Since January 2011, DHS has continued to update and strengthen its strategy for how the department plans to address our high-risk designation and resolve its management challenges. In January 2011, DHS provided us with its initial Integrated Strategy for High Risk Management, which summarized the department’s preliminary plans for addressing the high-risk area. The January 2011 strategy, which DHS later updated in June 2011 and December 2011, was generally responsive to the actions and outcomes we identified for the department to address this high-risk area. Specifically, in our March 2011 written response to DHS’s January 2011 update, we stated that the strategy generally identified multiple, specific actions and target completion time frames consistent with the outcomes we identified; designated senior officials to be responsible for implementing most actions; and included scorecards to depict, at a high level, the department’s views of its progress in addressing each high-risk area and a framework for monitoring implementation of corrective actions through, among other things, quarterly meetings between DHS and us. However, the January 2011 update generally did not discuss the root causes of problems. Further, while the strategy identified whether DHS believed it had the resources available to implement planned actions, it did not identify what the specific resource needs were or what additional resources may be needed, making it difficult to assess the extent to which DHS has the capacity to implement those actions. In June 2011, DHS updated its Integrated Strategy for High Risk Management. The update demonstrated the department’s continued leadership commitment to address the high-risk designation and represented continued progress. For example: DHS identified 10 root causes that cut across the four management functions and management integration. By identifying these root causes, the department better positioned itself to determine corrective actions for addressing the underlying problems that have affected its management implementation efforts, and to assess the extent to which progress made in implementing the corrective actions has mitigated those underlying problems. DHS organized its corrective actions into 16 key management initiatives (e.g., financial management controls, IT program governance, and procurement staffing model) to address its management challenges and the 31 actions and outcomes we identified. Identifying key management initiatives should help DHS prioritize its efforts and resources for addressing its root causes and management challenges, and provide a useful framework for monitoring the department’s implementation of the initiatives and associated corrective actions. However, elements of the update could be strengthened or clarified to better address our high-risk criteria and the actions and outcomes we previously identified, including (1) better defining the root causes of its management problems; (2) clarifying the resources available to implement corrective actions; (3) consistently reporting the progress of its corrective actions; and (4) more clearly and consistently reporting the progress of its key management initiatives. DHS provided its most recent update to its strategy in December 2011. Overall, we believe that the December update positions the department to address its management challenges and the implementation and transformation high-risk area. For example: DHS updated its initiatives—removing two initiatives from the management integration area and adding four new initiatives, including human resources information technology, management health assessment, strategic sourcing, and acquisition workforce development; DHS included, for the first time, ratings of the department’s progress addressing the 31 high-risk outcomes; and DHS enhanced its reporting and rating methodology for its key management initiatives. Specifically, DHS replaced a color-coded (green, yellow or red) rating system used in previous updates with a new system for self-reporting progress. DHS now measures and reports its progress addressing the five criteria for removal from high risk in two ways. One way uses standard indicators for measuring progress and a pie graph for reporting such progress across all of its key management initiatives against the first four criteria—leadership commitment, capacity, corrective action plans, and monitoring. The second way uses specific performance measures unique to each initiative for measuring progress and a fuel-type gauge for reporting on the fifth criterion—demonstrated progress. According to DHS, the revised methodology, amongst other things, results in a more objective view of each initiative’s progress. However, the December 2011 update could be strengthened or clarified to better enable DHS and GAO to assess the department’s progress, in the following ways: More clearly and consistently report the resources available to implement corrective actions. DHS identified whether it had sufficient resources to implement most of the corrective actions. However, as we also reported to DHS regarding the January and June 2011 strategies, for many corrective actions DHS did not provide information on what the specific resource needs are or what additional resources may be needed to implement the corrective actions. The absence of resource information makes it difficult to fully assess the extent to which DHS has the capacity to implement these actions, particularly within the time frames identified for the corrective actions Consistently report on corrective actions. DHS provided information on the department’s rationale for eliminating and adding key management initiatives, but has not consistently provided such information for the corrective actions it established for each initiative. For example, the December strategy contained three new corrective actions for the IT program-governance initiative that were not in the June 2011 strategy, but did not include three corrective actions that had been in the June 2011 strategy. The December strategy did not consistently explain the department’s rationale for eliminating or adding corrective actions from the June strategy, such as whether the corrective actions were already completed, or if the corrective actions were no longer appropriate or feasible. Without consistently providing information on the basis for DHS’s decision to add or remove corrective actions, it is difficult for DHS and us to track the status and progress of the department’s efforts to fully implement its management initiatives. Establish measures and report on progress for all initiatives. DHS established a total of 58 measures to track its demonstrated progress in implementing the 18 initiatives included in the December 2011 strategy. While these measures provide additional insight into DHS’s self-reported progress and represent an important improvement from the June 2011 strategy, DHS has not yet established measures for one of its initiatives—the new management health assessment initiative—and did not report on its progress for more than 40 percent (24 of the 58) of the measures in the December 2011 strategy. Without establishing measures and consistently reporting on their progress, neither DHS nor we can fully assess the department’s progress in implementing its initiatives. Stabilize its methodology for measuring progress. We believe that the enhanced methodology DHS established for assessing its progress in implementing its initiatives generally allows for a more- objective assessment. However, the evolving nature of DHS’s methodology, which the department revised in the June 2011 strategy and again in the December strategy, makes it difficult to effectively monitor the department’s progress over time. By strengthening these four aspects, we believe the December 2011 strategy, if implemented and sustained, provides a path for DHS to address our high-risk designation. We will continue to closely monitor and assess DHS’s progress in addressing the high-risk designation and the department’s overall transformation efforts as part of our work for the 2013 high-risk update, which we plan to issue in January 2013. DHS has made progress addressing management challenges and achieving high-risk outcomes in some key areas. The Secretary and Deputy Secretary of Homeland Security, and other senior officials, have demonstrated commitment and top leadership support to address the department’s management challenges. As the following examples illustrate, DHS is making progress achieving the long-term goal of enhancing its management capabilities and building a more-integrated department. In June 2011, we reported that, per departmental acquisition guidance, DHS’s Science and Technology directorate reviewed and approved test and evaluation documents and plans for programs undergoing testing, and conducted independent assessments for the programs that completed operational testing. In October 2011, to enhance the department’s ability to oversee major acquisition programs, DHS realigned the acquisition management functions previously performed by two divisions within the Office of Chief Procurement Officer to establish the Office of Program Accountability and Risk Management (PARM). PARM, which is responsible for program governance and acquisition policy, serves as the Management Directorate’s executive office for program execution and works with DHS leadership to assess the health of major acquisitions and investments. To help with this effort, PARM is developing a database, known as the Decision Support Tool, intended to improve the flow of information from component program offices to the Management Directorate to support its governance efforts. DHS also included a new management initiative in its December 2011 update (strategic sourcing) to increase savings and improve acquisition efficiency by consolidating contracts departmentwide for the same kinds of products and services, and reported awarding 14 strategically sourced contracts in fiscal year 2011. We currently have ongoing work related to both of these areas that we will report on later this year. In February 2012, we reported that the DHS Chief Information Officer (CIO) and Chief Human Capital Officer were coordinating to streamline and consolidate the department’s human resources investments. Specifically, in 2010 and 2011, the DHS CIO conducted program and portfolio reviews of hundreds of IT investments and systems. DHS evaluated portfolios of investments within its components to avoid investing in systems that are duplicative or overlapping, and to identify and leverage investments across the department. DHS also consolidated (1) 6 personnel security–related systems into its departmentwide Integrated Security Management System—with an additional personnel security system planned for consolidation in 2012, and (2) two components’ portals into the Homeland Security Information Network, with plans to consolidate 12 additional portals before 2014. DHS has reduced the number of material weaknesses in internal controls from 18 since the inception of the department in 2003 to 5 in fiscal year 2011. In addition, in fiscal year 2010 DHS committed to the goal of receiving a qualified audit opinion on its consolidated balance sheet in fiscal year 2011 by, for example, remediating financial management issues at the U.S. Coast Guard (USCG).