Department of Homeland Security: Progress Made, but More Work Remains in Strengthening Management Functions
Released: 2015-02-26T00:00:00


Highlights: section_title: Why GAO Did This Study
paragraphs: GAO has regularly reported on government operations identified as high risk because of their increased vulnerability to fraud, waste, abuse, and mismanagement, or the need for transformation to address economy, efficiency, or effectiveness challenges. In 2003, GAO designated implementing and transforming DHS as high risk because DHS had to transform 22 agencies into one department, and failure to address associated risks could have serious consequences for U.S. national and economic security. While challenges remain for DHS across its range of missions, it has made considerable progress. As a result, in its 2013 high-risk update, GAO narrowed the scope of the high-risk area to focus on strengthening and integrating DHS management functions (human capital, acquisition, financial, and information technology). As requested, this statement discusses, among other things, DHS's progress and actions remaining in strengthening and integrating its management functions. This statement is based on GAO's 2015 high-risk update and reports and testimonies from September 2011 through February 2015. Among other things, GAO analyzed DHS strategies and interviewed DHS officials.

section_title: What GAO Found
paragraphs: As GAO reported in its 2015 high-risk update report earlier this month, the Department of Homeland Security's (DHS) efforts to strengthen and integrate its management functions have resulted in the department meeting two and partially meeting three of GAO's criteria for removal from the high-risk list (see table).

b “Partially met”: Some but not all actions necessary to generally meet the criterion have been taken.

c “Not met”: Few, if any, actions toward meeting the criterion have been taken.

For example, the department's Deputy Secretary, Under Secretary for Management, and other senior officials have continued to demonstrate leadership commitment by frequently meeting with GAO to discuss the department's plans and progress in addressing the high-risk area. DHS has also established a plan for addressing the high-risk area, which it has updated seven times since 2010. However, DHS needs to show additional progress in other areas. For example, in October 2014, DHS identified that it had resources needed to implement 7 of 11 initiatives the department had under way to address the high-risk area, but did not identify sufficient resources for the 4 remaining initiatives.

Key to addressing the department's management challenges is DHS demonstrating the ability to achieve sustained progress across 30 actions and outcomes that GAO identified and DHS agreed were needed to address the high-risk area. GAO found in its 2015 high-risk update report that DHS fully addressed 9 of these actions and outcomes, while work remains to fully address the remaining 21. Of the 9 actions and outcomes that DHS has addressed, 5 have been sustained as fully implemented for at least 2 years. For example, DHS fully met 1 outcome for the first time by obtaining a clean opinion on its financial statements for 2 consecutive years. DHS has also mostly addressed an additional 5 actions and outcomes, meaning that a small amount of work remains to fully address them. However, DHS has partially addressed 12 and initiated 4 of the remaining actions and outcomes. For example, DHS does not have modernized financial management systems, a fact that affects its ability to have ready access to reliable information for informed decision making. Addressing some of these actions and outcomes, such as modernizing the department's financial management systems and improving employee morale, are significant undertakings that will likely require multiyear efforts. In GAO's 2015 high-risk update report, GAO concluded that in the coming years, DHS needs to continue to show measurable, sustainable progress in implementing its key management initiatives and achieving the remaining 21 actions and outcomes.

section_title: What GAO Recommends
paragraphs: This testimony contains no new recommendations. GAO has made about 2,200 recommendations to DHS since 2003 to strengthen its management efforts, among other things. DHS has implemented more than 69 percent of these recommendations and has actions under way to address others.

section_title: Letter
paragraphs: Thank you for the opportunity to discuss the Department of Homeland  Security’s (DHS) ongoing efforts to strengthen and integrate its  management functions. In the 12 years since the department’s creation,  DHS has implemented key homeland security operations, achieved  important goals and milestones, and grown to more than 240,000  employees and approximately $60 billion in budget authority. We have  issued hundreds of reports addressing the range of DHS’s missions and  management functions, and our work has identified gaps and  weaknesses in the department’s operational and implementation efforts,  as well as opportunities to strengthen their efficiency and effectiveness.  Since 2003, we have made approximately 2,200 recommendations to  DHS to strengthen program management, performance measurement  efforts, and management processes, among other things. DHS has  implemented more than 69 percent of these recommendations and has  actions under way to address others.

We also report regularly to Congress on government operations that we  identified as high risk because of their increased vulnerability to fraud,  waste, abuse, and mismanagement, or the need for transformation to  address economy, efficiency, or effectiveness challenges. In 2003, we  designated implementing and transforming DHS as high risk because  DHS had to transform 22 agencies—several with major management  challenges—into one department, and failure to address associated risks  could have serious consequences for U.S. national and economic  security. Given the significant effort required to build and integrate a  department as large and complex as DHS, our initial high-risk designation  addressed the department’s initial transformation and subsequent  implementation efforts, to include associated management and  programmatic challenges.

Since 2003, the focus of the Implementing and Transforming DHS high- risk area has evolved in tandem with DHS’s maturation and evolution. In  September 2011, we reported in our assessment of DHS’s progress and  challenges 10 years after the terrorist attacks of September 11, 2001,  (9/11) that the department had implemented key homeland security  operations and achieved important goals in many areas to create and  strengthen a foundation to reach its potential. that continuing weaknesses in DHS’s management functions had been a  key theme impacting the department’s implementation efforts. While  challenges remain for DHS across its range of missions, the department  has made considerable progress in transforming its original component  agencies into a single cabinet-level department and positioning itself to  achieve its full potential. As a result, in our 2013 high-risk update, we  narrowed the scope of the high-risk area to focus on strengthening DHS  management functions (human capital, acquisition, financial  management, and information technology ), and changed the name  from Implementing and Transforming DHS to Strengthening DHS  Management Functions to reflect this focus. We also reported in our 2013  update that the department needs to demonstrate continued progress in  implementing and strengthening key management initiatives and  addressing corrective actions and outcomes in order to mitigate the risks  that management weaknesses pose to mission accomplishment and the  efficient and effective use of the department’s resources.

GAO, Department of Homeland Security: Progress Made and Work Remaining in  Implementing Homeland Security Missions 10 Years after 9/11, GAO-11-881  (Washington, D.C.: Sept. 7, 2011).

In November 2000, we published our criteria for removing areas from the  high-risk list. Specifically, agencies must have (1) a demonstrated strong  commitment and top leadership support to address the risks; (2) a  corrective action plan that identifies the root causes, identifies effective  solutions, and provides for substantially completing corrective measures  in the near term, including but not limited to steps necessary to implement  solutions we recommended; (3) the capacity (that is, the people and other  resources) to resolve the risks; (4) a program instituted to monitor and  independently validate the effectiveness and sustainability of corrective  measures; and (5) the ability to demonstrate progress in implementing  corrective measures.

As requested, my statement discusses

DHS’s progress and actions remaining in strengthening and  integrating its management functions, and crosscutting issues that have affected DHS’s progress in  implementing its mission functions.

This statement is based on GAO’s 2015 high-risk update report as well as  reports and testimonies we issued from September 2011 through  February 2015. For the past products, among other things, we analyzed  DHS strategies and other documents related to the department’s efforts  to address its high-risk areas, reviewed our past reports issued since  DHS began its operations in March 2003, and interviewed DHS officials.  More detailed information on the scope and methodology of our prior  work can be found within each specific report. We conducted the work on  which this statement is based in accordance with generally accepted  government auditing standards. Those standards require that we plan  and perform the audit to obtain sufficient, appropriate evidence to provide  a reasonable basis for our findings and conclusions based on our audit  objectives. We believe that the evidence obtained provides a reasonable  basis for our findings and conclusions based on our audit objectives.
subsections: section_title: DHS Has Made Progress in Strengthening Its Management Functions, but Considerable Work Remains
subsections: section_title: DHS Progress in Meeting Criteria for Removal from the High-Risk List
paragraphs: DHS’s efforts to strengthen and integrate its management functions have  resulted in progress addressing our criteria for removal from the high-risk  list. In particular, in our 2015 high-risk update report, which we released  earlier this month, we found that DHS has met two criteria and partially  met the remaining three criteria, as shown in table 1.

Leadership commitment (met). In our 2015 report, we found that the  Secretary and Deputy Secretary of Homeland Security, the Under  Secretary for Management at DHS, and other senior officials have  continued to demonstrate commitment and top leadership support for  addressing the department’s management challenges. We also found that  they have taken actions to institutionalize this commitment to help ensure  the long-term success of the department’s efforts. For example, in April  2014, the Secretary of Homeland Security issued a memorandum entitled  Strengthening Departmental Unity of Effort, committing to, among other  things, improving DHS’s planning, programming, budgeting, and  execution processes through strengthened departmental structures and  increased capability. Senior DHS officials, including the Deputy  Secretary and Under Secretary for Management, have also routinely met  with us over the past 6 years to discuss the department’s plans and  progress in addressing this high-risk area. During this time, we provided  specific feedback on the department’s efforts. We concluded that it will be  important for DHS to maintain its current level of top leadership support  and commitment to ensure continued progress in successfully executing  its corrective actions through completion.

Corrective action plan (met). We found that DHS has established a plan  for addressing this high-risk area. Specifically, in a September 2010 letter  to DHS, we identified and DHS agreed to achieve 31 actions and  outcomes that are critical to addressing the challenges within the  department’s management areas and in integrating those functions  across the department. In March 2014, we updated the actions and  outcomes in collaboration with DHS to reduce overlap and ensure their  continued relevance and appropriateness. These updates resulted in a  reduction from 31 to 30 total actions and outcomes. Toward achieving the  actions and outcomes, DHS issued its initial Integrated Strategy for High  Risk Management in January 2011 and has since provided updates to its  strategy in seven later versions, most recently in October 2014. The  integrated strategy includes key management initiatives and related  corrective actions plans for addressing DHS’s management challenges  and the actions and outcomes we identified. For example, the October  2014 strategy update includes an initiative focused on financial systems  improvement and modernization and an initiative focused on IT human  capital management. These initiatives support various actions and  outcomes, such as modernizing the U.S. Coast Guard’s financial  management system and implementing an IT human capital strategic  plan, respectively. We concluded in our 2015 report that DHS’s strategy  and approach to continuously refining actionable steps to implementing  the outcomes, if implemented effectively and sustained, should provide a  path for DHS to be removed from our high-risk list.

Capacity (partially met). In October 2014, DHS identified that it had  resources needed to implement 7 of the 11 initiatives the department had  under way to achieve the actions and outcomes, but did not identify  sufficient resources for the 4 remaining initiatives. In addition, our prior  work has identified specific capacity gaps that could undermine  achievement of management outcomes. For example, in April 2014, we  reported that DHS needed to increase its cost-estimating capacity and  that the department had not approved baselines for 21 of 46 major  acquisition programs. These baselines—which establish cost, schedule,  and capability parameters—are necessary to accurately assess program  performance. Thus, in our 2015 report, we concluded that DHS needs to  continue to identify resources for the remaining initiatives; work to  mitigate shortfalls and prioritize initiatives, as needed; and communicate  to senior leadership critical resource gaps.

Framework to monitor progress (partially met). In our 2015 report we  found that DHS established a framework for monitoring its progress in  implementing the integrated strategy it identified for addressing the 30  actions and outcomes. In the June 2012 update to the Integrated Strategy  for High Risk Management, DHS included, for the first time, performance  measures to track its progress in implementing all of its key management  initiatives. DHS continued to include performance measures in its October  2014 update. However, we also found that the department can strengthen  this framework for monitoring a certain area. In particular, according to  DHS officials, as of November 2014, they were establishing a monitoring  program that will include assessing whether financial management  systems modernization projects for key components that DHS plans to  complete in 2019 are following industry best practices and meet users’  needs. Effective implementation of these modernization projects is  important because, until they are complete, the department’s current  systems will not effectively support financial management operations. As  we concluded in our 2015 report, moving forward, DHS will need to  closely track and independently validate the effectiveness and  sustainability of its corrective actions and make midcourse adjustments,  as needed.

Demonstrated, sustained progress (partially met). We found in our  2015 report that DHS has made important progress in strengthening its  management functions, but needs to demonstrate sustainable,  measurable progress in addressing key challenges that remain within and  across these functions. In particular, we found that DHS has implemented  a number of actions demonstrating the department’s progress in  strengthening its management functions. For example, DHS has  strengthened its enterprise architecture program (or blueprint) to guide  and constrain IT acquisitions and obtained a clean opinion on its financial  statements for 2 consecutive years, fiscal years 2013 and 2014.  However, we also found that DHS continues to face significant  management challenges that hinder the department’s ability to  accomplish its missions. For example, DHS does not have the acquisition  management tools in place to consistently demonstrate whether its major  acquisition programs are on track to achieve their cost, schedule, and  capability goals. In addition, DHS does not have modernized financial  management systems. This affects its ability to have ready access to  reliable information for informed decision making. As we concluded in our  2015 report, addressing these and other management challenges will be  a significant undertaking that will likely require several years, but will be  critical for the department to mitigate the risks that management  weaknesses pose to mission accomplishment.

section_title: DHS Progress in Achieving Key High-Risk Actions and Outcomes
paragraphs: Key to addressing the department’s management challenges is DHS  demonstrating the ability to achieve sustained progress across the 30  actions and outcomes we identified and DHS agreed were needed to  address the high-risk area. In our 2015 report, we found that DHS has  fully implemented 9 of these actions and outcomes, with additional work  remaining to fully address the remaining 21. Achieving sustained  progress across the actions and outcomes, in turn, requires leadership  commitment, effective corrective action planning, adequate capacity (that  is, the people and other resources), and monitoring the effectiveness and  sustainability of supporting initiatives. The 30 key actions and outcomes  include, among others, validating required acquisition documents in  accordance with a department-approved, knowledge-based acquisition  process, and sustaining clean audit opinions for at least 2 consecutive  years on department-wide financial statements and internal controls.

We further found that DHS has made important progress across all of its  management functions and significant progress in the area of  management integration. In particular, DHS has made important progress  in several areas to fully address 9 actions and outcomes, 5 of which it has  sustained as fully implemented for at least 2 years. For instance, DHS  fully met 1 outcome for the first time by obtaining a clean opinion on its  financial statements for 2 consecutive years and fully met another  outcome by establishing sufficient component-level acquisition capability.  It also sustained full implementation of another outcome by continuing to  use performance measures to assess progress made in achieving  department-wide management integration. DHS has also mostly  addressed an additional 5 actions and outcomes, meaning that a small  amount of work remains to fully address them.

We also found that considerable work remains, however, in several areas  for DHS to fully achieve the remaining actions and outcomes and thereby  strengthen its management functions. Specifically, DHS has partially  addressed 12 and initiated 4 of the actions and outcomes. As previously  mentioned, addressing some of these actions and outcomes, such as  modernizing the department’s financial management systems and  improving employee morale, are significant undertakings that will likely  require multiyear efforts. Table 2 summarizes DHS’s progress in  addressing the 30 actions and outcomes and is followed by selected  examples.

Acquisition management. In our 2015 report, we found that DHS has  fully addressed 1 of the 5 acquisition management outcomes, partially  addressed 3 outcomes, and initiated actions to address the remaining  outcome. For example, DHS has recently taken a number of actions to  fully address establishing effective component-level acquisition capability.  These actions include initiating (1) monthly Component Acquisition  Executive staff forums in March 2014 to provide guidance and share best  practices and (2) assessments of component policies and processes for  managing acquisitions. DHS has also initiated efforts to validate required  acquisition documents in accordance with a knowledge-based acquisition  process, but this remains a major challenge for the department. A  knowledge-based approach provides developers with information needed  to make sound investment decisions, and it would help DHS address  significant challenges we have identified across its acquisition programs.  DHS’s acquisition policy largely reflects key acquisition management  practices, but the department has not implemented it consistently For  example, in March 2014, we found that U.S. Customs and Border  Protection (CBP) had not fully followed DHS policy regarding testing for  the integrated fixed towers being deployed on the Arizona border. As a  result, DHS does not have complete information on how the towers will  operate once they are fully deployed.

In addition, in our 2015 report we found that DHS continues to assess  and address whether appropriate numbers of trained acquisition  personnel are in place at the department and component levels, an  outcome it has partially addressed. Further, while DHS has initiated  efforts to demonstrate that major acquisition programs are on track to  achieve their cost, schedule, and capability goals, DHS officials have  acknowledged it will be years before this outcome has been fully  addressed. Much of the necessary program information is not yet  consistently available or up to date.

IT management. In our 2015 report, we found that DHS has fully  addressed 2 of the 6 IT management outcomes, mostly addressed  another 3, and partially addressed the remaining 1. For example, DHS  has finalized a directive to establish its tiered governance and portfolio  management structure for overseeing and managing its IT investments,  and annually reviews each of its portfolios and the associated  investments to determine the most efficient allocation of resources within  each of the portfolios. DHS has also implemented its IT Strategic Human  Capital Plan at the enterprise level. This includes developing an IT  specialist leadership competency gap workforce analysis and a DHS IT  career path pilot. However, as DHS has not yet determined the extent to  which the component chief information officers have implemented the  enterprise human capital plan’s objectives and goals, DHS’s capacity to  achieve this outcome is unclear. Additionally, we found that DHS  continues to take steps to enhance its information security program.  However, while the department obtained a clean opinion on its financial  statements, in November 2014, the department’s financial statement  auditor reported that continued flaws in security controls such as those for  access controls, configuration management, and segregation of duties   Thus,  were a material weakness for fiscal year 2014 financial reporting.the department needs to remediate the material weakness in information  security controls reported by its financial statement auditor.

Financial management. In our 2015 report, we found that DHS has fully  addressed 2 financial management outcomes, partially addressed 3, and  initiated 3.financial statements for 2 consecutive years, fiscal years 2013 and 2014,  fully addressing 2 outcomes. As of November 2014, DHS was working   Most notably, DHS received a clean audit opinion on its  toward addressing a third outcome—establishing effective internal control  over financial reporting. We reported in September 2013 that DHS needs  to eliminate all material weaknesses at the department level, including  weaknesses related to financial management systems, before its financial  auditor can affirm that controls are effective. However, as we reported in  our 2015 report, DHS has yet to identify and commit the resources  needed for remediating the remaining material weaknesses. As we  reported in September 2013, according to DHS’s auditors, the existence  of these material weaknesses limits DHS’s ability to process, store, and  report financial data in a manner that ensures accuracy, confidentiality,  integrity, and availability of data without substantial manual intervention.  This, in turn, increases the risk that human error may cause material  misstatements in the financial statements.

We also found in our 2015 report that DHS needs to modernize key  components’ financial management systems and comply with financial  management system requirements. The components’ financial  management system modernization efforts are at various stages due, in  part, to a bid protest and the need to resolve critical stability issues with a  legacy financial system before moving forward with system modernization  efforts. For fiscal year 2014, auditors reported that persistent and  pervasive financial system functionality conditions exist at multiple  components and that DHS continues to rely on compensating controls  and complex manual work-arounds due to serious legacy financial system  issues. We concluded that without sound controls and systems, DHS faces long-term challenges in obtaining and sustaining a clean audit  opinion on internal control over financial reporting, and ensuring its  financial management systems generate reliable, useful, and timely  information for day-to-day decision making.

Human capital management. In our 2015 report, we found that DHS has  fully addressed 1 human capital management outcome, mostly addressed  2, and partially addressed the remaining 4. For example, the Secretary of  Homeland Security signed a human capital strategic plan in 2011 that  DHS has since made sustained progress in implementing, fully  addressing this outcome. We also found that DHS has actions under way  to identify current and future human capital needs. However, DHS has  considerable work ahead to improve employee morale. For example, the  Office of Personnel Management’s 2014 Federal Employee Viewpoint  Survey data showed that DHS’s scores continued to decrease in all four  dimensions of the survey’s index for human capital accountability and  assessment—job satisfaction, talent management, leadership and  knowledge management, and results-oriented performance culture. DHS  has taken steps to identify where it has the most significant employee  satisfaction problems and developed plans to address those problems. In  September 2012, we recommended, among other things, that DHS   In  improve its root-cause analysis efforts related to these plans.December 2014, DHS reported actions under way to address our  recommendations but had not fully implemented them. Given the  sustained decrease in DHS employee morale indicated by Federal  Employee Viewpoint Survey data, as we concluded in our 2015 report, it  is particularly important that DHS implement these recommendations and  thereby help identify appropriate actions to take to improve morale within  its components and department-wide.

GAO, DHS Training: Improved Documentation, Resource Tracking, and Performance  Measurement Could Strengthen Efforts, GAO-14-688 (Washington, D.C.: Sept. 10, 2014). found that while component officials generally identified the Leader  Development Framework as beneficial, DHS management could benefit  from improved information for identifying the need for and making  program improvements. In support of the Leader Development  Framework, we recommended, among other things, that DHS clearly  identify Leader Development Program goals and ensure program  performance measures reflect key attributes. DHS agreed and  implemented this recommendation in December 2014. However, to fully  achieve this outcome, DHS also needs to develop and make sustained  progress in implementing a formal training strategy, as well as issue  department-wide policies on training and development, among other  things.

Management integration. In our 2015 report, we found that DHS has  sustained its progress in fully addressing 3 of 4 outcomes we identified  and agreed they are key to the department’s management integration  efforts. For example, in January 2011, DHS issued an initial action plan to  guide its management integration efforts—the Integrated Strategy for  High Risk Management. Since then, DHS has generally made  improvements to the strategy with each update based on feedback we  provided. DHS has also shown important progress in addressing the last  and most significant management integration outcome—to implement  actions and outcomes in each management area to develop consistent or  consolidated processes and systems within and across its management  functional areas—but we found that considerable work remains. For  example, the Secretary’s April 2014 Strengthening Departmental Unity of  Effort memorandum highlighted a number of initiatives designed to allow  the department to operate in a more integrated fashion, such as the  Integrated Investment Life Cycle Management initiative, to manage  investments across the department’s components and management  functions. DHS completed its pilot for a portion of this initiative in March  2014 and, according to DHS’s Executive Director for Management  Integration, has begun expanding its application to new portfolios, such  as border security and information sharing, among others. However,  given that these main management integration initiatives are in the early  stages of implementation and contingent upon DHS following through  with its plans, it is too early to assess their impact. To achieve this  outcome, we concluded that DHS needs to continue to demonstrate  sustainable progress integrating its management functions within and  across the department and its components.

In our 2015 report, we further concluded that in the coming years, DHS  needs to continue implementing its Integrated Strategy for High Risk  Management and show measurable, sustainable progress in  implementing its key management initiatives and corrective actions and  achieving outcomes. In doing so, it will be important for DHS to maintain its current level of top leadership support and sustained  commitment to ensure continued progress in executing its corrective  actions through completion; continue to implement its plan for addressing this high-risk area and  periodically report its progress to us and Congress;  identify and work to mitigate any resource gaps, and prioritize  initiatives as needed to ensure it can implement and sustain its  corrective actions; closely track and independently validate the effectiveness and  sustainability of its corrective actions and make midcourse  adjustments as needed; and make continued progress in achieving the 21 actions and outcomes it  has not fully addressed and demonstrate that systems, personnel,  and policies are in place to ensure that progress can be sustained  over time.

We will continue to monitor DHS’s efforts in this high-risk area to  determine if the actions and outcomes are achieved and sustained over  the long term.

section_title: Key Themes Continue to Impact DHS’s Progress in Implementing Its Mission Functions
paragraphs: In September 2011, we reported that our work had identified three key  themes that had impacted DHS’s progress in implementing its mission  functions since it began operations: (1) executing and integrating its  management functions for results, (2) leading and coordinating the  homeland security enterprise, and (3) strategically managing risks and  assessing homeland security efforts. As previously discussed, DHS has  made important progress with respect to the first theme by strengthening  and integrating its management functions, but considerable work remains.  Our recent work indicates that DHS has similarly made progress related  to the other two themes of leading and coordinating the homeland  security enterprise and strategically managing risk and assessing  homeland security efforts, but that these two themes continue to impact  the department’s progress in implementing its mission functions.

Leading and coordinating the homeland security enterprise. As we  reported in September 2011, while DHS is one of a number of entities  with a role in securing the homeland, it has significant leadership and  coordination responsibilities for managing efforts across the homeland  security enterprise. To satisfy these responsibilities, it is critically  important that DHS develop, maintain, and leverage effective  partnerships with its stakeholders while at the same time addressing  DHS-specific responsibilities in satisfying its missions. Before DHS began  operations, we reported that to secure the nation, DHS must form  effective and sustained partnerships among components and also with a  range of other entities, including federal agencies, state and local  governments, the private and nonprofit sectors, and international  partners. DHS has made important strides in providing leadership and  coordinating efforts. For example, in June 2014, we reported on DHS  efforts to enhance border security by using collaborative mechanisms  such as the Alliance to Combat Transnational Threats to coordinate  border security efforts. Specifically, we reported that DHS and CBP had  coordinated border security efforts in (1) information sharing, (2) resource  targeting and prioritization, and (3) leveraging of assets. For example,  through the Alliance to Combat Transnational Threats, interagency  partners—including CBP, the Arizona Department of Public Safety, and  the Bureau of Land Management, among others—worked jointly to target  individuals and criminal organizations involved in illegal cross-border  activity.

However, our recent work has also identified opportunities for DHS to  improve its partnerships. For example, with respect to DHS’s efforts to  enhance border security using collaborative mechanisms, in June 2014,  we found that DHS had established performance measures and reporting  processes for the mechanisms, but opportunities existed to strengthen  the mechanisms. For instance, we found that establishing written  agreements with its federal, state, local, and tribal partners could help  DHS address coordination challenges, such as limited resource  commitments and lack of common objectives, and recommended that  DHS establish such agreements. DHS concurred and stated that it  planned to develop memoranda of understanding to better facilitate its  partnerships. Further, in November 2014, we reported on DHS’s  processing of Freedom of Information Act requests. We found, among  other things, that DHS lacked an important mechanism for effectively  facilitating public interaction with the department on the handling of  Freedom of Information Act requests because the department did not  have an updated regulation reflecting changes in how it processes these  requests. We recommended that DHS finalize and issue an updated  DHS Freedom of Information Act regulation. DHS concurred and reported  planned actions to implement this recommendation by April 2015.

GAO-11-881. to critical infrastructure security and resilience. Our recent work has  further found that DHS offices and components have continued to engage  in risk management activities. For example, in September 2014, we  reported that during fiscal years 2011 to 2013, DHS offices and  components conducted or required thousands of vulnerability  assessments of critical infrastructure. These assessments can identify  factors that render an asset or facility susceptible to threats and hazards.  However, we also found that DHS is not well positioned to integrate  relevant assessments to, among other things, support nationwide  comparative risk assessments, because the assessment tools and  methods used vary in length, detail, and areas assessed. In addition,  our recent work has identified opportunities for components to better  strategically manage risks in various programs. For example, in  September 2014, we reported that CBP had a $1 million budget for covert  operations of various activities—including nuclear and radiological  testing—covering fiscal years 2009 through 2013. We found that DHS  had established a policy that requires that components with limited  resources make risk-informed decisions, but that CBP testing did not  inform capabilities across all border locations, and CBP had not  conducted a risk assessment that could inform and prioritize the  locations, materials, and technologies to be tested through covert  operations. We recommended that—to help ensure that resources for  covert operations provide reasonable assurance that efforts to detect and  interdict nuclear and radiological material smuggled across the border are  working as intended and appropriately targeted—DHS conduct or use a  risk assessment to inform the department’s priorities for covert  operations. DHS concurred and reported that it plans to implement this  recommendation in July 2015.

In September 2011, we reported that limited strategic and program  planning, as well as assessment and evaluation to inform approaches  and investment decisions, had contributed to DHS programs not meeting  strategic needs or doing so effectively and efficiently. Our recent work  has indicated that strategic and program planning challenges continue to  affect implementation of some DHS programs. For example, in  September 2014, we reported on DHS headquarters consolidation efforts  and their management by DHS and the General Services Administration  (GSA). We found that DHS and GSA’s planning for the consolidation did  not fully conform with leading capital decision-making practices intended  to help agencies effectively plan and procure assets. DHS and GSA  officials reported that they had taken some initial actions that may  facilitate consolidation planning in a manner consistent with leading  practices, but consolidation plans, which were finalized between 2006  and 2009, had not been updated to reflect these changes. According to  DHS and GSA officials, the funding gap between what was requested and  what was received from fiscal years 2009 through 2014 was over $1.6  billion. According to these officials, this gap had escalated estimated  costs by over $1 billion—from $3.3 billion to $4.5 billion—and delayed  scheduled completion by over 10 years, from an original completion date  of 2015 to the current estimate of 2026. However, DHS and GSA had not  conducted a comprehensive assessment of current needs, identified  capability gaps, or evaluated and prioritized alternatives to help them  adapt consolidation plans to changing conditions and address funding  issues as reflected in leading practices. We recommended that DHS and  GSA work jointly to assess these needs. DHS and GSA concurred, and  DHS reported in February 2015 that the agencies had drafted an  enhanced consolidation plan. We will assess this plan when it and any  additional supporting analyses are made available to us.

We also recently found that DHS had taken preliminary steps to begin to  understand the cyber risk to building and access controls systems in  federal facilities, but that significant work remained, such as developing a  strategy to guide these efforts. In particular, in December 2014, we found  that DHS lacked a strategy that (1) defines the problem, (2) identifies  roles and responsibilities, (3) analyzes the resources needed, and (4)  identifies a methodology for assessing cyber risk to building and access  controls systems in federal facilities.a strategy that clearly defines the roles and responsibilities of key  components within DHS had contributed to a lack of action within the  department. For example, we found that no one within DHS was  assessing or addressing cyber risk to building and access control  systems particularly at the nearly 9,000 federal facilities protected by the  Federal Protective Service as of October 2014. We recommended that  DHS, in consultation with GSA, develop and implement a strategy to  address cyber risk to building and access control systems. DHS  concurred and identified steps it plans to take to develop a strategy by  May 2015.

We concluded that the absence of  Chairman Perry, Ranking Member Watson Coleman, and members of the  subcommittee, this completes my prepared statement. I would be happy  to respond to any questions you may have at this time.

section_title: GAO Contact and Staff Acknowledgments
paragraphs: For further information about this testimony, please contact Rebecca  Gambler at (202) 512-8777 or gamblerr@gao.gov. In addition, contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this statement. Individuals making key  contributions to this statement include Joseph P. Cruz (Assistant  Director), Michael LaForge, Thomas Lombardi, Emily Kuhn, Taylor  Matheson, Shannin O’Neill, and Katherine Trimble. Key contributors for  the previous work that this testimony is based on are listed in each  product.

section_title: Related GAO Products
paragraphs: DHS Training: Improved Documentation, Resource Tracking, and  Performance Measurement Could Strengthen Efforts. GAO-14-688.  Washington, D.C.: September 10, 2014.

Department of Homeland Security: Progress Made; Significant Work  Remains in Addressing High-Risk Areas. GAO-14-532T. Washington,  D.C.: May 7, 2014.

Homeland Security Acquisitions: DHS Could Better Manage Its Portfolio  to Address Funding Gaps and Improve Communications with Congress.  GAO-14-332. Washington, D.C.: April 17, 2014.

Department of Homeland Security: DHS’s Efforts to Improve Employee  Morale and Fill Senior Leadership Vacancies. GAO-14-228T.  Washington, D.C.: December 12, 2013.

DHS Financial Management: Continued Effort Needed to Address  Internal Control and System Challenges. GAO-14-106T. Washington,  D.C.: November 15, 2013.

Information Technology: Additional OMB and Agency Actions Are Needed  to Achieve Portfolio Savings. GAO-14-65. Washington, D.C.: November  6, 2013.

DHS Financial Management: Additional Efforts Needed to Resolve  Deficiencies in Internal Controls and Financial Management Systems.  GAO-13-561. Washington, D.C.: September 30, 2013.

DHS Recruiting and Hiring: DHS Is Generally Filling Mission-Critical  Positions, but Could Better Track Costs of Coordinated Recruiting Efforts.  GAO-13-742. Washington, D.C.: September 17, 2013.

Information Technology: Additional Executive Review Sessions Needed  to Address Troubled Projects. GAO-13-524. Washington, D.C.: June 13,  2013.

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.


Question-summary annotations: questions: question: What must the DHS demonstrate to address management challenges?
answer: Key to addressing the department's management challenges is DHS demonstrating the ability to achieve sustained progress across 30 actions and outcomes that GAO identified and DHS agreed were needed to address the high-risk area.
child_questions: question: To what extent has DHS addressed these actions?
answer: GAO found in its 2015 high-risk update report that DHS fully addressed 9 of these actions and outcomes, while work remains to fully address the remaining 21.
child_questions: question: What was found about the implementation of the 9 actions the DHS addressed fully?
answer: Of the 9 actions and outcomes that DHS has addressed, 5 have been sustained as fully implemented for at least 2 years. For example, DHS fully met 1 outcome for the first time by obtaining a clean opinion on its financial statements for 2 consecutive years.

question: What actions have been mostly addressed?
answer: DHS has also mostly addressed an additional 5 actions and outcomes, meaning that a small amount of work remains to fully address them.

question: What of the DHS's addressing of the remaining actions?
answer: However, DHS has partially addressed 12 and initiated 4 of the remaining actions and outcomes. For example, DHS does not have modernized financial management systems, a fact that affects its ability to have ready access to reliable information for informed decision making.
child_questions: question: What process should DHS take in addressing these actions?
answer: Addressing some of these actions and outcomes, such as modernizing the department's financial management systems and improving employee morale, are significant undertakings that will likely require multiyear efforts. In GAO's 2015 high-risk update report, GAO concluded that in the coming years, DHS needs to continue to show measurable, sustainable progress in implementing its key management initiatives and achieving the remaining 21 actions and outcomes.

questions: question: On what kinds of government operations has GAO reported?
answer: GAO has regularly reported on government operations identified as high risk because of their increased vulnerability to fraud, waste, abuse, and mismanagement, or the need for transformation to address economy, efficiency, or effectiveness challenges.

question: Why was DHS designated as high risk?
answer: In 2003, GAO designated implementing and transforming DHS as high risk because DHS had to transform 22 agencies into one department, and failure to address associated risks could have serious consequences for U.S. national and economic security.
child_questions: question: How has DHS progressed since being designated as high risk?
answer: While challenges remain for DHS across its range of missions, it has made considerable progress.
child_questions: question: How have DHS's changes altered GAO's work?
answer: As a result, in its 2013 high-risk update, GAO narrowed the scope of the high-risk area to focus on strengthening and integrating DHS management functions (human capital, acquisition, financial, and information technology).

question: On what does this statement report?
answer: As requested, this statement discusses, among other things, DHS's progress and actions remaining in strengthening and integrating its management functions.
child_questions: question: On what is it based?
answer: This statement is based on GAO's 2015 high-risk update and reports and testimonies from September 2011 through February 2015. Among other things, GAO analyzed DHS strategies and interviewed DHS officials.