Homeland Security: DHS Needs to Improve Ethics-Related Management Controls for the Science and Technology Directorate
Released: 2005-12-22T00:00:00

Letter

Background

The S&T Directorate consists of four offices responsible for managing and executing DHS’s R&D programs: (1) the Office of Programs, Plans and Budgets (PPB); (2) Office of Research and Development (ORD); (3) Homeland Security Advanced Research Projects Agency (HSARPA); and (4) Systems Engineering and Development (SED), as seen in figure 1 below.

Under Secretary for Science and Technology Development (ORD)

Agency (HSARPA) & Development (SED)

Prepares deployment, systems development, (including DOE labs)

On June 29, 2005, a Chief Financial Officer position was created for the S&T Directorate to consolidate and execute budgetary planning. Because the budgetary responsibility for the S&T Directorate was moved out of the Office of Programs, Plans, and Budgets, its name was changed to the Office of Programs, Plans and Requirements (PPR). This new position and name change are not reflected in this figure.

In the first few years of DHS’s existence, the S&T Directorate focused on the urgency of organizing itself to meet the nation’s homeland security research and development requirements, and had few resources devoted to developing its management infrastructure, including the management controls to guard against conflicts of interest. In our 2004 report on DHS’s potential use of the national laboratories, we noted that when the S&T Directorate began operating in March 2003, they sought and hired scientists, engineers, and experts in needed disciplines from federal laboratories, universities, and elsewhere in the federal government. These individuals were brought into the S&T Directorate to use their knowledge in ways that would help the Directorate achieve its mission quickly and effectively. DHS officials told us that these individuals came to DHS out of a sense of urgency and motivated by a strong sense of patriotism. Some of these scientists were hired from the national laboratories, and they came with the understanding that they would return to their laboratories following their time at DHS.

As part of their responsibilities, portfolio managers led and facilitated Integrated Project Teams (IPT), which included representatives from ORD, HSARPA, and SED. In addition to identifying R&D projects and budgets, IPTs were responsible for determining which office (ORD, HSARPA, or SED) within the S&T Directorate would be responsible for them. These determinations were important because it influenced whether the project and associated funds went to the public or private sector. According to a March 2004 Office of Inspector General report, ORD generally executes programs that involve the national laboratories and which the private sector should not, could not, or would not perform. HSARPA generally executes programs for which technology development involves the private sector. SED generally executes programs employing proven technologies and resulting in transition to operational systems.

As previously discussed, IPA employees are generally subject to the same laws and regulations that govern the ethical conduct of other federal employees. Section 208 of Title 18 of the United States Code, a criminal statute, generally precludes federal employees from personally and substantially participating in any particular matter that would have a direct and predictable effect on their financial interests, or the financial interest of any organization attributable to them. An employee’s participation is “substantial” if their participation is meaningful to the matter. An employee can be personally and substantially involved in a variety of ways, including making a recommendation, rendering advice, or making a decision on a particular matter. The law can be waived if the employee first makes a full disclosure of the conflict of interest to the official responsible for his or her appointment, “and receives in advance a written determination made (i.e., waiver) by such official that the interest is not so substantial as to be deemed likely to affect the integrity of the services which the government may expect.” Executive departments and agencies are required to forward documentation of such waivers to OGE. Waivers cannot be granted to cover past activities. In addition to avoiding conflicts of interest, executive branch employees must avoid even the appearance of a conflict of interest. However, when there is potential for such an appearance of a conflict, an employee can be granted an “authorization” to work on a matter even in situations where a reasonable person with knowledge of the relevant facts can question the employee’s impartiality in a matter.

As mentioned earlier, OMB requires agencies to establish a set of management controls and GAO issues standards for internal control in the federal government. In addition, GAO developed the Internal Control Management and Evaluation Tool to help managers and evaluators determine how well an agency’s internal control is designed and functioning and help determine what, where, and how improvements, when needed, may be implemented. The five standards for internal control are: control environment, risk assessment, control activities, information and communications, and monitoring. Two of these standards, control environment and control activities, include key factors related to conflicts of interest. If effectively implemented, these internal controls can help to guard against employees participating in actions that present a personal conflict of interest. Examples of relevant key factors that address the establishment and maintenance of an effective control environment of an agency are: establishment and use of a formal code of conduct and other policies communicating appropriate ethical and moral behavioral standards and addressing acceptable operational practices and conflicts of interest; establishment of an ethical tone at the top of the organization and communicated throughout the agency; and implementation of policies and procedures for hiring employees.

Internal control activities are the policies, procedures, techniques, and mechanisms that help ensure that management’s directives to mitigate identified risks are carried out. Examples of relevant key factors that address internal control activities are: existence of appropriate policies, procedures, techniques, and mechanisms with respect to each of the agency’s activities; providing appropriate training and other control activities to give employees the tools they need to perform their duties and responsibilities to meet the demands of changing organizational needs; and documentation of transactions and other significant events is complete and accurate and facilitates tracing the transaction or event and related information from authorization and initiation, through its processing, to after it is completed.

DHS’s S&T Directorate Can Do More to Improve Its Management Controls Related to Conflicts of Interest for Its IPA Portfolio Managers

DHS’s S&T Directorate has implemented several management controls to help its IPA portfolio managers comply with conflict of interest laws and regulations. Most of these were implemented during the course of our review. Since the S&T Directorate was created in 2003, individuals employed in the S&T Directorate under the IPA have completed an “assignment agreement”, as required by OPM. Having procedures in place for hiring employees and implementing them is one aspect of an effective management control environment. The assignment agreements include a section on conflicts of interest and employee conduct. As part of the assignment agreement, each applicant must acknowledge that: “applicable Federal, State or local conflict-of-interest laws have been reviewed with the employee to assure that conflict-of-interest situations do not inadvertently arise during this assignment”; and “the employee has been notified of laws, rules and regulations, and policies on employee conduct which apply to him/her while on this assignment.”

We reviewed the IPA assignment agreements for all of the IPA portfolio managers and found that the IPA portfolio managers acknowledged these provisions.

The S&T Directorate’s leadership took steps to establish an ethical tone and communicate it through a March 15, 2004, memorandum from DHS’s Undersecretary for S&T to all S&T Directorate employees emphasizing that they should strictly adhere to all applicable ethics laws. The memo summarized ethics laws, called attention to the consequences of noncompliance, provided points of contact for those with questions, and explained that S&T employees “have the responsibility to be scrupulous in complying with all applicable ethics laws.” Further, the memo specifically mentioned that employees hired under the IPA may not participate in matters involving their “home” institution (which, in the S&T Directorate, has often been a DOE national laboratory). The memo explained provisions of 18 U.S.C. § 208, stating that an employee may not participate “personally and substantially” in a particular matter that may affect an entity in which he has a financial interest and that “personal and substantial participation can occur if the employee participates in a decision, approval, disapproval, recommendation, investigation, or the rendering of advice on the matter.”

According to DHS’s DAEO, the IPAs in the S&T Directorate were employed before a process was in place to screen them for personal conflict of interest issues. On June 30, 2005, the S&T Directorate issued new, internal procedures for hiring employees under the IPA. These new procedures outline the responsibilities of the parties involved in the hiring process and detail the steps necessary to hire an IPA. These steps include a preliminary review of financial disclosure forms by DHS’s Office of General Counsel (OGC) to determine whether conflicts of interest exist based on the roles and responsibilities of the proposed position.

Along with these new hiring procedures, the S&T Directorate began requiring applicants being considered under the IPA to complete written disqualification statements meant to bar their involvement in any matter that could reasonably be perceived to affect the interests of their national laboratory or other employer. In addition, once hired, IPAs can complete a memorandum that provides their supervisor with a written recusal from “certain Government matters” that affect the institution to which they will return after their employment at DHS, and allows them “to describe the screening arrangement” they are implementing to ensure that they comply with their “obligation to recuse.” In this memorandum, the employee then lists each asset, entity, or other interest that gives rise to a disqualifying interest under 18 U.S.C. § 208.

DHS officials told us that S&T Directorate employees, including those hired under the IPA, are offered the same new employee and annual ethics training as are all new DHS employees. Having training and orientation programs for new employees, with ongoing training for all employees, are key activities for establishing effective controls. On January 7, 2005, the Assistant Secretary of PPB also held a mandatory meeting for all IPAs in the S&T Directorate. S&T Directorate officials told us that this meeting was called to discuss the ethics issues that apply specifically to employees hired under the IPA, including the conflict of interest statutes.

Other important management controls that could help ensure portfolio managers comply with conflict of interest laws are not yet in place in the S&T Directorate. Importantly, the process for determining where R&D projects and funds are directed, including the role of the IPA portfolio managers, has never been finalized. Establishment of a process for each agency activity is one of the key factors for meeting internal control standards. Though IPTs were created to help make this determination, as previously discussed, we were told that each IPT worked differently and there were no requirements to operate in the same way. In addition, neither the S&T Directorate nor its draft process requires documentation of how determinations are made about where R&D projects and funds are directed.

Further, the S&T Directorate is only now seeking waivers, where appropriate, and considering whether to grant authorizations or take other actions for their portfolio managers hired under the IPA. As we discussed, under 18 U.S.C. § 208(b)(1), the official responsible for an employee's appointment may grant a waiver in advance allowing participation in certain matters if he or she makes a written determination that the affected financial interest “is not so substantial as to be deemed likely to affect the integrity” of the employee's services. In May 2005, an S&T Directorate official stated to us that they first needed to “scrutinize all of their positions to determine whether an actual or apparent conflict requires such action.” In August 2005, senior S&T officials told us that, in conjunction with DHS’s DAEO and OGE, they had begun the process of determining whether to issue waivers to IPA portfolio managers. During our exit briefing with DHS in September 2005, DHS officials indicated that one option might be to not hire anyone for which a waiver may be needed. In DHS’s December 2005 letter to us commenting on our report, it noted that the S&T Directorate is now seeking waivers for at least 6 of its IPAs.

Finally, IPA portfolio managers in the S&T Directorate are not routinely offered specific training that focuses on the application of the ethics statutes and regulations to the unique financial relationship between the IPA portfolio managers and their “home” institution. The January 2005 meeting held with all IPAs in the S&T Directorate to discuss the specific ethics issues related to their circumstances is not scheduled to be repeated. Ensuring that management conveys the message on a periodic basis that integrity and ethical values must not be compromised is part of maintaining an effective control environment. Because of IPA portfolio managers’ ties to their “home” institution, and that their responsibilities at DHS may involve issues that affect their “home” institution, ensuring that these managers receive regular training that targets the application of conflict of interest laws to IPAs may keep them alert to those actions that could constitute a violation of such laws.

IPA Portfolio Managers’ Role in Determining Where R&D Projects and Funds Were Directed Was Unclear

The recent changes and further improvements to the S&T Directorate’s ethics-related management controls are critical because we found that the role of the IPA portfolio managers in determining where R&D projects and associated funds were directed was unclear. This was due to several factors, as discussed in more detail below.

First, the process that was to be followed by IPA portfolio managers when determining where R&D projects and funds are directed, and the decision- making role of the IPA portfolio managers within such a process, has never been finalized. DHS provided us with a draft version of this process as part of a Web-based tool. However, IPTs were not required to follow this draft process and team members from the two IPTs that we examined said that they were becoming familiar with the process. In this draft, DHS stated that IPTs, facilitated by portfolio managers, were to “decide” which office within the S&T Directorate would execute a project, (i.e., ORD, HSARPA, or SED). The draft stated that if the members of the IPT could not reach agreement, the project would be reviewed by the Executive Review Board (ERB), which consisted of the Assistant Secretary, Programs, Plans, and Budgets, and the Directors of SED, ORD, and HSARPA. However, in September 2005, senior S&T Directorate officials told us that the information regarding the decision-making role of the IPT in the draft Web- based tool was inaccurate, indicating that IPTs can only make recommendations to the ERB, but not a final decision. However, as we noted, 18 U.S.C. § 208 guards against “personal and substantial participation” through various actions which include “decision” and “recommendation.”

Second, DHS officials, portfolio managers, and IPT members were unable to provide us with any documentation, such as meeting minutes, to indicate the actual role that the five IPA portfolio managers from the national laboratories played in the decision-making process within the IPTs. Third, the testimony regarding the extent of the IPA portfolio managers’ involvement in the decision-making process was inconsistent and, at times, vague. For example, one IPA portfolio manager told us that he/she recused himself/herself from any decision that may have involved his/her national laboratory, although this manager noted that he/she was present and “facilitated” the IPT meetings when such decisions were made. Other IPA portfolio managers told us that they participated to varying degrees. For example, one told us that he/she was involved in the IPT decisions regarding which S&T Directorate office would execute a project only when the other IPT members could not reach agreement. Another told us that he/she participated in all IPT discussions that helped make this determination. However, because there was no documentation of the decision-making process, we could not determine the extent of the IPA portfolio managers’ actual involvement on any particular funding matter, or whether their involvement affected their “home” institution, such as a national laboratory.

In March 2005, we discussed our review with OGE to obtain their views on the ethics issues, both in general and as they may specifically apply to the S&T Directorate. During these discussions, OGE officials told us that they planned to begin their first audit of DHS’s ethics program in late 2005. Because we could not determine whether or not the IPA portfolio managers participated “personally and substantially” in the decision-making process, however, we contacted the Acting Director of OGE in September 2005 and suggested that OGE review this matter further in conjunction with its planned ethics program review of DHS. In December 2005, OGE officials told us that they plan to examine, among other matters, the transparency and accountability issues in DHS’s ethics program raised by our findings.

Conclusions

In the first few years of its existence, the S&T Directorate focused on rapidly organizing itself to meet the nation’s homeland security R&D requirements. During this time, DHS had few resources devoted to developing the S&T Directorate’s management infrastructure, including management controls to guard employees against conflicts of interest. Although the S&T Directorate has recently implemented management controls to help protect against conflicts of interest, and is currently considering others, more needs to be done. In the absence of a process for deciding what entities will implement R&D projects, the role that IPA portfolio managers played has been inconsistent and the potential exists that they may have unknowingly violated conflict of interest laws. By developing and carrying out a process to decide which office will execute a project, and clearly defining the roles and responsibilities of those involved in the process, the S&T Directorate may help its IPA portfolio managers avoid such situations in the future. In addition, documenting how the decisions are made while implementing this process may help protect both DHS and its employees if questions are raised.

Ensuring that the S&T Directorate continues to have access to the best personnel with needed expertise is important to the success of DHS’s mission. The IPA provides the S&T Directorate with a mechanism to hire some of these people. However, because IPA portfolio managers have an arrangement for future employment with an entity that could benefit from the S&T Directorate’s work, determining whether (1) waivers of the conflict of interest laws are appropriate, (2) IPA portfolio managers should be authorized to work on these issues regardless of any appearance of a conflict, or (3) DHS should take other steps to facilitate the use of their expertise to achieve the S&T Directorate’s mission, could help ensure that these valuable employees are protected against violating conflict of interest laws.

Further, once hired, IPA employees must understand how the ethics laws address their unique situations; namely, that they have an agreement for future employment with an entity that stands to benefit from the S&T Directorate’s funding. Regular training for IPA portfolio managers that targets the conflict of interest laws could help them understand what actions are not permitted.

Finally, to help ensure that DHS’s ethics-related management controls are implemented and working in a satisfactory manner, it is critical that DHS establish a monitoring and oversight program. Such a monitoring mechanism will allow the S&T Directorate to assess its ethics-related management controls in order to facilitate awareness and mitigation of risk in DHS, while providing a greater degree of impartiality and integrity.

Recommendations for Executive Action

To help IPA portfolio managers comply with the conflict of interest law, we are recommending that the Secretary of Homeland Security direct the Undersecretary of the S&T Directorate to improve the S&T Directorate’s management controls related to potential conflicts of interest by finalizing the S&T Directorate’s R&D process and defining and standardizing the role of the IPA portfolio managers in this process; developing a system to document how decisions are made within the determining, in consultation with DHS’s DAEO and OGE, whether waivers of 18 U.S.C. § 208 or authorizations related to the appearance of a conflict of interest are appropriate, or other actions are needed; providing regular ethics training for IPA portfolio managers that focuses on the application of the ethics statutes and regulations to their unique financial situation; and establishing a monitoring and oversight program of ethics-related management controls.

Agency Comments and Our Evaluation

We provided a draft of this report to the Secretary of Homeland Security. DHS concurred with our recommendations and noted some actions that they plan to take. If implemented effectively, these actions would be responsive to some of our recommendations. For example, the S&T Directorate plans to (1) coordinate with the DAEO and OGE in seeking waivers under 18 U.S.C. § 208 for some of the IPAs in the S&T Directorate; (2) enhance its ethics-related training for IPAs; and (3) strengthen its monitoring and oversight programs for ethics-related management controls.

Although DHS agreed with all of our recommendations, it believed that we misstated the facts in asserting that IPA employees do not routinely receive specific training regarding conflicts of interest. We revised the report to indicate that the ethics training we believe is still needed should focus on the application of the ethics statutes and regulations to the unique financial relationship between the IPA portfolio managers and their “home” institutions. Second, we are encouraged that the S&T Directorate has reviewed the individual circumstances of all of the IPAs in the S&T Directorate and is seeking waivers under 18 U.S.C. § 208 for at least six of these individuals. However, as stated in our report, the S&T Directorate has not finalized the process for determining where research and development projects and associated funds are directed, nor has it defined and standardized the role of the IPA portfolio managers in this process. Further, the ability of IPA portfolio managers themselves to influence or control where projects and funds are directed has been inconsistent and, at times, vague within the S&T Directorate. Thus, IPA portfolio managers continue to be vulnerable to violating the conflict of interest laws. DHS’s comments are provided in appendix III. In addition, we received technical comments from DHS, which we incorporated as appropriate.

We also provided a draft to OGE. On December 8, 2005, we met with OGE officials, including the Deputy Director of the Office of Agency Programs, who provided us with technical comments, which we made as appropriate.

We are sending copies of this report to the Secretary of Homeland Security and other interested parties. In addition, this report is available at no charge on the GAO Web site at http://www.gao.gov.

If you or your staff have any further questions about this report, please contact me at (202) 512-6806 or stalcupg@gao.gov. Major contributors to this report included Ben Crawford, Terry Draver, John Krump, James Lager, Andrea Levine, Sarah Veale, and Michael Volpe.

DHS Research and Development Funding Distribution in Fiscal Year 2004

In fiscal year 2004, the most recent year in which the Science and Technology (S&T) Directorate could provide us with detailed breakdowns of its obligated funds, about 41 percent of the $761 million obligated for its research and development (R&D) funding was distributed to Department of Energy and federal laboratories (mostly the Office of Research and Development’s programs) and about 40 percent to the private sector (mostly the Homeland Security Advanced Research Projects Agency’s programs), as seen in figure 2 below.

Scope and Methodology

The objectives of our review were to examine (1) the management controls that have been established within the Department of Homeland Security’s (DHS) Science and Technology (S&T) Directorate to help guard against conflicts of interest for portfolio managers hired under the Intergovernmental Personnel Act (IPA), and (2) the role of the IPA portfolio managers (particularly those from the national laboratories) in determining where research and development (R&D) projects and associated funds are directed.

To address our objectives, we analyzed DHS documentation of management controls related to conflicts of interest and other relevant documents. These documents included such materials as agency directives, official memos, human capital procedures, fiscal years 2007-2011 Planning, Programming, and Budgeting Cycle guidance, DHS reports and testimony to Congress, and IPA agreement forms for the Directorate’s employees hired under the IPA. In addition, we reviewed the most current, but incomplete, draft of an electronic version of the Research, Development, Testing and Evaluation process to be used by the S&T Directorate. We reviewed relevant laws and regulations, including the Homeland Security Act of 2002, Title 18 U.S.C. Section 208(a); (b); and 5 C.F.R. pt. 2635. In addition, we used GAO’s Standards for Internal Control in the Federal Government and Internal Control Management and Evaluation Tool. We also reviewed prior work from DHS’s Office of the Inspector General (OIG) and GAO on the DHS S&T Directorate and ethics-related issues.

We interviewed officials in the S&T Directorate, including the Deputy Secretary for S&T and head of Programs, Plans, and Budgets (PPB); Director of the Office of Research and Development (ORD); Acting Director of the Homeland Security Advanced Research Projects Agency (HSARPA); S&T portfolio managers, five of whom were employed by DHS on IPA agreements from the national laboratories; and the human capital director for S&T. We did not interview the Director of Systems, Engineering, and Development (SED) because SED works with mature technologies at or near the deployment stage, rather than technologies needing R&D by an entity like the national laboratories. More specifically, we examined the role of the IPA portfolio managers from the national laboratories in determining where R&D projects and associated funds were directed during the period from December 2004 through May 2005. In addition, we interviewed DHS’s Designated Agency Ethics Officer, attorneys in DHS’s General Counsel’s Office, and DHS’s OIG.

We judgmentally selected two portfolios within the S&T Directorate to examine in more detail the existence of their process and management controls and compare any differences in the application of such processes and controls. These portfolios were: (1) the Biological Countermeasures portfolio, which is the largest portfolio in the S&T Directorate and is run by an IPA; and (2) the Border and Transportation Security (BTS) portfolio, a smaller portfolio managed by a career federal employee. We interviewed the members of these Integrated Project Teams, which included representatives of PPB, HSARPA, ORD and SED. In addition, we reviewed the fiscal years 2004 and 2005 Execution Plans for the Biological Countermeasures portfolio, the fiscal year 2004 Execution Plan for the BTS portfolio, and the fiscal year 2004 BTS portfolio funding allocations by type of entity. (e.g., national laboratory, university, private industry, etc.)

We also met with the Acting Director of the Office of Government Ethics (OGE) and her staff to discuss the ethics issues we were reviewing at DHS. OGE exercises leadership in the executive branch to prevent conflicts of interest on the part of government employees and to resolve those conflicts of interest that do occur. The responsibilities of the Director of OGE include, among other things, consulting with agency ethics counselors and other responsible officials regarding the resolution of conflict of interest problems in individual cases, and ordering corrective action on the part of agencies and employees which the Director deems necessary.

Written comments from DHS are included in appendix III. We performed our work from September 2004 through December 2005 in accordance with generally accepted government auditing standards.