DHS’s efforts to strengthen and integrate its management functions have resulted in progress addressing our criteria for removal from the high-risk list. In particular, in our 2015 high-risk update report, which we released earlier this month, we found that DHS has met two criteria and partially met the remaining three criteria, as shown in table 1. Leadership commitment (met). In our 2015 report, we found that the Secretary and Deputy Secretary of Homeland Security, the Under Secretary for Management at DHS, and other senior officials have continued to demonstrate commitment and top leadership support for addressing the department’s management challenges. We also found that they have taken actions to institutionalize this commitment to help ensure the long-term success of the department’s efforts. For example, in April 2014, the Secretary of Homeland Security issued a memorandum entitled Strengthening Departmental Unity of Effort, committing to, among other things, improving DHS’s planning, programming, budgeting, and execution processes through strengthened departmental structures and increased capability. Senior DHS officials, including the Deputy Secretary and Under Secretary for Management, have also routinely met with us over the past 6 years to discuss the department’s plans and progress in addressing this high-risk area. During this time, we provided specific feedback on the department’s efforts. We concluded that it will be important for DHS to maintain its current level of top leadership support and commitment to ensure continued progress in successfully executing its corrective actions through completion. Corrective action plan (met). We found that DHS has established a plan for addressing this high-risk area. Specifically, in a September 2010 letter to DHS, we identified and DHS agreed to achieve 31 actions and outcomes that are critical to addressing the challenges within the department’s management areas and in integrating those functions across the department. In March 2014, we updated the actions and outcomes in collaboration with DHS to reduce overlap and ensure their continued relevance and appropriateness. These updates resulted in a reduction from 31 to 30 total actions and outcomes. Toward achieving the actions and outcomes, DHS issued its initial Integrated Strategy for High Risk Management in January 2011 and has since provided updates to its strategy in seven later versions, most recently in October 2014. The integrated strategy includes key management initiatives and related corrective actions plans for addressing DHS’s management challenges and the actions and outcomes we identified. For example, the October 2014 strategy update includes an initiative focused on financial systems improvement and modernization and an initiative focused on IT human capital management. These initiatives support various actions and outcomes, such as modernizing the U.S. Coast Guard’s financial management system and implementing an IT human capital strategic plan, respectively. We concluded in our 2015 report that DHS’s strategy and approach to continuously refining actionable steps to implementing the outcomes, if implemented effectively and sustained, should provide a path for DHS to be removed from our high-risk list. Capacity (partially met). In October 2014, DHS identified that it had resources needed to implement 7 of the 11 initiatives the department had under way to achieve the actions and outcomes, but did not identify sufficient resources for the 4 remaining initiatives. In addition, our prior work has identified specific capacity gaps that could undermine achievement of management outcomes. For example, in April 2014, we reported that DHS needed to increase its cost-estimating capacity and that the department had not approved baselines for 21 of 46 major acquisition programs. These baselines—which establish cost, schedule, and capability parameters—are necessary to accurately assess program performance. Thus, in our 2015 report, we concluded that DHS needs to continue to identify resources for the remaining initiatives; work to mitigate shortfalls and prioritize initiatives, as needed; and communicate to senior leadership critical resource gaps. Framework to monitor progress (partially met). In our 2015 report we found that DHS established a framework for monitoring its progress in implementing the integrated strategy it identified for addressing the 30 actions and outcomes. In the June 2012 update to the Integrated Strategy for High Risk Management, DHS included, for the first time, performance measures to track its progress in implementing all of its key management initiatives. DHS continued to include performance measures in its October 2014 update. However, we also found that the department can strengthen this framework for monitoring a certain area. In particular, according to DHS officials, as of November 2014, they were establishing a monitoring program that will include assessing whether financial management systems modernization projects for key components that DHS plans to complete in 2019 are following industry best practices and meet users’ needs. Effective implementation of these modernization projects is important because, until they are complete, the department’s current systems will not effectively support financial management operations. As we concluded in our 2015 report, moving forward, DHS will need to closely track and independently validate the effectiveness and sustainability of its corrective actions and make midcourse adjustments, as needed. Demonstrated, sustained progress (partially met). We found in our 2015 report that DHS has made important progress in strengthening its management functions, but needs to demonstrate sustainable, measurable progress in addressing key challenges that remain within and across these functions. In particular, we found that DHS has implemented a number of actions demonstrating the department’s progress in strengthening its management functions. For example, DHS has strengthened its enterprise architecture program (or blueprint) to guide and constrain IT acquisitions and obtained a clean opinion on its financial statements for 2 consecutive years, fiscal years 2013 and 2014. However, we also found that DHS continues to face significant management challenges that hinder the department’s ability to accomplish its missions. For example, DHS does not have the acquisition management tools in place to consistently demonstrate whether its major acquisition programs are on track to achieve their cost, schedule, and capability goals. In addition, DHS does not have modernized financial management systems. This affects its ability to have ready access to reliable information for informed decision making. As we concluded in our 2015 report, addressing these and other management challenges will be a significant undertaking that will likely require several years, but will be critical for the department to mitigate the risks that management weaknesses pose to mission accomplishment. Key to addressing the department’s management challenges is DHS demonstrating the ability to achieve sustained progress across the 30 actions and outcomes we identified and DHS agreed were needed to address the high-risk area. In our 2015 report, we found that DHS has fully implemented 9 of these actions and outcomes, with additional work remaining to fully address the remaining 21. Achieving sustained progress across the actions and outcomes, in turn, requires leadership commitment, effective corrective action planning, adequate capacity (that is, the people and other resources), and monitoring the effectiveness and sustainability of supporting initiatives. The 30 key actions and outcomes include, among others, validating required acquisition documents in accordance with a department-approved, knowledge-based acquisition process, and sustaining clean audit opinions for at least 2 consecutive years on department-wide financial statements and internal controls. We further found that DHS has made important progress across all of its management functions and significant progress in the area of management integration. In particular, DHS has made important progress in several areas to fully address 9 actions and outcomes, 5 of which it has sustained as fully implemented for at least 2 years. For instance, DHS fully met 1 outcome for the first time by obtaining a clean opinion on its financial statements for 2 consecutive years and fully met another outcome by establishing sufficient component-level acquisition capability. It also sustained full implementation of another outcome by continuing to use performance measures to assess progress made in achieving department-wide management integration. DHS has also mostly addressed an additional 5 actions and outcomes, meaning that a small amount of work remains to fully address them. We also found that considerable work remains, however, in several areas for DHS to fully achieve the remaining actions and outcomes and thereby strengthen its management functions. Specifically, DHS has partially addressed 12 and initiated 4 of the actions and outcomes. As previously mentioned, addressing some of these actions and outcomes, such as modernizing the department’s financial management systems and improving employee morale, are significant undertakings that will likely require multiyear efforts. Table 2 summarizes DHS’s progress in addressing the 30 actions and outcomes and is followed by selected examples. Acquisition management. In our 2015 report, we found that DHS has fully addressed 1 of the 5 acquisition management outcomes, partially addressed 3 outcomes, and initiated actions to address the remaining outcome. For example, DHS has recently taken a number of actions to fully address establishing effective component-level acquisition capability. These actions include initiating (1) monthly Component Acquisition Executive staff forums in March 2014 to provide guidance and share best practices and (2) assessments of component policies and processes for managing acquisitions. DHS has also initiated efforts to validate required acquisition documents in accordance with a knowledge-based acquisition process, but this remains a major challenge for the department. A knowledge-based approach provides developers with information needed to make sound investment decisions, and it would help DHS address significant challenges we have identified across its acquisition programs. DHS’s acquisition policy largely reflects key acquisition management practices, but the department has not implemented it consistently For example, in March 2014, we found that U.S. Customs and Border Protection (CBP) had not fully followed DHS policy regarding testing for the integrated fixed towers being deployed on the Arizona border. As a result, DHS does not have complete information on how the towers will operate once they are fully deployed. In addition, in our 2015 report we found that DHS continues to assess and address whether appropriate numbers of trained acquisition personnel are in place at the department and component levels, an outcome it has partially addressed. Further, while DHS has initiated efforts to demonstrate that major acquisition programs are on track to achieve their cost, schedule, and capability goals, DHS officials have acknowledged it will be years before this outcome has been fully addressed. Much of the necessary program information is not yet consistently available or up to date. IT management. In our 2015 report, we found that DHS has fully addressed 2 of the 6 IT management outcomes, mostly addressed another 3, and partially addressed the remaining 1.