DHS invests in a wide array of complex acquisitions to achieve its national security mission. DHS components and offices sponsor investments to address mission capability gaps and are the end-users of the developed acquisitions. DHS has stated that the Undersecretary for Management, as the Chief Acquisition Officer, is responsible for acquisition policy. The purpose of DHS’s investment review and budget processes are to provide oversight of these major investments. Specifically, DHS established the investment review process in 2003 to help protect its major investments by providing departmental oversight of major investments throughout their life cycles and to help ensure that funds allocated for investments through the budget process are being spent wisely, efficiently, and effectively. In 2005, we reported that this process adopted many acquisition best practices that, if applied consistently, could help increase the chances for successful outcomes. However, we noted that incorporating additional program reviews and knowledge deliverables into the process could better position DHS to make well-informed decisions. In 2007, we further reported that DHS had not fully defined and documented policies and procedures for investment management or fully implemented key practices needed to control its information technology (IT) investments. To strengthen DHS’s investment management capability, we recommended that the department fully define and document project and portfolio-level policies and procedures and implement key control processes. In addition to the investment review process, the DHS budget process serves as the framework for decision making for ongoing and future DHS programs. The framework is cyclic, consisting of planning, programming, budgeting, and execution phases that examine existing program funding and link the funding to program performance to ensure funds are expended appropriately and that they produce the expected results and benefits. The investment review process framework manages investment risk by developing an organized, comprehensive, and iterative approach to identifying; assessing; mitigating; and continuously tracking, controlling, and documenting risk tailored to each project. The investment review process has four main objectives: (1) identify investments that perform poorly, are behind schedule, are over budget, or that lack capability, so officials can identify and implement corrective actions; (2) integrate capital planning and investment control with resource allocation and investment management; (3) ensure that investment spending directly supports DHS’s mission and identify duplicative efforts for consolidation; and (4) ensure that DHS conducts required management, oversight, control, reporting, and review for all major investments. The process requires event-driven decision making by high-ranking executives at a number of key points in an investment’s life cycle. The investment review process provides guidance to components for all DHS investments, but it requires formal department-level review and approval only for major investments—those that are categorized as level 1 or 2 (see table 1). The investment review process has two types of reviews: programmatic and portfolio. Programmatic reviews are held at specific milestones and require documentation and discussion commensurate with the investment’s life cycle phase. These reviews contribute to the investment review goal of identifying investments that perform poorly, are behind schedule, are over budget, or that lack capability so officials can identify and implement corrective actions. Portfolio reviews are designed to identify efforts for consolidation and mission alignment by monitoring and assessing broad categories of investments that are linked by similar missions to ensure effective performance, minimization of overlapping functions, and proper funding. The IRB and JRC are responsible for reviewing, respectively, level 1 and level 2 investments at key milestone decision points, but no less than annually, and provide strategic guidance (see table 2). In addition to requiring department-level review, DHS policy directs component heads to conduct appropriate management and oversight of investments and establish processes to manage approved investments at the component level. The investment review process has three broad life cycle stages, covering five investment phases and four decision points or milestones (see fig. 1). In the preacquisition stage, gaps are to be identified and capabilities to address them defined. In the first phase of the acquisition stage—concept and technology development—requirements are to be established and alternatives explored. In the next phase—capability development and demonstration—prototypes are to be developed. In the final acquisition phase, the assets are produced and deployed. With the high dollar thresholds and inherent risk of level 1 and level 2 investments, IRB or JRC approval at milestone decision points is important to ensure that major investment performance parameters and documentation are satisfactorily demonstrated before the investment transitions to the next acquisition phase. IRB and JRC milestone reviews are not required once an investment reaches the sustainment phase. As designed, knowledge developed during each investment phase is to be captured in key documents and is to build throughout the investment life cycle. Performing the disciplined analysis required at each phase is critical to achieving successful outcomes. The main goals of the first investment phase, program initiation, are to determine gaps in capabilities and then describe the capabilities to fill the gap—this information is then captured in the mission needs statement. If the mission needs statement is approved, the investment then moves to the concept and technology development phase, which focuses both on setting requirements and important baselines for managing the investment throughout its life cycle. A key step in this phase is translating needs into specific operational requirements, which are captured in the operational requirements document. Operational requirements provide a bridge between the functional requirements of the mission needs statement and the detailed technical requirements that form the basis of the performance specifications, which will ultimately govern development of the system. Once the program has developed its operational requirements document, it then uses these requirements to inform the development of its acquisition program baseline, a critical document that addresses the program’s critical cost, schedule, and performance parameters and is expressed in measurable terms. See figure 2 for a description of the documents. The department’s budget policy has two main objectives: (1) articulate DHS goals and priorities, and (2) develop and implement a program structure and resource planning to accomplish DHS goals. DHS uses the process to determine investment priorities and allocate resources each year. The budget process emphasizes the importance of ensuring investments expend funds appropriately and that investment performance produces the expected benefits or results. IRB decisions and guidance regarding new investments are to be reflected to the extent possible in any iteration of the budget as appropriate. The Office of the Chief Financial Officer (CFO) manages the budget process. DHS has not effectively implemented or adhered to its investment review process due to a lack of involvement by senior officials as well as limited resources and monitoring; consequently, DHS has not identified and addressed cost, schedule, and performance problems in many major investments. Poor implementation largely rests on DHS’s inability to ensure that the IRB and JRC effectively carried out their oversight responsibilities. Of 48 major investments requiring department-level review, 45 were not reviewed in accordance with the department’s investment review policy, and 18 were not reviewed at all. In the absence of IRB and JRC meetings, investment decisions were reached outside of the required review process. Moreover, when IRB meetings were held, DHS did not consistently enforce decisions that were reached because the department did not track whether components and offices took the actions required by the IRB. In addition, 27 major investments have not developed or received DHS approval for basic acquisition documents required to guide and measure the performance of program activities—and the investment review process. Of those, over a third reported cost, schedule, or performance breaches in fiscal year 2007 and second quarter fiscal year 2008. According to DHS representatives, acquisition management practices are still new to many components, and we found 24 investments lacked certified program managers needed to develop basic acquisition documents. We found that two out of nine components do not have required component-level review processes to adequately manage their major investments. DHS has recognized these deficiencies and began efforts in 2007 to clarify and better adhere to the investment review process. Of DHS’s 48 major investments requiring department-level review between fiscal year 2004 and the second quarter of fiscal year 2008, only three had all milestone and annual reviews. Of the 39 level 1 investments requiring IRB review and approval to proceed to the next acquisition phase, as of March 2008, 18 have never been reviewed by the IRB—4 of which have already reached production and deployment. The remaining 21 level 1 investments received at least one milestone or annual review through the investment review process. None of the 9 level 2 investments had JRC review and approval. DHS policy provides that its major investments be reviewed no less than yearly. However, in fiscal year 2007, the most recent year for which data were available, only 7 of the 48 required annual reviews were conducted. As a result, DHS lacked the information needed to address cost, schedule, and performance deficiencies—a problem we identified with over one-third of DHS’s major investments between fiscal year 2007 and the second quarter of fiscal year 2008. In our prior work on the Department of Defense (DOD), we found that when such reviews are skipped or not fully implemented, programs build momentum and move toward product development with little if any early department-level assessment of the costs and feasibility. Committing to programs before they have this knowledge contributes to poor cost, schedule, and performance outcomes. DHS level 1 investments that were never reviewed through the IRB process include some of the department’s largest investments with important national security objectives. For example, the Federal Emergency Management Agency’s (FEMA) Consolidated Alert and Warning System, which has estimated life-cycle costs of $1.6 billion, includes programs to update the Emergency Alerting System and other closely related projects. In 2007, we reported that FEMA faces technical, training, and funding challenges to develop an integrated alert and warning system. Customs and Border Protection’s (CBP) Secure Freight Initiative, which has estimated life-cycle costs of $1.7 billion, is designed to test the feasibility of scanning 100 percent of U.S.-bound cargo containers with nonintrusive equipment and radiation detection equipment at foreign seaports. Earlier this year, we reported that the Secure Freight Initiative faces a number of challenges, including measuring performance outcomes, logistical feasibility of some aspects of the investment, and technological issues. While these two investments are still in the concept and technology development phase, other major investments that have not been reviewed are even further along in the investment life cycle—when problems become more costly to fix. For example, CBP’s Western Hemisphere Travel Initiative, with estimated life-cycle costs of $886 million, is in capability development and demonstration. The investment aims to improve technologies to identify fraudulent documentation at U.S. ports of entry. We recently reported that because key elements of planning for the investment’s management and execution remain uncertain, DHS faces challenges deploying technology, and staffing and training officers to use it. Reviews of the 9 level 2 investments—those with acquisition costs between $50 million and $100 million, or $100 million to $200 million for information technology—were similarly lacking. While the JRC met periodically between fiscal years 2004 and 2006, senior officials stated that it did not make approval decisions about any level 2 investments. As a result, investments such as the following—which are all now in the operations and support phase—were not reviewed and approved by the JRC: FEMA’s Total Asset Visibility, which has $91 million in estimated life-cycle costs, aims to improve emergency response logistics in the areas of transportation, warehousing, and distribution. Transportation and Security Administration’s (TSA) Hazardous Threat Assessment Program, which has $181 million in estimated life-cycle costs, was developed to perform a security threat assessment on applicants for licenses to transport hazardous materials. The National Protection and Programs Directorate’s National Security and Emergency Preparedness investment, which has $1.8 billion in estimated life-cycle costs, aims to provide specially designed telecommunications services to the national security and emergency preparedness communities in the event of a disaster if conventional communication services are ineffective. During 2006, the JRC stopped meeting altogether after the chair was assigned to other duties within the department. DHS representatives recognized that since the JRC stopped meeting in 2006, there has been no direction for requirements or oversight of level 2 investments at the department level and that strengthening the JRC is a top priority. In the meantime, oversight of level 2 investments has devolved to the components. Without the appropriate IRB and JRC milestone reviews, DHS loses the opportunity to identify and address cost, schedule, and performance problems and, thereby, minimize program risk. Fourteen of the investments that lacked appropriate review through IRB and JRC oversight experienced cost growth, schedule delays, and underperformance—some of which was substantial. At least 8 investments reported cost growth between fiscal year 2007 and the second quarter of fiscal year 2008 (see table 3). Other programs experienced schedule delays and underperformance. For example, CBP’s Automated Commercial Environment program reported a 20 percent performance shortfall in the first quarter of fiscal year 2008. Moreover, we reported in July 2008 that the Coast Guard’s Rescue 21 program changed its acquisition baseline or cost, schedule, and performance goals four times resulting in a total 182 percent cost growth and 5-year schedule slip. DHS has acknowledged that the IRB and JRC have not conducted oversight in accordance with DHS policy—largely because the process has depended on direct involvement and availability of high-level leadership as well as a lack of sufficient staff resources to organize the review meetings. According to DHS representatives, the Deputy Secretary was unavailable to commit to the time required to conduct reviews of all investments, so only some major investments were reviewed. Our prior work shows that this problem existed from the start. For example, in 2004, we reported that DHS was having difficulty bringing all of its information technology programs before the IRB in a timely manner. We reported in 2005 that key stakeholders, such as the Chief Procurement Officer, did not receive materials in time to conduct a thorough review and provide meaningful feedback prior to investment review meetings and recommended that DHS ensure that stakeholders, including CPO officials, have adequate time to review investment submissions and provide formal input to decision- making review boards. Moreover, in 2007, we reported that DHS investment boards did not conduct regular investment reviews and control activities were not performed consistently across projects. DHS Chief Procurement Office and Chief Financial Office representatives added that the process was not adequately staffed to conduct annual reviews of investments as required by the investment review policy. We have previously recommended that DHS provide adequate resources, including people, funding, and tools, for oversight of major investments. A 2007 DHS assessment of 37 major investments found that many investments are awaiting senior management review. For example, FEMA’s major investment, the flood map modernization program, requested a key investment review decision meeting in 2004 that was subsequently scheduled and cancelled in 2006. As a result, the program proceeded from development to operations and support without IRB review or approval. Because of these limitations, alternative approaches to obtaining decisions were adopted. Numerous officials reported that rather than going through the formal investment review process, in some cases DHS component officials began to seek approval directly from the Deputy Secretary. For example, in November 2006, the DHS Inspector General reported on the CBP’s Secure Border Initiative program, noting that the investment oversight processes were sidelined in the urgent pursuit of SBInet’s aggressive schedule and that the IRB and JRC processes were bypassed and key decisions about the scope of the program and the acquisition strategy were made without rigorous review and analysis or transparency. DHS officials indicated that some decisions were very informal, based on conversations with the Deputy Secretary and without input from other IRB members. In such cases, the investment review process was bypassed, including consideration of supporting reviews and recommendations. DHS CPO and CFO representatives said they did not always know whether a decision had been made through this informal process. DHS investment review policy requires programs to develop specific documentation that captures key knowledge needed to make informed investment decisions. This approach is similar to DOD’s, which requires adequate knowledge at critical milestones to reduce the risk associated with each phase of the investment’s life cycle and enable program managers to deliver timely, affordable, quality products. GAO’s work on commercial best practices for major acquisitions has demonstrated that this approach, if effectively implemented, can significantly improve program outcomes. Our prior work has found that inadequate attention to developing requirements results in requirements instability, which can ultimately cause cost escalation, schedule delays, and fewer end items. Many major DHS investments do not have basic acquisition information required by investment review policy to guide and measure the performance of program activities and the investment review process. In particular, mission needs statements, operational requirements documents, and acquisition program baselines establish capability gaps, requirements needed to address gaps, and cost, schedule, and performance parameters, respectively. As of March 2008, of the 57 level 1 and 2 investments, 34 were in a phase that required all three documents, but 27 did not have or only provided an unapproved draft of one or more of these documents (see appendix III for the investments lacking these approved documents). Of the 27 investments, we found that over a third reported cost, schedule, or performance breaches between fiscal year 2007 and second quarter fiscal year 2008. For example, the Infrastructure Transformation program, which did not have an approved operational requirements document or acquisition program baseline, reported being up to 19 percent behind schedule in 2007. In another instance, the Immigration and Customs Enforcement (ICE) Detention and removal modernization program, which also lacked an approved operational requirements document and acquisition program baseline, reported schedule slippage of about 20 percent. Without required development and review of key acquisition data, DHS cannot be sure that programs have mitigated risks to better ensure good outcomes. CPO representatives explained that department acquisition management practices are new to many DHS components. For most investments, CPO representatives said that program managers were not familiar with basic acquisition documents and investment oversight staff had to work with program managers to help them develop these documents prior to investment reviews. In addition, we found that in fiscal year 2007, 24 major investments did not have program managers certified by DHS as having the required knowledge and skills to oversee complex acquisition programs. Moreover, other factors such as pressure to get programs up and running, additional external requirements, and technological challenges also impact the ability to successfully manage acquisitions to support good acquisition outcomes. At the same time, some component officials said that they received insufficient and inconsistent guidance regarding what information should be included in key acquisition documents. This issue is long-standing. For example, we reported in 2005 that because of the small number of department oversight staff, only limited support was provided to programs to assist them in completing their submissions for oversight reviews. In addition, component officials told us that key acquisition documents are sometimes approved at the component level but are not reviewed and approved at the department level. For example, TSA officials indicated that documents needed for the Secure Flight and Passenger Screening Programs were approved by TSA and submitted to DHS for approval, but no action was taken to review and approve them. The investment reviews that have been conducted have not always provided the discipline needed to help ensure programs achieve cost, schedule, and performance goals—even when a review identified important deficiencies in an acquisition decision memorandum. DHS has not routinely followed up on whether specific actions required by acquisition decision memorandums to mitigate potential risks have been implemented. The IRB issued a 2004 acquisition decision memorandum approving the U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT)—a program that aims to facilitate travel and trade—to move into the capability development and demonstration phase although the IRB found the investment’s cost, schedule, and performance risk to be high. The memorandum stated that more clarity was needed on the program’s end- state capability, benefits related to life-cycle costs, and how it planned to transition to the operations and support phase. We reported that in 2006 DHS had yet to develop a comprehensive plan describing what the end- state capability would be, and how, when, and at what cost it would be delivered. In a 2006 decision memorandum, the IRB again instructed US- VISIT to address the end-state capability, by requiring a comprehensive affordable exit plan for airports, seaports, and landports. We subsequently reported that, as of October 2007, US-VISIT had yet to establish critical investment management processes, such as effective project planning, requirements management, and financial management, which are required to ensure that program capabilities and expected mission outcomes are delivered on time and within budget. In addition, DHS had not developed capability for the other half of US-VISIT, even though it had allocated about one-quarter of a billion dollars to this effort. In a May 2006 decision memorandum, the IRB directed the Cargo Advanced Automated Radiography System investment to develop within 6 months an acquisition program baseline, a concept of operations, and an operational requirements document. It also called for the investment to be reviewed annually. As of the second quarter of fiscal year 2008, a baseline and the concept of operations had been drafted, according to program officials. However, an operational requirements document had not been developed even though a $1.3 billion contract had been awarded for the investment. In addition, the Cargo Advanced Automated Radiography System investment had not yet received a follow-on review by the IRB. In another example, in a December 2006 decision memorandum, the IRB directed ICE’s major investment Automation and Modernization to update its acquisition program baseline, its cost-benefit analysis and its life-cycle cost analysis. Automation and Modernization has since updated its acquisition program baseline, but its cost analyses were last updated in 2005. Current and former CPO and CFO representatives noted that staffing has not been sufficient to review investments in a timely manner and conduct follow-up to ensure decisions are implemented. They indicated that support was needed to undertake a number of functions, including: designing the investment review process, collecting and reviewing investment documentation, preparing analyses to support investment decisions, and organizing review meetings, as well as conducting follow-up for major investments. According to DHS representatives, from 2004 to 2007 there were four full-time equivalent DHS employees plus support from four contractors to fulfill those responsibilities. Many acquisition decision memos provided specific deadlines for components to complete action items, but according to CPO and CFO representatives IRB action items were not tracked. Without follow-up, the IRB did not hold components and major investment program offices accountable for addressing oversight concerns. DHS’s investment review process requires that component heads establish processes and provide the requisite resources to manage approved investments adequately. Component heads are also responsible for approving all level 3 and level 4 investments and ensuring they comply with DHS investment review submission requirements. In the absence of sufficient review at the department level, well-designed component-level processes are particularly critical to ensuring that investments receive some level of oversight. For example, CBP and TSA officials reported that they relied on their component investment review processes to ensure some level of oversight when the department did not review their investments. However, for the nine components we reviewed, two did not have a process in place and others had processes that were either in development or not focused on the entire investment life cycle. For example, the Domestic Nuclear Detection Office and the National Protection and Programs Directorate did not have a formal investment review process, meaning that in the absence of an IRB or JRC review, their eight major investments received no formal review. While FEMA has a process to manage contract-related issues, its review process does not currently address the entire investment life cycle. According to CPO representatives, the department is working with components to ensure that components have a process in place to manage investments and to have them designate an acquisition officer who is accountable for major investments at the component level. DHS has acknowledged that the investment review process has not been fully implemented. In fact, the process has been under revision since 2005. DHS has begun to make improvements to the planning, execution, and performance of major investments as initial steps to clarify and better adhere to the investment review process. To gain an understanding and awareness of DHS’s major investments, in 2007 during the course of our review, the Undersecretary for Management undertook an assessment of 37 major investments conducted under the CPO’s direction. The assessment identified a range of systemic weaknesses in the implementation of its investment review process and in the process itself. The DHS assessment found many level 1 investments await leadership decisions; acquisition decision memos lack rigor; a lack of follow-up and enforcement of oversight decisions; inadequate technical support at the investment level; and unclear accountability for acquisitions at the component level. Many of the deficiencies identified are consistent with our findings. For example, the DHS assessment of Citizenship and Immigration Services (CIS) found that investments were either missing, or using draft or unsigned versions of key investment management documents, limiting DHS’s ability to measure the investments’ performance. In one case, DHS found that the Verification Information Systems investment is poorly defined. In another case, DHS reported that CIS’s investment Transformation was using draft and unsigned acquisition documents, including its mission needs statement, acquisition plan, and acquisition program baseline. In 2007, we reported that: CIS had not finalized its acquisition strategy for Transformation and cost estimates therefore remain uncertain, plans do not sufficiently discuss enterprise architecture alignment and expected project performance, and these gaps create risks that could undermine Transformation’s success as it begins to implement its plans. In addition, DHS found that CIS’s investment Customer Service Web Portal did not have key investment management documents and that the investment’s performance cannot be adequately assessed. Similarly, DHS found that CIS’s investment Integrated Document Production did not have performance measures or documentation that performance metrics have been implemented to measure program cost, schedule, and performance execution. To address the findings of its 2007 review, DHS is taking steps to reiterate the DHS investment review policy and establish a more disciplined and comprehensive investment review process. Beginning in February 2008, interim policies were issued by the Undersecretary for Management to improve management of major investments pending release of a new investment review management directive. Specifically, the Undersecretary for Management issued a memorandum in February 2008 on initiating efforts to improve the quality of acquisition program baselines for level 1 investments, and another in July 2008 on improving life-cycle cost estimating for major investments. To help address the backlog of investments awaiting review, the CPO has begun to review and issue acquisition decision memorandums for each level 1 program. As of August 2008, acquisition decision memorandums had been completed for three programs. The memorandums indicate documentation that must be completed, issues that must be addressed, and related completion dates before investment approval is given. The memorandums also identify any limits or restrictions on the program until those actions are completed. Further, the Undersecretary for Management signed an interim acquisition management directive in November 2008 to improve acquisition management and oversight pending results from a formal DHS executive review. DHS’s annual budget process for funding major investments has not been appropriately informed by the investment review process—largely because the IRB seldom conducts oversight reviews and when it has, the two processes have not been aligned to better ensure funding decisions fulfill mission needs. While DHS’s investment review framework integrates the two processes—an approach similarly prescribed by GAO and OMB capital planning principles—many major investments received funding without determining that mission needs and requirements were justified. In addition, two-thirds of DHS major investments did not have required life-cycle cost estimates, which are essential to making informed budget and capital planning decisions. At the same time, DHS has not conducted regular reviews of its investment portfolios—broad categories of investments—to ensure effective performance and minimize unintended duplication of effort for proposed and ongoing investments. In July 2008, more than one-quarter of DHS’s major investments were designated by OMB as poorly planned and by DHS as poorly performing. The DHS Undersecretary for Management has said that strengthening the links between investment review and budget decisions is a top priority. OMB and GAO capital planning principles underscore the importance of a disciplined decision making and requirements process as the basis to ensure that investments succeed with minimal risk and lowest life-cycle cost. This process should provide agency management with accurate information on acquisition and life-cycle costs, schedules, and performance of current and proposed capital assets. The OMB Capital Programming Guide also stresses the need for agencies to develop processes for making investment decisions that deliver the right amount of funds to the right projects. In addition, OMB and GAO guidance provide that an investment review policy should seek to use long-range planning and a disciplined, integrated budget process for portfolio management to achieve performance goals at the lowest life-cycle cost and least risk to the taxpayer and the government. Investment portfolios are integrated, agencywide collections of investments that are assessed and managed collectively based on common criteria. Managing investments as portfolios is a conscious, continuous, and proactive approach to allocating limited resources among an organization’s competing initiatives in light of the relative benefits expected from these investments. Our prior work at DOD has shown that fragmented decision-making processes do not allow for a portfolio management approach to make investment decisions that benefit the organization as a whole. The absence of an integrated approach can contribute to duplication in programs and equipment that does not operate effectively together. GAO best practices work also emphasizes that (1) a comprehensive assessment of agency needs should be conducted, (2) current capabilities and assets should be identified to determine if and where a gap may lie between current and needed capabilities, and (3) a decision about how best to meet the identified gap should be evaluated. The approved mission needs statement must support the need for a project before the project can proceed to the acquisition phase. OMB guidance states that in creating capital plans, agencies should identify a performance gap between the existing portfolio of agency assets and the mission need that is not filled by the agency’s asset portfolio. Moreover, best practices indicate that investment resources should match valid requirements before approval of investments. The DHS investment review process calls for IRB decisions and program guidance regarding new investments to be reflected to the extent possible in the budget. The DHS budget process consists of overlapping planning, programming, budgeting, and execution phases that examine existing program funding and link funding to program performance to ensure funds are expended appropriately and produce the expected results and benefits (see fig. 3). Annually, components submit resource allocation proposals for major investments to the CFO for review in March and, in turn, resource allocation decisions are provided to components in July. According to CFO representatives, information from investment oversight reviews would be useful to inform investment annual resource allocation decisions. CFO representatives explained that the CFO sought to align resource allocation decisions with the IRB approvals in 2006, but this was not possible because of the erratic investment review meeting schedule. As a result, a number of CFO and CPO representatives confirmed that funding decisions for major investments have not been contingent upon the outcomes of the investment review process. One of the primary functions of the IRB is to review and approve level 1 investments for formal entry into the annual budget process. However, we found that 18 of DHS’s 57 major investments did not have an approved mission needs statement—a document that formally acknowledges that the need is justified and supported. Specifically, the statement summarizes the investment requirement, the mission or missions that the investment is intended to support, the authority under which the investment was begun, and the funding source for the investment. As such, approval of the mission needs statement is required at the earliest stages of an investment. Lacking information on which major investments have validated mission needs, the CFO has allocated funds for major investments for which a capability gap has not been established. We reported in 2007 that DHS risked selecting investments that would not meet mission needs in the most cost-effective manner. The 18 investments that lacked an approved mission needs statement accounted for more than half a billion dollars in estimated fiscal year 2008 appropriations (see table 4). In addition, two thirds of major investment budget decisions were reached without a life-cycle cost estimate. A life-cycle cost estimate provides an exhaustive and structured accounting of all resources and associated cost elements required to develop, produce, deploy, and sustain a particular program. Life-cycle costing enhances decision making, especially in early planning and concept formulation of acquisition and can support budgetary decisions, key decision points, milestone reviews, and investment decisions. GAO and OMB guidance emphasize that reliable cost estimates are important for program approval and continued receipt of annual funding. DHS policy similarly provides that life-cycle cost estimates are essential to an effective budget process and form the basis for annual budget decisions. However, 39 of the 57 level 1 and level 2 major DHS investments we reviewed did not have a life-cycle cost estimate. Moreover, DHS’s 2007 assessment of 37 major investments also found investments without life-cycle cost estimates and noted poor cost estimating as a systemic issue. Without such estimates, DHS major investments are at risk of experiencing cost overruns, missed deadlines, and performance shortfalls. Cost increases often mean that the government cannot fund as many programs as intended. To begin to address this issue, the DHS Undersecretary for Management issued a memo in July 2008 initiating an effort to review and improve the credibility of life-cycle cost estimates for all level 1 investments prior to formal milestone approval. The JRC is responsible for managing the department’s level 1 and level 2 major investment portfolios and making portfolio-related recommendations to the IRB. Managing investments as portfolios is a continuous and proactive approach to allocating finite resources among an organization’s competing initiatives in light of the relative benefits expected from these investments. Taking a portfolio perspective allows an agency to determine how its collective investments can optimally address its strategic goals and objectives. As part of this responsibility, the JRC is expected to identify crosscutting opportunities and overlapping or common requirements and determine how best to ensure that DHS uses its finite resources wisely in those areas. Specifically, the JRC reviews investments to identify duplicative mission capabilities and to assess redundancies. While a certain amount of redundancy can be beneficial, our prior work has found that unintended duplication indicates the potential for inefficiency and waste. The Enterprise Architecture Board supports the JRC by overseeing the department’s enterprise architecture and performing technical reviews of level 1 and level 2 IT investments. In 2007, we reported that DHS did not have an explicit methodology and criteria for determining program alignment to the architecture. We further reported that DHS policies and procedures for portfolio management had yet to be defined, and as a result, control of the department’s investment portfolios was ad hoc. When it met regularly, the JRC played a key role in identifying several examples of overlapping investments, including passenger screening programs. Specifically, in March 2006, the JRC identified programs that had potential overlaps, including TSA’s Secure Flight, TSA’s Registered Traveler, and CBP’s Consolidated Registered Traveler programs, yet the programs lacked coordination and were struggling with interoperability and information sharing. Because the JRC stopped meeting soon thereafter, DHS may have missed opportunities to follow up on these cases or identify further cases of potential overlap. In 2007, we reported that while TSA and CBP had begun coordinating efforts, they had yet to align their passenger prescreening programs to identify potential overlaps and minimize duplication. We recommended that DHS take additional steps and make key policy and technical decisions that were necessary to more fully coordinate these programs. TSA and CBP have since worked with DHS to develop a strategy to align regulatory policies and coordinate efforts to facilitate consistency across their programs. In another case, we reported that CIS’s Transformation investment has been conducted in an ad hoc and decentralized manner, and, in certain instances, is duplicative with other IT investments. DHS’s 2007 assessment of 37 major investments also identified potential overlap and duplication of effort between investments. Overall the review found that limited communication and coordination across components led to overlapping DHS programs. For example, DHS found that the CIS Verification Information System had potential duplication of requirements implementation with National Protection and Program Directorate’s U.S. Computer Emergency Readiness Team investment. In another instance, DHS found the CIS Integrated Document Production investment had an unclear relationship to other DHS credentialing investments. OMB requires all agencies including DHS to submit program justification documents for major investments to inform both quantitative decisions about budgetary resources consistent with the administration’s program priorities, and qualitative assessments about whether the agency’s programming processes are consistent with OMB policy and guidance. To help ensure that investments of public resources are justified and that public resources are wisely invested, OMB began using a Management Watch List in the President’s fiscal year 2004 budget request as a means to oversee the justification for and planning of agencies’ information technology investments. This list was derived based on a detailed review of each investment’s Capital Asset Plan and Business Case. In addition, OMB has established criteria for agencies to use in designating high-risk projects that require special attention from oversight authorities and the highest levels of agency management. These projects are not necessarily at risk of failure, but may be on the list because of one or more of the following four reasons: The agency has not consistently demonstrated the ability to manage complex projects. The project has exceptionally high development, operating, or maintenance costs, either in absolute terms or as a percentage of the agency’s total portfolio. The project is being undertaken to correct recognized deficiencies in the adequate performance of an essential mission program or function of the agency, a component of the agency, or another organization. Delay or failure of the project would introduce for the first time unacceptable or inadequate performance or failure of an essential mission function of the agency, a component of the agency, or another organization. According to DHS officials, without input from investment oversight reviews, a limited budget review of program justification documents prior to OMB submittal can be the only oversight provided for some DHS major investments. CFO representatives told us that in the absence of investment review decisions, they rely on the best available information provided by program managers in order to determine if funding requests are reasonable. As a result, major investment programs can proceed regardless of whether the investment has received the appropriate IRB review or has required acquisition documents. We reported that as of July 2008, 15 DHS major investments are on both the OMB Management Watch List and list of high-risk projects with shortfalls, meaning that they are both poorly planned and poorly performing. According to DHS officials, the funding, programming, and budget execution process is not integrated into the requirements and acquisition oversight process and the DHS Undersecretary for Management has said that strengthening these processes is a top priority. The challenges DHS faces in implementing its investment review process are long-standing and have generally resulted in investment decisions that are inconsistent with established policy and oversight. Concurrent with this lack of oversight are acquisition programs worth billions of dollars with cost, schedule, and performance deficiencies. Weaknesses in some component management practices compound the problem leaving investments with little to no scrutiny or review. While the department’s process has been under revision since 2005, DHS has begun new efforts to clarify and better adhere to the investment review process. Without validating mission needs, requirements, and program baselines including costs, as well as identifying duplicative efforts and monitoring progress, DHS cannot appropriately manage investments and inform the budget process. Until DHS aligns oversight of major investments with annual budget decisions, the department is at risk of failing to invest in programs that maximize resources to address capability gaps and ultimately help meet critical mission needs. We recommend that the Secretary of Homeland Security direct the Undersecretary for Management to take the following five actions to better ensure the investment review process is fully implemented and adhered to: Establish a mechanism to identify and track on a regular basis new and ongoing major investments and ensure compliance with actions called for by investment oversight boards. Reinstate the JRC or establish another departmental joint requirements oversight board to review and approve acquisition requirements and assess potential duplication of effort. Ensure investment decisions are transparent and documented as required. Ensure that budget decisions are informed by the results of investment reviews including IRB approved acquisition information and life cycle cost estimates. Identify and align sufficient management resources to implement oversight reviews in a timely manner throughout the investment life cycle. To improve investment management, we recommend that the Secretary of Homeland Security direct component heads to take the following two actions: Ensure that components have established processes to manage major investments consistent with departmental policies. Establish a mechanism to ensure major investments comply with established component and departmental investment review policy standards. We provided a draft of this report to DHS for review and comment. In written comments, the department generally concurred with our findings and recommendations, citing actions taken and efforts under way to improve the investment review process. The department’s comments are reprinted in appendix II. DHS components also provided technical comments which we incorporated as appropriate and where supporting documentation was provided. In addition, several DHS components and offices reported additional progress since the time of our review to ensure their major investments comply with departmental policies. DHS is taking important steps to strengthen investment management and oversight. After being under revision since 2005, DHS issued a new interim management directive on November 7, 2008, that outlines a revised acquisition and investment review process. DHS also cited two new offices within the Chief Procurement Office that were established to provide better acquisition management and oversight; recently completed program reviews; and plans to revise training, standards, and certification processes for program managers. While many of these efforts are noted in our report, investment management and oversight has been an ongoing challenge since the department was established, and continued progress and successful implementation of these recent efforts will require sustained leadership and management attention. DHS stated that the new interim acquisition management directive will address many of our recommendations; however, our work has found that DHS has not fully implemented similar steps in the past. For example, in response to our first recommendation, to establish a mechanism to identify and track on a regular basis new and ongoing major investments and ensure compliance with actions called for by investment review board decisions, DHS’s new interim directive requires major programs to participate in an acquisition reporting process. While DHS is in the process of implementing a Next Generation Periodic Reporting System, it is too soon to tell whether this system will be successfully implemented. DHS’s first-generation periodic reporting system was never fully implemented, making it difficult for the department to track and enforce investment decisions. In response to our second recommendation, to reinstate the JRC or establish another departmental joint requirements oversight board to review and approve acquisition requirements and assess potential duplication of effort, DHS stated it has already developed a new Strategic Requirements Review process to assess capability needs and gaps; completed pilots; and briefed senior leadership. According to DHS’s new interim acquisition management directive, the results of this process are to be validated by the JRC, which is still in the process of being established and for which no timeline was provided. Further, as we found in this report, when the JRC was previously established in 2004, it was never fully implemented due to a lack of senior management officials’ involvement. In response to our third recommendation, that DHS ensure investment decisions are transparent and documented as required, DHS stated that its new interim acquisition management directive already implements this by requiring acquisition documentation for each acquisition decision event and capturing decisions and actions in acquisition decision memorandums. DHS also reported that it has conducted eight Acquisition Review Board meetings with documented Acquisition Decision Memorandums. While this progress is notable, our work has found that since 2004, DHS’s investment review board has not been able to effectively carry out its oversight responsibilities and keep pace with investments requiring review due to a lack of senior officials’ involvement as well as limited monitoring and resources. It is too soon to tell whether DHS’s latest efforts will be sustained to ensure investments are consistently reviewed as needed. Regarding our fourth recommendation, that the department ensure budget decisions are informed by the results of investment reviews, the new interim management directive creates a link between the budget and requirements processes and describes interfaces with other investment processes. While this process is more clearly established in the new directive, its implementation will be evidenced in the documents produced during upcoming budget cycles. We found in this report that the previous investment review process also highlighted links to the budget and other investment processes, yet the results of oversight reviews did not consistently inform budget decisions. In response to our fifth recommendation, to identify and align sufficient management resources to implement oversight reviews in a timely manner throughout the investment life cycle, DHS stated that it has partially implemented the recommendation by establishing a senior executive–led Acquisition Program Management Division within the Office of the CPO and plans to increase staffing from its current level of 12 experienced acquisition and program management specialists to 58 by the end of fiscal year 2010. Creating a new division to manage oversight reviews is a positive step; however, we have found that DHS has been challenged to provide sufficient resources to support its acquisition oversight function and the CPO’s office has had difficulty filling vacancies in the past. Regarding our two recommendations to improve investment management at the component level, DHS noted that the new interim management directive requires components to align their internal policies and procedures by the end of the third quarter of fiscal year (June) 2009. In addition, DHS plans to issue another management directive which will instruct component heads to create component acquisition executives in their organizations to be responsible for the implementation of management and oversight of component acquisition processes. If fully implemented, these steps should help to ensure that components have established processes to manage major investments. DHS further noted that establishment of the Acquisition Program Management Division, the new interim acquisition management directive, reestablishment of the acquisition review process, and other steps work together to ensure major investments comply with established component and departmental investment review policy standards. To implement this recommendation, the new component acquisition executives will need to be in place and successfully implement and ensure compliance with the new processes. DHS will continue to face ongoing challenges to implementing an effective investment review process identified in this report and highlighted in the department’s Integrated Strategy for High Risk Management. For example, consistent with our findings, the strategy cites challenges to ensuring availability of leadership to conduct investment reviews; timely collection and assessment of program data; and sufficient staff to support the investment review process. Sustained leadership focus will be even more critical to implement changes and maintain progress on acquisition management challenges as the department undergoes its first executive branch transition in 2009. As agreed with your offices, unless you publicly announce the contents of this report, we plan no further distribution for 30 days from the report date. At that time, we will send copies of this report to interested congressional committees and the Secretary of Homeland Security. We will also make copies available to others upon request. In addition, the report will be available at no charge on GAO’s Web site at http://www.gao.gov. If you or your staff have questions regarding this report, please contact me at (202) 512-4841 or huttonj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Principal contributors to this report were Amelia Shachoy, Assistant Director; William Russell; Laura Holliday; Nicole Harkin; Patrick Peterson; Karen Sloan; Marie Ahearn; and Kenneth Patton. Our objectives were to: (1) evaluate DHS’s implementation of the investment review process, and (2) assess DHS’s integration of the investment review and budget processes to ensure major investments fulfill mission needs. To assess how the investment review process has been implemented, we reviewed the DHS Investment Review Process management directive and corresponding handbook to determine which major investments required DHS review. In doing so, we focused on determining such key factors as how frequently major investments required oversight reviews and what documents such as mission need statements and acquisition program baselines are required to be approved by DHS executive review boards. We included in our analyses 57 level 1 and level 2 investments that DHS identified for fiscal year 2008. We determined the level of oversight provided to 48 of these major investments—those that required department-level review from fiscal year 2004 through the second quarter of fiscal year 2008. We also interviewed representatives of the Chief Procurement Office (CPO), Chief Financial Office (CFO), and Chief Information Office as well as nine DHS components and offices that manage major investments. We then collected investment review and program documents for each major investment and compared the information to investment review policy requirements. We also reviewed acquisition decision memorandums from fiscal year 2004 through the second quarter of fiscal year 2008. Based on the decision memos and investment information, we determined how many investments had been reviewed in accordance with DHS policy from fiscal year 2004 through the second quarter of fiscal year 2008. We also reviewed prior GAO reports on DHS programs as well as commercial best practices for acquisition. We reviewed DHS documents such as interim policy memos and guidance and interviewed CPO staff regarding planned revisions to the investment review process. We also compared our findings with a 2007 DHS internal assessment of 37 major investments. In addition, we reviewed available DHS periodic reports on major investments as well as component operational status reports to identify instances of cost growth, schedule slips, and performance shortfalls for major investments and to determine the status of program manager certification in fiscal year 2007 through the second quarter of fiscal year 2008. This information is self-reported by DHS major program offices and all programs did not always provide complete information, and we did not independently verify information in these reports. To assess the integration of investment review and the budget process, we reviewed DHS management directives for the investment review and the planning, programming, budgeting, and execution process as well as corresponding guidance. We also interviewed representatives from the Chief Procurement Office and Chief Financial Office to discuss how the processes have been integrated since 2004. We used investment data and acquisition documents from each major investment program to determine which had required life-cycle cost estimates and other documents such as a validated mission need statements. We also reviewed fiscal year 2009 DHS budget justification submissions to OMB. We compared DHS budget practices with GAO and Office of Management and Budget (OMB) guidance on capital programming principles. In addition, we reviewed relevant GAO reports. We conducted this performance audit from September 2007 until November 2008 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Mission needs statements, operational requirements documents, and acquisition program baselines establish capability gaps, requirements needed to address those gaps, and cost, schedule, and performance parameters, respectively. Of the 57 DHS level 1 and 2 investments, 34 were in an acquisition phase that required all three documents; 27 either did not develop the document or only provided an unapproved draft of one or more of these documents (see table 5). Some major investment programs provided acquisition program baselines approved at the component level that were submitted but did not receive department review and approval. Appendix IV: Department of Homeland Security Investments Reviewed by GAO Provides fusion and visualization of information to create timely and accurate situational awareness reports for the Secretary of Homeland Security, the White House, and other users to detect, deter, and prevent terrorist activities Homeland Security Information System Facilitates information sharing and collaboration across DHS and its partners; enables real- time sharing of threat information for tactical first-responder support; and supports decision making in a real time secure environment. Designed to support processing of applications and petitions, capture fees and provide funds control, provide case status and support, and record the results of the adjudication of each application and petition. Established to provide: naturalization processing, interface with associated databases, improved accuracy, and more timely and accurate information to the public. Provides resources for all web development and maintenance activities. Includes web content management, development of web based transactions with Citizenship and Immigration Services customers and staff, web site maintenance, and web site hosting. Provides integrated card production system printers’ hardware and software, operational contract support, and facilities required to print secure cards granting immigration privileges or benefits to applicants. A system to allow all new immigration benefits applications and petitions to be filed electronically through a Citizenship and Immigration Services Internet web-based portal. Citizenship and Immigration Services will have a more comprehensive view of the customer and any potentially fraudulent transactions; improved audit functionality and record management; better resource management; and increased sharing of information within DHS and with other agency partners such as Justice and State. Supports the Systematic Alien Verification for Entitlements Program by providing automated status-verification information to federal, state, and local benefit-granting and entitlement agencies, and the E-Verify program by allowing participating employers to verify their new employees are authorized to work in the United States. Aims to replace and modernize most of the Coast Guard’s fleet of offshore cutters, boats, aircraft, and command and control systems over 25 years. Supports incident response, contingency planning, violation reporting and processing, vessel casualty investigation and analysis, vessel documentation, user fee collection, analysis of mission performance, monitoring of program effectiveness. Will implement a nationwide system for tracking and exchanging information with identification system equipped vessels operating in or approaching U.S. waters to improve homeland security and enhance Coast Guard and DHS operational mission performance. Command, control and communication system that improves mission execution in coastal zones. Essential to meet Search and Rescue program goals. Results in improved response to distress calls and better coordination and interoperability with other government agencies and first responders. Intended to replace the aging 41-foot utility boats and other large non-standard boats with assets more capable of meeting all of the Coast Guard multi-mission operational requirements. A collection of systems or applications used to provide vessel logistics information management capacity to the Coast Guard. Customs and Border Protection (CBP) Automated Commercial Environment Web-based import and export system that consolidates seven systems into one portal. It will provide advanced technology and information to decide, before a shipment reaches U.S. borders, what cargo should be targeted, and what cargo should be expedited. Intranet-based enforcement and decision support tool that is the cornerstone for all CBP targeting efforts. CBP uses the system to improve the collection, use, analysis, and dissemination of information to target, identify, and prevent potential terrorists and terrorist weapons from entering the United States and identify other violations and violators of U.S. law. Will build additional facilities to meet the needs of CBP’s expansion of its Border Patrol agent staffing. The recent addition of more agents and technology into enforcement activities has exceeded existing facility capacity. Framework used by trusted traveler programs for registering enrollees and performing identification and validation using automated systems. Technologies support the interdiction of weapons of mass destruction and effect, contraband, and illegal aliens being smuggled across the United States border, while having a minimal impact on the flow of legitimate commerce. Aims to integrate technology and tactical infrastructure into a comprehensive border security suite. This system will improve agent ability to respond to illegal activity and help DHS manage, control, and secure the border. Phase I will deploy next-generation technology and integrated systems to scan maritime containers for radiation or other special nuclear material. Will help develop an integrated and coordinated air and marine force to detect, interdict and prevent acts of terrorism arising from unlawful movement of people, illegal drugs and other contraband toward or across the borders of the United States. The goal is to modernize and standardize the existing CBP air and marine fleets and will require a specific number of primary and secondary air and marine locations and additional personnel to meet growing needs. Consolidated business case between CBP and ICE that will modernize: subject record “watch list” processing, inspection support at ports of entry, as well as case management. Western Hemisphere Travel Initiative Will fulfill the regulatory requirement to develop and implement a system to verify that U.S. and non-U.S. citizens present an authorized travel document denoting identity and citizenship when entering the United States. Provides a state-of-the-art, flexible, secure through security certification and accreditation, classified, collateral, integrated, and centrally managed enterprise wide-area network. Includes the consolidated DHS IT infrastructure environments which support the cross- organizational missions of protecting the homeland from a myriad of threats. These IT infrastructure investments are critical to providing a foundation in which information can be disseminated and shared across all DHS components, including external customers and intelligence partners, in a secure, cost effective, and efficient manner. Aims to achieve compliant financial management services and optimize financial management operations across the diverse systems cobbled together in 2003 when DHS was created from 22 agencies and over 200,000 people. Aims to improve and consolidate DHS’s vast array of payroll and personnel systems. It will provide DHS with a common flexible suite of human resource business systems. Its systems will develop, procure, and deploy current and next generation passive cargo portal units at the nation’s borders. Will deliver an advanced imaging system that will automatically detect high density material, detecting shielding that could be used to hide special nuclear material and highly enriched uranium or weapons grade plutonium. The system aims to improve throughput rates providing more effective scanning of a higher portion of cargo at the nation’s ports of entry. An integrated system to collect, analyze and distribute status, alarms, alert, and spectral data from all radiation portal monitors and equipment deployed at the Federal, State, Local, Tribal and international levels. Federal Emergency Management Agency (FEMA) Consolidated Alert & Warning System Provides the president, governors, mayors, tribal leadership with the ability to speak to the American people in the event of a national emergency by providing an integrated, survivable, all-hazards public alert and warning system that leverages all available technologies and transmission paths. It will also provide "situation awareness" to the public and leadership at multiple levels of government in an emergency. Provides information exchange delivery mechanisms through a portal for disaster information, an information exchange backbone, and data interoperability standards. Established a technology-based, cost effective process for updating, validating, and distributing flood risk data and digitalized flood maps throughout the Nation. Provides inspection staff and logistics at a moment’s notice to any Presidentially declared disaster. The state of readiness is 24 hours a day, 7 days a week, 365 days a year. Provides FEMA, emergency support function partners, and state decision makers with visibility of disaster relief assets and shipments to help ensure that the right assets are delivered in the right quantities to the right locations at the right time. Immigration and Customs Enforcement (ICE) Aims to satisfy three fundamental requirements: 1) house a growing population of illegal aliens, 2) provide appropriate conditions of confinement and 3) maintain its facility infrastructure. These requirements must be met through a series of design and build actions that begin with establishing facility infrastructure, continue with establishing detention capacity and culminate in building secure housing facilities. IT modernization and automation initiative that serves as the principal ICE program to: enhance ICE’s technology foundation, maximize workforce productivity, secure the IT environment, and improve information sharing across ICE and DHS. Detention and Removal Modernization Will provide operations management and field personnel the technical tools necessary to apprehend, detain, and remove illegal aliens in a cost-effective manner. Web-based system that manages data on schools, program sponsors, foreign students, exchange visitors, and their dependents during their approved participation in the U.S. education system so that only legitimate visitors enter the US. Survivable network connecting DHS with sectors that restore the infrastructure: electricity, IT and communications; states' homeland security advisors; and sector-specific agencies and resources for each critical infrastructure sector. Collects, catalogs and maintains standardized and quantifiable, risk-related infrastructure information to enable the execution of national risk management and for prioritizing the data for use by DHS partners. Aims to provide specially designed telecommunications services to the national security and emergency preparedness user community during natural or man-made disasters when conventional communications services are ineffective. These telecommunication services are used to coordinate response and recovery efforts and, if needed, to assist with facilitating the reconstitution of the government. Combines the capabilities of four existing investments to form a fully integrated IT system that will help fulfill the organization’s mission to collect, analyze, and respond to cyber security threats and vulnerabilities pursuant to its mission and authorities. Program is to collect, maintain, and share information, including biometric identifiers, on foreign nationals to determine whether an individual (1) should be prohibited from entering the United States; (2) can receive, extend, change, or adjust immigration status; (3) has overstayed or otherwise violated the terms of admission; (4) should be apprehended or detained for law enforcement action; or (5) needs special protection/attention (e.g., refugees). The vision of the US-VISIT Program is to deploy end-to-end management of data on foreign nationals covering their interactions with U.S. immigration and border management officials before they enter, when they enter, while they are in the U. S., and when they exit. Information Technology investment with a mission of providing early detection and characterization of a biological attack on the United States. National Bio and Agro-Defense Facility Infrastructure investment to support the Science and Technology Chemical and Biological Division program, which provides the technologies and systems needed to anticipate, deter, detect, mitigate, and recover from possible biological attacks on this nation’s population, agriculture or infrastructure. The program operates laboratories and biological detection systems and conducts research. Infrastructure investment to support the Science and Technology Chemical and Biological Division program, a key component in implementing the Presidents National Strategy for Homeland Security by addressing the need for substantial research into relevant biological and medical sciences to better detect, and mitigate the consequences of biological attacks and to conduct risk assessments. The program operates laboratories and biological detection systems and conducts research. Transportation Security Administration (TSA) Implements a national checked-baggage screening system to protect against criminal and terrorist threats, while minimizing transportation industry and traveling public burdens. An airborne communication system of systems (air-to-ground, ground-to-air, air-to-air and intra-cabin) that will give Air Marshall and other Law Enforcement Officers access to wireless communications and the ability to share information while in flight. System to manage the schedules of federal air marshals given the flights available (~25,000 per day) and the complexities of last minute changes due to flight cancellations. Hazmat Threat Assessment Program Leverages existing intelligence data to perform threat assessments on commercial truck drivers who transport hazardous materials to determine threat status to transportation security. Provides the resources required to deploy and maintain passenger screening and carry-on baggage screening equipment and processes at approximately 451 airports nationwide in order to minimize the risk of injury or death of people or damage of property due to hostile acts of terrorism. Will strengthen the security of the nation’s transportation systems by creating, implementing, and operating a threat-based watch list matching capability for approximately 250 million domestic air carrier passengers per year. Will improve security by establishing a system-wide common secure biometric credential, used by all transportation modes, for personnel requiring unescorted physical and/or logical access to secure areas of the trans system. Provides common environment for hosting applications; integrated data infrastructure; content; and a collection of shared services.

Summary: In fiscal year 2007, the Department of Homeland Security (DHS) obligated about $12 billion for acquisitions to support homeland security missions. DHS's major investments include Coast Guard ships and aircraft; border surveillance and screening equipment; nuclear detection equipment; and systems to track finances and human resources. In part to provide insight into the cost, schedule, and performance of these acquisitions, DHS established an investment review process in 2003. However, concerns have been raised about how well the process has been implemented--particularly for large investments. GAO was asked to (1) evaluate DHS's implementation of the investment review process, and (2) assess DHS's integration of the investment review and budget processes to ensure major investments fulfill mission needs. GAO reviewed relevant documents, including those for 57 DHS major investments (investments with a value of at least $50 million)--48 of which required department-level review through the second quarter of fiscal year 2008; and interviewed DHS headquarters and component officials. While DHS's investment review process calls for executive decision making at key points in an investment's life cycle--including program authorization--the process has not provided the oversight needed to identify and address cost, schedule, and performance problems in its major investments. Poor implementation of the process is evidenced by the number of investments that did not adhere to the department's investment review policy--of DHS's 48 major investments requiring milestone and annual reviews, 45 were not assessed in accordance with this policy. At least 14 of these investments have reported cost growth, schedule slips, or performance shortfalls. Poor implementation is largely the result of DHS's failure to ensure that its Investment Review Board (IRB) and Joint Requirements Council (JRC)--the department's major acquisition decision-making bodies--effectively carried out their oversight responsibilities and had the resources to do so. Regardless, when oversight boards met, DHS could not enforce IRB and JRC decisions because it did not track whether components took actions called for in these decisions. In addition, many major investments lacked basic acquisition documents necessary to inform the investment review process, such as program baselines, and two out of nine components--which manage a total of 8 major investments--do not have required component-level processes in place. DHS has begun several efforts to address these shortcomings, including issuing an interim directive, to improve the investment review process. The investment review framework also integrates the budget process; however, budget decisions have been made in the absence of required oversight reviews and, as a result, DHS cannot ensure that annual funding decisions for its major investments make the best use of resources and address mission needs. GAO found almost a third of DHS's major investments received funding without having validated mission needs and requirements--which confirm a need is justified--and two-thirds did not have required life- cycle cost estimates. At the same time, DHS has not conducted regular reviews of its investment portfolios--broad categories of investments that are linked by similar missions--to ensure effective performance and minimize unintended duplication of effort for investments. Without validated requirements, life-cycle cost estimates, and regular portfolio reviews, DHS cannot ensure that its investment decisions are appropriate and will ultimately address capability gaps. In July 2008, 15 of the 57 DHS major investments reviewed by GAO were designated by the Office of Management and Budget as poorly planned and by DHS as poorly performing.