Secure Border Initiative: SBInet Planning and Management Improvements Needed to Control Risks
Published: 2007-02-27T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: This testimony summarizes GAO's February 2007 report on SBInet, one element of the Department of Homeland Security's (DHS) Secure Border Initiative (SBI). SBInet is responsible for developing a comprehensive border protection system. By legislative mandate, GAO reviewed SBInet's fiscal year 2007 expenditure plan. This testimony focuses on (1) the extent that the plan provided explicit and measurable commitments relative to schedule and costs, (2) how DHS is following federal acquisition regulations and management best practices, and (3) concurrency in SBInet's schedule. GAO assessed the plan against federal guidelines and industry standards and interviewed program officials.
section_title: What GAO Found
paragraphs: SBInet's December 2006 expenditure plan offered a high-level and partial outline of a large and complex program that forms an integral component of the broader multiyear initiative. However, the SBInet expenditure plan, including related documentation and program officials' statements, lacked specificity on such things as planned activities and milestones, anticipated costs and staffing levels, and expected mission outcomes. This, coupled with the large cost and ambitious time frames, adds risk to the program. Without sufficient and reliable information on program goals, status and results, Congress and DHS are not in the best position to use the plan as a basis for assessing program outcomes, accounting for the use of current and future appropriations, and holding program managers accountable for achieving effective control of the border. As of December 2006, SBInet was using, at least to some extent acquisition best practices, but DHS had not fully established the range of capabilities needed to effectively mitigate risks and to successfully manage the program. To its credit, the SBInet contract was generally competed in accordance with federal requirements. However, the SBInet contract does not fully satisfy the federal regulatory requirement to specify a maximum dollar value or the number of units that may be ordered. We also reported that important management controls provided for in Office of Management and Budget (OMB) guidance and best practices were not yet in place, although the program manager stated that he was committed to doing so. Until they are in place, the program is at increased risk of failure. DHS's plan to execute SBInet activities through a series of concurrent task orders introduces additional risk. With multiple related and dependent projects being undertaken simultaneously, SBInet is exposed to possible cost and schedule overruns and performance problems. Without assessing this level of concurrency and how it affects project implementation, SBInet runs the risk of not delivering promised capabilities and benefits on time and within budget. SBI and SBInet officials told us that they understand the risks inherent in concurrency and are addressing these risks. However, as of December 2006, they had not provided evidence that identified the dependencies among their concurrent activities and that they were proactively managing the associated risk.

section_title: Letter
paragraphs: We are pleased to be here today to discuss the Secure Border Initiative’s  SBInet program’s planning and management challenges.
In November 2005, the Department of Homeland Security (DHS)  established the Secure Border Initiative (SBI), a multiyear, multibillion  dollar program aimed at securing U.S. borders and reducing illegal  immigration. One element of SBI is SBInet, the program responsible for  developing a comprehensive border protection system. DHS estimates that  the total cost for completing the acquisition phase for the southwest  border is $7.6 billion from fiscal years 2007 through 2011. Of this total,  approximately $5.1 billion is for the design, development, integration, and  deployment of fencing, roads, vehicle barriers, sensors, radar units, and  command, control, and communications and other equipment, and   $2.5 billion is for integrated logistics and operations support during the  acquisition phase for the southwest border. According to DHS, work on  the northern border is not projected to begin before fiscal year 2009.
The Department of Homeland Security Appropriations Act, 2007, required  DHS to submit to Congress an expenditure plan to establish a security  barrier along the border of the United States composed of fencing and  vehicle barriers and other forms of tactical infrastructure and technology.  This plan was to address nine legislative conditions and was submitted to  Congress on December 4, 2006. As required by the act, we reviewed the  expenditure plan, and found that the plan, including related  documentation and program officials’ statements, satisfied four legislative  conditions, partially satisfied four legislative conditions, and did not  satisfy one legislative condition. See appendix I for a summary of the  legislative conditions and to what extent they were satisfied.
The legislatively mandated expenditure plan for SBInet is a congressional  oversight mechanism aimed at ensuring that planned expenditures are  justified, performance against plans is measured, and accountability for  results is ensured. Although the program is in its early stages, a  comprehensive expenditure plan is intended to provide Congress with the  information needed to effectively oversee the program and hold DHS  accountable for program results. Effective program planning and  execution require a range of management controls. These controls, which  are carved out in federal requirements and best practices, are instrumental  in minimizing a program’s exposure to cost, schedule, and performance  risks. Without adequate management controls, there is increased risk that  SBInet will not produce the right solution, not be managed the right way,  and not be implemented within cost estimates.
Our testimony today is based on our recent report for the House and  Senate Appropriations Committees on the fiscal year 2007 SBInet  expenditure plan. It focuses on the following issues:  the extent to which the expenditure plan and related documentation  provided explicit and measurable commitments relative to schedule  and costs,     how DHS defined and is following federal acquisition requirements and  program management best practices, and    the concurrency in SBInet’s program schedule.
To accomplish our objectives, we analyzed the SBInet December 2006  expenditure plan and supporting documentation. We also interviewed  cognizant program officials and contractors. We did not review the  justification for cost estimates included in the expenditure plan. We  conducted our work at DHS’s U.S. Customs and Border Protection (CBP)  headquarters in the Washington, D.C., metropolitan area from October  2006 through December 2006, in accordance with generally accepted  government auditing standards.
subsections: section_title: Background
paragraphs: SBI is a comprehensive, multiyear, multibillion dollar program established  in November 2005 by the Secretary of Homeland Security to secure U.S.  borders and reduce illegal immigration. SBI’s mission is to promote border  security strategies that help protect against and prevent terrorist attacks  and other transnational crimes. Elements of SBI will be carried out by  several organizations within DHS. One element of SBI is SBInet, the  program within CBP that is responsible for developing a comprehensive  border protection system. The SBInet program is managed by the SBInet  Program Management Office (PMO). The PMO reports to the CBP SBI  Program Executive Director.
SBInet is a large and complex program that is responsible for leading the  effort to ensure that the proper mix of personnel, tactical infrastructure,  rapid response capability, and technology is deployed along the border.  DHS defines control of the U.S. border as the ability to detect illegal  entries into the United States, identify and classify these entries to  determine the level of threat involved, efficiently and effectively respond  to these entries, and bring events to a satisfactory law enforcement  resolution. SBInet’s initial focus will be on the southwest border  investments and areas between ports of entry that CBP has designated as  having the highest need for enhanced border security due to serious  vulnerabilities.
In September 2006, CBP awarded an indefinite delivery/indefinite quantity  systems integration contract for 3 years, with three additional 1-year  options. The minimum dollar amount is $2 million; the maximum is stated  as “the full panoply of supplies and services to provide 6,000 miles of  secure U.S. border.” According to DHS, the SBInet solution is to include a  variety of sensors, communications systems, information technology,  tactical infrastructure (roads, barriers, and fencing), and command and  control capabilities to enhance situational awareness of the responding  officers. The solution is also to include the development of a common  operating picture that provides uniform data, through a command center  environment, to all DHS agencies and is interoperable with stakeholders  external to DHS. See figure 1 for examples of existing technology along  the border.
section_title: SBInet Documentation Includes General Program Information but Lacks Detailed Implementation Plans
paragraphs: Our statement will now focus on what type of information DHS has  provided on explicit and measurable commitments relative to schedule  and costs.
The SBInet expenditure plan included general cost information for  proposed activities and some associated milestone information. DHS  estimates that the total cost for completing the acquisition phase for the  southwest border is $7.6 billion for fiscal years 2007 through 2011. Of this  total, approximately $5.1 billion is for the design, development,  integration, and deployment of fencing, roads, vehicle barriers, sensors,  radar units, and command, control, and communications and other  equipment, and $2.5 billion is for integrated logistics and operations  support during the acquisition phase for the southwest border. In addition,  the SBInet expenditure plan and related documentation discussed  generally how approximately $1.5 billion already appropriated will be  allocated to SBInet activities (see table 1). For example, about   $790 million is allocated for the Tucson Border Patrol sector and   $260 million for the Yuma sector in Arizona.
Table: 1 SBInet Funding Allocations Fiscal Years, 2005-2007 (dollars in thousands)
Yma and Tcson tactical  infrastrctre  $325,000   $1,187,565  $1,549,365  nds were allocated to SBInet activities.  des activities related to test and evalation, deployment and installation, and integrated  logistics spport.
The expenditure plan also includes certain milestones, such as starting  and ending dates, for some but not all activities. For example, consistent  with DHS’s task order approach to managing SBInet’s implementation, the  task order for Project 28 includes detailed milestones. In other cases, such  as the Tucson and Yuma sector activities, milestones and costs are  preliminary and highly likely to change because they are still in the  planning and requirement setting stage. According to SBInet officials,  factors such as technological, environmental, and eminent domain  constraints can affect the timetables and costs of these activities.  Figure 2  illustrates the extent to which milestones were defined for selected  activities.
Despite including general cost information for proposed activities and  some associated milestone information, the expenditure plan and related  documentation did not include sufficient details about what will be done,  the milestones involved, the performance capability expected, and the  costs for implementing the program. For example, although the plan stated  that about $790 million will be spent in the Tucson sector for such  elements as fencing, ground sensors, radars, cameras, and fixed and  mobile towers, the plan did not specify how the funds will be allocated by  element and did not provide specific dates for implementation. According  to DHS, each task order will define what will be done, when, the  performance capability, and the total cost.
The expenditure plan did not include costs incurred to date mainly  because SBInet activities are in the early stages of implementation and  costs had not yet been captured by DHS’s accounting system (e.g., the  SBInet systems integration contract was awarded in September 2006 and  the first two task orders were awarded in September and October 2006).  Moreover, the expenditure plan did not include a baseline measure of  miles under control of the border. While the plan did not discuss progress  made to date by the program to obtain control of the border, related  program documents, such as the bimonthly SBI reports to Congress,  included information on the number of miles under control in the  southwest border.
section_title: SBInet Has Followed Some but Not All Federal Acquisition Requirements and Related Best Practices
paragraphs: Our statement will now focus on DHS’s use of federal acquisition  requirements and related program management best practices.
As of December 2006, SBInet was using several acquisition best practices.  The extent to which these practices were in use varied, and outcomes  were dependent on successful implementation. Specifically, SBInet was  using several of the best practices or “Guiding Principles” in DHS  Management Directive 1400, such as conducting a competition open to all  qualified suppliers to award the systems integration contract, and using a  performance-based approach where the agency identified the outcome it  was seeking to achieve and allowed the competing companies to propose  their specific solutions. SBInet plans to use a system for comparing costs  incurred with progress achieved known as earned value management  (EVM).
However, we reported that the SBInet systems integration contract did  fully satisfy an acquisition requirement to contain a specific number of  units that may be ordered or a maximum dollar value. According to the  Federal Acquisition Regulation (FAR), an agency may use an indefinite  delivery/indefinite quantity contract, such as that used for SBInet, when it  is not possible to determine in advance the precise quantities of goods or  services that may be required during performance of the contract. Though  these types of contracts are indefinite, they are not open-ended. The FAR  requires that indefinite quantity contracts contain a limit on the supplies or  services that may be ordered, stated in terms of either units or dollars.  This limit serves a variety of purposes, including establishing the  maximum financial obligation of the parties. According to DHS, the  quantity stated in the contract, “6,000 miles of secure U.S. border,” is  measurable and is therefore the most appropriate approach to defining the  contract ceiling. We do not agree because the contract maximum used in  the SBInet contract, “the full panoply of supplies and services to provide  6,000 miles of secure U.S. border,” does not allow anyone to calculate with  certainty what the maximum financial obligation of the parties might turn  out to be since the contract does not make clear the total amount of  supplies or services that would be required to secure even 1 mile of U.S.  border. In order to ensure that the contract is consistent with the FAR  requirement, a maximum quantity or dollar value limit needs to be  included in the contract.
Managing major programs like SBInet also requires applying discipline and  rigor when acquiring and accounting for systems and services, such as  those requirements and practices embodied in OMB and related guidance.  Our work and other best practice research have shown that applying such  rigorous management practices improves the likelihood of delivering  expected capabilities on time and within budget. In other words, the  quality of information technology (IT) systems and services is largely  governed by the quality of the management processes involved in  acquiring and managing them. Some of these processes and practices are  embodied in the Software Engineering Institute’s (SEI) Capability Maturity  Models®, which define, among other things, acquisition process  management controls that, if implemented effectively, can greatly increase  the chances of acquiring systems that provide promised capabilities on  time and within budget. Other practices are captured in OMB guidance,  which establishes requirements for planning, budgeting, acquisition, and  management of federal capital assets.
As of December 2006, the SBInet program office had not fully defined and  implemented critical acquisition processes, such as project planning,  process and product quality assurance, measurement and analysis, and  requirements management. To its credit, the program office has  developed and begun implementing a draft risk management plan, dated  September 29, 2006. The draft plan addresses, among other things, a  process for identifying, analyzing, mitigating, tracking, and controlling  risks. As part of this process, the program office developed a risk  management database that identifies for each risk, among other things, the  status, priority, probability of occurrence, the overall impact,  consequence, and a mitigation strategy. The program office also  established a governance structure, which includes a Risk Review Board  (RRB) that is chaired by the SBInet Program Manager. According to the  SBInet Risk Manager, a draft RRB charter has been developed.
SBInet had not yet implemented other key management practices, such as  developing and implementing a system security plan, employing an EVM  system to help manage and control program cost and schedule, and  following capital planning and investment control review requirements to  help ensure that agencies investments achieve a maximum return on  investment. According to a SBInet program office security specialist, as of  December 2006, the program office had not developed a system security  plan because it was too early in the system development life cycle. He  stated that a plan is to be developed as part of the system certification and  accreditation process. Regarding EVM, the program office is relying on the  prime integrator’s EVM system to manage the prime contractor’s progress  against cost and schedule goals. The prime integrator’s system has been  independently certified as meeting established standards. However, the  EVM system had not been fully implemented because, as of December  2006, the baselines against which progress can be measured for the two  task orders that had been issued, as of early December (program  management and Project 28) had not yet been established. According to  program officials, these baselines were to be established for the program  management task order and the Project 28 task order in mid-December  2006 and mid-January 2007, respectively. Further, it is unclear where  SBInet is in the DHS capital planning and investment control review  process. The SBInet expenditure plan did not describe the status of the  program in the review process, but indicated that it is being managed  using the DHS framework. However, a SBInet DHS Joint Requirements  Council and Investment Review Board briefing document for fiscal year  2007, dated November 22, 2006, indicates that the program office plans to  implement the review process on an annual basis. According to the SBInet  Program Manager, SBInet projects are at various stages in the acquisition  life cycle. As a result, the program office plans to combine multiple  projects into a single decision milestone for purposes of investment review  that is to occur on, at least, an annual basis.
According to the SBInet Program Manager, the program had not fully  defined and implemented critical management practices because priority  was given to meeting an accelerated program implementation schedule.  However, he stated that he was committed to putting these processes in  place and further stated that the program plans to develop a plan for  defining and implementing critical acquisition planning processes by the  spring of 2007. Until the program office fully defines and implements these  key program management practices, its efforts to acquire, deploy, operate,  and maintain program capabilities will be at a higher risk of not producing  promised performance levels and associated benefits on time and within  budget.
section_title: SBInet’s Acquisition Approach Calls for Considerable Concurrency that Introduces Additional Risk
paragraphs: The SBInet PMO plans to execute SBInet activities through a series of  concurrent task orders that will be managed by a mix of government and  contractor staff. The PMO plans to nearly triple its current workforce,  from about 100 to 270 personnel, by September 2007 in order to support  and oversee this series of concurrent task orders. As of December 2006,  SBInet personnel included 38 government employees and 60 contractor  staff. By September 2007, personnel levels are projected to reach   113 government employees and 157 contractors. As of December 2006,  SBInet officials told us that they have assigned lead staff for the task  orders that have been awarded. However, SBI and SBInet officials  expressed concerns about difficulties in finding an adequate number of  staff with the required expertise to support planned activities. Staffing  shortfalls could limit government oversight efforts.
As shown in figure 2, SBInet’s acquisition approach calls for considerable  concurrency among related planned tasks and activities. For example,  according to DHS, lessons learned from the Project 28 task order are to be  incorporated in the sector task orders. However, the task orders for the  other sectors will be awarded prior to the completion and evaluation of  Project 28. The program management task order is also to establish the  capabilities to manage and oversee all of the other task orders. The risk of  concurrency is further increased because, as discussed earlier, DHS does  not have all the management processes in place to mitigate the risk and  successfully manage the program. The greater the degree of concurrency  among related and dependent program tasks and activities, the greater a  program’s exposure to cost, schedule, and performance risks. SBI and  SBInet officials told us that they understand the risks inherent in  concurrency and are addressing these risks. However, as of December  2006, they had not provided evidence that identified the dependencies  among their concurrent activities and that they were proactively managing  the associated risk.
section_title: Conclusions, Recommendations for Executive Action, and Agency Response
paragraphs: The legislatively mandated expenditure plan for SBInet is a congressional  oversight mechanism aimed at ensuring that planned expenditures are  justified, performance against plans is measured, and accountability for  results is ensured. We found that Congress and DHS are not in the best  position to use the plan as a basis for measuring program success,  accounting for the use of current and future appropriations, and holding  program managers accountable for achieving effective control of the  southwest border because the plan has not provided information on  explicit and measurable commitments relative to the capabilities,  schedule, costs, and benefits associated with individual SBInet program  activities. Specifically, DHS needs to provide sufficient details on such  things as planned activities and milestones, anticipated costs and staffing  levels, and expected mission outcomes. DHS also needs to document that  planned SBInet expenditures are justified, performance against plans is  measured, and accountability for results is ensured. We recommended that  DHS ensure that future expenditure plans include explicit and measurable  commitments relative to the capabilities, schedule, costs, and benefits  associated with individual SBInet program activities.
DHS has not fully established the capabilities needed to effectively  mitigate risks and to successfully manage the program. We reported that  although the SBInet contract was generally competed in accordance with  federal requirements, the contract does not fully satisfy federal  regulations. Under the FAR, indefinite quantity contracts such as the  SBInet contract must contain the specific number of units that may be  ordered or a maximum dollar value. However, the SBInet contract merely  contains the maximum number of miles to be secured. While SBInet  officials consider this sufficient to satisfy the FAR requirement, a  maximum quantity expressed in units other than the overall outcome to be  achieved or expressed as a dollar value limit would help ensure that the  contract is consistent with this requirement. We recommended that DHS  modify the SBInet systems integration contract to include a maximum  quantity or dollar value.
DHS’s approach to SBInet introduces additional risk because the  program’s schedule entails a high level of concurrency. With multiple  related and dependent projects being undertaken simultaneously, SBInet  is exposed to possible cost and schedule overruns and performance  problems. Without assessing this level of concurrency and how it affects  project implementation, SBInet runs the risk of not delivering promised  capabilities and benefits on time and within budget. We recommended that  DHS re-examine the level of concurrency and appropriately adjust the  acquisition strategy.
DHS generally agreed with our findings and conclusions, but did not agree  with our assessment that the SBInet contract does not contain specific  numbers of units that may be ordered or a maximum dollar value. In  addition, DHS stated that CBP intends to fully satisfy each of the  legislative conditions in the near future to help minimize the program’s  exposure to cost, schedule, and performance risks.
With respect to our recommendations, DHS concurred with two of our  recommendations and disagreed with one. Specifically, DHS concurred  with our recommendation for future expenditure plans to include explicit  and measurable commitments relative to capabilities, schedule, costs, and  benefits associated with individual SBInet program activities. According to  DHS, future SBInet expenditure plans will include actual and planned  progress, report against commitments contained in prior expenditure  plans, and include a section that addresses and tracks milestones. DHS  also concurred with our recommendation to re-examine the level of  concurrency and appropriately adjust the acquisition strategy. In its  written comments, DHS stated that CBP is constantly assessing the overall  program as it unfolds, and adjusting it to reflect progress, resource  constraints, refinements and changes in requirements, and insight gained  from ongoing system engineering activities. DHS also stated that CBP  recognizes the risk inherent in concurrency and has plans to address this  risk.
DHS did not agree with our recommendation to modify the SBInet  integration contract to include a maximum quantity or dollar value.  According to DHS, the quantity stated in the contract, “6,000 miles of  secure U.S. border,” is measurable and is therefore the most appropriate  approach to defining the contract ceiling. We do not agree. In order to  ensure that the SBInet contract is consistent with the FAR, we continue to  believe that it should be modified to include a maximum quantity, either  units or a dollar value, rather than the total amount of miles to be secured.
This concludes our prepared testimony. We would be happy to respond to  any questions that members of the subcommittee may have.
section_title: Contacts and Acknowledgments
paragraphs: For questions regarding this testimony, please call Richard M. Stana at  (202) 512-8816 or StanaR@gao.gov or Randolph C. Hite at (202) 512-3439  or HiteR@gao.gov. Other key contributors to this statement were William  T. Woods, Director; Robert E. White, Assistant Director; Deborah Davis,  Assistant Director; Richard Hung, Assistant Director; E. Jeanette Espínola;  Frances Cook; Katherine Davis; Gary Delaney; Joseph K. Keener; Sandra  Kerr; Raul Quintero; and Sushmita Srikanth.
section_title: Appendix I: Satisfaction of Legislative Conditions
paragraphs: The SBInet December 2006 expenditure plan, including related  documentation and program officials’ statements, satisfied four legislative  conditions, partially satisfied four legislative conditions, and did not  satisfy one legislative condition. The nine legislative conditions and the  level of satisfaction are summarized in the table below.
Satisfied  This is a work of the U.S. government and is not subject to copyright protection in the  United States. It may be reproduced and distributed in its entirety without further  permission from GAO. However, because this work may contain copyrighted images or  other material, permission from the copyright holder may be necessary if you wish to  reproduce this material separately.