DHS Acquisition Management Directive 102-01 (MD 102) and an accompanying instruction manual establish the department’s policies and processes for managing major acquisition programs. While DHS has had an acquisition management policy in place since October 2004, the department issued the initial version of MD 102 in 2008.leaders in the department are responsible for acquisition management functions, including managing the resources needed to fund major programs. DHS’s Chief Acquisition Officer—currently the Under Secretary for Management (USM)—is responsible for the management and oversight of the department’s acquisition policies and procedures. The Acquisition Decision Authority is responsible for approving the movement of programs through the acquisition life cycle at key milestone events. The USM or Deputy Secretary serve as the decision authority for programs with life cycle cost estimates of $1 billion or greater, while the cognizant component acquisition executive may serve as the decision authority for a program with a lower cost estimate. The DHS Acquisition Review Board (ARB) supports the Acquisition Decision Authority by reviewing major acquisition programs for proper management, oversight, accountability, and alignment with the department’s strategic functions at the key acquisition milestones and other meetings as needed. The ARB is supported by the Office of Program Accountability and Risk Management (PARM), which reports to the USM and is responsible for DHS’s overall acquisition governance process. In March 2012, PARM issued its first Quarterly Program Accountability Report (QPAR), which provided an independent evaluation of major programs’ health and risks. Since that time, PARM has issued two additional QPARs, most recently in July 2013, and plans to issue a fourth by the end of September 2013. PARM also prepares the Comprehensive Acquisition Status Reports, which are to be submitted to the appropriations committees with the President’s budget proposal and updated quarterly. The Office of Program Analysis and Evaluation (PA&E), within the Office of the Chief Financial Officer, is responsible for advising the USM, among others, on resource allocation issues. PA&E also oversees the development of the Future Years Homeland Security Program (FYHSP). The FYHSP is DHS’s 5-year funding plan for programs approved by the Secretary that are to support the department’s strategic plan. DHS acquisition policy reflects many key program management practices intended to mitigate the risks of cost growth and schedule slips. However, we previously found that the department did not implement the policy consistently. Officials explained that DHS’s culture emphasized the need to rapidly execute missions more than sound acquisition management practices, and we found that senior leaders did not bring to bear the critical knowledge needed to accurately track program performance. Most notably, we found that most programs lacked approved acquisition program baselines, which are critical management tools that establish how systems will perform, when they will be delivered, and what they will cost. We also reported that most of the department’s major programs were at risk of cost growth and schedule slips as a result. In our past work examining DOD weapon acquisition issues and best practices for product development, we have found that leading commercial firms pursue an acquisition approach that is anchored in knowledge, whereby high levels of product knowledge are demonstrated by critical points in the acquisition process. While DOD’s major acquisitions have unique aspects, our large body of work in this area has established knowledge-based principles that can be applied to government agencies and can lead to more effective use of taxpayer dollars. A knowledge-based approach to capability development allows developers to be reasonably certain, at critical points in the acquisition life cycle, that their products are likely to meet established cost, schedule, and performance objectives. This knowledge provides them with information needed to make sound investment decisions. Over the past several years, our work has emphasized the importance of obtaining key knowledge at critical points in major system acquisitions and, based on this work, we have identified eight key practice areas for program management. These key practice areas are summarized in table 1, along with our assessment of DHS’s acquisition policy. As indicated in table 1, DHS acquisition policy establishes several key program-management practices through document requirements. MD 102 requires that major acquisition programs provide the ARB documents demonstrating the critical knowledge needed to support effective decision making before progressing through the acquisition life cycle. Figure 1 identifies acquisition documents that must be approved at the department level and their corresponding key practice areas. DHS acquisition policy has required these documents since November 2008, but in September 2012, we reported that the department generally had not implemented this policy as intended, and had not adhered to key program management practices. For example, we reported that DHS had only approved 4 of 66 major programs’ required documents in accordance with the policy. See figure 2. In September 2012, we reported that DHS leadership had, since 2008, formally reviewed 49 of the 71 major programs for which officials had responded to our survey. Of those 49 programs, DHS permitted 43 programs to proceed with acquisition activities without verifying the programs had developed the knowledge required under MD 102. Additionally, we reported that most of DHS’s major acquisition programs lacked approved acquisition program baselines, as required. These baselines are critical tools for managing acquisition programs, as they are the agreement between program-, component-, and department-level officials, establishing how systems will perform, when they will be Officials from half of the eight delivered, and what they will cost.components’ acquisition offices we spoke with, as well as PARM officials, noted that DHS’s culture had emphasized the need to rapidly execute missions more than sound acquisition management practices. PARM officials explained that, in certain instances, programs were not capable of documenting knowledge, while in others, PARM lacked the capacity to validate that the documented knowledge was adequate. As a result, we reported that senior leaders lacked the critical knowledge needed to accurately track program performance, and that most of the department’s major programs were at risk of cost growth and schedule slips. We also reported that DHS’s lack of reliable performance data not only hindered its internal acquisition management efforts, but also limited congressional oversight. We made five recommendations to the Secretary of Homeland Security at that time, identifying specific actions DHS should take to mitigate the risk of poor acquisition outcomes and strengthen the department’s investment management activities. DHS concurred with all five recommendations, and is taking steps to address them, most notably through policy updates. Since that time, we have continued to assess DHS’s acquisition management activities and the reliability of the department’s performance data. We currently have a review underway for this subcommittee assessing the extent to which DHS is executing effective executive oversight and governance (including the quality of the data used) of a major effort to modernize an information technology system, TECS. TECS is a major border enforcement system used for preventing terrorism, providing border security and law enforcement information about people who are inadmissible or may pose a threat to the security of the United States. We are (1) determining the status of the modernization effort, including what has been deployed and implemented to date, as well as the extent to which the modernization is meeting its cost and schedule commitments, including the quality of schedule estimates; and (2) assessing requirements management and risk management practices. We plan to issue our report in early November. According to DHS officials, its efforts to implement the department’s acquisition policy were complicated by the large number of programs initiated before the department was created, including 11 programs that PARM officials told us in 2012 had been fielded and were in the sustainment phase when MD 102 was signed.work, we found that, in May 2013, the USM waived the acquisition documentation requirements for 42 major acquisition programs that he identified as having been already fielded for operational use when MD 102 was issued in 2008. In a memo implementing the waiver, the USM explained that it would be cost prohibitive and inefficient to recreate documentation for previous acquisition phases. However, he stated that the programs will continue to be monitored, and that they must comply with MD 102 if any action is taken that materially impacts the scope of the current program, such as a major modernization or new acquisition. We plan to obtain more information on this decision and its effect on the department’s management of its major acquisitions. In September 2012, we reported that most of DHS’s major acquisition programs cost more than expected, took longer to deploy than planned, or delivered less capability than promised. We reported that these outcomes were largely the result of DHS’s lack of adherence to key knowledge-based program management practices. As part of our ongoing work, we analyzed a recent PARM assessment that suggests many of the department’s major acquisition programs are continuing to struggle. In its July 2013 quarterly program assessment, PARM reported that it had assessed 112 major acquisition programs. PARM reported that 37 percent of the programs experienced no cost variance at the end of fiscal year 2012, but it also reported that a large percentage of the programs were experiencing cost or schedule variances at that time. See table 2. However, as we reported in September 2012, DHS acquisition programs generally did not have the reliable cost estimates and realistic schedules needed to accurately assess program performance. We will continue to track DHS’s efforts to improve the quality of its program assessments moving forward. We have previously reported that cost growth and schedule slips at the individual program level complicated DHS’s efforts to manage its investment portfolio as a whole. When programs encountered setbacks, the department often redirected funding to troubled programs at the expense of others, which in turn were more likely to struggle. DHS’s Chief Financial Officer recently issued a memo stating that DHS faced a 30 percent gap between funding requirements for major acquisition programs and available resources. DHS has efforts underway to develop a more disciplined and strategic portfolio management approach, but the department has not yet developed key portfolio management policies and processes that could help the department address its affordability issues, and DHS’s primary portfolio management initiative may not be fully implemented for several years. In September 2012, we noted that DHS’s acquisition portfolio may not be affordable. That is, the department may have to pay more than expected for less capability than promised, and this could ultimately hinder DHS’s day-to-day operations.DHS’s Chief Financial Officer issued an internal memo in December 2012, shortly after our report was issued, stating that the aggregate 5- year funding requirements for major acquisitions would likely exceed available resources by approximately 30 percent. This acknowledgment was a positive step toward addressing the department’s challenges, in that it clearly identified the need to improve the affordability of the department’s major acquisition portfolio. Additionally, the Chief Financial Officer has required component senior financial officers to certify that they have reviewed and validated all current-, prior-, and future-year funding information presented in ARB materials, and ensure it is consistent with the FYHSP. Additionally, through our ongoing work, PA&E officials told us that the magnitude of the actual funding gap may be even greater than suggested because only a small portion of the cost estimates that informed the Chief Financial Officer’s analysis had been approved at the department level, and expected costs may increase as DHS improves the quality of the estimates. This is a concern we share. While holding components accountable is important, without validated and department- approved documents—such as acquisition program baselines and life cycle cost estimates—efforts to fully understand and address the department’s overall funding gap will be hindered. In September 2012, we reported that DHS largely made investment decisions on a program-by-program and component-by-component basis. DHS did not have a process to systematically prioritize its major investments to ensure that the department’s acquisition portfolio was consistent with anticipated resource constraints. In our work at DOD, we have found this approach hinders efforts to achieve a balanced mix of programs that are affordable and feasible and that provide the greatest return on investment. In our past work focused on improving weapon system acquisitions, we found that successful commercial companies use a disciplined and integrated approach to prioritize needs and allocate resources. As a result, they can avoid pursuing more projects than their resources can support, and better optimize the return on their investment. This approach, known as portfolio management, requires companies to view each of their investments as contributing to a collective whole, rather than as independent and unrelated. With an enterprise perspective, companies can effectively (1) identify and prioritize opportunities, and (2) allocate available resources to support the highest priority—or most promising—investment opportunities. Over the past several years, we have examined the practices that private and public sector entities use to achieve a balanced mix of new projects, and based on this work, we have identified key practice areas for portfolio management. One I would like to highlight today is that investments should be ranked and selected using a disciplined process to assess the costs, benefits, and risks of alternative products to ensure transparency and comparability across alternatives. In this regard, DHS established the Joint Requirements Council (JRC) in 2003, to identify crosscutting opportunities and common requirements among DHS components and help determine how DHS should use its resources. But the JRC stopped meeting in 2006 after the chair was assigned to other duties within the department. In 2008, we recommended that it be reinstated, or that DHS establish another joint requirements oversight board, and DHS officials recognized that strengthening the JRC was a top priority. Through our ongoing work, we have identified that DHS recently piloted a Capabilities and Requirements Council (CRC) to serve in a similar role as the JRC. The CRC began reviewing a portfolio of cyber capabilities in the summer of 2013. The pilot is intended to inform the department’s fiscal year 2015 budget request; therefore, it is too soon to assess the outcomes of this new oversight body. It is also unknown at this time how DHS will sustain the CRC over time or what its outcomes will be. In addition to private and public sector practices, which we discuss above, our prior work at DOD has identified an oversight body similar to the CRC’s expected function. The Joint Requirements Oversight Council (JROC) has a number of statutory responsibilities related to the identification, validation, and prioritization of joint military requirements. This body, which has been required by law since 1997, and its supporting organizations review requirements documents several times per year, prior to major defense acquisition programs’ key milestones. Through these reviews, proposed acquisition programs are scrutinized prior to their initiation and before decisions are made to begin production. The JROC also takes measures to help ensure the programs are affordable. In 2011, we reported that the JROC required the military services to show that their proposed programs were fully funded before it validated requirements for five of the seven proposed programs we reviewed. The two other proposed programs were funded at more than 97 and 99 percent, respectively. This full funding requirement is similar to the funding certification requirement DHS’s CFO established in December 2012. While some DOD acquisition programs continue to experience cost growth and schedule delays, as identified in our annual report on weapon systems acquisitions, the department does have in place mechanisms that DHS could adopt to improve the affordability of its acquisition portfolio, and put its acquisition programs in a better position to achieve successful outcomes. In September 2012, we reported that the CRC is one of several new councils and offices that DHS would establish as part of its Integrated Investment Life Cycle Model (IILCM), which is intended to improve portfolio management at DHS through the identification of priorities and capability gaps. This model, which the department proposed in January 2011, would provide a framework for information to flow between councils and offices responsible for strategic direction, requirements development, resource allocation, and program governance. DHS explained that the IILCM would ensure that mission needs drive investment decisions. While the IILCM, as envisioned, could improve DHS management decisions by better linking missions to acquisition outcomes, our ongoing work indicates that its full implementation may be several years away. From January 2011 to June 2012, the schedule for initiating IILCM operations slipped by a year, and in May 2013, a DHS official responsible for the IILCM told us he was unsure when the IILCM would be fully operational. We also found that some component acquisition officials are not aware of how the IILCM would apply to their own acquisition portfolios. Some of the officials we interviewed told us that DHS leadership needs to conduct more outreach and training about the IILCM and how it is expected to work, and a DHS headquarters official told us that the department is in the process of implementing an initial department-wide IILCM communications strategy. We will continue to assess the department’s progress in implementing what it views as a very important management model. Chairman Duncan, Ranking Member Barber, and Members of the Subcommittee, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time. If you or your staff have any questions about this testimony, please contact Michele Mackin at (202) 512-4841 or MackinM@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. GAO staff who made key contributions to this testimony include Katherine Trimble (Assistant Director), Nate Tranquilli, Steve Marchesani, Mara McMillen, and Sylvia Schatz. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: GAO has highlighted DHS acquisition management issues on its high-risk list, and over the past several years, GAO's work has identified significant shortcomings in the department's ability to manage an expanding portfolio of major acquisitions. It is important for DHS to address these shortcomings because the department invests extensively in acquisition programs to help it execute its many critical missions. DHS is acquiring systems to help secure the border, increase marine safety, enhance cyber security, and execute a wide variety of other operations. In 2011, DHS reported to Congress that it planned to ultimately invest $167 billion in its major acquisition programs. In fiscal year 2013 alone, DHS reported it was investing more than $9.6 billion. This statement discusses (1) DHS's acquisition policy and how it has been implemented; and (2) DHS's mechanisms for managing emerging affordability issues. The statement is based on GAO's prior work on DHS acquisition management and leading commercial companies' knowledge-based approach to managing their large investments. It also reflects observations from ongoing work for this subcommittee. For that work, GAO is reviewing key documentation, and interviewing headquarters and component level acquisition and financial management officials. GAO has previously established that the Department of Homeland Security's (DHS) acquisition policy reflects many sound program management practices intended to mitigate the risks of cost growth and schedule slips. The policy largely reflects the knowledge-based approach used by leading commercial firms, which do not pursue major investments without demonstrating, at critical milestones, that their products are likely to meet cost, schedule, and performance objectives. DHS policy requires that important acquisition documents be in place and approved before programs are executed. For example, one key document is an acquisition program baseline, which outlines a program's expected cost, schedule, and the capabilities to be delivered to the end user. However, in September 2012, GAO found that the department did not implement the policy consistently, and that only 4 of 66 programs had all of the required documents approved in accordance with DHS's policy. GAO made five recommendations, which DHS concurred with, identifying actions DHS should take to mitigate the risk of poor acquisition outcomes and strengthen management activities. Further, GAO reported that the lack of reliable performance data hindered DHS and congressional oversight of the department's major programs. Officials explained that DHS's culture had emphasized the need to rapidly execute missions more than sound acquisition management practices. GAO also reported that most of the department's major programs cost more than expected, took longer to deploy than planned, or delivered less capability than promised. DHS has taken steps to improve acquisition management, but as part of its ongoing work, GAO found that DHS recently waived documentation requirements for 42 programs fielded for operational use since 2008. DHS explained it would be cost prohibitive and inefficient to recreate documentation for previous acquisition phases. GAO plans to obtain more information on this decision and its effect on the management of DHS's major acquisitions. DHS's July 2013 status assessment indicated that, as of the end of fiscal year 2012, many major programs still face cost and schedule shortfalls. DHS expects to provide another update in the near future. In December 2012, DHS's Chief Financial Officer reported that the department faced a 30 percent gap between expected funding requirements for major acquisition programs and available resources. DHS has efforts underway to develop a more disciplined and strategic approach to managing its portfolio of major investments, but the department has not yet developed certain policies and processes that could help address its affordability issues. In September 2012, GAO reported that DHS largely made investment decisions on a program-by-program and component-by-component basis and did not have a process to systematically prioritize its major investments. In GAO's work at the Department of Defense, it has found this approach hinders efforts to achieve a balanced mix of programs that are affordable and feasible and that provide the greatest return on investment. DHS's proposed Integrated Investment Life Cycle Model (IILCM) is intended to improve portfolio management by ensuring mission needs drive investment decisions. For example, a high-level oversight body would identify potential trade-offs among DHS's component agencies. GAO has recommended such an oversight body for several years. Full implementation of the IILCM may be several years away. GAO will continue to assess the department's progress in its ongoing work. GAO is not making any new recommendations in this statement. It has made numerous recommendations in its prior work to strengthen acquisition management, and DHS is taking steps to address them.