Department of Homeland Security: Progress Made, but More Work Remains in Strengthening Management Functions
Released: 2015-02-26T00:00:00

Letter

DHS Has Made Progress in Strengthening Its Management Functions, but Considerable Work Remains

DHS Progress in Meeting Criteria for Removal from the High-Risk List

DHS’s efforts to strengthen and integrate its management functions have resulted in progress addressing our criteria for removal from the high-risk list. In particular, in our 2015 high-risk update report, which we released earlier this month, we found that DHS has met two criteria and partially met the remaining three criteria, as shown in table 1.

Leadership commitment (met). In our 2015 report, we found that the Secretary and Deputy Secretary of Homeland Security, the Under Secretary for Management at DHS, and other senior officials have continued to demonstrate commitment and top leadership support for addressing the department’s management challenges. We also found that they have taken actions to institutionalize this commitment to help ensure the long-term success of the department’s efforts. For example, in April 2014, the Secretary of Homeland Security issued a memorandum entitled Strengthening Departmental Unity of Effort, committing to, among other things, improving DHS’s planning, programming, budgeting, and execution processes through strengthened departmental structures and increased capability. Senior DHS officials, including the Deputy Secretary and Under Secretary for Management, have also routinely met with us over the past 6 years to discuss the department’s plans and progress in addressing this high-risk area. During this time, we provided specific feedback on the department’s efforts. We concluded that it will be important for DHS to maintain its current level of top leadership support and commitment to ensure continued progress in successfully executing its corrective actions through completion.

Corrective action plan (met). We found that DHS has established a plan for addressing this high-risk area. Specifically, in a September 2010 letter to DHS, we identified and DHS agreed to achieve 31 actions and outcomes that are critical to addressing the challenges within the department’s management areas and in integrating those functions across the department. In March 2014, we updated the actions and outcomes in collaboration with DHS to reduce overlap and ensure their continued relevance and appropriateness. These updates resulted in a reduction from 31 to 30 total actions and outcomes. Toward achieving the actions and outcomes, DHS issued its initial Integrated Strategy for High Risk Management in January 2011 and has since provided updates to its strategy in seven later versions, most recently in October 2014. The integrated strategy includes key management initiatives and related corrective actions plans for addressing DHS’s management challenges and the actions and outcomes we identified. For example, the October 2014 strategy update includes an initiative focused on financial systems improvement and modernization and an initiative focused on IT human capital management. These initiatives support various actions and outcomes, such as modernizing the U.S. Coast Guard’s financial management system and implementing an IT human capital strategic plan, respectively. We concluded in our 2015 report that DHS’s strategy and approach to continuously refining actionable steps to implementing the outcomes, if implemented effectively and sustained, should provide a path for DHS to be removed from our high-risk list.

Capacity (partially met). In October 2014, DHS identified that it had resources needed to implement 7 of the 11 initiatives the department had under way to achieve the actions and outcomes, but did not identify sufficient resources for the 4 remaining initiatives. In addition, our prior work has identified specific capacity gaps that could undermine achievement of management outcomes. For example, in April 2014, we reported that DHS needed to increase its cost-estimating capacity and that the department had not approved baselines for 21 of 46 major acquisition programs. These baselines—which establish cost, schedule, and capability parameters—are necessary to accurately assess program performance. Thus, in our 2015 report, we concluded that DHS needs to continue to identify resources for the remaining initiatives; work to mitigate shortfalls and prioritize initiatives, as needed; and communicate to senior leadership critical resource gaps.

Framework to monitor progress (partially met). In our 2015 report we found that DHS established a framework for monitoring its progress in implementing the integrated strategy it identified for addressing the 30 actions and outcomes. In the June 2012 update to the Integrated Strategy for High Risk Management, DHS included, for the first time, performance measures to track its progress in implementing all of its key management initiatives. DHS continued to include performance measures in its October 2014 update. However, we also found that the department can strengthen this framework for monitoring a certain area. In particular, according to DHS officials, as of November 2014, they were establishing a monitoring program that will include assessing whether financial management systems modernization projects for key components that DHS plans to complete in 2019 are following industry best practices and meet users’ needs. Effective implementation of these modernization projects is important because, until they are complete, the department’s current systems will not effectively support financial management operations. As we concluded in our 2015 report, moving forward, DHS will need to closely track and independently validate the effectiveness and sustainability of its corrective actions and make midcourse adjustments, as needed.

Demonstrated, sustained progress (partially met). We found in our 2015 report that DHS has made important progress in strengthening its management functions, but needs to demonstrate sustainable, measurable progress in addressing key challenges that remain within and across these functions. In particular, we found that DHS has implemented a number of actions demonstrating the department’s progress in strengthening its management functions. For example, DHS has strengthened its enterprise architecture program (or blueprint) to guide and constrain IT acquisitions and obtained a clean opinion on its financial statements for 2 consecutive years, fiscal years 2013 and 2014. However, we also found that DHS continues to face significant management challenges that hinder the department’s ability to accomplish its missions. For example, DHS does not have the acquisition management tools in place to consistently demonstrate whether its major acquisition programs are on track to achieve their cost, schedule, and capability goals. In addition, DHS does not have modernized financial management systems. This affects its ability to have ready access to reliable information for informed decision making. As we concluded in our 2015 report, addressing these and other management challenges will be a significant undertaking that will likely require several years, but will be critical for the department to mitigate the risks that management weaknesses pose to mission accomplishment.

DHS Progress in Achieving Key High-Risk Actions and Outcomes

Key to addressing the department’s management challenges is DHS demonstrating the ability to achieve sustained progress across the 30 actions and outcomes we identified and DHS agreed were needed to address the high-risk area. In our 2015 report, we found that DHS has fully implemented 9 of these actions and outcomes, with additional work remaining to fully address the remaining 21. Achieving sustained progress across the actions and outcomes, in turn, requires leadership commitment, effective corrective action planning, adequate capacity (that is, the people and other resources), and monitoring the effectiveness and sustainability of supporting initiatives. The 30 key actions and outcomes include, among others, validating required acquisition documents in accordance with a department-approved, knowledge-based acquisition process, and sustaining clean audit opinions for at least 2 consecutive years on department-wide financial statements and internal controls.

We further found that DHS has made important progress across all of its management functions and significant progress in the area of management integration. In particular, DHS has made important progress in several areas to fully address 9 actions and outcomes, 5 of which it has sustained as fully implemented for at least 2 years. For instance, DHS fully met 1 outcome for the first time by obtaining a clean opinion on its financial statements for 2 consecutive years and fully met another outcome by establishing sufficient component-level acquisition capability. It also sustained full implementation of another outcome by continuing to use performance measures to assess progress made in achieving department-wide management integration. DHS has also mostly addressed an additional 5 actions and outcomes, meaning that a small amount of work remains to fully address them.

We also found that considerable work remains, however, in several areas for DHS to fully achieve the remaining actions and outcomes and thereby strengthen its management functions. Specifically, DHS has partially addressed 12 and initiated 4 of the actions and outcomes. As previously mentioned, addressing some of these actions and outcomes, such as modernizing the department’s financial management systems and improving employee morale, are significant undertakings that will likely require multiyear efforts. Table 2 summarizes DHS’s progress in addressing the 30 actions and outcomes and is followed by selected examples.

Acquisition management. In our 2015 report, we found that DHS has fully addressed 1 of the 5 acquisition management outcomes, partially addressed 3 outcomes, and initiated actions to address the remaining outcome. For example, DHS has recently taken a number of actions to fully address establishing effective component-level acquisition capability. These actions include initiating (1) monthly Component Acquisition Executive staff forums in March 2014 to provide guidance and share best practices and (2) assessments of component policies and processes for managing acquisitions. DHS has also initiated efforts to validate required acquisition documents in accordance with a knowledge-based acquisition process, but this remains a major challenge for the department. A knowledge-based approach provides developers with information needed to make sound investment decisions, and it would help DHS address significant challenges we have identified across its acquisition programs. DHS’s acquisition policy largely reflects key acquisition management practices, but the department has not implemented it consistently For example, in March 2014, we found that U.S. Customs and Border Protection (CBP) had not fully followed DHS policy regarding testing for the integrated fixed towers being deployed on the Arizona border. As a result, DHS does not have complete information on how the towers will operate once they are fully deployed.

In addition, in our 2015 report we found that DHS continues to assess and address whether appropriate numbers of trained acquisition personnel are in place at the department and component levels, an outcome it has partially addressed. Further, while DHS has initiated efforts to demonstrate that major acquisition programs are on track to achieve their cost, schedule, and capability goals, DHS officials have acknowledged it will be years before this outcome has been fully addressed. Much of the necessary program information is not yet consistently available or up to date.

IT management. In our 2015 report, we found that DHS has fully addressed 2 of the 6 IT management outcomes, mostly addressed another 3, and partially addressed the remaining 1. For example, DHS has finalized a directive to establish its tiered governance and portfolio management structure for overseeing and managing its IT investments, and annually reviews each of its portfolios and the associated investments to determine the most efficient allocation of resources within each of the portfolios. DHS has also implemented its IT Strategic Human Capital Plan at the enterprise level. This includes developing an IT specialist leadership competency gap workforce analysis and a DHS IT career path pilot. However, as DHS has not yet determined the extent to which the component chief information officers have implemented the enterprise human capital plan’s objectives and goals, DHS’s capacity to achieve this outcome is unclear. Additionally, we found that DHS continues to take steps to enhance its information security program. However, while the department obtained a clean opinion on its financial statements, in November 2014, the department’s financial statement auditor reported that continued flaws in security controls such as those for access controls, configuration management, and segregation of duties Thus, were a material weakness for fiscal year 2014 financial reporting.the department needs to remediate the material weakness in information security controls reported by its financial statement auditor.

Financial management. In our 2015 report, we found that DHS has fully addressed 2 financial management outcomes, partially addressed 3, and initiated 3.financial statements for 2 consecutive years, fiscal years 2013 and 2014, fully addressing 2 outcomes. As of November 2014, DHS was working Most notably, DHS received a clean audit opinion on its toward addressing a third outcome—establishing effective internal control over financial reporting. We reported in September 2013 that DHS needs to eliminate all material weaknesses at the department level, including weaknesses related to financial management systems, before its financial auditor can affirm that controls are effective. However, as we reported in our 2015 report, DHS has yet to identify and commit the resources needed for remediating the remaining material weaknesses. As we reported in September 2013, according to DHS’s auditors, the existence of these material weaknesses limits DHS’s ability to process, store, and report financial data in a manner that ensures accuracy, confidentiality, integrity, and availability of data without substantial manual intervention. This, in turn, increases the risk that human error may cause material misstatements in the financial statements.

We also found in our 2015 report that DHS needs to modernize key components’ financial management systems and comply with financial management system requirements. The components’ financial management system modernization efforts are at various stages due, in part, to a bid protest and the need to resolve critical stability issues with a legacy financial system before moving forward with system modernization efforts. For fiscal year 2014, auditors reported that persistent and pervasive financial system functionality conditions exist at multiple components and that DHS continues to rely on compensating controls and complex manual work-arounds due to serious legacy financial system issues. We concluded that without sound controls and systems, DHS faces long-term challenges in obtaining and sustaining a clean audit opinion on internal control over financial reporting, and ensuring its financial management systems generate reliable, useful, and timely information for day-to-day decision making.

Human capital management. In our 2015 report, we found that DHS has fully addressed 1 human capital management outcome, mostly addressed 2, and partially addressed the remaining 4. For example, the Secretary of Homeland Security signed a human capital strategic plan in 2011 that DHS has since made sustained progress in implementing, fully addressing this outcome. We also found that DHS has actions under way to identify current and future human capital needs. However, DHS has considerable work ahead to improve employee morale. For example, the Office of Personnel Management’s 2014 Federal Employee Viewpoint Survey data showed that DHS’s scores continued to decrease in all four dimensions of the survey’s index for human capital accountability and assessment—job satisfaction, talent management, leadership and knowledge management, and results-oriented performance culture. DHS has taken steps to identify where it has the most significant employee satisfaction problems and developed plans to address those problems. In September 2012, we recommended, among other things, that DHS In improve its root-cause analysis efforts related to these plans.December 2014, DHS reported actions under way to address our recommendations but had not fully implemented them. Given the sustained decrease in DHS employee morale indicated by Federal Employee Viewpoint Survey data, as we concluded in our 2015 report, it is particularly important that DHS implement these recommendations and thereby help identify appropriate actions to take to improve morale within its components and department-wide.

GAO, DHS Training: Improved Documentation, Resource Tracking, and Performance Measurement Could Strengthen Efforts, GAO-14-688 (Washington, D.C.: Sept. 10, 2014). found that while component officials generally identified the Leader Development Framework as beneficial, DHS management could benefit from improved information for identifying the need for and making program improvements. In support of the Leader Development Framework, we recommended, among other things, that DHS clearly identify Leader Development Program goals and ensure program performance measures reflect key attributes. DHS agreed and implemented this recommendation in December 2014. However, to fully achieve this outcome, DHS also needs to develop and make sustained progress in implementing a formal training strategy, as well as issue department-wide policies on training and development, among other things.

Management integration. In our 2015 report, we found that DHS has sustained its progress in fully addressing 3 of 4 outcomes we identified and agreed they are key to the department’s management integration efforts. For example, in January 2011, DHS issued an initial action plan to guide its management integration efforts—the Integrated Strategy for High Risk Management. Since then, DHS has generally made improvements to the strategy with each update based on feedback we provided. DHS has also shown important progress in addressing the last and most significant management integration outcome—to implement actions and outcomes in each management area to develop consistent or consolidated processes and systems within and across its management functional areas—but we found that considerable work remains. For example, the Secretary’s April 2014 Strengthening Departmental Unity of Effort memorandum highlighted a number of initiatives designed to allow the department to operate in a more integrated fashion, such as the Integrated Investment Life Cycle Management initiative, to manage investments across the department’s components and management functions. DHS completed its pilot for a portion of this initiative in March 2014 and, according to DHS’s Executive Director for Management Integration, has begun expanding its application to new portfolios, such as border security and information sharing, among others. However, given that these main management integration initiatives are in the early stages of implementation and contingent upon DHS following through with its plans, it is too early to assess their impact. To achieve this outcome, we concluded that DHS needs to continue to demonstrate sustainable progress integrating its management functions within and across the department and its components.

In our 2015 report, we further concluded that in the coming years, DHS needs to continue implementing its Integrated Strategy for High Risk Management and show measurable, sustainable progress in implementing its key management initiatives and corrective actions and achieving outcomes. In doing so, it will be important for DHS to maintain its current level of top leadership support and sustained commitment to ensure continued progress in executing its corrective actions through completion; continue to implement its plan for addressing this high-risk area and periodically report its progress to us and Congress; identify and work to mitigate any resource gaps, and prioritize initiatives as needed to ensure it can implement and sustain its corrective actions; closely track and independently validate the effectiveness and sustainability of its corrective actions and make midcourse adjustments as needed; and make continued progress in achieving the 21 actions and outcomes it has not fully addressed and demonstrate that systems, personnel, and policies are in place to ensure that progress can be sustained over time.

We will continue to monitor DHS’s efforts in this high-risk area to determine if the actions and outcomes are achieved and sustained over the long term.

Key Themes Continue to Impact DHS’s Progress in Implementing Its Mission Functions

In September 2011, we reported that our work had identified three key themes that had impacted DHS’s progress in implementing its mission functions since it began operations: (1) executing and integrating its management functions for results, (2) leading and coordinating the homeland security enterprise, and (3) strategically managing risks and assessing homeland security efforts. As previously discussed, DHS has made important progress with respect to the first theme by strengthening and integrating its management functions, but considerable work remains. Our recent work indicates that DHS has similarly made progress related to the other two themes of leading and coordinating the homeland security enterprise and strategically managing risk and assessing homeland security efforts, but that these two themes continue to impact the department’s progress in implementing its mission functions.

Leading and coordinating the homeland security enterprise. As we reported in September 2011, while DHS is one of a number of entities with a role in securing the homeland, it has significant leadership and coordination responsibilities for managing efforts across the homeland security enterprise. To satisfy these responsibilities, it is critically important that DHS develop, maintain, and leverage effective partnerships with its stakeholders while at the same time addressing DHS-specific responsibilities in satisfying its missions. Before DHS began operations, we reported that to secure the nation, DHS must form effective and sustained partnerships among components and also with a range of other entities, including federal agencies, state and local governments, the private and nonprofit sectors, and international partners. DHS has made important strides in providing leadership and coordinating efforts. For example, in June 2014, we reported on DHS efforts to enhance border security by using collaborative mechanisms such as the Alliance to Combat Transnational Threats to coordinate border security efforts. Specifically, we reported that DHS and CBP had coordinated border security efforts in (1) information sharing, (2) resource targeting and prioritization, and (3) leveraging of assets. For example, through the Alliance to Combat Transnational Threats, interagency partners—including CBP, the Arizona Department of Public Safety, and the Bureau of Land Management, among others—worked jointly to target individuals and criminal organizations involved in illegal cross-border activity.

However, our recent work has also identified opportunities for DHS to improve its partnerships. For example, with respect to DHS’s efforts to enhance border security using collaborative mechanisms, in June 2014, we found that DHS had established performance measures and reporting processes for the mechanisms, but opportunities existed to strengthen the mechanisms. For instance, we found that establishing written agreements with its federal, state, local, and tribal partners could help DHS address coordination challenges, such as limited resource commitments and lack of common objectives, and recommended that DHS establish such agreements. DHS concurred and stated that it planned to develop memoranda of understanding to better facilitate its partnerships. Further, in November 2014, we reported on DHS’s processing of Freedom of Information Act requests. We found, among other things, that DHS lacked an important mechanism for effectively facilitating public interaction with the department on the handling of Freedom of Information Act requests because the department did not have an updated regulation reflecting changes in how it processes these requests. We recommended that DHS finalize and issue an updated DHS Freedom of Information Act regulation. DHS concurred and reported planned actions to implement this recommendation by April 2015.

GAO-11-881. to critical infrastructure security and resilience. Our recent work has further found that DHS offices and components have continued to engage in risk management activities. For example, in September 2014, we reported that during fiscal years 2011 to 2013, DHS offices and components conducted or required thousands of vulnerability assessments of critical infrastructure. These assessments can identify factors that render an asset or facility susceptible to threats and hazards. However, we also found that DHS is not well positioned to integrate relevant assessments to, among other things, support nationwide comparative risk assessments, because the assessment tools and methods used vary in length, detail, and areas assessed. In addition, our recent work has identified opportunities for components to better strategically manage risks in various programs. For example, in September 2014, we reported that CBP had a $1 million budget for covert operations of various activities—including nuclear and radiological testing—covering fiscal years 2009 through 2013. We found that DHS had established a policy that requires that components with limited resources make risk-informed decisions, but that CBP testing did not inform capabilities across all border locations, and CBP had not conducted a risk assessment that could inform and prioritize the locations, materials, and technologies to be tested through covert operations. We recommended that—to help ensure that resources for covert operations provide reasonable assurance that efforts to detect and interdict nuclear and radiological material smuggled across the border are working as intended and appropriately targeted—DHS conduct or use a risk assessment to inform the department’s priorities for covert operations. DHS concurred and reported that it plans to implement this recommendation in July 2015.

In September 2011, we reported that limited strategic and program planning, as well as assessment and evaluation to inform approaches and investment decisions, had contributed to DHS programs not meeting strategic needs or doing so effectively and efficiently. Our recent work has indicated that strategic and program planning challenges continue to affect implementation of some DHS programs. For example, in September 2014, we reported on DHS headquarters consolidation efforts and their management by DHS and the General Services Administration (GSA). We found that DHS and GSA’s planning for the consolidation did not fully conform with leading capital decision-making practices intended to help agencies effectively plan and procure assets. DHS and GSA officials reported that they had taken some initial actions that may facilitate consolidation planning in a manner consistent with leading practices, but consolidation plans, which were finalized between 2006 and 2009, had not been updated to reflect these changes. According to DHS and GSA officials, the funding gap between what was requested and what was received from fiscal years 2009 through 2014 was over $1.6 billion. According to these officials, this gap had escalated estimated costs by over $1 billion—from $3.3 billion to $4.5 billion—and delayed scheduled completion by over 10 years, from an original completion date of 2015 to the current estimate of 2026. However, DHS and GSA had not conducted a comprehensive assessment of current needs, identified capability gaps, or evaluated and prioritized alternatives to help them adapt consolidation plans to changing conditions and address funding issues as reflected in leading practices. We recommended that DHS and GSA work jointly to assess these needs. DHS and GSA concurred, and DHS reported in February 2015 that the agencies had drafted an enhanced consolidation plan. We will assess this plan when it and any additional supporting analyses are made available to us.

We also recently found that DHS had taken preliminary steps to begin to understand the cyber risk to building and access controls systems in federal facilities, but that significant work remained, such as developing a strategy to guide these efforts. In particular, in December 2014, we found that DHS lacked a strategy that (1) defines the problem, (2) identifies roles and responsibilities, (3) analyzes the resources needed, and (4) identifies a methodology for assessing cyber risk to building and access controls systems in federal facilities.a strategy that clearly defines the roles and responsibilities of key components within DHS had contributed to a lack of action within the department. For example, we found that no one within DHS was assessing or addressing cyber risk to building and access control systems particularly at the nearly 9,000 federal facilities protected by the Federal Protective Service as of October 2014. We recommended that DHS, in consultation with GSA, develop and implement a strategy to address cyber risk to building and access control systems. DHS concurred and identified steps it plans to take to develop a strategy by May 2015.

We concluded that the absence of Chairman Perry, Ranking Member Watson Coleman, and members of the subcommittee, this completes my prepared statement. I would be happy to respond to any questions you may have at this time.

GAO Contact and Staff Acknowledgments

For further information about this testimony, please contact Rebecca Gambler at (202) 512-8777 or gamblerr@gao.gov. In addition, contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals making key contributions to this statement include Joseph P. Cruz (Assistant Director), Michael LaForge, Thomas Lombardi, Emily Kuhn, Taylor Matheson, Shannin O’Neill, and Katherine Trimble. Key contributors for the previous work that this testimony is based on are listed in each product.

Related GAO Products

DHS Training: Improved Documentation, Resource Tracking, and Performance Measurement Could Strengthen Efforts. GAO-14-688. Washington, D.C.: September 10, 2014.

Department of Homeland Security: Progress Made; Significant Work Remains in Addressing High-Risk Areas. GAO-14-532T. Washington, D.C.: May 7, 2014.

Homeland Security Acquisitions: DHS Could Better Manage Its Portfolio to Address Funding Gaps and Improve Communications with Congress. GAO-14-332. Washington, D.C.: April 17, 2014.

Department of Homeland Security: DHS’s Efforts to Improve Employee Morale and Fill Senior Leadership Vacancies. GAO-14-228T. Washington, D.C.: December 12, 2013.

DHS Financial Management: Continued Effort Needed to Address Internal Control and System Challenges. GAO-14-106T. Washington, D.C.: November 15, 2013.

Information Technology: Additional OMB and Agency Actions Are Needed to Achieve Portfolio Savings. GAO-14-65. Washington, D.C.: November 6, 2013.

DHS Financial Management: Additional Efforts Needed to Resolve Deficiencies in Internal Controls and Financial Management Systems. GAO-13-561. Washington, D.C.: September 30, 2013.

DHS Recruiting and Hiring: DHS Is Generally Filling Mission-Critical Positions, but Could Better Track Costs of Coordinated Recruiting Efforts. GAO-13-742. Washington, D.C.: September 17, 2013.

Information Technology: Additional Executive Review Sessions Needed to Address Troubled Projects. GAO-13-524. Washington, D.C.: June 13, 2013.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.