DHS’s mission is to lead the unified national effort to secure America by preventing and deterring terrorist attacks and protecting against and responding to threats and hazards to the nation. DHS is also responsible for ensuring that the nation’s borders are safe and secure, welcoming lawful immigrants and visitors, and promoting the free flow of commerce. Created in 2003, DHS assumed control of about 209,000 civilian and military positions from 22 agencies and offices that specialize in one or more aspects of homeland security. The intent behind the merger that created DHS was to improve coordination, communication, and information sharing among these multiple federal agencies. Figure 1 shows DHS’s organizational structure; table 1 identifies DHS’s principal organizations and describes their missions. Not since the creation of the Department of Defense in 1947 has the federal government undertaken a transformation of this magnitude. As we reported before the department was created, such a transformation is critically important and poses significant management and leadership challenges. For these reasons, we designated the implementation of the department and its transformation as high risk in 2003, and we continue to do so today. In this regard, we have stated that failure to effectively address DHS’s management challenges and program risks could have serious consequences for our national security. In support of its organizational transformation and in response to the nation’s evolving security needs, DHS has been spending billions of dollars each year to develop and acquire IT systems to perform both mission-critical and support functions, which frequently must be coordinated among components, as well as among external entities. For fiscal year 2010, DHS expected to spend approximately $6.3 billion on 348 IT-related programs, which included 53 major IT acquisition programs that were designated for oversight by the DHS Under Secretary for Management. We refer to these 53 programs as “large acquisitions” throughout this report. Table 2 describes the programs relevant to this review. In order to manage these acquisitions, the department finalized an acquisition life cycle and review process in 2010, and established the Management Directorate, headed by the Under Secretary for Management, which houses both the Chief Information Officer (CIO) and Chief Procurement Officer (CPO). The CIO’s responsibilities include setting departmental IT policies, processes, and standards, and ensuring that IT acquisitions comply with DHS IT management processes, technical requirements, and approved enterprise architecture, among other things. Additionally, the CIO chairs DHS’s Chief Information Officer Council, which is responsible for ensuring the development of IT resource management policies, processes, best practices, performance measures, and decision criteria for managing the delivery of IT services and investments, while controlling costs and mitigating risks. The CPO is the department’s senior procurement executive, who has leadership and authority over DHS acquisition and contracting, including major investments. The CPO office’s responsibilities include issuing acquisition policies and implementation instructions, overseeing acquisition and contracting functions, and ensuring that a given acquisition’s contracting strategy and plans align with the intent of the department’s ARB, the department’s highest investment review board. DHS’s acquisition management directive defines four acquisition life cycle phases that are to ensure consistent and efficient management, support, review, and approval for programs across the department. Each phase culminates in an ARB review on whether a program is ready to proceed to the next life cycle phase. The ARB’s chairperson is responsible for determining the readiness of a program and for approving the key acquisition documents critical to establishing a program’s business case, operational requirements, acquisition baseline, and testing and support plans. Also, the ARB’s chairperson is responsible for assessing breaches of the acquisition plan’s cost and schedule baselines and directing corrective actions. Other DHS entities share responsibility for IT management and procurement activities. For example, control of IT management functions is shared by the DHS CIO and CIOs at the major organizational components (e.g., directorates, offices, and agencies). Similarly, DHS relies on a structure of dual accountability and collaboration between the CPO and the heads of DHS components to carry out the acquisition function. DHS components have also designated component acquisition executives to serve as the senior acquisition officials within the components and to be responsible for implementation of management and oversight of all component acquisition processes. Since its creation, DHS has faced challenges in acquiring large IT systems, leading to cost and schedule overruns on multiple programs. Our November 2008 report on DHS’s oversight of major acquisition programs described several of these challenges. Specifically,  DHS had not effectively implemented or adhered to its investment  DHS had not consistently enforced decisions that were reached by the investment review board because the department did not track whether components and offices had taken the actions required by the board; and two of nine components did not have the required component-level review processes to adequately manage their major investments. Accordingly, we made a series of recommendations to DHS to address weaknesses in departmentwide acquisition policies and practices and with individual programs, such as reinstating the department’s oversight board to review and approve acquisition requirements and assess potential duplication of effort, and directing that component heads establish a mechanism to ensure that major investments comply with established component and departmental investment review policy standards. The department generally concurred with our findings and recommendations, citing actions that had been taken and efforts under way to improve the investment review process. In September 2009 and again in June of 2010, we reported on the status of DHS’s acquisition improvement efforts and on selected major acquisition programs. Despite some progress, we found that many of DHS’s major system acquisitions were still not receiving effective oversight and that DHS continued to face challenges in fully defining and implementing key system investment and acquisition management policies and procedures. Among other things, we noted that the ARB had begun to meet more frequently than in the past and had reviewed dozens of major acquisition programs, but more than 40 programs had not been reviewed, and programs did not consistently implement review action items by established deadlines;  nearly 80 percent of major programs lacked basic acquisition documents, and a database established to track key program information—such as cost and schedule performance and program risks—relied on self-reported program data rather than independently verified data; and component acquisition review processes were not fully in place, and components’ efforts to implement department oversight directives and sufficiently staff the associated processes were not yet complete. We concluded that, while the department had made progress in establishing key institutional acquisition and IT investment management- related controls and implementing them on large-scale programs, considerable effort remained before the department could be considered a mature IT system acquirer and investor and that our prior recommendations continued to provide the department with a framework to guide its efforts. IV&V is a process whereby organizations can reduce the risks inherent in system development and acquisition efforts by having a knowledgeable party who is independent of the developer determine that the system or product meets the users’ needs and fulfills its intended purpose. IV&V involves proactively determining early in a program’s life cycle what its risks are likely to be, and then identifying those that could be mitigated or lessened by performing additional reviews and quality assessments. IV&V activities can help ensure that quality is built into program deliverables from the beginning—starting with business and requirements analysis, continuing through software development and unit-testing activities, and ending with system and integration testing and acceptance. We have previously identified IV&V as a leading practice for large and complex system development and acquisition programs. In addition, a review published in 1999 by the Institute of Electrical and Electronics Engineers (IEEE) found that IV&V had a measurable beneficial effect on a program’s development. For example, it  promoted the earlier detection of system faults, identified a greater number of faults,  helped to reduce the average time it takes to fix faults, and  enhanced operational correctness. The study concluded that any process that systematically applies well- designed IV&V activities to a structured software development process would result in similar benefits. Typically, IV&V is performed by an agent that is independent of the development organization to obtain unbiased reviews of a system’s processes, products, and results, with the goal of verifying and validating that these meet stated requirements, standards, and user needs. As such, we have reported that IV&V is work above and beyond the normal quality assurance and performance review activities performed during system development and acquisition. This work must not substitute for the developer’s responsibility, but should complement and reinforce the developer’s system engineering processes, configuration management, and qualification test functions. According to recognized industry standards, IV&V can provide management with an objective assessment of a program’s processes, products, and risks throughout its life cycle and help ensure conformance to program performance, schedule, and budget targets. Furthermore, it can help facilitate the early detection and correction of system anomalies and support the system’s conformance to performance, schedule, and budget goals, among other benefits. We have previously identified the independence of the responsible agent as a key aspect of IV&V’s value to the IT acquisitions process. Independence is defined by the following three components:  Technical independence–requires the effort to be performed by personnel who are not involved in the development of the system. This ensures that the IV&V team brings a fresh viewpoint to the analysis of the system development process and its products.  Managerial independence–requires that the agent be managed separately from the development and program management organizations. The effort must be allowed to freely select the system components or segments it will analyze and test, and the test and analysis techniques it will use. The agent must also be allowed to freely report its findings to program management, without prior approval from the development group.  Financial independence–requires that the funding for IV&V be controlled by an organization separate from the development organization. This ensures that the effort will not be curtailed by having its funding diverted to other program needs, and that financial pressures cannot be used to influence the effort.