In July 2002, President Bush issued the National Strategy for Homeland Security. The strategy set forth overall objectives to prevent terrorist attacks within the United States, reduce America’s vulnerability to terrorism, and minimize the damage and assist in the recovery from attacks that occur. The strategy further identified a plan to strengthen homeland security through the cooperation and partnering of federal, state, local, and private sector organizations on an array of functions. It also specified a number of federal departments, as well as nonfederal organizations, that have important roles in securing the homeland, with DHS having key responsibilities in implementing established homeland security mission areas. This strategy was updated and reissued in October 2007. In November 2002, the Homeland Security Act of 2002 was enacted into law, creating DHS. The act defined the department’s missions to include preventing terrorist attacks within the United States; reducing U.S. vulnerability to terrorism; and minimizing the damages, and assisting in the recovery from, attacks that occur within the United States. The act further specified major responsibilities for the department, including the analysis of information and protection of infrastructure; development of countermeasures against chemical, biological, radiological, and nuclear, and other emerging terrorist threats; securing U.S. borders and transportation systems; and organizing emergency preparedness and response efforts. DHS began operations in March 2003. Its establishment represented a fusion of 22 federal agencies to coordinate and centralize the leadership of many homeland security activities under a single department. We have evaluated many of DHS’s management functions and programs since the department’s establishment, and have issued over 400 related products. In particular, in August 2007, we reported on the progress DHS had made since its inception in implementing its management and mission functions. We also reported on broad themes that have underpinned DHS’s implementation efforts, such as agency transformation, strategic planning, and risk management. Over the past five years, we have made over 900 recommendations to DHS on ways to improve operations and address key themes, such as to develop performance measures and set milestones for key programs and implement internal controls to help ensure program effectiveness. DHS has implemented some of these recommendations, taken actions to address others, and taken other steps to strengthen its mission activities and facilitate management integration. DHS has made progress in implementing its management functions in the areas of acquisition, financial, human capital, information technology, and real property management. Overall, DHS has made more progress in implementing its mission functions—border security; immigration enforcement; immigration services; and aviation, surface transportation, and maritime security; for example—than its management functions, reflecting an initial focus on implementing efforts to secure the homeland. DHS has had to undertake these critical missions while also working to transform itself into a fully functioning cabinet department—a difficult undertaking for any organization and one that can take, at a minimum, 5 to 7 years to complete even under less daunting circumstances. As DHS continues to mature as an organization, we have reported that it will be important that it works to strengthen its management areas since the effectiveness of these functions will ultimately impact its ability to fulfill its mission to protect the homeland. Acquisition Management. DHS’s acquisition function includes managing and overseeing nearly $16 billion in acquisitions to support its broad and complex missions, such as information systems, new technologies, aircraft, ships, and professional services. DHS has recognized the need to improve acquisition outcomes and taken some positive steps to organize and assess the acquisition function, but continues to lack clear accountability for the outcomes of acquisition dollars spent. A common theme in our work on acquisition management is DHS’s struggle to provide adequate support for its mission components and resources for departmentwide oversight. DHS has not yet accomplished its goal of integrating the acquisition function across the department. For example, the structure of DHS’s acquisition function creates ambiguity about who is accountable for acquisition decisions because it depends on a system of dual accountability and cooperation and collaboration between the Chief Procurement Officer (CPO) and the component heads. In June 2007, DHS officials stated that they were in the process of modifying the lines of business management directive, which exempts the Coast Guard and the Secret Service from complying, to ensure that no contracting organization is exempt. This directive has not yet been revised. In September 2007, we reported on continued acquisition oversight issues at DHS, identifying that the department has not fully ensured proper oversight of its contractors providing services closely supporting inherently government functions. The CPO has established a departmentwide program to improve oversight; however, DHS has been challenged to provide the appropriate level of oversight and management attention to its service contracting and major investments, and we continue to be concerned that the CPO may not have sufficient authority to effectively oversee the department’s acquisitions. DHS still has not developed clear and transparent policies and processes for all acquisitions. Concerns have been raised about how the investment review process has been used to oversee its largest acquisitions, and the investment review process in still under revision. We have ongoing work reviewing oversight of DHS’s major investments which follows-up on our prior recommendations. Regarding the acquisition workforce, our work and the work of the DHS IG has found acquisition workforce challenges across the department; we have ongoing work in this area as well. Financial Management. DHS’s financial management efforts include consolidating or integrating component agencies’ financial management systems. DHS has made progress in addressing financial management and internal control weaknesses and has designated a Chief Financial Officer, but the department continues to face challenges in these areas. However, since its establishment, DHS has been unable to obtain an unqualified or “clean” audit opinion on its financial statements. For fiscal year 2007, the independent auditor issued a disclaimer on DHS’s financial statements and identified eight significant deficiencies in DHS’s internal control over financial reporting, seven of which were so serious that they qualified as material weaknesses. DHS has taken steps to prepare corrective action plans for its internal control weaknesses by, for example, developing and issuing a departmentwide strategic plan for the corrective action plan process and holding workshops on corrective action plans. While these are positive steps, DHS and its components have not yet fully implemented corrective action plans to address all significant deficiencies—including the material weaknesses—identified by previous financial statement audits. According to DHS officials, the department has developed goals and milestones for addressing these weaknesses in its internal control over financial reporting. Until these weaknesses are resolved, DHS will not be in position to provide reliable, timely, and useful financial data to support day-to-day decision making. Human Capital Management. DHS’s key human capital management areas include pay, performance management, classification, labor relations, adverse actions, employee appeals, and diversity management. DHS has significant flexibility to design a modern human capital management system, and in October 2004 DHS issued its human capital strategic plan. DHS and the Office of Personnel Management jointly released the final regulations on DHS’s new human capital system in February 2005. Although DHS intended to implement the new personnel system in the summer of 2005, court decisions enjoined the department from implementing certain labor management portions of the system. DHS has since taken actions to implement its human capital system. In July 2005 DHS issued its first departmental training plan, and in April 2007, it issued its Fiscal Year 2007 and 2008 Human Capital Operational Plan. This plan identifies five department priorities—hiring and retaining a talented and diverse workforce; creating a DHS-wide culture of performance; creating high-quality learning and development programs for DHS employees; implementing a DHS-wide integrated leadership system; and being a model of human capital service excellence. DHS has met some of the goals identified in the plan, such as developing a hiring model and a communication plan. However, more work remains for DHS to fully implement its human capital system. For example, DHS has not yet taken steps to fully link its human capital planning to overall agency strategic planning nor has it established a market-based and more performance- oriented pay system. DHS has also faced difficulties in developing and implementing effective processes to recruit and hire employees. Although DHS has developed its hiring model and provided it to all components, we reported in August 2007 that DHS had not yet assessed components’ practices against the model. Furthermore, employee morale at DHS has been low, as measured by the results of the 2006 U.S. Office of Personnel Management Federal Human Capital Survey. DHS has taken steps to seek employee feedback and involve them in decision making by, for example, expanding its communication strategy and developing an overall strategy for addressing employee concerns reflects in the survey results. In addition, although DHS has developed a department-level training strategy, it has faced challenges in fully implementing this strategy. Information Technology Management. DHS’s information technology management efforts should include: developing and using an enterprise architecture, or corporate blueprint, as an authoritative frame of reference to guide and constrain system investments; defining and following a corporate process for informed decision making by senior leadership about competing information technology investment options; applying system and software development and acquisition discipline and rigor when defining, designing, developing, testing, deploying, and maintaining systems; establishing a comprehensive, departmentwide information security program to protect information and systems; having sufficient people with the right knowledge, skills, and abilities to execute each of these areas now and in the future; and centralizing leadership for extending these disciplines throughout the organization with an empowered Chief Information Officer. DHS has undertaken efforts to establish and institutionalize the range of information technology management controls and capabilities noted above that our research and past work have shown are fundamental to any organization’s ability to use technology effectively to transform itself and accomplish mission goals. For example, DHS has organized roles and responsibilities for information technology management under the Chief Information Officer. DHS has also developed an information technology human capital plan that is largely consistent with federal guidance and associated best practices. In particular, we reported that the plan fully addressed 15 and partially addressed 12 of 27 practices set forth in the Office of Personnel Management’s human capital framework. However, we reported that DHS’s overall progress in implementing the plan had been limited. With regard to information technology investment management, DHS has established a management structure to help manage its investments. However, DHS has not always fully implemented any of the key practices our information technology investment management framework specifies as being needed to actually control investments. Furthermore, DHS has developed an enterprise architecture, but we have reported that major DHS information technology investments have not been fully aligned with DHS’s enterprise architecture. In addition, DHS has not fully implemented a comprehensive information security program. While it has taken actions to ensure that its certification and accreditation activities are completed, the department has not shown the extent to which it has strengthened incident detection, analysis, and reporting and testing activities. Real Property Management. DHS’s responsibilities for real property management are specified in Executive Order 13327, “Federal Real Property Asset Management,” and include the establishment of a Senior Real Property Officer, development of an asset inventory, and development and implementation of an asset management plan and performance measures. In June 2006, the Office of Management and Budget upgraded DHS’s Real Property Asset Management Score from red to yellow after DHS developed an Asset Management Plan, developed a generally complete real property data inventory, submitted this inventory for inclusion in the governmentwide real property inventory database, and established performance measures consistent with Federal Real Property Council standards. DHS also designated a Senior Real Property Officer. However, in August 2007 we reported that DHS had yet to demonstrate full implementation of its asset management plan and full use of asset inventory information and performance measures in management decision making. Our work has identified various cross-cutting issues that have hindered DHS’s progress in its management areas. We have reported that while it is important that DHS continue to work to strengthen each of its core management functions, it is equally important that these key issues be addressed from a comprehensive, departmentwide perspective to help ensure that the department has the structure and processes in place to effectively address the threats and vulnerabilities that face the nation. These issues include agency transformation, strategic planning and results management, and accountability and transparency. Agency Transformation. In 2007 we reported that DHS’s implementation and transformation remained high risk because DHS had not yet developed a comprehensive management integration strategy and its management systems and functions⎯especially related to acquisition, financial, human capital, and information technology management⎯were not yet fully integrated and wholly operational. We have recommended, among other things, that agencies on the high-risk list produce a corrective action plan that defines the root causes of identified problems, identifies effective solutions to those problems, and provides for substantially completing corrective measures in the near term. Such a plan should include performance metrics and milestones, as well as mechanisms to monitor progress. In March 2008 we received a draft of DHS’s corrective action plan and have provided the department with some initial feedback. We will continue to review the plan and expect to be able to provide additional comments on the plan in the near future. Strategic Planning and Results Management. DHS has not always implemented effective strategic planning efforts, has not yet issued an updated strategic plan, and has not yet fully developed adequate performance measures or put into place structures to help ensure that the agency is managing for results. DHS has developed performance goals and measures for some of its programs and reports on these goals and measures in its Annual Performance Report. However, some of DHS’s components have not developed adequate outcome-based performance measures or comprehensive plans to monitor, assess, and independently evaluate the effectiveness of their plans and performance. Since issuance of our August 2007 report, DHS has begun to develop performance goals and measures for some areas in an effort to strengthen its ability to measures its progress in key management and mission areas. We commend DHS’s efforts to measure its progress in these areas and have agreed to work with the department to provide input to help strengthen established measures. Accountability and Transparency. Accountability and transparency are critical to the department effectively integrating its management functions and implementing its mission responsibilities. We have reported that it is important that DHS make its management and operational decisions transparent enough so that Congress can be sure that it is effectively, efficiently, and economically using the billions of dollars in funding it receives annually. We have encountered delays at DHS in obtaining access to needed information, which have impacted our ability to conduct our work in a timely manner. Since we highlighted this issue last year to this subcommittee, our access to information at DHS has improved. For example, TSA has worked with us to improve its process for providing us with access to documentation. DHS also provided us with access to its national level preparedness exercise. Moreover, in response to the provision in the DHS Appropriations Act, 2008, that restricts a portion of DHS’s funding until DHS certifies and reports that it has revised its guidance for working with GAO. DHS has provided us with a draft version of its revised guidance. We have provided DHS with comments on this draft and look forward to continuing to collaborate with the department. DHS is now 5 years old, a key milestone for the department. Since its establishment, DHS has had to undertake actions to secure the border and the transportation sector and defend against, prepare for, and respond to threats and disasters while simultaneously working to transform itself into a fully functioning cabinet department. Such a transformation is a difficult undertaking for any organization and can take, at a minimum, 5 to 7 years to complete even under less daunting circumstances. Nevertheless, DHS’s 5-year anniversary provides an opportunity for the department to review how it has matured as an organization. As part of our broad range of work reviewing DHS management and mission programs, we will continue to assess in the coming months DHS’s progress in addressing high-risk issues. In particular, we will continue to assess the progress made by the department in its transformation and information sharing efforts, and assessing whether any progress made is sustainable over the long term. Further, as DHS continues to evolve and transform, we will review its progress and performance and provide information to Congress and the public on its efforts. This concludes my prepared statement. I would be pleased to answer any questions you and the Subcommittee Members may have. For further information about this testimony, please contact Norman J. Rabkin, Managing Director, Homeland Security and Justice, at 202-512- 8777 or rabkinn@gao.gov. Other key contributors to this statement were Cathleen A Berrick, Anthony DeFrank, Rebecca Gambler, and Thomas Lombardi. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The Department of Homeland Security (DHS) began operations in March 2003 with missions that include preventing terrorist attacks from occurring within the United States, reducing U.S. vulnerability to terrorism, minimizing damages from attacks that occur, and helping the nation recover from any attacks. GAO has reported that the implementation and transformation of DHS is an enormous management challenge. GAO's prior work on mergers and acquisitions found that successful transformations of large organizations, even those faced with less strenuous reorganizations than DHS, can take at least 5 to 7 years to achieve. This testimony addresses (1) the progress made by DHS in implementing its management functions; and (2) key issues that have affected the department's implementation efforts. This testimony is based on GAO's August 2007 report evaluating DHS's progress between March 2003 and July 2007; selected reports issued since July 2007; and GAO's institutional knowledge of homeland security and management issues. Within each of its management areas--acquisition, financial, human capital, information technology, and real property management--DHS has made some progress, but has also faced challenges. DHS has recognized the need to improve acquisition outcomes and taken some positive steps to organize and assess the acquisition function, but continues to lack clear accountability for the outcomes of acquisition dollars spent. The department also has not fully ensured proper oversight of its contractors providing services closely supporting inherently government functions. DHS has designated a Chief Financial Officer and taken actions to prepare corrective action plans for its internal control weaknesses. However, DHS has been unable to obtain an unqualified audit opinion of its financial statements, and for fiscal year 2007 the independent auditor identified significant deficiencies in DHS's internal control over financial reporting. DHS has taken actions to implement its human capital system by, for example, issuing a departmental training plan and human capital operational plan. Among other things, DHS still needs to implement a human capital system linked to its strategic plan, establish a market-based and more performance-oriented pay system, and seek more routine feedback from employees. DHS has taken actions to develop information technology management controls, such as developing an information technology human capital plan and developing policies to ensure the protection of sensitive information. However, DHS has not yet fully implemented a comprehensive information security program or a process to effectively manage information technology investments. DHS has developed an Asset Management Plan and established performance measures consistent with Federal Real Property standards. However, DHS has yet to demonstrate full implementation of its Asset Management Plan or full use of asset management inventory information. Various cross-cutting issues have affected DHS's implementation efforts. For example, DHS has not yet updated its strategic plan and put in place structures to help it manage for results. Accountability and transparency are critical to effectively implementingDHS's management functions. GAO has experienced delays in obtaining access to needed information from DHS, though over the past year, GAO's access has improved. GAO is hopeful that planned revisions to DHS's guidance for working with GAO will streamline our access to documents and officials. DHS's 5 year anniversary provides an opportunity for the department to review how it has matured as an organization. As part of our broad range of work, GAO will continue to assess DHS's progress in addressing high-risk issues. In particular, GAO will continue to assess the progress made by the department in its transformation efforts and whether any progress made is sustainable over the long term.