DHS’s efforts to strengthen and integrate its acquisition, IT, financial, and human capital management functions have resulted in the department meeting 3 out of 5 criteria for removal from the High-Risk List—leadership commitment, action planning, and monitoring progress. DHS has partially met the remaining two criteria—capacity and demonstrated, sustained progress, as shown in figure 1. With regard to leadership commitment, DHS’s top leadership, including the Secretary and Deputy Secretary of Homeland Security, has continued to demonstrate commitment and support for addressing the department’s management challenges. They have also taken actions to institutionalize this commitment to help ensure the long-term success of the department’s efforts. One such effort is the Under Secretary for Management’s Integrated Priorities initiative to strengthen the integration of DHS’s business operations across the department. During monthly leadership meetings with the Under Secretary for Management, the department’s Chief Executive Officers have been providing status updates on their respective actions to address this high-risk designation. Furthermore, top DHS leaders, such as the Under Secretary for Management and the department’s Chief Executive Officers, routinely meet with GAO management to discuss progress on high-risk areas. With regard to having an action plan and monitoring effectiveness, in January 2011, DHS produced its first Integrated Strategy for High-Risk Management and has issued 14 updated versions, most recently in September 2018. The September 2018 strategy describes DHS’s progress to-date, planned corrective actions to further strengthen its management functions, and includes performance measures to monitor key management initiatives. DHS’s Management Directorate leads this ongoing effort and DHS’s strategy and approach, if effectively implemented and sustained, provides a path for DHS to be removed from our High-Risk List. DHS has partially met the criteria for capacity but needs to make additional progress identifying and allocating resources in certain areas— namely acquisition, IT, and financial management—to fully demonstrate its capacity. DHS has analyzed components’ acquisition program staffing assessments but has yet to conduct an in-depth analysis across components or develop a plan to address any gaps. With regard to IT staffing, DHS has not fully identified or reported to Congress or the Office of Personnel Management (OPM) on its department-wide cybersecurity specialty areas of critical needs, such as cybersecurity management or incident response, as required by law. Additionally, DHS’s financial statement auditor has identified several capacity-related issues, including resource limitations and inadequate management and staff training, as causes for the material weaknesses reported. The final criterion is demonstrated progress, which remains partially met. In 2010, we identified, and DHS agreed, that achieving 30 specific outcomes in the areas of acquisition management, IT management, financial management, human capital management, and management integration would be critical to addressing the department’s management challenges. As such, these 30 outcomes became the key criteria by which we gauge DHS’s demonstrated progress. We reported in March 2019 that DHS has fully addressed 17 of the 30 needed outcomes, mostly addressed four, partially addressed six, and initiated actions to address the remaining three, as shown in table 1. In the last 2 years, DHS has made particular progress in the areas of human capital and IT management. Specifically, since 2017 DHS has taken steps to fully address 4 outcomes. The department fully addressed two key human capital outcomes by (1) demonstrating that components are basing hiring decisions and promotions on human capital competencies and (2) strengthening employee engagement efforts. In addition, in the last 2 years DHS has fully addressed two IT outcomes by (1) providing ongoing oversight and support to troubled IT investments to help improve their cost, schedule, and performance; and (2) demonstrating significant progress in implementing its IT strategic workforce planning initiative. Important progress and remaining work in all of the five key areas include: Acquisition management. DHS continues to face challenges in funding its acquisition portfolio. In May 2018, we found that recent enhancements to DHS’s acquisition management, resource allocation, and requirements policies largely reflect key portfolio management practices. However, we also found that of the 24 major acquisition programs we assessed with approved schedule and cost goals, 10 were on track to meet those goals during 2017—a decrease from 2016. In addition, we found that DHS’s portfolio of major acquisition programs was not affordable from fiscal years 2018 to 2022 because the planned costs exceeded the planned budget. DHS has taken steps to strengthen acquisition requirements development across the department, such as reestablishing the Joint Requirements Council in June 2014 to review and validate DHS acquisition requirements. However, opportunities remain to further strengthen DHS’s acquisition process by, for example, using the Joint Requirements Council to (1) identify overlapping or common requirements and (2) make recommendations to senior leadership to help ensure that DHS uses its finite investment resources wisely and maintains a balanced portfolio of investments that combine near-term operational improvements with long-term strategic planning. IT management. DHS has updated its approach for managing its portfolios of IT investments across all components. As part of the revised approach, the department is using its capital planning and investment control process and the Joint Requirements Council to assess IT investments across the department on an ongoing basis. For example, as part of its capital planning process for the fiscal year 2020 budget, the Office of the Chief Information Officer worked with the components to assess each major IT investment to ensure alignment with DHS’s functional portfolios, and to identify opportunities to share capabilities across components. This updated approach should enable DHS to identify potentially duplicative investments and opportunities for consolidating investments, as well as reduce component-specific investments. Additionally, DHS has continued to take steps to enhance its information security program. In November 2018, the department’s financial statement auditor reported that DHS had made progress in correcting its prior year IT security weaknesses. However, for the 15th consecutive year, the auditor designated deficiencies in IT systems controls as a material weakness for financial reporting purposes. Work also remains in implementing our six open recommendations concerning DHS’s cybersecurity workforce assessment requirements. DHS also faces challenges in fulfilling its pivotal role in government- wide cybersecurity efforts, as identified in our Ensuring the Cybersecurity of the Nation high-risk area. DHS has established the National Cybersecurity and Communications Integration Center, which functions as the 24/7 cyber monitoring, incident response, and management center for the federal civilian government. However, DHS has continued to be challenged in measuring how the center is performing its functions in accordance with mandated implementing principles. Financial management. DHS received a clean audit opinion on its financial statements for 6 consecutive years—fiscal years 2013 to 2018. However, in fiscal year 2018, its auditor reported two material weaknesses in the areas of financial reporting and information technology controls and financial systems, as well as instances of non-compliance with laws and regulations. These deficiencies hamper DHS’s ability to provide reasonable assurance that its financial reporting is reliable and the department is in compliance with applicable laws and regulations. Further, DHS components’ financial management systems and business processes need to be modernized; the current systems affect the department’s ability to have ready access to reliable information for informed decision-making. As we reported in 2017, DHS officials have faced various challenges in their efforts to address this—lack of sufficient resources, aggressive schedule, complex requirements, and increased costs. Effectively modernizing financial management systems for the Coast Guard, Federal Emergency Management Agency, and Immigration and Customs Enforcement would help address DHS’s risk in this area. Human capital management. DHS has continued to strengthen its employee engagement efforts by implementing our 2012 recommendation to establish metrics of success within components’ action plans for addressing its employee satisfaction problems. Further, DHS has conducted audits to better ensure components are basing hiring decisions and promotions on human capital competencies. OPM’s 2018 Federal Employee Viewpoint Survey data showed that in the past 2 years, DHS’s score on the Employee Engagement Index increased by 4 points—from 56 in 2016 to 60 in 2018—which was 1 point more than the government wide increase over the same period. While this improvement is notable, DHS’s 2018 score ranked 20th among 20 large and very large federal agencies. Increasing employee engagement and morale is critical to strengthening DHS’s mission and management functions. Management integration. Since 2015, DHS has focused its efforts to address crosscutting management challenges through the establishment and monitoring of its Integrated Priorities initiative. The department updated these priorities in September 2017. Each priority includes goals, objectives, and measurable action plans that are discussed at monthly leadership meetings led by senior DHS officials, including the Under Secretary for Management. DHS needs to continue to demonstrate sustainable progress integrating its management functions within and across the department. In closing, it is clear that significant effort is required to build and integrate a department as large and complex as DHS, which has grown to more than 240,000 employees and approximately $74 billion in budget authority. Continued progress for this high-risk area depends primarily on addressing the remaining outcomes. In the coming years, DHS needs to continue implementing its Integrated Strategy for High-Risk Management to show measurable, sustainable progress in implementing corrective actions and achieving outcomes. In doing so, it remains important for DHS to maintain its current level of top leadership support and sustained commitment to ensure continued progress in executing its corrective actions through completion; continue to identify the people and resources necessary to make progress towards achieving outcomes, work to mitigate shortfalls and prioritize initiatives as needed, and communicate to senior leadership critical resource gaps; continue to implement its plan for addressing this high-risk area and periodically provide assessments of its progress to us and Congress; closely track and independently validate the effectiveness and sustainability of its corrective actions, and make midcourse adjustments as needed; and make continued progress in achieving the 13 outcomes it has not fully addressed and demonstrate that systems, personnel, and policies are in place to ensure that progress can be sustained over time. We will continue to monitor DHS’s efforts in this high-risk area to determine if the outcomes are achieved and sustained over the long term. Madam Chairwoman Torres Small, Ranking Member Crenshaw, and Members of the Subcommittee, this completes my prepared statement. I would be happy to respond to any questions you may have at this time. If you or your staff members have any questions about this testimony, please contact me at (404) 679-1875 or curriec@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Other individuals making key contributions to this work include Claudia Becker, Assistant Director; Imoni Hampton, Analyst-in-Charge; Michele Fejfar, Melissa Greenaway, James Lawson, and Tom Lombardi. Key contributors for the previous work that this is based on are listed in each product. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: GAO has regularly reported on government operations identified as high-risk because of their increased vulnerability to fraud, waste, abuse, and mismanagement, or the need for transformation to address economic, efficiency, or effectiveness challenges. In 2003, shortly after the department was formed, we designated Implementing and Transforming DHS as a high risk area to the federal government because DHS had to transform 22 agencies into one department, and failure to address associated risks could have serious consequences for U.S. national security. In 2013, we reported that although challenges remained for DHS, the department had made considerable progress. As a result, we narrowed the scope of the high-risk area to focus on strengthening DHS management functions (human capital, acquisition, financial management, and information technology). discusses DHS's progress and remaining actions needed to strengthen and integrate its management functions. This statement discusses DHS’s progress and remaining actions needed to strengthen and integrate its management functions. This statement is based on our 2019 high-risk update and other reports issued from February 2017 through March 2019. Among other things, GAO analyzed DHS strategies and other documents related to the department's efforts to address its high-risk areas. As GAO reported in its 2019 high-risk update, the Department of Homeland Security (DHS) has continued its efforts to strengthen and integrate its acquisition, information technology, financial, and human capital management functions. As a result, the department has continued to meet three out of five criteria for removal from GAO's High-Risk List (leadership commitment, action plan, and monitoring) and partially meet the remaining two criteria (capacity and demonstrated progress). With regard to leadership commitment, DHS's top leadership has continued to demonstrate support for addressing the department's management challenges through, for example, its Integrated Priorities initiative to strengthen the integration of DHS's business operations across the department. Additionally, DHS has established an action plan for addressing the high-risk area and has issued 14 updated versions since 2011.This action plan also demonstrates DHS's ongoing monitoring of these efforts as it describes DHS's progress to-date and planned corrective actions. The two key areas where additional work is needed are DHS's capacity and demonstrated progress. With regard to capacity, DHS needs to make additional progress identifying and allocating resources in the areas of acquisition, information technology, and financial management. With regard to demonstrated progress, DHS should show the ability to achieve sustained improvement across 30 outcomes that GAO identified and DHS agreed were needed to address the high-risk area. GAO found in its 2019 high-risk update that DHS fully addressed 17 of these outcomes, while work remains to fully address the remaining 13. DHS has made some progress in recent years regarding human capital and information technology outcomes, but needs to continue implementing its action plan to show measurable, sustainable progress in achieving the 13 outcomes not yet fully addressed. Since 2003, GAO has made about 2,800 recommendations to DHS to strengthen its management efforts, among other things. DHS has implemented more than 75 percent of these recommendations which have strengthened program management and performance measurement.