Since the department’s creation in 2003, we have designated the implementation and transformation of DHS as high risk because DHS had to combine 22 agencies—several with major management challenges— into one department, and failure to effectively address DHS’s management and mission risks could have serious consequences for U.S. national and economic security. This high-risk area includes (1) challenges in strengthening DHS’s management functions—financial management, human capital, information technology (IT), and acquisition management—(2) the effect of those challenges on DHS’s mission implementation, and (3) challenges in integrating management functions within and across the department and its components. On the basis of our prior work, in September 2010 we identified and provided to DHS 31 actions and outcomes that are critical to addressing the challenges within the department’s management areas and in integrating those functions across the department. These key actions and outcomes include, among others, validating required acquisition documents in accordance with a department-approved, knowledge-based acquisition process. The Aviation and Transportation Security Act (ATSA) established TSA as the federal agency with primary responsibility for securing the nation’s civil aviation system, which includes the screening of all passengers and property transported from and within the United States by commercial passenger aircraft. In accordance with ATSA, all passengers, their accessible property, and their checked baggage are screened pursuant to TSA-established procedures at more than 450 airports presently regulated for security by TSA. These procedures generally provide, among other things, that passengers pass through security checkpoints where they and their identification documents, and accessible property, are checked by transportation security officers (TSO), other TSA employees, or by private-sector screeners under TSA’s Screening Partnership Program. TSA relies upon multiple layers of security to deter, detect, and disrupt persons posing a potential risk to aviation security. These layers include TSOs responsible for screening passengers and their carry-on baggage at passenger checkpoints, using technologies that include x-ray equipment, magnetometers, and Advanced Imaging Technology (AIT), among others. In response to the December 2009 attempted terrorist attack, TSA revised its procurement and deployment strategy for AIT, commonly referred to as full-body scanners, increasing the number of AIT units it planned to procure and deploy. TSA stated that AIT provides enhanced security benefits compared with walk-through metal detectors, such as enhanced detection capabilities for identifying nonmetallic threat objects and liquids. AIT produces an image of a passenger’s body that a screener interprets. The image identifies objects, or anomalies, on the outside of the physical body but does not reveal items beneath the surface of the skin, such as implants. As of May 2012, TSA has deployed more than 670 AIT units to approximately 170 airports and reported that it plans to deploy a total of about 1,250 AIT units. In January 2012, we issued a classified report on TSA’s procurement and deployment of AIT that addressed the extent to which (1) TSA followed DHS acquisition guidance when procuring AIT and (2) deployed AIT units are effective at detecting threats. Another layer of security is checked-baggage screening, which uses technology referred to as explosive detection systems (EDS) and explosives trace detection (ETD). Our past work has found that technology program performance cannot be accurately assessed without valid baseline requirements established at the program start. Without the development, review, and approval of key acquisition documents, such as the mission need statement and operational requirements document, agencies are at risk of having poorly defined requirements that can negatively affect program performance and contribute to increased costs. For example, in June 2010, we reported that more than half of 15 DHS programs we reviewed awarded contracts to initiate acquisition activities without component or department approval of documents essential to planning acquisitions, setting operational requirements, or establishing acquisition program baselines.currently have ongoing work related to this area and we plan to report the results later this year. We made a number of recommendations to help address issues related to these procurements as discussed below. DHS has generally agreed with these recommendations and, to varying degrees, has taken actions to address them. In addition, our past work has found that TSA faces challenges in identifying and meeting program requirements in some of its aviation security programs. For example: We reported in January 2012 that TSA did not fully follow DHS acquisition policies when acquiring AIT, which resulted in DHS approving full AIT deployment without full knowledge of TSA’s revised specifications. Specifically, DHS’s Acquisition Directive 102 required TSA to notify DHS’s Acquisition Review Board (ARB) if AIT could not meet any of TSA’s five key performance parameters (KPP) or if TSA changed a KPP during qualification testing. Senior TSA officials acknowledged that TSA did not comply with the directive’s requirements, but stated that TSA still reached a “good decision” in procuring AIT and that the ARB was fully informed of the program’s changes to its KPPs. Further, TSA officials stated that the program was not bound by the directive because it was a new acquisition process and they believed that the ARB was not fully functioning at the time. DHS officials stated that the ARB discussed the changed KPP but did not see the documents related to the change and determined that TSA must update the program’s key acquisition document, the Acquisition Program Baseline, before TSA could deploy AIT units. However, we reported that, according to a February 2010 acquisition decision memorandum from DHS, the ARB approved TSA for full-scale production without reviewing the changed KPP. DHS officials stated that the ARB should have formally reviewed changes made to the KPP to ensure that TSA did not change it arbitrarily. According to TSA, it should have submitted its revised requirements for approval, but it did not because there was confusion as to whether DHS should be informed of all changes. We had previously reported that programs procuring new technologies with fluctuating requirements will have a difficult time ensuring that the acquisition is meeting program needs. DHS acquisition oversight officials agreed that changing key requirements is not a best practice for system acquisitions already under way. As a result, we found that TSA procured and deployed a technology that met evolving requirements, but not the initial requirements included in its key acquisition requirements document that the agency initially determined were necessary to enhance the aviation system. We recommended that TSA should develop a roadmap that outlines vendors’ progress in meeting all KPPs. DHS agreed with our recommendation. In July 2011, we reported that TSA revised its EDS requirements to better address current threats, and plans to implement these requirements in a phased approach. However, we reported that some number of EDS machines in TSA’s checked baggage screening fleet are configured to detect explosives at the levels established in the 2005 requirements. The remaining EDS machines are configured to detect explosives at 1998 levels. When TSA established the 2005 requirements, it did not have a plan with the appropriate time frames needed to deploy EDSs to meet the requirements. To help ensure that TSA’s checked baggage screening machines are operating most effectively, we recommended that TSA develop a plan to deploy EDSs to meet the most recent explosive-detection requirements and ensure that the new machines, as well as machines deployed in airports, are operated at the levels in established requirements. DHS concurred with our recommendation and has begun taking action to address it; for example, DHS reported that TSA has developed a plan to evaluate its current fleet of EDSs to determine the extent to which they comply with these requirements. However, our recommendation is intended to ensure that TSA operate all EDSs at airports at the most recent requirements. Until TSA develops a plan identifying how it will approach the upgrades for currently deployed EDSs—and the plan includes such items as estimated costs and the number of machines that can be upgraded—it will be difficult for TSA to provide reasonable assurance that its upgrade approach is feasible or cost effective. Our prior work has also shown that not resolving problems discovered during testing can sometimes lead to costly redesign and rework at a later date. Addressing such problems before moving to the acquisition phase can help agencies better manage costs. Specifically: In January 2012, we reported that TSA began deploying AIT before it received approval for how it would test AIT. For example, DHS’s Acquisition Directive 102 required DHS to approve testing and evaluation master plans—the documents that ensure that programs are tested appropriately—prior to testing. However, we found that DHS did not approve TSA’s testing and evaluation master plan until January 2010, after TSA had completed qualification and operational tests and DHS had already approved TSA for full AIT deployment. According to DHS, the DHS Director of Operational Testing and Evaluation assessed the testing of AIT prior to the September 2009 ARB meeting and recommended approving the decision to procure AIT at that meeting, even though the ARB did not approve its testing plans. Additionally, we reported that DHS approved TSA’s AIT deployment in September 2009, on the basis of laboratory-based qualification testing results and initial field-based operational testing results that were not completed until later that year. According to DHS officials, the department initially had challenges providing effective oversight to projects already engaged in procurement when the directive was issued. For example, they noted that TSA had begun conducting qualification testing in 2009, but DHS’s first AIT oversight meeting under the new directive was not until later that year. As a result, we reported that TSA procured AIT without DHS’s full oversight and approval or knowledge of how TSA would test and evaluate AIT. In July 2011, we reported that TSA revised the explosive detection requirements for EDS checked baggage screening machines in 2005 though it did not begin operating EDS systems to meet these 2005 requirements until 2009.