DHS has made progress in implementing its acquisition, information technology, financial, and human capital management functions, but continues to face obstacles and weaknesses in these functions that could hinder the department’s transformation and implementation efforts. For example, DHS has faced challenges in implementing acquisition management controls, a consolidated financial management system, and a strategic human capital plan, among other things. As DHS continues to mature as an organization, it will be important that the department continue to work to strengthen its management functions since the effectiveness of these functions affects its ability to fulfill its homeland security and other missions. Acquisition management. While DHS has made recent progress in clarifying acquisition oversight processes, it continues to face obstacles in managing its acquisitions and ensuring proper implementation and departmentwide coordination. We previously reported that DHS faced challenges in acquisition management related to acquisition oversight, cost growth, and schedule delays. In June 2010, we reported that DHS continued to develop its acquisition oversight function and had begun to implement a revised acquisition management directive that includes more detailed guidance for programs to use when informing component and departmental decision making. We also reported that the senior-level Acquisition Review Board had begun to meet more frequently and provided programs decision memorandums with action items to improve performance. However, while the Acquisition Review Board reviewed 24 major acquisition programs in fiscal years 2008 and 2009, more than 40 major acquisition programs had not been reviewed, and programs had not consistently implemented review action items identified as part of the review by established deadlines. DHS acquisition oversight officials raised concerns about the accuracy of cost estimates for some of its major programs, making it difficult to assess the significance of the cost growth we identified. In addition, over half of the programs we reviewed awarded contracts to initiate acquisition activities without component or department approval of documents essential to planning acquisitions, setting operational requirements, and establishing acquisition program baselines. Programs also experienced other acquisition planning challenges, such as staffing shortages and lack of sustainment. For example, we reported that the U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT) did not sufficiently define what capabilities and benefits would be delivered, by when, and at what cost, which contributed to development and deployment delays. In addition, we reported that three Coast Guard programs we reviewed—Maritime Patrol Aircraft, Response Boat-Medium, and Sentinel—reported placing orders for or receiving significant numbers of units prior to completing testing to demonstrate that what the programs were buying met Coast Guard needs. Our prior work has found that resolution of problems discovered during testing can sometimes require costly redesign or rework. We have made a number of recommendations to DHS to strengthen its acquisition management functions, such as (1) reinstating the Joint Requirements Council —the department’s requirements review body—or establishing another departmental joint requirements oversight board to review and approve acquisition requirements and assess potential duplication of effort; (2) ensuring that budget decisions are informed by the results of investment reviews; (3) identifying and aligning sufficient management resources to implement oversight reviews throughout the investment life cycle; and (4) ensuring major investments comply with established component and departmental review policy standards. DHS generally concurred with these recommendations and reported taking action to begin to address some of them, including developing the Next Generation Periodic Reporting System to capture and track key program information, and monitoring cost and schedule performance, contract awards and program risks. Based on our work on DHS’s acquisition management, we have identified specific actions and outcomes that we believe the department needs to achieve to address its acquisition management challenges. We believe that these actions and outcomes are critical to addressing the underlying root causes that have resulted in the high-risk designation. In particular, DHS should demonstrate and sustain effective execution of a knowledge-based acquisition process for new and legacy acquisition programs by, among other things, (1) validating required acquisition documents in a timely manner at each major milestone; (2) establishing and operating a Joint Requirements Council, or a similar body, to review and validate acquisition programs’ requirements; (3) ensuring sufficient numbers of trained acquisition personnel at the department and component levels; and (4) establishing and demonstrating measurable progress in achieving goals that improve acquisition programs’ compliance with departmental policies. Information technology management. DHS has undertaken efforts to establish information technology management controls and capabilities, but in September 2009 we reported that DHS had made uneven progress in its information technology management efforts to institutionalize a framework of interrelated management controls and capabilities. For example, DHS had continued to issue annual updates to its enterprise architecture that added previously missing scope and depth, and further improvements were planned to incorporate the level of content, referred to as segment architectures, needed to effectively introduce new systems and modify existing ones. Also, we reported that DHS had redefined its acquisition and investment management policies, practices, and structures, including establishing a system life cycle management methodology, and it had increased its acquisition workforce. Nevertheless, challenges remain relative to, for example, implementing the department’s plan for strengthening its information technology human capital and fully defining key system investment and acquisition management policies and procedures for information technology. Moreover, the extent to which DHS had actually implemented these investment and acquisition management policies and practices on major information technology programs had been inconsistent. For example, our work showed that major information technology acquisition programs had not been subjected to executive-level acquisition and investment management reviews. As a result, we reported that major information technology programs aimed at delivering important mission capabilities, such as the Rescue 21 search and rescue system and the Secure Border Initiative Network (SBInet) virtual border fence, had not lived up to their capability, benefit, cost, and schedule expectations because of, for example, deficiencies in development and testing, and lack of risk management processes and key practices for developing reliable cost and schedule estimates. We have made a range of recommendations to strengthen DHS information technology management, such as establishing procedures for implementing project-specific investment management policies, and policies and procedures for portfolio-based investment management. We reported that while DHS and its components have made progress, more needs to be done before DHS can ensure that all system acquisitions are managed with the necessary rigor and discipline. Based on our work, we have identified actions and outcomes that we believe would help the department address challenges in information technology management that have contributed to our designation of DHS implementation and transformation as high risk. For example, DHS should, among other things, demonstrate measurable progress in implementing its information technology human capital plan and accomplishing defined outcomes, including ensuring that each system acquisition program office is sufficiently staffed. DHS should also establish and implement information technology investment management practices that have been independently assessed as having satisfied the capabilities associated with stage three of our Information Technology Investment Management Framework. In addition, the department should establish enhanced security of the department’s internal information technology systems and networks. Financial management. DHS has made progress in addressing its financial management and internal controls weaknesses, but has not yet addressed all of them or developed a consolidated departmentwide financial management system. Since its establishment, DHS has been unable to obtain an unqualified audit opinion on its financial statements (i.e., prepare a set of financial statements that are considered reliable). For fiscal year 2009, the independent auditor issued a disclaimer on DHS’s financial statements and identified eight deficiencies in DHS’s internal control over financial reporting, six of which were so significant that they qualified as material weaknesses. Until these weaknesses are resolved, DHS will not be in position to provide reliable, timely, and useful financial data to support day-to-day decision making. DHS has taken steps to prepare and implement corrective action plans for its internal control weaknesses through the Internal Control Playbook, DHS’s annual plan to design and implement departmentwide internal controls. In addition, in June 2007 and December 2009 we reported on DHS’s progress in developing a consolidated financial management system, called the Transformation and Systems Consolidation (TASC) program, and made a number of recommendations to help DHS address challenges affecting the departmentwide financial management integration. In June 2007, we reported that DHS had made limited progress in integrating its existing financial management systems, and we made six recommendations focused on the need for DHS to define a departmentwide strategy and embrace disciplined processes necessary to properly manage the specific projects. We followed up on these recommendation in our December 2009 report and found that DHS had begun to take actions to implement four of our six 2007 recommendations but had not yet fully implemented any of them. Specifically, DHS had made progress in (1) defining its financial management strategy and plan, (2) developing a comprehensive concept of operations, (3) incorporating disciplined processes, and (4) implementing key human capital practices and plans for such a systems implementation effort. However, DHS had not yet taken the necessary actions to standardize and reengineer business processes across the department, including applicable internal controls, and to develop detailed consolidation and migration plans. While some of the details of the department’s standardization of business processes and migration plans depend on the selected new financial management system, DHS would benefit from performing a gap analysis and identifying all of its affected current business processes so that DHS can analyze how closely the proposed system will meet the department’s needs. In addition, we reported that DHS’s reliance on contractors to define and implement the new financial management system, without the necessary oversight mechanisms to ensure that the processes were properly defined and effectively implemented, could result in system efforts plagued with serious performance and management problems. We reported that these issues placed DHS at risk for implementing a financial management system that does not meet cost, schedule, and performance goals. We recommended that DHS establish contractor oversight mechanisms to monitor the TASC program; expedite the completion of the development of the TASC financial management strategy and plan so that the department is well positioned to move forward with an integrated solution; and develop a human capital plan for the TASC program that identifies needed skills for the acquisition and implementation of the new system.