DHS’s acquisition management policy, commonly referred to as MD-102, as implemented by the DHS Instruction Manual, establishes two overarching categories of acquisitions: acquisitions of capital assets— such as information technology (IT) systems or aircraft—and acquisitions of services—such as those provided by security guards and emergency responders. For each acquisition type, acquisitions are further categorized as major or non-major based on expected cost. An acquisition’s major or non-major status determines who acts as the Acquisition Decision Authority (ADA), the individual responsible for management and oversight of the acquisition. DHS policy established the DHS Chief Acquisition Officer as the ADA for major acquisitions and the Component Acquisition Executive (CAE)—the senior acquisition official within the component—as the ADA for all non-major acquisitions. CAEs have overarching responsibility for the acquisition cost, schedule, risk, and system performance of the component’s acquisition portfolio and are responsible for ensuring that appropriate acquisition planning takes place. According to the DHS Instruction Manual, the CAEs are required to establish component-specific non-major acquisition policies and guidance that support the “spirit and intent” of department acquisition policies. CAEs establish unique processes for managing their components’ non- major acquisitions. Components that do not have CAE-approved policies for non-major acquisition management are required to follow MD-102 and the Instruction until those policies are developed. Figure 1 illustrates the decision authority and thresholds for major and non-major acquisitions. DHS acquisition policy establishes an acquisition lifecycle framework that includes a series of five acquisition decision events. These acquisition decision events provide the ADA an opportunity to assess whether an acquisition meets certain requirements and is ready to proceed through the lifecycle phases. Figure 2 depicts the five acquisition decision events and the four phases of the acquisition lifecycle. As part of an acquisition decision event for a major acquisition, the ADA reviews and approves key acquisition documents, such as an acquisition program baseline. An acquisition program baseline establishes an acquisition’s critical cost, schedule, and performance parameters. Baselines are useful management tools that can help leadership (1) understand of the scope of an acquisition, (2) assess how well the acquisition is being executed, and (3) secure adequate funding. For non- major acquisitions, each CAE has flexibility in deciding how his or her component will apply the acquisition lifecycle framework and the types of documentation that will be required at each acquisition decision event. The Instruction grants the components flexibility when managing non- major acquisitions. Within DHS headquarters, PARM is the lead office responsible for overseeing the department’s acquisition processes. PARM has a direct management role with major acquisitions and less oversight of non-major acquisitions. For non-major acquisitions, PARM’s role is to ensure CAEs are overseeing their components’ acquisitions appropriately, and facilitate component efforts to report acquisition information using DHS’s INVEST system, among other things. The INVEST system is a central repository for data on DHS acquisitions and investments, such as budget, schedule, and performance information. INVEST data are used to oversee both major and non-major acquisitions and to satisfy internal and external reporting requirements. DHS’s component agencies lack the information needed to effectively oversee their non-major acquisitions because they cannot confidently identify all of them. They identified over $6 billion in non-major acquisitions; however, we found 8 of the 11 components could not identify all of their non-major acquisitions and we found that the data that 9 components provided for these acquisitions were unreliable. Several officials indicated that their focus had been on major acquisitions historically, and they had not turned their attention to non-major acquisitions until more recently. Many component officials said they were still in the process of identifying all of their non-major acquisitions, but it was unclear when they would complete these efforts. DHS headquarters had not established time frames for components to do so, which may have resulted in components losing traction in their efforts. Federal internal controls standards establish that management should obtain relevant data from reliable sources in a timely manner. Another key challenge involves the use of baselines, which establish a program’s critical cost, schedule, and performance parameters. Component officials identified 38 non-major acquisitions that were active at the start of fiscal year 2017 (as opposed to acquisitions that have been delivered to end users and are considered to be non-active). We found that most of the active non-major acquisitions (23 of 38) did not have approved baselines, and that the value of the acquisitions without baselines constituted nearly half of the total value of the active acquisitions. At the beginning of fiscal year 2017, some components did not require approved baselines. However, in response to our preliminary findings, in February 2017, DHS required component leadership approve baselines for non-major acquisitions, which should help components oversee them more effectively. Component officials identified 38 non-major acquisitions, valued at greater than $6 billion, that were active as of the start of fiscal year 2017. We define acquisitions to be active when they have entered the obtain phase of the acquisition lifecycle and have not yet achieved FOC. Of the reported 38 active acquisitions, 36 were capital asset acquisitions with a total value exceeding $6 billion. The remaining two active acquisitions were services acquisitions with combined annual expenditures of $19 million in 2016. Across DHS, components identified a total of 255 non- major acquisitions in all phases of the acquisition lifecycle. DHS’s non-major acquisitions encompass diverse systems and capabilities that address critical mission needs including immigration services, law enforcement, and disaster response. For example, non- major acquisitions include USCG response boats that perform law enforcement and search and rescue missions; CBP’s Mobile Video Surveillance System, which identifies and detects illegal incursions into areas that have gaps in coverage from other surveillance systems; and DNDO’s Human Portable Tripwire, a small, wearable system that can detect radiological threats. Figure 3 depicts these three acquisitions. Acquisition management efforts have the greatest impact on active acquisitions. When an acquisition is considered active, managers develop, test, and evaluate the extent to which the acquired capability can meet DHS mission needs, and adhere to critical cost, schedule, and performance parameters. By comparison, acquisition management activities have less impact on acquisitions that have reached FOC because these acquisitions have passed key decision events in the acquisition lifecycle. Meanwhile, we define acquisitions that are very early in the acquisition life cycle, i.e. in the need or analyze/select phases, to be pre-active. Pre-active acquisitions do not yet have critical cost, schedule, and performance parameters because component officials have not yet agreed on what they want, when they want it, or how much they want to spend. Figure 4 depicts the number of non-major acquisitions component officials identified by acquisition lifecycle phase. About 74 percent of the non-major acquisitions that component officials identified (189 of 255) had reached FOC at the start of fiscal year 2017, and components were operating and maintaining them until disposal. Although officials indicated these acquisitions were no longer active and had already passed all of their major acquisition decision events, it is still important for DHS to understand the scope of these acquisitions because up to 70 percent of an acquisition’s total life cycle costs can occur after FOC. About 11 percent of the non-major acquisitions that component officials identified (28 of 255) are in the pre-active phases of the acquisition lifecycle. During these phases, program managers identify a mission need that justifies investment in a new acquisition and evaluate alternative options to meet that need. DHS component officials identified 255 non-major acquisitions across DHS, but officials from most of the components (8 of 11) also reported to us that they were not confident that they had accounted for all of their non-major acquisitions. However, these officials also told us they were working to improve their ability to identify their non-major acquisitions going forward. In the view of some officials, the problems lie primarily in tracking the non-active acquisitions, rather than those that are still active. Even when component officials could identify these acquisitions, we found that the data they provided were often unreliable. The data reliability issues often involved the type of information included in acquisition baselines, specifically cost, schedule, and capability information. We spoke with officials from 11 components to get their perspective on whether they were able to accurately identify the full scope of their non- major acquisitions. Officials from 8 of the 11 DHS components told us they could not identify all of their non-major acquisitions. These officials were able to provide data on some acquisitions, but they were not confident that they had identified all of them. Officials from 3 of the 8 components stated that they were more confident in their ability to identify all active acquisitions but were less sure that the full scope of post-FOC acquisitions were identified. Component officials offered two reasons for the lack of confidence in the data: 1. Historically, managing non-major acquisitions has been a relatively low priority when compared to managing major acquisitions or other component activities. 2. The components lack effective procedures for identifying those acquisitions. Officials from all of the components we reviewed indicated that they are working to improve their management of non-major acquisitions for a variety of reasons, including to improve their ability to monitor acquisition cost growth and other acquisition performance metrics. Competing priorities: Officials from 6 components indicated that managing non-major acquisitions has historically been a lower priority than managing major acquisitions or other component activities. For example, CBP officials reported that since 2011, CBP’s CAE staff has focused on bringing major acquisitions into compliance with DHS acquisition policy. It took CBP until 2016 to baseline all of its Level 1 acquisitions. In 2014, CBP officials turned their attention to non-major acquisitions. They began to identify their non-major acquisitions, and worked to understand their purpose, status, and the CBP offices they support. According to CBP officials, these efforts are ongoing. Similarly, following the issuance of MD-102 in 2008, FEMA focused on managing major acquisitions before placing an emphasis on non- major acquisition management in 2015. According to component officials, FEMA is now developing a more robust management process for non-major acquisitions. They said that the first step toward increasing the management rigor for these acquisitions is to accurately identify them. Ineffective procedures: Officials from 2 components stated that they lack effective procedures for identifying non-major acquisitions. USCG and USCIS officials acknowledged that their procedures for identifying these acquisitions need improvement. Specifically, a USCG official told us that USCG procedures do not always successfully distinguish IT acquisitions from non-acquisition activities. According to the official, many non-major IT acquisition activities may be occurring, but the USCG acquisition support staff may not be aware of them. USCG officials said that the component has approximately 400-500 IT investments to assess to determine whether they should be identified as acquisitions. As a result, USCG may be underreporting the dollar value of non-major acquisitions. According to USCG officials, the process of identifying all such acquisitions is underway. Additionally, a senior USCIS official stated that his component’s method for identifying its smaller non-major acquisitions needs improvement. USCIS combines its smallest acquisitions—those valued at less than $50 million—into a single acquisition, aligns each combined acquisition to specific offices within USCIS, such as the Office of Information Technology, and tracks each combined acquisition as a single acquisition. Using this approach, USCIS may be underreporting the number of non-major acquisitions, as multiple acquisitions may be counted as one, and the CAE may be missing opportunities to influence the acquisitions at key decision events. To improve tracking of these acquisitions, the official told us that USCIS is evaluating each individual acquisition to determine if it is active, and if it should be managed as a stand-alone acquisition. In addition, according to USCIS officials, USCIS has recently revised its non- major acquisition policy, which will change the acquisition tracking requirement. This revision is expected to be finalized in 2017. DHS component officials told us that they were working to improve their ability to identify non-major acquisitions. For example, officials from 4 components stated that they were using new guidance provided in a 2016 update to the DHS Instruction Manual to more consistently categorize all acquisitions as (1) capital acquisitions, (2) service acquisitions, or (3) simple procurements. The guidance includes a series of yes-or-no questions that acquisition officials answer to categorize a particular acquisition. Component officials said these categorizations are helping them identify all of the non-major acquisitions in their respective portfolios. For example, FEMA officials said they have used the new guidance to determine whether acquisitions considered procurements should actually be managed as non-major acquisitions. Officials from the other components reported efforts such as updating component policies and performing ongoing reviews to identify which activities are acquisitions. However, it was unclear when these various efforts to identify the full scope of all non-major acquisitions would be complete because no timelines had been established by DHS headquarters, which may have resulted in components losing traction in their efforts. Federal internal controls standards establish that management should obtain relevant data from reliable sources in a timely manner. Until components have identified all of their non-major acquisitions, they cannot effectively manage their acquisition portfolios or apply the level and type of oversight that complies with department policy. Having an established time frame should help ensure that the actions underway are seen to completion. In addition to the components’ inability to identify all non-major acquisitions, our analysis and information received from component officials identified a number of data reliability issues. Specifically, our analysis found that the data provided by 8 of the 11 components were not complete. For example, several life cycle cost estimates did not include government personnel costs. In addition, most of the components that reported active acquisitions could not provide approved baselines supporting the data they provided, in part because some components did not require approved baselines. Officials from 6 components also acknowledged they have issues with data reliability, specifically with accuracy and completeness, which could hinder their CAEs’ ability to manage non-major acquisitions in accordance with DHS acquisition policy. Our analysis of all non-major acquisition data provided by the DHS components found that the data were complete for over 60 percent of the acquisitions reported and that data for active acquisitions had fewer issues with incomplete data than acquisitions that were post-FOC. In responding to our requests for information, 5 components did not provide a complete FOC date or cost information for at least one of their active non-major acquisitions. Although the components have different requirements for documenting such information, key acquisition management best practices recommend that all acquisitions have well defined requirements and establish realistic cost and schedule estimates. Table 1 describes the data reliability issues that we identified in the component-reported non-major acquisition data. Cost, schedule, and capability information are basic acquisition data that would be included in an acquisition baseline, and we have previously found that these types of information help senior leadership manage acquisitions more effectively. However, most of the components that reported active acquisitions could not provide approved baselines for all of their non-major acquisitions since not all of them were required to provide approved baselines. In addition to the completeness issues we identified, officials from 6 components acknowledged that they have issues with data reliability, specifically with accuracy and completeness. Accuracy: Officials from 5 components reported issues with the accuracy of the non-major acquisition data they provided. Data accuracy refers to the extent that recorded data reflect the actual underlying information. For example, DNDO officials stated they did not have full confidence in 20 percent of the acquisition data they reported because most DNDO non-major acquisitions were not required to have program baselines. Instead, DNDO is using rough order of magnitude cost estimates for these acquisitions, which they acknowledged are inherently inaccurate. Completeness: Officials from 3 of the 6 components also told us that their non-major acquisitions data were incomplete. Data completeness refers to the extent that relevant records are present— an issue addressed in the scope discussion above—and that the fields in each record are populated appropriately. For example, FEMA officials said that they had limited cost value data for non-major acquisitions because many of these acquisitions have not had formal life cycle cost estimates, and that improvements to their non-major acquisitions data are required in order to provide such estimates. Table 2 lists the components we reviewed, whether we identified data reliability issues—specifically incomplete data—in the non-major acquisition data reported by the components, and whether component officials self-identified data reliability issues in that data. For 9 components, we identified data reliability issues through our analysis, component officials identified data reliability issues themselves, or both. In accordance with the CAE responsibilities outlined in the DHS Instruction Manual, CAEs have developed a variety of processes to maintain and report data on non-major acquisitions. For example, USCG officials reported using the INVEST system and three of their own systems to track and report data on non-major acquisitions. They told us their non-major acquisition data and corresponding documentation is regularly compiled and CAE staff review it every month. Meanwhile, CBP officials reported using a less centralized approach. CBP officials track non-major acquisition data in two department-level systems and multiple component-level systems, including several Microsoft Excel spreadsheets and Microsoft Access databases. CBP officials reported that their component lacks a systematic data review process, and that they had to manually aggregate their data to respond to our queries. Additionally, components’ policies for managing non-major acquisitions vary. For example, at the start of fiscal year 2017, 7 components had policies in place requiring component leadership to approve program baselines for active non-major acquisitions. However, the 4 other components did not. Our prior work and DHS acquisition policy emphasize the importance of the critical cost, schedule, and performance parameters that a baseline provides. As our work showed in 2012, the baseline is a critical tool for managing an acquisition. First, it is an agreement between program-, component-, and department-level officials establishing what the capabilities being acquired should cost, when they should be delivered, and how they should perform. DHS acquisition policy for major acquisitions requires that the ADA approve a program’s baseline before it initiates design and development activities, and this baseline then serves as a performance management tool to monitor and measure an acquisition’s execution. Second, baselines can help acquisition leaders secure funding needed for programs to meet critical cost, schedule, and performance parameters. If a program is not fully funded, a baseline can help leaders identify the trade-offs needed to fund the program with existing resources. Our prior work has demonstrated that resources, including time and funding, should be consistent with performance requirements. For major programs, the ADA confirms the program is fully resourced through the next 5 years when the ADA approves the program’s baseline. At the start of fiscal year 2017, the majority of DHS’s active non-major acquisitions did not have component-approved baselines, though 3 components—NPPD, USCG, and USSS—did have baselines for all of the active non-major acquisitions they identified. Across the 11 components, over half of the reported active non-major acquisitions (23 of 38) did not have approved baselines, including both of the active services acquisitions. The baselines provided by the components for the remaining 15 acquisitions varied in length and detail, but each included the cost, schedule, and performance parameters needed to monitor a program over time. Some components provided other types of acquisition documentation, such as an Operational Requirements Document or Test and Evaluation Master Plan. However, in each case, we determined that the documents submitted did not effectively define the acquisitions by linking their cost, schedule, and performance parameters. As such, we did not consider these documents to represent a baseline. Figure 5 shows the number of active non-major acquisitions and the number of component-approved baselines at each component. We found that the 21 capital acquisitions without CAE-approved baselines constituted a 47 percent share ($3.0 billion) of the approximately $6.4 billion components reported as the total value of their non-major capital acquisitions. Figure 6 shows the value of non-major acquisitions with CAE-approved baselines and the value of those without CAE-approved baselines. Component officials offered a variety of reasons why their CAEs had not approved baselines for non-major acquisitions. For example, they said that (1) the baselines for these acquisitions have been a relatively low priority and were therefore still pending development or approval; (2) their components chose not to require program baselines for non-major acquisitions; or (3) while the component requires baselines for future non- major acquisitions, the acquisitions were initiated prior to the establishment of that requirement. However, this situation is likely to change, given that, in February 2017, DHS issued a new policy specifically focused on managing non-major acquisitions. In response to our preliminary findings, during the course of our audit, the Under Secretary for Management included in this policy a requirement that component leadership approve baselines for these acquisitions. This new requirement should help components execute their acquisitions more effectively. Specifically, as identified above, CAEs are likely to: (1) accurately understand the size of their portfolio; (2) have adequate knowledge about execution against cost, schedule and performance parameters when making acquisition decisions; and (3) secure the funding the acquisition needs to meet those parameters. Establishing a program baseline need not be a significant program burden. Baselines should reflect basic, existing acquisition information in a format that is effective for component management. DHS headquarters officials have increased their focus on non-major acquisitions, and a new policy may help DHS’s component agencies establish effective management controls, particularly by helping ensure the new baseline policy is implemented. In 2015, DHS headquarters officials established an annual review process for non-major acquisitions with life cycle cost estimates greater than $50 million, and they now plan to use this process to ensure that components are assessing acquisition performance against approved cost, schedule and performance baselines. DHS leadership has also added new reporting requirements for these acquisitions, and, in response, all components have started entering non-major acquisition data into INVEST, DHS’s central acquisition information system. The data component officials entered into INVEST during 2016 were unreliable, but headquarters officials are taking steps to improve the reliability of this data. Further, DHS headquarters officials have defined roles and responsibilities for managing non-major acquisitions, hired an oversight official specifically responsible for these acquisitions, and elevated selected non-major acquisitions for department-level oversight. MD-102 establishes that the Executive Director of PARM should ensure CAEs are overseeing their components’ non-major acquisitions appropriately. Specifically, the policy states that the Executive Director shall review CAE governance activities and monitor the performance of non-major acquisitions. To this end, PARM has implemented a series of annual reviews of components’ non-major acquisitions with a life cycle cost greater than $50 million that have not yet achieved FOC. According to our analysis, the $50 million threshold provides PARM insight into the bulk of the resources components plan to allot to these acquisitions. Components valued 21 of their 38 reported active non-major acquisitions at more than $50 million, and these acquisitions account for approximately 95 percent—$6.1 billion—of the roughly $6.4 billion components reported as the total value of their active non-major acquisitions. PARM initiated these reviews in 2015, and, during the first round, officials said they reviewed the components’ non-major acquisition policies in an effort to determine whether these policies aligned with departmental guidance. PARM officials also said the components provided updates on the acquisitions’ costs, key milestones, and capabilities. For the second series of annual reviews in 2016, the DHS Under Secretary for Management issued a memorandum intended to increase the rigor of PARM’s non-major acquisition reviews. The memorandum stated that the components must provide PARM “evidence of sufficient acquisition documentation as tailored by the CAE” and report cost, schedule, and performance metrics with associated milestones. However, the memorandum did not identify (1) any minimum requirements for sufficient acquisition documentation; or (2) the specific cost, schedule, and performance metrics the components should report to PARM. To clarify the requirements, later in 2016, PARM developed more detailed instructions for the 2016 annual review. PARM instructed the components to identify whether they had an overarching policy or set of policies that were specific to non-major acquisitions, and whether these policies aligned with departmental guidance. PARM instructed the components to report the annual costs associated with each acquisition, provide a high- level schedule, include a description of the capability or service being acquired, and discuss issues such as the CAE’s confidence in the program’s meeting the metrics in the program baseline, if a baseline was indeed in place. Additionally, in response to our preliminary findings, a new policy that DHS finalized in February 2017 includes a requirement that component leadership approve baselines for non-major acquisitions that have not yet achieved FOC, and states that PARM’s Executive Director will leverage its reviews to assess whether CAEs are (a) baselining these acquisitions in accordance with the requirement; and (b) tracking the acquisitions’ progress against cost, schedule, and performance parameters from approved baselines. These reviews would help PARM’s Executive Director determine whether CAEs are overseeing their non-major acquisitions in accordance with MD-102. Federal internal control standards state that management should monitor program results and evaluate these results against a previously established baseline. As part of its efforts to increase oversight of non-major acquisitions, DHS leadership now requires components to enter data into the INVEST system for all non-major acquisitions valued at greater than $50 million that have not yet reached FOC. INVEST, DHS’s central system for acquisition information, is used by program-, component-, and department-level officials to enter and obtain information for monthly reporting and monitoring. In the past, components were required to enter non-major acquisition data into INVEST only for IT acquisitions valued at greater than $50 million as part of the DHS IT Capital Planning and Investment Control process. In March 2016, DHS’s Under Secretary for Management issued a memo requiring components to enter data into INVEST for both IT and non-IT non-major acquisitions valued at greater than $50 million. However, we found that the data component officials had entered into INVEST for non-major acquisitions through 2016 were unreliable. Only about half of the acquisitions eligible for entry into INVEST had been entered into the system. As of January 2017, component officials had entered data into INVEST for 10 of the 21 programs that were eligible for entry into the system—i.e., active non-major acquisitions valued at greater than $50 million. For the majority of the non-major acquisitions in INVEST, we found few source documents—particularly baselines—that CAEs could use to validate the data. A December 2016 requirement states that CAEs must validate the accuracy of these data in INVEST twice a year, mirroring the current certification requirement for major acquisitions. This recent requirement, combined with the February 2017 baselining requirement, will likely improve the reliability of the data. Additionally, component officials have reported challenges when trying to enter non-major acquisition data into INVEST. PARM did not initially provide specific guidance on entering the data, and officials from some components said they were confused about the amount and type of information that should be entered into INVEST. In response to this confusion, PARM officials created a new guidebook in October 2016 and issued additional instructions in a December 2016 memo intended to clarify the INVEST data-entry process. In addition to PARM’s implementation of annual non-major acquisition reviews and the requirement to enter non-major acquisition data into INVEST, DHS headquarters has taken several additional actions to help improve the components’ management of these acquisitions. These actions include the following: Defining roles and responsibilities for managing non-major acquisitions. In February 2017, the DHS Under Secretary for Management more clearly defined CAEs’ roles and responsibilities for managing non-major acquisitions. PARM also issued new non-major acquisition management guidance specific to the DHS Management Directorate in February 2017. The new policy consolidates the Management Directorate’s CAE authority by designating the Deputy Director of PARM the CAE for all of the Management Directorate’s non-major acquisitions. Previously, offices within the Management Directorate, such as the OCIO and the Office of the Chief Readiness Support Officer, had their own CAEs. One such office in the scope of our review—OCIO—did not use the acquisition lifecycle process for its acquisition management. This new policy could help to ensure the various offices take a consistent approach. Hiring an oversight official specifically responsible for non-major acquisitions. In light of the billions of dollars the department is spending on these acquisitions, in May 2016, PARM hired an official to focus solely on DHS’s non-major acquisitions. This official’s responsibilities and goals include working with the DHS components to develop and improve their policies and processes for managing non-major acquisitions, in part by ensuring that they align with departmental guidance. Formalizing the process for identifying/categorizing acquisitions. DHS’s Master Acquisition Oversight List identifies the department’s acquisitions and categorizes them by component, major or non-major status, and acquisition type, in order to help DHS’s acquisition managers apply the appropriate oversight requirements. In 2015, PARM established a DHS Master Acquisition Oversight List Governance Board. This body reviews and approves major and non- major acquisition additions, removals, and other updates to the department’s Master Acquisition Oversight List. The board members consist of representatives from the department’s lines of business, including the Office of the Chief Financial Officer, OCIO, and the Office of the Chief Procurement Officer. Elevating non-major acquisitions for department-level oversight. Finally, in some circumstances, the DHS Under Secretary for Management has elevated selected non-major acquisitions to major acquisition status, and, as a result, these acquisitions have received greater department oversight. For example, in April 2016, the Under Secretary for Management elevated CBP’s Remote Video Surveillance System to major acquisition status in response to an expansion in the acquisition’s scope that increased its value above the non-major acquisition dollar threshold. Similarly, at FEMA’s request, the Under Secretary for Management elevated FEMA’s Integrated Public Alert and Warning System acquisition to major status because of its complexity, cross-component impact, and high visibility outside of the department. DHS officials stated that the Under Secretary for Management may elevate non-major acquisitions for other reasons, including external events such as congressional and media interest, if a program’s importance to DHS’s strategic and performance plans is disproportionate to its size, and if an acquisition has significant program or policy implications. These actions reflect DHS leadership’s increased focus on non-major acquisitions as the department continues to work to mature its acquisition management processes across all of its component agencies. Over the past 8 years, DHS leadership has taken several steps to mature its acquisition management processes. More recently, DHS leadership has increasingly focused on its non-major acquisitions, which is fitting, given the billions of dollars going to these programs. Primary responsibility for managing these acquisitions rests, appropriately, with component officials. However, the fact that officials from few components could confidently identify the full scope of their non-major acquisitions is problematic. Understandably, the focus to date has been on active acquisitions, but it is also important that components understand the extent of their non-major acquisitions that have been fielded but are still receiving taxpayer funds to operate. Without an established time frame for components to identify the full picture of their non-major acquisitions— particularly given their acknowledged resource constraints and competing priorities—progress may not have been sustained. To improve the management of DHS’s non-major acquisitions, we recommended that the Secretary of Homeland Security direct the Under Secretary for Management to establish a time frame for components to identify all of their non-major acquisitions. We provided a draft of this product to DHS for comment. In its written comments, reproduced in appendix II, DHS concurred with our recommendation and indicated that the Under Secretary for Management has directed Component Acquisition Executives to identify all Level 3 acquisitions across DHS by no later than October 31, 2017. We reviewed the supporting documentation provided by DHS, reproduced in appendix III, and determined that this direction addressed the recommendation. DHS also provided technical comments that we addressed as appropriate. We are sending copies of this report to the appropriate congressional committees, the Secretary of the Department of Homeland Security, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-4841 or mackinm@gao.gov. Contact points for our Office of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. The objectives of this audit were designed to examine the Department of Homeland Security’s (DHS) management of non-major acquisitions. This review addresses both the components’ management of non-major acquisitions as well as the department’s oversight role. Specifically, this report assesses (1) the extent to which component leadership is effectively overseeing non-major acquisitions and (2) the extent to which DHS headquarters has helped components establish effective management controls for non-major acquisitions. To identify the extent to which component leadership is effectively overseeing non-major acquisitions, we attempted to identify all non-major acquisitions within DHS. We asked officials from DHS’s Office of Program Accountability and Risk Management (PARM), which are responsible for overseeing the department’s acquisitions, to identify the components that manage non-major acquisitions. PARM identified 14 DHS components in response. We requested data from the 14 DHS components and obtained non-major acquisition data from 11 components. Officials from the 3 remaining components stated that they did not manage non-major acquisitions. For example, officials from the DHS Science and Technology Directorate stated that their component does not identify any acquisition valued at less than $50 million as a non-major acquisition and, based on that definition, the component does not have any non-major acquisitions to report. For this reason, we removed the Science and Technology Directorate from our scope. The 11 DHS component offices and agencies we reviewed are: Customs and Border Protection, Domestic Nuclear Detection Office, Federal Emergency Management Agency, Federal Law Enforcement Training Centers, Immigration and Customs Enforcement, National Protection and Programs Directorate, Office of the Chief Information Officer, Transportation Security Administration, U.S. Citizenship and Immigration Services, U.S. Coast Guard, and U.S. Secret Service. We developed a data collection instrument, sent it to each component, and requested the acquisition name, capability description, total acquisition cost, acquisition type, most recent acquisition decision events, full operational capability (FOC) date, and acquisition lifecycle phase for all of the component’s non-major acquisitions. We used a data collection instrument to obtain non-major acquisitions data based on preliminary discussions with DHS and component officials that indicated we should work directly with the components to collect this information. To assess the reliability of the data provided by components, we reviewed the data to identify outliers, missing data and other potential errors, and compared the data to source documents when available. In interviews and via e-mail correspondence; we provided component officials an opportunity to review, discuss, and, where applicable, correct any completeness and accuracy issues. In addition, we requested that each component update its non-major acquisition data to be accurate as of October 1, 2016. We also requested and reviewed information on how the components enter, store, access, update, and review non-major acquisition data, as well as component officials’ comments on the reliability of the data they provided. Based on this assessment, we determined that the population of current non-major acquisitions and their associated acquisition costs could not be reliably determined. However, we determined that the data were sufficiently reliable to identify the minimum number of non-major acquisitions, and the general magnitude of the minimum acquisition costs associated with active non-major acquisitions. For those acquisitions that components could identify, we found that the data components provided for these non-major acquisitions were generally unreliable as further discussed in the report. In addition to the non-major acquisitions at the components that PARM identified, with the assistance of component officials we also identified one non-major acquisition at the DHS Office of the Chief Readiness Support Officer and one non-major acquisition at the DHS Office of the Chief Security Officer. We included these acquisitions in our scope when working to identify the universe of non-major acquisitions at DHS. As a final quality assurance step, we returned the collected and updated data collection instruments to the respective components, and requested officials verify and, when applicable, correct the data. To designate each acquisition active, pre-active, or post-FOC, we reviewed the FOC and acquisition phase data that the component officials provided. We designated an acquisition active if it had reached Acquisition Decision Event 2A but had not reached FOC by October 1, 2016. If any increment, project, or segment of an acquisition was active, we designated the entire acquisition active. We designated acquisitions with an FOC date on or before October 1, 2016 post-FOC, and those that had not yet reached Acquisition Decision Event 2A by October 1, 2016 pre-active. For acquisitions with conflicting data, we confirmed our designation with component officials. In addition, we collected acquisition cost information for each acquisition, specifically, life cycle cost estimates for capital asset acquisitions and annual expenditure data for services acquisitions. For active acquisitions that did not have final cost estimates in place, we accepted and reported the preliminary information that was available, such as rough order of magnitude estimates or life cycle cost estimates with lower confidence levels. To understand the processes components use to manage non-major acquisitions and assess the extent to which components were consistently baselining these acquisitions, we reviewed draft and final DHS acquisition policy, and component-level non-major acquisition policies and guidance. We also requested and reviewed acquisition decision memos and component-approved acquisition program baselines—or any equivalent documents containing cost, schedule, and performance parameters—for all acquisitions that were active as of October 1, 2016. We then reviewed each baseline document to determine whether it actually contained cost, schedule, and performance parameters in accordance with key acquisition management practices we established in previous reports. We also interviewed department and component officials to expand our understanding of component management processes, and determine why the components were or were not approving baselines for non-major acquisitions. To identify the extent to which DHS headquarters has helped components establish effective management controls for non-major acquisitions, we reviewed draft and final department acquisition policy, guidance, and memos to identify how PARM and other headquarters entities contribute to non-major acquisition management. We also reviewed this documentation to identify existing and planned oversight mechanisms for non-major acquisitions. We requested information from officials at nine DHS headquarters entities and the 11 DHS components in our scope to identify how, if at all, DHS headquarters entities other than PARM monitor or interact with non-major acquisitions during the acquisition process. We interviewed officials from PARM to discuss PARM’s annual review process, DHS’s Master Acquisition Oversight List, and other efforts to address non-major acquisitions. Finally, we interviewed officials from PARM and the components to better understand ongoing efforts to enter non-major acquisition data into DHS’s Investment Evaluation, Submission, & Tracking (INVEST) system, which is the department’s central system for information on its acquisitions. We also interviewed officials to better understand the circumstances under which DHS headquarters elevates non-major acquisitions to major acquisition status, increasing headquarters oversight. To assess the reliability of the data in the INVEST system, we traced non- major acquisition data from INVEST to available source documents. We collected INVEST reports for active non-major acquisitions and compared cost information in those reports to available source documents, such as acquisition program baselines and life cycle cost estimates. To assess relevant internal controls, we reviewed the DHS INVEST User Guide and Training Manual and identified the purpose and structure of the INVEST system. We subsequently evaluated INVEST reports and identified the forms each component used to enter data into INVEST, as well as the level of completeness of the forms and any system-generated errors. Finally, we interviewed component and PARM officials to understand what, if any, internal controls headquarters and components were using for the non-major acquisition data before, during, and after entering that data into INVEST. We found the data in INVEST not to be sufficiently reliable for our purposes of reporting on the universe of non-major acquisitions. We conducted this performance audit from February 2016 to April 2017 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In addition to the contact listed above, Nathan Tranquilli (Assistant Director), Katherine Trimble (Assistant Director), Betsy Gregory-Hosler (Analyst-in-Charge), Andrew Fisher, Javier Irizarry, Kirsten Leikem, and John Rastler made significant contributions to this report. Peter Anderson, Christopher Businsky, Lorraine Ettaro, and Sylvia Schatz also made key contributions to this report.

Summary: Each year, DHS acquires a wide array of systems intended to help its component agencies execute their many critical missions. GAO has previously reported that DHS's process for managing its major acquisitions is maturing. However, non-major acquisitions (generally those with cost estimates of less than $300 million) are managed by DHS's component agencies and have not received as much oversight. Recently GAO reported on a non-major acquisition that was executed poorly, limiting DHS's ability to address human capital weaknesses. GAO was asked to examine DHS's management of non-major acquisitions. This report assesses: (1) the extent to which component leadership is effectively overseeing non-major acquisitions; and (2) the extent to which DHS headquarters has helped components establish effective management controls for non-major acquisitions. GAO reviewed policy and component guidance, and interviewed officials from DHS headquarters and 11 components responsible for managing non-major acquisitions. GAO also traced non-major acquisition data from DHS's central acquisition data system to source documents to assess data reliability. The Department of Homeland Security's (DHS) component agencies—such as the U.S. Coast Guard and Customs and Border Protection—lack the information needed to effectively oversee their non-major acquisitions because they cannot confidently identify all of them. They identified over $6 billion in non-major acquisitions; however, GAO found 8 of the 11 components could not identify them all. Several officials indicated that their focus had been on major acquisitions historically, and they had not turned their attention to non-major acquisitions until more recently. Many component officials said they were still in the process of identifying all of these acquisitions, but it was unclear when they would complete these efforts. DHS headquarters had not established time frames for components to do so, which may have resulted in components losing traction in their efforts. Federal internal controls standards establish that management should obtain relevant data from reliable sources in a timely manner. Another key challenge involves the use of baselines, which establish a program's critical cost, schedule, and performance parameters. Component officials identified 38 non-major acquisitions that were active at the start of fiscal year 2017 (as opposed to acquisitions that have been delivered to end users and are considered to be non-active). GAO found that most of the active non-major acquisitions (23 of 38) did not have approved baselines, and that the value of the acquisitions without baselines constituted nearly half of the total value of the active acquisitions. At the beginning of fiscal year 2017, some components did not require approved baselines. However, in response to GAO's preliminary findings, in February 2017, DHS required component leadership to approve baselines for non-major acquisitions, which should help components oversee them more effectively. DHS headquarters is taking steps to help components establish more effective management controls for non-major acquisitions. In 2015, DHS headquarters officials established a process to review them annually. In February 2017, in response to GAO's preliminary findings, DHS established that components shall use the annual reviews to assess the extent to which non-major acquisitions are on track to meet cost, schedule, and performance parameters from approved baselines. DHS leadership has also established ongoing reporting requirements for non-major acquisitions. All components have started entering non-major acquisition data into DHS's central acquisition information system, and headquarters officials are taking steps to improve the reliability of these data. GAO recommended that DHS headquarters establish time frames for components to identify all non-major acquisitions. DHS concurred with GAO's recommendation and directed components to identify all non-major acquisitions by October 31, 2017.