For the second series of annual reviews in 2016, the DHS Under  Secretary for Management issued a memorandum intended to increase  the rigor of PARM’s non-major acquisition reviews. The memorandum  stated that the components must provide PARM “evidence of sufficient  acquisition documentation as tailored by the CAE” and report cost,  schedule, and performance metrics with associated milestones. However,  the memorandum did not identify (1) any minimum requirements for  sufficient acquisition documentation; or (2) the specific cost, schedule,  and performance metrics the components should report to PARM. To  clarify the requirements, later in 2016, PARM developed more detailed  instructions for the 2016 annual review. PARM instructed the components  to identify whether they had an overarching policy or set of policies that  were specific to non-major acquisitions, and whether these policies  aligned with departmental guidance. PARM instructed the components to  report the annual costs associated with each acquisition, provide a high- level schedule, include a description of the capability or service being  acquired, and discuss issues such as the CAE’s confidence in the  program’s meeting the metrics in the program baseline, if a baseline was  indeed in place.
Additionally, in response to our preliminary findings, a new policy that  DHS finalized in February 2017 includes a requirement that component  leadership approve baselines for non-major acquisitions that have not yet  achieved FOC, and states that PARM’s Executive Director will leverage  its reviews to assess whether CAEs are (a) baselining these acquisitions  in accordance with the requirement; and (b) tracking the acquisitions’  progress against cost, schedule, and performance parameters from  approved baselines. These reviews would help PARM’s Executive  Director determine whether CAEs are overseeing their non-major  acquisitions in accordance with MD-102. Federal internal control  standards state that management should monitor program results and  evaluate these results against a previously established baseline.
section_title: Components Have Started Entering Non-Major Acquisition Data into INVEST and Headquarters Is Taking Steps to Improve Data Reliability
paragraphs: As part of its efforts to increase oversight of non-major acquisitions, DHS  leadership now requires components to enter data into the INVEST  system for all non-major acquisitions valued at greater than $50 million  that have not yet reached FOC. INVEST, DHS’s central system for  acquisition information, is used by program-, component-, and  department-level officials to enter and obtain information for monthly  reporting and monitoring. In the past, components were required to enter  non-major acquisition data into INVEST only for IT acquisitions valued at  greater than $50 million as part of the DHS IT Capital Planning and  Investment Control process. In March 2016, DHS’s Under Secretary for  Management issued a memo requiring components to enter data into  INVEST for both IT and non-IT non-major acquisitions valued at greater  than $50 million.
However, we found that the data component officials had entered into  INVEST for non-major acquisitions through 2016 were unreliable. Only  about half of the acquisitions eligible for entry into INVEST had been  entered into the system. As of January 2017, component officials had  entered data into INVEST for 10 of the 21 programs that were eligible for  entry into the system—i.e., active non-major acquisitions valued at  greater than $50 million. For the majority of the non-major acquisitions in  INVEST, we found few source documents—particularly baselines—that  CAEs could use to validate the data. A December 2016 requirement  states that CAEs must validate the accuracy of these data in INVEST  twice a year, mirroring the current certification requirement for major  acquisitions. This recent requirement, combined with the February 2017  baselining requirement, will likely improve the reliability of the data.
Additionally, component officials have reported challenges when trying to  enter non-major acquisition data into INVEST. PARM did not initially  provide specific guidance on entering the data, and officials from some  components said they were confused about the amount and type of  information that should be entered into INVEST. In response to this  confusion, PARM officials created a new guidebook in October 2016 and  issued additional instructions in a December 2016 memo intended to  clarify the INVEST data-entry process.
section_title: DHS Headquarters Has Taken Additional Actions to Help Improve Components’ Management of Non-Major Acquisitions
paragraphs: In addition to PARM’s implementation of annual non-major acquisition  reviews and the requirement to enter non-major acquisition data into  INVEST, DHS headquarters has taken several additional actions to help  improve the components’ management of these acquisitions. These  actions include the following:
Defining roles and responsibilities for managing non-major  acquisitions. In February 2017, the DHS Under Secretary for  Management more clearly defined CAEs’ roles and responsibilities for  managing non-major acquisitions. PARM also issued new non-major  acquisition management guidance specific to the DHS Management  Directorate in February 2017. The new policy consolidates the  Management Directorate’s CAE authority by designating the Deputy  Director of PARM the CAE for all of the Management Directorate’s  non-major acquisitions. Previously, offices within the Management  Directorate, such as the OCIO and the Office of the Chief Readiness  Support Officer, had their own CAEs. One such office in the scope of  our review—OCIO—did not use the acquisition lifecycle process for its  acquisition management. This new policy could help to ensure the  various offices take a consistent approach.
Hiring an oversight official specifically responsible for non-major  acquisitions. In light of the billions of dollars the department is  spending on these acquisitions, in May 2016, PARM hired an official  to focus solely on DHS’s non-major acquisitions. This official’s  responsibilities and goals include working with the DHS components  to develop and improve their policies and processes for managing  non-major acquisitions, in part by ensuring that they align with  departmental guidance.
Formalizing the process for identifying/categorizing acquisitions.
DHS’s Master Acquisition Oversight List identifies the department’s  acquisitions and categorizes them by component, major or non-major  status, and acquisition type, in order to help DHS’s acquisition  managers apply the appropriate oversight requirements. In 2015,  PARM established a DHS Master Acquisition Oversight List  Governance Board. This body reviews and approves major and non- major acquisition additions, removals, and other updates to the  department’s Master Acquisition Oversight List. The board members  consist of representatives from the department’s lines of business,  including the Office of the Chief Financial Officer, OCIO, and the  Office of the Chief Procurement Officer.
Elevating non-major acquisitions for department-level oversight.
Finally, in some circumstances, the DHS Under Secretary for  Management has elevated selected non-major acquisitions to major  acquisition status, and, as a result, these acquisitions have received  greater department oversight. For example, in April 2016, the Under  Secretary for Management elevated CBP’s Remote Video  Surveillance System to major acquisition status in response to an  expansion in the acquisition’s scope that increased its value above  the non-major acquisition dollar threshold. Similarly, at FEMA’s  request, the Under Secretary for Management elevated FEMA’s  Integrated Public Alert and Warning System acquisition to major  status because of its complexity, cross-component impact, and high  visibility outside of the department. DHS officials stated that the Under  Secretary for Management may elevate non-major acquisitions for  other reasons, including external events such as congressional and  media interest, if a program’s importance to DHS’s strategic and  performance plans is disproportionate to its size, and if an acquisition  has significant program or policy implications.
These actions reflect DHS leadership’s increased focus on non-major  acquisitions as the department continues to work to mature its acquisition  management processes across all of its component agencies.
section_title: Conclusions
paragraphs: Over the past 8 years, DHS leadership has taken several steps to mature  its acquisition management processes. More recently, DHS leadership  has increasingly focused on its non-major acquisitions, which is fitting,  given the billions of dollars going to these programs. Primary  responsibility for managing these acquisitions rests, appropriately, with  component officials. However, the fact that officials from few components  could confidently identify the full scope of their non-major acquisitions is  problematic. Understandably, the focus to date has been on active  acquisitions, but it is also important that components understand the  extent of their non-major acquisitions that have been fielded but are still  receiving taxpayer funds to operate. Without an established time frame  for components to identify the full picture of their non-major acquisitions— particularly given their acknowledged resource constraints and competing  priorities—progress may not have been sustained.
section_title: Recommendation for Executive Action
paragraphs: To improve the management of DHS’s non-major acquisitions, we  recommended that the Secretary of Homeland Security direct the Under  Secretary for Management to establish a time frame for components to  identify all of their non-major acquisitions.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this product to DHS for comment. In its written  comments, reproduced in appendix II, DHS concurred with our  recommendation and indicated that the Under Secretary for Management  has directed Component Acquisition Executives to identify all Level 3  acquisitions across DHS by no later than October 31, 2017.  We reviewed  the supporting documentation provided by DHS, reproduced in appendix  III, and determined that this direction addressed the recommendation.
DHS also provided technical comments that we addressed as  appropriate.
We are sending copies of this report to the appropriate congressional  committees, the Secretary of the Department of Homeland Security, and  other interested parties. In addition, the report is available at no charge on  the GAO website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-4841 or mackinm@gao.gov. Contact points for our Office  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made key contributions to this report  are listed in appendix IV.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: The objectives of this audit were designed to examine the Department of  Homeland Security’s (DHS) management of non-major acquisitions. This  review addresses both the components’ management of non-major  acquisitions as well as the department’s oversight role. Specifically, this  report assesses (1) the extent to which component leadership is  effectively overseeing non-major acquisitions and (2) the extent to which  DHS headquarters has helped components establish effective  management controls for non-major acquisitions.
To identify the extent to which component leadership is effectively  overseeing non-major acquisitions, we attempted to identify all non-major  acquisitions within DHS. We asked officials from DHS’s Office of Program  Accountability and Risk Management (PARM), which are responsible for  overseeing the department’s acquisitions, to identify the components that  manage non-major acquisitions. PARM identified 14 DHS components in  response. We requested data from the 14 DHS components and obtained  non-major acquisition data from 11 components. Officials from the 3  remaining components stated that they did not manage non-major  acquisitions. For example, officials from the DHS Science and  Technology Directorate stated that their component does not identify any  acquisition valued at less than $50 million as a non-major acquisition and,  based on that definition, the component does not have any non-major  acquisitions to report. For this reason, we removed the Science and  Technology Directorate from our scope. The 11 DHS component offices  and agencies we reviewed are:
Customs and Border Protection,
Domestic Nuclear Detection Office,
Federal Emergency Management Agency,
Federal Law Enforcement Training Centers,  Immigration and Customs Enforcement,
National Protection and Programs Directorate,
Office of the Chief Information Officer,
Transportation Security Administration,
U.S. Citizenship and Immigration Services,
U.S. Coast Guard, and
U.S. Secret Service.
We developed a data collection instrument, sent it to each component,  and requested the acquisition name, capability description, total  acquisition cost, acquisition type, most recent acquisition decision events,  full operational capability (FOC) date, and acquisition lifecycle phase for  all of the component’s non-major acquisitions. We used a data collection  instrument to obtain non-major acquisitions data based on preliminary  discussions with DHS and component officials that indicated we should  work directly with the components to collect this information.
To assess the reliability of the data provided by components, we reviewed  the data to identify outliers, missing data and other potential errors, and  compared the data to source documents when available. In interviews  and via e-mail correspondence; we provided component officials an  opportunity to review, discuss, and, where applicable, correct any  completeness and accuracy issues. In addition, we requested that each  component update its non-major acquisition data to be accurate as of  October 1, 2016. We also requested and reviewed information on how the  components enter, store, access, update, and review non-major  acquisition data, as well as component officials’ comments on the  reliability of the data they provided. Based on this assessment, we  determined that the population of current non-major acquisitions and their  associated acquisition costs could not be reliably determined. However,  we determined that the data were sufficiently reliable to identify the  minimum number of non-major acquisitions, and the general magnitude of  the minimum acquisition costs associated with active non-major  acquisitions. For those acquisitions that components could identify, we  found that the data components provided for these non-major acquisitions  were generally unreliable as further discussed in the report.
In addition to the non-major acquisitions at the components that PARM  identified, with the assistance of component officials we also identified  one non-major acquisition at the DHS Office of the Chief Readiness  Support Officer and one non-major acquisition at the DHS Office of the  Chief Security Officer. We included these acquisitions in our scope when  working to identify the universe of non-major acquisitions at DHS. As a  final quality assurance step, we returned the collected and updated data  collection instruments to the respective components, and requested  officials verify and, when applicable, correct the data.
To designate each acquisition active, pre-active, or post-FOC, we  reviewed the FOC and acquisition phase data that the component officials  provided. We designated an acquisition active if it had reached  Acquisition Decision Event 2A but had not reached FOC by October 1,  2016. If any increment, project, or segment of an acquisition was active,  we designated the entire acquisition active. We designated acquisitions  with an FOC date on or before October 1, 2016 post-FOC, and those that  had not yet reached Acquisition Decision Event 2A by October 1, 2016  pre-active. For acquisitions with conflicting data, we confirmed our  designation with component officials. In addition, we collected acquisition  cost information for each acquisition, specifically, life cycle cost estimates  for capital asset acquisitions and annual expenditure data for services  acquisitions. For active acquisitions that did not have final cost estimates  in place, we accepted and reported the preliminary information that was  available, such as rough order of magnitude estimates or life cycle cost  estimates with lower confidence levels.
To understand the processes components use to manage non-major  acquisitions and assess the extent to which components were  consistently baselining these acquisitions, we reviewed draft and final  DHS acquisition policy, and component-level non-major acquisition  policies and guidance. We also requested and reviewed acquisition  decision memos and component-approved acquisition program  baselines—or any equivalent documents containing cost, schedule, and  performance parameters—for all acquisitions that were active as of  October 1, 2016. We then reviewed each baseline document to determine  whether it actually contained cost, schedule, and performance  parameters in accordance with key acquisition management practices we  established in previous reports. We also interviewed department and  component officials to expand our understanding of component  management processes, and determine why the components were or  were not approving baselines for non-major acquisitions.
To identify the extent to which DHS headquarters has helped components  establish effective management controls for non-major acquisitions, we  reviewed draft and final department acquisition policy, guidance, and  memos to identify how PARM and other headquarters entities contribute  to non-major acquisition management. We also reviewed this  documentation to identify existing and planned oversight mechanisms for  non-major acquisitions. We requested information from officials at nine  DHS headquarters entities and the 11 DHS components in our scope to  identify how, if at all, DHS headquarters entities other than PARM monitor  or interact with non-major acquisitions during the acquisition process. We  interviewed officials from PARM to discuss PARM’s annual review  process, DHS’s Master Acquisition Oversight List, and other efforts to  address non-major acquisitions. Finally, we interviewed officials from  PARM and the components to better understand ongoing efforts to enter  non-major acquisition data into DHS’s Investment Evaluation,  Submission, & Tracking (INVEST) system, which is the department’s  central system for information on its acquisitions. We also interviewed  officials to better understand the circumstances under which DHS  headquarters elevates non-major acquisitions to major acquisition status,  increasing headquarters oversight.
To assess the reliability of the data in the INVEST system, we traced non- major acquisition data from INVEST to available source documents. We  collected INVEST reports for active non-major acquisitions and compared  cost information in those reports to available source documents, such as  acquisition program baselines and life cycle cost estimates. To assess  relevant internal controls, we reviewed the DHS INVEST User Guide and  Training Manual and identified the purpose and structure of the INVEST  system. We subsequently evaluated INVEST reports and identified the  forms each component used to enter data into INVEST, as well as the  level of completeness of the forms and any system-generated errors.  Finally, we interviewed component and PARM officials to understand  what, if any, internal controls headquarters and components were using  for the non-major acquisition data before, during, and after entering that  data into INVEST. We found the data in INVEST not to be sufficiently  reliable for our purposes of reporting on the universe of non-major  acquisitions.
We conducted this performance audit from February 2016 to April 2017 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact listed above, Nathan Tranquilli (Assistant  Director), Katherine Trimble (Assistant Director), Betsy Gregory-Hosler  (Analyst-in-Charge), Andrew Fisher, Javier Irizarry, Kirsten Leikem, and  John Rastler made significant contributions to this report. Peter Anderson,  Christopher Businsky, Lorraine Ettaro, and Sylvia Schatz also made key  contributions to this report.