In an effort to increase homeland security following the September 11, 2001, terrorist attacks on the United States, President Bush issued the National Strategy for Homeland Security in July 2002 and signed legislation creating DHS in November 2002. The strategy set forth the overall objectives, mission areas, and initiatives to prevent terrorist attacks within the United States, reduce America’s vulnerability to terrorism, and minimize the damage and assist in the recovery from attacks that may occur. The strategy also called for the creation of DHS. The department, which began operations in March 2003, represented a fusion of 22 federal agencies to coordinate and centralize the leadership of many homeland security activities under a single department. Although the National Strategy for Homeland Security indicated that many federal departments (and other nonfederal stakeholders) will be involved in homeland security activities, DHS has the dominant role in implementing the strategy. The strategy identified six mission areas and 43 initiatives. DHS was designated the lead federal agency for 37 of the 43 initiatives. In addition, DHS had activities underway in 40 of the 43 initiatives. In addition, DHS has the dominant share of homeland security funding. Figure 1 shows the proposed fiscal year 2006 homeland security funding for federal departments and agencies, with DHS constituting about 55 percent of the total. The November 2002 enactment of legislation creating DHS represented a historic moment of almost unprecedented action by the federal government to fundamentally transform how the nation protects itself from terrorism. Rarely in the country’s past had such a large and complex reorganization of government occurred or been developed with such a singular and urgent purpose. This represented a unique opportunity to transform a disparate group of agencies with multiple missions, values, and cultures into a strong and effective cabinet department whose goals are to, among other things, protect U.S. borders, improve intelligence and information sharing, and prevent and respond to potential terrorist attacks. Together with this unique opportunity, however, came a significant risk to the nation that could occur if the department’s implementation and transformation was not successful. GAO designated DHS’s transformation as high-risk in January 2003based on three factors. First, DHS faced enormous challenges in implementing an effective transformation process, developing partnerships, and building management capacity because it had to effectively combine 22 agencies with an estimated 170,000 employees specializing in various disciplines— including law enforcement, border security, biological research, computer security, and disaster mitigation—into one department. Second, DHS faced a broad array of operational and management challenges that it inherited from its component legacy agencies. In fact, many of the major components that were merged into the new department, including the Immigration and Naturalization Service, the Transportation Security Administration, Customs Service, Federal Emergency Management Agency, and the Coast Guard, brought with them at least one major problem such as strategic human capital risks, information technology management challenges, or financial management vulnerabilities, as well as an array of program operations challenges and risks. Finally, DHS’s national security mission was of such importance that the failure to effectively address its management challenges and program risks could have serious consequences on our intergovernmental system, our citizen’s health and safety, and our economy. Overall, our designation of DHS’s transformation as a high-risk area and its inclusion on the 2003 High-Risk List was due to the failure to transform the diverse units into a single, efficient, and effective organization would have dire consequences for our nation. Since our 2003 designation of DHS’s transformation as high-risk, DHS leadership has provided a foundation for maintaining critical operations while undergoing transformation. DHS has worked to protect the homeland and secure transportation and borders, funded emergency preparedness improvements and emerging technologies, assisted law enforcement activities against suspected terrorists, and issued its first strategic plan. According to DHS’s performance and accountability report for fiscal year 2004 and updated information provided by DHS officials, the department has accomplished the following activities as part of its integration efforts: reduced the number of financial management service centers from 19 to 8, consolidated acquisition support for 22 legacy agencies within 8 major procurement programs, consolidated 22 different human resources offices to 7, and consolidated bank card programs from 27 to 3. As described in the next section, despite real and hard-earned progress, DHS still has significant challenges to overcome in all of its management areas. It is because of these continuing challenges that we continue to designate the implementation and transformation of DHS as high-risk. DHS faces a number of management challenges to improving its ability to carry out its homeland security missions. Among these challenges, which are discussed in more detail in the following sections, are providing focus for management efforts, monitoring transformation and integration, improving strategic planning, managing human capital, strengthening financial management infrastructure, establishing an information technology management framework, managing acquisitions, and coordinating research and development. One challenge that DHS faces is to provide focus on management efforts. The experience of successful transformations and change management initiatives in large public and private organizations suggests that it can take 5 to 7 years until such initiatives are fully implemented and cultures are transformed in a substantial manner. Because this timeframe can easily outlast the tenures of managers, high-performing organizations recognize that they need to have mechanisms to reinforce accountability for organization goals during times of leadership transition. Focus on management efforts needs to be provided at two levels of leadership. The first level is that of the political appointees in top leadership positions. These leaders are responsible for both mission and management support functions. Although DHS has been operating about 2 years, it has had two Secretaries, three Deputy Secretaries, and additional turnover at the Undersecretary and Assistant Secretary levels. The problem of turnover in top leadership is not unique to DHS. The average tenure of political leadership in federal agencies—slightly less than 3 years for the period 1990-2001—and the long-term nature of change management initiatives can have critical implications for the success of those initiatives. The frequent turnover of the political leadership has often made it difficult to obtain the sustained and inspired attention required to make needed changes. Similarly, the recent turnover in DHS’s top leadership raises questions about the department’s ability to provide the consistent and sustained senior leadership necessary to achieve integration over the long term. Another level for focus on management efforts is those leaders responsible for day-to-day management functions. As we have reported, a Chief Operating Officer (COO)/Chief Management Officer (CMO) may effectively provide the continuing, focused attention essential to successfully completing these multiyear transformations in agencies like DHS. At DHS, we have reported that the COO/CMO concept would provide the department with a single organizational focus for the key management functions involved in the business transformation of the department, such as human capital, financial management, information technology, acquisition management, and performance management, as well as for other organizational transformation initiatives. We have also recently testified that a COO/CMO can effectively provide the continuing, focused attention essential to successfully complete the implementation of DHS’s new human capital system, a large-scale, multiyear change initiative. The specific implementation of a COO/CMO position must be determined within the context of the particular facts, circumstances, challenges and opportunities of each individual agency. As the agency is currently structured, the roles and responsibilities of the Under Secretary for Management contain some of the characteristics of a COO/CMO for the department. According to Section 701 of the Homeland Security Act, the Under Secretary for Management is responsible for the management and administration of the Department in such functional areas as budget, accounting, finance, procurement, human resources and personnel, information technology, and communications systems. In addition, the Under Secretary is responsible for the transition and reorganization process and to ensure an efficient and orderly transfer of functions and personnel to the Department, including the development of a transition plan. While the protection of the homeland is the primary mission of the department, critical to meeting this challenge is the integration of DHS’s varied management processes, systems, and people—in areas such as information technology, financial management, procurement, and human capital—as well as in its administrative services. The integration of these various functions is being executed through DHS’s management integration initiative. The success of this initiative is important since the initiative provides critical support for the total integration of the department, including its operations and programs, to ultimately meet its mission of protecting the homeland. Last week, we released a report on DHS’s management integration efforts to date as compared against selected key practices consistently found to be at the center of successful mergers and transformations. Overall, we found that while DHS has made some progress in its management integration efforts, it has the opportunity to better leverage this progress by implementing a comprehensive and sustained approach to its overall integration efforts. First, key practices show that establishing implementation goals and a timeline is critical to ensuring success and could be contained in an overall integration plan for a merger or transformation. DHS has issued guidance and plans to assist its integration efforts, on a function-by-function basis (information technology and human capital, for example); but it does not have such a comprehensive strategy to guide the management integration departmentwide. Specifically, DHS still does not have a plan that clearly identifies the critical links that must occur across these functions, the necessary timing to make these links occur, how these critical interrelationships will occur, and who will drive and manage them. Second, it is important to dedicate a strong and stable implementation team for the day-to-day management of the transformation, a team vested with the necessary authority and resources to help set priorities, make timely decisions, and move quickly to implement decisions. In addition, this team would ensure that various change initiatives are sequenced and implemented in a coherent and integrated way. DHS is establishing a Business Transformation Office, reporting to the Under Secretary for Management, to help monitor and look for interdependencies among the individual functional integration efforts. However, this office is not currently responsible for leading and managing the coordination and integration that must occur across functions not only to make these individual initiatives work but also to achieve and sustain the overall management integration of DHS. To address this challenge, we recommended, and DHS agreed, that it should develop an overarching management integration strategy and provide it’s recently established Business Transformation Office with the authority and responsibility to serve as a dedicated integration team and also help develop and implement the strategy. Effective strategic planning is another challenge for DHS. We have previously identified strategic planning as one of the critical success factors for new organizations. This is particularly true for DHS, given the breadth of its responsibility and need to clearly identify how stakeholders’ responsibilities and activities align to address homeland security efforts. Without thoughtful and transparent planning that involves key stakeholders, DHS may not be able to implement its programs effectively. In 2004, DHS issued its first departmentwide strategic plan. We have evaluated DHS’s strategic planning process, including the development of its first departmentwide strategic plan, and plan to release a report on our findings within a few weeks. This report will discuss (1) the extent to which DHS’s planning process and associated documents address the required elements of the Government Performance and Results Act of 1993 (GPRA) and reflect good strategic planning practices and (2) the extent to which DHS’s planning documents reflect both its homeland security and nonhomeland security mission responsibilities. Another management challenge faced by DHS is how to manage its human capital. Our work in identifying key practices for implementing successful mergers and transformations indicates that attention to strategic human capital management issues should be at the center of such efforts. DHS has been given significant authority to design a new human capital system free from many of the government’s existing civil service requirements, and has issued final regulations for this new system. We have issued a series of reports on DHS’s efforts to design its human capital system. First, we found that the department’s efforts to design a new human capital system was collaborative and facilitated the participation of employees from all levels of the department, and generally reflected important elements of effective transformations. We recommended that the department maximize opportunities for employees’ involvement throughout the design process and that it place special emphasis on seeking the feedback and buy-in of front line employees in the field. Second, we found that DHS’s human capital management system, as described in the recently released final regulations, includes many principles that are consistent with proven approaches to strategic human capital management. For example, many elements for a modern compensation system—-such as occupational cluster, pay bands, and pay ranges that take into account factors such as labor market conditions—- are to be incorporated into DHS’s new system. However, these final regulations are intended to provide an outline and not a detailed, comprehensive presentation of how the new system will be implemented. Thus, DHS has considerable work ahead to define the details of the implementation of its system, and understanding these details is important to assessing the overall system. DHS faces significant financial management challenges. Specifically, it must address numerous internal control weaknesses, meet the mandates of the DHS Financial Accountability Act, and integrate and modernize its financial management systems, which individually have problems and collectively are not compatible with one another. Overcoming each of these challenges will assist DHS in strengthening its financial management environment, improving the quality of financial information available to manage the department day to day, and obtaining an unqualified opinion on its financial statements. DHS’s independent auditors were unable to issue an opinion on any of the department’s financial statements for fiscal year 2004. This was a substantial setback in DHS’s financial management progress, compounded by continued challenges in resolving its internal control weaknesses. The number of material internal control weaknesses at the department has increased from 7 as of September 30, 2003 to 10 as of September 30, 2004. With the passage of the Department of Homeland Security Financial Accountability Act (the Accountability Act), DHS is now subject to the Chief Financial Officers Act of 1990 (the CFO Act) and the Federal Financial Management Improvement Act of 1996 (FFMIA). The Accountability Act also requires that in fiscal year 2005 the Secretary of Homeland Security include an assertion on internal controls over financial reporting at the department, and in fiscal year 2006 requires an audit of internal controls over financial reporting. We will continue to monitor the steps DHS is taking to meet the requirements of the Accountability Act as part of our audit of the consolidated financial statements of the United States government. We reported in July 2004 that DHS continues to work to reduce the number of financial management service providers and to acquire and deploy an integrated financial enterprise solution. At that time, DHS reported that it had reduced the number of financial management service providers for the department from the 19 providers at the time DHS was formed to 10. DHS planned to consolidate to 7 providers. Additionally, DHS hired a contractor to deploy an integrated financial enterprise solution. This is a costly and time consuming project and we have found that similar projects have proven challenging for other federal agencies. We will therefore continue to monitor DHS’s progress on overcoming this serious challenge. DHS has recognized the need for a strategic management framework that addresses key information technology disciplines, and has made a significant effort to make improvements in each of these disciplines. For example, DHS is implementing its information technology (IT) investment management structure, developing an enterprise architecture, and has begun IT strategic human capital planning. However, much remains to be accomplished before it will have fully established a departmentwide IT management framework. To fully develop and institutionalize the management framework, DHS will need to strengthen strategic planning, develop the enterprise architecture, improve management of systems development and acquisition, and strengthen security. To assist DHS, we have made numerous recommendations, including (1) limiting information technology investments until the department’s strategic management framework is completed and available to effectively guide and constrain the billions of dollars that DHS is spending on such investments; (2) taking appropriate steps to correct any limitations in the Chief Information Officer’s ability to effectively support departmentwide missions; and (3) ensuring the department develops and implements a well-defined enterprise architecture to guide and constrain business transformation and supporting system modernization. The development of this framework is essential to ensuring the proper acquisition and management of key DHS programs such as U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT), Automated Commercial Environment, and Secure Flight. To this end, we have recently reported on key management challenges and weaknesses for each of the programs that an effective DHS-wide framework for managing systems investments would be instrumental in addressing. Our work has indicated that managing acquisitions is also a major management challenge for DHS. The department faces the challenge of structuring its acquisition organization so that its various procurement organizations are held accountable for complying with procurement policies and regulations and ensuring that taxpayer dollars are well-spent. In addition, the department has in place a number of large, complex, and high-cost acquisition programs, such as US-VISIT and the Coast Guard’s Deepwater program, which will need to be closely managed to ensure that they receive the appropriate level of oversight and that acquisition decisions are made based on the right level of information. For example, we reported in March 2004 that the Deepwater program needed to pay more attention to management and contractor oversight in order to avoid cost overruns. We have also reported on contract management problems at the former Immigration and Naturalization Service, now a part of DHS, and TSA. We will issue a report at the end of the this month that addresses (1) areas where DHS has been successful in promoting collaboration among its various organizations, (2) areas where DHS still faces challenges in integrating the acquisition function, and (3) the department’s progress in implementing an effective review process for its major, complex investments. DHS also faces management challenges in coordinating research and development (R&D). Our work has recently found that DHS has not yet completed a strategic plan to identify priorities, goals, objectives, and policies for the R&D of homeland security technologies and that additional challenges remain in its coordination with other federal agencies. Failure to complete a strategic plan and to fully coordinate its research efforts may limit DHS’s ability to leverage resources and could increase the potential for duplication of research. In addition, DHS faces challenges with regard to its use of DOE laboratories. These challenges include the development of a better working relationship through better communication and the development of clear, well-defined criteria for designating the DOE laboratories to receive the majority of DHS’s R&D funding. Moreover, DHS faces the challenge of balancing the immediate needs of the users of homeland security technologies with the need to conduct R&D on advanced technologies for the future. Similarly, conducting R&D on technologies for detecting, preventing, and mitigating terrorist threats is vital to enhancing the security of the nation’s transportation system. In our report on the Transportation Security Administration’s (TSA) and DHS’s transportation security R&D programs, we found that although TSA and DHS have made some efforts to coordinate R&D with each other and with other federal agencies, both their coordination with the Department of Transportation (DOT) and their outreach to the transportation industry have been limited. For example, officials from the modal administrations of DOT, which continue to conduct some transportation security R&D, said they had not provided any input into TSA’s and DHS’s transportation security R&D project selections. Consequently, DOT’s and the transportation industry’s security R&D needs may not be adequately reflected in TSA’s and DHS’s R&D portfolios. Therefore, we recommend that TSA and DHS (1) develop a process with DOT to coordinate transportation security R&D, such as a memorandum of agreement identifying roles and responsibilities and designating agency liaisons and (2) develop a vehicle to communicate with the transportation industry to ensure that its R&D security needs have been identified and considered. DHS generally concurred with our report and its recommendations. Given the dominant role that DHS plays in securing the homeland, it is critical that DHS be able to ensure that its management systems are operating as efficiently and effectively as possible. While it is understood that a transformation of this magnitude takes time and that DHS’s immediate focus has been on its homeland security mission, we see the need for DHS to increase its focus on management issues. This is important not only to DHS itself, but also to the nation’s homeland security efforts, because, in addition to managing its own organization, DHS plays a larger role in managing homeland security and in coordinating with the activities of other federal, state, local, and private stakeholders. This larger DHS role presents its own unique challenges. For example, DHS faces the challenge of clarifying the role of government versus the private sector. In April 2002, we testified that the appropriate roles and responsibilities within and between the levels of governments and with the private sector are evolving and need to be clarified. New threats are prompting a reassessment and shifting of long-standing roles and responsibilities. These shifts have been occurring on a piecemeal and ad hoc basis without the benefit of an overarching framework and criteria to guide the process. As another example, DHS faces a challenge in determining how federal resources are allocated to non-federal stakeholders. We have long advocated a risk management approach to guide the allocation of resources and investments for improving homeland security. Additionally, OMB has identified various tools, such as benefit-cost analysis, it considers useful in planning such as capital budgeting and regulatory decisionmaking. DHS must develop a commonly accepted framework and supporting tools to inform cost allocations in a risk management process. Although OMB asked the public in 2002 for suggestions on how to adjust standard tools to the homeland security setting, a vacuum currently exists in which benefits of homeland security investments are often not quantified and almost never valued in monetary terms. As a final example, DHS faces a challenge in sharing information among all stakeholders. DHS has initiatives underway to enhance information sharing (including the development of a homeland security enterprise architecture to integrate sharing between federal, state, and local authorities). However, our August 2003 report noted that these initiatives, while beneficial for the partners, presented challenges because they (1) were not well coordinated, (2) risked limiting participants’ access to information, and (3) potentially duplicated the efforts of some key agencies at each level of government. We also found that despite various legislation, strategies, and initiatives, federal agencies, states, and cities did not consider the information sharing process to be effective. A well-managed DHS will be needed to meet these larger homeland security challenges. As DHS continues to evolve, integrate its functions, and implement its programs, we will continue to review its progress and provide information to Congress for oversight purposes. Mr. Chairman, this concludes my prepared statement. I will now be pleased to respond to any questions that you or other members of the subcommittee have. For further information about this testimony, please contact Norman J. Rabkin at 202-512-8777. Other key contributors to this statement were Stephen L. Caldwell, Wayne A. Ekblad, Carole J. Cimitile, Ryan T. Coles, Tammy R. Conquest, Benjamin C. Crawford, Heather J. Dunahoo, Kimberly M. Gianopoulos, David B. Goldstein, Randolph C. Hite, Robert G. Homan, Casey L. Keplinger, Eileen R. Larence, Michele Mackin, Lisa R. Shames, and Sarah E. Veale. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The Department of Homeland Security (DHS) plays a key role in coordinating the nation's homeland security efforts with stakeholders in the federal, state, local, and private sectors. While GAO has conducted numerous reviews of specific DHS missions, such as border and transportation security and emergency preparedness, this testimony addresses overall DHS management issues. This testimony addresses (1) why GAO designated DHS's transformation as a high-risk area; and (2) the specific management challenges facing DHS. GAO designated DHS's transformation as a high-risk area in 2003, based on three factors. First, DHS faced enormous challenges in implementing an effective transformation process, developing partnerships, and building management capacity because it had to transform 22 agencies into one department. Second, DHS faced a broad array of operational and management challenges that it inherited from its component legacy agencies. Finally, DHS's failure to effectively address its management challenges and program risks could have serious consequences for our national security. Overall, DHS has made some progress, but significant management challenges remain to transform DHS into a more efficient organization while maintaining and improving its effectiveness in securing the homeland. Therefore, DHS's transformation remains a high-risk area. DHS faces a number of management challenges to improve its ability to carry out its homeland security missions. Among these challenges are providing focus for management efforts; monitoring transformation and integration; improving strategic planning; managing human capital; strengthening financial management infrastructure; establishing an information technology management framework; managing acquisitions; and coordinating research and development.