DHS has 15 components involved in achieving its broad strategic goals of countering terrorism and homeland security threats, securing U.S. borders and sovereignty, securing cyberspace and critical infrastructure, preserving U.S. prosperity and economic security, and strengthening preparedness and resilience. DHS relies on contracts to support these missions and has 10 contracting activities with authority to procure products and services within and across DHS’s components. For example, OPO within DHS’s Management Directorate is responsible for contracting for a number of DHS’s components and offices, including the Science and Technology Directorate, the Cybersecurity and Infrastructure Security Agency, and the Countering Weapons of Mass Destruction Office. See appendix II for DHS’s organizational chart, identifying operational and support components and contracting activities. The FAR requires that agencies take certain steps when identifying and developing requirements that need to be addressed through the execution of a contract. For example, the FAR requires that agencies conduct market research, as appropriate, and defines market research as the process used to collect and analyze information about capabilities in the market that could satisfy an agency’s needs. While the extent of market research will vary depending on characteristics of the requirement, the FAR provides general policies and procedures for conducting market research with the goal of arriving at the most suitable approach to acquiring, distributing, and supporting supplies and services. The FAR also requires agencies to perform acquisition planning activities for all acquisitions to ensure that the government meets its needs in the most effective, economical, and timely manner possible. In addition to the FAR, DHS relies on the Homeland Security Acquisition Regulation and Homeland Security Acquisition Manual—issued by DHS’s Chief Procurement Officer to implement and supplement the FAR—to establish policies and procedures for all acquisition activities within the department. For example, together the Homeland Security Acquisition Regulation and Homeland Security Acquisition Manual provide more specific department-wide policies and procedures for implementing acquisition requirements laid out by the FAR, such as competition, acquisition planning, and market research. Contracting activities may also implement their own procedures that support and implement the FAR, Homeland Security Acquisition Regulation, and Homeland Security Acquisition Manual. DHS also has its own policies and guidance for managing its service acquisition programs. For example, DHS generally defines major acquisition programs as those with life-cycle cost estimates of $300 million or more. However, DHS’s Acquisition Management Instruction 102-01-001 identifies additional thresholds for approval of stand-alone service acquisition programs—service contracts that are not part of a larger acquisition program. Specifically, service acquisition programs with annual cost estimates of $1 billion or more, or between $100 million and $1 billion are identified as Major Level 1 or 2 acquisition programs, respectively, and generally require approval from DHS’s Chief Acquisition Officer. Service acquisition programs with annual cost estimates under $100 million can be approved at the component level in accordance with component policies and processes. As of November 2019, DHS did not have any service programs identified as Major Level 1 or 2. In response to the 2009 Presidential Memorandum on Government Contracting, OFPP, within OMB, issued a policy letter in September 2011 to all executive agencies—including DHS—to clarify, in part, when governmental outsourcing of services is and is not appropriate. Specifically, the letter defines inherently governmental functions, according to the definition in the Federal Activities Inventory Reform Act, as those that are so intimately related to the public interest as to require performance by federal employees, such as determining agency policy or budget requests. Additionally, it identifies categories of service functions that agencies are allowed to contract for, but that require heightened management attention, as they pose a risk to the government losing control of either its responsibility to perform inherently governmental functions or its mission and operations. Figure 1 illustrates the increasing risk related to contracting for these types of functions. The letter also provides guidance on managing the performance of closely associated with inherently governmental and critical service functions, among others. In 2010, OFPP had also identified categories of services requiring heightened management attention. The three categories of service functions requiring special or heightened management attention follow: 1. Closely associated with inherently governmental functions. The 2011 OFPP policy letter adopts a single definition of an inherently governmental function, clarifies the types of services that constitute those closely associated with inherently governmental functions, and highlights the steps that agencies must take to ensure that the contractor does not ultimately perform functions that are reserved exclusively for federal employees. The response to public comments in the 2011 OFPP policy letter—in accordance with the FAR— provides the example that aspects of acquisition planning, such as determining requirements and approving a contract strategy, are inherently governmental functions. However, contractors may be used to support acquisition planning efforts through functions such as performing market research or drafting statements of work. These supporting functions are deemed closely associated with inherently governmental functions and can be contracted for. However, the OFPP policy letter states that agencies are required to take certain steps—such as assigning a sufficient number of qualified government employees to perform contract management—to ensure, among other things, that the contractor does not perform, interfere with, or undermine the integrity of the agency’s decision-making responsibilities. 2. Critical functions. The 2011 OFPP policy letter describes critical functions that, when contracted for, pose a risk that the agency could lose control of its mission and operations. Among other things, the policy established the criteria for identifying critical functions that are internally unique to each agency based upon their mission and operations. As an example, the 2011 OFPP policy letter notes that analyzing areas of tax law that impose significant compliance burdens on taxpayers may constitute a critical function for the Internal Revenue Service’s Office of the Taxpayer Advocate. OFPP notes that when contracting for a critical function, agencies must retain sufficient internal capability either through: dedicating an adequate number of federal personnel to perform the function in-house or alongside the contractors in the event the contractor fails to perform; or ensuring federal personnel are available to oversee and manage the contractor workforce. 3. Special interest functions. Special interest functions, according to OFPP, are functions that required increased management attention due to heightened risk of workforce imbalance. Some special interest functions may also be either closely associated with inherently governmental or critical functions. According to OFPP, contracting for these functions also poses a risk that the agency can lose control of its mission and operations. In a November 2010 memo, OMB instructed agencies to identify and analyze a list of product and service codes to be deemed special interest functions. DHS, with OMB approval, has chosen 17 product and service codes to categorize as special interest functions, including policy review and development and acquisition support services. To mitigate the risk associated with contracting for special interest functions, agencies are required to analyze their contracts for special interest functions annually to ensure the mix of federal employees to contractors is appropriately balanced. For examples of functions deemed closely associated with inherently governmental, critical, and special interest, see appendix III. Since March 2019, DHS has required program officials to complete its Inherently Governmental and Critical Functions Analysis job aid for all proposed service contract requirements above the simplified acquisition threshold—currently $250,000—with a product and service code that is not included on DHS’s exemption list. The department established the Inherently Governmental and Critical Functions Analysis job aid to enable it to systematically ensure that proposed service requirements do not include inherently governmental functions and to identify those that contain functions considered closely associated with inherently governmental or critical. The job aid collects general information about the proposed service contract, such as a brief description, followed by three discrete sections to check for these three functions. Section 1. This section includes a checklist for functions that the FAR has identified as being inherently governmental, such as developing federal agency policy and determining price reasonableness of vendor bids. In order to proceed with contracting for the service, the program official has to certify that none of these functions exist within the proposed requirement. Section 2. This section includes a checklist for functions that the FAR and OMB have identified as being closely associated with inherently governmental functions, such as conducting market research or drafting statements of work. If program officials identify any functions that are closely associated with inherently governmental in the proposed requirement, the job aid includes a narrative section where the program official is expected to input information on the nature of the work to be performed by the contractor and how heightened management attention will be given. Section 3. This section requires program officials to consider whether the proposed requirement is necessary for the agency to effectively perform and maintain control of its mission, which would designate the requirement as critical. Agencies are allowed to contract for critical functions so long as the program official certifies that the agency has sufficient internal capacity to undertake the work if, for any reason, the contractor is unable to provide the service. Special interest functions are not required to be identified in the job aid. The job aid concludes with the program official’s signature and is eventually forwarded to the contracting officer as part of the overall procurement package prior to soliciting for the proposed requirement. The job aid was put in place following the March 2019 decommissioning of DHS’s prior tool—the BWAT. The BWAT was used to implement DHS’s Balanced Workforce Strategy, which focuses on achieving the appropriate mix of federal and contractor personnel. This strategy was established in October 2009 to meet the statutory requirements in the 2009 Omnibus Appropriations Act. The 2009 Omnibus Appropriations Act directed most federal agencies—including DHS—to devise and implement guidelines and procedures to ensure that, on a regular basis, consideration is given to using federal employees to perform new functions, and functions that are performed by contractors but can be performed by federal employees. The Balanced Workforce Strategy established processes to enable DHS to achieve the appropriate mix of federal employees and contractors to accomplish the department’s mission, while minimizing risk to DHS’s missions from an overreliance on contractors. DHS implemented this strategy through the BWAT—an online questionnaire completed by individual program offices for certain service contracts. The function of the BWAT was to ensure the proposed service functions are not inherently governmental, and to identify whether the functions are closely associated with inherently governmental, critical, or special interest, among others. In addition, the BWAT recommended the ratio of federal employees to contractors needed to oversee those services. This analysis was then approved by the program and reviewed by the contracting officer as part of the procurement package. According to officials from an internal DHS working group, the Balanced Workforce Strategy—and BWAT by extension—were deemed no longer necessary based on the maturation of the department’s program and contracting officials’ ability to identify inherently governmental, closely associated with inherently governmental, critical, and special interest functions without a detailed questionnaire. In addition, the software used to conduct the BWAT was not supportable and faced obsolescence issues. For additional information on the differences between the BWAT and the job aid, see appendix IV. DHS relies on its planning, programming, budgeting, and execution process to plan for and allocate resources—including those for service contracts—across the department. DHS uses this process to develop its Future Years Homeland Security Program—a database that contains 5- year program funding plans and is used to prepare a report to Congress—and the department’s annual budget request. According to DHS guidance, at the outset of the annual planning, programming, budgeting, and execution process, the Office of Policy and Office of Program Analysis and Evaluation under the Chief Financial Officer provides resource planning guidance to the components outlining departmental priorities. Following the identification of departmental priorities, DHS guidance states that components should consider their objectives and commitments within fiscal guidance constraints, to estimate needs in their resource plans. The components then prepare their annual resource plans, based on their needs and in line with DHS priorities, which are reviewed by DHS leadership and culminate in a document reflecting the department’s resource decisions. See figure 2 for a depiction of the planning, programming, budgeting, and execution process. Beginning with the fiscal year 2017 budget request, DHS has used the common appropriation structure to organize the information in its budget requests. This common appropriation structure is comprised of four appropriation accounts: procurements, construction, and improvements; operations and support; and federal assistance. Each of these accounts has mission oriented program/project activities that correspond to the components’ different operations. For example, ICE’s fiscal year 2020 budget request includes program/project activities for the three operational directorates that accomplish its mission— Homeland Security Investigations, Enforcement and Removal Operations, and the Office of the Principal Legal Advisor. Within the component’s program/project activity accounts, service contract requirements are reflected in budget documents through object classes prescribed by OMB. OMB guidance establishes object classes as a measure for communicating resource needs in budget justifications and identifies eight object class codes for other contracted services, as shown in table 1. We have conducted prior work on the use of service contracts across the federal government, including how agencies have mitigated challenges overseeing and managing risks associated with service contracts that require heightened management attention, and how agencies have identified estimated service contract needs as part of agency budget requests. Specifically: In December 2011, we reported on how the Departments of Homeland Security, Transportation, and Housing and Urban Development, the United States Agency for International Development, and the National Science Foundation considered and mitigated risks associated with professional and management support service contracts—including contracts that are considered to be a special interest function and can increase the risk that contractors inappropriately influence the government’s authority, control, and accountability for decisions. We found that these agencies generally did not consider and mitigate the risks associated with selected professional and management support service contracts prior to their award. We recommended that OMB establish a deadline for agencies to develop procedures to improve their management of risks related to professional and management support service contracts. OMB agreed with our recommendation but did not establish such a deadline. In February 2016, we reported on what insights the Department of Defense had into the military department’s use of service contracts to fulfill current and future requirements, and how the department reported on service contract requirements in its annual budget requests to Congress. We found that while program offices within the military departments generally had information on current and future service contract requirements beyond the budget year, that future service requirements through the Future Years Defense Program were not identified to Department of Defense leadership in annual budget requests because there was no requirement to do so. We also found that the Department of Defense’s budget requests to Congress did not include all planned service contract needs and that its contracted services budget exhibit intended to meet certain statutory reporting requirements significantly underreported its estimated budget request for contracted services. We suggested that Congress should consider revising statutory reporting requirements to include estimated requirements beyond the budget year. In August 2018, Congress included a provision in the National Defense Authorization Act for Fiscal Year 2019 requiring the Department of Defense to include information on planned service contract requirements in the Future Years Defense Program. We also recommended that the military departments revise budgeting guidance to collect service contract information beyond the budget year, and that the Department of Defense modify its approach for reporting on service contracts in budget exhibits to ensure that certain service contract requirements are included. The department generally agreed with these recommendations, and has taken some steps to update military department budget guidance and modified its approach for reporting service contract requirements in its budget requests. In September 2019, we reported on the extent to which the National Nuclear Security Administration reports information on service contract requirements in its congressional budget justification documents and manages potential risks of service contracts that are at risk of performing inherently governmental functions. We found that the National Nuclear Security Administration did not consistently include information on all of its service contracts in budget justification materials. We also found that the agency may not be effectively managing the risks of contractors performing inherently governmental activities because contracting officers are not required to document how they will oversee contracts for services closely associated with inherently governmental functions, and the agency does not verify that planned oversight is performed. We recommended that the National Nuclear Security Administration report on all professional support services contracts with obligations as part of its budget justification materials, ensure contracting officers document plans to oversee service contracts at risk of performing inherently governmental functions, and develop a process to ensure that contracting officers are carrying out planned oversight. The National Nuclear Security Administration generally agreed with these recommendations. DHS obligated about $70.7 billion, or 76 percent, of its $93.7 billion in total contract obligations on services from fiscal years 2013 through fiscal year 2018. See figure 3 for details on DHS’s obligations on services and products from fiscal years 2013 through 2018. DHS annual service contract obligations increased by 40 percent from fiscal years 2013 to 2018, from about $10.5 billion to $14.7 billion. This increase in service contract obligations was largely driven by increases in Federal Emergency Management Agency and CBP service contract obligations, which grew by $2.2 billion and $927 million respectively. In fiscal year 2018, the Federal Emergency Management Agency had the highest service contract obligations, at $3.3 billion, followed by DHS headquarters organizations, and CBP. Of the Federal Emergency Management Agency’s fiscal year 2018 service contract obligations, $2.5 billion, nearly 75 percent, were identified as disaster-related. See figure 4 for additional detail on fiscal year 2018 service contract obligations by DHS component. DHS relies on a variety of services to accomplish its missions. For example, about $2.1 billion, or 14 percent of DHS’s total fiscal year 2018 service contract obligations, were for guard services to protect federal buildings or other security needs. DHS obligated about $2 billion, or 13 percent of its total fiscal year 2018 service contract obligations, towards various information technology and telecommunications services—such as satellite services and hardware and software maintenance. DHS’s five service categories with the highest amount of contract obligations in fiscal year 2018 accounted for about 40 percent of its total service contract obligations that year. See figure 5 for additional details on DHS’s top service obligations. In fiscal year 2018, 65 percent of DHS’s total service contract obligations were for services in need of heightened management attention or oversight due to being a closely associated with inherently governmental, critical, or special interest function. DHS’s obligations on contracts for these types of services increased by about 58 percent, from about $6 billion in fiscal year 2013 to $9.5 billion in fiscal year 2018. See figure 6 for additional details on the proportion of contract obligations for services in need of heightened management attention over time. Within our selected components, obligations for service contracts in need of heightened management attention increased the most from fiscal years 2013 to 2018 for contracts awarded by ICE—increasing by $732.1 million. CBP’s obligations for service contracts in need of heightened management attention increased over this time frame by $598 million. Service contracts in need of heightened management attention accounted for more than three quarters of all service contract obligations in fiscal year 2018 for DHS headquarters organizations and ICE. See figure 7 for additional detail on fiscal year 2018 contract obligations for services in need of heightened management attention by DHS component. DHS has policies and guidance to identify its service and product needs and develop contract requirements. In addition to the FAR, Homeland Security Acquisition Regulation, and Homeland Security Acquisition Manual, which combined establish DHS’s acquisition regulations and contracting policies, DHS has developed additional guidance specific to identifying needs and developing contract requirements. For example, DHS’s Developing and Managing Contract Requirements Desk Guide for the Acquisition Workforce is available to program personnel as a resource for how to define requirements, including processes and required documents and templates. DHS has also developed guidance for program and contracting officials for specific activities related to the requirements development process—such as market research, acquisition planning, and source selection guides—as well as guidebooks for specific participants involved in identifying needs and developing contract requirements, such as the contracting officer’s representative. Based on DHS policies and guidance, we identified key processes DHS undertakes to identify needs and develop contract requirements for services and products. Of these key processes, assessing for inherently governmental functions is specific to DHS’s development of service requirements. In response to the 2011 OFPP policy letter’s requirements to screen service contracts for the performance of inherently governmental functions and consider how contractor employees are used to perform agency functions, DHS implemented the BWAT in 2013. As previously noted, this tool has now been replaced by the Inherently Governmental and Critical Functions Analysis job aid. These tools have been required for service contracts specifically to ensure that contractors are not performing tasks that should be reserved for federal employees. Once completed, the output from these tools are reviewed by the contracting officer and included in the procurement package. Figure 8 summarizes key processes we identified that DHS uses to identify and develop service requirements. In addition to the policies and guidance DHS has for identifying and developing service requirements, DHS components in our review have implemented additional guidance and tools. For example, USCIS has developed specific guidance to support the program office’s development of requirements, including information on how to define requirements, conduct market research, and develop a cost estimate and acquisition strategy. Further, all of the components in our review reported using tools, such as templates and checklists, to help guide program and contracting officials through the requirements development process. For example, all of the components in our review use templates for market research, acquisition plans, and requirements documents that identify what information officials should include in these documents. The components in our review also provided program and contracting officials with checklists for what documents are required in the procurement package, depending on the type of contract being solicited. Some of the components in our review maintain this information on acquisition websites that serve as repositories for DHS and component guidance, templates, and other requirements. For example, ICE’s Office of Acquisition Management’s portal provides guidance, documents, and templates by phase of the acquisition process, from acquisition planning and solicitation preparation through contract administration and close-out. DHS components in our review also relied on subject matter experts to assist in their requirements development efforts, with the level of involvement varying depending on the requirement. Specifically, officials associated with two of the eight contracts in our review stated they used integrated product teams to assist with developing their service requirements. For example, officials involved in requirements development for services at USCIS’s 135 Application Support Center locations told us they established an integrated product team with program officials, the contracting officer, cost estimators, Field Office Directorate personnel, and Office of Security and Integrity personnel. Officials from the other six contracts relied on more informal subject matter expert involvement. Component officials from three of our contracts that relied on more informal coordination methods said that when the requirement is recurring and has previously been contracted for, formal coordination through an integrated product team may not be necessary. DHS has established a process for reviewing the procurement strategy for certain service and product procurement actions prior to award, but has not developed an approach to ensure proposed service contract requirements are clearly defined or that it is consistently reviewing what DHS considers to be high-risk service procurement actions. In 2018, OCPO and the Office of Program Accountability and Risk Management began piloting a DHS-wide Service Requirements Review to validate, optimize, prioritize, and approve service requirements early in the development process. However, DHS discontinued these efforts before the pilot was finalized. According to DHS officials, they initiated this pilot because there had been no consistency or rigor for reviewing service contract requirements even though these contracts account for over 70 percent of DHS’s contract obligations. According to DHS documents and officials, the main objectives of the pilot were to: ensure service requirements are clearly defined and reviewed before planning how the services are obtained; assess whether the services should be provided in whole or in part by foster collaboration and opportunities to leverage efficiencies for similar service requirements to avoid duplication in services across the department; and assess whether the requirement should be managed as a service acquisition program. To accomplish these objectives, DHS identified stakeholders from within DHS’s Management Directorate to be headquarters-level reviewers for service requirements based on the type of service being contracted for. However, according to OCPO and Office of Program Accountability and Risk Management officials, the pilot was discontinued in April 2019 before any service requirements were reviewed because it was determined to be too resource intensive. According to DHS officials, the discontinuation of the Service Requirements Review pilot coincided with the implementation of the Procurement Strategy Roadmap, a separate OCPO-led initiative to review and approve the procurement strategy for all service and product acquisitions with a total estimated value over $50 million. The Procurement Strategy Roadmap requires contracting activities, along with their procurement teams, to present and discuss the procurement strategy with the DHS Chief Procurement Officer, members of OCPO, and other stakeholders as needed, prior to drafting an acquisition plan or other decision documents. According to OCPO officials, it was intended to require procurement staff to meet with OCPO officials early in the acquisition planning process, prior to the service contract requirement being finalized, to discuss how services and products would be purchased. Specifically, the Procurement Strategy Roadmap is intended to address what OCPO considered as key elements of the procurement process, such as the requirement, competition, the availability of strategic sourcing or small business options, and contract type. Following the discontinuation of the Service Requirements Review pilot in April 2019, OCPO and Office of Program Accountability and Risk Management officials discussed expanding the Procurement Strategy Roadmap to incorporate some elements of the Service Requirements Review pilot, including reviewing proposed requirements to determine if they are clearly defined and valid, when appropriate. For example, OCPO officials said they have included the Office of Program Accountability and Risk Management and the Office of the Chief Information Officer to facilitate additional DHS stakeholder involvement in some reviews, and to broaden the discussion beyond how services and products will be purchased and include what the requirement is and whether it needs to be purchased at all. However, as of February 2020, OCPO officials told us that reviewing requirements to ensure they are clearly defined and collaborating with additional DHS stakeholders to identify opportunities to leverage existing service requirements was not the intent of the Procurement Strategy Roadmap. For example, OCPO officials stated that proposed requirements may only be reviewed by additional DHS stakeholders during the Procurement Strategy Roadmap if the requirement is new, “unique,” or “high risk,” and that this decision is based on their review of the information in the Procurement Strategy Roadmap and professional judgment. When asked what constitutes a unique or high risk requirement, officials told us a proposed requirement could be high risk if it had historical procurement issues, but noted that ultimately the decision to review the requirement and whether to involve additional DHS stakeholders in that review is subjective and based on whether OCPO leadership believes other stakeholders may add value in developing and reviewing the proposed requirement. According to OCPO officials, some Procurement Strategy Roadmap requirements supporting major acquisition programs undergo separate review by DHS headquarters stakeholders in the Acquisition Review Board. However, high-dollar service acquisitions that are not associated with a major acquisition program or not above $100 million do not currently receive headquarters- level scrutiny to determine whether requirements are clearly defined or to leverage efficiencies and buying power for similar service requirements across the department. In addition, OCPO has not established a process to ensure it is consistently reviewing proposed procurement actions through the Procurement Strategy Roadmap. Our review of the fiscal year 2019 Procurement Strategy Roadmap eligible procurement actions found that OCPO subjectively waived the review for 18 of the 49 eligible actions— over 36 percent of the actions that should have been subject to a Procurement Strategy Roadmap. The waived procurement actions included three out of six Federal Emergency Management Agency actions, eight out of 16 OPO actions, four out of 12 CBP actions, and two out of six Transportation Security Administration actions. According to OCPO officials, the decision to waive a procurement action is a subjective one, made by OCPO leadership based on the initial information provided. For example, officials said the review may be waived if the procurement action is recurring or will be fulfilled using an already established DHS contract vehicle. We found, however, that the subjective decision to waive the reviews does not take into account other acquisition risks. For example, our review of the description of waived procurement actions found that 11 of the 18 actions were for services, including some for administrative and professional support and information technology services that DHS considers to be in need of heightened management attention. Two of the waived actions were for requirements that resulted in orders placed off General Services Administration Schedule contracts, despite an OCPO official telling us that these orders are expected to receive increased scrutiny to ensure that any existing DHS contract vehicles have been fully considered. Our review of waived procurement actions also found that OCPO waived several Federal Emergency Management Agency actions for disaster response activities and CBP actions for services at temporary soft-sided facilities used for holding detainees on the U.S.-Mexico border. Our prior work has noted challenges in requirements development and acquisition planning for these types of contracts. For example, in April 2019, we reported that contracting officers at FEMA were receiving requirements packages for disaster contracts that lacked technical specificity or had inaccurate estimates of the products and services needed. In March 2020, we also reported on acquisition planning, requirements development, and information sharing challenges with one of the waived procurement actions—a CBP delivery order for a soft-sided facility and services to hold and care for detainees—finding that these challenges led to CBP spending millions of dollars on services that were not ultimately needed. Federal internal control standards state that management should identify and respond to risk to achieve its objectives. OCPO officials acknowledged that the intent of the Procurement Strategy Roadmap was not to replace the Service Requirements Review that preceded it, and that expanding the scope of the Procurement Strategy Roadmap to review requirements would require additional resources. However, the department’s previous efforts to devote management attention to its growing proportion of service procurements are indicative of its concerns about its use of service contracts. While the Procurement Strategy Roadmap is not specific to services, it can provide a mechanism to address these concerns. Moreover, without documenting factors OCPO considers when waiving certain Procurement Strategy Roadmap eligible procurement actions, DHS is at risk of not consistently reviewing service procurement actions that could benefit from headquarters-level review. Given DHS’s reliance on service contracts, which accounted for 78 percent of DHS’s contract obligations in fiscal year 2018, developing a risk-based approach for reviewing proposed service requirements through the Procurement Strategy Roadmap or other means could help to improve DHS’s use of service contracts by identifying opportunities to leverage efficiencies and ensuring service requirements are clearly defined across the department. DHS does not have a formal process for identifying all service requirements in need of heightened management attention or for planning, documenting, and updating the amount of federal personnel necessary to perform or oversee these requirements. In order to maintain control of their mission and performance of inherently governmental functions, part of contracting for services in need of heightened management attention—including functions that are closely associated with inherently governmental, critical, and special interest—is ensuring that agencies dedicate an adequate number of federal employees to oversee these functions. Specifically, OFPP notes that prior to contract award, for services that require heightened management attention agencies should complete an analysis that among other things and depending on the service, establishes that they can: retain sufficient capacity and capability to give heightened management attention to contractor performance or retain control of its operations; limit or guide the contractor’s exercise of discretion; ensure reasonable identification of contractors and contractor work avoid or mitigate conflicts of interest. Functions Requiring Heightened Management Attention The Office of Management and Budget’s (OMB) Office of Federal Procurement Policy (OFPP) guidance identifies three categories of service contracts requiring heightened management attention—those closely associated with inherently governmental functions, critical functions, and special interest functions. Depending on the function, these categories of service contracts may involve contractor work products that support policy development and program evaluation, and other tasks that are essential to the agencies’ ability to perform its mission. According to OMB, these contracts require management attention to ensure that they do not result in the performance of inherently governmental functions by the contractor and that agencies retain control of their mission and operations. DHS officials stated that, as of March 2019, they use the Inherently Governmental and Critical Functions Analysis, or job aid, to screen proposed service requirements to ensure that there are no inherently governmental functions and to identify functions that may be contracted for that are closely associated with inherently governmental or critical. If a function is identified as closely associated with inherently governmental or critical, program officials must certify that there is sufficient internal capacity to oversee contractor activities and maintain control of its missions and operations. Further, if a function is closely associated with inherently governmental, the job aid includes a narrative section where the program office should document mitigation strategies to ensure heightened management attention and enhanced oversight occur throughout the life of the contract. We found that the job aid does not provide a place to identify special interest functions that require heightened management attention. In addition, the job aid does not require program officials to analyze or document the expected federal personnel necessary to perform or oversee service requirements in need of heightened management attention following contract award; therefore information available for planning purposes is limited. We analyzed all nine of the 27 completed job aids that included closely associated with inherently governmental functions, and found that none included any calculation of federal oversight personnel necessary or mentioned the federal personnel who will be expected to perform oversight activities. The narrative section of the job aid instructs components to document mitigation strategies for functions identified as closely associated with inherently governmental functions. We found that two of the nine job aids identified mitigation strategies, such as noting that federal employees will ensure the contractor’s presence is announced at all meetings. However, neither provided any detail about who—such as the program manager or contracting officer representative—would be responsible for performing and overseeing the contractor employees performing the contracted functions or tasks. Program and contracting officials from ICE, CBP, and USCIS stated that analyzing and documenting the expected federal oversight personnel necessary prior to contract award with the BWAT provided visibility—both within the program and across the component—into resource needs. However, only ICE continues to analyze and document federal oversight necessary outside of the job aid. Following the BWAT’s decommissioning, ICE established a Service Contract Review Template for all service contracts above $1 million. ICE program officials are expected to complete this template with information such as a description of the requirement, the anticipated product and service code, identification of special interest functions, expected number of contractors needed, the number of federal employees available to oversee the work, and a justification for outsourcing the requirement. From this information, the template produces a recommended percentage of federal personnel necessary to perform management oversight. ICE created this new process because it wanted to ensure that it has a repeatable, documented decision-making process that helps plan oversight, such as the proper balance of federal and contractor employees and determining the reasonableness of the contract. DHS’s job aid also does not provide a process to update oversight needs if the contracted tasks or functions change throughout the life of the service contract. Officials from three of the four components in our review reported not having a formal process for updating federal oversight needs when elements of the contract change—such as an increase in the number of contractor personnel performing tasks or a change in scope. For example, component program and contracting officials told us that, although one of the service contracts in our review experienced an increase in the number of contractor personnel, they did not update planning for federal oversight personnel needs. In contrast, officials from ICE reported having a process to reevaluate federal oversight needed that is triggered by specific contract funding actions. Funding actions that trigger the process include: establishing a new contract, exercising an option on an existing contract, or adding funding to a service contract. ICE officials explained that through this process they review the service contract for changes to the number of contractors and whether the current oversight levels are sufficient. If they find that current oversight levels are no longer sufficient, ICE officials stated that they would require the program office to develop a risk mitigation strategy, such as assigning additional oversight personnel or increasing the contractor’s reporting requirements. DHS headquarters officials told us they no longer have a formal process for analyzing and documenting federal oversight requirements because the department has matured since implementing the BWAT, and program and contracting staff are aware of how to plan for federal oversight requirements for service contracts in need of heightened management attention. Specifically, during our review, DHS and component officials from OPO and USCIS stated that they rely on their program and contracting officials’ historical knowledge and professional judgment to determine and communicate oversight needs informally at the component level. However, we found a lack of understanding and inconsistencies in how oversight was analyzed and documented prior to the BWAT’s decommissioning. Specifically, 25 of the 75 required BWATs for special interest functions we reviewed either could not be provided or did not contain the information used to calculate and, therefore, plan for sufficient federal employees to conduct oversight. In addition, according to DHS documents and officials, the department plans for federal oversight personnel needs more broadly through its annual workforce planning efforts; and therefore, it is not necessary to analyze federal oversight personnel needs at the contract level. Yet we found that DHS’s fiscal year 2018 annual workforce plan focused on DHS and government-wide mission critical occupations, like Border Patrol Agents and Transportation Security Administration Officers. The plan does not address oversight needs based on services in need of heightened management attention (i.e., contracted functions that are closely associated with inherently governmental, critical, or special interest). While DHS’s workforce plan accounts for government-wide mission critical occupations, such as contracting officers and specialists, there is not the same level of consideration given to program managers, employees who serve as contracting officer’s representatives, or other program staff that are responsible for performing oversight at the contract level. According to OCPO officials, program officials completing the job aid should document in the narrative section the federal personnel responsible for ensuring the task does not become inherently governmental. However, we found that the job aid instructions do not address how program officials should analyze or document the federal personnel who will be tasked with conducting oversight. The job aid also does not include similar instructions, or provide space, to depict this information for functions identified as critical. Moreover, although there is guidance on when an initial job aid needs to be completed, there is no guidance indicating when, and under what circumstances, program and contracting officials may need to update federal oversight needs based on changes to the functions or task being performed by the contractor. Officials associated with only three of the eight contracts in our review reported receiving some training on the new job aid, but OCPO officials explained that they have not provided additional training beyond the instructions in the acquisition alert that implemented the job aid. Federal internal control standards state that agency’s management should use and internally communicate quality information to achieve the entity’s objectives. OCPO officials told us that components—such as ICE—have the discretion to establish additional processes for identifying and calculating federal oversight beyond what is required by the job aid. However, without consistently identifying all service requirements in need of heightened management attention and establishing a repeatable process across the department for analyzing, documenting, and updating the federal personnel needed to perform or oversee the requirement when changes occur, program and contracting officials lack reasonable assurance that they are dedicating an adequate number of federal employees to oversee these functions. This places DHS components at risk of inconsistently planning federal oversight necessary to ensure the department retains control of its missions and the performance of inherently governmental functions. DHS components included in our review are at risk of not conducting the oversight tasks and safeguards necessary to ensure that, once the contract has been awarded, the contractor’s functions are performed in a way so as to not become inherently governmental, and that DHS retains sufficient internal capability to retain control of its mission for functions that are closely associated with inherently governmental, critical, or special interest. The 2010 Consolidated Appropriations Act states that agencies should have specific safeguards and monitoring systems in place to ensure the work that contractors are performing has not changed or expanded during performance to become an inherently governmental function. Additionally in 2010, OMB issued a memo that states agencies shall conduct meaningful analysis—through the annual service inventory—focused on special interest functions that require heightened management attention to ensure proper workforce balance. Based on our review of contract documentation and interviews with program and contracting officials associated with the eight contracts in our review, oversight of these service contracts in need of heightened management attention focused largely on assessing the quality of specific contractor tasks. Oversight of these contracts did not include a focus on ensuring the work of the contractors is not performed in a way so as to become inherently governmental, or that DHS retains sufficient internal capability to perform its missions. While assessing quality is important in monitoring contractor performance, it does not allow DHS to identify when tasks beyond what is detailed in the contract—including tasks that are potentially inherently governmental and require that final agency action reflects the independent conclusions of agency officials—are being performed. According to DHS’s most recent service contract inventory analysis and OCPO officials, DHS relies on well-trained contracting officer’s representatives to monitor contractor performance for inherently governmental functions. Yet one of the eight contracts in our review has not had a certified contracting officer’s representative assigned to the contract since its award in September 2018. For the remaining seven contracts, we found that their contracting officer’s representative appointment letters—which document oversight responsibilities— mentioned performing surveillance and inspections against the contract’s performance requirements. But only two of the seven letters—both from CBP—reference performing oversight tasks focused on how the contractor is completing the work. Specifically, both appointment letters stated that ongoing reviews should be completed focusing on the way work is performed and how the government is managing service acquisitions for closely associated with inherently governmental and critical functions. However, none of the letters we reviewed identified specific safeguards—such as vetting all contractor recommendations through a panel of federal employees—that federal personnel should perform to mitigate identified concerns with contractors performing closely associated with inherently governmental or losing sufficient internal capability for performing critical functions. Similarly, program and contracting officials associated with six of the eight service contracts in our review did not identify additional oversight tasks undertaken as a result of the contract requiring heightened management attention. Rather, these officials said they assess the contractor’s performance in terms of the quality of deliverables when asked about the types of oversight tasks performed. For example, DHS headquarters officials responsible for overseeing a service contract for technical support related to the development of nuclear detection technologies stated that their oversight largely focuses on tracking the completion of tasks included in the statement of work as well as available funding. These officials did not identify any additional actions taken to address the risk of contractors working in situations that permit or might permit access to confidential business or other sensitive information—a function closely associated with inherently governmental functions in need of heightened management attention. Additionally, acquisition officials from one of the DHS components in our review stated that they have previously relied on the contractor to report if they were performing work that was not specified in the contract. While performance monitoring is crucial to ensure that the contractor is meeting the terms of the contract, it alone does not provide DHS visibility into whether work is being performed that is outside the scope of the contract or inappropriate for contractors. Program and contracting officials associated with two of the eight service contracts in our review identified safeguards they have established to prevent contractors from performing inherently governmental work. For example, program and contracting officials associated with a USCIS contract awarded to assist in the preparation of Freedom of Information Act requests stated that they have safeguards in place to ensure the contractor does not approve agency responses to Freedom of Information Act requests—an inherently governmental function, according to the 2011 OFPP policy letter. Specifically, officials associated with this contract explained that they use a software program that does not allow a user without federal employee credentials to approve a request within the system. This is an example of a safeguard that can be instituted for similar service contracts when the risk of the contractor performing the inherently governmental function of approving requests is present. Additionally, officials associated with CBP’s service contract for maintaining its unmanned aircraft systems stated that they ensure that their onsite personnel do not direct contractors to perform unauthorized tasks by requiring these personnel to report directly to the program office. Contracting and program officials’ lack of focus on safeguards to mitigate risks associated with contract functions in need of heightened management attention is due, in part, to DHS not identifying—either in guidance or training that we reviewed—a list of oversight tasks that program and contracting officials can perform. DHS’s OCPO officials explained that there are unique aspects of each contract that should drive oversight needs so they have not established any required safeguards component program and contracting officials must employ. Despite the uniqueness of each contract, officials from OPO stated that it would be helpful to have a list of identified potential oversight tasks or safeguards for service contracts in need of heightened management attention to ensure they are managing the risk of the contractor performing work outside of scope. We found that at least one federal agency has such a list available. Specifically, the Department of State’s Contracting Officer’s Representative Handbook provides a list of mitigation strategies contracting officer’s representative can employ for contracts requiring risk mitigation—such as reserving final approval authority of any contractor proposed action for federal employees only. Additional strategies listed include requiring contractor affiliation be clearly displayed on all presentation material, and conducting conflict of interest reviews when contractors are performing services that involve or relate to evaluating another contractor’s performance. Without identifying what oversight tasks or safeguards component personnel can institute to prevent contractors from performing inherently governmental functions or from affecting the ability of the agency to maintain control of its mission and operations, DHS is at risk of its personnel not knowing which steps they should take to prevent that from occurring. DHS components in our review consider service contract requirements when identifying their resource needs and formulating their budget justifications, but DHS headquarters and Congress have limited visibility into requested and actual service contract requirement costs. DHS uses the planning, programming, budgeting, and execution process to allocate resources—including those for service contracts—across the department. DHS’s guidance for this process that we reviewed does not provide specific instructions for how the components should consider service contract requirements when budgeting, but program officials we spoke with said that they generally provide information on specific service contract costs, among other resource needs, to their budget offices during the programming phase. Components then include these resource needs in their budget justifications, which are submitted to DHS headquarters for review before being submitted to OMB and then Congress. Based on our review of component budget justifications, components communicate service contract requirements in three primary ways, but none provide complete visibility into service contract requirements. Object Classes: Object classes are broad spending categories identified in OMB guidance. As shown earlier in table 1, there are eight object classes for other contracted services. According to component officials, once the resource needs for service contracts are identified, they are grouped into the object classes that best represent the requirement by either program or budget officials before submitting budget justifications to DHS headquarters. However, object class codes do not provide visibility into just service contract requirements. For example, budget officials at ICE and USCIS told us that aligning service requirements across object classes is not always perfect or precise. According to ICE officials, object class codes may include other expenses, such as interagency agreements. Further, USCIS officials noted that some contract requirements can apply to multiple object classes, so how requirements are communicated by object class is subjective based on program officials’ judgment. Cost Drivers: According to DHS budget officials, cost drivers identified in budget documentation represent the requirements that make up the largest costs at the program/project activity level. Service requirements may be included as a cost driver, but only if the estimated value of the contract represents a large portion of the program/project activity’s costs. For example, ICE’s budget guidance instructs the program offices to identify major requirements that add up to at least 50 percent of the program/project activity resource needs as non-pay cost drivers. Based on that guidance, in fiscal year 2020 budget documentation, one of ICE’s service contracts included in our review—for Office of the Principal Legal Advisor document management services—is identified as a cost driver. Only one other contract included in our review—from USCIS—was identified as a cost driver. Capital Investment Exhibit: According to DHS budget officials, the five contracts with the highest dollar value supporting each component’s capital investment are identified in the component’s budget documentation. Service contracts may be included in the capital investment exhibit if they meet this criteria, but the details included are vague. For example, for each contract listed, the exhibit typically includes information such as the contract number and total value, but does not categorize whether the contract is for a product or service nor consistently provide a description of the contract itself. For the contracts in our review, one of the eight—a contract for nuclear detection technology technical support—was included in the capital investment exhibit in fiscal year 2020 budget documentation. Since component budget offices submit their proposed budget requests with service contract requirements aligned into object class codes, program/project activities, and capital investment exhibits, DHS lacks visibility into the components’ requested service contract requirement needs. For example, officials from the Office of the Chief Financial Officer stated that they do not have visibility into DHS and the components’ specific service contract requirements. Rather, officials said their visibility is limited to changes in service contract requirements that are justified as part of requested increases or decreases in components’ funds. While officials from the Office of the Chief Financial Officer stated that they can request additional information from the components on service requirements if needed, officials could not identify any specific circumstances that have led to them requesting this information for their own purposes or in response to congressional interest. See figure 9 for details on how service contract requirements are communicated to DHS headquarters in budget documentation. Moreover, although DHS obligates over three-quarters of its contract spending to services, neither the Office of the Chief Financial Officer or OCPO have full visibility into or track service contract requirement costs. For example, similar to how information is portrayed in budget documents, officials from the Office of the Chief Financial Officer stated they report obligations to Congress by object class level on a quarterly basis; therefore, visibility into service contract requirement costs is limited. Further, OCPO officials stated that they also do not have a system for tracking service contract obligations reported through FPDS- NG or otherwise. In a discussion held during the course of our review, congressional requesters expressed interest in receiving additional information and visibility into DHS’s estimated service contract requirements. Members of Congress have also previously expressed interest in having increased oversight and visibility into other aspects of DHS’s proposed spending as well as into the Department of Defense’s estimated service contract requirements. For example, DHS budget officials told us that the decision to include the top five highest dollar value contracts in its capital investment exhibits was driven by congressional interest in this type of information on service contracts. In addition, in 2009, Congress began requiring the Department of Defense to identify in its budget submission the amounts requested for its service contracts for each component, installation, or activity, excluding services related to research and development and military construction. For example, the Department of Defense has two budget exhibits that provide details on estimated service contract requirements—one that details its advisory and assistance services, and another that tracks contracted services across prior fiscal years. In February 2016, we found shortfalls in the Department of Defense’s reporting of service contract requirements in its budget documents. We recommended that it modify its approach for reporting service contracts in its budget justifications to include additional service requirements. The Department of Defense agreed with this recommendation and, in February 2016, took steps to fully report on these service categories in its service contract spending exhibit accompanying the fiscal year 2017 budget request. We have also reported on challenges with congressional visibility into DHS’s major acquisition programs in budget documents. In April 2018, we found that DHS budget practices limit Congress’s visibility into costs and recommended that DHS work with Congress to include information on operations and support funding requests for major acquisitions in its annual budget justifications. DHS agreed with this recommendation and addressed it by adding an operations and support funding information display for major acquisition programs to its congressional budget justification for fiscal year 2021. Federal internal control standards state that agency’s management should communicate quality information internally and externally to inform decisions. Although detailed information on service requirements is available at the component level, DHS’s budget justifications do not provide that level of visibility. Visibility into service requirements is especially critical given that increases in DHS’s service contract obligations—particularly those in need of heightened management attention—may pose risks to DHS maintaining control over its mission. Given these increases, additional visibility into how much of DHS’s mission is being accomplished through the use of services requiring heightened management attention could inform DHS’s decision-making on the tasks it chooses to contract for, and the balance of its federal and contractor workforce. Without working with Congress to determine the format and level of detail needed to communicate service contract requirements in budget information, DHS headquarters and Congress are at risk of not having the information for sound resource planning and decision-making related to DHS’s use of service contracts. Service contracts play a critical role in supporting DHS’s wide range of missions, but increases in service contract obligations—including significant increases in obligations for services in need of heightened management attention—necessitate DHS’s attention as it develops, reviews, oversees, and budgets for service contract needs. DHS’s recent effort to perform a headquarters-level review of certain service and product procurement actions is a positive step in improving the department’s visibility into how it is acquiring certain services and products. However, without developing a risk-based approach for reviewing certain proposed service contract requirements to ensure they are clearly defined and valid before they are procured and consistently reviewing eligible procurement actions, DHS cannot ensure it has established the rigor needed to review its service procurements. Further, changes in DHS’s processes and a lack of agency-wide guidance for planning, documenting, and updating federal oversight personnel and activities for services in need of heightened management attention have put the department at risk of not effectively addressing whether contractors are performing inherently governmental functions. These risks could pose challenges to DHS’s ability to maintain control over its mission and operations. Ensuring DHS has guidance for planning and updating the resources needed to oversee these contracts, and identifying the types of activities that federal personnel should be performing to mitigate the risks associated with these contracts are critical to DHS’s ability to address these concerns. Finally, despite the availability of information on specific service contract requirements within component program offices, DHS does not communicate most of this information in budget documentation provided to DHS headquarters or Congress, nor is DHS currently required to do so. Given that DHS’s service contract obligations—including those in need of heightened management attention—account for more than three quarters of DHS’s total annual contract obligations, DHS is missing opportunities to make more informed strategic decisions because it does not have visibility into its current or future service requirement spending for these services. We are making six recommendations to the Secretary of Homeland Security: The Secretary of Homeland Security should direct the DHS Chief Procurement Officer to, in coordination with the Office of Program Accountability and Risk Management, develop a risk-based approach for reviewing service requirements—through the Procurement Strategy Roadmap or other means—to ensure proposed service requirements are clearly defined and reviewed before planning how they are to be procured. (Recommendation 1) The Secretary of Homeland Security should direct the DHS Chief Procurement Officer to document the factors the Office of the Chief Procurement Officer considers when waiving procurement actions from its Procurement Strategy Roadmap to ensure it is consistently considering potential acquisition risks in its planning—including those specific to services. (Recommendation 2) The Secretary of Homeland Security should direct the DHS Chief Procurement Officer to update the Inherently Governmental and Critical Functions Analysis to require the identification of special interest functions. (Recommendation 3) The Secretary of Homeland Security should direct the DHS Chief Procurement Officer to update the Inherently Governmental and Critical Functions Analysis to provide guidance for analyzing, documenting, and updating the federal workforce needed to perform or oversee service contracts requiring heightened management attention. (Recommendation 4) The Secretary of Homeland Security should direct the DHS Chief Procurement Officer to develop guidance identifying oversight tasks or safeguards personnel can perform, when needed, to mitigate the risk associated with contracts containing closely associated with inherently governmental functions, special interest functions, or critical functions. (Recommendation 5) The Secretary of Homeland Security should direct the DHS Chief Financial Officer to work with Congress to identify information to include in its annual congressional budget justifications to provide greater transparency into requested and actual service requirement costs, particularly for those services requiring heightened management attention. (Recommendation 6) We provided a draft of this report to DHS for review and comment. In its comments, summarized below and reproduced in appendix V, DHS agreed with the third and fifth recommendations and identified steps it plans to take to address them. DHS disagreed with the first, second, fourth, and sixth recommendations. DHS also provided technical comments, which we incorporated as appropriate. DHS did not agree with the first recommendation, that OCPO, in coordination with the Office of Program Accountability and Risk Management, develop a risk-based approach for reviewing service requirements through the Procurement Strategy Roadmap, or other means, to ensure that proposed service requirements are clearly defined and reviewed before planning how they are to be procured. In its response, DHS cited Instruction 102-01-001 as codifying how DHS and its components acquire and sustain services for major acquisitions. However, as noted in our report, as of November 2019 none of DHS’s services programs rose to the level of being classified as a major service acquisition. Therefore, DHS is at risk of overlooking those service contracts that are not a service acquisition program or not associated with its major acquisitions. DHS also noted the use of existing key processes that enable it to identify needs and develop contract requirements for services. While we acknowledge in our report that DHS and selected components have these processes in place, we found they were not consistently used throughout the contracts in our review, and none can serve as a replacement for the kind of risk-based headquarters-level oversight that we believe is necessary. For example, among its processes, DHS cited the use of integrated product teams as a way to facilitate comprehensive reviews of service requirements. We noted in our report, however, that according to officials only two of the eight contracts in our review used such an approach. Further, DHS stated that other existing efforts meet the primary objectives of the Service Requirements Review pilot, thus making an additional headquarters-level review of service requirements unnecessary. However, all of these efforts were also already in place when the then Under Secretary of Management directed OCPO and the Office of Program Accountability and Risk Management to undertake its December 2018 pilot program to provide consistency and rigor to reviewing service contract requirements. Therefore, we continue to believe that given the amount DHS obligates in service contracts to support its mission, establishing a risk-based approach to review service requirements prior to and in coordination with its consideration of how those requirements are to be procured will help prevent negative acquisition outcomes and the potential for wasted resources. DHS also did not agree with the second recommendation. In its response, DHS stated that OCPO’s decision to waive a Procurement Strategy Roadmap review does not mean that the Chief Procurement Officer did not consider acquisition risks, and that it is unclear what other acquisition risks we believe are not being considered. The recommendation to document the factors considered when waiving the Procurement Strategy Roadmap is intended to ensure that the department is able to consistently apply a framework and maintain institutional knowledge—particularly given the risks and challenges that vacancies in top leadership positions throughout the department could pose to addressing management issues. Waiving procurements without documentation of what acquisition risks are being considered puts the department at risk of inconsistently making those decisions and not being able to leverage Procurement Strategy Roadmap lessons learned. DHS noted in its response that the decision to waive a procurement review is based on several considerations, such as the type of service, information provided to the Chief Procurement Officer by the Head of Contracting Activity, and historical and current knowledge of the procurement, among others. However, the department offered no further insights as to: what types of services may not warrant a Procurement Strategy Roadmap; what type of information provided by the Head of Contracting Activity may indicate a review is unnecessary; or how the Chief Procurement Officer maintains the historical knowledge of procurements that may have previously experienced challenges and thus warrant a Procurement Strategy Roadmap. We continue to believe that taking the step of documenting the factors considered—such as types of services that may require additional review, or challenges with prior procurements, some of which may have been awarded years prior—will help ensure that decisions to waive Procurement Strategy Roadmaps are made consistently and transparently. DHS did not agree with the fourth recommendation, that OCPO should update the Inherently Governmental and Critical Functions Analysis job aid to provide guidance for analyzing, documenting, and updating the federal workforce needed to perform or oversee service contracts requiring heightened management attention. In its response, DHS stated that the job aid requires components to certify that they have sufficient internal capacity to oversee and manage contractor activities and maintain control of its missions and operations when the requirement is a closely associated with inherently governmental or critical function. Further, DHS stated that the job aid requires components to certify that there are an adequate number of positions filled by federal employees to manage and monitor contractors if the requirement is a critical function. As noted in our report, each component is making its own determination, in the absence of guidance, as to what factors to consider. In its response, DHS stated that OCPO will assist components with examples of analysis by reviewing what some components are doing, and sharing those examples with others. However, in the absence of guidance about what DHS expects the components to analyze and document based on those examples, DHS does not know how or whether the components are considering the federal workforce available to oversee service contracts in need of heightened management attention, or what steps, if any, the components are taking to mitigate risks if there are not enough federal personnel available to oversee the contracts after award. In its response, DHS recognized the need to provide guidance for updating the job aid, if there is a change in the contract requirement, to help ensure it has sufficient internal capacity to oversee and manage contractor activities, maintains control of its missions and operations, and has the appropriate workforce in place. We consider this to be a positive step to address part of the recommendation; however, it is unclear what considerations the components will use to update their analysis without the presence of guidance for how to analyze the federal workforce needed prior to the contract being awarded. We maintain that without guidance, DHS is at risk of inconsistent consideration of federal oversight for service contracts across its components—an action at odds with its goals of improving integration, and centralizing and coordinating its many functions to ensure that its whole is greater than its parts. Finally, DHS did not agree with the sixth recommendation, to work with Congress to identify information to include in congressional budget justifications to provide greater transparency into requested and actual service requirement costs, particularly for services requiring heightened management attention. In its response, DHS stated that it does not believe including additional information on estimated or actual service contract requirement costs is appropriate, and stated that contract information can be found in congressional budget justifications in budget object class breakouts, cost drivers, and in the Procurement, Construction, and Improvement Appropriation Capital Investment exhibit. We acknowledge these same three sources of information in our report, and note the limitations with each (either over-estimating or under- estimating service contracts) to providing visibility into DHS’s estimated or actual service contract requirements—both internally to DHS and externally to Congress. For example, as we note in the report, contracts identified in the Capital Investment Exhibit are not categorized as being for a product or service nor does the exhibit consistently provide a description of what the contract is for. In its response DHS noted limitations with our analysis comparing contract obligation data from FPDS-NG with what is reported in DHS’s budget justifications, however, after discussion with DHS officials during our review, we did not include that comparison in our report. DHS also noted in its response that the congressional budget justifications are intended to focus on the request, not on the previous or current year’s contracts. However, the recommendation that DHS work with Congress is impartial as to what type of service contract information would be useful for providing greater transparency into DHS’s service contract requirements. Rather, the recommendation is intended to address the limited visibility both DHS and Congress have into DHS service requirements—in particular the significant increases in services requiring heightened management attention—and provide a means to report on that information to improve internal and external oversight over these requirements and to allow for more informed decision-making. The need for this visibility into service contract requirements is aligned with prior recommendations GAO has made related to the need to increase visibility in DHS’s congressional budget justifications for major acquisition programs’ funding requests; recommendations that DHS has agreed with and implemented. Given that service contracts accounted for over three quarters of DHS’s contract obligations from fiscal years 2013 through 2018, we continue to believe that our recommendation to work with Congress on how to convey that information in congressional budget requests is valid. We are sending copies of this report to the appropriate congressional committees, the Secretary of Homeland Security, the DHS Chief Procurement Officer, the Commissioner of U.S. Customs and Border Protection, the Director of Immigration and Customs Enforcement, and the Director of U.S. Citizenship and Immigration Services. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-4841 or makm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix VI. You asked us to review the Department of Homeland Security’s (DHS) use of and planning for service contracts. This report addresses the extent to which DHS and selected components and offices (1) used service contracts from fiscal years 2013 through 2018; (2) identified, developed, and reviewed service contract requirements; (3) ensured oversight of service contracts requiring heightened management attention; and (4) considered service requirements in budgeting processes. To identify the extent to which DHS used service contracts, we reviewed the Federal Procurement Data System-Next Generation (FPDS-NG) data on DHS-funded contract obligations from fiscal years 2013 through 2018 adjusted for inflation using the Gross Domestic Product Price Index. We identified obligations for services using the codes associated with services in the General Services Administration’s Federal Procurement Data System Product and Service Codes Manual. We analyzed the FPDS-NG data to identify DHS service obligations compared to obligations for products, service obligations by DHS component, the types of services procured, and the proportion of service contracts for functions in need of heightened management attention—those deemed closely associated with inherently governmental, critical, and special interest functions. We assessed the reliability of FPDS-NG data by reviewing existing information about the FPDS-NG system and the data it collects— specifically the data dictionary and data validation rules—and performing electronic testing. We determined the FPDS-NG data were sufficiently reliable for the purposes of identifying DHS’s use of service contracts. We selected a non-generalizable sample of four DHS contracting activities that had high obligations for service contracts and special interest functions compared to other DHS contracting activities—U.S. Customs and Border Protection (CBP), U.S. Immigration and Customs Enforcement (ICE), U.S Citizenship and Immigration Services (USCIS), and the Office of Procurement Operations (OPO). For the purposes of this report, we will refer to these contracting activities, which include three components and one office, as components. From these components, we selected a non-generalizable sample of 100 contracts awarded in fiscal year 2018 that were above the simplified acquisition threshold and were not exempt from performing a Balanced Workforce Assessment Tool (BWAT)—a risk analysis tool used by DHS components at that time to identify the appropriate mix of federal and contractor employees. Seventy five of the 100 contracts were for special interest functions, with the remaining 25 randomly selected. From that sample, we selected eight contracts—two from each component—that were identified as requiring heightened management attention. We selected a range of contracts based on whether the contract contained functions requiring heightened management attention, the percent of recommended federal oversight, and whether the requirement was new, among other selection criteria. We conducted semi-structured interviews with program, contracting, and budgeting officials from the eight selected component contracts to identify how the selected service contract requirements were developed, overseen, and considered when budgeting. Information collected from the four components and eight contracts cannot be generalized to all components and contracts. For additional details on the contracts we selected, see table 2. To determine how DHS and selected components identified, developed, and reviewed service contract requirements prior to soliciting for a contract, we reviewed relevant documentation, including the Federal Acquisition Regulation (FAR), and DHS, CBP, ICE, USCIS, and OPO contracting policies. To determine what processes selected components have for identifying and developing service requirements, we reviewed documentation, and interviewed program and contracting officials associated with our four selected components and eight selected contracts. To determine how DHS is reviewing service contract requirements, we reviewed DHS Office of the Chief Procurement Officer (OCPO) and Office of Program Accountability and Risk Management guidance and documentation on recent DHS headquarters initiatives—the Procurement Strategy Roadmap and Service Requirements Review pilot—and federal internal control standards on risk assessment. We also interviewed officials on these efforts to identify similarities and differences, and the processes established to review certain service contracts. To determine the extent to which DHS and the selected components in our review ensured federal oversight of service contracts requiring heightened management attention, we reviewed relevant documentation and regulations including Office of Federal Procurement Policy (OFPP) memorandums, the FAR, DHS contracting policies and guidance, and federal internal control standards on information and communication and risk assessment. To understand how DHS and selected components planned and documented oversight needs we reviewed available BWATs from our non-generalizable sample of contracts that we identified as special interest functions. Using FPDS-NG data, we identified an additional 27 contracts with completed job aids that were awarded in fiscal year 2019 for special interest functions across our selected components following implementation of the Inherently Governmental and Critical Functions Analysis job aid in March 2019. We reviewed the completed job aid associated with each of these contracts to understand how the oversight planning process has changed. We interviewed OCPO and component program and contracting officials about their use of both the BWAT and the Inherently Governmental and Critical Functions Analysis job aid. To determine the extent to which DHS and selected components conducted federal oversight of service contracts requiring heightened management attention throughout the life of a service contract, we analyzed documentation—such as contracting officer’s representative appointment letters depicting oversight responsibilities and training for contracting and program officials—and interviewed officials responsible for performing oversight functions. Additionally, to understand the types of tasks oversight officials can perform to mitigate the risk of contractors performing inherently governmental functions or losing control of the department’s mission, we reviewed OCPO provided guidance and trainings and interviewed relevant officials. To determine the extent to which DHS and selected components consider service contracts when budgeting, we reviewed Office of Management and Budget (OMB), DHS headquarters, and component budgeting guidance, federal internal control standards on information and communication, and interviewed headquarters and component budget officials. To determine how service contract requirements are communicated during resource planning and budget formulation, we reviewed DHS and component budget justification documents to identify what ways service requirement information is reflected, including whether specific information on our selected contracts was visible. We compared the resources DHS reported needing and receiving in its fiscal year 2018 budget documentation with DHS’s use of service contracts as reported in FPDS-NG in the same fiscal year as a proxy for visibility of service contract requirements in DHS budgeting. We conducted this performance audit from February 2019 to May 2020 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix II: Department of Homeland Security Organizational Chart The Office of Procurement Operations is the contracting activity for the following DHS components and offices shown above: Countering Weapons of Mass Destruction; Cybersecurity and Infrastructure Security Agency; Civil Rights and Civil Liberties; General Counsel; Office of Intelligence and Analysis; Legislative Affairs; Office of Operations Coordination; Partnership and Engagement; Office of Strategy, Policy, and Plans; Public Affairs; Chief Information Officer; Chief Financial Officer; Secretary/ Deputy Secretary; Management Directorate; Privacy; and the Science and Technology Directorate. In September 2011, the Office of Federal Procurement Policy (OFPP) in the Office of Management and Budget (OMB) issued a policy letter to help agencies manage the performance of inherently governmental and critical functions. The guidance states contracts whose performance may involve closely associated with inherently governmental, critical, or special interest functions require heightened management attention. Specifically, guidance states that closely associated with inherently governmental functions are functions that require heightened management attention to ensure that contractor’s activities do not expand into inherently governmental functions. OMB’s response to public comments on the proposed policy letter provides examples of inherently governmental and closely associated with inherently governmental functions, as shown in table 3. In response to public comments on the proposed policy letter, OMB called critical functions core to the agency’s mission or operations. In addition, the policy letter states that critical functions, when contracted for, pose the risk that the agency can lose control of its mission and operations. Examples of work previously identified by DHS as critical functions for the department include: Intelligence services—proprietary software used to conduct deep and dark web searches on possible threats against senior officials. Risk mitigation services—supporting undercover agents’ identities Program support—immigration data integration Administrative services—working closely with agency senior leadership to conduct research, schedule and attend meetings, as well as develop policies. The policy letter states that agencies must retain sufficient internal capability to give critical functions heightened management attention by: dedicating an adequate number of qualified federal personnel to understand the agency’s requirements and perform functions alongside contractors, if necessary, in the event the contractor fails to perform; or ensure qualified federal personnel are available to oversee and manage the contractor workforce. OMB guidance also describes special interest functions as requiring heightened management attention. In a 2010 memo, OFPP issued guidance to help agencies conduct a required service contract inventory for fiscal year 2010. The guidance describes the service contract inventory as a tool to better understand how contracted services are used and whether contractors’ skills are utilized in an appropriate manner. According to the guidance, agencies should give priority consideration to special interest functions, which for fiscal year 2010 OFPP identified as the categories of professional management services and information technology support services. Special interest functions require increased management attention due to increased risk of workforce imbalance. DHS, in line with OMB guidance, has identified 17 product and service codes to categorize as special interest functions, as shown in table 4. The Department of Homeland Security (DHS) implemented its Balanced Workforce Strategy (BWS) in October 2009 to establish a set of processes that, when repeated on a regular basis, enables the department to achieve the appropriate mix of federal employees and contractors to accomplish the department’s mission while minimizing mission risk that may result from an overreliance on contractors. To accomplish the intended goals of the BWS, DHS instituted an online questionnaire called the Balanced Workforce Assessment Tool (BWAT). The BWAT was in place until March 2019 when DHS determined it— along with the strategy—were no longer necessary given the maturation of their acquisition workforce and their inability to support the software underlying the BWAT. In its place, DHS commissioned its Inherently Governmental and Critical Functions Analysis—known as the job aid. Marie A. Mak 202-512-4841 or MakM@gao.gov In addition to the contact named above, Penny Berrier (Assistant Director), Meghan Perez (Analyst in Charge), Erin Butkowski, Signe Janoska-Bedi, and Jacqueline Wade were principal contributors. In addition, the following people made contributions to this report: Pete Anderson, Lorraine Ettaro, Suellen Foth, Julia Kennon, Roxanna Sun, and Anne Louise Taylor.

Summary: DHS's spending on services—such as guard services and technology support—represents over 75 percent of its annual contract obligations. The Office of Management and Budget has recognized that some service contracts require extra management attention because they pose a risk that the government could lose control of its decisions or operations. GAO was asked to review DHS's use of and planning for service contracts. This report addresses, among other objectives, the extent to which DHS and selected components and offices use, oversee, and budget for service contracts. GAO analyzed Federal Procurement Data System-Next Generation data from fiscal years 2013 through 2018; selected non-generalizable samples of four components with high service contract obligations and eight service contracts requiring heightened management attention; and interviewed DHS officials. From fiscal years 2013 through 2018, the Department of Homeland Security (DHS) increased its reliance on contracts for services, particularly those in categories that may need heightened management attention, such as drafting policy documents (see figure). These services include functions that are closely associated with inherently governmental, critical, or special interest, which could put the government at risk of losing control of its mission if performed by contractors without proper oversight by government officials. GAO found that DHS and selected components do not consistently plan for the level of federal oversight needed for these contracts because there is no guidance on how to document and update the number of federal personnel needed to conduct oversight. GAO also found that program and contracting officials from six of the eight contracts GAO reviewed did not identify specific oversight activities they conducted to mitigate the risk of contractors performing functions in a way that could become inherently governmental. DHS lacks guidance on what these oversight tasks could entail. Without guidance for documenting and updating the planned federal oversight personnel needed, and identifying oversight tasks, DHS cannot mitigate the risks associated with service contracts in need of heightened management attention. Selected DHS components have information on service requirements, but budget documentation—submitted to DHS headquarters as well as to Congress—does not communicate details about most estimated or actual service contract requirements costs. Given that services account for over three-quarters of DHS's annual funding for contracts, additional insights would shed light into how much of DHS's mission is being accomplished through services, including those requiring heightened management attention. Without more visibility into this information, DHS headquarters and Congress are at risk of not having complete information for sound resource planning and decision-making, particularly as it relates to determining what proposed service contract requirements DHS should prioritize when budgeting. GAO is making six recommendations, including that DHS provide guidance for documenting and updating the federal workforce needed to oversee certain service contracts and identifying oversight tasks, and report service requirement information in budget documents to Congress. DHS agreed with two of the recommendations and did not agree with four of them. GAO continues to believe the recommendations are valid, as discussed in the report.