Figure 1 provides an overview of CBP organizational components that had prime contractor invoice review, approval, and payment responsibilities under the original SBInet program. CBP’s Contracting Division, which is part of the Office of Administration Procurement Directorate’s Enterprise Contracting Office, was assigned SBInet program prime contractor management and administrative responsibilities, including receiving and approving or rejecting invoices. The Office of Technology Innovation and Acquisition within CBP was assigned responsibility for managing key program and contractor oversight acquisition functions associated with SBInet, such as verifying and accepting contract deliverables. This office was also to work closely with CBP’s SBI Contracting Division. Contracting officers (CO) and contracting officer’s technical representatives (COTR) in the SBI Contracting Division were assigned responsibility for reviewing invoices and maintaining contract files. The SBI Business Operations Division was responsible for providing CO-approved invoices to CBP’s National Finance Center (NFC) for processing contractor invoices for payment. In carrying out its assigned prime contractor invoice-related responsibilities under the original SBInet program, CBP relied on the FAR, HSAR, as well as DHS, CBP, and SBI program policies and procedures. The overarching policy for federal contracting is the FAR. DHS issued a supplemental regulation, HSAR, an acquisition manual for DHS contracting and, in October 2008, CBP’s SBI Contracting Division issued standard operating procedures (SOP) setting out required review, approval, and processing steps for all SBI prime contractor invoice processing. Figure 2 provides an overview of CBP’s process for reviewing, approving, and paying prime contractor invoices under the original SBInet program. CBP’s process for reviewing, approving, and paying prime contractor invoices under the original SBInet program relies on both preventative and detective controls. Generally, preventative controls are more efficient and effective than detective controls. CBP’s detective controls began with SBInet’s prime contractor submitting an invoice to the SBI Contracting Division’s CO, COTR, and CBP’s NFC for review. After reviewing the invoice, the COTR was responsible for recommending whether the CO should approve or reject the invoice. If the CO and COTR approved an invoice, the CO was to notify the SBI Business Operations Division within the Program Management Office to check for fund availability. If funds were available, CBP’s NFC was to be notified to process the invoice for payment. Further, while not required, CBP’s COs may request the Defense Contract Audit Agency (DCAA), a defense agency within the U.S. Department of Defense, to conduct an invoice review or rate verification for any invoice. In addition, CBP officials told us that the CO will always request DCAA to conduct a closeout audit (a detective control) for any task order, although this is not required. DHS’s Office of Procurement provides that the CO submit a memorandum to request a final audit for the entire IDIQ contract, or any of it delivery order, or task order components. Under the original SBInet program, CBP took actions intended to establish internal controls over contractor payments. CBP established SOPs setting out required contractor invoice review, approval, and processing steps for CBP’s COs and COTRs to follow. These procedures were based on requirements in the FAR. We identified the need to improve CBP’s controls in two important areas. Specifically, we identified the need to improve CBP’s preventative controls over payments to the SBInet program contractor with respect to requiring invoices with sufficiently detailed data supporting billed costs to facilitate effective invoice review and specific, sufficiently detailed, risk-based invoice review procedures to enable full, effective, and documented reviews prior to making payments. Because CBP’s preventative controls were not fully effective, the agency will continue to (1) be impaired in its ability to provide assurance that the estimated $780 million already paid the prime contractor under the original SBInet program was proper and allowable, in the correct amount, and only for goods and services provided and (2) rely heavily on detective controls (primarily contract closeout audits) for assurance concerning the propriety of SBInet program disbursements. Further, until CBP takes action to improve its preventative controls, it will continue to be impaired in its ability to effectively review the estimated $80 million obligated, but yet to be disbursed, to the prime contractor under the original SBInet program. In addition, our findings have implications as possible “lessons learned” for DHS to consider and address as appropriate in designing and implementing contract payment controls for its new technology portfolio approach. Standards for Internal Control in the Federal Government and related guidance provide that an entity’s internal controls should enable it to verify that ordered (invoiced) goods and services were proper and met the government’s specifications. CBP’s policies and related SOPs applicable to the original SBInet program required the prime contractor to submit invoices showing total costs incurred by cost element (i.e., direct labor, direct materials, major subcontracts, other direct costs, overtime premium, overhead, travel, and general and administrative expenses). However, CBP’s policies and procedures did not require the invoices to include any additional supporting detail. Not requiring such detail not only precluded us from testing whether invoiced costs complied with the SBInet contract and were properly supported, but, more important, resulted in numerous instances in which CBP’s COs and COTRs did not have the detailed support they needed to effectively review the SBInet contractors’ invoices. For example, in one instance a CO requested additional detailed information such as travel dates and travel destinations to review the reasonableness of a lump sum invoiced cost amount for travel. Figure 3 shows an example of a SBInet prime contractor invoice submitted and paid for costs incurred for the period from September 12 through 25, 2008. Figure 3 also highlights lump sum invoiced costs for the “Direct Labor” and “Travel” cost elements. In this example, the SBInet prime contractor billed, and CBP paid, a total of $3,705,718.70, including $1,518,873.38 for the period for direct labor without any supporting details such as the hours worked and labor rate category. Supporting details are necessary to allow reviewing officials to determine, for example, whether the appropriate rate was charged and to assess the reasonableness of the hours charged. Similarly, for the $108,148.57 billed for travel for the period, the contractor did not provide supporting details necessary for a reviewing official to assess the amount claimed, such as the purpose of the trip and travel destination. Supporting details help CBP’s COs and COTRs assess the propriety of invoice cost elements billed to the government, and effectively review the prime contractor’s invoices. Lacking sufficiently detailed data supporting the original SBInet contractor’s invoiced costs, we were unable to determine whether the 99 invoices we sampled for review were proper and in compliance with original SBInet program contract provisions. Our review identified numerous instances of CBP CO and COTR frustration when they were unable to obtain detail to support SBInet contractor lump sum invoiced costs, despite repeated requests. The SBInet prime contractor denied these requests on the basis that CBP’s policies did not require supporting detail. CBP paid the invoiced amounts in all cases. In November 2009, CBP requested, and the SBInet prime contractor began providing, some additional information with its invoices submitted under the original SBInet program task orders. For example, the prime contractor included additional information on work performed for the invoice period. However, the additional information the contractor provided did not include sufficient additional detail needed to support an effective review of invoiced costs, such as hours worked, labor rate category, purpose of travel, or travel destination. CBP could have relied on a provision of the contract to obtain additional support for lump sum invoiced costs. That is, as authorized by the contract’s Allowable Cost and Payment Clause (FAR 52.216-7 (a) (1)), CBP could have required the SBInet contractor to provide, in such form and with reasonable details, support for lump sum invoiced cost element claims. CBP and SBI Contracting Division management officials told us they were aware of their ability to obtain supplemental detailed supporting cost information under the FAR Allowable Cost and Payment clause. However, they also told us that CBP made a business decision for the overall SBI program (including the original SBInet program) not to request such detailed supporting data from its prime contractor, but rather to rely on other oversight mechanisms (such as closeout audits) to help identify any contractor billing issues. Closeout audits are less effective as a control to identify or correct any contractor payment issues because they may not be conducted until a number of years after completion of a contract. The contractor’s ability to repay any improper payments may deteriorate, responsible prime contractor officials may change, their memories may fade, or needed supporting data may be lost. As provided by Standards for Internal Control in the Federal Government, well-developed and consistently implemented policies and procedures are critical in providing reasonable assurance that management’s directives are carried out and program risks, such as the risk of improper payments, are minimized. CBP’s SOP applicable to COs’ and COTRs’ reviews of SBInet contractor invoices provided general guidance that COs and COTRs were to “evaluate invoices to certify receipt of the product or service in accordance with the terms of the contract or order, as well as the accuracy and validity of the elements in the invoice.” However, CBP’s procedures for reviewing prime contractor invoices submitted under the original SBInet program were not sufficiently detailed and appropriately risk based to enable consistent, effective, and documented invoice reviews. CBP’s prime contractor invoice review procedures under the original SBInet program did not identify the specific review steps required for COs and COTRs to carry out and document effective, risk based reviews that could reasonably ensure that the SBInet contractor’s invoices were in the correct amount and accurately reflected all and only allowable goods and services as provided for under the original SBInet program. For example, CBP’s SOP for reviewing payments to the prime contractor under the original SBInet program did not reflect such specific review steps as how to consider the relative risks and review invoice cost elements (including major subcontracts, direct materials, direct labor, and other direct costs); what qualifies as sufficient supporting evidence for amounts invoiced by the prime contractor; and how to review invoice credit amounts and contract reserve adjustments. SBI’s prime contractor reported to CBP that it met two of its six small business subcontracting goals that were identified in the prime contractor’s subcontracting plan for the reporting period ended March 31, 2010. The prime contractor reported that it was unable to meet the remaining small business goals primarily as a result of non-small business contract awards necessitated by the Secure Fence Act of 2006, as amended. Specifically, to obtain the material needed to meet the 2006 statutory directive, in December 2007, the prime contractor entered into a large-scale steel purchase of approximately $242 million that it told us was only available from a large business. Consequently, the SBI prime contractor reported that this steel purchase reduced the subcontract award dollars available such that it was unable meet all of its small business contract award goals for the SBI program. The SBI’s prime contractor reported on its performance against small business subcontracting goals that were identified in its subcontracting plan and aligned with the categories used by the Small Business Administration (SBA) for prime contracts. That is, consistent with SBA definitions, the SBI prime contractor established five socio-economic subcategories for its SBI program: (1) Small Disadvantaged Business, (2) Woman-Owned Small Business, (3) Historically Underutilized Business Zone (HUBZone), (4) Veteran-Owned Small Business, and (5) Service-Disabled Veteran-Owned Small Business. The SBI prime contractor-established goals for each subcategory ranged from 1 to 5 percent of the total SBI program contract dollars awarded. Additionally, the SBI prime contractor also established an overall small business goal of awarding 40 percent of the total SBI program contract dollars to small businesses, which included, but was not limited to socio-economic small business goals. As shown in table 1, as of March 31, 2010, the SBI contractor reported that it met subcontracting participation goals for the HUBZone and Veteran- Owned small business categories. Further, the prime contractor reported that while it had awarded a total of over $262 million in SBI program funds to small businesses, its overall small business participation rate of approximately 33 percent from November 2005 through March 31, 2010, fell short of the 40 percent subcontracting goal. SBI prime contractor officials told us they relied on self reported subcontractor data to report on the extent to which it met established small business participation targets. DHS’s January 2011 decision to end the original SBInet program has implications for contractor payments controls under both the original SBInet program and its successor program. That is, our SBInet contractor payment findings apply to the remaining residual original SBI program funds, to SBInet contract closeout audits, and as “lessons learned” for the successor SBI technology program. In January 2011, the Secretary directed CBP to end SBInet as originally conceived as a single technology solution, and instead to implement a new border security technology portfolio approach utilizing existing technologies tailored to specific sectors of the Southwest border and their varying terrains and population densities. DHS announced that it intends to acquire all the technologies for the new approach through full and open competitions. The Secretary also directed that while the new technology approach should include elements of the former SBInet program where appropriate, DHS did not plan to use the current SBInet prime contract to procure any of the technology systems under the new plan. Therefore, our SBInet contractor payment findings are directly relevant to the remaining $80 million in original SBI program funds obligated but not yet disbursed. As discussed previously, CBP has an opportunity to improve the design of its preventative controls with respect to the remaining funds to be paid to the original SBInet program prime contractor. Further, our findings have implications for the contract closeout activities associated with the contract and task orders under the original SBInet program. Given our findings on the design of prime contractor payment controls under the original SBInet program, prompt action to complete closeout audits related to payments to the prime contractor under the original SBInet program contract and task orders is imperative. While CBP has the authority to do so as of February 2011, it had not yet requested that DCAA to conduct closeout audits on any of the original SBInet program contracts and related task orders. CBP actions to timely request and monitor effective completion of these audits are important because it may take several years for a contractor to close its books and additional time for DCAA to review the final rates applicable in each calendar year. Also, in requesting and monitoring contract closeout audits, it will be important that CBP also provide information on our findings so that DCAA can adjust its planned review and testing procedures accordingly. However, CBP has not yet established a monitoring mechanism to follow up on the status of any DCAA closeout audits. Internal control standards provide that any previously identified deficiencies related to an entity or program should be considered in planning future audits of the entity or program. They also state that an entity should establish performance monitoring activities. Such monitoring represents an essential internal control activity that can be used to help assess the effectiveness of CBP controls over contractor payments (including vulnerability to, and recovery of, any improper payments), and whether any additional follow-up actions are necessary. Finally, our findings concerning payments to the prime contractor under the recently ended SBInet program are useful as “lessons learned.” Our findings related to DHS controls over prime contractor payments under the original SBInet program will be applicable to designing procedures and controls for future technology portfolio contracting efforts. Our findings related to the design of current SBInet prime contractor payment policies and procedures represent important “lessons learned” for designing and implementing appropriate controls over contractor payments under the new technology portfolio approach. Effective controls over contractor payments are essential to helping provide assurance that SBInet program funds were disbursed only for authorized goods and services, and in the correct amounts. Because preventative controls are generally more cost-efficient and effective than detective controls, timely actions to strengthen controls in this area are particularly important with respect to the remaining $80 million in original SBInet program funds not yet disbursed. Furthermore, given the nearly $800 million in contract payments CBP already disbursed, full and timely completion of detective controls, particularly closeout audits, will also be essential in providing reasonable assurance that SBInet program funds were disbursed only for authorized goods and services and in the correct amounts. As such it will be important for CBP to take prompt actions to (1) request that DCAA design and conduct closeout audits recognizing the need to strengthen detective controls and (2) establish a mechanism to coordinate and track completed closeout audits to ensure that such audits are fully effective, and completed in time to effectively address to any errors or improper payments identified. Further, our findings concerning the design of CBP’s controls over payments to the prime contractor under the recently ended SBInet program serve as “lessons learned” to be considered in designing and implementing controls as part of the newly announced technology portfolio approach. We recommend that the Secretary of Homeland Security direct CBP’s SBI Contracting Division Director to take the following five actions. With respect to the remaining funds not yet disbursed under the original SBInet contract: Revise CBP’s SBI SOPs to require the SBInet contractor to submit data supporting invoiced costs to CBP in sufficient detail to facilitate effective CO and COTR invoice review. Revise CBP’s SBI SOPs to include specific, risk-based steps required for COs and COTRs to properly review and approve contractor invoices to ensure that they accurately reflect all program costs incurred, including specifying required documentation of such review and approval. With respect to closeout audits under the original SBI prime contract and any task orders that receive closeout audits under DHS’s SOPs: Request that DCAA to perform closeout audits as expeditiously as possible, including providing information on the contractor payment control findings concerning the original SBInet program that we identified for consideration in determining the extent and nature of DCAA testing required as part of such audits. Establish procedures for coordinating with DCAA to monitor the status of closeout audits related to the original SBInet program. With respect to the new technology portfolio approach: Document the consideration and incorporation as appropriate, of lessons learned based on our findings on the design of controls over payments to the original SBInet contractor in designing and implementing contract provisions and related policies and procedures for reviewing and approving prime contractor invoices. Such provisions should provide for obtaining sufficiently detailed data supporting invoiced costs to support effective invoice reviews and include the specific, appropriately risk-based steps required for COs and COTRs to carry out an effective contractor invoice review. In commenting on a draft of this report, DHS concurred with two of our recommendations and concurred in principle with the remaining three. DHS agreed that the government needs to perform adequate review of contractor requests for interim and final payments and that the government should maintain effective and repeatable processes for risk- based reviews to provide effective “preventative” management controls. With respect to the two recommendations for which it concurred, DHS cited actions under way to provide more focused, risk-based invoice review procedures, and incorporate lessons learned from past contractor invoice review experience into policies and processes for invoice review under the new technology portfolio approach. For the three recommendations with which it concurred in principle, DHS expressed concerns with respect to the cost-effectiveness or appropriateness of the recommended actions. Specifically, regarding our recommendation to revise CBP’s procedures to require the SBInet contractor to submit data supporting invoiced costs to CBP in sufficient detail to facilitate effective CO and COTR invoice review, CBP stated that it plans to enhance its current required review process by June 30, 2011, to provide copies of all contractor invoices directly to DCAA. However, DHS commented that requiring the prime contractor to submit substantial supporting documentation data where controls are already in place is not cost-effective. In this regard, we modified our recommendation by deleting examples of details to accompany invoices in order to allow CBP flexibility to decide specifically what detailed supporting data are needed. Nonetheless, as evidenced by numerous CO and COTR requests for more detailed data to support their invoice reviews discussed previously in our report, we continue to believe that the contractor should be required to provide information in sufficient detail to facilitate invoice reviews that can function as effective preventative controls in this area. DHS also concurred in principle with our recommendations to request and monitor the expeditious completion of DCAA closeout audits. DHS agreed that there is a need to close out contracts as soon as practical and plans to continue to discuss with DCAA the importance of completing annual incurred cost audits so that contracts can be closed. However, DHS commented that DCAA management, not DHS, ultimately determines the completion of these audits. As discussed in our draft report, the focus of our recommendations was on DHS assisting DCAA in efficiently and effectively carrying out its responsibilities. Specifically, we recommended that DHS provide DCAA with information on our findings concerning the SBInet contractor’s invoices to help focus its audit work and coordinate with DCAA to monitor the status of closeout audits. We continue to believe that DHS and CBP need to establish a mechanism to monitor completed closeout audits to ensure that such audits are fully effective and completed in time to effectively address to any errors or improper payments identified. By strengthening their monitoring of the status of DCAA closeout audits, DHS and CBP officials could better help ensure that corrective actions and lessons learned are effectively implemented and adopted, as appropriate. We therefore believe that these two recommendations remain valid. We also made changes as appropriate throughout the draft in response to DHS technical comments. DHS comments are reprinted in appendix I. We are sending copies of this report to the Chairmen and Ranking Members of the Senate and House Committees on Appropriations and other Senate and House committees and subcommittees that have authorization and oversight responsibilities for homeland security. We will also send copies to the Secretary of Homeland Security, the Commissioner of U.S. Customs and Border Protection, and the Director of the Office of Management and Budget. The report also is available at no charge on the GAO Web site at http://www.gao.gov. Should you or your staff have any questions on matters discussed in this report, please contact me at (202) 512-9095 or at raglands@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix II. In addition to the contact named above, Chanetta Reed, Assistant Director; Kwabena Ansong; Heather Dunahoo; Nicholas Epifano; Aaron Livernois; and Stephen Lowery made key contributions to this report.

Summary: In 2005, the Department of Homeland Security (DHS) initiated a multibillion-dollar contract to secure part of the nation's borders, the Secure Border Initiative (SBI). At that time, SBI was to include a single solution technology component; SBInet. DHS assigned the U.S. Customs and Border Protection (CBP) responsibility for overseeing the SBI contract, including SBInet. In January 2011, DHS announced that it was ending SBInet, and replacing it with a new technology portfolio. GAO was asked to (1) assess CBP's controls over payments to the prime contractor under the original SBInet program, and (2) provide information about the SBI program prime contractor's reporting against small business subcontracting goals. GAO assessed CBP controls against federal standards for internal control and relevant federal regulatory provisions, and summarized data on contractor performance against small business contracting goals. GAO's review of CBP's controls over payments to the prime contractor under the original SBInet program identified the need to improve controls in two critical areas. Specifically, GAO found that CBP's design of controls for SBInet contractor payments did not (1) require invoices with sufficiently detailed data supporting billed costs to facilitate effective invoice reviews or (2) provide for sufficiently detailed, risk-based invoice review procedures to enable effective invoice reviews prior to making payments. Although CBP's established procedures were based on the Federal Acquisition Regulation (FAR), GAO identified numerous instances of CBP contracting officers lacking detailed support in the SBInet contractor invoices they received for review. Because CBP's preventative controls were not fully effective, the agency will continue to (1) be impaired in providing assurance that the reported $780 million it already paid to the contractor under the original SBInet program was allowable under the contract, in the correct amount, and only for goods and services provided, and (2) rely heavily on detective controls (such as timely, effective contract closeout audits) for all SBInet funds disbursed. Further, timely action to improve CBP's preventative controls is critical for the estimated $80 million in original SBInet program funds yet to be disbursed. Also, in light of the recent DHS announcement that it is replacing the originally conceived SBInet program with a new technology portfoliobased approach, GAO's findings concerning weaknesses in CBP's design of controls over payments to the prime contractor under the recently ended SBInet program can serve as "lessons learned" to be considered in designing and implementing controls as part of the newly announced portfolio-based approach to providing technological support to border security. With respect to performance against small business contracting goals, the prime contractor reported that it met two of the six small business subcontracting goals for the overall SBI program. Specifically, it reported that it met subcontracting participation goals for Historically Underutilized Business Zone and Veteran-Owned small business categories, but was unable to meet the other four small business goals because a large steel purchase significantly reduced the subcontract dollars available for small businesses to participate in the SBI contract. GAO makes five recommendations to improve CBP controls over prime contractor payments under the SBInet and the successor technology portfolio, including actions to strengthen invoice review procedures, provide more detailed support, and to better focus closeout audits. DHS concurred in principle with all recommendations, but for some, DHS also commented on the cost-effectiveness or others' role in implementation. GAO addresses these comments in the report.