This appendix describes how we developed the risk management framework and how we used it to evaluate activities related to homeland security and combating terrorism. The framework is intended to be a starting point for risk management activities and will likely evolve as processes mature and lessons are learned. A glossary is included at the end of this appendix. Although the Homeland Security Act and subsequent strategies advocate the use of risk management to protect the nation's critical infrastructure and key resources, they did not define how this was to be accomplished. Homeland Security Presidential Directive 7 (HSPD-7) directed the Secretary of the Department of Homeland Security (DHS) to establish uniform policies, approaches, guidelines, and methodologies integrating federal infrastructure protection and risk management activities. However, no further direction or guidance as to the course of action has been forthcoming. The ability to anticipate future happenings and to choose among alternatives lies at the heart of risk management and provides us with a guide, based on good management practices and supported by established internal controls that can enhance decision making. Although risk management has long been used for assessing risk in some sectors, such as environmental issues, health care, finance, and the insurance industry, the application of risk management principles to the homeland security area is relatively new. The many areas and activities under homeland security provide untested and difficult challenges because the source of the risk is an intelligent adversary with whom there exists little domestic experience. As a result, the probabilities and consequences of a terrorist attack are difficult to predict. In spite of this high degree of uncertainty and the knowledge that not all risk can be eliminated, enhancing protection from known or potential threats can help prevent or mitigate adverse events. Given that there is no established universally agreed upon set of requirements or processes for a risk management framework specifically related to homeland security and combating terrorism, we developed a framework that would be applicable by reviewing, analyzing, and synthesizing several sources of information. We began by reviewing current risk literature and previous GAO reports and testimonies. We consulted the Government Performance and Results Act (GPRA) of 1993; the Government Auditing Standards, 2003 Revision, GAO's Standards for Internal Control in the Federal Government (November 1999); guidance from the Office of Management and Budget (OMB); the work of the President's Commission on Risk Management; consulting papers; and the enterprise risk management approach of the Committee of Sponsoring Organizations (COSO) of the Treadway Commission. In addition, we consulted with experts in the fields of risk management, risk modeling, and terrorism. We reviewed numerous frameworks from industry, government, and academic sources. We synthesized information from these numerous government, industry, and academic sources in developing our risk management framework. The framework was field-tested on several GAO reviews. The draft framework was then reviewed by three academic experts in risk management. No substantial changes to the draft framework were recommended. The framework should be considered to be a starting point in a field that is evolving, and the entire cycle of risk management activities should be viewed as a goal. The phases contained in the framework are strategic goals, objectives, and constraints; risk assessment; alternatives evaluation; management selection; and implementation and monitoring. The framework has been developed so that individual phases of the approach, such as risk assessment, do not become ends in themselves, but provide a full cycle of related activities, from strategic planning through implementation and monitoring. The process is dynamic, and although the various phases appear linear, new information can be entered at any phase. The framework can be used to inform agency officials and decision makers of the basic components of a risk management system or can be used as a stand-alone guide. Figure 4 illustrates our risk management framework and some sources of criteria, such as GAO best practices, Office of Management and Budget circulars, GAO guidance on internal controls, and the Government and Performance Act of 1993 and their link with management processes. While statistical methods and risk-ranking approaches frequently underlie risk assessment approaches, different application areas tend to develop their own terminologies and their own logical sequences for the cause of risk. The risk management framework is designed to be flexible, in that the approach may be applied at various organizational levels ranging from that of a department level of a multiagency organization down to that of a specific project or program. Because there is no one uniformly accepted approach to risk management, terms and activities may differ across applications. However, any approach that omits the substance of the steps shown in figure 4 is likely to have material weaknesses. Table 11 summarizes the phases of our risk management framework and provides examples of elements contained in those phases. The following sections provide more detail on the five phases of our risk management framework. This phase addresses what the strategic goals are attempting to achieve and the steps needed to attain those results, including milestones and performance measures to permit measurement of progress toward those goals. Ideally, management decisions should be made in the context of a strategic plan, with clearly articulated goals and objectives that flow from the plan. Strategic goals at the highest level could be considered an "end- state" followed by a logical hierarchy of major goals and subordinate objectives composed of clear, concise, measurable activities and timelines to achieve results and ensure accountability. An organization's program or plan and risk planning documents should address risk-related issues that are central to its mission. Our work related to the Government Performance and Results Act of 1993 has produced guidance that identifies risk for the congressional oversight of federal agencies' strategic plans. The consideration of risk in strategic planning may be incorporated into planning documents or into specific management strategies. Currently, it is difficult to translate plans and actions into a clear sense of how we are progressing in making our nation more secure. One reason is that homeland security efforts, in general, lack clear goals with corresponding performance measures to evaluate progress toward these goals. As others, such as the Gilmore Commission, have stated, a continuing problem for homeland security has been the lack of clear strategic guidance about the definition and objectives of preparedness. Risk management allows entities to operate more effectively in environments of uncertainty by providing the discipline and structure in which to address these issues, since risk management is not an end in itself, but an important component of an entity's management process. As such, risk management is interrelated with, among other things, an entity's governance, performance management, and internal controls. The process of risk management provides the rigor and structure necessary to identify and select among alternative risk responses whose cumulative effect is intended to reduce risk, and the methodologies and techniques for making selection decisions. This process enables entities to enhance their capability to identify potential adverse events, assess risks, and establish integrated responses. Further, this phase in the planning process would include support and buy-in from upper levels of management and stakeholders. Acceptance for concepts of the model from this group provides the groundwork for future discussions. Finally, various constraints may have an impact on risk management plans. Some constraints may be imposed by statute, higher-level policy, budget, or other factors beyond management's control and may vary with the scale of the application. Managers at different levels within an organization will have different degrees of flexibility to institute risk management countermeasures. An important constraint for federal agencies, such as DHS, is the role that Congress plays in authorizing and funding programs. For example, Congress may direct specific actions affecting how agencies allocate funding. This phase addresses the process of evaluating the threats and vulnerabilities of assets so that countermeasures might be instituted to prevent or mitigate risks. Threat, in the risk management model, concerns the probability that a specific type of attack will be initiated against a specific target. It includes any circumstance or event with the potential to cause loss or damage to the asset. Although agencies may not have enough information to identify and characterize all threats related to their assets, known or imagined adverse events would be characterized in some detail. Effective threat analysis is dependent on an understanding of an adversary's intention, motivation, historical data, and capability to damage. An additional crucial component of risk assessment is vulnerability, that is, any weakness that an adversary can exploit to harm or damage the asset. An asset may be highly vulnerable to one mode of attack but have a low level of vulnerability to another, depending on a variety of factors, such as countermeasures already in place. While consequence concerns the result of an adverse event on a particular asset, criticality is the asset's relative importance to the entity. A criticality assessment identifies and prioritizes assets and functions in terms of specific criteria, such as their importance to public safety and the economy, as a basis for identifying which structures or processes are relatively more important to protect from attack. Criticality assessments are important because they provide, in combination with the framework's threat and risk assessments, the basis for prioritizing which assets require greater protection relative to finite resources and provide information for later stages in the risk management process. Risk assessments should utilize the most appropriate subject matter experts in assessing the components of risk. When dealing with Bayesian probability estimates, this is critical. In addition, mathematical constructs must be chosen carefully, specifically tailoring approaches in the context of uncertainty and data quality. This phase addresses the evaluation of risk reduction methods by consideration of countermeasures or countermeasure systems and the costs and benefits associated with them. Ideally, a risk management framework would include an evaluation of a risk assessment as a valid decision support tool to establish and prioritize a risk management strategy. Furthermore, a strategy might include risk management consultants and decision-making tools, such as software that simulates a particular type of attack. Information developed in previous phases would inform decisions. Specific countermeasures would be considered and prioritized based on a number of factors, such as the degree of risk reduction they afford and the cost and difficulty to implement them. Risk assessment may give guidance to implementing countermeasures or countermeasure systems that may be used for more than one critical asset, or to prevent, mitigate, or respond to multiple adverse events occurring simultaneously. In addition, external risk consultants can be advantageous at this phase in terms of creating a variety of countermeasure options. While external reviewers cannot ensure the success of a plan, they can increase the probability of selecting the most effective countermeasures for the least cost because of their expertise in the area. Further, risk scenarios might also provide valuable information pertaining to an entity's ability to respond to a terrorist event, evaluate its coordination with other entities, identify problems, and institute corrective action. Finally, a risk management strategy should include a cost-benefit analysis of countermeasure options as they are a critical element of alternatives evaluation. Major regulatory actions or capital investments of federal expenditures generally require a cost-benefit or cost-effectiveness approach. This approach can be useful in evaluating alternatives, since it links the benefits from risk-reducing countermeasures to the costs associated with them. In the development of such analyses, quantitative impacts affecting both costs and benefits are, to the extent possible, identified in monetary terms. While the core OMB guidance for evaluating countermeasures for budgetary and regulatory purposes focuses on monetary cost-benefit evaluation, OMB is essentially silent when costs and benefits cannot be easily quantified or monetized. Costs that are not generally estimated or included in monetary terms include opportunity costs, that is, the value of opportunities forgone because resources are applied to antiterrorism countermeasures. These costs are most controversial when considered in areas such as public service programs or services curtailed or cancelled. Benefits are usually measured in terms of the risk reduction they provide. They are considered in terms of the overall effectiveness of the countermeasures with respect to the estimated vulnerabilities. This phase addresses such issues as determining where resources and investments will be made, the sources and types of resources needed, and where those resources would be targeted. Management's active participation in this phase is important as decisions are of necessity influenced by the preferences and value judgments of agency leadership. For example, some managers will prefer to concentrate countermeasures on a relatively few critical assets, while others may value distributional impacts, that is, to distribute resources over a wide variety of assets. Ideally, a risk management strategy would also identify appropriate mechanisms to allocate resources, such as grants based on identified needs. Furthermore, a key factor in the selection of risk reducing measures is risk tolerance, the level of comfort management has with various levels of risk. This tolerance may change over time, depending on new information, changes in financial constraints, and attitude toward risk. The risk management strategy, with stakeholder input, will identify what constitutes an acceptable level of risk for assets and how resources are delegated. The risk management strategy reflects consideration as to which risks should be managed immediately and to what extent, and which risks can be deferred and addressed at a later time. Milestones and timelines for implementation are important elements that allow evaluating the extent to which progress is being made toward achieving goals. It also illustrates the degree of protection that can be obtained and places security and costs in perspective. The documentation of management decisions, including the rationales that support the decisions, will provide valuable information for future adjustments. This phase addresses the degree to which risk management strategies contain internal controls and performance measurement guidelines. In addition to implementing countermeasures, it may also include implementing new organizational policies and procedures, as well as human, physical, and technical controls. Countermeasures would be initiated in accordance with the timelines in the risk management schedule. Monitoring and evaluation include, when and where appropriate, external peer review, testing and validation of countermeasures, evaluating the effects of these actions on future operation, and identifying unintended consequences. GAO has also discussed the importance of these activities as they ensure actions are taken to address risks. Internal control monitoring should assess the quality of performance over time and ensure that the findings of audits and other reviews are promptly resolved. Internal controls help to ensure that procedures are documented and maintained. Risk management represents a unique set of challenges. Developing such a framework is designed to guide the actions of management to prepare for and respond to adverse events in an environment of uncertainty. As applied to homeland security, the ability to determine the likelihood of terrorism-related events occurring and quantifying the resulting outcomes is balanced against the benefit as protection (security) provided at an acceptable cost. Generally, a major difficulty in executing and implementing a risk management system occurs because of what is commonly called decision uncertainty, that is, the assumed goal of minimizing risk does not have a common meaning. For example, minimizing risk is based on values, the measure of risk, and the comparison of values and risk. Decision uncertainty arises when there is controversy or ambiguity concerning how to compare and weight social objectives. Three major sources of decision uncertainty are Risk measurement--although the selection of risk measurement is both an art and a science, it must be technically correct as well as both valid and meaningful. The social cost of risk--in order to make different risks comparable, various risks often have to be quantified into comparable quantities and placing values on cost and benefits involves judgments. The quantification of social values--uncertainty surrounds the level of risk that is acceptable or can be tolerated. That is, how much money is to be spent on protection meaning risk reduction and what is the cost in terms of opportunities forgone because of finite resources. This value is dependent upon determining society's risk attitude or tolerance and may change over time. Coordination activities suggest that for the results of a risk management system to be meaningful and useful, all related agencies should be using similar methods. If agencies' methods are not compatible, then comparisons between agencies become difficult and sector or national risk assessments becomes less reliable. In our earlier work, we concluded that a structured, systematic approach to risk management offers the best assurance that activities designed to protect the homeland and combat the effects of terrorism will produce the most effective and efficient results. Specific difficulties implementing risk management systems are contained in chapters 2, 3, and 4. For purposes of our risk management framework, we use the following definitions: Asset---any person, facility, material, information, or activity that has a positive or symbolic value. An asset may have a value to an adversary as well as to its owner, although the nature and magnitude of these values may differ. Assets may be categorized or combined in many ways; examples are people, information, equipment, facilities, operations, and activities. Benefit---net outcome, usually translated into monetary terms; a benefit may include both direct and indirect effects. Consequence---the expected worse case or reasonable worse case impact of a successful attack. The consequence to a particular asset can be evaluated when threat and vulnerability are considered together. This loss or damage may be long- or short-term in nature. Cost---input, both direct and indirect. Cost-benefit analysis---part of the management decision-making process in which the costs and benefits of each countermeasure alternative are compared and the most appropriate alternative is selected. Costs include the price paid for tangible materials and the ongoing operational costs associated with implementing the countermeasures. Benefits are expressed in terms of the amount of risk reduction based on the overall effectiveness of the countermeasure with respect to the assessed vulnerabilities. Countermeasure---any action taken or physical equipment used principally to reduce or eliminate one or more vulnerabilities. The cost of a countermeasure is usually expressed in monetary terms but may include nonmonetary costs such as reduced operational effectiveness, unfavorable working conditions, adverse publicity and political consequences. Criticality assessment---identifies and evaluates an entity's assets or operations on the basis of a variety of factors, including the importance of an asset or function and the significance of a system in terms of national security, economic activity, and public safety. A criticality assessment provides the basis for determining which assets require greater or special protection relative to finite resources. Impact---the amount of loss or damage that can be expected from a successful attack on an asset. Loss may be monetary, but may include loss of lives and destruction of a symbolic structure. Monitoring and evaluation---is a continuous repetitive assessment process to keep a risk management process current and relevant. It includes, among other activities, external peer review, testing, and validation. Opportunity cost--the value of opportunities forgone. Risk--an event that has a potentially negative impact and the possibility that such an event will occur and adversely affect an entity's assets, activities, and operations. The principal classes of risk from terrorism are to the general public, targets of symbolic value, organizational, governmental, and societal infrastructure, cyber and physical infrastructure, and economic sectors and structures. Risk assessment---the process of qualitatively or quantitatively determining the probability of an adverse event and the severity of its impact on an asset. It is a function of threat, vulnerability, and consequence. A risk assessment may include scenarios in which two or more risks interact to create a greater or lesser impact. A risk assessment provides the basis for the rank ordering of risks and for establishing priorities for applying countermeasures. Risk management---a continuous process of managing--through a series of mitigating actions that permeate an entity's activities--the likelihood of an adverse event and its negative impact. Risk management addresses risk before mitigating action, as well as the risk that remains after countermeasures have been taken. Scenario---the combination of weapon and attack mode on a specific target or critical asset (for example, the release of sarin gas in a subway train). Threat---an indication of the likelihood that a specific type of attack will be initiated against a specific target or class of targets. It may include any indication, circumstance, or event with the potential to cause the loss of or damage to an asset. It can also be defined as an adversary's intention and capability to undertake actions that would be detrimental to a valued asset. Threat assessment---the identification and evaluation of adverse events that can harm or damage an asset. A threat assessment includes the probability of an event and the extent of its lethality. Threats may be present at the global, national, or local level. Vulnerability---the probability that a particular attempted attack will succeed against a particular target or class of targets. Vulnerability assessment---the identification of weaknesses in physical structures, personal protection systems, processes or other areas that may be exploited. A vulnerability assessment identifies inherent states and the extent of their susceptibility to exploitation relative to the existence of any countermeasures. In addition to the persons named above, David Alexander, Neil Asaba, Nancy A. Briggs, Christine Davis, Scott Farrow, Kevin Heinz, Emily S. Pickrell, Albert Schmidt, Stan Stenersen, April Thompson, and L. James Valverde made key contributions to this report. Critical Infrastructure Protection: Challenges in Addressing Cybersecurity. GAO-05-827T. Washington, D.C.: July 19, 2005 Critical Infrastructure Protection: Department of Homeland Security Faces Challenges in Fulfilling Cybersecurity Responsibilities. GAO-05-434. Washington, D.C.: May 26, 2005. Homeland Security: Agency Plans, Implementation, and Challenges Regarding the National Strategy for Homeland Security. GAO-05-33. Washington, D.C.: January 14, 2005. Homeland Security: Further Actions Needed to Coordinate Federal Agencies' Facility Protection Efforts and Promote Key Practices. GAO-05-49. Washington, D.C.: November 30, 2004. U.S. Postal Service: Physical Security Measures Have Increased at Some Core Facilities, but Security Problems Continue. GAO-05-48. Washington, D.C.: November 16, 2004. Drinking Water: Experts' Views on How Federal Funding Can Best Be Spent to Improve Security. GAO-04-1098T. Washington, D.C.: September 30, 2004. Financial Market Preparedness: Improvements Made, but More Action Needed to Prepare for Wide-Scale Disasters. GAO-04-984. Washington, D.C.: September 27, 2004. Nuclear Regulatory Commission: Preliminary Observations on Efforts to Improve Security at Nuclear Power Plants. GAO-04-1064T. Washington, D.C.: September 14, 2004. U.S. Postal Service: Better Guidance Is Needed to Ensure an Appropriate Response to Anthrax Contamination. GAO-04-239. Washington, D.C.: September 9, 2004. Public Key Infrastructure: Examples of Risk and Internal Control Objectives Associated with Certification Authorities. GAO-04-1023R. Washington, D.C.: August 10, 2004. Combating Terrorism: DOD Efforts to Improve Installation Preparedness Can Be Enhanced with Clarified Responsibilities and Comprehensive Planning. GAO-04-855. Washington, D.C.: August 9, 2004. Homeland Security: Transformation Strategy Needed to Address Challenges Facing the Federal Protective Service. GAO-04-537. Washington, D.C.: July 14, 2004. Critical Infrastructure Protection: Improving Information Sharing with Infrastructure Sectors. GAO-04-780. Washington, D.C.: July 9, 2004. Information Security: Agencies Need to Implement Consistent Processes in Authorizing Systems for Operation. GAO-04-376. Washington, D.C.: June 28, 2004. National Nuclear Security Administration: Key Management Structure and Workforce Planning Issues Remain as NNSA Conducts Downsizing. GAO-04-545. Washington, D.C.: June 25, 2004. Nuclear Security: Several Issues Could Impede Ability of DOE's Office of Energy, Science, and Environment to Meet the May 2003 Design Basis Threat. GAO-04-894T. Washington, D.C.: June 22, 2004. Information Security: Information System Controls at the Federal Deposit Insurance Corporation. GAO-04-630. Washington, D.C.: May 28, 2004. Posthearing Questions Related to Fragmentation and Overlap in the Federal Food Safety System. GAO-04-832R. Washington, D.C.: May 26, 2004. Terrorism Insurance: Effects of Terrorism Risk Insurance Act of 2002. GAO-04-720T. Washington, D.C.: April 28, 2004. Nuclear Security: DOE Needs to Resolve Significant Issues before It Fully Meets the New Design Basis Threat. GAO-04-623. Washington, D.C.: April 27, 2004. Terrorism Insurance: Implementation of the Terrorism Risk Insurance Act of 2002. GAO-04-307. Washington, D.C.: April 23, 2004. Critical Infrastructure Protection: Establishing Effective Information Sharing with Infrastructure Sectors. GAO-04-699T. Washington, D.C.: April 21, 2004. Homeland Security: Federal Action Needed to Address Security Challenges at Chemical Facilities. GAO-04-482T. Washington, D.C.: February 23, 2004. Posthearing Questions from the September 17, 2003, Hearing on "Implications of Power Blackouts for the Nation's Cybersecurity and Critical Infrastructure Protection: The Electric Grid, Critical Interdependencies, Vulnerabilities, and Readiness." GAO-04-300R. Washington, D.C.: December 8, 2003. Security: Counterfeit Identification Raises Homeland Security Concerns. GAO-04-133T. Washington, D.C.: October 1, 2003. Nuclear Regulatory Commission: Oversight of Security at Commercial Nuclear Power Plants Needs to Be Strengthened. GAO-03-752. Washington, D.C.: September 4, 2003. Nuclear Security: DOE Faces Security Challenges in the Post September 11, 2001, Environment. GAO-03-896TNI. Washington, D.C.: June 24, 2003. Nuclear Security: NNSA Needs to Better Manage Its Safeguards and Security Program. GAO-03-471. Washington, D.C.: May 30, 2003. Information Security: Progress Made, but Challenges Remain to Protect Federal Systems and the Nation's Critical Infrastructures. GAO-03-564T. Washington, D.C.: April 8, 2003. Homeland Security: EPA's Management of Clean Air Act Chemical Facility Data. GAO-03-509R. Washington, D.C.: March 14, 2003. Homeland Security: Voluntary Initiatives Are Under Way at Chemical Facilities, but the Extent of Security Preparedness Is Unknown. GAO-03-439. Washington, D.C.: March 14, 2003. Potential Terrorist Attacks: Additional Actions Needed to Better Prepare Critical Financial Market Participants. GAO-03-414. Washington, D.C.: February 12, 2003. Potential Terrorist Attacks: More Actions Needed to Better Prepare Critical Financial Markets. GAO-03-468T. Washington, D.C.: February 12, 2003. Potential Terrorist Attacks: Additional Actions Needed to Better Prepare Critical Financial Market Participants. GAO-03-251. Washington, D.C.: February 12, 2003. High-Risk Series: Protecting Information Systems Supporting the Federal Government and the Nation's Critical Infrastructures. GAO-03-121. Washington, D.C.: January 1, 2003. Combating Terrorism: Actions Needed to Guide Services' Antiterrorism Efforts at Installations. GAO-03-14. Washington, D.C.: November 1, 2002. Homeland Security: Department of Justice's Response to Its Congressional Mandate to Assess and Report on Chemical Industry Vulnerabilities. GAO-03-24R. Washington, D.C.: October 10, 2002. Building Security: Interagency Security Committee Has Had Limited Success in Fulfilling Its Responsibilities. GAO-02-1004. Washington, D.C.: September 17, 2002. Chemical Safety: Emergency Response Community Views on the Adequacy of Federally Required Chemical Information. GAO-02-799. Washington, D.C.: July 31, 2002. Critical Infrastructure Protection: Significant Homeland Security Challenges Need to Be Addressed. GAO-02-918T. Washington, D.C.: July 9, 2002. Information Security: Corps of Engineers Making Improvements, but Weaknesses Continue. GAO-02-589. Washington, D.C.: June 10, 2002. Security Breaches at Federal Buildings in Atlanta, Georgia. GAO-02-668T. Washington, D.C.: April 30, 2002. National Preparedness: Technologies to Secure Federal Buildings. GAO-02-687T. Washington, D.C.: April 25, 2002. Diffuse Security Threats: Technologies for Mail Sanitation Exist, but Challenges Remain. GAO-02-365. Washington, D.C.: April 23, 2002. Terrorism Insurance: Rising Uninsured Exposure to Attacks Heightens Potential Economic Vulnerabilities. GAO-02-472T. Washington, D.C.: February 27, 2002. Critical Infrastructure Protection: Significant Challenges in Safeguarding Government and Privately Controlled Systems from Computer-Based Attacks. GAO-01-1168T. Washington, D.C.: September 26, 2001. Combating Terrorism: Actions Needed to Improve DOD Antiterrorism Program Implementation and Management. GAO-01-909. Washington, D.C.: September 19, 2001. Critical Infrastructure Protection: Significant Challenges in Protecting Federal Systems and Developing Analysis and Warning Capabilities. GAO-01-1132T. Washington, D.C.: September 12, 2001. Coast Guard: Progress Being Made on Addressing Deepwater Legacy Asset Condition Issues and Program Management, but Acquisition Challenges Remain. GAO-05-757. Washington, D.C.: July 22, 2005. Coast Guard--Electronic Certification Procedures. B-302789. Washington, D.C.: July 6, 2005 Coast Guard: Preliminary Observations on the Condition of Deepwater Legacy Assets and Acquisition Management Challenges. GAO-05-651T. Washington, D.C.: June 21, 2005. Maritime Security: Enhancements Made, but Implementation and Sustainability Remain Key Challenges. GAO-05-448T. Washington, D.C.: May 17, 2005. Coast Guard: Preliminary Observations on the Condition of Deepwater Legacy Assets and Acquisition Management Challenges. GAO-05-307T. Washington, D.C.: April 20, 2005. Maritime Security: New Structures Have Improved Information Sharing, but Security Clearance Processing Requires Further Attention. GAO-05-394. Washington, D.C.: April 15, 2005. Coast Guard: Observations on Agency Priorities in Fiscal Year 2006 Budget Request. GAO-05-364T. Washington, D.C.: March 17, 2005. Homeland Security: Process for Reporting Lessons Learned from Seaport Exercises Needs Further Attention. GAO-05-17. Washington, D.C.: January 14, 2005. Coast Guard: Station Readiness Improving, but Resources Challenges and Management Concerns Remain. GAO-05-161. Washington, D.C.: January 31, 2005. Port Security: Planning Needed to Develop and Operate Maritime Worker Identification Card Program. GAO-05-106. Washington, D.C.: December 10, 2004. Maritime Security: Better Planning Needed to Help Ensure an Effective Port Security Assessment Program. GAO-04-1062. Washington, D.C.: September 30, 2004. Maritime Security: Partnering Could Reduce Federal Costs and Facilitate Implementation of Automatic Vessel Identification System. GAO-04-868. Washington, D.C.: July 23, 2004. Maritime Security: Substantial Work Remains to Translate New Planning Requirements into Effective Port Security. GAO-04-838. Washington, D.C.: June 30, 2004. Coast Guard: Station Spending Requirements Met, but Better Processes Needed to Track Designated Funds. GAO-04-695. June 14, 2004. Coast Guard: Key Management and Budget Challenges for Fiscal Year 2005 and Beyond. GAO-04-636T. Washington, D.C.: April 7, 2004. Homeland Security: Summary of Challenges Faced in Targeting Oceangoing Cargo Containers for Inspection. GAO-04-557T. Washington, D.C.: March 31, 2004. Coast Guard Programs: Relationship between Resources Used and Results Achieved Needs to Be Clearer. GAO-04-432. Washington, D.C.: March 22, 2004. Homeland Security: Preliminary Observations on Efforts to Target Security Inspections of Cargo Containers. GAO-04-325T. Washington, D.C.: December 16, 2003. Posthearing Questions Related to Aviation and Port Security. GAO-04-315R. Washington, D.C.: December 12, 2003. Maritime Security: Progress Made in Implementing Maritime Transportation Security Act, but Concerns Remain. GAO-03-1155T. Washington, D.C.: September 9, 2003. Container Security: Expansion of Key Customs Programs Will Require Greater Attention to Critical Success Factors. GAO-03-770. Washington, D.C.: July 25, 2003. Homeland Security: Challenges Facing the Department of Homeland Security in Balancing its Border Security and Trade Facilitation Missions. GAO-03-902T. Washington, D.C.: June 16, 2003. Coast Guard: Challenges during the Transition to the Department of Homeland Security. GAO-03-594T. Washington, D.C.: April 1, 2003. Transportation Security: Post-September 11th Initiatives and Long- Term Challenges. GAO-03-616T. Washington, D.C.: April 1, 2003. Coast Guard: Comprehensive Blueprint Needed to Balance and Monitor Resource Use and Measure Performance for All Missions. GAO-03-544T. Washington, D.C.: March 12, 2003. Homeland Security: Challenges Facing the Coast Guard as It Transitions to the New Department. GAO-03-467T. Washington, D.C.: February 12, 2003. Coast Guard: Strategy Needed for Setting and Monitoring Levels of Effort for All Missions. GAO-03-155. Washington, D.C.: November 12, 2002. Port Security: Nation Faces Formidable Challenges in Making New Initiatives Successful. GAO-02-993T. Washington, D.C.: August 5, 2002. Combating Terrorism: Preliminary Observations on Weaknesses in Force Protection for DOD Deployments through Domestic Seaports. GAO-02-955TNI. Washington, D.C.: July 23, 2002. Passenger Rail Security: Enhanced Federal Leadership Needed to Prioritize and Guide Security Efforts. GAO-05-851. September 9, 2005 Homeland Security: Actions Needed to Better Protect National Icons and Federal Office Buildings from Terrorism. GAO-05-790. June 24, 2005. Protection of Chemical and Water Infrastructure: Federal Requirements, Actions of Selected Facilities, and Remaining Challenges. GAO-05-327. Washington, D.C.: March 28, 2005. Transportation Security: Systematic Planning Needed to Optimize Resources. GAO-05-357T. February 15, 2005 Homeland Security: Agency Plans, Implementation, and Challenges Regarding the National Strategy for Homeland Security. GAO-05-33. January 14, 2005. Homeland Security: Further Actions Needed to Coordinate Federal Agencies' Facility Protection Efforts and Promote Key Practices. GAO-05-49. November 30, 2004 General Aviation Security: Increased Federal Oversight is Needed, but Continued Partnership with the Private Sector is Critical to Long-Term Success. GAO-05-144. November 10, 2004. Air Traffic Control: System Management Capabilities Improved, but More Can Be Done to Institutionalize Improvements. GAO-04-901. August 20, 2004 Aviation Security: Challenges in Using Biometric Technologies. GAO-04-785T. May 19, 2004. Homeland Security: Summary of Challenges Faced in Targeting Oceangoing Cargo Containers for Inspection. GAO-04-557T. March 31, 2004 Rail Security: Some Actions Taken to Enhance Passenger and Freight Rail Security, but Significant Challenges Remain. GAO-04-598T. March 23, 2004. Homeland Security: A Risk Management Approach Can Guide Preparedness Efforts. GAO-02-208T. Washington, D.C.: October 31, 2001. Homeland Security: Key Elements of a Risk Management Approach. GAO-02-150T. Washington, D.C.: October 12, 2001.

Summary:
Congress and the President have called for various homeland security efforts to be based on risk management--a systematic process for assessing threats and taking appropriate steps to deal with them. GAO examined how three Department of Homeland Security (DHS) components were carrying out this charge: the Coast Guard, which has overall responsibility for security in the nation's ports; the Office for Domestic Preparedness (ODP), which awards grants for port security projects; and the Information Analysis and Infrastructure Protection Directorate (IAIP), which has responsibility for developing ways to assess risks across all types of critical infrastructure. GAO's work focused on identifying the progress each DHS component has made on risk management and the challenges each faces in moving further. The three DHS components GAO studied varied considerably in their progress in developing a sound risk management framework for homeland security responsibilities. The varied progress reflects, among other things, each component's organizational maturity and the complexity of its task. The Coast Guard, which is furthest along, is the component of longest standing, being created in 1915, while IAIP came into being with the creation of the Department of Homeland Security in 2003. IAIP, which has made the least progress, is not only a new component but also has the most complex task--addressing not just ports but all types of infrastructure. The Coast Guard and ODP have a relatively robust methodology in place for assessing risks at ports; IAIP is still developing its methodology and has had several setbacks in completing the task. All three components, however, have much left to do. In particular, each component is limited in its ability to compare and prioritize risks. The Coast Guard and ODP can do so within a port but not between ports; IAIP has not demonstrated that it can do so either within or between all infrastructure sectors. Each component faces many challenges in making further progress. Success will depend partly on continuing to improve various technical and management processes that are part of risk management. For example, obtaining better quality data from intelligence agencies would help DHS components estimate the relative likelihood of various types of threats--a key element of assessing risks. In the longer term, progress will depend increasingly on how well risk management is coordinated across agencies, because current approaches in many ways are neither consistent nor comparable. Also, weaving risk-based data into the annual budget cycle of program review will be important. Supplying the necessary guidance and coordination is what the Department of Homeland Security was set up to do and, as the Secretary of Homeland Security has stated, what it now needs increasingly to address. This is a key issue for the department as it seeks to identify relative risks and take appropriate actions related to the nation's homeland security activities.