The US-VISIT expenditure plan partially satisfies 8 of the 11 legislative conditions required of DHS. For example, the plan partially satisfies the legislative conditions that it contain a listing of all open GAO and DHS Office of Inspector General recommendations. Specifically, while the plan did include a listing and status of our recommendations, it did not provide milestones for addressing any of the recommendations, as required by the act. include a certification by the DHS Chief Procurement Officer that the program was reviewed and approved in accordance with the department’s investment management process and that this process fulfilled all capital planning and investment control requirements and reviews established by the Office of Management and Budget (OMB). While the plan did include such a certification, it was based on information that pertains to the fiscal year 2007 expenditure plan and the fiscal year 2009 budget submission, rather than on the fiscal year 2008 expenditure plan, as required by the act. include an architectural compliance certification by the Chief Information Officer that the system architecture of the program is sufficiently aligned with the information system enterprise architecture of DHS. Specifically, while the plan did include such a certification, the basis for the certification was an assessment against the 2007 DHS enterprise architecture, which is a version that we recently reported to be missing important US-VISIT architectural content. provide a detailed accounting of operations and maintenance, contractor services, and program management costs. While the plan did provide an accounting of operations and maintenance, and program management costs, it did not separately identify the program’s contractor costs, as required by the act. The plan does not satisfy the remaining three conditions that apply to DHS. Specifically: The expenditure plan did not explicitly define how funds are to be obligated to meet future program commitments, including linking the planned expenditure of funds to milestone-based delivery of specific capabilities and services. While the plan linked funding to four broad core capability areas and associated projects, it did not link this planned use of funds to milestones, and it did not consistently decompose projects into specific mission capabilities, services, performance levels, benefits and outcomes, or program management capabilities. The expenditure plan did not include a certification by the DHS Chief Human Capital Officer that the program’s human capital needs are being strategically and proactively managed and that the program has sufficient human capital capacity to execute the expenditure plan. While the plan contained a certification, it only addressed that the human capital plan reviewed by the Chief Human Capital Officer contained specific initiatives to address the hiring, development, and retention of program employees and that a strategy existed to develop indicators to measure the progress and results of these initiatives. It did not address the implementation of this plan or whether the current human capital capabilities were sufficient to execute the expenditure plan. The expenditure plan did not include a complete schedule for the full implementation of a biometric exit program or certification that a biometric exit program is not possible within 5 years. While the plan contains a very high-level schedule that identifies five broadly defined tasks and high-level milestones, the schedule did not include, among other things, decomposition of the program into a work breakdown structure or sequencing, integrating, or resourcing each work element in the work breakdown structure. We are making five observations about US-VISIT relative to its proposed exit solution, its management of program risks, and its use of earned value management. These observations are summarized here. Reliability of cost estimates for air and sea exit alternatives is not clear. In developing its air and sea exit Notice of Proposed Rule Making (NPRM), DHS is required to prepare a written assessment of the costs, benefits, and other effects of its proposal and a reasonable number of alternatives and to adopt the least costly, most cost-effective, or least burdensome among them. To accomplish this, it is important that DHS have reliable cost estimates for its proposed and alternative solutions. However, the reliability of the estimates that DHS developed is not clear because (1) DHS documents characterize the estimates as being, by definition, rough and imprecise, but DHS officials responsible for developing the estimates stated that this characterization is not accurate; (2) our analysis of the estimates’ satisfaction of cost estimating best practices shows that while DHS satisfied some key practices, it did not fully satisfy others or the documentation provided was not sufficient for us to determine whether still other practices were met; and (3) data on certain variables pertaining to airline costs were not available for inclusion in the estimates, and airlines report that these costs were understated in the estimates. DHS reports that the proposed air and sea exit solution provides less security and privacy than other alternatives. Adequate security and privacy controls are needed to assure that personally identifiable information is secured against unauthorized access, use, disclosure, or retention. Such controls are especially needed for government agencies, where maintaining public trust is essential. In the case of US-VISIT, one of its stated goals is to protect the security and privacy of U.S. citizens and visitors. DHS’s proposed air and sea exit solution would require air and vessel carriers to implement and manage the collection of biometric data at the location(s) of their choice. However, the NPRM states that having carriers collect the biometric information is less secure than alternatives where DHS collects the information, regardless of the information collection point. Similarly, the NPRM states that the degree of confidence in compliance with privacy requirements is lower when DHS does not maintain full custody of personally identifiable information. Public comments on the proposed air and sea exit solution raise a range of additional concerns. Ninety-one entities—including the airline, trade, and travel industries, as well as federal, state, and foreign governments—commented on the air and sea exit proposal. The comments that were provided raised a number of concerns and questions about the proposed solution. For example, comments stated that (1) technical requirements the carriers must meet in delivering their respective parts of the proposed solution had yet to be provided; (2) the proposed solution conflicts with air and vessel carrier passenger processing improvements; (3) the proposed solution is not fully integrated with other border screening programs involving air carriers; and (4) stakeholders were not involved in this rulemaking process as they had been in previous rulemaking efforts. Risk management database shows that some program risks have not been effectively managed. Proactively managing program risks is a key acquisition management control and, if defined and implemented properly, it can increase the chances of programs delivering promised capabilities and benefits on time and within budget. To its credit, the US-VISIT program office has defined a risk management plan and related process that is consistent with relevant guidance. However, its own risk database shows that all risks have not been proactively mitigated. As we have previously reported, not proactively mitigating risks increases the chances that risks become actual cost, schedule, and performance problems. Significance of a task order’s schedule variances have been minimized by frequent rebaselining. According to the GAO Cost Assessment Guide, rebaselining should occur rarely, as infrequently as once in the life of a program or project. Schedule rebaselining should occur only when a schedule variance is significant enough to limit its utility as a predictor of future schedule performance. For task order 7, the prime contractor’s largest task order, the program office has rebaselined its schedule twice in the last 2 years—first in October 2006 and again in October 2007. This rebaselining has resulted in the task order showing a $3.5 million variance, rather than a $7.2 million variance that would exist without either of the rebaselinings. DHS has not adequately met the conditions associated with its legislatively mandated fiscal year 2008 US-VISIT expenditure plan. The plan does not fully satisfy any of the conditions that apply to DHS, either because it does not address key aspects of the condition or because what it does address is not adequately supported or is otherwise not reflective of known program weaknesses. Given that the legislative conditions are intended to promote the delivery of promised system capabilities and value, on time and within budget, and to provide Congress with an oversight and accountability tool, these expenditure plan limitations are significant. Beyond the expenditure plan, other program planning and execution limitations and weaknesses also confront DHS in its quest to deliver US- VISIT capabilities and value in a timely and cost-effective manner. Most notably, DHS has proposed a solution for a long-awaited exit capability, but it is not clear if the cost estimates used to justify it are sufficiently reliable to do so. Also, DHS has reported that the proposed solution provides less security and privacy than other alternatives analyzed, and the proposed solution is being challenged by those who would be responsible for implementing it. Further, DHS’s ability to measure program performance and progress, and thus be positioned to address cost and schedule shortfalls in a timely manner, is hampered by weaknesses in the prime contractor’s implementation of earned value management. Each of these program planning and execution limitations and weaknesses introduce risk to the program. In addition, DHS is not effectively managing the program’s risks, as evidenced by the program office’s risk database showing that known risks are being allowed to go years without risk mitigation and contingency plans. Overall, while DHS has taken steps to implement a significant percentage of our prior recommendations aimed at improving management of US-VISIT, additional management improvements are needed to effectively define, justify, and deliver a system solution that meets program goals, reflects stakeholder input, minimizes exposure to risk, and provides Congress with the means by which to oversee program execution. Until these steps are taken, US-VISIT program performance, transparency, and accountability will suffer. To assist DHS in planning and executing US-VISIT, we recommend that the Secretary of Homeland Security direct the department’s Investment Review Board to review the reasons for the plan’s limitations and address the challenges and weaknesses raised by our observations about the proposed air and sea exit solution, risk management, and the implementation of earned value management, and to report the results to Congress.