DHS has some of the most extensive acquisition needs within the federal government. In fiscal year 2007, DHS obligated about $12 billion to acquire goods and services ranging from the basic goods and services federal agencies purchase, such as information technology equipment and support, to more complex and unique acquisitions, such as airport security systems and Coast Guard ships. DHS and its component agencies have faced a number of challenges related to procuring services and major system acquisitions. When DHS was formed in 2003, it was responsible for integrating 22 agencies with disparate missions. Of these, only seven came with their own procurement offices, only some of which had also managed complex acquisitions such as the Coast Guard’s Deepwater program or TSA’s airport screening programs. While the Homeland Security Acquisition Manual and the Federal Acquisition Regulation (FAR) do not distinguish between the terms acquisition and procurement, DHS officials have noted that procurement—the actual transaction to acquire goods and services—is only one element of acquisition. The term acquisition can include the development of operational and life-cycle requirements, such as formulating concepts of operations, developing sound business strategies, exercising prudent financial management, assessing trade-offs, and managing program risks. We have identified three key performance areas for acquisition management: assessing and organizing acquisition functions to meet agency needs; developing clear and transparent policies and processes for all acquisitions; developing an acquisition workforce to implement and monitor acquisitions. Our prior work has shown that these are among the key elements of an efficient, effective, and accountable acquisition function. We testified in April 2008 that, despite its initial positive acquisition management efforts, several challenges remained. The following summarizes each of these three areas: Assessing and organizing the acquisition function: Since it was created in 2003, DHS has recognized the need to improve acquisition outcomes, and has taken some steps to organize and assess the acquisition function. DHS has worked to integrate the disparate acquisition processes and systems that the component organizations brought with them when the department was created. To help assess acquisition management, in 2005 the Department developed an oversight program. This program incorporates DHS policy, internal controls, and elements of an effective acquisition function. This program has been partially implemented and monitors component-level performance through four recurring reviews: self-assessments; operational status; on-site; and acquisition planning. However, DHS has not yet accomplished its goal of integrating the acquisition function across the department. For example, the structure of DHS’s acquisition function creates ambiguity about who is accountable for acquisition decisions because it depends on a system of dual accountability and cooperation and collaboration between the CPO and the component heads. DHS officials stated in June 2007 that that they were in the process of modifying the lines of business management directive to clarify the CPO’s authority; however, this directive has yet to be approved. Developing clear and transparent polices and processes: DHS had made some progress in this area but has generally not developed clear and transparent policies and processes for all acquisitions. Specifically, DHS put into place an investment review process in 2003 that adopts many acquisition best practices to help the department reduce risk and increase the chances for successful investment in terms of cost, schedule, and performance. However, in 2005, we found that the process did not include critical management reviews. Further, our work has identified concerns with the implementation of the investment review process. In 2007, we reported that DHS had not fully implemented key practices of its investment review process to control projects. For example, we reported that DHS executives may not have the information they need to determine whether information technology investments are meeting expectations, which may increase the risk that underperforming projects are not identified and corrected in a timely manner. We have ongoing work on the implementation of DHS’s investment review process scheduled to be released later this year. Developing an acquisition workforce to implement and monitor acquisitions: DHS has taken initial steps needed to develop an acquisition workforce. In 2006, DHS reported significant progress in providing staff for the component contracting offices, though much work remained to fill the positions with qualified, trained acquisition professionals. DHS has also taken a positive step by authorizing additional staff for the CPO to provide staff for procurement oversight, program management and cost analysis functions. We have ongoing work on DHS’s acquisition workforce scheduled to be released later this year. Our work on both services contracting and major investments has consistently identified the need for improved acquisition planning to better ensure taxpayer dollars are spent prudently. Acquisitions must be appropriately planned and structured to minimize the risk of the government receiving services that are over cost estimates, delivered late, and of unacceptable quality. Specifically, we have emphasized the importance of clearly defined requirements to achieving desired results, and measurable performance standards to ensuring control and accountability. Too often, our work on federal acquisitions has reported that unrealistic, inadequate, or frequently changing requirements have left the government vulnerable to wasted taxpayer dollars. For services closely supporting inherently governmental functions, we found that DHS did not use risk assessment in its plans to hire contractors to provide these services. For services procured through methods such as interagency and performance-based contracting, we found acquisition planning was lacking. For major systems, acquisition planning includes establishing well-defined requirements and ensuring appropriate resources, such as adequate staffing and expertise, are in place to manage the investments; yet we have consistently found that these key elements are not in place. While there are benefits to using contractors to perform services for the government—such as increased flexibility in fulfilling immediate needs— we and others have raised concerns about the federal government’s increased reliance on contractor services. Of key concern is the risk associated with a contractor providing services that closely support inherently governmental functions: the loss of government control over and accountability for mission-related policy and program decisions. Professional and management support services, including program management and support services such as acquisition support, budget preparation, intelligence services, and policy development, closely support inherently governmental functions. To help ensure that the government does not lose control over and accountability for such decisions, longstanding federal procurement policy requires attention to the risk that government decisions may be influenced by, rather than independent from, contractor judgments when contracting for services that closely support inherently governmental functions. This type of risk assessment is also part of the acquisition planning process. While DHS program officials generally acknowledged that their professional and management support services contracts closely supported inherently governmental functions, they did not assess the risk of contractors providing these services. The nine cases we reviewed in detail provided examples of cases in which contractors provided services integral to and comparable to those provided by government employees; contractors provided ongoing support; and contract requirements were broadly defined. These conditions need to be carefully monitored to help ensure the government does not lose control over and accountability for mission related decisions. To improve DHS’s ability to manage the risk of selected services that closely support inherently governmental functions, as well as government control over and accountability for decisions, we recommended that DHS establish strategic-level guidance on and routinely assess the risk of using contractors for selected services and more clearly define contract requirements. DHS’s use of interagency contracting—a process by which one agency uses another agency’s contracts and contracting services—is another area we have identified acquisition planning was lacking. While interagency contracting offers the benefits of efficiency and convenience, in January 2005, we noted shortcomings and designated the management of interagency contracting as a governmentwide high-risk area. Our work on DHS’s use of interagency contracting showed that the department did not always select interagency contracts based on planning and analysis and instead made decisions based on the benefits of speed and convenience. We found that DHS conducted limited evaluation of contracting alternatives to ensure good value when selecting among interagency contracts. While interagency contacting is often chosen because it requires less planning than establishing a new contract, evaluating the selection of an interagency contract is important because not all interagency contracts provide good value when considering both timeliness and total cost. Although DHS guidance has required planning and analysis of alternatives for all acquisitions since July 2005, we found that it was not conducted for the four cases in our review for which it was required. To improve the management of interagency contracting, we recommended that DHS develop consistent, comprehensive guidance and training and establish criteria to consider in selecting an interagency contract. To help improve service acquisition outcomes, federal procurement policy calls for agencies to use a performance-based approach to the maximum extent practicable. This approach includes: a performance work statement that describes outcome oriented requirements, measurable performance standards, and quality assurance surveillance. In using a performance- based approach, the FAR requires contract outcomes or requirements to be well-defined, that is, providing clear descriptions of results to be achieved. Our prior reviews of complex DHS investments using a performance-based approach point to a number of shortcomings. For example, in June 2007, we reported that a performance-based contract for a DHS financial management system, eMerge2, lacked clear and complete requirements, which led to schedule delays and unacceptable contractor performance. Ultimately, the program was terminated after a $52 million investment. The DHS Inspector General has also indicated numerous opportunities for DHS to make better use of sound practices, such as well- defined requirements. Consistent with these findings, our 2008 report on performance-based acquisitions, for which we reviewed contracts for eight major investments at Coast Guard, CBP, and TSA, found that contracts for investments that did not have well-defined requirements, or a complete set of measurable performance standards, or both, at the time of contract award or the start of work experienced cost overruns, schedule delays, or did not otherwise meet performance expectations. In contrast, service contracts for investments that had well-defined requirements linked to measurable standards performed within budget meeting the standards in all cases where contractors had begun work. For example, TSA’s Screening Partnership Program improved its contracted services at the San Francisco International Airport to incorporate well-defined requirements linked to clearly measurable performance standards and delivered services within budget. To improve the outcomes of performance-based acquisitions, we recommended that DHS improve acquisition planning for requirements for major complex investments to ensure they are well- defined, and develop consistently measurable performance standards linked to those requirements. Following are examples of complex investments with contracts that did not have well-defined requirements or complete measurable performance standards and did not meet cost, schedule, or performance expectations. Contracts for systems development for two CBP major investments— Automated Commercial Environment (ACE) and Secure Border Initiative (SBInet)—lacked both well-defined requirements and measurable performance standards prior to the start of work and both experienced poor outcomes. The first, for DHS’s ACE Task Order 23 project—a trade software modernization effort—was originally estimated to cost $52.7 million over a period of approximately 17 months. However, the program lacked stable requirements at contract award and, therefore, could not establish measurable performance standards and valid cost or schedule baselines for assessing contractor performance. Software requirements were added after contract award, contributing to a project cost increase of approximately $21.1 million, or 40 percent, over the original estimate. Because some portions of the work were delayed to better define requirements, the project is not expected to be completed until January 2011—over three years later than originally planned. The second, Project 28 for systems development for CBP’s SBInet—a project to help secure a section of the United States-Mexico border using a surveillance system—did not meet expected outcomes due to a lack of both well-defined requirements and measurable performance standards. CBP awarded the Project 28 contract planned as SBInet’s proof of concept and the first increment of the fielded SBInet system before the overall SBInet operational requirements and system specifications were finalized. More than 3 months after Project 28 was awarded, DHS’s Inspector General reported that CBP had not properly defined SBInet’s operational requirements and needed to do so quickly to avoid rework of the contractor’s systems engineering. We found that several performance standards were not clearly defined to isolate the contractor’s performance from that of CBP employees, making it difficult to determine whether any problems were due to the contractor’s system design, CBP employees, or both. As a result, it was not clear how CBP intended to measure compliance with the Project 28 standard for probability of detecting persons attempting to illegally cross the border. Although it did not fully meet user needs and its design will not be used as a basis for future SBInet development, DHS fully accepted the project after an 8-month delay.In addition, DHS officials have stated that much of the Project 28 system will be replaced by new equipment and software. However, Project 28 is just one part of the entire Secure Border Initiative, and our recent work has noted that requirements and testing processes for the initiative have not been effectively managed, and important aspects of the program remain in flux. Additionally, our work has found that the Coast Guard’s Deepwater Program, ongoing since the late 1990s, is intended to replace or modernize 15 major classes of Coast Guard assets. In March 2007, we reported that the Coast Guard’s Deepwater contract had requirements that were set at unrealistic levels and were frequently changed. For some of the Deepwater assets, this resulted in cost escalation, schedule delays, and reduced contractor accountability over a period of many years of producing poor results such as ships that experienced serious structural defects. In light of these serious performance and management problems, Coast Guard leadership has changed its approach to this acquisition. It has taken over the lead role in systems integration, which was formerly held by a contractor. Formerly, the contractor had significant program management responsibilities, such as contractual responsibility for drafting task orders and managing the system integration of Deepwater as a whole. Coast Guard project managers and technical experts now hold the greater balance of management responsibility and accountability for program outcomes. Coast Guard officials have begun to hold competitions for Deepwater assets outside of the lead system integrator contract, and cost and schedule information is now captured at a level that has resulted in improved visibility, such as the ability to track and report cost breaches for assets. The Coast Guard has also begun to follow a disciplined project management framework, requiring documentation and approval of decisions at key points in a program’s life cycle. However, like other federal agencies, the Coast Guard has faced challenges in building an adequate government workforce and is relying on support contractors in key positions, such as cost estimators and contract specialists. Our work on contractors performing services closely supporting inherently governmental functions found that DHS program officials and contracting officers were not aware of federal requirements for enhanced oversight for these types of services. Both the FAR and the Office of Management and Budget’s Office of Federal Procurement Policy (OFPP) policy state that when contracting for these types of services a sufficient number of qualified government employees assigned to plan and oversee these contractor activities is needed to maintain control and accountability. For the nine cases we reviewed, the level of oversight provided did not always help ensure accountability for decisions or the ability to judge whether contractors were performing as required. We found cases in which the DHS components lacked the capacity to oversee contractor performance due to limited expertise and workload demands. DHS components were also limited in their ability to assess contactor performance in a way that addressed the risk of contracting for services that closely support inherently governmental functions. Assessing contractor performance requires a plan that outlines how services will be delivered and establishes measurable outcomes. However, none of the oversight plans and contract documents we reviewed contained specific measures for assessing contractor performance of selected services. To address this deficiency, we recommended that DHS assess the ability of its workforce to provide sufficient oversight when using these types of contracted services. Limited oversight also is due in part to insufficient data to monitor acquisitions. Our work on procurement methods, such as interagency contracting and performance-based acquisition, has found that DHS does not systematically monitor its use of these contracts to assess whether these methods are being properly managed, or to assess costs, benefits, or other outcomes of these acquisition methods. With regard to interagency contracting, we found that DHS was not able to readily provide data on the amounts spent through different types of contracts or on the fees paid to other agencies for the use of their contracting services or vehicles. This lack of information means that DHS cannot assess whether the department could achieve savings through using another type of contracting vehicle. We similarly found that DHS did not have reliable data on performance-based acquisitions to facilitate required reporting, informed decisions, and analysis of acquisition outcomes. For example, our review of contracts at the Coast Guard, CBP, Immigration and Customs Enforcement (ICE), and TSA showed that, about 51 percent of the 138 contracts we identified in FPDS-NG as performance-based had none of the required performance-based elements: a performance work statement, measurable performance standards, and a method of assessing contractor performance against performance standards. The unreliability of these data makes it difficult for DHS to be able to accurately report on governmentwide performance targets for performance-based acquisitions. We have recommended that DHS work to improve the quality of FPDS-NG data so that DHS can more accurately identify and assess the quality of the use and outcomes of various procurement methods. Inaccurate federal procurement data is not unique to DHS and is a long- standing governmentwide concern. Our prior work and the work of the General Services Administration’s Inspector General have identified issues with the accuracy and completeness of FPDS and FPDS-NG data, and OMB has stressed the importance of submitting timely and accurate procurement data to FPDS-NG. The Acquisition Advisory Panel has also raised concerns about the accuracy of FPDS-NG data. These circumstances illustrate the magnitude of the challenge DHS faces in developing timely and accurate data to monitor acquisitions. To improve procurement oversight, the CPO established and has implemented a departmentwide program to provide comprehensive insight into each component’s programs and disseminate successful management techniques throughout DHS. This program, which is based on a series of component-level reviews, was designed with the flexibility to address specific procurement issues. As such, it could be used to address areas such as performance-based acquisitions, interagency contracting, and the appropriate use of contractors providing services closely supporting inherently governmental functions. Some of the four key oversight reviews have begun under this program, but management assessments, or evaluation of the outcomes of acquisition methods and contracted services, have not been conducted. Our work has found that the CPO continues to face challenges in maintaining the staffing levels needed to fully implement the oversight program, and CPO authority to ensure that components comply with the procurement oversight plan remains unclear. Improving acquisition outcomes has been an ongoing challenge since DHS was established in 2003. Our work has consistently noted that sound acquisition planning, including clearly defining requirements, and ensuring adequate oversight are hallmarks of successful service acquisitions. A sufficient acquisition workforce is also key to properly managing acquisitions. Our body of work has also included many recommendations to the Secretary of Homeland Security to take actions aimed at improving acquisition management, planning, and oversight. While DHS has generally concurred with our recommendations, the department has not always stated how the underlying causes of the deficiencies we have identified will be addressed. Until the department takes needed action to address these causes, it will continue to be challenged to make the best use of its acquisition dollars. Mr. Chairman, this concludes my prepared statement. I would be happy to respond to any questions that you or other members of the subcommittee may have at this time. For further information about this statement, please contact me at (202) 512-4841 or huttonj@gao.gov. Contact points for GAO’s Offices of Congressional Relations and Public Affairs are listed on the last page of this product. Key contributors to this statement were Amelia Shachoy, Assistant Director; Ann Marie Udale, Karen Sloan and Kenneth Patton. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Since it was created in 2003, the Department of Homeland Security (DHS) has obligated billions of dollars annually to meet its expansive homeland security mission. The department's acquisitions support complex and critical trade, transportation, border security, and information technology investments. In fiscal year 2007, DHS spent over $12 billion on procurements to meet this mission including spending for complex services and major investments. Prior GAO work has found that while DHS has made some initial progress in developing its acquisition function since 2003, acquisition planning and oversight for procurement and major acquisitions need improvement. This testimony discusses GAO's findings in these areas and is based on GAO's body of work on acquisition management issues. Recognizing the need to improve its acquisition outcomes, DHS has taken some steps to integrate disparate acquisition processes and systems that the component organizations brought with them when the department was formed. However, we have reported that more needs to be done to develop clear and transparent policies and processes for all acquisitions, and to develop an acquisition workforce to implement and monitor acquisitions. With regard to acquisition planning, DHS did not assess the risk of hiring contractors to perform management and professional support services that have the potential to increase the risk that government decisions may be influenced by, rather than independent from, contractor judgments. Planning for services procured through interagency and performance-based contracting methods was also lacking. For example, DHS did not always consider alternatives to ensure good value when selecting among interagency contracts. Shortcomings in DHS's use of a performance-based approach for complex acquisitions included a lack of well-defined requirements, a complete set of measurable performance standards, or both, at the time of contract award or the start of work. Contracts for several investments we reviewed experienced cost overruns, schedule delays, or less than expected performance. Acquisition oversight also has consistently been identified as needing improvement. While the Chief Procurement Officer (CPO) has recently implemented a departmentwide oversight program, evaluations of the outcomes of acquisition methods and contracted services have not yet been conducted. Further, the CPO continues to face challenges in maintaining the staffing levels needed to fully implement the oversight program, and CPO authority to ensure that components comply with the procurement oversight plan remains unclear.