DHS’s efforts to strengthen and integrate its management functions have resulted in progress addressing our criteria for removal from the high-risk list. In particular, in our February 2015 high-risk update report, we found that DHS had met two criteria and partially met the remaining three criteria. DHS subsequently met an additional criterion—establishing a framework for monitoring progress—and therefore as of March 2016, has met three criteria and partially met the remaining two criteria, as shown in table 1. Leadership commitment (met). We found in our 2015 report and have observed over the last year that the Secretary and Deputy Secretary of Homeland Security, the Under Secretary for Management at DHS, and other senior officials have continued to demonstrate exemplary commitment and top leadership support for addressing the department’s management challenges. Additionally, they have taken actions to institutionalize this commitment to help ensure the long-term success of the department’s efforts. For example, in April 2014, the Secretary of Homeland Security issued a memorandum entitled Strengthening Departmental Unity of Effort, committing to, among other things, improving DHS’s planning, programming, budgeting, and execution processes through strengthened departmental structures and increased capability. Senior DHS officials, including the Deputy Secretary and Under Secretary for Management, have also routinely met with us over the past 7 years to discuss the department’s plans and progress in addressing this high-risk area, most recently in February 2016. Throughout this time, we provided specific feedback on the department’s efforts. We concluded in our 2015 report and continue to believe that it will be important for DHS to maintain its current level of top leadership support and commitment to ensure continued progress in successfully executing its corrective actions through completion. Action plan (met). We found that DHS has established a plan for addressing this high-risk area. Specifically, in a September 2010 letter to DHS, we identified and DHS agreed to achieve 31 actions and outcomes that are critical to addressing the challenges within the department’s management areas and in integrating those functions across the department. In March 2014, we updated the actions and outcomes in collaboration with DHS to reduce overlap and ensure their continued relevance and appropriateness. These updates resulted in a reduction from 31 to 30 total actions and outcomes. Toward achieving the actions and outcomes, DHS issued its initial Integrated Strategy for High Risk Management in January 2011 and has since provided updates to its strategy in nine later versions, most recently in January 2016. The integrated strategy includes key management initiatives and related corrective actions plans for addressing DHS’s management challenges and the actions and outcomes we identified. For example, the January 2016 strategy update includes an initiative focused on financial systems modernization and an initiative focused on IT human capital management. These initiatives support various actions and outcomes, such as modernizing the U.S. Coast Guard’s financial management system and implementing an IT human capital strategic plan, respectively. We concluded in our 2015 report and continue to believe that DHS’s strategy and approach to continuously refining actionable steps to implementing the outcomes, if implemented effectively and sustained, should provide a path for DHS to be removed from our high- risk list. Capacity (partially met). In October 2014, DHS identified that it had resources needed to implement 7 of the 11 initiatives the department had under way to achieve the actions and outcomes, but did not identify sufficient resources for the 4 remaining initiatives. In addition, our prior work has identified specific capacity gaps that could undermine achievement of management outcomes. For example, in April 2014, we reported that DHS needed to increase its cost-estimating capacity and that the department had not approved baselines for 21 of 46 major acquisition programs. These baselines—which establish cost, schedule, and capability parameters—are necessary to accurately assess program performance. Thus, in our 2015 report, we concluded that DHS needs to continue to identify resources for the remaining initiatives; work to mitigate shortfalls and prioritize initiatives, as needed; and communicate to senior leadership critical resource gaps. In its January 2016 strategy update, DHS stated that the department had addressed capacity shortcomings it previously identified and self-assesses the capacity criterion as fully met. We are analyzing DHS’s capacity to resolve risks as part of our ongoing assessment of the department’s progress in addressing the Strengthening DHS Management Functions high-risk area and will report on our findings in our 2017 high-risk update. Monitoring (met). In our 2015 report we found that DHS established a framework for monitoring its progress in implementing the integrated strategy it identified for addressing the 30 actions and outcomes. In the June 2012 update to the Integrated Strategy for High Risk Management, DHS included, for the first time, performance measures to track its progress in implementing all of its key management initiatives. DHS continued to include performance measures in its October 2014 update. However, in our 2015 report we also found that DHS could strengthen its financial management monitoring efforts and thus concluded that the department had partially met the criterion for establishing a framework to monitor progress. In particular, according to DHS officials, as of November 2014, they were establishing a monitoring program that would include assessing whether financial management systems modernization projects for key components that DHS plans to complete in 2019 are following industry best practices and meet users’ needs. However, DHS had not yet entered into a contract for independent verification and validation services in connection with its efforts to establish this program. Effective implementation of these modernization projects is important because, until they are complete, the department’s current systems will not effectively support financial management operations. DHS subsequently entered into a contract for independent verification and validation services that should help ensure the financial management systems modernization projects meet key requirements. As a result, we currently assess DHS to have met the framework to monitor progress criterion. As we concluded in our 2015 report and continue to believe, moving forward, DHS will need to closely track and independently validate the effectiveness and sustainability of its corrective actions and make midcourse adjustments, as needed. Demonstrated progress (partially met). We found in our 2015 report that DHS had made important progress in strengthening its management functions, but needed to demonstrate sustainable, measurable progress in addressing key challenges that remain within and across these functions. In particular, we found that DHS had implemented a number of actions demonstrating the department’s progress in strengthening its management functions. For example, DHS had strengthened its enterprise architecture program (or blueprint) to guide and constrain IT acquisitions and obtained a clean opinion on its financial statements for 2 consecutive years, fiscal years 2013 and 2014. DHS has continued to demonstrate important progress over the last year by, for example, obtaining a clean opinion on its financial statements for a third consecutive year. However, we also found in our 2015 report that DHS continued to face significant management challenges that hindered the department’s ability to accomplish its missions. For example, DHS did not have the acquisition management tools in place to consistently demonstrate whether its major acquisition programs were on track to achieve their cost, schedule, and capability goals. In addition, DHS did not have modernized financial management systems, which affected its ability to have ready access to reliable information for informed decision making. Over the last year DHS has continued to take actions to address these challenges but they persist, as discussed in more detail below. As we concluded in our 2015 report, addressing these and other management challenges will be a significant undertaking that will likely require several years, but will be critical for the department to mitigate the risks that management weaknesses pose to mission accomplishment. Key to addressing the department’s management challenges is DHS demonstrating the ability to achieve sustained progress across the 30 actions and outcomes we identified and DHS agreed were needed to address the high-risk area. Achieving sustained progress across the actions and outcomes, in turn, requires leadership commitment, effective corrective action planning, adequate capacity (that is, the people and other resources), and monitoring the effectiveness and sustainability of supporting initiatives. The 30 actions and outcomes address each management function (acquisition, IT, financial, and human capital) as well as management integration. For example, one of the outcomes focusing on acquisition management is validating required acquisition documents in accordance with a department-approved, knowledge-based acquisition process, and the outcomes focusing on financial management include sustaining clean audit opinions for at least 2 consecutive years on department-wide financial statements and internal controls. We found in our 2015 report that DHS had made important progress across all of its management functions and significant progress in the area of management integration. In particular, DHS had made important progress in several areas to fully address 9 actions and outcomes, 5 of which it had sustained as fully implemented for at least 2 years. For instance, DHS fully met 1 outcome for the first time by obtaining a clean opinion on its financial statements for 2 consecutive years and sustained full implementation of another outcome by continuing to use performance measures to assess progress made in achieving department-wide management integration. Since our 2015 update, DHS fully addressed another outcome as a result of actions it has taken to improve the maturity of its system acquisition management practices, leaving additional work to fully address the remaining 20 outcomes. As of March 2016, DHS has also mostly addressed an additional 7 actions and outcomes—3 since our 2015 report—meaning that a small amount of work remains to fully address them. We also found in our 2015 report and continue to observe, that considerable work remains, however, in several areas for DHS to fully achieve the remaining actions and outcomes and thereby strengthen its management functions. Specifically, as of March 2016, DHS has partially addressed 9 and initiated 4 of the actions and outcomes. As previously mentioned, addressing some of these actions and outcomes, such as modernizing the department’s financial management systems, are significant undertakings that will likely require multiyear efforts. Table 2 summarizes DHS’s progress in addressing the 30 actions and outcomes as of March 2016, and is followed by selected examples. Acquisition management. DHS has fully addressed 1 of the 5 acquisition management outcomes, mostly addressed 2 outcomes, partially addressed 1 outcome, and initiated actions to address the remaining outcome. For example, DHS has taken a number of actions to fully address establishing effective component-level acquisition capability. These actions include initiating (1) monthly Component Acquisition Executive staff forums to provide guidance and share best practices and (2) assessments of component policies and processes for managing acquisitions. DHS has also continued to make progress addressing the outcome on validating required acquisition documents in a timely manner. Specifically, the Under Secretary for Management provided direction to the components on submitting the outstanding documentation. We will continue to assess DHS’s progress on this outcome. In addition, DHS has conducted staffing analysis reports that quantify gaps in acquisition personnel by position. Moving forward, DHS must develop and implement a plan for filling key vacant positions identified through its staffing analysis reports. Further, DHS should continue to improve its acquisition program management by effectively using the Joint Requirements Council, which it reinstated in June 2014, to identify and eliminate any unintended redundancies in program requirements, and by demonstrating that major acquisition programs are on track to achieve their cost, schedule, and capability goals. IT management. DHS has fully addressed 3 of the 6 IT management outcomes, mostly addressed another 2, and partially addressed the remaining 1. For example, DHS has finalized a directive to establish its tiered governance and portfolio management structure for overseeing and managing its IT investments, and annually reviews each of its portfolios and the associated investments to determine the most efficient allocation of resources within each of the portfolios. The department has also made progress in implementing its IT Strategic Human Capital Plan for fiscal years 2010 through 2012. However, in January 2015 DHS shifted its IT paradigm from acquiring assets to acquiring services, and acting as a service broker (i.e., an intermediary between the purchaser of a service and the seller of that service). According to DHS officials in May 2015, this paradigm change will require a major transition in the skill sets of DHS’s IT workforce, as well as the hiring, training, and managing of staff with those new skill sets; as such, this effort will need to be closely managed in order to succeed. Additionally, we found that DHS continues to take steps to enhance its information security program. However, while the department made progress in remediating findings from the previous year, in November 2015, the department’s financial statement auditor designated deficiencies in IT systems controls as a material weakness for financial reporting purposes for the 12th consecutive year. This designation was due to flaws in security controls such as those for access controls, configuration management, segregation of duties, and contingency planning. Thus, DHS needs to remediate this longstanding material weakness. Information security remains a major management challenge for the department. Financial management. DHS has fully addressed 2 financial management outcomes, partially addressed 3, and initiated 3. Most notably, DHS received a clean audit opinion on its financial statements for 3 consecutive years, fiscal years 2013, 2014, and 2015, fully addressing 2 outcomes. In addition, in November 2015, DHS’s financial statement auditors reported that one of four material weaknesses in its internal controls over financial reporting had been reduced to a significant deficiency in connection with its remediation efforts. However, the remaining material weaknesses reported by DHS auditors continue to hamper DHS’s ability to establish effective internal control over financial reporting and comply with financial management system requirements. DHS continues to make progress on three multi-year projects to modernize selected components’ financial management systems. According to its January 2016 strategy update, DHS has made the most progress on its U.S. Coast Guard modernization project; whereas additional planning and discovery efforts need to be completed on its projects to modernize Federal Emergency Management Agency and U.S. Immigration and Customs Enforcement financial management systems before DHS will be in a position to implement modernized solutions for these components and their customers. Without sound controls and systems, DHS faces long-term challenges in sustaining a clean audit opinion on its financial statements and in obtaining and sustaining a clean opinion on its internal control over financial reporting, and ensuring its financial management systems generate reliable, useful, and timely information for day-to-day decision making as a routine business operation. Human capital management. DHS has fully addressed 1 human capital management outcome, mostly addressed 3, and partially addressed the remaining 3. For example, the Secretary of Homeland Security signed a human capital strategic plan in 2011 that DHS has since made sustained progress in implementing, fully addressing this outcome. DHS also has actions under way to identify current and future human capital needs, an outcome it mostly addressed since our 2015 report due to progress implementing its Workforce Planning Model. However, DHS has considerable work ahead to improve employee morale. For example, the Office of Personnel Management’s 2015 Federal Employee Viewpoint Survey data showed that DHS ranked last among 37 large federal agencies in all four dimensions of the survey’s index for human capital accountability and assessment. Further, the survey data showed that DHS’s scores continued to decrease in three index dimensions (job satisfaction, leadership and knowledge management, and results-oriented performance culture) and remained constant in the fourth dimension (talent management). DHS has developed plans for addressing its employee satisfaction problems, but as we previously recommended, DHS needs to continue to improve its root-cause analysis efforts related to these plans. DHS has also developed and implemented mechanisms to assess training programs but could take additional actions. For example, in September 2014, we found that DHS had implemented component- specific and department-wide training programs and that the five DHS components in our review all had documented processes to evaluate their training programs. However, to fully achieve this outcome, DHS also needs to, among other things, issue department-wide policies on training and development and strengthen its learning management capabilities. In February 2016, we reported that DHS had initiated the Human Resources Information Technology (HRIT) investment in 2003 to address issues presented by its human resource environment, which with respect to learning management, included limitations resulting from nine disparate learning management systems that did not exchange information. DHS established the Performance and Learning Management System (PALMS) program to provide a system that will consolidate DHS’s nine existing learning management systems into one system and enable comprehensive training reporting and analysis across the department, among other things. However, in our February 2016 report we found that selected PALMS capabilities had been deployed to headquarters and two components, but full implementation at four components was not planned, leaving uncertainty about whether the PALMS system would be used enterprise-wide to accomplish these goals. We further found that DHS did not fully implement effective acquisition management practices and therefore was limited in monitoring and overseeing the implementation of PALMS and ensuring that the department obtains a system that improves its learning management weaknesses, reduces duplication, and delivers within cost and schedule commitments. We made 14 recommendations to DHS to, among other things, address HRIT’s poor progress and ineffective management. DHS concurred with all 14 recommendations and provided estimated completion dates for implementing each of them. Management integration. DHS has sustained its progress in fully addressing 3 of 4 outcomes we identified and they agreed are key to the department’s management integration efforts. For example, in January 2011, DHS issued an initial action plan to guide its management integration efforts—the Integrated Strategy for High Risk Management. Since then, DHS has generally made improvements to the strategy with each update based on feedback we provided. DHS has also shown important progress in addressing the last and most significant management integration outcome—to implement actions and outcomes in each management area to develop consistent or consolidated processes and systems within and across its management functional areas—but, as we concluded in our 2015 update, considerable work remains. For example, the Secretary’s April 2014 Strengthening Departmental Unity of Effort memorandum highlighted a number of initiatives designed to allow the department to operate in a more integrated fashion. Further, in its January 2016 update, DHS reported that in August 2015 the Under Secretary for Management identified four integrated priority areas to bring focus to strengthening integration among the department’s management functions. According to DHS’s January 2016 update, these priorities— which include, for example, strengthening resource allocation and reporting ability and developing and deploying secure technology solutions—each have stretch goals and milestones that are monitored by integrated teams led by senior DHS officials. However, given that these management integration initiatives are in the early stages of implementation, it is too early to assess their impact. We concluded in our 2015 report and continue to believe that in the coming years, DHS needs to continue implementing its Integrated Strategy for High Risk Management and show measurable, sustainable progress in implementing its key management initiatives and corrective actions and achieving outcomes. In doing so, it will be important for DHS to maintain its current level of top leadership support and sustained commitment to ensure continued progress in executing its corrective actions through completion; continue to implement its plan for addressing this high-risk area and periodically report its progress to us and Congress; identify and work to mitigate any resource gaps and prioritize initiatives as needed to ensure it can implement and sustain its corrective actions; closely track and independently validate the effectiveness and sustainability of its corrective actions and make midcourse adjustments as needed; and make continued progress in achieving the 20 actions and outcomes it has not fully addressed and demonstrate that systems, personnel, and policies are in place to ensure that results can be sustained over time. We will continue to monitor DHS’s efforts in this high-risk area to determine if the actions and outcomes are achieved and sustained over the long term. Each year, DHS invests billions of dollars in its major acquisition programs to help execute its many critical missions. In fiscal year 2015 alone, DHS reported that it planned to spend approximately $7.2 billion on these acquisition programs, and the department expects it will ultimately invest more than $180 billion in them. DHS and its underlying components are acquiring systems to help secure the border, increase marine safety, screen travelers, enhance cyber security, improve disaster response, and execute a wide variety of other operations. Each of DHS’s major acquisition programs generally costs $300 million or more and spans multiple years. To help manage these programs, DHS has established an acquisition management policy that we found in September 2012 to be generally sound, in that it reflects key program management practices. However, we also have found that DHS has lacked discipline in managing its programs according to this policy, and that many acquisition programs have faced a variety of challenges. These challenges can contribute to poor acquisition outcomes, such as cost increases or the risk of end users—such as border patrol agents or first responders in a disaster— receiving technologies that do not work as expected. Reflecting the shortcomings we have identified since 2005, we have made 64 recommendations to DHS on acquisition management issues; 42 of which have been implemented. Our findings also formed the basis of the five acquisition management outcomes identified in the high risk list, which DHS continues to address. As detailed below, DHS has fully addressed one outcome, mostly addressed two outcomes, partially addressed one outcome, and initiated efforts to address the final outcome. Outcome 1: Validate required acquisition documents in a timely manner (mostly addressed); Outcome 2: Establish effective component level acquisition capability (fully addressed); Outcome 3: Establish and effectively operate the Joint Requirements Council (partially addressed); Outcome 4: Assess and address whether appropriate numbers of trained acquisition personnel are in place at the department component levels (mostly addressed); and Outcome 5: Demonstrate that major acquisition programs are on track to achieve their cost, schedule, and capability goals (initiated). In March 2005, we reported that a lack of clear accountability was hampering DHS’s efforts to integrate the acquisition functions of its numerous organizations into an effective whole. We found that DHS remained a collection of disparate organizations, many of which were performing functions with insufficient oversight, giving rise to an environment rife with challenges. For example, the Chief Procurement Officer had been delegated the responsibility to manage, administer, and oversee all acquisition activity across DHS, but in practice enforcement of these activities was spread throughout the department with unclear accountability. We concluded that unless DHS’s top leaders addressed these challenges, the department was at risk of continuing to exist with a fragmented acquisition organization that provided stopgap, ad hoc solutions. In November 2008, we found that billions invested in major acquisition programs continued to lack appropriate oversight. While the acquisition review process DHS had in place at the time of our review called for executive decision making at key points in an acquisition program’s life cycle, the process had not provided the oversight needed to identify and address cost, schedule, and performance problems in its major investments. Poor implementation of the process was evidenced by the number of programs that did not adhere to the department’s acquisition review policy—of DHS’s 48 major programs requiring milestone and annual reviews, 45 were not assessed in accordance with this policy. Furthermore, at least 14 of these programs had reported cost growth, schedule slips, or performance shortfalls. We found that poor implementation was largely the result of DHS’s failure to ensure that the department’s major acquisition decision-making bodies effectively carried out their oversight responsibilities and had the resources to do so. For example, although a Joint Requirements Council had been responsible for managing acquisition investment portfolios and validating requirements, the council had not met since 2006. We also found in November 2008 that acquisition program budget decisions had been made in the absence of required oversight reviews and, as a result, DHS could not ensure that annual funding decisions for its major investments made the best use of resources and addressed mission needs. We found almost a third of DHS’s major investments received funding without having validated mission needs and requirements—which confirm a need is justified—and two-thirds did not have required life-cycle cost estimates. Without validated requirements, life-cycle cost estimates, and regular portfolio reviews, DHS cannot ensure that its investment decisions are appropriate and will ultimately address capability gaps. In July 2008, 15 of the 57 DHS major investments we reviewed were designated by the Office of Management and Budget as poorly planned and by DHS as poorly performing. Among other things, we recommended that DHS reinstate the Joint Requirements Council or establish another departmental joint requirements oversight board to review and approve acquisition requirements and assess potential duplication of effort. In November 2008, DHS issued the initial version of Acquisition Management Directive 102-01—the policy in effect today—in an effort to establish an acquisition management system that effectively provides required capability to operators in support of the department’s missions. DHS Acquisition Management Directive 102-01 and DHS Instruction Manual 102-01-001, which includes 12 appendixes, establish the department’s policies and processes for managing these major acquisition programs. In September 2012 we found that these documents reflect many key program management practices that could help mitigate program risks. Table 3 presents our 2012 assessment of the policy. However, in September 2012 we also found that DHS had not consistently met the policy’s requirements. At the time of our 2012 review, the department had only verified that 4 of 66 programs documented all of the critical knowledge the policy requires to proceed with acquisition activities. See figure 1. In 2012, most major programs lacked reliable cost estimates, realistic schedules, and agreed-upon baseline objectives, limiting DHS leadership’s ability to effectively manage those programs and provide information to Congress. As a result, we were only able to gain insight into the magnitude of the cost growth for 16 of 77 programs we reviewed, but we found that their aggregate cost estimates had increased by 166 percent. Additionally, we found that nearly all of the DHS program managers we surveyed in 2012 reported their programs had experienced significant challenges. Sixty-eight of the 71 respondents reported they experienced funding instability, faced workforce shortfalls, or their planned capabilities changed after initiation, and most survey respondents reported a combination of these challenges. DHS has concurred with and presented plans for addressing all of the acquisition management recommendations that we have addressed to the Secretary since September 2012, the implementation of which will enhance acquisition management. For example, in April 2014, we found that the department’s Acquisition Review Board rarely directed programs to make tradeoffs for affordability. We recommended that this board assess program-specific tradeoffs at all of its meetings, particularly in light of the fact that the department had identified a 30-percent gap between the 5-year funding needed for its major acquisitions and the actual resources expected to be available. DHS has since implemented this recommendation. Furthermore, in reviews completed in March, April, and October of 2015, we found that DHS had taken steps to improve oversight of its major acquisition programs and that it had begun to implement its 2008 acquisition policy more consistently. Many of DHS’s recent actions correspond to the high risk outcomes, as shown in the table 4. DHS faced a unique challenge when it was formed—merging 22 separate entities into a single department—which included integrating the acquisition functions of its numerous organizations into an effective whole. The department is to be commended for the efforts its leadership has taken to address the acquisition management shortcomings we have identified over the past 10 years. However, in our April 2015 review, we continued to find enduring challenges to acquisition programs, such as: Staffing shortfalls—DHS reported that 21 of the 22 programs we reviewed faced program office workforce shortfalls pertaining to such positions as program managers, systems engineers, and logisticians. Program funding gaps—we found that 11 of the 22 programs we reviewed faced funding gaps (projected funding vs. estimated costs) of 10 percent or greater, including five programs that faced gaps of 30 percent or greater. Inconsistencies in how components were implementing the department’s acquisition management policy—for example, we found that the funding plans for Coast Guard programs continued to be incomplete, in that they did not account for all of the operations and maintenance funding the Coast Guard planned to allocate to its major acquisition programs. These gaps in information reduce the value of the funding plans presented to Congress and obscure the affordability of Coast Guard acquisition programs. Further, as we noted in our most recent high risk update, the department has additional work to do to fully address the remaining acquisition management outcomes. To address these issues, we have, among other things, recommended that DHS assess program-specific affordability tradeoffs at all acquisition review meetings and ensure that funding plans submitted to Congress are comprehensive and clearly account for all operations and maintenance funding that DHS plans to allocate to its programs. DHS concurred with these recommendations and is taking actions to implement them. For example, DHS established that department leadership would, during all acquisition program reviews, specifically address affordability issues and make explicit tradeoffs as necessary, and DHS officials told us that DHS leadership is discussing affordability at all program reviews to help ensure adequate funding exists. Additionally, DHS has continued to obtain department-level approval for program baselines as needed, and has initiated efforts to improve the quality of acquisition data reported by components. To ensure that recent efforts are sustained, the department must continue to implement its sound acquisition policy consistently and effectively across all components. We continue to track DHS’s progress through ongoing reviews of the Joint Requirements Council, non-major program acquisitions, and our annual assessment of major acquisition programs, in addition to our high risk updates. Chairman Johnson, Ranking Member Carper, and members of the committee, this completes our prepared statement. We would be happy to respond to any questions you may have at this time. For further information about this testimony, please contact Rebecca Gambler at (202) 512-8777 or gamblerr@gao.gov or Michele Mackin at (202)-512-4841 or mackinm@gao.gov. In addition, contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals making key contributions to this statement include Larry Crosland, Jennifer Kamara, James Kernen, Emily Kuhn, Elizabeth Luke, Valerie Freeman, David Lysy, Taylor Matheson, Shannin O’Neill, Lindsay Taylor, Nathan Tranquilli, Katherine Trimble, and Shaunyce Wallace. Key contributors for the previous work that this testimony is based on are listed in each product. Homeland Security: Weak Oversight of Human Resources Information Technology Investment Needs Considerable Improvement. GAO-16- 407T. Washington, D.C.: February 25, 2016. Homeland Security: Oversight of Neglected Human Resources Information Technology Investment Is Needed. GAO-16-253. Washington, D.C.: February 11, 2016. Immigration Benefits System: Better Informed Decision Making Needed on Transformation Program. GAO-15-415. Washington, D.C.: May 18, 2015. Homeland Security Acquisitions: Major Program Assessments Reveal Actions Needed to Improve Accountability. GAO-15-171SP. Washington, D.C.: April 22, 2015. Homeland Security Acquisitions: DHS Should Better Define Oversight Roles and Improve Program Reporting to Congress. GAO-15-292. Washington, D.C.: March 12, 2015. Department of Homeland Security: Progress Made, but More Work Remains in Strengthening Management Functions. GAO-15-388T. Washington, D.C.: February 26, 2015. DHS Training: Improved Documentation, Resource Tracking, and Performance Measurement Could Strengthen Efforts. GAO-14-688. Washington, D.C.: September 10, 2014. Department of Homeland Security: Progress Made; Significant Work Remains in Addressing High-Risk Areas. GAO-14-532T. Washington, D.C.: May 7, 2014. Homeland Security Acquisitions: DHS Could Better Manage Its Portfolio to Address Funding Gaps and Improve Communications with Congress. GAO-14-332. Washington, D.C.: April 17, 2014. Department of Homeland Security: DHS’s Efforts to Improve Employee Morale and Fill Senior Leadership Vacancies. GAO-14-228T. Washington, D.C.: December 12, 2013. DHS Financial Management: Continued Effort Needed to Address Internal Control and System Challenges. GAO-14-106T. Washington, D.C.: November 15, 2013. Information Technology: Additional OMB and Agency Actions Are Needed to Achieve Portfolio Savings. GAO-14-65. Washington, D.C.: November 6, 2013. DHS Financial Management: Additional Efforts Needed to Resolve Deficiencies in Internal Controls and Financial Management Systems. GAO-13-561. Washington, D.C.: September 30, 2013. Information Technology: Additional Executive Review Sessions Needed to Address Troubled Projects. GAO-13-524. Washington, D.C.: June 13, 2013. Department of Homeland Security: Taking Further Action to Better Determine Causes of Morale Problems Would Assist in Targeting Action Plans. GAO-12-940. Washington, D.C.: September 28, 2012. Homeland Security: DHS Requires More Disciplined Investment Management to Help Meet Mission Needs. GAO-12-833. Washington, D.C.: September 18, 2012. Department of Homeland Security: Billions Invested in Major Programs Lack Appropriate Oversight. GAO-09-29. Washington, D.C.: November 18, 2008. Homeland Security: Successes and Challenges in DHS’s Efforts to Create an Effective Acquisition Organization. GAO-05-179. Washington, D.C.: March 29, 2005. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: In 2003, GAO designated implementing and transforming DHS as high risk because the failure to address risks associated with transforming 22 agencies into one department could have serious consequences for U.S. national and economic security. While challenges remain, DHS has made considerable progress. As a result, in 2013 GAO narrowed the scope of the high-risk area to focus on strengthening and integrating DHS management functions (human capital, acquisition, financial, and information technology). This statement discusses DHS's progress and actions remaining in addressing these functions with a focus on acquisition management. In fiscal year 2015 alone, DHS reported that it planned to spend approximately $7.2 billion on its major acquisition programs to help execute its many critical missions. This statement is based on GAO's 2015 high-risk update, GAO products from 2005 through 2016, and selected updates from ongoing work. To conduct past and ongoing work we reviewed key documents such as DHS strategies and interviewed agency officials. The Department of Homeland Security's (DHS) efforts to strengthen and integrate its management functions have resulted in it meeting three and partially meeting two of GAO's criteria for removal from the high-risk list (see table). For example, DHS has established a plan for addressing the high-risk area and a framework for monitoring its progress in implementing the plan. However, DHS needs to show additional results in other areas, including demonstrating the ability to achieve sustained progress across 30 outcomes that GAO identified and DHS agreed were needed to address the high-risk area. As of March 2016, DHS had fully addressed 10 of these outcomes but work remained in 20. GAO has reported on DHS's acquisition management for over 10 years. The department has struggled to effectively manage its major programs, including ensuring that all major acquisitions had approved baselines and that they were affordable. GAO has noted significant progress in recent reviews (see table). This progress is largely attributable to sustained senior leadership attention. Source: GAO analysis of DHS documents, interviews, and prior GAO reports. | GAO-16-507T To ensure that recent efforts are sustained, the department must continue to implement its sound acquisition policy consistently and effectively across all components. GAO has made numerous recommendations in this regard, which DHS has concurred with and is taking actions to implement. This testimony contains no new recommendations. GAO has made about 2,400 recommendations to DHS since 2003 to strengthen management efforts, among other things. DHS has implemented more than 70 percent of these recommendations, including those related to acquisition management, and has actions under way to address others.