In March 2003, DHS began operations and set about the daunting task of merging 22 separate and autonomous federal agencies with homeland security-related missions under the centralized leadership of a single department. In doing so, DHS assumed operational control of about 209,000 civilian and military positions from these agencies. As we have previously reported, the creation and transformation of DHS is critically important and poses significant management and leadership challenges, and failure to address these challenges could have serious consequences for our national security. Consequently, in 2003, we first designated the department’s implementation and transformation as high risk, and we continue to do so today. IT is a critical tool in DHS’s quest to transform itself and carry out the department’s critical missions on a day-to-day basis. For fiscal year 2008 alone, the department is requesting almost $4 billion in IT budgetary authority. The department’s ability to effectively and efficiently invest these funds and deliver IT systems and infrastructure that perform as intended depends in large part on the capabilities of its IT human capital. As we have reported, DHS and the other federal agencies historically have been challenged in their ability to strategically manage human capital. For this reason, we first designated strategic human capital management as a governmentwide high-risk area in 2001, and we continue to do so today. To accomplish its mission, the department is organized into various agencies and directorates, each of which is responsible for specific homeland security missions and for coordinating related efforts with other DHS organizations, as well as external entities. Table 1 shows DHS’s principal organizations and their respective missions. Within DHS, responsibility for IT human capital management resides with the Management Directorate—specifically, the Offices of the CIO and the CHCO—and with component agency CIO and human capital offices. More specifically, the management directive of the DHS Office of the CIO’s states that the office is responsible for leveraging the best available technologies and applying proven IT management and human capital practices to provide shared services, coordinate acquisition strategies, maintain an enterprise architecture, and advocate and enable business transformation, among other things. To assist in managing these matters, DHS established the DHS CIO Council made up of the CIOs from each of DHS’s component organizations. The council identified eight priorities, including IT human capital, and for each priority, it assigned an executive sponsor that is responsible for overseeing the department’s efforts in that area. The council also established the IT Human Capital Resource Center (formerly called the IT Human Capital Center of Excellence) to support the council and the executive sponsor responsible for IT human capital. In short, the center is responsible for setting a DHS-wide vision and strategy for IT human capital and the functions that IT staff perform. The center is staffed by the component CIO organizations and, among other things, is responsible for coordinating the implementation of the department’s IT human capital initiatives. Figure 1 shows a simplified and partial DHS organizational structure, including the CIO IT human capital-related entities. According to the DHS overall strategic human capital plan, which covers IT and non-IT personnel, the Office of the CHCO is responsible for implementing initiatives to achieve strategic human capital goals in support of the department’s mission. With regard to IT, this includes planning and managing human capital to meet current and future mission needs, recruiting a high-quality workforce, developing a strong and capable workforce, motivating and retaining high performers, and fostering a culture of continuous learning and improvement. It also includes applying human capital best practices in carrying out these responsibilities. Each of the department’s component agencies has its own CIO and human capital director to, among other things, manage the implementation of their respective IT human capital initiatives. According to DHS, this includes recruiting staff to close competency and skill gaps, coordinating and delivering mission-essential training, analyzing workforce data, and aligning component human capital plans with the department human capital plans to achieve agency and department missions. To accomplish its mission, DHS relies extensively on IT. For example, in fiscal year 2007, about $4.16 billion dollars in funding was requested to support 278 major IT programs. Table 2 shows the fiscal year 2007 IT funding for key DHS components. To manage the use of these funds and carry out these programs, the department reports that it employs about 2,600 IT personnel. While these personnel represent about 1 percent of the department’s total workforce, they nonetheless perform critical mission functions. Specifically, IT personnel develop, manage, and operate mission-critical systems that are intended to unify the department under a common IT infrastructure and to facilitate agencies’ ability to analyze intelligence to identify threats, guard U.S. borders and airports, protect critical infrastructure, coordinate national responses to emergencies, and implement other security measures. Moreover, IT staff track and oversee the efforts of a sizable workforce of support contractors. According to DHS, the need to successfully manage its IT human capital is essential to effectively and efficiently leveraging technology in achieving the department’s mission. This need is compounded by the fact that the department faces major near-term IT human capital challenges. For example, DHS estimates that between 2005 and 2010, approximately 35 percent of its IT workforce will be eligible for retirement. Moreover, it reports that in light of the continued growth in demand of experienced IT professionals and the high rate of turnover experienced thus far, the department faces significant risk of critical skill shortages, which could hamper its mission imperatives. During the last 3 years, we have reported on the importance of DHS adopting a strategic approach to addressing its IT human capital challenges. For example, in August 2004, we reported that DHS had begun strategic planning for IT human capital at the headquarters level, but it had not yet systematically gathered baseline data about its existing workforce. We also reported on CIO staffing concerns and slow progress in this area. Accordingly, we recommended that the department analyze whether it had appropriately allocated and deployed IT staff with the relevant skills to obtain its institutional and program-related goals. In response, the DHS CIO approved funding for the IT Human Capital Resource Center in July 2004. Among other things, the center subsequently began work to complete an IT human capital plan. Consistent with our recommendation, the center was to ensure that the completed plan provided for an analysis of IT workforce skill sets. In May 2005, the DHS CIO issued a draft version of the IT human capital plan. This draft version was sent to the Senate and House Appropriations Committees on August 30, 2006, as part of the CIO’s report pursuant to requirements in DHS’s fiscal year 2006 appropriations act. According to the CIO Council senior executive leading the effort to develop this plan, it was developed in partnership with the DHS CHCO’s office and intended to direct the department’s IT human capital efforts. In March 2006, we testified on a number of IT human capital and other management challenges at DHS. We noted that DHS had undertaken a departmentwide human capital initiative, MAXHR, which was to provide greater flexibility and accountability in the way employees are paid, developed, evaluated, afforded due process, and represented by labor organizations. Part of this initiative involved the development of departmentwide workforce competencies. We testified that the department had intended to implement MAXHR in the summer of 2005 but had encountered delays. More recently, DHS officials stated that MAXHR had been canceled and is to be replaced by another initiative called the Human Capital Operational Plan. In May 2007, we reported that while DHS continues work to develop and implement departmentwide human capital initiatives, its overall progress in managing its IT and non-IT human capital had been limited. Since 2002, we have also reported on human capital management weaknesses associated with key DHS IT programs. For example: In September 2005, we reported that the program office for the Atlas program was not adequately staffed. Accordingly, we recommended that the Atlas program conduct a staffing needs assessment to determine the positions and the level of staffing needed for all Atlas projects, and that it develop a human capital strategy for meeting its staffing needs. DHS agreed with our recommendations and has since completed a needs assessment, developed a human capital strategy, and used it to staff the program office and projects. In February 2006, we reported that the US-VISIT program had developed a human capital strategy, as we had recommended 2 years earlier, and had begun implementing it. However, we also reported that several activities in the plan had not been implemented, such as assessing the extent of current employees’ competency gaps and developing a listing of competency-based training courses. To address this shortfall, among other things, the program recently developed a new human capital plan. We have not yet reviewed the new plan. In May 2006, we reported that the Automated Commercial Environment (ACE) program had yet to develop and implement a human capital management strategy, as we had recommended several years earlier. Instead, program officials told us that they were following a less formal approach to bolstering ACE’s workforce. Accordingly, we recommended that the department report to its appropriations committees on its strategy for managing ACE human capital needs. DHS agreed with our recommendation and has since been working to develop a strategy. A strategic approach to human capital management includes viewing people as assets whose value to an organization can be enhanced by investing in them. Such an approach enables organizations to effectively use their people and determine how well they integrate human capital considerations into daily decision making and planning for mission results. It also helps organizations remain aware of and be prepared for current and future needs as an organization, ensuring that they have the knowledge, skills, and abilities needed to pursue their missions. On the basis of our experience with leading organizations, we issued a model in 2002 for strategic human capital management. The model is built around four cornerstones: (1) leadership; (2) strategic human capital planning; (3) acquiring, developing, and retaining talent; and (4) results- oriented organizational cultures. We also issued a set of key practices in 2003 for effective strategic human capital management. These practices are generic, applying to any organization or component, such as an agency’s IT organization. Since then, OPM, in conjunction with OMB and us, issued a strategic human capital framework—called the Human Capital Assessment and Accountability Framework—to provide a consistent, comprehensive representation of human capital management to guide federal agencies. Consistent with our 2002 model, OPM’s framework provides six standards, along with associated indicators (practices) for achieving success. The six standards for success and related definitions are as follows: Strategic alignment. The organization’s human capital strategy is aligned with mission, goals, and organizational objectives and integrated into its strategic plans, performance plans, and budgets. Workforce planning and deployment. Among other things, the organization strategically uses staff in order to achieve mission goals in the most efficient ways. Leadership and knowledge management. The organization’s leaders and managers effectively manage people, ensure continuity of leadership, and sustain a learning environment that drives continuous improvement in performance. Results-oriented performance culture. The organization has a diverse, results-oriented, high-performance workforce and a performance management system that effectively differentiates between high and low performance and links individual, team, or unit performance to organizational goals and desired results. Talent management. The organization makes progress toward closing gaps or making up deficiencies in most mission-critical skills, knowledge, and competencies. Accountability. The organization’s human capital decisions are guided by a data-driven, results-oriented planning and accountability system. Our recent work has shown that DHS and other federal agencies, such as the Securities and Exchange Commission, have begun to use OPM’s framework as the basis for preparing strategic IT and other human capital plans. According to DHS CIO officials, they used the OPM framework in developing the IT human capital plan that they included in the August 2006 report to Congress. DHS has developed an IT human capital plan that is largely consistent with OPM guidance. Specifically, of 27 key practices in OPM’s framework, the department’s plan and related documentation fully address 15 practices and partially address the other 12, meaning that these 12 are missing elements that are essential to having a well-defined and executable plan. DHS officials responsible for developing the plan attributed the missing elements to, among other things, the department’s decision to focus its resources on other IT priorities. These officials also stated that until the missing elements are fully addressed, it is unlikely that the plan will be effectively and efficiently implemented, which in turn will continue to put DHS at risk of not having sufficient people with the right knowledge, skills, and abilities to manage and deliver its mission-critical IT systems. Examples of the key practices that DHS has fully and partially addressed in its IT human capital plan and related documentation, organized according to OPM’s six standards for success, are given in the following text. Also, table 3 is a summary of the DHS plan’s satisfaction of all 27 key practices. Appendix II contains our full analysis of the plan’s satisfaction of these 27 practices. Both the summary and full analysis contain examples to demonstrate full or partial satisfaction of the practices. They do not contain all examples of DHS’s accomplishments or limitations to a given key practice. Strategic alignment. DHS’s plan and related documentation satisfy a number of strategic alignment practices. For example, they specify human capital goals for the IT organization and provide for linking them to departmental human capital goals. More specifically, the plan identifies such IT human capital goals as meeting current and future mission needs, recruiting a high-quality IT workforce, and motivating and retaining high performers. The plan further states that IT human capital programs and initiatives should produce performance outcomes that support the overall DHS strategic goal of operational excellence. In addition, the plan calls for involving key stakeholders—such as the CIO, the CHCO, and their component agency counterparts—in carrying out a range of workforce planning activities, such as conducting a workforce analysis, developing an inventory of current staff skills, and identifying the future skills that are needed for mission-critical positions. By addressing these key practices, the plan helps set the overall direction and tone for strategic management of IT human capital and lays a foundation for demonstrating management commitment and promoting buy-in across the organization. However, the plan and related documentation do not fully satisfy other key practices. For example, they do not include specific milestones for when most defined activities and steps are to be completed. This is a serious limitation because milestones help to ensure that resources needed to execute plans are allocated, and they provide a basis for measuring progress. In addition, although the plan provides for involving key stakeholders, it does not assign stakeholders responsibility and accountability for specific activities. Without fully addressing these practices, the plan does not provide an adequate basis for promoting accountability for results, and thus ensuring that the plan will be effectively implemented. Workforce planning and deployment. The plan and related documentation satisfy a number of key practices in this standards area, including provision for incentives for new recruits, training for existing staff, and an exchange program to draw on private sector personnel with necessary skills. This is important because such practices are essential ingredients to acquiring, training, and deploying an effective workforce. However, the plan does not provide for regular collection and analysis of data on promotions, conversions, separations, and retirements to show an understanding of trends and related indicators of performance. Without this information, DHS will be limited in its ability to know whether the techniques being employed are effective, and thus performance results and accountability goals are being met. Leadership and knowledge management. DHS’s plan and supporting documentation provide for a number of leadership and knowledge management practices. For example, DHS planning documents (e.g., DHS Succession Management Plan FY 2006–2009) supporting the IT human capital plan describe and encourage leadership development across all DHS components through application of the department’s Leadership Competency Framework and succession approach to workforce planning efforts. The plan also identifies succession planning goals and objectives, implementation strategies, and program evaluation critical success factors to achieve expected leadership outcomes. These efforts are important because they show how the department and components plan for and minimize the impact of changes to its leadership team arising from retirements and separations. However, the plan does not address how these activities are to be linked to and reflected in department annual performance plans and budgets. Having performance plans and budgets that address the IT human capital goals is vital to ensuring that the plan is properly funded to ensure implementation. Results-oriented performance culture. DHS’s plan and supporting documentation satisfy key practice elements under this standards area, such as identifying outcome-based human capital goals for its IT workforce and linking these goals to departmental strategic plans. However, the plan does not address linking each work unit’s efforts and performance to these goals. Linking the work units to goals is important because it provides a framework for setting performance expectations, determining whether expectations are met, and establishing accountability, each of which is critical to effective and efficient plan implementation. Talent management. DHS’s plan addresses important practices related to talent management, including documenting mission-critical occupations, strategizing how to reduce competency gaps between the workforce’s current skills and those needed to achieve mission goals, and tracking efforts to implement strategies. In particular, it provides for a monthly forum hosted by the IT Human Capital Resource Center for DHS components to share ideas and strategies for recruitment, retention, and training of their workforces. These initiatives are important because they provide a disciplined and systematic approach to identifying and reducing organizational skill shortfalls, and thus contribute to better ensuring that DHS has the right people with the right skills. However, neither the plan nor supporting documents fully provide for measuring whether its recruitment and training efforts are closing competency gaps. Such performance measurement is vital to effective plan implementation because it provides feedback on the effectiveness of efforts and the need for corrective action. Accountability. The plan addresses the key practice for establishing and using applicable merit principles and standards in appraising IT staff performance, and for establishing a process for employee grievances to be considered and addressed. However, the plan does not fully address other accountability-related practices. For example, it does not provide for proactively identifying where the department is at risk with regard to attaining its IT human capital goals and developing initiatives to mitigate any high risks. This is a significant omission because proactively managing risks is a proven means for avoiding problems before they can occur. According to DHS officials responsible for developing the plan, the 12 key practices were not fully addressed for several reasons. Specifically, they stated that uncertainty surrounding the source of resources for implementing the plan led to a lack of a clear definition of stakeholder roles and responsibilities, which in turn made setting realistic milestones impractical. They added that a number of other IT priorities that were competing for resources, such as consolidation of data centers, also contributed to the 12 practices not being addressed, while other omissions were purely an unintended oversight, such as not addressing central management of risks. According to the officials, the next version of the plan, which is tentatively scheduled to be released in the second quarter of fiscal year 2008 based on the assumption that resources are made available, is to address all of these omissions. Without a comprehensive IT human capital plan, DHS does not have an effective means for ensuring that it has the right people in the right place at the right time to achieve the department’s mission-related IT goals. The department has acknowledged this risk and estimates there is currently a medium-to-high level of risk of not meeting DHS’s mission due to personnel and competency and skill shortages. The DHS departmental offices and component agencies that share responsibility for implementing the IT human capital plan have collectively made little progress in doing so. In general, the DHS Offices of the CHCO and the CIO have done more to implement the plan than have the DHS component agencies, as described in the following text. The plan’s state of implementation is due to both a lack of clarity around the respective implementation-related roles and responsibilities of the various DHS organizations involved, as well as the lower funding priority that these organizations have given to the plan’s implementation relative to other competing IT efforts. Until a complete and well-defined IT human capital plan is effectively and efficiently implemented, the department will continue to run the risk of not having the people it needs to leverage technology in achieving organizational transformation and mission goals. At the department level, the CIO and the CHCO organizations, working with the CIO Council’s Human Capital Resource Center, have together performed some of the tasks in the plan. For example, they have performed a gap analysis between existing and future skill needs and have begun examining strategies for reducing the identified gaps. They have also identified mission-critical occupations and skills necessary to achieve departmental goals. However, it is unclear which organization has primary responsibility for the plan. According to officials from both the Offices of the CHCO and the CIO, primary responsibility for the IT human capital plan and its implementation has recently moved from the CIO to the CHCO. However, these officials have yet to provide us with documentation of this transfer in responsibility. Despite the previously noted positive steps toward implementing the plan, officials from the CIO and the CHCO offices told us that the plan is largely not implemented. For example, while DHS is collecting information on the number of increasing, decreasing, and new mission-critical occupations, it is not identifying and analyzing year-to-year changes and trends to determine whether recruitment and retention strategies need to be updated to meet current organizational needs. In addition, although the department has documented performance goals and objectives for some work units (e.g., managers in Customs and Border Protection) and linked them to department-level organizational goals, it had not done so for much of the department. At the component level, none of the three agencies that we reviewed had begun implementing the plan, as described in the following text. The Coast Guard had not implemented the plan. According to Coast Guard officials, including the Director, Future Force, and the Chief of Human Resource Information Services, they were aware of the plan’s existence, but were unaware of any requirement to implement it. However, they stated that their own human capital efforts satisfy everything in the plan. For example, these officials said that they had performed workforce analyses to determine skill and competency gaps and have employed a range of strategies, such as strategic recruitment through direct hiring authority and internal training, to fill the gaps. The Coast Guard has yet to provide us with documentation to substantiate these statements. Customs and Border Protection had not implemented the plan, although officials from its Office of Information Technology and the Office of Human Resources Management told us that they were aware of the plan and the need to implement it. According to these officials, the agency is in the process of developing a strategy to implement the plan. They also stated that the strategy was to be completed in June 2007, but it is still under development. On August 30, 2007, the officials reported that the strategy had been completed. We have not yet received the strategy and had an opportunity to analyze it. The Federal Emergency Management Agency had not implemented the plan. Agency officials, including the Deputy CIO and the Chief of the Human Capital Branch, stated that they were aware of the plan but were unaware of a requirement to implement it. They also stated that their agency human capital efforts nevertheless were fully consistent with the plan. However, the officials have yet to provide analysis and related documentation to support these statements. In addition, the officials added that they are in the process of developing an agencywide human capital plan—addressing both IT and non-IT personnel—that is to be consistent with the plan and is to be issued on October 1, 2007. The lack of implementation progress can be attributed in part to ambiguity surrounding implementation roles and responsibilities. In particular, the plan itself is in large part silent on implementation roles and responsibilities as well as implementation accountability mechanisms. Moreover, as we have previously noted, the plan does not address important aspects of OPM’s key practices that are implementation related. To help clarify the plan, including implementation roles and responsibilities, the DHS CIO Council’s Human Capital Resource Center developed an implementation briefing and provided it to the CIO Council members in November 2005. However, the briefing does not assign specific implementation activities to specific organizations. Rather, it groups implementation activities into solution sets and then broadly assigns these sets to department and component agency CIOs, CHCOs, and human capital directors. As a result, department and component agency officials told us that they were not clear on who was responsible for what, particularly with regard to the sources of funding and staff. Moreover, as we have previously noted, officials for at least one component agency were not even aware that they were required to implement it, or what their roles and responsibilities were relative to implementation. The lack of implementation progress can also be attributed to resources being assigned to competing IT initiatives that were judged to be higher priorities. According to DHS CIO officials, including the CIO Council senior executive leading the effort, when it came time to fund implementation of the plan, the department and components decided to fund other priorities, such as DHS’s effort to consolidate multiple component data centers and create a unified departmental network. Furthermore, the IT Human Capital Resource Center program manager responsible for implementing the plan resigned in January 2006, and his replacement left in November 2006. According to DHS CIO and CHCO officials, the department has not provided funding to fill the position, which still remains vacant. Department and component officials agreed that the IT human capital plan is largely not implemented. However, they stated that they are nonetheless following many of the OPM framework practices in the plan as a by- product of fulfilling their periodic reporting requirements to OMB on the President’s Management Agenda human capital initiatives. Specifically, the department and its components are required to report quarterly to OMB on progress in meeting certain human capital goals, such as filling mission-critical positions and delivering training to strengthen key IT knowledge, skills, and abilities. For example, the actions reported to OMB require the department and components to identify mission-critical occupations and competencies, develop recruitment strategies to maintain mission-critical competencies at desired levels, and report on progress toward achieving human capital goals, which are also called for by the plan and OPM’s framework. Our analysis showed that efforts related to this reporting requirement align with about 12 of the 27 practices that we examined. DHS officials did not disagree with this analysis. This means that despite a number of IT human capital-related activities, the department and its component agencies are not implementing the full range of practices needed for effective management of IT human capital. An effective DHS IT workforce is essential to the department’s efforts to leverage technology in transforming itself and achieving mission goals and outcomes. Central to creating and sustaining such a workforce is developing a comprehensive IT human capital plan that reflects relevant guidance and best practices, and ensuring that the plan is effectively implemented. While much of such a plan has been developed, and thus a planning foundation exists upon which to build, this plan is nevertheless lacking with respect to relevant guidance and best practices aimed at, among other things, ensuring that the plan is effectively implemented. Moreover, actual implementation of the plan to date has been limited, with much remaining to be accomplished by the department CIO and CHCO organizations as well as their DHS component agency counterparts. The status of the plan and its implementation is largely attributable to the lack of clarity surrounding implementation roles and responsibilities, and the lack of priority being given to the plan’s implementation relative to competing IT priorities at the department and component agency levels. Until DHS has a comprehensive plan and follows through to ensure that it is effectively implemented departmentwide, it will remain challenged in its ability to have sufficient people with the right knowledge, skills, and abilities to effectively leverage technology in support of transformation and mission goals. To strengthen DHS’s management of IT human capital, we recommend that the Secretary of Homeland Security direct the Under Secretary for Management and the head of each DHS component agency to instruct their respective CIOs and human capital directors to make development and implementation of a comprehensive IT human capital plan an imperative within each organization. In this regard, we recommend that the Secretary direct the Under Secretary and the component agency heads to ensure that (1) IT human capital planning efforts fully satisfy relevant federal guidance and related best practices, (2) roles and responsibilities for implementing the resulting IT human capital plan and all supporting plans are clearly defined and understood, (3) resources needed to effectively and efficiently implement the plans are made available, and (4) progress in implementing the plans is regularly measured and periodically reported to DHS leadership and Congress. In written comments on a draft of this report, signed by the Director, Departmental GAO/Office of Inspector General Liaison and reprinted in appendix III, the department stated that it agreed with our recommendations. Consistent with our report, it also stated that the state of IT human capital management varies widely across DHS component organizations, and it acknowledged that a lower priority has been assigned to IT human capital relative to other IT-related matters. In addition, DHS stated that it understands the importance of IT human capital planning and that it will dedicate the resources needed to ensure that it has a highly skilled and effective IT workforce. DHS also provided what it termed additional information about ongoing and planned activities to update and clarify the status of its IT human capital efforts, particularly with regard to the key practices that we determined to be “partially satisfied.” Among other things, DHS stated that some of our determinations were based on the DHS IT Human Capital Strategic Plan (2005), which was not intended to include certain details relative to achieving results, such as milestones, time frames, and roles and responsibilities. According to DHS, this plan is a high-level strategy and not a “blueprint for execution.” Rather, it said that the IT Gap Analysis Report and Improvement Plan (2007) is the department’s “operative diagram” for achieving its human capital goals and results. We agree that the IT Gap Analysis Report and Improvement Plan (2007) is relevant to our determinations. However, we disagree that our determinations were based solely on the strategic plan. As described in our report’s scope and methodology, our determinations were based on examining all relevant documentation that the department provided for each key practice, including the IT Gap Analysis Report and Improvement Plan (2007), as well as on interviews with key officials from DHS’s Offices of the CIO and CHCO, the CIO Council executive sponsor for Human Capital issues, and officials from the department’s IT Human Capital Resource Center. Accordingly, the determinations in our draft report already recognized most of the additional information that DHS provided. In cases where new information was provided, we have incorporated, or otherwise recognized, this information in our report as appropriate. We are sending copies of this report to the Chairmen and Ranking Members of the Senate and House committees that have authorization and oversight responsibilities for homeland security and other interested congressional committees. We are also sending copies to the Directors of OMB and OPM; the DHS Secretary, Undersecretary for Management, CHCO, and CIO; the component agency heads; and other interested parties. In addition, the report will also be available without charge on GAO’s Web site at http://www.gao.gov. Should you have any questions about matters discussed in this report, please contact me at (202) 512-3439 or by e-mail at hiter@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix IV. The objectives of our review were to determine (1) whether the Department of Homeland Security’s (DHS) information technology (IT) human capital plan is consistent with federal guidance and associated best practices and (2) the status of the plan’s implementation. To address our first objective, we reviewed the department’s May 20, 2005, IT human capital plan, which DHS labeled as “Draft Final for Discussion Purposes” and submitted on August 30, 2006, to the Senate and House Appropriations Committees pursuant to requirements in DHS’s fiscal year 2006 appropriations act. We evaluated this plan and supporting documentation against selected practices in the Office of Personnel Management’s (OPM) Human Capital Assessment and Accountability Framework. We used this framework because it is the federal guidance that DHS used in developing its plan, and because the framework reflects the human capital best practices in GAO’s strategic human capital model. In addition, this framework provides a method for assessing the adequacy of a human capital plan. In applying this method, we focused on 27 practices in the framework that are essential to a well-defined and useful plan and that span the six standards areas in the framework. We also validated our use of the 27 practices with OPM. Using the framework’s method, we compared the DHS IT human capital plan and supporting documentation with each of the elements comprising the 27 practices. We also interviewed (1) officials from DHS’s Offices of the Chief Information Officer (CIO) and the Chief Human Capital Officer (CHCO); (2) the CIO Council executive sponsor for Human Capital issues; and (3) officials from the department’s IT Human Capital Resource Center, which helped develop the IT human capital plan and supporting documentation. In performing our comparative analysis, we determined if the practice was fully satisfied, partially satisfied, or not satisfied. For purposes of this review, we defined “fully satisfied” to mean that the agency demonstrated, through verifiable evidence, that it had addressed all aspects of the key practice; “partially satisfied” to mean that such evidence showed that some, but not all, aspects of the key practice had been addressed; and “not satisfied” to mean that such evidence showed that none of the aspects of the key practice had been addressed. In addition, we shared all of our preliminary determinations with officials from the DHS CIO Council and the DHS Office of the CHCO and provided them with an opportunity to comment on these determinations. These officials agreed with many of our determinations but also provided additional evidence to support revising others, which we have done and incorporated in this report. For our second objective, we reviewed plan implementation activities within the DHS Offices of the CIO and the CHCO and three DHS component agencies: the Coast Guard, Customs and Border Protection, and the Federal Emergency Management Administration. We selected these components because based on DHS’s fiscal year 2006 budget, they were among the largest with respect to total budget, IT budget, and IT staff positions. Thus, the scope of our component agency coverage extended to about $20 billion of DHS’s $40 billion total budget; $720 million of the department’s $2.2 billion IT budget; and 60 percent of its IT personnel. In each of these organizations, we requested and reviewed available documentation on its respective efforts to implement the plan, including development of supporting implementation plans, completion of tasks, and the status of ongoing efforts related to IT human capital. We also interviewed responsible officials from DHS’s Offices of the CIO and the CHCO; the Coast Guard’s Human Resources Directorate; Customs and Border Protection’s Office of Human Resources Management; and the Federal Emergency Management Administration’s Office of the CIO and its Office of Human Resources Management. We performed our work at DHS headquarters in Washington, D.C., from October 2006 through July 2007, in accordance with generally accepted government auditing standards. Key stakeholders—identified by DHS as including the CIO, the CHCO, component agency CIO and human capital directors, and the IT Human Capital Resource Center— participated in the development of the department’s IT human capital plan and workforce planning and analysis efforts. For example, in March 2005, DHS held an off-site meeting with these stakeholders to facilitate collaboration and to gather stakeholder input as part of plan development efforts. DHS’s IT human capital plan also states that the department intends to involve these stakeholders in efforts to periodically revise the plan to reflect current priorities and conditions. Furthermore, the plan and supporting documentation identify these stakeholders as participating in analyzing and identifying the department’s workforce needs and in developing a departmentwide workforce plan to fill identified gaps. The organization defines successful achievement of its mission in terms of valid and reliable data, including both long- and short-term human capital performance goals. In its IT human capital plan and supporting documentation, DHS defines accomplishing its near-term and long-term IT human capital goals and objectives in terms of qualitative and quantitative measures that are to be based on valid and reliable data, and links them to accomplishing DHS’s mission. Specifically, the plan identifies departmental human capital goals, such as recruiting a high-quality IT workforce, training its IT workforce to be capable, and retaining high performers. It also describes how these goals support the strategic goal of empowering the IT workforce and how this helps to achieve DHS’s mission. Trends in mission-critical occupations are analyzed in terms of suggested factors in order to continually adjust the agency’s recruitment and retention strategy to its current state of need. In the IT human capital plan and supporting documentation, the department provides updates for fiscal years 2004 and 2005 on, for example, the number of mission-critical occupations that are increasing, decreasing, or new. However, the plan and supporting documentation generally do not identify and analyze the year-to-year trends. For example, supporting documentation (e.g., the DHS Workforce Plan FY 2005–2008) has data for 2003 and 2004, but the year-to-year changes and trends in occupations are not identified and analyzed to determine whether the recruitment and retention strategy needs to be updated to meet the current state of organizational need. In addition, while DHS officials noted an example of one component agency (Transportation Security Administration) adjusting its recruitment and retention strategy to meet the current state of need, they stated that most components are not adjusting recruitment strategies on the basis of available occupation data. An integrated human capital planning process is in use, including representatives from the agency/unit human capital team, the primary IT human capital officer, and senior leaders and managers from mission- specific program areas. DHS’s IT human capital plan and supporting documentation identify use of a human capital planning process that includes stakeholders from across the department and component agencies. For example, in developing the IT human capital plan, the department used a process involving representatives from the department’s CHCO, CIO, and component offices, among others. This was also the case with regard to other supporting documentation. For example, in developing the DHS Workforce Plan FY 2005–2008, the department brought together stakeholders from across the department to collaborate on and produce this product. This workforce plan also defines a human capital planning process whose stated purpose is to help identify, in an integrated and cost- effective manner, the human capital resources needed to meet mission goals and develop strategies for developing or acquiring those resources. Mission-critical occupations and competencies are identified in the agency’s strategic plan and/or performance plan, and its strategic human capital plan. Although documentation supporting DHS’s IT human capital plan identifies mission-critical occupations (e.g., IT project managers and IT security specialists), the IT human capital plan and other DHS strategic and human capital plans do not. Specifically, DHS’s IT Human Capital Plan to Mitigate IT Competency and Skill Gaps and the DHS Workforce Plan FY 2005–2008 identify technical competencies and skills needed for IT occupations. However, the DHS IT human capital plan and the departmentwide strategic and human capital plans do not identify mission-critical IT occupations and competencies. While documents supporting DHS’s IT human capital plan (e.g., the November 2005 implementation briefing and the May 2007 IT Gap Analysis Report and Improvement Plan) include milestones and assign roles and responsibilities, neither these documents nor the IT human capital plan include specific time frames or milestones for when most defined activities and steps are to be completed. In addition, although the supporting documents and the plan provide for involving key stakeholders, they do not assign stakeholders responsibility and accountability for specific activities. Key human capital leaders and agency stakeholders utilize collaborative mechanisms/forums that provide a venue for consistent dialogue in the planning process (e.g., team members of review boards, working groups, or executive off-sites). DHS’s IT human capital plan and supporting documentation describe the department’s collaborative mechanisms and forums for planning strategic human capital activities. They include, for example, the DHS CIO Council, which is made up of component agency CIOs and which has monthly meetings to discuss, among other things, human capital matters. The council used this forum and off-site meetings to collaborate with the DHS CHCO office, the IT Human Capital Resource Center, and component human capital directors, among others, in developing the IT human capital plan. In addition, the department tasks the Human Capital Resource Center to bring together representatives from DHS and the components on a monthly basis to share ideas and strategies on emerging IT human capital issues. Furthermore, DHS established a Workforce Planning Council, comprising department and component agency officials, to develop a workforce plan and provide for analysis across DHS. In the IT human capital plan and supporting documentation, DHS documents a change management process that identifies human capital practices needed to achieve the department’s human capital objectives. For example, in the DHS Workforce Plan FY 2005–2008, the department describes its change management process that includes steps such as identifying departmental goals, identifying workforce requirements, developing a workforce strategy, and evaluating the effectiveness of the planning process. In addition, the IT human capital plan identifies certain practices—such as analyzing workforce needs and capabilities, developing an IT training strategy, implementing an IT leadership development program, and developing performance measures for accountability—as being critical to achieving DHS human capital objectives. Moreover, supporting documentation (e.g., DHS’s November 2005 implementation briefing) identifies traceable linkages between the practices it is intended to implement and IT human capital goals and objectives. Studies indicate which occupations and competencies are essential to achieving the agency’s strategic goals. Documentation supporting the IT human capital plan (e.g., DHS’s IT Human Capital Plan to Mitigate IT Competency and Skill Gaps) identifies occupations and competencies to achieve the agency’s strategic goals. For example, the department identified competencies within IT project management, information security, and enterprise architecture as being critical to achieving the department’s mission goals. Line managers and key staff, including human resources, consider and prepare for possible workforce changes in areas such as mission/goals, technology, program additions or deletions, functions, and outsourcing initiatives. DHS’s IT human capital plan and supporting documentation include guidance for managers and key staff to consider, plan, and prepare for changes in the department’s mission, programs, and workforce composition. Specifically, DHS’s IT human capital plan states that DHS managers should consider and prepare for changes in organizational goals, personnel, and technology. In addition, supporting documentation (e.g., the DHS Workforce Plan FY 2005–2008) acknowledges the possibility of workforce changes due to retirements and attrition. The workforce plan also states that it will serve as an integrated approach for addressing future business needs, and identifies steps that department managers should go through in planning for changes, including considering how changes will impact mission goals, programs, functions, and workforce composition. The workforce plan also states that managers should consider using alternative strategies, such as outsourcing. Turnover indicators are monitored regularly. Documentation supporting the IT human capital plan (specifically, the DHS Workforce Plan FY 2005–2008) identifies several factors to be monitored, including appointments, separations, and retirements, and assigns the responsibility for monitoring the factors to the department’s Office of the CHCO. This documentation also reports on the department’s appointments, separations, and retirements during fiscal years 2004 and 2005. A workforce analysis process is used on a regular basis for assessment and planning, and to drive human capital decisions. The IT human capital plan and supporting documentation show that DHS uses a workforce analysis process for human capital assessment, planning, and decisions. For example, supporting documentation (e.g., the DHS Workforce Plan FY 2005–2008) identifies workforce trends analyzed among cross-cutting and high-profile mission- critical occupations and the process established and followed to develop such trend data. Furthermore, the documentation also shows that DHS established a Workforce Planning Council that is responsible for ensuring that workforce planning and human capital initiatives are integrated consistently and cost-effectively across DHS. According to DHS CHCO officials, the department intends to conduct workforce analysis efforts every 2 years. However, these officials also report that not all components are using the workforce data on a regular basis to drive human capital decisions. The agency has a clearly defined strategy and plan to facilitate human capital changes. The IT human capital plan and supporting documents clearly identify human capital strategies and goals, but do not fully provide for how and when human capital changes will be made. For example, the plan defines strategic goals and objectives and states that an implementation plan is to be developed and executed with performance measures, such as milestones, deadlines, and assignment of personnel responsible for achieving them. However, as we have previously discussed, DHS developed such a plan in November 2005 (i.e., the November 2005 implementation briefing) and later updated it in the May 2007 IT Gap Analysis Report and Improvement Plan, but these documents do not include specific time frames or milestones for when most defined activities and steps are to be completed. In addition, although the document provides for involving key stakeholders, it does not assign stakeholders responsibility and accountability for specific activities. Staffing data showing trends in appointments, promotions, conversions, separations, and retirements are analyzed regularly, and management decisions regarding workforce deployment are based on documented data. The IT human capital plan and supporting documentation include analyses of staffing data for appointments, separations, and retirements that are reported to the Office of Management and Budget (OMB) on a quarterly basis. In addition, these documents (e.g., the DHS Workforce Plan FY 2005–2008) include workforce trends analyses among cross-cutting and mission-critical occupations. However, trends in these data are not fully analyzed, and, according to DHS CHCO officials, not all components are using the data on a regular basis to drive human capital decisions. The agency uses multifaceted techniques to close competency gaps within the organization (e.g., strategic recruitment, midcareer hiring, and training). The IT human capital plan and supporting documentation provide for a variety of recruitment and training techniques to be used in closing competency gaps. For example, supporting documents (e.g., DHS’s IT Human Capital Plan to Mitigate IT Competency and Skill Gaps) describe efforts planned and under way to mitigate gaps using strategic recruitment through outsourcing, private/public cross training, internal training, and e-training. Leadership development and succession needs are considered, reflected in human capital plans and strategies, and addressed through related human capital management efforts/programs. The IT human capital plan and supporting documentation, in particular DHS’s Succession Management Plan FY 2006–2009, describe practices to be followed in developing the leadership skills of DHS personnel. These documents also identify succession planning goals and objectives, implementation strategies, and program evaluation critical success factors to measure whether expected outcomes are being achieved. The agency has a strategy and plan for communication of human capital changes and progress, and to capture employee feedback related to human capital practices and needs. In its IT human capital plan and supporting documentation, DHS identifies strategies and plans for communicating changes and progress to employees. For example, the IT human capital plan includes initiatives to improve communication on human capital changes and progress, such as developing training materials and courses to educate supervisors on how to (1) take advantage of hiring flexibilities; (2) promote the use and accessibility of departmentwide training opportunities, including e-learning; and (3) provide Web-based information on training and human capital policies and procedures. In addition, supporting documentation, such as the DHS Workforce Plan FY 2005–2008, includes a communications plan on how to keep DHS personnel informed on workforce changes, including the department’s progress in implementing them. Furthermore, according to DHS CHCO and CIO officials, the department captures employee feedback on its practices through representatives to the IT Human Capital Resource Center and also through annual IT staff surveys. Annual performance plans, budgets, and performance reports document plans for and progress toward human capital goals. As directed by OMB, DHS reports quarterly on its progress on human capital goals. However, DHS’s IT human capital plan and supporting documentation do not provide for developing annual performance plans, budget documents, or performance reports that discuss plans for and progress against human capital goals. In addition, the information reported to OMB is primarily on DHS efforts to close IT competencies and skills gaps, which is just one of the multiple goals and objectives in DHS’s plan and supporting documentation. Work units have documented performance goals and objectives linked to the agency strategic plan and performance plan. Although DHS’s IT human capital plan and related documentation support having measurable performance goals for work units, such performance plans and measures have not been fully developed. For example, DHS CIO and CHCO officials stated that although the department has documented performance goals and objectives for some work units (e.g., managers in Customs and Border Protection) and linked them to department-level organizational goals, it had not done so for much of the department. Specifically, only managers in the DHS CHCO’s office and also at Customs and Border Protection have performance objectives that are linked to strategic plans. The agency’s strategic planning process documents and tracks mission-critical occupations and competency gap-reduction efforts. DHS’s IT human capital plan and supporting documentation provide details on the department’s strategic planning process, including the reporting and tracking of mission-critical occupations and efforts to reduce competency gaps. For example, in supporting documentation (e.g., the DHS Workforce Plan FY 2005– 2008), the department describes a workforce planning process that is to help identify the human capital resources needed to meet mission goals and develop strategies for developing or acquiring those resources. In addition, other supporting documentation (e.g., the IT Human Capital Plan to Mitigate IT Competency and Skill Gaps) identifies mission-critical IT occupations and high-level efforts needed to close its competency gaps. The department uses its OMB quarterly reports to document and track the status of efforts to close those competency gaps. Strategies are developed and implemented for reducing competency gaps through training, development, or alternative sources. As described in its IT human capital plan and supporting documentation, DHS’s strategies to close its competency gaps consist of a number of human capital initiatives, including training, staff development, and an outside executive exchange program. Specifically, DHS’s IT Human Capital Plan to Mitigate IT Competency and Skill Gaps details planned and ongoing efforts to mitigate gaps using, for example, strategic recruitment through outsourcing, private/public cross training, internal training, and e-training. The IT human capital plan and supporting documentation state that data on its progress toward meeting human capital goals will be reported to OMB and DHS management as required; they do not, however, specify what data are to be reported. The department reports quarterly to OMB on the status of efforts to close competency gaps. In addition, a recently completed (May 2007) DHS workforce survey and gap analysis identify existing IT competency gaps, but do not indicate any progress in closing them. According to DHS CHCO and CIO officials, the department to date has had limited resources and data available to assess the effectiveness of ongoing efforts to close competency gaps. They further stated that they intend to use the newly completed analysis as a baseline for measuring the success of future efforts. Recruitment strategies are created to maintain mission-critical competencies at the desired level using business forecasting and workforce analysis results. Documentation supporting DHS’s IT human capital plan provides for developing recruiting strategies based on workforce forecasting and analysis results. For example, the DHS Workforce Plan FY 2005–2008 states that the department is to use a strategic approach to recruitment and workforce planning. In addition, it identifies a DHS corporate recruitment workgroup, which includes senior human resources and civil rights staff throughout DHS, who are to assess departmentwide recruitment activities and tools; coordinate participation in recruitment fairs; and develop recruitment strategies and activities for crosscutting occupations, primarily entry-level positions. In May 2007, the department developed an improvement plan that provides updated strategies for addressing competency gaps and maintaining mission-critical competencies. This plan is based on the analysis of a recently completed workforce survey. Human capital risks are tracked, documented, and reported to a central advisory or management board, and action is taken to mitigate high-risk areas. Documents supporting DHS’s IT human capital plan (e.g., the IT Human Capital Plan to Mitigate IT Competency and Skill Gaps and the IT Gap Analysis Report and Improvement Plan) identify and document some but not all key human capital risks and do not provide for reporting risks to management or a management board. More specifically, these plans document that failure to fill critical competency and skill sets (e.g., IT project management and IT security) poses a medium-to-high human capital risk to DHS’s ability to achieve mission goals. However, DHS CHCO and CIO officials acknowledged that the department does not track these risks through any formal mechanism. In addition, they stated that DHS has not established a comprehensive effort to identify and track the full range of human capital risks facing the department, as well as reporting those risks to management or a central advisory or management board. Applicable merit principles and standards are upheld, and employee grievances are considered and addressed. DHS’s IT human capital plan and supporting documentation provide for the application and enforcement of merit principles and standards and for considering and addressing employee grievances. For example, the plan recognizes that the department has legislative and regulatory requirements to implement performance-based management practices, including merit principles and standards, for its IT workforce. In addition, an OPM analysis of DHS’s human resources management operations reports that the department’s human resources management operates in a consistent manner with merit principles. Moreover, DHS has a policy directive that defines the process for administering its employee grievance system. The department also regularly reports to management and employees on the number of grievances filed and resolved as well as the number of cases outstanding. Program and initiative implementation efforts include published plans that clearly outline periodic review of performance and desired outcomes. DHS’s IT human capital plan and supporting documentation provide for performance reviews of desired outcomes. For example, supporting documentation (specifically, DHS’s IT Human Capital Plan to Mitigate IT Competency and Skill Gaps and IT Gap Analysis Report and Improvement Plan) provides analyses and snapshots of the department’s performance in trying to close gaps in mission-critical competencies. However, these competency gap snapshots do not constitute a comprehensive review and evaluation of progress against all of the objectives established in the human capital plan. In addition, DHS’s IT human capital plan and supporting documentation do not clearly outline or identify time frames for periodic review. DHS CHCO and CIO officials stated that they intend to address this in future revisions to the plan. DHS’s IT human capital plan does not clearly assign accountability for human capital improvements or provide for regular assessments of that accountability. However, documents supporting the plan (specifically, the department’s November 2005 implementation briefing and the May 2007 IT Gap Analysis Report and Improvement Plan) do assign accountability and responsibility for human capital improvements. For example, the documents assign accountability to the DHS CHCO, DHS CIO, and component agency heads to make improvements related to closing selected competency gaps. However, the documents do not provide for assessing accountability on a regular basis and using the results as an input into future planning and resource allocation decisions. DHS CHCO and CIO officials stated that while data related to competency gaps are used as an input, data regarding accountability are not. In addition to the individual named above, Gerard Aflague, Mathew Bader, Justin Booth, Barbara Collier, S. Mike Davis, Bill Doherty (Assistant Director), and Gary Mountjoy (Assistant Director) made key contributions to this report.

Summary: In performing its missions, the Department of Homeland Security (DHS) relies extensively on information technology (IT). Recognizing this, DHS's fiscal year 2006 appropriations act required its Chief Information Officer (CIO) to submit a report to congressional appropriations committees that includes, among other things, an IT human capital plan, and the act directs GAO to review the report. GAO's review addressed (1) whether the IT human capital plan is consistent with federal guidance and associated best practices and (2) the status of the plan's implementation. In performing its review, GAO compared DHS's plan and supporting documentation with 27 practices in the Human Capital Assessment and Accountability Framework of the Office of Personnel Management, and examined plan implementation activities at three DHS component agencies. DHS's IT human capital plan is largely consistent with federal guidance and associated best practices; however, it does not fully address a number of important practices that GAO examined. Specifically, the plan and supporting documentation fully address 15 practices; for example, they provide for developing a complete inventory of existing staff skills, identifying IT skills that will be needed to achieve agency goals, determining skill gaps, and developing plans to address such gaps. They also provides for involving key stakeholders--such as the CIO, the Chief Human Capital Officer (CHCO), and component agency CIOs and human capital directors--in carrying out the skill gap analyses and other workforce planning activities. Nevertheless, elements of 12 of the 27 practices are not included in the plan or related documentation. For example, although the plan and supporting documents describe the department's IT human capital goals and steps necessary to implement them, most steps do not include associated milestones. In addition, although the plan and supporting documents provide for involving key stakeholders, they do not specifically assign these stakeholders responsibility and accountability for carrying out planned activities. These and other missing elements of the practices are important because they help ensure that the plan is implemented efficiently and effectively. DHS officials provided various reasons why the missing practices were omitted, including uncertainty surrounding the source of resources for implementing the plan and the demands of other IT priorities, such as consolidating component agency data centers. To date, DHS has made limited progress in implementing the plan, according to officials from the offices of the department's CIO and CHCO and three DHS agencies (the Coast Guard, Customs and Border Protection, and the Federal Emergency Management Agency). These officials said that they are nonetheless following several of the practices because they are required to report quarterly to the Office of Management and Budget on progress in meeting such human capital goals as filling mission-critical positions and delivering key IT training. DHS officials stated that the department's limited progress in implementing the plan was due to its focus on other priorities, and ambiguity surrounding plan implementation roles and responsibilities. Until DHS has a complete plan that fully addresses all practices and the department and components implement the plan, DHS will continue to be at risk of not having sufficient people with the right knowledge, skills, and abilities to manage and deliver the IT systems that are essential to executing the department's mission and achieving its transformation goals.