GAO has broad statutory authority under title 31 of the United States Code to audit and evaluate agency financial transactions, programs, and activities. To carry out these audit and evaluation authorities, GAO has a broad statutory right of access to agency records. Using the authority granted under title 31, we perform a range of work to support Congress that, among other things, includes the following: Evaluations of federal programs, policies, operations, and performance: For example, evaluations of transportation security programs related to passenger-screening operations at airports, our work to assess enforcement of immigration laws, and our work on the U.S. Coast Guard's Deepwater acquisition to replace its aging fleet. Management and financial audits to determine whether public funds are being spent efficiently, effectively, and in accordance with applicable laws: For example, DHS's appropriations acts for fiscal years 2002 through 2006 have mandated that we review expenditure plans for the U.S. Visitor and Immigrant Status Indicator Technology (U.S.VISIT) program. Investigations to assess whether illegal or improper activities may have occurred: For example, we investigated the Federal Emergency Management Agency's (FEMA) Individuals and Households Program to determine the vulnerability of the program to fraud and abuse in the wake of Hurricanes Katrina and Rita. Constructive engagements in which we work proactively with agencies, when appropriate, to help guide their efforts toward transformation and achieving positive results: For example, we have worked to establish such an arrangement with the Transportation Security Administration (TSA) on its design and implementation of the Secure Flight Program for passenger pre-screening for domestic flights whereby we could review documents on system development as they were being formulated and provide TSA with our preliminary observations for its consideration. Congress mandated TSA certify that the design and implementation of the program would meet 10 specific criteria. Congress also mandated that we review and comment on TSA's certification. TSA's certification has not yet occurred. We carry out most of our work in accordance with generally accepted government auditing standards. Our analysts and financial auditors are responsible for planning, conducting, and reporting their work in a timely manner without internal or external impairments. These standards require that analysts and financial auditors promptly obtain sufficient, competent, and relevant evidence to provide a reasonable basis for any related findings and conclusions. Therefore, prompt access to all records and other information associated with these activities is needed for the effective and efficient performance of our work. Our work involves different collection approaches to meet the evidence requirements of generally accepted government auditing standards. Such evidence falls into four categories: physical (the results of direct inspection or observation); documentary (information created by and for an agency, such as letters, memorandums, contracts, management and accounting records, and other documents in various formats, including electronic databases); testimonial (the results of face-to-face, telephone, or written inquiries, interviews, and questionnaires); and analytical (developed by or for GAO through computations, data comparisons, and other analyses). We have promulgated protocols describing how we will interact with the agencies we audit. We expect that agencies will promptly comply with our requests for all categories of needed information. We also expect that we will receive full and timely access to agency officials who have stewardship over the requested records; to agency employees responsible for the programs, issues, events, operations, and other factors covered by such records; and to contractor personnel supporting such programs, issues, events, and operations. In addition, we expect that we will have timely access to an agency's facilities and other relevant locations while trying to minimize interruptions to an agency's operations when conducting work related to requests for information. We provide an appropriate level of security to information obtained during the course of our work. We are statutorily required to maintain the same level of confidentiality of information as is required of the agency from which it is received, and we take very seriously our obligation to safeguard the wide range of sensitive information we routinely receive. For example, we ensure that GAO employees have appropriate security clearances to access information. We also have well-established security policies and procedures. Timely access to information, facilities, and other relevant locations is in the best interests of both GAO and the agencies. We need to efficiently use the time available to complete our work to minimize the impact on the agency being reviewed and to meet the time frames of our congressional clients. Therefore, we expect that an agency's leadership and internal procedures will recognize the importance of and support prompt responses to our requests for information. When we believe that delays in obtaining requested access significantly impede our work, we contact the agency's leadership for resolution and notify our congressional clients, as appropriate. Unlike those of many other executive agencies, DHS's processes for working with us includes extensive coordination among program officials, liaisons, and attorneys at the departmental and component levels and centralized control for all incoming GAO requests for information and outgoing documents. In an April 2004 directive on GAO relations, DHS established a department liaison to manage its relationship with us. In addition, DHS has a GAO coordinator within all of its components and, within the DHS General Counsel Office, an Assistant General Counsel for General Law who provides advice on GAO relations. According to the directive, the department liaison (1) receives and coordinates all GAO notifications of new work, (2) participates in all entrance conferences, and (3) notifies the Assistant General Counsel of new work to obtain participation of counsel. The directive requires the Assistant General Counsel to participate in all entrance meetings to ensure that the scope of any request is clear and finite, and that mutual obligations between DHS and GAO are met. The component coordinator handles all matters involving GAO for the component, generally participates in GAO entrance meetings, and seeks advice of component's counsel, as appropriate. The following figure illustrates the coordination of information among DHS officials described above when we make a request for information. Typically when we begin an engagement, we send a letter to the department liaison to notify DHS that we are starting a new engagement and we request an entrance meeting to discuss the work. During the course of our review, we provide written requests for meetings and documents to component coordinators using a DHS-prescribed form. The component coordinators then forward our requests to program officials and consult with component counsel, who may consult with the Assistant General Counsel. Figure 1. DHS Process for Working with GAO. In a memo that transmitted the above directive to senior managers in DHS components, the then-Under Secretary for Management emphasized the importance of a positive working relationship between the two agencies. The memo stated that failure to meet or brief GAO staffs in a timely manner, as well as being viewed as nonresponsive to GAO document requests, could result in tense and acrimonious interactions. The Under Secretary also reminded senior officials that prompt and professional discharge of their responsibilities to GAO requests could affect both DHS's funding and restrictions attached to that funding. In testimony before this committee and the House Committee on Appropriations, Subcommittee on Homeland Security in February 2007, we stated that DHS has not made its management or operational decisions transparent enough to allow Congress to be sure that the department is effectively, efficiently, and economically using its billions of dollars of annual funding. We also noted that our work for Congress to assess DHS's operations has been significantly hampered by long delays in obtaining access to program documents and officials. We emphasized that for Congress, GAO, and others to independently assess the department's efforts, DHS would need to become more transparent and minimize recurring delays in providing access to information on its programs and operations. At most federal agencies and in some cases within DHS, we obtain the information we need directly from program officials, often on the spot or very soon after making the request. For example, our work on the Secure Border Initiative (SBI) has so far met with a very welcome degree of access to both DHS officials and documents. SBI is a comprehensive multiyear program established in November 2005 to secure U.S. borders and reduce illegal immigration. One element of SBI is SBInet, the program within the U.S. Customs and Border Protection (CBP) responsible for developing a comprehensive border protection system of tactical infrastructure, rapid response capability, and technology. The fiscal year 2007 Department of Homeland Security Appropriations Act required that, before DHS could obligate $950 million of the $1.2 billion appropriated for SBInet, it had to prepare a plan for expending these funds, have it reviewed by GAO, and then submit it to Congress for approval. The plan was to be submitted within 60 days of the act's passage. CBP officials provided us office space at CBP headquarters, gave us access to all levels of SBInet management, and promptly provided us with all the documentation we requested, much of which was still in draft form and predecisional. DHS met the 60-day requirement when it submitted its plan to the Appropriations Committees on December 4, 2006. We met our responsibilities by being able to review the plan as it developed over the 60-day period, and to provide the results of our review to the House and Senate Appropriations Committees on December 7 and 13, 2006, respectively. In contrast to the access we were afforded in the above example, the process used in most of our interactions with DHS is layered and time- consuming. As discussed earlier, we are asked to submit each request for documents to the component coordinator rather than directly to program officials even if we have already met with these officials. Also as mentioned earlier, the component coordinator often refers our request to component counsel. And the Assistant General Counsel for General Law in DHS's General Counsel's office may become involved. The result is that we often wait for months for information that in many cases could be provided immediately. In some cases, DHS does not furnish information until our review is nearly finished, greatly impeding our ability to provide a full and timely perspective on the program under review. Each access issue with DHS requires that we make numerous and repetitive follow-up inquiries. Sometimes, despite GAO's right of access to information, DHS delays providing information as it vets concerns internally, such as whether the information is considered deliberative or predecisional. At other times, we experience delays without DHS expressing either a concern or a cause for the delays. On other occasions, DHS is unable to tell us when we might obtain requested information or even if we will obtain it. We have encountered access issues in numerous engagements, and the lengths of delay are both varied and significant and have affected our ability to do our work in a timely manner. We have experienced delays with DHS components that include CBP, U.S. Immigration and Customs Enforcement (ICE), FEMA, and TSA on different types of work such as information sharing, immigration, emergency preparedness in primary and secondary schools, and accounting systems. I have examples of two engagements to share with you today that illustrate the types of delays we experience and how they have affected the timing of our work. My first example is of an engagement related to detention standards for aliens in custody, where the team working on this engagement experienced delays of up to 5 months in obtaining various documents. The objective of this work, which is still under way and is being done for the House Committee on Homeland Security, is to assess ICE efforts to review facilities that house alien detainees, determine whether the facilities have complied with DHS standards, and determine the extent that complaints have been filed about conditions in the facilities. Some of the facilities are owned and operated by DHS; others are operated under contract with DHS. In order to determine the extent to which facilities are complying with DHS standards, we requested that ICE provide copies of the reports of inspections it conducted in 2006 at 23 detention facilities. We requested those reports in December 2006 and did not receive the final four of the inspection reports until just last week, after DHS departmental intervention. We had several meetings and discussions with DHS officials including program officials, liaisons, and attorneys, and we were never provided a satisfactory answer about the reason for this 5-month delay. We also experienced delays on this engagement obtaining a copy of the contract for detainee phone services between ICE and the phone service contractor. DHS took 1 month to provide the contract and redacted almost the entire document because a DHS attorney contended the information was "privileged." We followed up with DHS officials to communicate that our authority provided for access to this type of information and then waited another 2 weeks before we were able to get an unredacted copy of the contract. In another engagement being done at the request of the then-Chairman of the House Committee on Government Reform, we are reviewing an emergency preparedness exercise that DHS conducted in June 2006 called Forward Challenge 06. The purpose of the exercise was to allow agencies to activate their continuity of operations plans, deploy essential personnel to an alternate site, and perform essential functions as a means of assessing their mission readiness. Our objective is to determine the extent to which participating agencies were testing the procedures, personnel, and resources necessary to perform essential functions in their continuity- of-operations plans during the exercise. We began our work a few months before the exercise and had arranged with DHS to observe the actual exercise. However, 2 days before its start, DHS officials told us we would not be permitted to observe the exercise and stated that after completion, they would instead brief us on the exercise and the lessons they had learned from it. They provided that briefing in August 2006, at which time we requested relevant documentation to support the claims the DHS officials made to us. Subsequently, in November 2006, DHS provided us with one-third of the agency after-action reports we requested but redacted key information, including the identity of the participating agencies. DHS, however, was reluctant to provide us with the balance of the documents requested, stating that it considered these to be "deliberative materials" and expressing concern that sharing these with us would have a significant and negative impact on participants' level of openness in future exercises. Despite GAO's right of access to the information, the involvement of GAO and DHS officials at the highest level, and a letter of support from the former and current chairman of the committee, we did not receive access to the requested documentation until March 2007. Our report for this engagement was to be issued in November 2006; because we did not receive the needed information until March 2007, we will not be able to issue our analysis until later this year. We have made good faith efforts to resolve access issues. Specifically, we have undertaken many steps to work with DHS to resolve delays as expeditiously as possible and gain access to information needed for our work. At our audit team level we have asked staff to set reasonable time frames for requesting DHS to provide information and arrange for meeting and when we encounter resistance, to ensure that the information we request is critical to satisfying the audit objectives. When delays occur, our approach is to involve various management levels at both GAO and DHS, beginning with lower-level managers and working up to the Comptroller General and the Secretary. At each level, our managers and legal staff contact their counterpart liaisons and counsel, component heads, or DHS senior managers, as appropriate, either by telephone, e-mail, or letter, to communicate our access authority and need for the information to satisfy audit objectives. Our communication efforts have generally resulted in obtaining the requested or alternative information, or making other accommodations. We have proposed to DHS that the department take several steps that would enhance the efficiency of its process. First, our staff should be able to deal directly with program officials after we have held our initial entrance conference. If these officials have concerns about providing us requested information, they can involve DHS liaison or coordinators. Second, to the extent that DHS counsel finds it necessary to screen certain sensitive documents, it should do so on an exception basis. Other documents should be provided directly to us without prior review or approval by counsel. We provide DHS several opportunities to learn how we are using the information its officials provide us--we provide routine updates on our work to program officials; we provide program officials, liaisons, and counsel a "statement of facts" that basically describes what we learned during the engagement; and we formally provide DHS a copy of our draft report that contains our evidence, conclusions, and recommendations for its comment. There is no reason to hold information back from us when it has been made available to contractors, other federal agencies, state and local governments, or the public, or when its only sensitivity is that DHS considers it confidential or classified. The Secretary of DHS and the Under Secretary for Management have stated their desire to work with us to resolve access issues. We are willing to work with DHS to resolve any access-related concerns. Nevertheless, we remain troubled that the design and implementation of the current DHS process is routinely causing unnecessary delays. Mr. Chairman, this completes my prepared statement. I would be happy to respond to any questions your or other members of the subcommittee may have at this time. For further information about this statement, please contact Norman J. Rabkin, Managing Director, Homeland Security and Justice Issues, on (202) 512-8777 or rabkinn@gao.gov. Individuals making key contributions to this testimony include Linda Watson, John Vocino, Jan Montgomery, Geoff Hamilton and Richard Ascarate. GAO has broad statutory authority under title 31 of the United States Code to audit and evaluate agency financial transactions, programs, and activities. Under 31 U.S.C. SS 712, GAO has authority to investigate all matters related to the receipt, disbursement, and use of public money. Section 717 of title 31, U.S.C., authorizes GAO to evaluate the results of programs and activities of federal agencies, on GAO's own initiative or when requested by either house of Congress or a committee of jurisdiction. Section 3523(a) of title 31 authorizes GAO to audit the financial transactions of each agency, except as specifically provided by law. To carry out these audit and evaluation authorities, GAO has a broad statutory right of access to agency records. Under 31 U.S.C. SS 716(a), federal agencies are required to provide GAO with information about their duties, powers, activities, organization, and financial transactions. When an agency does not make a record available to GAO within a reasonable period of time, GAO may issue a written request to the agency head specifying the record needed and the authority for accessing the record. Should the agency fail to release the record to GAO, GAO has the authority to enforce its requests for records by filing a civil action to compel production of records in federal district court. A limitation in section 716, while not restricting GAO's basic statutory right of access, acts to limit GAO's ability to compel production of particular records through a court action. For example, GAO may not bring such an action to enforce its statutory right of access to a record where the President or the Director of the Office of Management and Budget certifies to the Comptroller General and Congress (1) that a record could be withheld under one of two specified provisions of the Freedom of Information Act (FOIA) and (2) disclosure to GAO reasonably could be expected to impair substantially the operations of the government. The first prong of this certification provision requires that such record could be withheld under FOIA pursuant to either 5 U.S.C. SS 552(b)(5), relating to inter-agency or intra-agency memorandums or letters that would not be available by law to a party other than an agency in litigation with the agency, or 5 U.S.C. SS 552(b)(7), relating to certain records or information compiled for law enforcement purposes. The second prong of the certification provision, regarding impairment of government operations, presents a very high standard for the agency to meet. The Senate report on this section 716 limitation stated: "As the presence of this additional test makes clear, the mere fact that materials sought are subject to 5 U.S.C. 552(b)(5) or (7) and therefore exempt from public disclosure does not justify withholding them from the Comptroller General. Currently GAO is routinely granted access to highly sensitive information, including internal memoranda and law enforcement files, and has established a fine record in protecting such information from improper use or disclosure. Thus, in order for the certification to be valid, there must be some unique or highly special circumstances to justify a conclusion that possession by the Comptroller General of the information could reasonably be expected to substantially impair Government operations." The committee report also points out that the Comptroller General's statutory right of access to agency records is not diminished by the certification provisions of the legislation. The certification simply allows the President or Director of the Office of Management and Budget (OMB) to preclude the Comptroller General from seeking a judicial remedy in certain limited situations. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary:
In testimony before this committee and the House Committee on Appropriations, Subcommittee on Homeland Security in February 2007, GAO stated that the Department of Homeland Security (DHS) has not made its management or operational decisions transparent enough to allow Congress to be sure that the Department is effectively, efficiently, and economically using its billions of dollars of annual funding. GAO also noted that its work for Congress to assess DHS's operations has, at times, been significantly hampered by long delays in obtaining access to program documents. Following the aforementioned testimonies, GAO was asked to testify about its access issues. This testimony provides information on (1) the scope of GAO's work, (2) GAO protocols for accessing agency information, (3) DHS processes for working with GAO, (4) access issues GAO has encountered, and (5) steps GAO has taken to address these issues. To carry out its audit and evaluation authorities, GAO has a broad statutory right of access to agency records. Auditing standards require that analysts and financial auditors promptly obtain sufficient, competent, and relevant evidence to provide a reasonable basis for any related findings and conclusions. Therefore, prompt access to all records and other information associated with these activities is needed for the effective and efficient performance of GAO's work. This is also necessary in order for the Congress to be able to conduct its constitutional responsibilities in a timely and effective manner. Since DHS began operations in 2003, GAO has provided major analyses of the department's plans and programs for transportation security, immigration, Coast Guard, and emergency management. GAO has also reported on DHS's management functions such as human capital, financial management, and information technology. GAO has processes it applies in working with departmental agencies across the federal government that work well. DHS's adopted processes have frequently impeded GAO's efforts to carry out its mission by delaying access to documents required to assess the department's operations. This process involves multiple layers of review by department- and component-level liaisons and attorneys and results in frequent and sometimes lengthy delays in obtaining information. GAO recognizes that the department has legitimate interests in protecting certain types of sensitive information from public disclosure. GAO shares that interest as well and follows strict security guidelines in handling such information. GAO similarly recognizes that agency officials will need to make judgments with respect to the manner and the processes they use in response to GAO's information requests. However, to date, because of the processes adopted to make these judgments, GAO has often not been able to do its work in a timely manner. GAO has been able to eventually obtain information and answer audit questions, but the delays experienced at DHS impede GAO's ability to conduct audit work efficiently and to provide timely information to congressional clients.