In July 2002, President Bush issued the National Strategy for Homeland Security. The strategy set forth overall objectives to prevent terrorist attacks within the United States, reduce America’s vulnerability to terrorism, and minimize the damage and assist in the recovery from attacks that occur. The strategy set out a plan to improve homeland security through the cooperation and partnering of federal, state, local, and private sector organizations on an array of functions. The National Strategy for Homeland Security specified a number of federal departments, as well as nonfederal organizations, that have important roles in securing the homeland. In terms of federal departments, DHS was assigned a leading role in implementing established homeland security mission areas. In November 2002, the Homeland Security Act of 2002 was enacted into law, creating DHS. This act defined the department’s missions to include preventing terrorist attacks within the United States; reducing U.S. vulnerability to terrorism; and minimizing the damages, and assisting in the recovery from, attacks that occur within the United States. The act also specified major responsibilities for the department, including to analyze information and protect infrastructure; develop countermeasures against chemical, biological, radiological, and nuclear, and other emerging terrorist threats; secure U.S. borders and transportation systems; and organize emergency preparedness and response efforts. DHS began operations in March 2003. Its establishment represented a fusion of 22 federal agencies to coordinate and centralize the leadership of many homeland security activities under a single department. A variety of factors have affected DHS’s efforts to implement its mission and management functions. These factors include both domestic and international events, such as Hurricanes Katrina and Rita, and major homeland security-related legislation. Figure 1 provides a timeline of key events that have affected DHS’s implementation. Our report assesses DHS’s progress across 14 mission and management areas. We based these areas on those identified in the National Strategy for Homeland Security, the goals and objectives set forth in the DHS strategic plan and homeland security presidential directives, our reports, and studies conducted by the DHS IG and other organizations and groups, such as the 9/11 Commission and the Century Foundation. The 14 we identified are 5. Surface transportation security 7. Emergency preparedness and response 8. Critical infrastructure and key resources protection 9. Science and technology 12. Human capital management 13. Information technology management 14. Real property management For each mission and management area, we identified performance expectations and vetted them with DHS officials. These performance expectations are a composite of the responsibilities or functions—derived from legislation, homeland security presidential directives and executive orders, DHS planning documents, and other sources—that the department is to achieve. Our analysts and subject matter experts reviewed our prior work, DHS IG work, and evidence DHS provided between March and July 2007, including DHS officials’ assertions when supported by documentation. On the basis of this analysis and our experts’ judgment, we then assessed the extent to which DHS had achieved each of the expectations we identified. We made preliminary assessments for each performance expectation based solely on GAO and DHS IG work. In March through July, we received additional information from DHS, which we reviewed and used to inform our final assessments. In some cases the assessments remained the same as our preliminary ones, and in other cases they changed. When our review of our prior work, the DHS IG’s work, and DHS’s documentation indicated that DHS had satisfied most of the key elements of a performance expectation, we concluded that DHS had generally achieved it. When our reviews showed that DHS had not yet satisfied most of the key elements of a performance expectation, we concluded that DHS had generally not achieved it. More specifically, where our prior work or that of the DHS IG indicated DHS had not achieved a performance expectation and DHS did not provide documentation to prove otherwise, we concluded that DHS had generally not achieved it. For a small number of performance expectations we could not make an assessment because neither we nor the DHS IG had completed work and the information DHS provided did not enable us to clearly assess DHS’s progress. We used these performance expectation assessments to determine DHS’s overall progress in each mission and management area. After making an assessment for each performance expectation, we added up those rated as generally achieved. We divided this number by the total number of performance expectations for the mission or management area, excluding those performance expectations for which we could not make an assessment. If DHS generally achieved more than 75 percent of the identified performance expectations, we identified its overall progress as substantial. When the number achieved was more than 50 percent but 75 percent or less, we identified its overall progress as moderate. If DHS generally achieved more than 25 percent but 50 percent or less, we identified its overall progress as modest. For mission and management areas in which DHS generally achieved 25 percent or less of the performance expectations, we identified overall progress as limited. We and the DHS IG have completed varying degrees of work for each mission and management area, and DHS’s components and offices provided us with different amounts and types of information. As a result, our assessments of DHS’s progress in each mission and management area reflect the information available for our review and analysis and are not equally comprehensive across all 14 mission and management areas. It is also important to note that while there are qualitative differences between the performance expectations, we did not weigh some more heavily than others in our overall assessments of mission and management areas. We also recognize that these expectations are not time bound, and DHS will take actions to satisfy these expectations over a sustained period of time. Our assessment of DHS’s progress relative to each performance expectation refers to the progress made by the department since March 2003 and does not imply that DHS should have fully achieved each performance expectation at this point. In commenting on a draft of our report, DHS took issues with our methodology. First, DHS believed that we altered the criteria we used to judge the department’s progress. We did not change our criteria; rather we made a change in terminology to better convey the intent behind the performance expectations that DHS achieve them instead of merely take actions that apply or relate to them. Second, DHS took issue with the binary standard approach we used to assess each performance expectation. We acknowledge the limitations of this standard in our report but believe it was appropriate for our review given that the Administration has generally not established quantitative goals and measures for the expectations. Therefore, we could not assess where along a spectrum of progress DHS stood in achieving each performance expectation. Third, DHS was concerned about an apparent shift in criteria we applied after the department provided us additional information and documents. What DHS perceived as a change in criteria for certain performance expectations was really the process by which we disclosed our preliminary assessment; analyzed additional documents and information from DHS; and updated and, in many cases revised, our assessments based on the additional inputs. Fourth, DHS raised concerns with consistency in our application of the methodology. Our core team of GAO analysts and managers reviewed all inputs from GAO staff to ensure consistent application of our methodology, criteria, and analytical process, and our quality control process included detailed reviews of the report’s facts as well as assurances that we followed generally accepted government auditing standards. Finally, DHS points outs that we treated all performance expectations as if they were of equal significance. In our report, we acknowledged that differences exist, but we did not weight the performance expectations because congressional, departmental, and others’ views on the relative priority of each expectation may be different, and we did not believe it was appropriate to substitute our judgment for theirs. Overall, we appreciate DHS’s concerns and recognize that in such a broad- based endeavor, some level of disagreement is inevitable, especially at any given point in time. However, we have been as transparent as possible regarding our purpose, methodology, and professional judgments and believe that our methodology provides a sound basis for the progress report. Our report shows that since March 2003, DHS has attained some level of progress in implementing the performance expectations in all of its major mission and management areas, but the rate of progress among these areas has varied. Overall, DHS has made more progress in its mission areas than in its management areas, reflecting an understandable focus on implementing efforts to secure the homeland. As DHS continues to mature as an organization, we believe it will be able to put more focus—and achieve more expectations—in the management areas. Within its mission areas, DHS has made more progress in developing strategies, plans, and programs than in implementing them. For example, in the area of border security we found that DHS has developed a multiyear strategy and initiative for identifying illegal border crossings between ports of entry. However, DHS is in the early stages of implementing this strategy, and we and the DHS IG identified problems with implementation of past programs with similar objectives. Likewise, in the area of emergency preparedness and response, DHS has developed the National Incident Management System. However, we have reported that much more work remains for DHS to effectively coordinate its implementation. Below we provide more information on progress made by DHS in its mission and management areas. DHS’s border security mission includes detecting and preventing terrorists and terrorist weapons from entering the United States; facilitating the orderly and efficient flow of legitimate trade and travel; interdicting illegal drugs and other contraband; apprehending individuals who are attempting to enter the United States illegally; inspecting inbound and outbound people, vehicles, and cargo; and enforcing laws of the United States at the border. As shown in table 2, we identified 12 performance expectations for DHS in the area of border security and found that DHS has generally achieved 5 of them and has generally not achieved 7 others. DHS’s immigration enforcement mission includes apprehending, detaining, and removing criminal and illegal aliens; disrupting and dismantling organized smuggling of humans and contraband as well as human trafficking; investigating and prosecuting those who engage in benefit and document fraud; blocking and removing employers’ access to undocumented workers; and enforcing compliance with programs to monitor visitors. As shown in table 3, we identified 16 performance expectations for DHS in the area of immigration enforcement and found that DHS has generally achieved 8 of them and has generally not achieved 4 others. For 4 performance expectations, we could not make an assessment. DHS’s immigration services mission includes administering immigration benefits and working to reduce immigration benefit fraud. As shown in table 4, we identified 14 performance expectations for DHS in the area of immigration services and found that DHS has generally achieved 5 of them and has generally not achieved 9 others. DHS’s aviation security mission includes strengthening airport security; providing and training a screening workforce; prescreening passengers against terrorist watch lists; and screening passengers, baggage, and cargo. As shown in table 5, we identified 24 performance expectations for DHS in the area of aviation security and found that DHS has generally achieved 17 of them and has generally not achieved 7 others. DHS’s surface transportation security mission includes establishing security standards and conducting assessments and inspections of surface transportation modes, which include passenger and freight rail; mass transit; highways, including commercial vehicles; and pipelines. As shown in table 6, we identified 5 performance expectations for DHS in the area of surface transportation security and found that DHS has generally achieved 3 of them and has generally not achieved 2. DHS’s maritime security responsibilities include port and vessel security, maritime intelligence, and maritime supply chain security. As shown in table 7, we identified 23 performance expectations for DHS in the area of maritime security and found that DHS has generally achieved 17 of them and has generally not achieved 4 others. For 2 performance expectations, we could not make an assessment. DHS’s emergency preparedness and response mission includes preparing to minimize the damage and recover from terrorist attacks and disasters; helping to plan, equip, train, and practice needed skills of first responders; and consolidating federal response plans and activities to build a national, coordinated system for incident management. As shown in table 8, we identified 24 performance expectations for DHS in the area of emergency preparedness and response and found that DHS has generally achieved 5 of them and has generally not achieved 18 others. For 1 performance expectation, we could not make an assessment. DHS’s critical infrastructure and key resources protection activities include developing and coordinating implementation of a comprehensive national plan for critical infrastructure protection, developing partnerships with stakeholders and information sharing and warning capabilities, and identifying and reducing threats and vulnerabilities. As shown in table 9, we identified 7 performance expectations for DHS in the area of critical infrastructure and key resources protection and found that DHS has generally achieved 4 of them and has generally not achieved 3 others. DHS’s science and technology efforts include coordinating the federal government’s civilian efforts to identify and develop countermeasures to chemical, biological, radiological, nuclear, and other emerging terrorist threats. As shown in table 10, we identified 6 performance expectations for DHS in the area of science and technology and found that DHS has generally achieved 1 of them and has generally not achieved 5 others. DHS’s acquisition management efforts include managing the use of contracts to acquire goods and services needed to fulfill or support the agency’s missions, such as information systems, new technologies, aircraft, ships, and professional services. As shown in table 11, we identified 3 performance expectations for DHS in the area of acquisition management and found that DHS has generally achieved 1 of them and has generally not achieved 2 others. DHS’s financial management efforts include consolidating or integrating component agencies’ financial management systems. As shown in table 12, we identified 7 performance expectations for DHS in the area of financial management and found that DHS has generally achieved 2 of them and has generally not achieved 5 others. DHS’s key human capital management areas include pay, performance management, classification, labor relations, adverse actions, employee appeals, and diversity management. As shown in table 13, we identified 8 performance expectations for DHS in the area of human capital management and found that DHS has generally achieved 2 of them and has generally not achieved 6 others. DHS’s information technology management efforts include developing and using an enterprise architecture, or corporate blueprint, as an authoritative frame of reference to guide and constrain system investments; defining and following a corporate process for informed decision making by senior leadership about competing information technology investment options; applying system and software development and acquisition discipline and rigor when defining, designing, developing, testing, deploying, and maintaining systems; establishing a comprehensive, departmentwide information security program to protect information and systems; having sufficient people with the right knowledge, skills, and abilities to execute each of these areas now and in the future; and centralizing leadership for extending these disciplines throughout the organization with an empowered Chief Information Officer. As shown in table 14, we identified 13 performance expectations for DHS in the area of information technology management and found that DHS has generally achieved 2 of them and has generally not achieved 8 others. For 3 performance expectations, we could not make an assessment. DHS’s responsibilities for real property management are specified in Executive Order 13327, “Federal Real Property Asset Management,” and include establishment of a Senior Real Property Officer, development of an asset inventory, and development and implementation of an asset management plan and performance measures. As shown in table 15, we identified 9 performance expectations for DHS in the area of real property management and found that DHS has generally achieved 6 of them and has generally not achieved 3 others. Our report contains detailed information on DHS’s progress in achieving each of the performance expectations, including a detailed summary of our work, the DHS IG’s work, and DHS documentation and officials’ statements. We also provide our basis for each assessment. In commenting on a draft of our report, DHS disagreed with our assessments for 42 of the 171 performance expectations noted above. In our report, we provide detailed responses to DHS’s comments on the 42 performance expectations. We look forward to discussing our assessments in all the mission and management areas in more detail with the committee and subcommittees to help inform their ongoing oversight efforts. Our work has identified cross-cutting issues that have hindered DHS’s progress in its mission and management areas. These issues include: (1) transforming and integrating DHS’s management functions; (2) establishing baseline performance goals and measures and engaging in effective strategic planning efforts; (3) applying and improving a risk management approach for implementing missions and making resource allocation decisions; (4) sharing information with key stakeholders; and (5) coordinating and partnering with federal, state, local, and private sector agencies entities. The creation of DHS is an enormous management challenge, and DHS faces a formidable task in its transformation efforts as it works to integrate over 170,000 federal employees from 22 component agencies. Each component agency brought differing missions, cultures, systems, and procedures that the new department had to efficiently and effectively integrate into a single, functioning unit. At the same time it weathers these growing pains, DHS must still fulfill its various homeland security and other missions. DHS has developed a strategic plan, is working to integrate some management functions, and has continued to form necessary partnerships to achieve mission success. Despite these efforts, we reported earlier this year that DHS implementation and transformation remains high-risk because DHS has not yet developed a comprehensive management integration strategy and its management systems and functions⎯especially related to acquisition, financial, human capital, and information management⎯are not yet fully integrated and wholly operational. A number of DHS’s programs lack outcome goals and measures, a fact that may hinder the department’s ability to effectively assess the results of program efforts or fully assess whether the department is using resources effectively and efficiently, especially given various agency priorities for resources. In particular, we have reported that some of DHS’s components have not developed adequate outcome-based performance measures or comprehensive plans to monitor, assess, and independently evaluate the effectiveness of their plans and performance. For example, in August 2005 we reported that U.S. Immigration and Customs Enforcement lacked outcome goals and measures for its worksite enforcement program and recommended that the agency set specific time frames for developing these goals and measures. Further, we have reported that many of DHS’s border- related performance goals and measures are not fully defined or adequately aligned with one another, and some performance targets are not realistic. We have also recognized that DHS faces some inherent difficulties in developing performance goals and measures to address its unique mission and programs, such as in developing measures for the effectiveness of its efforts to prevent and deter terrorist attacks. Within its sphere of responsibility, DHS cannot afford to protect everything against all possible threats. As a result, DHS must make choices about how to allocate its resources to most effectively manage risk. In April 2007, DHS established the new Office of Risk Management and Analysis to serve as the DHS Executive Agent for national-level risk management analysis standards and metrics; develop a standardized approach to risk; develop an approach to risk management to help DHS leverage and integrate risk expertise across components and external stakeholders; assess DHS risk performance to ensure programs are measurably reducing risk; and communicate DHS risk management in a manner that reinforces the risk-based approach. It is too early to tell what effect this office will have on strengthening departmentwide risk management activities. Several DHS component agencies have taken steps toward integrating risk- based decision making into their decision-making processes. For example, the Coast Guard has developed security plans for seaports, facilities, and vessels based on risk assessments. Other components have not always utilized such an approach. In addition, DHS has not performed comprehensive risk assessments in transportation, critical infrastructure, and the immigration and customs systems to guide resource allocation decisions. For example, DHS has not fully utilized a risk-based strategy to allocate resources among transportation sectors. Although TSA has developed tools and processes to assess risk within and across transportation modes, it has not fully implemented these efforts to drive resource allocation decisions. In 2005, we designated information sharing for homeland security as high-risk and continued that designation in 2007. We recently reported that the nation still lacked an implemented set of governmentwide policies and processes for sharing terrorism-related information but has issued a strategy on how it will put in place the overall framework, policies, and architecture for sharing with all critical partners—actions that we and others have recommended. DHS has taken some steps to implement its information-sharing responsibilities. For example, DHS implemented a network to share homeland security information. States and localities are also creating their own information “fusion” centers, some with DHS support. However, DHS did not fully adhere to key practices in coordinating efforts on its homeland security information network with state and local information sharing initiatives and faces other information-sharing challenges, including developing productive information-sharing relationships among the federal government, state and local governments, and the private sector. To secure the nation, DHS must form effective and sustained partnerships among legacy component agencies and also with a range of other entities, including other federal agencies, state and local governments, the private and nonprofit sectors, and international partners, but has faced difficulties in doing so. Thirty-three of the 43 initiatives the National Strategy for Homeland Security are required to be implemented by three or more federal agencies. In addition, the private sector is a key homeland security partner. For example, DHS must partner with individual companies and organizations to protect vital national infrastructure, such as the nation’s water supply, transportation systems, and chemical facilities. In October 2006 we reported that all 17 critical infrastructure sectors had established their respective government councils, and nearly all sectors had initiated their voluntary private sector councils in response to the National Infrastructure Protection Plan. In addition, through its Customs-Trade Partnership Against Terrorism Program, CBP has worked in partnership with private companies to review their supply chain security plans. However, DHS has faced some challenges in developing other effective partnerships and in clarifying the roles and responsibilities of various homeland security stakeholders. For example, federal and private sector stakeholders stated that the Transportation Security Administration (TSA) has not provided them with the information they would need to support TSA’s efforts for the Secure Flight program. Further, lack of clarity regarding roles and responsibilities caused DHS difficulties in coordinating with its emergency preparedness and response partners in responding to Hurricanes Katrina and Rita. Given the leading role that DHS plays in securing the homeland, it is critical that the department’s mission programs and management systems and functions operate as efficiently and effectively as possible. In the more than 4 years since its establishment, the department has taken important actions to secure the border and the transportation sector and to defend against, prepare for, and respond to threats and disasters. DHS has had to undertake these critical missions while also working to transform itself into a fully functioning cabinet department—a difficult undertaking for any organization and one that can take, at a minimum, 5 to 7 years to complete even under less daunting circumstances. At the same time, a variety of factors, including Hurricanes Katrina and Rita, threats to and attacks on transportation systems in other countries, and new responsibilities and authorities provided by Congress have forced the department to reassess its priorities and reallocate resources to address key domestic and international events and to respond to emerging issues and threats. As it moves forward, DHS will continue to face the challenges that have affected its operations thus far, including transforming into a high- performing, results-oriented agency; developing results-oriented goals and measures to effectively assess performance; developing and implementing a risk-based approach to guide resource decisions; and establishing effective frameworks and mechanisms for sharing information and coordinating with homeland security partners. DHS has undertaken efforts to address these challenges but will need to give continued attention to these efforts in order to efficiently and effectively identify and prioritize mission and management needs, implement efforts to address those needs, and allocate resources accordingly. Efforts to address these challenges are especially important given the threat environment and long-term fiscal imbalance facing the nation. While this testimony contains no new recommendations, in past products GAO has made approximately 700 recommendations to DHS. DHS has implemented some of these recommendations and taken actions to implement others. However, we have reported that the department still has much to do to ensure that it conducts its missions efficiently and effectively while it simultaneously prepares to address future challenges that face the department and the nation. A well-managed, high-performing Department of Homeland Security is essential to meeting the significant homeland security challenges facing the nation. As DHS continues to evolve, implement its programs, and integrate its functions, we will continue to review its progress and performance and provide information to Congress and the public on its efforts. This concludes my prepared statement. I would be pleased to answer any questions you and the Committee members may have. For further information about this testimony, please contact Norman J. Rabkin, Managing Director, Homeland Security and Justice, at 202-512- 8777 or rabkinn@gao.gov. Other key contributors to this statement were Jason Barnosky, Rebecca Gambler, Kathryn Godfrey, Christopher Keisling, Thomas Lombardi, Octavia Parks, and Sue Ramanathan. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The Department of Homeland Security's (DHS) recent 4-year anniversary provides an opportunity to reflect on the progress DHS has made. The creation of DHS was one of the largest federal reorganizations in the last several decades, and GAO has reported that it was an enormous management challenge and that the size, complexity, and importance of the effort made the challenge especially daunting and critical to the nation's security. Our prior work on mergers and acquisitions has found that successful transformations of large organizations, even those faced with less strenuous reorganizations than DHS, can take at least 5 to 7 years to achieve. This testimony is based on our August 2007 report evaluating DHS's progress since March 2003. Specifically, it addresses DHS's progress across 14 mission and management areas and key themes that have affected DHS's implementation efforts. Since its establishment in March 2003, DHS has made varying levels of progress in implementing its mission and management areas, as shown in the following table. In general, DHS has made more progress in its mission areas than in its management areas. Within its mission areas, DHS has made progress in developing plans and programs, but has faced challenges in its implementation efforts. Key underlying themes have affected DHS's implementation efforts. These include strategies to achieve agency transformation, strategic planning and results management, risk management, information sharing, and partnerships and coordination. For example, we have designated DHS's implementation and transformation as high-risk. While DHS has made progress in transforming its component agencies into a fully functioning department, it has not yet addressed elements of the transformation process, such as developing a comprehensive transformation strategy. DHS also has not yet fully adopted and applied a risk management approach in implementing its mission and management functions. Some DHS component agencies have taken steps to do so, but this approach is not yet used departmentwide. In addition, DHS has taken steps to share information and coordinate with homeland security partners but has faced difficulties in these partnership efforts. Given DHS's leading role in securing the homeland, it is critical that the department's mission and management programs operate as efficiently and effectively as possible. DHS has taken important actions to secure the border and transportation sectors and to prepare for and respond to disasters. DHS has had to undertake these missions while also working to transform itself into a fully functioning cabinet department--a difficult task for any organization. As DHS moves forward, it will be important for the department to continue to develop more measurable goals to guide implementation efforts and to enable better accountability. It will also be important for DHS to continually reassess its mission and management goals, measures, and milestones to evaluate progress made, identify past and emerging obstacles, and examine alternatives to effectively address those obstacles.