DHS’s acquisition management policy, commonly referred to as MD-102, as implemented by the DHS Instruction Manual, establishes two overarching categories of acquisitions: acquisitions of capital assets— such as information technology (IT) systems or aircraft—and acquisitions of services—such as those provided by security guards and emergency responders. For each acquisition type, acquisitions are further categorized as major or non-major based on expected cost. An acquisition’s major or non-major status determines who acts as the Acquisition Decision Authority (ADA), the individual responsible for management and oversight of the acquisition. DHS policy established the DHS Chief Acquisition Officer as the ADA for major acquisitions and the Component Acquisition Executive (CAE)—the senior acquisition official within the component—as the ADA for all non-major acquisitions. CAEs have overarching responsibility for the acquisition cost, schedule, risk, and system performance of the component’s acquisition portfolio and are responsible for ensuring that appropriate acquisition planning takes place. According to the DHS Instruction Manual, the CAEs are required to establish component-specific non-major acquisition policies and guidance that support the “spirit and intent” of department acquisition policies. CAEs establish unique processes for managing their components’ non- major acquisitions. Components that do not have CAE-approved policies for non-major acquisition management are required to follow MD-102 and the Instruction until those policies are developed. Figure 1 illustrates the decision authority and thresholds for major and non-major acquisitions. DHS acquisition policy establishes an acquisition lifecycle framework that includes a series of five acquisition decision events. These acquisition decision events provide the ADA an opportunity to assess whether an acquisition meets certain requirements and is ready to proceed through the lifecycle phases. Figure 2 depicts the five acquisition decision events and the four phases of the acquisition lifecycle. As part of an acquisition decision event for a major acquisition, the ADA reviews and approves key acquisition documents, such as an acquisition program baseline. An acquisition program baseline establishes an acquisition’s critical cost, schedule, and performance parameters. Baselines are useful management tools that can help leadership (1) understand of the scope of an acquisition, (2) assess how well the acquisition is being executed, and (3) secure adequate funding. For non- major acquisitions, each CAE has flexibility in deciding how his or her component will apply the acquisition lifecycle framework and the types of documentation that will be required at each acquisition decision event. The Instruction grants the components flexibility when managing non- major acquisitions. Within DHS headquarters, PARM is the lead office responsible for overseeing the department’s acquisition processes. PARM has a direct management role with major acquisitions and less oversight of non-major acquisitions. For non-major acquisitions, PARM’s role is to ensure CAEs are overseeing their components’ acquisitions appropriately, and facilitate component efforts to report acquisition information using DHS’s INVEST system, among other things. The INVEST system is a central repository for data on DHS acquisitions and investments, such as budget, schedule, and performance information. INVEST data are used to oversee both major and non-major acquisitions and to satisfy internal and external reporting requirements. DHS’s component agencies lack the information needed to effectively oversee their non-major acquisitions because they cannot confidently identify all of them. They identified over $6 billion in non-major acquisitions; however, we found 8 of the 11 components could not identify all of their non-major acquisitions and we found that the data that 9 components provided for these acquisitions were unreliable. Several officials indicated that their focus had been on major acquisitions historically, and they had not turned their attention to non-major acquisitions until more recently. Many component officials said they were still in the process of identifying all of their non-major acquisitions, but it was unclear when they would complete these efforts. DHS headquarters had not established time frames for components to do so, which may have resulted in components losing traction in their efforts. Federal internal controls standards establish that management should obtain relevant data from reliable sources in a timely manner. Another key challenge involves the use of baselines, which establish a program’s critical cost, schedule, and performance parameters. Component officials identified 38 non-major acquisitions that were active at the start of fiscal year 2017 (as opposed to acquisitions that have been delivered to end users and are considered to be non-active). We found that most of the active non-major acquisitions (23 of 38) did not have approved baselines, and that the value of the acquisitions without baselines constituted nearly half of the total value of the active acquisitions. At the beginning of fiscal year 2017, some components did not require approved baselines. However, in response to our preliminary findings, in February 2017, DHS required component leadership approve baselines for non-major acquisitions, which should help components oversee them more effectively. Component officials identified 38 non-major acquisitions, valued at greater than $6 billion, that were active as of the start of fiscal year 2017. We define acquisitions to be active when they have entered the obtain phase of the acquisition lifecycle and have not yet achieved FOC. Of the reported 38 active acquisitions, 36 were capital asset acquisitions with a total value exceeding $6 billion. The remaining two active acquisitions were services acquisitions with combined annual expenditures of $19 million in 2016. Across DHS, components identified a total of 255 non- major acquisitions in all phases of the acquisition lifecycle. DHS’s non-major acquisitions encompass diverse systems and capabilities that address critical mission needs including immigration services, law enforcement, and disaster response. For example, non- major acquisitions include USCG response boats that perform law enforcement and search and rescue missions; CBP’s Mobile Video Surveillance System, which identifies and detects illegal incursions into areas that have gaps in coverage from other surveillance systems; and DNDO’s Human Portable Tripwire, a small, wearable system that can detect radiological threats. Figure 3 depicts these three acquisitions. Acquisition management efforts have the greatest impact on active acquisitions. When an acquisition is considered active, managers develop, test, and evaluate the extent to which the acquired capability can meet DHS mission needs, and adhere to critical cost, schedule, and performance parameters. By comparison, acquisition management activities have less impact on acquisitions that have reached FOC because these acquisitions have passed key decision events in the acquisition lifecycle. Meanwhile, we define acquisitions that are very early in the acquisition life cycle, i.e. in the need or analyze/select phases, to be pre-active. Pre-active acquisitions do not yet have critical cost, schedule, and performance parameters because component officials have not yet agreed on what they want, when they want it, or how much they want to spend. Figure 4 depicts the number of non-major acquisitions component officials identified by acquisition lifecycle phase. About 74 percent of the non-major acquisitions that component officials identified (189 of 255) had reached FOC at the start of fiscal year 2017, and components were operating and maintaining them until disposal. Although officials indicated these acquisitions were no longer active and had already passed all of their major acquisition decision events, it is still important for DHS to understand the scope of these acquisitions because up to 70 percent of an acquisition’s total life cycle costs can occur after FOC. About 11 percent of the non-major acquisitions that component officials identified (28 of 255) are in the pre-active phases of the acquisition lifecycle. During these phases, program managers identify a mission need that justifies investment in a new acquisition and evaluate alternative options to meet that need. DHS component officials identified 255 non-major acquisitions across DHS, but officials from most of the components (8 of 11) also reported to us that they were not confident that they had accounted for all of their non-major acquisitions. However, these officials also told us they were working to improve their ability to identify their non-major acquisitions going forward. In the view of some officials, the problems lie primarily in tracking the non-active acquisitions, rather than those that are still active. Even when component officials could identify these acquisitions, we found that the data they provided were often unreliable. The data reliability issues often involved the type of information included in acquisition baselines, specifically cost, schedule, and capability information. We spoke with officials from 11 components to get their perspective on whether they were able to accurately identify the full scope of their non- major acquisitions. Officials from 8 of the 11 DHS components told us they could not identify all of their non-major acquisitions. These officials were able to provide data on some acquisitions, but they were not confident that they had identified all of them. Officials from 3 of the 8 components stated that they were more confident in their ability to identify all active acquisitions but were less sure that the full scope of post-FOC acquisitions were identified. Component officials offered two reasons for the lack of confidence in the data: 1. Historically, managing non-major acquisitions has been a relatively low priority when compared to managing major acquisitions or other component activities. 2. The components lack effective procedures for identifying those acquisitions. Officials from all of the components we reviewed indicated that they are working to improve their management of non-major acquisitions for a variety of reasons, including to improve their ability to monitor acquisition cost growth and other acquisition performance metrics. Competing priorities: Officials from 6 components indicated that managing non-major acquisitions has historically been a lower priority than managing major acquisitions or other component activities. For example, CBP officials reported that since 2011, CBP’s CAE staff has focused on bringing major acquisitions into compliance with DHS acquisition policy. It took CBP until 2016 to baseline all of its Level 1 acquisitions. In 2014, CBP officials turned their attention to non-major acquisitions. They began to identify their non-major acquisitions, and worked to understand their purpose, status, and the CBP offices they support. According to CBP officials, these efforts are ongoing.