With the terrorist attacks of September 11, 2001, the threat of terrorism rose to the top of the country’s national security and law enforcement agendas. In response to these growing threats, the Congress passed and the President signed the Homeland Security Act of 2002, which created DHS. We have previously identified IT management as critical to the transformation of the new department. Not only does DHS face considerable challenges in integrating the many systems and processes that provide management with information for decision making, but it must sufficiently identify its future needs in order to build effective systems that can support the national homeland security strategy in the coming years. To jump start this planning process and also begin to identify opportunities for improved effectiveness and economy, OMB issued two memorandums in July 2002 to selected agencies telling them to “cease temporarily” and report on new IT infrastructure and business systems investments above $500,000. On March 1, 2003, DHS assumed operational control of nearly 180,000 employees from 22 incoming agencies and offices. In establishing the new department, the Congress articulated a seven-point mission for DHS: Prevent terrorist attacks within the United States. Reduce the vulnerability of the United States to terrorism. Minimize the damage and assist in the recovery from terrorist attacks. Carry out all functions of entities transferred to the department, including by acting as a focal point regarding natural and man-made crises and emergency planning. Ensure that the functions of the agencies within the department that are not directly related to securing the homeland are not diminished or neglected. Ensure that the overall economic security of the United States is not diminished by efforts aimed at securing the homeland. Monitor connections between illegal drug trafficking and terrorism, coordinate efforts to sever such connections, and otherwise contribute to efforts to interdict illegal drug trafficking. To help DHS accomplish its mission, the Homeland Security Act of 2002 establishes four mission-related directorates, the (1) Border and Transportation Security directorate, (2) Emergency Preparedness and Response directorate, (3) Science and Technology directorate, and (4) Information Analysis and Infrastructure Protection directorate. In addition to these directorates, the U.S. Secret Service and the U.S. Coast Guard remain intact as distinct entities within DHS; Immigration and Naturalization Service adjudications and benefits programs report directly to the deputy secretary as the Bureau of Citizenship and Immigration Services, and the Management directorate is responsible for budget, human capital, and other general management issues. According to the most recent President’s budget, DHS expects to make about $4 billion in IT investments in fiscal year 2004—the third largest IT investment budget in the federal govenment. In addition, as we have testified, information management and technology are among the critical success factors that the new department should emphasize in its initial implementation phase. For example, DHS currently has several ongoing IT projects that are critical to the effective implementation of its mission, such as the Integrated Surveillance Intelligence System, which is to provide “24 by 7” border coverage through ground-based sensors, fixed cameras, and computer-aided detection capabilities; Student Exchange Visitor Information System, which is expected to manage information about nonimmigrant foreign students and exchange visitors from schools and exchange programs; Automated Commercial Environment project, which is to be a new trade United States Visitor and Immigrant Status Indicator Technology (US- VISIT), a governmentwide program intended to improve the nation’s capacity for collecting information on foreign nationals who travel to the United States, as well as control the pre-entry, entry, status, and exit of these travelers. Moreover, as all of the programs and agencies are brought together in the new department, it will be an enormous undertaking to integrate their diverse communication and information systems. Among the IT challenges that the new department will have to face and overcome are developing, maintaining, and implementing an enterprise architecture, and establishing and enforcing a disciplined IT investment management process (which includes establishing an effective selection, control, and evaluation process). The department’s ability to overcome these challenges is complicated by the IT management problems that its major components had when they transferred to DHS. Specifically, as we previously reported, we still have numerous outstanding IT management recommendations that require action at component agencies, such as the Customs Service and the Coast Guard. Figure 1 illustrates the timing of OMB’s July 2002 memorandums. These memorandums instructed selected agencies to (1) cease temporarily new IT infrastructure and business systems (i.e., financial management, procurement, and human resources systems) investments above $500,000 pending a review of the investment plans of all proposed DHS component agencies; (2) identify and submit to OMB information on any current or planned spending on these types of initiatives; and (3) participate in applicable IT investment review groups co-chaired by OMB and the Office of Homeland Security. According to OMB, its goal in issuing these memorandums was to seek opportunities for improved effectiveness and economy. In addition, according to officials from OMB’s Office of Information and Regulatory Affairs, another purpose was to obtain an inventory of current and planned IT infrastructure and business systems investments for organizations to be moved to DHS, which was expected to help in the administration’s transition planning. Although OMB directed selected agencies to temporarily cease these investments, it did not necessarily mean that work was to be stopped on all IT infrastructure and business systems projects at the applicable agencies. First, the memorandums only pertained to funding for new development efforts and not to existing systems in a “steady state” using operations and maintenance funding. Second, the cessation did not apply if funds pertaining to a development or acquisition contract had already been obligated. Third, agencies could request an expedited review to obtain the approval to proceed if they had an emergency or critical need. The following are examples of how OMB’s direction to temporarily cease IT investments would apply in certain circumstances. If an agency had an existing procurement system in a steady state in which no major modifications or modernization efforts were planned, there would have been no effect on the funding of this system. If an agency had an ongoing contract with available obligations for the development of a financial management system, there would have been no effect on this contract, but new obligations for development or modernization efforts would have been required to be approved by the review group. If an agency wanted to award a contract over $500,000 for a new or modernized IT infrastructure item such as a local area network, it would have been required to obtain approval from the investment review group before proceeding. Our testimony of October 2002, stated that it was not possible to assess the full effect of the July memorandums on the selected agencies at that time. Except for emergency requests, according to representatives from OMB’s Office of Information and Regulatory Affairs, the review group had not taken any action at the time of our review on the agencies’ submissions in response to the July memorandums because neither they nor OMB had completed their reviews of these documents. The July memorandums called on the Homeland Security IT Investment Review Group to assess individual IT investments as part of considering whether to consolidate or integrate component agency efforts. In fulfilling this role, the review group relied on an informal process, which was not documented. Although the review group reviewed the few investments that component agencies submitted, according to OMB and DHS IT officials, the group generally addressed broader issues related to the transition to the new department. In particular, these officials noted that the review group concentrated on longer term IT strategic issues, such as those related to the development of an enterprise architecture, associated with the transition to the proposed department. The investment review group was tasked with (1) reviewing component agency IT investment submissions that met the criteria in the memorandums, and (2) making recommendations related to these submissions, including looking for opportunities to consolidate and integrate component agency investments. According to OMB IT representatives, the group generally met once a week but did not have a documented process for performing reviews of the few component agency investments that were submitted for review. These officials reported that in the review process that was implemented, (1) agencies requested approval of selected IT investments, (2) OMB and the investment review group reviewed the agency submission, and (3) the review group made a recommendation. Once this recommendation was made, the normal budget execution process was implemented. Moreover, according to these representatives, the investment review group used the principles contained in section 300 of OMB Circular A-11 and section 8(b) of OMB Circular A-130 as the criteria for evaluating submitted investments. In addition, in commenting on a draft of this report, representatives from OMB’s Office of Information and Regulatory Affairs and Office of the General Counsel stated that although the activities of the Homeland Security IT Investment Review Group were generally conducted on an informal basis, the group relied on the already-existing processes documented in these circulars to fulfill its responsibilities. According to OMB IT representatives, when the establishment of DHS became closer in time, the focus of the review group shifted from reviewing individual investments to addressing the IT strategic issues involved with establishing the department. In particular, according to DHS officials, the review group created six working groups to address, respectively, business architecture, networks, information security, Web management, directory services (e.g., e-mail capability), and technical reference model issues. In addition, according to these officials, the investment review group took into account transition work being performed by other entities. For example, the review group worked with a liaison from the Chief Financial Officers Council, which was looking at financial management system matters related to the new department. The July 2002 memorandums resulted in some changes to agency IT infrastructure and business systems investments. Specifically, according to OMB and DHS IT officials, the review group recommended approval with conditions the five IT investments submitted to it and four component agencies reported that they changed other initiatives as a result of the memorandums. However, it is not known whether, or the extent to which, savings have resulted from the memorandums. In particular, OMB did not track the savings associated with the July memorandums because, according to OMB IT representatives, budgetary savings had not occurred when the review group was in place. Nevertheless, OMB and DHS IT officials cited other benefits that resulted from the memorandums, such as the identification of ongoing component agency efforts or resources that were important to the operation of the department at its inception. Four component agencies submitted five IT investment requests to be reviewed by the review group. According to OMB and DHS IT officials, all of these requests were recommended for approval with conditions. In addition, four component agencies reported that on their own initiative that they terminated, delayed, or changed other initiatives as a result of the July memorandums. (See table 1.) The July memorandums stated that initial estimates indicated that potential savings of between $100 million and $200 million (IT infrastructure) and $65 million and $85 million (business systems) could be achieved over a 2- year period as a result of consolidating and integrating component agency investments. OMB reported to congressional committees that these estimates were based primarily on best practices in the federal government and private industry. However, an OMB IT representative stated that these estimates were a rough approximation and that no documentation existed to support how they were derived. The July memorandums also stated that the review group would track these savings. Moreover, OMB reported to congressional committees that this tracking would include a breakout of the savings, the cause of the savings, and the time period in which the savings would be generated. However, a tracking process was not established because, according to an OMB IT representative, no budgetary savings had occurred at the time that the investment review group was in place since no investment was terminated by the group. According to this representative, OMB still believes that budgetary savings will occur and expects that DHS will track these savings. Moreover, this representative stated that OMB will be actively working with DHS as part of its budgetary and management processes to ensure that such savings occur. DHS’s CIO agreed that savings are expected to result from the department’s consolidation and integration of systems. Moreover, he stated that DHS will be tracking such savings and has established a mechanism for doing so. Specifically, the CIO pointed to DHS’s establishment of IT commodity councils—groups that are responsible for a collection of related materials or services—that would perform this function. According to the Director of Strategic Sourcing and Acquisition Systems, the councils have established project teams that are responsible for tracking savings. According to this official, each project is in the process of developing their project plans, departmental requirements, and savings targets. Until savings resulting from the consolidation and integration of systems and services are identified, tracked, and reported, it will remain unknown whether OMB’s July memorandums and the subsequent establishment of DHS have achieved the potential economies identified by OMB. In addition, DHS IT officials stated that they were not aware of any plans to report budgetary savings resulting from the consolidation and integration of systems to applicable congressional committees. Such savings information is an important element for the Congress to consider when deliberating DHS budget requests and overseeing its IT management. Moreover, the Chairman of the House Committee on Government Reform has previously expressed concern that there has been a tremendous push for additional IT spending at DHS component agencies without ensuring appropriate management or accountability. Although budgetary savings have not yet been identified, DHS IT officials, including the CIO, cited other benefits to the July memorandums. In particular, DHS IT officials estimated that several million dollars in costs have been avoided as a result of the Secret Service decision. (A Secret Service IT official provided an explanation of how this estimate was derived, but we could not validate this amount because it was not clearly supported by the documentation provided.) In addition, the CIO stated that the investment review group evolved into the department’s CIO Council, which is responsible for developing, promulgating, implementing, and managing a vision and direction for information resources and telecommunications management. Further, the DHS chief technology officer reported that the review group provided the new department with a head start on day one operations by, for example, deciding to use the Immigration and Naturalization Service’s network backbone for the department. Finally, these and DHS component agency IT officials stated that the memorandums facilitated the department’s long-term IT planning efforts, including the development of an enterprise architecture. Once DHS became operational and the investment review group established by the July memorandums no longer existed, the department established an IT investment management process that includes departmental reviews of component agency IT investments meeting certain criteria. As part of the selection phase of this process, DHS’s CIO reported that he approved the department’s IT portfolio as part of the fiscal year 2005 budget cycle. In addition, as of January 26, 2004, the department’s highest level investment management board had performed control reviews of nine investments that had reached key decision points. In each of these cases, the project was allowed to proceed although additional documentation was required and/or conditions were set. Finally, the department’s investment management process is still evolving as the department attempts to deal with a large number of IT investments eligible for departmental reviews. In May 2003, DHS issued an investment review management directive and IT capital planning and investment control guide, which provide the department’s entities with requirements and guidance on documentation and review of IT investments. In particular, the management directive establishes four levels of investments, the top three of which are subject to review by department-level boards—the Investment Review Board (IRB), Management Review Council, and Enterprise Architecture Board. Appendix I provides a description of these department-level boards and the investments that they are responsible for. The directive also establishes a five-phase acquisition process that calls for these investments to be reviewed at key decision points, such as program authorization. In addition, the IT capital planning and investment control guide lays out a process for selecting, controlling, and managing investments. Figure 2 provides an overview of the review process outlined in the management directive and capital planning and investment control guide. As part of the selection phase of its capital planning and investment control process, DHS reviewed component agency IT investments for its fiscal year 2005 budget submission. Specifically, according to DHS IT officials, (1) the CIO approved the department’s IT portfolio and (2) all of the major IT systems submitted to OMB for the fiscal year 2005 budget were assessed and scored by an investment review team. In addition, beginning in May 2003, DHS’s top-level board (the IRB) began reviewing the department’s highest priority projects. As of January 26, 2004, the department had performed 12 control reviews of nine investments. Table 2 summarizes the results of these reviews. Although DHS is making progress in reviewing component agency projects, its investment management process continues to evolve. In particular, as of January 2, 2004, the department had identified about 100 IT programs that were eligible for review by its two top-level departmental boards and, according to IT officials, is having difficulty in bringing all of these programs before the boards in a timely manner. Moreover, DHS has not established a process to ensure that control reviews of component agency IT investments are performed in a timely manner. Specifically, although DHS’s capital planning and investment control guide states that the Office of the CIO will maintain a control review schedule for all initiatives in the department’s IT investment portfolio, as of January 2, 2004, this schedule has not been developed. According to the DHS IRB coordinator and IT officials, DHS has requested information from its component entities related to the schedules and priorities of its level 1, or top-level, investments. These officials stated that such information can then be used to develop a master milestone calendar for control reviews. Control review schedules, or master milestone calendars, are important to ensure that DHS is reviewing its highest priority IT investments in a timely manner so as to be able to affect changes to component agency approaches or even terminate a poorly managed or strategically unnecessary investment, if appropriate. DHS’s CIO also stated that the department’s CIO Council is developing a peer review process for major IT projects that is expected to include defining a life-cycle management process and a quarterly reporting process. The CIO stated that the new process is expected to be instituted by the end of March 2004. OMB took a prudent step in issuing its July memorandums directing federal agencies that were expected to be part of the new department to temporarily cease funding for new IT infrastructure and business systems investments in anticipation of the establishment of DHS. Although documentation of the implementation of the memorandums was lacking, OMB and DHS IT officials outlined an approach that included both reviewing specific IT investments and the beginning of planning for the transition to the new department. Further, DHS component agencies identified actions that they took, such as putting initiatives on hold, and other benefits that resulted from the memorandums. Nevertheless, according to OMB IT representatives, budgetary savings as a result of the July memorandums had not occurred at the time that the review group was in place. Although DHS has begun to establish a mechanism to track such savings in the future, until savings resulting from the consolidation and integration of systems and services are identified, tracked, and reported, it will remain unknown whether OMB’s July memorandums and the subsequent establishment of DHS have achieved the millions of dollars in potential economies identified by OMB. The Congress would benefit from such information in its deliberations on the department’s budget and in its oversight of DHS’s management of IT. Finally, DHS has begun to perform high-level oversight of component agency IT investments, although much remains to be accomplished and the process for this oversight is still evolving. Accordingly, DHS continues to face challenges in providing robust and constructive oversight of component agency IT investments. A significant challenge remaining is determining the current status and upcoming major milestones of IT investments subject to departmental review in order to schedule timely control reviews. To demonstrate its progress in consolidating and integrating its systems and services, we recommend that the Secretary of Homeland Security direct the Chief Information Officer to periodically report to appropriate congressional committees, the budgetary savings that have resulted from the department’s IT consolidation and integration efforts, including a breakout of the savings, the cause of the savings, and the time period in which the savings have been, or will be, generated. To ensure that IT investments subject to departmental review undergo timely control reviews, we recommend that the Secretary of Homeland Security direct the Chief Information Officer to develop a control review schedule for IT investments subject to departmental oversight (i.e., level 1, 2, and 3 investments). We received oral comments on a draft of this report from OMB and DHS. Representatives from OMB’s Office of Information and Regulatory Affairs and Office of the General Counsel generally agreed with the findings of the report. These representatives also provided a technical comment that we included in the report, as appropriate. In addition, DHS’s Office of the CIO capital planning and investment control officials stated that the report was factually accurate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the Secretary of Homeland Security and the Director, Office of Management and Budget. Copies will also be available at no charge on the GAO Web site at www.gao.gov. If you have any questions on matters discussed in this report, please contact me at (202) 512-9286 or Linda J. Lambert, Assistant Director, at (202) 512-9556. We can also be reached by e-mail at pownerd@gao.gov and lambertl@gao.gov, respectively. Another key contributor to this report was Niti Bery. Deputy Secretary (Chair) Chief Information Officer (CIO) This board also reviews all level 1 and 2 IT investments and makes recommendations to the Investment Review Board and Management Review Council DHS also plans to employ a Joint Requirements Council to serve as a working group to make recommendations to the Investment Review Board and Management Review Council on cross-cutting IT investments. The Joint Requirements Council, whose membership includes the Chief Technology Officer, Director of Strategic Sourcing and chief operating officers of DHS’s component entities, met for the first time on January 7, 2004. The General Accounting Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no cost is through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full- text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site daily. The list contains links to the full-text document files. To have GAO e-mail this list to you every afternoon, go to www.gao.gov and select “Subscribe to e-mail alerts” under the “Order GAO Products” heading.

Summary: In July 2002, the Office of Management and Budget (OMB) issued two memorandums directing agencies expected to be part of the Department of Homeland Security (DHS) to temporarily cease funding for new information technology (IT) infrastructure and business systems investments and submit information to OMB on current or planned investments in these areas. GAO was asked to (1) explain OMB's implementation of these memorandums, (2) identify any resulting changes to applicable IT investments, and (3) ascertain if DHS has initiated its own investment management reviews and, if so, what the results of these reviews have been. The July 2002 memorandums established an investment review group cochaired by OMB and the Office of Homeland Security to review submitted investments and estimated that millions of dollars potentially could be saved as a result of consolidating and integrating component agency investments. The investment review group relied on an informal, undocumented process to fulfill its responsibilities. Nevertheless, according to OMB and DHS IT officials, the review group both reviewed five component agency investments that were submitted and addressed long-term IT strategic issues related to the transition to the new department. OMB and DHS IT officials cited some changes to agency IT infrastructure and business systems investments because of the July memorandums. In addition, DHS IT officials cited other benefits that resulted from the memorandums. However, it is not known whether, or the extent to which, savings have resulted from the memorandums. In particular, OMB did not track savings associated with the July memorandums because, according to OMB IT staff, anticipated budgetary savings had not occurred at the time the review group was in place. DHS's chief information officer stated that the department plans to track savings related to the consolidation and integration of systems and has established a mechanism for doing so. However, until such savings are identified, tracked, and reported it will remain unknown whether the July memorandums and the subsequent establishment of DHS have achieved the potential economies identified by OMB. Once DHS became operational and the investment review group no longer existed, the department established its own IT investment management process, which is still evolving. As part of this process, between May 2003 and late January 2004, the DHS's highest level investment management board performed reviews of nine investments that had reached key decision points. Even with this progress, the department has identified about 100 IT programs that are eligible for review by its two top department-level boards. However, DHS has not established a process to ensure that key reviews of such IT investments are performed in a timely manner.