With top leadership support and commitment, DHS has made important progress in strengthening its management functions, but considerable work remains. As shown in figure 1, as of March 2019, DHS had met three out of five criteria for removal from our High Risk List—leadership commitment, action planning, and monitoring progress. DHS has partially met the remaining two criteria: capacity (i.e., people and other resources) and demonstrated, sustained progress. To address the criteria for capacity, DHS needs to make additional progress in identifying and allocating resources in certain areas—namely, acquisition, information technology, and financial management—to fully demonstrate its capacity. For the criteria for demonstrated, sustained progress, we reported in March 2019 that DHS had fully addressed 17 out of the 30 outcomes that are the basis for gauging DHS’s progress across management areas, as shown in table 1. To fully meet the criteria for demonstrated, sustained progress, DHS needs to continue implementing its Integrated Strategy for High-Risk Management and maintain engagement with us to show measurable, sustainable progress in implementing corrective actions and achieving outcomes. DHS can accomplish this by, among other things, maintaining a high level of top leadership support and sustained commitment to ensure continued progress in executing its corrective actions through completion, and increasing employee engagement and morale. Examples of important programs and remaining work in the key management functions include: In the key management function of human capital management, DHS leadership is needed to address skills gaps that have had a significant role in the DHS management high-risk area. For example, we have found that DHS lacks guidance on how to identify critical cybersecurity and acquisition skills needed to support its new information technology delivery model. We have also found that DHS has insufficient technical skills to support its biometric identification services program. Addressing these skill gaps could help DHS fully demonstrate its capacity to strengthen and integrate its management functions. Additionally, within human capital management, DHS has struggled with low employee morale scores since it began operations in 2003. DHS’s 2018 score ranked 20th among 20 large and very large federal agencies. Increasing employee engagement and morale is critical to strengthening DHS’s mission and management functions. DHS has continued to strengthen its employee engagement efforts by implementing our 2012 recommendation to establish metrics of success within components’ action plans for addressing its employee satisfaction problems. Further, DHS has conducted audits to better ensure components are basing hiring decisions and promotions on human capital competencies. In addition, OPM’s 2018 Federal Employee Viewpoint Survey data showed that in the past 2 years, DHS’s score on the Employee Engagement Index (EEI) increased by 4 points—from 56 in 2016 to 60 in 2018—which was 1 point more than the government-wide increase over the same period. While this improvement is notable, DHS’s current EEI score is 1 point below its EEI baseline score in 2010, suggesting that DHS is still working to regain lost ground after an 8 point drop between 2010 and 2015. In the key management function of financial management, DHS officials have faced challenges modernizing DHS components’ financial management systems and business processes that affect the department’s ability to have ready access to timely and reliable information for informed decision-making. Effectively modernizing financial management systems for the Coast Guard, FEMA, and ICE would help improve the reliability of their financial reporting. As we have reported, perhaps the single most important element of successful management improvement and transformation initiatives is the demonstrated commitment of top leaders, as shown by their personal involvement in reform efforts. With regard to leadership commitment, DHS’s top leadership, including leaders at the Secretary and Deputy Secretary level, has demonstrated exemplary commitment and support for addressing the department’s management challenges. They have also taken actions to institutionalize this commitment to help ensure the long- term success of the department’s efforts. One such effort is the Under Secretary for Management’s Integrated Priorities initiative to strengthen the integration of DHS’s business operations across the department. During monthly leadership meetings with the Under Secretary for Management, the department’s Chief Executive Officers have been providing status updates on their respective actions to address this high- risk designation. Furthermore, top DHS leaders, such as the Under Secretary for Management and the department’s Chief Executive Officers, routinely meet with our management to discuss progress on high-risk areas. In April 2019, we sent a letter to the Acting Secretary of Homeland Security detailing 26 open recommendations that we deem highest priority for implementation. Priority recommendations are those that we believe warrant priority personal attention from heads of key departments or agencies. These 26 recommendations fall into six major areas— emergency preparedness and response, border security, transportation security, infrastructure and management, cybersecurity, and chemical and nuclear security. Many of these recommendations cut across DHS’s mission areas that are critical for national security. Given that these recommendations are often the most complex and difficult to implement, top DHS leadership will play a critical role in addressing them. Fourteen of the 26 priority open recommendations we identified in the April 2019 letter are directed to acting officials serving in vacant positions. We have issued 12 recommendations to the Secretary of Homeland Security who is currently an acting official. We have also issued two recommendations to FEMA which is currently operating under acting leadership. Committed and consistent leadership at the department and component levels will be critical for addressing our priority recommendations. For example: In September 2014, we recommended that the Secretary of Homeland Security work jointly with the Administrator of the General Services Administration to strengthen management of the ongoing acquisition project to develop the multi-billion dollar headquarters facilities at the St. Elizabeth’s campus in Washington, D.C. Leadership is critical in this effort, given the magnitude of the project and the impact of headquarters consolidation on DHS operations. In October 2008, we recommended actions that FEMA should take to improve its administration of the National Flood Insurance Program high-risk area. We also recommended in September 2012 that FEMA develop a methodology to better assess a jurisdiction's capability to respond to and recover from a disaster without federal assistance. In July 2015, we further recommended that the Mitigation Framework Leadership Group establish an investment strategy to identify, prioritize, and guide federal investments in disaster resilience. Implementing these actions could limit the federal government’s fiscal exposure and increase the nation’s resilience to extreme weather events as the costs and impacts of weather disasters resulting from floods, drought, and other events are expected to increase in significance as previously “rare” events become more common and intense. In July 2018, we recommended that U.S. Customs and Border Protection (CBP) analyze the costs associated with future barrier segments along the southwest border and include cost as a factor in the Impedance and Denial Prioritization Strategy. Obtaining this key information could help CBP evaluate designs and prioritize locations for future border barrier segments to deter cross-border illegal activity. In February 2017, we recommended that DHS establish metrics and methods by which to evaluate the performance of DHS’s National Cybersecurity and Communications Integration Center in relation to its statutorily-required cybersecurity functions. Until it develops metrics and methods to evaluate its performance, the center cannot ensure that it is effectively meeting its statutory requirements, while cyber- based intrusions and attacks on federal systems and systems supporting our nation’s critical infrastructure are becoming more numerous, damaging, and disruptive. We also recommended in February 2018 that DHS take steps to better manage and assess its cybersecurity workforce gaps and areas of critical need. Given its important role in the nation’s cybersecurity, taking steps to address these issues will be critical. We will continue to monitor DHS’s progress in strengthening management functions and addressing priority recommendations. We also plan to continue to meet quarterly with DHS management to gauge leadership commitment, discuss progress, and review DHS’s goals and corrective action plans in its Integrated Strategy for High-Risk Management, which DHS issues twice per year. Thank you, Chairman Thompson, Ranking Member Rogers, and Members of the Committee. This concludes my testimony. I would be pleased to answer any questions. For further information on this testimony, please contact Christopher P. Currie at (404) 679-1875 or curriec@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Other individuals making key contributions to this work include Alana Finley, Assistant Director; Luis E. Rodriguez, Analyst-in-Charge; Karin Fangman; Andrew Howard; and Thomas Lombardi. Key contributors for the previous work that this is based on are listed in each product. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: In 2003, GAO designated Implementing and Transforming DHS as a high-risk area to the federal government. DHS has made considerable progress in transforming its original component agencies into a single cabinet-level department, and as a result, in 2013, GAO narrowed the scope of the high-risk area to focus on Strengthening DHS Management Functions . In addition, DHS leadership is responsible for implementing numerous recommendations that GAO has made to the department and its component agencies. Current vacancies in top leadership positions could pose a challenge to addressing high-risk areas and priority recommendations that span DHS's diverse missions, which include preventing terrorism and enhancing security, managing our borders, administering immigration laws, securing cyberspace, and responding to disasters. This testimony discusses the need for DHS leadership commitment to strengthen its management functions and address GAO's priority recommendations. This testimony is based on GAO's 2019 high-risk update and other reports issued from March 2006 through April 2019. With the support and commitment of top leadership, the Department of Homeland Security (DHS) has made important progress in strengthening its management functions; however, considerable work remains. As of March 2019, DHS had fully addressed 17 of the 30 outcomes related to its management functions (see table). DHS needs to continue to show sustained leadership commitment in implementing its Integrated Strategy for High-Risk Management to achieve the remaining outcomes. Leadership commitment is also pivotal in addressing other GAO high-risk areas where DHS has a role, such as ensuring the cybersecurity of the nation, the National Flood Insurance Program, and limiting the federal government's fiscal exposure by better managing climate change risks. Currently, DHS has acting officials serving in eight positions requiring Senate confirmation, including positions with responsibilities for implementing high-risk outcomes, such as the Secretary, Deputy Secretary, and Under Secretary for Management. a “Mostly addressed”: Progress is significant and a small amount of work remains. b “Partially addressed”: Progress is measurable, but significant work remains. c “Initiated”: Activities have been initiated to address the outcome, but it is too early to report progress. In April 2019, GAO sent a letter to the Acting Secretary of Homeland Security detailing 26 open recommendations that GAO believes warrant the highest priority personal attention from the department and its components. These 26 recommendations fall into six major areas—emergency preparedness and response, border security, transportation security, infrastructure and management, cybersecurity, and chemical and nuclear security. For example, GAO has recommended that DHS take steps to strengthen human capital management, such as better managing and assessing its cybersecurity workforce gaps and areas of critical need. Fourteen of the 26 recommendations have been issued to acting officials serving in vacant positions, including 12 to the Secretary of Homeland Security, and two to the Federal Emergency Management Agency which is currently operating under acting leadership. Since the creation of DHS, GAO has made approximately 2,800 recommendations to the department, and DHS has implemented more than 75 percent of them, strengthening program management and performance measurement, among other things. GAO will continue to monitor DHS's progress in strengthening management functions and addressing priority recommendations.