Inspectors General: DHS OIG's Structure, Policies, and Procedures Are Consistent with Standards, but Areas for Improvement Exist
Released: 2014-09-24T00:00:00

Letter

Background

On November 25, 2002, President Bush signed the Homeland Security Act of 2002, as amended, officially establishing DHS, with the primary mission of protecting the American homeland. DHS became operational on January 24, 2003. On March 1, 2003, under the President’s reorganization plan, 22 agencies and approximately 181,000 employees were transferred to the new department.

DHS is currently organized into the components shown in table 1, seven of which are referred to as key operational components.

According to DHS, the seven key operational components lead the department’s frontline activities to protect the nation. The other remaining DHS components provide resources, analysis, equipment, research, policy development, and support to ensure that the frontline organizations have the tools and resources to accomplish the DHS mission. The department’s five key mission areas are (1) preventing terrorism and enhancing security, (2) securing and managing the nation’s borders, (3) enforcing and administering the nation’s immigration laws, (4) safeguarding and securing cyberspace, and (5) ensuring resilience to disasters. In fiscal year 2013, DHS had about 226,000 full-time equivalent staff, and its budgetary resources totaled approximately $91 billion.

DHS Office of Inspector General

Over three decades ago, Congress established independent IG offices throughout the federal government as a result of growing reports of serious and widespread internal control breakdowns resulting in monetary losses and reduced effectiveness or efficiency in federal activities. The IG Act established IG offices at major departments and agencies, including DHS, to prevent and detect fraud, waste, abuse, and mismanagement in their agencies’ programs and operations; to conduct and supervise audits, inspections, and investigations; and to recommend policies to promote economy, efficiency, and effectiveness. As required by the IG Act, the DHS IG is presidentially appointed and confirmed by the Senate. The DHS OIG consists of several different component offices, as described in table 2.

IG Independence Requirements

The IG Act provides specific protections to IG independence that are necessary largely because of the unusual reporting requirements of the IGs, who are subject to the general supervision and budget processes of the agencies they audit while at the same time being expected to provide independent reports of their work to Congress. Protections to IG independence include a prohibition on the ability of the agency head to prevent or prohibit the IG from initiating, carrying out, or completing any audit or investigation. This prohibition is directed at helping to protect the OIG from external forces that could compromise its independence. Although these protections apply to the DHS OIG, exceptions exist for the Secretary of DHS when certain sensitive information or situations are involved.independent to knowledgeable third parties is also critical when the IG makes decisions related to the nature and scope of audit and investigative work performed by the OIG.

The IG’s personal independence and the need to appear An independent and reliable OIG structure firmly established at federal agencies is important for ensuring effective oversight of programs and operations. Auditors who work for OIGs are required to adhere to independence standards included in Government Auditing Standards, also known as generally accepted government auditing standards. Government Auditing Standards states that an audit organization and individual auditor must be free from impairments to independence and must avoid the appearance of an impairment. Auditors and audit organizations must maintain independence so that their opinions, findings, conclusions, judgments, and recommendations will be impartial and be viewed as impartial by objective third parties with knowledge of the relevant information. This requires staff to act with integrity, exercise objectivity and professional skepticism, and avoid circumstances or threats to independence that would cause a reasonable and informed third party to believe that an OIG’s work had been compromised.

In addition, to the extent legally permitted and not inconsistent with Government Auditing Standards, federal OIGs are required, as appropriate, to adhere to the quality standards promulgated by CIGIE. These standards include requirements for OIGs, including OIG employees who work on investigations and inspections, to maintain their independence. For additional information on quality and independence standards for OIGs, see appendix II.

GAO-12-331G.

DHS OIG’s Audit and Inspection Reports Provided Coverage of Key Component Agencies, Management Challenges, and High-Risk Areas

During fiscal years 2012 and 2013, the DHS OIG issued 361 audit and inspection reports. These reports provided coverage of all DHS key operational components, management challenges, and high-risk areas. According to the OIG, the majority of its audits and inspections were performed in response to congressional mandates or requests, while others were planned by the OIG based on factors such as the department’s strategic plan, which identifies strategic missions and priorities, and by the OIG’s annual performance plan and major management challenges identified for the department.

OIG Reports Covered All DHS Key Components

Our review of issues addressed in the DHS OIG’s audit and inspection reports issued during fiscal years 2012 and 2013 found that the OIG provided oversight of all components that DHS has identified as its key operational components. In addition, several OIG reports covered other DHS components, multiple components, and department-wide issues, as shown in table 3.

As table 3 illustrates, the majority of the OIG’s audit and inspection reports issued in fiscal years 2012 and 2013 addressed issues at the Federal Emergency Management Agency (FEMA). Specifically, 200 of these reports (55 percent) pertained solely to FEMA. Of these 200 reports, 166 reports involved audits of FEMA grants, including 118 reports on Disaster Assistance Grants. According to OIG officials, the large number of FEMA audits can be attributed to a number of factors. For example, the OIG has a statutory mandate to annually conduct audits of a sample of states and high-risk urban areas that receive grants administered by DHS to prevent, prepare for, protect against, or respond to natural disasters, acts of terrorism, and other disasters.FEMA’s programs are considered to have a higher financial risk than those of other DHS components because it distributes disaster relief funds to so many communities nationwide—for example, as of May 2014, over 135,000 applicants (e.g., local governments and nonprofit In addition, organizations to which public assistance funds are awarded) were receiving disaster assistance. Moreover, FEMA has the largest budget of all DHS components, with total budgetary resources of over $36 billion for fiscal year 2013, or about 38 percent of the department’s total budget. In addition, the OIG received $27 million from the Disaster Relief Fund in fiscal year 2013 specifically for conducting audits and investigations related to disasters.

OIG Reports Covered All Reported DHS Management Challenges and High-Risk Areas

Of the 361 audit and inspection reports issued during fiscal years 2012 and 2013, we found that 355 OIG reports pertained to the department’s management challenges reported by the OIG. OIGs began annually identifying management challenges (i.e., what the IG considers to be the most serious management and performance challenges facing the agency) for their respective departments or agencies in 1997 at the request of Congress and continue to do so based on requirements of the Reports Consolidation Act of 2000.to include their IGs’ lists of significant management challenges in their annual performance and accountability reports to the President, the Office of Management and Budget, and Congress. DHS reports this information in its annual agency financial report. As shown in table 4, the OIG reports issued during fiscal years 2012 and 2013 covered all nine management challenges identified for that time period.

Structure of DHS OIG Is Consistent with the IG Act, but Certain Policies and Procedures Could Be Improved

The DHS OIG’s organizational structure includes all of the positions required by the IG Act, as well as several nonstatutory positions that help the OIG carry out its responsibilities. According to the OIG, changes to the OIG’s structure made during fiscal year 2013 were intended to help further strengthen its organizational independence. The OIG also has policies and procedures designed to carry out most of the responsibilities required by the IG Act. However, we identified three areas—coordinating with the FBI, protecting employees’ identities, and obtaining legal advice—in which the OIG’s policies and procedures could be improved to better meet its responsibilities.

DHS OIG Organizational Structure Is Consistent with Provisions of the IG Act

The IG Act requires that each OIG have certain specific positions in its organization. First, for cabinet departments and certain major agencies, it requires that each OIG be headed by an IG appointed by the President and confirmed by the Senate. The act also requires that each IG appoint or designate certain other positions, including an Assistant IG (AIG) for Audits, an AIG for Investigations, and a Whistleblower Protection Ombudsman.

The IG Act also requires that each IG obtain legal advice from a counsel either reporting directly to the IG or to another IG. In addition, a special provision for the DHS OIG requires the IG to designate a senior official to carry out responsibilities related to receiving and investigating complaints that allege abuses of civil rights or civil liberties.

The DHS OIG has all of the positions required by the IG Act, which are highlighted in the OIG’s organization chart in figure 1.

For example, the DHS OIG has its own Office of Counsel, which is currently headed by a Deputy Counsel to the IG. Furthermore, in January 2012, the OIG issued a policy directive that designated the position of the AIG for Investigations as the Civil Rights and Civil Liberties Coordinator for investigative matters. In November 2012, the former Acting IG designated an individual within the Office of Investigations as the acting Whistleblower Protection Ombudsman with a goal of improving the availability of whistleblower protection information to employees throughout the department. In August 2013, after this function was transferred to the Office of Integrity and Quality Oversight (IQO), the same person became the permanent Whistleblower Protection Ombudsman.

The DHS OIG has created several other senior positions in addition to those required by the IG Act, which are also shown in figure 1. As of July 2014, these positions include the Deputy IG and Chief of Staff within the OIG executive office, who provide executive leadership to the OIG. In addition, the OIG has AIGs to lead its Offices of Emergency Management Oversight, Information Technology Audits, Inspections, Integrity and Quality Oversight, and Management. As discussed further below, the Deputy IG position has been vacant since December 2013 and all of the AIGs report directly to the IG as of July 2014.

Several Key OIG Positions Had Extended Vacancies

While the OIG’s organizational structure appears reasonable and includes the positions required by the IG Act, at the time of our audit, several of its key positions had not been filled with permanent employees for extended periods of time or had only recently been filled. In November 2013, the Senate held a hearing related to this issue in which the Ranking Member of the Subcommittee on Efficiency and Effectiveness of Federal Programs and the Federal Workforce, Committee on Homeland Security and Governmental Affairs noted that vacancies in the IG and several key OIG For example, the IG positions left the agency without proper leadership.position was either occupied by an acting IG or vacant from February 27, 2011, through March 5, 2014. Specifically, with the former IG’s resignation in February 2011, the Secretary designated the Deputy IG as the Acting IG who served in that position until January 2013, when he reached the statutory time limit for serving as an acting officer.point, the Acting IG reverted back to the title of Deputy IG, while still remaining the de facto head of the OIG. Because the Deputy IG was the head of the organization during that time, a Chief Operating Officer position was created in March 2013 to assume the functions that would otherwise be carried out by the Deputy IG when the IG position was filled. The Deputy IG once again became Acting IG in November 2013, when an IG was nominated, until his resignation in December 2013. Upon the Acting IG’s resignation, the Chief Operating Officer served as the head of the OIG until a new IG was confirmed by the Senate on March 6, 2014, and assumed the post on March 10, 2014. The Chief Operating Officer retired in April 2014 and the position was eliminated in July 2014.

Other executive positions within the OIG were also filled by acting staff for extended periods, including the following:

The Counsel to the IG had been vacant and filled by an Acting Counsel since December 2012 and remained so as of September 2014.

The AIG for Investigations was acting for 1 year before becoming permanent in May 2013.

The Office of Inspections has had an Acting or vacant AIG position since August 2012, except for approximately 2-½ months in early 2013 when it had an AIG.

Changes to Organizational Structure Are Intended to Improve OIG Independence

In January 2013, the OIG’s Office of Management evaluated the organizational structure of the OIG in regard to critical issues it was facing, including two situations that occurred in 2011 and 2012 that potentially threatened the credibility and independence of the OIG. One incident, which is detailed later in this report, arose from a conflict of interest with the former Acting IG, who had a family member who worked for a DHS unit associated with six audits or inspections, and required the reissuance of the associated reports. As a result of the OIG’s Office of Management’s study of this incident, the Chief Operating Officer position was created, as previously mentioned, to take on the normal duties of the second-in-command while either the Deputy IG or IG position was vacant. This included reviewing reports from which the former Acting IG had recused himself in order to avoid future conflicts of interest and to improve OIG independence.

The second incident resulted from a lack of independence of an inspection team from the Office of Investigations that was conducting an internal inspection of an Office of Investigations field office in September 2011. The Department of Justice subsequently investigated this incident, and a grand jury issued an indictment in April 2013 against two employees in the Office of Investigations field office. The defendants were accused of falsifying documents prior to the internal inspection in order to impede, obstruct, and influence the inspection and conceal from the inspectors severe lapses in the field office’s compliance with the OIG’s investigative standards and internal policies. In March 2014, a federal court found one of the employees guilty of conspiracy and five counts of falsifying government documents. As a result of the OIG’s Office of Management’s study related to this incident, the DHS OIG established IQO in the summer of 2013 to enhance its organizational independence and oversight of its operations. According to OIG officials, this office was established to foster a more efficient and responsive OIG, revitalize oversight efforts, and better serve employees. At the time of our review, IQO was taking over various quality control functions previously carried out by other OIG offices. Specifically, IQO was given responsibility for the following functions: Internal inspections of the OIG’s audit, inspection, and investigation offices, which were previously conducted by the Offices of Management and Investigations.

Quality review of draft audit and inspection reports, which was previously done primarily by a report reviewer in the executive office. The same individual will continue reviewing reports but is now part of IQO.

Complaint intake, including the OIG hotline and whistleblower protection functions, which was previously conducted by the Office of Investigations.

Ombudsman for OIG employees, which was also previously under the Office of Investigations and at that time was only set up to address concerns of Office of Investigations personnel.

OIG officials indicated that the Hotline and Whistleblower Protection functions would be in a better position to protect confidentiality and have better visibility if they were separate from the Office of Investigations as is the case in many similar organizations. In addition, IQO officials said that they were taking steps to strengthen both the Ombudsman and Whistleblower Protection functions by developing formal policies for these positions and providing training about these functions to the entire department. The establishment of IQO is a positive step toward improving the OIG’s organizational independence for the reasons cited by the OIG and because it provides a separation of duties where independence problems previously existed.

DHS OIG’s Roles and Responsibilities Are Generally in Accordance with the IG Act

The DHS OIG’s policies and procedures contained in its manuals and directives indicate that the OIG’s roles and responsibilities are generally consistent with selected requirements of the IG Act. Provisions of the IG Act include requirements that IGs carry out the following responsibilities, among others:

Conduct audits and investigations related to department programs and operations.

Receive and investigate complaints or information from DHS employees regarding possible violations of law, rules, or regulations, or mismanagement, waste, abuse, or substantial danger to public health and safety.

Maintain oversight responsibility for internal investigations performed by DHS components, such as the U.S. Secret Service, U.S. Immigration and Customs Enforcement (ICE), and U.S. Customs and Border Protection (CBP).

Establish and maintain a direct link on the home page of the OIG website for individuals to report fraud, waste, and abuse.

Recommend policies for, and conduct, supervise, or coordinate activities for, promoting economy, efficiency, and effectiveness in the administration of the department’s programs and operations or preventing and detecting fraud and abuse.

Report expeditiously to the Attorney General whenever the IG has reasonable grounds to believe there has been a violation of federal criminal law.

As discussed further in appendix III, we found that the DHS OIG had established policies and procedures to carry out these and other selected requirements of the IG Act. Specifically, the OIG had manuals containing detailed policies and procedures to follow in carrying out its audits, inspections, and investigations. For example, the manual for the Office of Investigations—the Special Agent Handbook—included policies and procedures for receiving and investigating complaints.

While most of the OIG’s roles and responsibilities are consistent with the IG Act, we identified three areas—coordinating with the FBI, protecting employees’ identities, and obtaining legal advice—in which the OIG could improve its policies and procedures to be more effective in meeting the OIG’s mission objectives.

OIG Lacks Agreement with the FBI for Coordination on Border Corruption Investigations

Although the OIG has a policy for notifying the FBI of any criminal investigations that it or another DHS component opens, it does not have an agreement with the FBI for sharing other information or otherwise coordinating efforts with the FBI on tips or allegations related to border corruption that are not under investigation. The IG Act requires OIGs to recommend policies for, and to conduct, supervise, or coordinate relationships between, the OIG and other federal agencies with respect to the identification and prosecution of participants in fraud or abuse. According to Attorney General Guidelines, OIGs have primary responsibility for preventing and detecting waste and abuse and concurrent responsibility with the FBI for preventing and detecting fraud and other criminal activity within their agencies and their agencies’ programs.

Congress has repeatedly expressed concern about border corruption and has held hearings on this issue. For example, in June 2011, the Senate held a hearing on CBP and the OIG’s collaboration in the fight to prevent border corruption. The hearing included a discussion of OIG efforts to work with the FBI as well as CBP in preventing corruption among federal employees involved in protecting the U.S. borders. To investigate corruption among employees of agencies involved in protecting the U.S. border, the FBI has established several local border corruption task forces (BCTF), many of which operate along the southwest border. The OIG participates in local BCTFs both in the southwest and other locations. In addition, the FBI established the National BCTF to help provide guidance and oversight of the local BCTFs. To facilitate the operation of the National BCTF, in 2010, the FBI signed a memorandum of understanding (MOU) with CBP and the Transportation Security Administration. Although the OIG has agents assigned to the BCTFs, OIG officials stated that they did not sign this MOU because the ongoing dialogue has not yielded an agreement that recognizes the OIG’s statutory authority and adequately delineates the roles and responsibilities of all parties involved, including the DHS components. OIG officials also stated that they could not reach agreement on sharing information with the FBI because, in their view, the proposed agreement was not sufficient to ensure mutual information sharing between the OIG and the FBI.

Since at least 2010, the OIG and FBI have been working to reach agreement on an MOU to describe how the parties would work together, along with other DHS components, on the National BCTF. OIG officials told us that since a permanent AIG for Investigations was designated in May 2013, he has been making efforts to improve relationships. For example, the AIG for Investigations has had more meetings with the FBI and DHS components involved in the National BCTF, such as CBP and ICE, to discuss coordination and information-sharing efforts as well as ways to reach agreement on a BCTF MOU. The AIG for Investigations is also in support of the National BCTF and is working diligently with the FBI to reach an agreement, but stated that he believes that the information to be shared needs to be clearly defined and that the FBI must also agree to share information.

Until the OIG and FBI reach agreement on working collaboratively, they are at risk of duplicating efforts or missing opportunities for taking effective action against border corruption. Recognizing this risk, the Senate Committee on Appropriations report for the DHS appropriations bill, 2014, directed the DHS Deputy Secretary—jointly with the OIG, CBP, and ICE—to report not later than March 17, 2014, on specific steps being taken to further address the process for investigating cases of corruption and the plan to work as a unified DHS with the FBI’s BCTF. In addition, the Senate Committee on Appropriations report for the DHS appropriations bill, 2015, directed the DHS Deputy Secretary—jointly with the OIG, CBP, and ICE—to submit a status update report on the same issues no later than 60 days after the enactment of the DHS Appropriation Act, 2015.

OIG Lacks Adequate Controls to Protect Identities of Employees Filing Complaints

The OIG receives and reviews complaints filed by DHS employees and the public regarding allegations of misconduct, including criminal misconduct, by DHS employees. It receives these complaints both directly from employees as well as through DHS components, where some complaints are initially filed. However, the OIG’s process for handling complaints that it receives directly from employees does not include adequate internal controls to provide reasonable assurance that the identities of employees who file complaints and request confidentiality will be protected. The IG Act requires that IGs shall not, after receipt of a complaint or information from an employee, disclose the identity of the employee without his or her consent unless the IG determines that such disclosure is unavoidable during the course of an investigation. Consistent with the IG Act, OIG policy requires not disclosing the identities of employees who file complaints. However, the OIG’s process for recording complaints and forwarding them to DHS components when necessary involves certain manual procedures usually carried out by only one OIG complaint intake employee per complaint without supervisory review. This process can be subject to human error; consequently, the OIG is at higher risk of not being able to ensure that employees’ identities will be protected.

During fiscal year 2013, according to OIG data provided to us, about 50 percent of the complaints received by the OIG came through the Joint Intake Center run by CBP and ICE and another 6 percent were received from other DHS components. The rest of the complaints were received directly from complainants through the OIG’s website or by e-mail, fax, or phone. Complaints received through the website (about 15 percent) are automatically recorded into the OIG’s complaint database, the Enforcement Data System, while complaints received through all other means, including those from the Joint Intake Center, must be manually recorded in the Enforcement Data System.

Although the transfer of complaint information from the OIG’s website into the Enforcement Data System is more automated than complaints from other sources, the website lacks certain controls that could result in the inadvertent disclosure of employees’ identities. For example, when filing a complaint on the website, if an employee does not want to allow full disclosure of his or her identity, an employee can choose to be (1) anonymous or (2) confidential. However, the website lacks certain controls over these two categories. For example, see the following:

The anonymous category is intended to mean that the complainant does not have to supply any identifying information. To select anonymous, a complainant can check a box on the website. However, after complainants make this selection, the website still allows complainants to provide their names and other personal information, which could potentially be disclosed.

The confidential category is intended to mean the employee provides identifying information but does not want it released outside of the OIG. If an employee wants confidentiality rather than anonymity, the employee must write in the request for confidentiality on the website form because the website does not have a box to check for this type of complaint. As a result, even though the Enforcement Data System includes a “complaint confidential” box, a request for confidentiality on the website does not automatically record this request in the Enforcement Data System. Therefore, requests for confidentiality depend on the analyst who subsequently reviews the complaint manually marking the correct box in the system.

Regardless of how a complaint is received, when a complaint is recorded in the Enforcement Data System, it is initially reviewed by a complaint intake analyst who determines if the complaint should be forwarded to a field office of the OIG Office of Investigations in the complainant’s jurisdiction. If it is forwarded, an OIG investigator in that office reviews the complaint and decides whether to open an investigation on it. If the OIG decides not to investigate the complaint, and the complaint was received through the Joint Intake Center or another DHS component, a complaint intake analyst will usually send it back to the component without first notifying the complainant since the component has already had access to the complaint information. However, if the complaint was received directly from an employee rather than through a DHS component (e.g., OIG website, e-mail, fax, or phone), the intake analyst will send an e-mail to the employee requesting his or her consent to forward the complaint to the DHS component. If the employee provides consent, the analyst forwards the complaint to the component via e-mail. If an employee does not provide consent, the complaint may still be sent to the component but without any identifying information. However, there is no secondary check of this manual process, such as a supervisory review. As a result, the protection of an employee’s identity depends on the accuracy and integrity of the individual processing the complaint. Without additional controls, the OIG could inadvertently disclose employees’ identities without their consent. Such disclosure can put employees at risk of retaliation by the DHS components in which they work and could discourage other employees from filing complaints. Officials in IQO said that they were aware of these issues and that they were developing standard operating procedures and considering improvements to the website and the Enforcement Data System to better protect employees’ identities, but they did not indicate when these would be complete.

OIG Lacks Guidelines for Obtaining Legal Advice

While the OIG has its own Office of Counsel, it sometimes also obtains advice or discusses legal issues with the department’s counsel. As previously discussed, the IG Act requires that an IG obtain legal advice from either a counsel reporting directly to the IG or a counsel reporting to another IG. However, the act does not preclude an IG from obtaining advice from its respective department’s counsel if appropriate. For example, it may be appropriate for the IG to consult the department’s counsel for legal advice regarding certain personnel practices if the OIG is subject to the human capital laws or regulations of the department or regarding ethics issues if the designated ethics official is a department employee.

In its recent report on an investigation into allegations of misconduct by the former Acting IG, the Subcommittee on Financial and Contracting Oversight, Senate Committee on Homeland Security and Governmental Affairs, reported that the former Acting IG inappropriately sought advice from the department’s counsel, according to former OIG officials.interviewed former and current OIG officials and reviewed various e-mails provided that indicated the former Acting IG sought legal advice from a counsel at the department on several occasions. In general, we found the consultations were likely acceptable and appropriate as the legal matter appeared to be under the department’s purview. However, in one e-mail the former Acting IG stated that he had lost confidence in his counsel and wanted legal help from a counsel at the department for the next 4 months. Because the former Acting IG’s request did not specify the type of legal assistance needed, it was not clear whether his request or any subsequent legal assistance received was for appropriate matters. The OIG did not have a policy stating the legal requirement for the IG to obtain legal advice from either the IG’s counsel or from counsel reporting to another IG, nor did it have any guidelines specifying the circumstances in which it would be appropriate for the OIG to consult with the department’s counsel. Having such a policy and guidelines could help avoid any potential impairment to independence when seeking legal advice. The OIG’s Deputy Counsel stated that he was considering whether to develop a policy and that he has asked a working group to draft guidelines on consultations between the OIG and the department’s counsel.

DHS OIG’s Policies and Procedures Were Consistent with Applicable Independence Standards, but Effective Implementation Is Key

Independence is one of the most important elements of a strong OIG function as it helps to ensure that an IG’s work is viewed as impartial by agency personnel, Congress, and the public. The DHS OIG’s policies and procedures indicated that the OIG staff were expected to comply with both generally accepted government auditing standards (GAGAS) and CIGIE independence standards. Each of the OIG’s oversight functions— audits, inspections, and investigations—had its own manual of policies and procedures that was consistent with applicable independence standards. However, the procedures for ensuring compliance with these standards varied among the different functions.

Audit Policies and Procedures Were Consistent with Independence Standards but Have Not Been Consistently Followed

Three offices within the DHS OIG conduct audits—the Offices of Audits, Information Technology Audits, and Emergency Management Oversight. Officials from each of these offices said that their operations are guided by DHS’s OIG Audit Manual, which refers to GAGAS and CIGIE independence standards and provides guidance consistent with these standards. In addition, each of their audit reports includes a statement about the audit’s compliance with GAGAS.

The OIG Audit Manual describes the OIG’s quality assurance and control system that, according to the manual, provides the controls necessary to ensure that GAGAS audits are conducted in accordance with applicable auditing standards and internal policies and guidance. For example, the manual requires supervisory and management reviews of audit documentation and resulting reports prior to issuance. The manual states that the AIG for each audit office is responsible for ensuring implementation of these controls. Other parts of the OIG’s quality control system described in the manual include annual internal quality control reviews of audit offices and reports, as well as external peer reviews of audit operations by an independent federal OIG at least once every 3 years.

The OIG Audit Manual describes how OIG audit staff should document their independence. For auditors at the director level and below, the manual requires staff to document their independence biweekly in the OIG’s Time and Tracking System. For senior executives, including the IG, Deputy IG, Chief of Staff, AIGs, and others involved in reviewing audit reports, the manual requires documentation of their independence once a year when they complete ethics training and financial disclosure forms. The manual further states that each office will maintain these annual certifications of independence, but does not require the certifications to be centrally maintained and monitored for compliance. Procedures for each of the three audit offices regarding annual certificates varied. For example, the Office of Audits said that it maintained annual independence certificates for its division directors as well as senior executives, while the Office of Emergency Management Oversight only maintained them for its senior executives (the AIG and Deputy AIG). The Office of Information Technology Audits said that instead of signing annual certifications, its senior executives sign independence certifications for every audit they work on, consistent with procedures for its audit staff. While the audit offices told us they maintained independence certificates centrally within each office, the OIG executive office, which consisted of four senior executives at the time of our audit, indicated that it did not do so. In response to our February 2014 request for copies of certificates for the senior executives in the front office, an OIG official gathered certificates from the individuals. Two of the certificates were signed after we requested them, and according to the official, a certificate could not be found for the Acting IG who had recently left the OIG. Similarly, both the internal quality reviews and peer reviews conducted from 2009 through 2012 identified instances in which employees, including some senior executives, had not documented their independence in accordance with the OIG Audit Manual, although these instances were not deemed significant enough to prevent the audit offices from passing these reviews.

If senior officials do not comply with the OIG Audit Manual requirement to sign annual certificates of independence or maintain them centrally in order to monitor compliance, they might not be aware of potential threats to independence or be as familiar with GAGAS or CIGIE independence requirements as they should be. For example, as a result of an impairment to the former Acting IG’s independence that was not identified in a timely manner, several audits and inspections were affected in fiscal year 2012. Specifically, a total of six reports from the Offices of Audits, Information Technology Audits, and Inspections were reissued to include a statement about an impairment of independence in appearance resulting from a family member of the former Acting IG being employed by an entity within DHS associated with these audits and inspections. In addition, because of the same impairment, one other audit was terminated without a report being issued. According to audit staff, they inadvertently became aware of the former Acting IG’s impairment in July 2012 as a result of an audit official hearing about the employment of the family member from a source outside of the OIG.

In addition, a number of other allegations of abuse of power and misconduct were made against the former Acting IG, including failure to uphold the independence and integrity of the DHS OIG office. These issues, among others, were to be the subject of a Subcommittee on Financial and Contracting Oversight, Senate Committee on Homeland Security and Governmental Affairs, hearing scheduled for December 2013 that was canceled after the former Acting IG resigned on December 16, 2013, and transferred to another office within DHS. In April 2014, the subcommittee issued a report on its investigation into the This investigative allegations of misconduct by the former Acting IG.report detailed the subcommittee’s findings of its investigation into the allegations, including some actions that it said jeopardized OIG independence. For example, the subcommittee found that the former Acting IG had directed the alteration or delay of some reports at the request of senior DHS officials and that he did not obtain independent legal advice. Subsequent to the issuance of the subcommittee report, the new DHS Secretary put the former Acting IG on administrative leave pending other investigations.

While signing a certificate of independence might not have prevented these independence issues, it could nevertheless serve as a reminder of individual responsibilities and potential threats to independence. Further, because certificates of independence are not maintained centrally, management’s ability to monitor compliance with independence requirements and obtain reasonable assurance that controls are in place and operating as intended is hindered. However, as stated in Standards for Internal Control in the Federal Government, no matter how well designed and operated, internal control cannot provide absolute assurance that all agency objectives will be met. Factors outside the control or influence of management, such as human error or acts of collusion to circumvent controls, can render policies and procedures ineffective.

Inspection Policies and Procedures Were Consistent with Independence Standards

According to OIG officials, the DHS OIG’s Office of Inspections follows guidance in CIGIE’s Quality Standards for Inspection and Evaluation. In addition, DHS’s OIG Inspections Manual states that inspectors are expected to be knowledgeable of, and to abide by, the performance standards, including independence, described in CIGIE’s quality standards. The OIG Inspections Manual includes guidance on independence that is consistent with CIGIE standards although not as detailed. For example, the manual states that while conducting an inspection, all team members have a responsibility to maintain independence so that opinions, conclusions, judgments, and recommendations will be impartial and viewed as such by knowledgeable third parties.

Neither CIGIE’s quality standards nor the OIG Inspections Manual requires external peer reviews of OIG inspection activities. However, CIGIE’s quality standards states that an OIG should have quality control mechanisms that provide an independent assessment of inspection processes and work. To help assess the inspection processes and work, in 2006, the AIG for Inspections requested an independent external review of three inspections. Each inspection was reviewed by a different OIG, and the reviews focused on the quality of work performed for each inspection. None of the reports from these external reviews identified any independence concerns. More recently, in February 2014, the OIG completed its first internal quality review of the Office of Inspections. The resulting report indicated that the Office of Inspections materially complied with CIGIE’s quality standards, and the report did not identify any issues with respect to independence.

Investigation Policies and Procedures Were Consistent with Independence Standards

According to DHS OIG officials, OIG investigations are conducted in accordance with CIGIE’s Quality Standards for Investigations. In addition, the Office of Investigations has its own manual—the Special Agent Handbook—which states that investigations will be conducted in accordance with CIGIE’s standards as well as Attorney General Guidelines for OIGs. CIGIE standards for investigations include requirements on independence that are similar to those for audits. The Special Agent Handbook includes guidance on ethical conduct and conflicts of interest, specifically stating that if a special agent suspects that a conflict of interest exists or that there might be an appearance of a conflict of interest, the agent should notify the Special Agent in Charge as soon as possible.

The DHS OIG Office of Investigations passed peer reviews by the Social Security Administration OIG and the Department of Defense OIG in 2009 and 2013, respectively. Neither of these peer reviews included any issues regarding independence or conflicts of interest. In addition, the Office of Investigations conducted its own internal inspections in the past. None of the internal inspection reports from fiscal years 2011 and 2012 identified any issues with respect to independence. However, because of serious concerns about the independence of the internal inspection function carried out by the Office of Investigations as previously discussed, the OIG decided to create IQO in 2013 and move this function to that office. OIG officials told us that the Special Agent Handbook is being updated, in part, as a result of the transfer of some functions, such as complaint intake, to IQO.

Conclusions

The DHS OIG’s organizational structure has the positions required by the IG Act to carry out its various responsibilities. However, the lack of an appointed IG for 3 years may have contributed to a number of other senior positions being filled with “acting” individuals for extended periods of time. The OIG has made some meaningful changes to its structure to try to address concerns about the integrity and independence of the OIG. The establishment of IQO is intended to enhance the OIG’s ability to carry out functions such as complaint intake and whistleblower protection, including helping to ensure that these functions maintain their independence. However, the DHS OIG process for recording and referring complaints received directly from DHS employees does not provide reasonable assurance that employees’ identities are protected, as required by the IG Act. In addition, the important role that the OIG plays in receiving and investigating allegations of criminal activity within the department can be enhanced through better coordination and information sharing with the FBI. OIG officials intend to continue working toward improved coordination with the FBI and provided input to a DHS report with their plans, as directed by the Senate. In light of the congressional direction to DHS, we are not making a recommendation on this matter at this time. Furthermore, although the IG has its own counsel as required by the IG Act, the OIG did not have a policy to address the legal requirements related to obtaining advice from legal counsel. While the DHS OIG has appropriate policies and procedures in place to comply with independence standards, even the best control procedures cannot always guarantee that standards are being met. Although the former Acting IG was required to sign an annual certificate of independence reminding him of independence requirements, the OIG did not have a policy that these certificates be collected and maintained centrally, which would improve management’s ability to monitor compliance with independence requirements.

Recommendations for Executive Action

We recommend that the OIG take the following three actions:

To improve its intake and complaint processing function, we recommend that the OIG design and implement additional controls, which may include additional automated controls and supervisory review, to provide reasonable assurance that employees’ identities are not disclosed without their consent when forwarding complaints to DHS components.

To help avoid any impairment to independence when seeking legal advice, we recommend that the OIG develop a policy for obtaining legal advice from counsel reporting either directly to the IG or another IG and work with the IG’s counsel to establish guidelines for when it would be appropriate for the OIG to consult with the department’s counsel.

To help ensure that senior executives are aware of independence requirements so that they are able to identify and mitigate any threats to their independence, we recommend that the OIG revise its guidance in the OIG Audit Manual to require signed annual certificates of independence to be collected and maintained centrally in order to monitor compliance.

Agency Comments and Our Evaluation

We provided a draft of this report to the DHS Inspector General for review and comment. In written comments, which are reprinted in appendix IV, the OIG generally agreed with our conclusions and concurred with all of our recommendations. In addition, the OIG provided technical comments that we incorporated into the report as appropriate. We also provided the FBI with an excerpt of the draft report related to its coordination with the OIG on border corruption investigations. The FBI did not have any comments.

The OIG described actions planned and under way to address each of our recommendations. Specifically, the OIG stated that it is revising its online allegation form to (1) ensure complainants do not inadvertently provide personal data when their intent was to remain anonymous and (2) simplify and clarify to complainants the distinctions between filing an anonymous complaint versus filing a confidential complaint. The OIG anticipates completing the changes to the online allegation form within 90 days of its letter. According to the OIG, it has also implemented supervisory controls to provide oversight and quality control of intake analysts’ work, including the movement or referral of complaints to DHS components. The OIG also stated that it plans to develop policy and guidelines within 90 days of its letter to describe the circumstances under which the IG can obtain legal advice from DHS’s Office of Legal Counsel. In addition, the OIG plans to revise its audit manual by October 31, 2014, to require the Office of Integrity and Quality Oversight to collect and maintain senior executives’ signed annual independence statements. If implemented effectively, the OIG’s planned actions should address the intent of our recommendations.

We are sending copies of this report to appropriate congressional committees, the Secretary of Homeland Security, and the DHS Inspector General. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staffs have any questions about this report, please contact me at (202) 512-9869 or khana@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff members who made key contributions to this report are listed in appendix V.

Appendix I: Objectives, Scope, and Methodology

The joint explanatory statement accompanying the Department of Homeland Security (DHS) Appropriations Act, 2013, directed GAO to review the Office of Inspector General’s (OIG) organizational structure and whether its audit, investigation, and inspection functions are organizationally structured to ensure that independence standards are met. To meet the committee’s time frames established in the explanatory statement, we briefed committee staffs on our preliminary observations in November 2013. This report provides the results of our review to determine (1) the coverage that the OIG’s audits and inspections provided of DHS’s key component agencies, management challenges, and high-risk areas; (2) the extent to which the OIG’s organizational structure and roles and responsibilities were consistent with the Inspector General Act of 1978, as amended (IG Act); and (3) the extent to which the design of OIG’s policies and procedures for planning, reviewing, and reporting on audit, inspection, and investigation results was consistent with applicable independence standards.

To determine the coverage that DHS OIG’s audits and inspections provided of DHS’s key component agencies, management challenges, and high-risk areas, we reviewed the DHS agency financial reports for fiscal years 2012 and 2013 to identify DHS’s key operational components. To identify the department’s management challenges, we reviewed the OIG’s annual performance plans for fiscal years 2012 and 2013. To identify the high-risk areas for DHS, we reviewed GAO’s High-Risk Series for 2013. To identify DHS OIG reports issued during fiscal years 2012 and 2013 and the subjects covered in those reports, we reviewed DHS OIG’s semiannual reports. In conducting our analysis, we did not review the coverage provided by investigations because they are generally conducted based on specific allegations of misconduct received and are not planned in advance as audits and inspections are. We compared the agencies and subjects covered in these audit and inspection reports with DHS’s key component agencies, management challenges, and high-risk areas to determine DHS OIG’s oversight coverage of DHS. We also interviewed knowledgeable DHS OIG officials to obtain their comments about the results of our analysis.

To determine the extent to which the organizational structure, roles, and responsibilities of the DHS OIG were consistent with the IG Act, we reviewed DHS OIG’s organization chart, office descriptions, policies related to its roles and responsibilities, memorandums of understanding, and other relevant documents. We also interviewed former and current DHS OIG officials, as well as officials from DHS components, including officials from U.S. Customs and Border Protection, U.S. Immigration and Customs Enforcement, and the Federal Emergency Management Agency, and officials from the Federal Bureau of Investigation (FBI). We analyzed the information from interviews and documentation to determine whether there were any inconsistencies between the information and the applicable IG Act requirements and the reasons for any such inconsistencies. Our review focused primarily on OIG documentation and discussions with OIG officials to assess the design of the OIG’s stated roles and responsibilities. For the most part, we did not review the implementation of these roles and responsibilities except for certain issues that came to our attention—specifically, the lack of a memorandum of understanding with the FBI, the procedures for protecting employee confidentiality, and the nature of OIG consultations with the department’s legal counsel.

To determine the extent to which the design of DHS OIG’s policies and procedures for planning, reviewing, and reporting on audit, inspection, and investigation results was consistent with applicable independence standards, we interviewed DHS OIG officials and reviewed applicable policy, procedure, and planning documents, such as the OIG Audit Manual, OIG Inspections Manual, and Special Agent Handbook. We also reviewed peer review reports of audit and investigative operations as well as reports of internal inspections of investigative activities. We assessed the design of the DHS OIG’s policies and procedures for planning, reviewing, and reporting on audit, investigation, and inspection results and determined whether the design was consistent with applicable independence standards found in Government Auditing Standards and the standards published by the Council of the Inspectors General on Integrity and Efficiency that include Quality Standards for Federal Offices of Inspector General, Quality Standards for Inspection and Evaluation, and Quality Standards for Investigations. We also requested information about which employees signed annual certifications of independence and requested copies of these certifications for selected staff.

We conducted this performance audit from June 2013 to September 2014 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Inspector General Quality and Independence Standards

Quality Standards

Federal inspectors general (IG) have various quality standards to which their offices must adhere in performing their work. The Quality Standards for Federal Offices of Inspector General (referred to as the Silver Book), adopted by Council of the Inspectors General on Integrity and Efficiency (CIGIE), provides the overall quality framework for managing, operating, and conducting the work of offices of inspector general (OIG) and covers critical topics such as independence, ethics, and confidentiality. These quality standards also address planning and coordinating work, maintaining quality assurance, and ensuring internal control. In addition to the Silver Book, federal OIGs have standards for specific types of work. For audits, the Inspector General Act of 1978, as amended requires IGs to carry out work in accordance with generally accepted government auditing standards published in Government Auditing Standards. For investigations and inspections, CIGIE has developed additional standards: Quality Standards for Investigations and Quality Standards for Inspection and Evaluation.

Independence Standards

Government Auditing Standards and CIGIE standards contain provisions covering independence. Government Auditing Standards establishes a conceptual framework that can be used to identify, evaluate, and apply safeguards (such as removing an individual from an audit team or consulting an independent third party) to eliminate the threats to independence or reduce them to an acceptable level. Under Government Auditing Standards, IGs should evaluate the following broad categories of threats to independence: 1. Self-interest: The threat that a financial or other interest will inappropriately influence an auditor’s judgment or behavior. 2. Self-review: The threat that an OIG employee or OIG that has provided nonaudit services will not appropriately evaluate the results of previous judgments made or services performed as part of the nonaudit services when forming a judgment significant to an audit. 3. Bias: The threat that an OIG employee will, as a result of political, ideological, social, or other convictions, take a position that is not objective. 4. Familiarity: The threat that aspects of a relationship with management or personnel of an audited entity, such as a close or long relationship or that of an immediate or close family member, will lead an OIG employee to take a position that is not objective. 5. Undue influence: The threat that external influences or pressures will affect an OIG employee’s ability to make independent and objective judgments. 6. Management participation: The threat that results from an auditor’s taking on the role of management or otherwise performing management functions on behalf of the entity undergoing an audit. 7. Structural: The threat that an OIG’s placement within a government entity, in combination with the structure of the government entity being audited, will affect the OIG’s ability to perform work and report results objectively.

CIGIE’s Quality Standards for Federal Offices of Inspector General closely mirrors the independence language in Government Auditing Standards. For example, it states that IGs and their staffs must be free both in fact and in appearance from personal, external, and organizational impairments to their independence. Further, the IGs and their staffs have a responsibility to maintain independence so that opinions, conclusions, judgments, and recommendations will be impartial and viewed as impartial by knowledgeable third parties. CIGIE also addresses the same seven categories of threats to independence as Government Auditing Standards. CIGIE’s standards specifically for investigations and inspections also include language about the importance of independence; however, they contain far less detail about independence than the overall standards.

Appendix III: DHS OIG’s Policies and Procedures to Address Selected IG Act Requirements

The Inspector General (IG) Act of 1978, as amended requires the independent IGs at major departments and agencies, including Department of Homeland Security (DHS), to carry out specific roles and responsibilities. Table 6 summarizes selected requirements and the DHS Office of Inspector General’s (OIG) procedures for carrying out these requirements.

Appendix IV: Comments from the Department of Homeland Security Office of Inspector General

Appendix V: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Michael LaForge (Assistant Director), Fred Evans, Latasha Freeman, Maxine Hattery, Colleen Heywood, Jackson Hufnagle, Kristi Karls, and Laura Pacheco made significant contributions to this work. Kathryn Bernet, Jacquelyn Hamilton, and Helina Wong also contributed to this report.