In 2003, the Department of Homeland Security was created and tasked with integrating numerous agencies and offices with varying missions from the General Services Administration; the Federal Bureau of Investigation; and the Departments of Agriculture, Defense, Energy, Health and Human Services, Justice, Transportation, and Treasury; as well as the Coast Guard and the Secret Service. Eight DHS components have internal procurement offices with a Head of Contracting Activity (HCA) who reports directly to the component head and is accountable to the CPO. The Office of Procurement Operations (OPO) also has an HCA who provides contracting support to all other components and reports directly to the CPO. The HCA for each component has overall responsibility for the day-to-day management of the component's acquisition function. Figure 1 shows the organizational relationship between the HCAs and the CPO. We reported in September 2006 that DHS planned to fully implement its acquisition oversight program during fiscal year 2007. The plan is composed of four recurring reviews: self-assessment, operational status, on-site, and acquisition planning. The CPO has issued an acquisition oversight program guidebook, provided training on self-assessment and operational status reviews, and began implementation of the four reviews in the plan (see table 1). The acquisition oversight plan generally incorporates basic principles of an effective and accountable acquisition function and includes mechanisms to monitor acquisition performance. Specifically, the plan incorporates DHS policy, internal controls, and elements of an effective acquisition function: organizational alignment and leadership, policies and processes, human capital, knowledge and information management, and financial accountability. While it is too early to assess the plan's overall effectiveness in improving acquisition performance, initial implementation of the first self-assessment has helped most components prioritize actions to address identified weaknesses. In addition, the CPO has helped several components implement organizational and process changes that may improve acquisition performance over time. For example, one component, with the assistance of the CPO, elevated its acquisition office to a level equivalent to its financial office. However, the acquisition planning reviews are not sufficient to determine if components' adequately plan their acquisitions. Federal acquisition regulations and DHS directives require agencies to perform acquisition planning in part to ensure good value, including cost and quality. Component HCAs are responsible to ensure that acquisition plans are completed in a timely manner, include an efficient and effective acquisition strategy and the resulting contract action or actions support the component's mission. Inadequate procurement planning can lead to higher costs, schedule delays, and systems that do not meet mission objectives. Several recent reviews have identified problems in DHS's acquisition planning. In 2006, we reported that DHS often opted for speed and convenience in lieu of planning and analysis when selecting a contracting method and may not have obtained a good value for millions of dollars in spending. As part of a 2006 special review of Federal Emergency Management Agency's (FEMA) contracts, DHS's CPO found significant problems with the requirements process and acquisition strategy and recommended in part that FEMA better plan acquisitions. For example, the CPO reported that FEMA's total cost for its temporary housing program could have been significantly reduced if FEMA had appropriately planned to acquire temporary homes before the fiscal year 2005 hurricane season. A 2006 internal review of the Office of Procurement Operation's contracts similarly found little evidence that acquisition planning occurred in compliance with regulations. While a key goal of the oversight program is to improve acquisition planning, we found potential problems with each of the three elements of the acquisition planning reviews, as shown in table 2. DHS faces two challenges in achieving the goals of its acquisition oversight plan. First, the CPO has had limited resources to implement the plan reviews. When implementation of the plan began in 2006, only two personnel were assigned acquisition oversight as their primary duty. The CPO received funding for eight additional oversight positions. However, officials told us that they have struggled to find qualified individuals. As of June 2007, seven positions had been filled. As part of the Department's fiscal year 2008 appropriation request, the CPO is seeking two additional staff, for a total of 12 oversight positions. The CPO will also continue to rely on resources from components to implement the plan, such as providing staff for on-site reviews. Second, while the CPO can make recommendations based on oversight reviews, the component head ultimately determines what, if any, action will be taken. DHS's organization relies on cooperation and collaboration between the CPO and components to accomplish departmentwide acquisition goals. However, to the extent that the CPO and components disagree on needed actions, the CPO lacks the authority to require compliance with recommendations. We have previously reported that the DHS system of dual accountability results in unclear working relationships between the CPO and component heads. DHS policy also leaves unclear what enforcement authority the CPO has to ensure that acquisition initiatives are carried out. In turn, we recommended that the Secretary of Homeland Security provide the CPO with sufficient enforcement authority to effectively oversee the Department's acquisitions--a recommendation that has yet to be implemented. CPO officials believe that there are other mechanisms to influence component actions, such as providing input into HCA hiring decisions and performance appraisals. Making the most of opportunities to strengthen its acquisition oversight program--along with overcoming implementation challenges--could position the agency to achieve better acquisition outcomes. We identified two such opportunities: periodic external assessments of the oversight program and sharing knowledge gained from the oversight plan reviews across the department. Federal internal control standards call for periodic external assessments of programs to help ensure their effectiveness. An independent evaluation of DHS's acquisition oversight program by the Inspector General or an external auditor could help strengthen the oversight conducted through the plan and better ensure that the program is fully implemented and maintaining its effectiveness over time. In particular, an external assessment with results communicated to appropriate officials can help maintain the strength of the oversight program by alerting DHS to acquisition concerns that require oversight, as well as monitoring the plan's implementation. For example, the plan initially called for components to complete the self-assessment by surveying their acquisition staff; however, the level of staff input for the first self-assessments was left to the discretion of the HCAs. Specifically, CPO officials advised HCAs to complete the questions themselves, delegate the completion to one or more staff members, or select a few key people from outside their organization to participate. While evolution of the plan and its implementation is to be expected and can result in improvements, periodic external assessments of the plan could provide a mechanism for monitoring changes to ensure they do not diminish oversight. Federal internal control standards also call for effective communication to enable managers to carry out their responsibilities and better achieve components' missions. The CPO has been assigned responsibility for ensuring the integrity of the oversight process--in part by providing lessons learned for acquisition program management and execution. While the CPO intends to share knowledge with components by posting lessons learned from operational status reviews to DHS's intranet, according to CPO officials, the Web site is currently limited to providing guidance and training materials and does not include a formal mechanism to share lessons learned among components. In addition to the Web site, other opportunities may exist for sharing knowledge. For example, CPO officials indicated that the CPO meets monthly with component HCAs to discuss acquisition issues. The monthly meetings could provide an opportunity to share and discuss lessons learned from oversight reviews. Finally, knowledge could be regularly shared with component acquisition staff through internal memorandums or reports on the results of oversight reviews. Integrating 22 federal agencies while implementing acquisition processes needed to support DHS's national security mission is a herculean effort. The CPO's oversight plan generally incorporates basic principles of an effective acquisition function, but absent clear authority, the CPO's recommendations for improved acquisition performance are, in effect, advisory. Additional actions are needed to achieve the plan's objectives and opportunities exist to strengthen oversight through enhanced internal controls. Until DHS improves its approach for overseeing acquisition planning, the department will continue to be at risk of failing to identify and address recurring problems that have led to poor acquisition outcomes. To improve oversight of component acquisition planning processes and the overall effectiveness of the acquisition oversight plan, we recommend that the Secretary of Homeland Security direct the Chief Procurement Officer to take the following three actions: Reevaluate the approach to oversight of acquisition planning reviews and determine whether the mechanisms under the plan are sufficient to monitor component actions and improve component acquisition planning efforts. Request a periodic external assessment of the oversight plan implementation and ensure findings are communicated to and addressed by appropriate officials. Develop additional opportunities to share lessons learned from oversight reviews with DHS components. We provided a draft of this report to DHS for review and comment. In written comments, DHS generally agreed with our facts and conclusions and concurred with all of our recommendations and provided information on what actions would be taken to address them. Regarding the recommendation on acquisition planning, DHS stated that during on-site reviews they will verify that CPO comments on acquisition plans have been sufficiently addressed. DHS is also developing training for component HCAs and other personnel to emphasize that CPO comments related to compliance with applicable laws and regulations must be incorporated into acquisition plans. The CPO will also annually require an acquisition planning review as part of the oversight plan's operational status reviews. Additionally, DHS intends to change the advanced acquisition planning database so that historical data are available for review. With regard to the recommendation for periodic external assessment of the oversight plan, DHS stated they plan to explore opportunities to establish a periodic external review of the oversight program. However, the first priority of the acquisition oversight office is to complete initial component on-site reviews. For the recommendation to develop additional opportunities to share lessons learned from oversight reviews, DHS stated it intends to share consolidated information from operational status and on-site reviews in regular meetings with component HCA staff. In addition, the CPO plans to explore further opportunities for sharing oversight results with the entire DHS acquisition community. DHS also responded to a 2005 GAO recommendation on the issue of the CPO lacking authority over the component HCAs. DHS commented that it is in the process of modifying its acquisition lines of business management directive to ensure that no DHS contracting organization is exempt. In addition, DHS stated that the Under Secretary for Management has authority as the Chief Acquisition Officer to monitor acquisition performance, establish clear lines of authority for making acquisition decisions, and manage the direction of acquisition policy for the department, and that these authorities also devolve to the CPO. Modifying the management directive to ensure no DHS contracting organization is exempt is a positive step. However, until DHS formally designates the Chief Acquisition Officer, and modifies applicable management directives to support this designation, DHS's existing policy of dual accountability between the component heads and the CPO leaves unclear the CPO's authority to enforce corrective actions to achieve the department's acquisition goals, which was the basis of our earlier recommendation. DHS's letter is reprinted in appendix II. DHS also provided technical comments which were incorporated as appropriate. We are sending copies of this report to interested congressional committees and the Secretary of Homeland Security. We will also make copies available to others upon request. In addition, the report will be available at no charge on GAO's Web site at http://www.gao.gov. If you or your staff have questions regarding this report, please contact me at (202) 512-4841 or huttonj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Principal contributors to this report were Amelia Shachoy, Assistant Director; William Russell; Tatiana Winger; Heddi Nieuwsma; Lily Chin; Karen Sloan; and Sylvia Schatz. To determine actions taken by DHS to implement the acquisition oversight plan and challenges DHS faces, we reviewed prior GAO and DHS Office of the Inspector General reports pertaining to acquisition oversight as well as relevant DHS documents, such as the oversight plan, documents of completed reviews and guidance to components, including training materials. We interviewed officials in the CPO's office and the nine DHS components with acquisition offices. We compared efforts undertaken to implement the plan by DHS officials against established program policies, the fiscal year 2007 implementation schedule, and other guidance materials. We reviewed four component self-assessments that were provided to us and also reviewed areas in which the CPO provided assistance to components based on self-assessment results. We also reviewed Standards for Internal Control in the Federal Government. We conducted our work from February 2007 to June 2007 in accordance with generally accepted government auditing standards.

Summary:
The Department of Homeland Security (DHS), the third largest department in federal procurement spending in fiscal year 2006, has faced ongoing cost, schedule, and performance problems with major acquisitions and procurement of services. In December 2005, DHS established an acquisition oversight program to provide insight into and improve components' acquisition programs. In 2006, GAO reported that DHS faced challenges in implementing its program. Congress mandated that DHS develop an oversight plan and tasked GAO with analyzing the plan. GAO (1) evaluated actions DHS and its components have taken to implement the acquisition oversight plan and (2) identified implementation challenges. GAO also identified opportunities for strengthening oversight conducted through the plan. GAO reviewed relevant DHS documents and GAO and DHS Inspector General reports and interviewed officials in the office of the Chief Procurement Officer (CPO) and nine DHS components. The CPO has taken several actions to implement DHS's acquisition oversight plan--which generally incorporates basic principles of an effective and accountable acquisition function. The plan monitors acquisition performance through four recurring reviews: self-assessment, operational status, on-site, and acquisition planning. Each component has completed the first self-assessment, which has helped components identify and prioritize acquisition weaknesses. In addition, each component has submitted an initial operational status report to the CPO and on-site reviews are being conducted. Despite this progress, the acquisition planning reviews are not sufficient to determine if components adequately plan their acquisitions--in part because a required review has not been implemented and the CPO lacks visibility into components' planning activities. DHS faces two key challenges in implementing its acquisition oversight plan. First, the CPO has had limited oversight resources to implement plan reviews. However, recent increases in staff have begun to address this challenge. Second, the CPO lacks sufficient authority to ensure components comply with the plan--despite being held accountable for departmentwide management and oversight of the acquisition function. GAO has previously recommended that DHS provide the CPO with sufficient enforcement authority to enable effective acquisition oversight. In addition to these challenges, GAO identified two opportunities to strengthen internal controls for overseeing the plan's implementation and for increasing knowledge sharing. Specifically, independent evaluations of DHS's oversight program could help ensure that the plan maintains its effectiveness over time. Sharing knowledge and lessons learned could provide DHS's acquisition workforce with the information needed to improve their acquisition processes and better achieve DHS's mission.