The mission of USCIS is to adjudicate applications and petitions for immigration benefits, and requests for other action by individuals seeking to become either a citizen of the United States or a lawful permanent resident or to temporarily study, live, or work in this country. To accomplish its mission, each year USCIS processes millions of applications, petitions, and requests for more than 50 types of immigrant and nonimmigrant-related benefits. As we reported in 2007, the processing of millions of applications, petitions, and requests has been hindered by inefficient, paper-based processes, which has resulted in a backlog that peaked in 2004 at more than 3.8 million cases; tens of thousands of missing or misplaced files; difficulties in verifying the identity of applicants; problems in providing other government agencies with the information necessary to identify criminals and potential terrorists; and benefits being issued to unverified applicants. Begun in 2005, the goals of the Transformation Program are to modernize the paper-based immigration benefits process to enhance national security and system integrity, and to improve customer service and operational efficiency. The program is comprised of many systems, each of which provides a service to facilitate operations, such as identity management and risk and fraud analytics. The main component of the program is the USCIS Electronic Immigration System (ELIS), which is to provide case management for the adjudication of immigration benefits and interface with other systems to achieve end-to-end processing of immigration benefits. Once the system has been implemented, USCIS expects that Applicants will be able to establish an account with USCIS to file and track the status of the application, petition, or request online. The system will apply risk-based rules automatically to incoming applications, petitions, and requests to identify potentially fraudulent applications and national security risks. Adjudicators will have electronic access to applications, petitions, and requests, relevant policies and procedures, and external databases to aid in decision making. USCIS will have management information to track and allocate workload. The system will allow electronic linkages to other agencies, such as the Departments of Justice and State, for data sharing and security purposes. Appendix II lists systems internal and external to USCIS with which USCIS ELIS will interface. Figure 1 provides an overview of how applicants are to file for immigration benefits and apply for citizenship using the new system. Five core operational requirements are expected to form the foundation of USCIS ELIS, which is to process and manage all applications. Table 1 describes the five core operational requirements. Each core operational requirement is broken down into a series of capabilities, features, and sub-features. For example, the Intake and Account Management operational requirement has five capabilities, such as the Establish/Authenticate portal account capability, which is broken down into four features, including Manage Account Access. This feature is further decomposed into five sub-features, including Provide Account Management for Customers and Representatives. Appendix III provides additional information on the planned capabilities for the Transformation Program. USCIS began implementing the Transformation Program by awarding contracts for various phases, including for pilot projects and system architecture. In fiscal year 2006, USCIS initiated three pilot projects and one for a proof-of-concept effort. Enumeration pilot: The pilot was a joint effort by USCIS and the then- United States Visitor and Immigrant Status Indicator Technology (US- VISIT) program to positively identify individuals through the generation of a unique identifier permanently associated with a person. The enumerator is created by the submission of fingerprint and biographic data. Each time the person returns to USCIS for a subsequent benefit application, biometric information is to be matched to determine if the individual is the same person. This process is intended to limit the number of times fingerprints are submitted for background checks. Biometric Storage System pilot: The Biometric Storage System was to help streamline the established USCIS biometric and card production processes and become the centralized repository for all USCIS customer biometrics. The system receives the 10-print fingerprints taken at application support centers along with related biographic data, and submits them to the Federal Bureau of Investigation for a fingerprint check and then to the US-VISIT Automated Biometric Identification System for creation of the enumerator and for permanent storage. The 10-print fingerprints and photos are then associated with benefit cards that serve as travel documents. The system is to store the images only as long as needed to facilitate adjudication and production of benefits cards. Digitization pilot: The Digitization pilot was comprised of the Enterprise Document Management System, which stores electronic documents along with metadata describing the documents, and the Records Digitization Facility, which scans documents into electronic format, creates the metadata, and transfers the document to the document management system. The pilot tested the use of images by adjudicators in their day-to-day work environment. The proof-of-concept was intended to demonstrate the case processing capability of the case management system. Specifically, it was to demonstrate that the enumerator (unique identifier based on biometrics) could link an applicant to related filings for that individual and assess whether the case management system could be used to view digitized files. According to the Transformation Program Management Plan, a post- implementation review completed in October 2007 determined that the proof-of-concept met all of its primary objectives and that the Transformation Program should continue with this approach. In November 2008, USCIS awarded a solutions architect contract for approximately $500 million to be allocated over a 5-year period to design, develop, test, deploy, and sustain the Transformation Program by November 2013. The overall strategy was to deliver the solution in two increments: Increment 1, to include releases A and B, and Increment 2, to include releases C, D, and E. Releases A and B included making USCIS ELIS available to applicants applying for nonimmigrant benefits and much of the functionality needed to operate the five core operational requirements. Table 2 shows the order in which USCIS ELIS’s five releases were to be deployed and the types of benefits to be made available to applicants in each release. In July 2011, DHS officially approved the Transformation Program’s acquisition program baseline and supporting operational requirements. The baseline included approved objectives (targets that reflect the most likely cost and schedule) and approved thresholds (ceilings which, if exceeded, initiate official re-planning actions). Table 3 details the cost and schedule parameters of the program’s approved July 2011 baseline. On May 22, 2012, USCIS launched the first release of USCIS ELIS (release A1). This release included capabilities associated with all of the core operational requirements, such as online account setup, case management, case acceptance, applicant evidence intake, and notice generation. Since May 2012, five primary releases, along with a series of maintenance releases, have been deployed to add functionality to USCIS ELIS, with new applicant processing added in two of the five releases. Table 4 shows the date of each functional release and a description of the capabilities in the release. USCIS ELIS is to be managed consistent with DHS’s acquisition management process. DHS’s Acquisition Management Directive 102-01 and its Instruction Manual 102-01-001 (the guidebook) establish the department’s policies and processes for managing major acquisition programs. Acquisition Management Directive 102-01 provides high-level direction to program managers to help determine funding needs, capability requirements, and schedule, and the guidebook provides specific direction to program managers on how to implement the directive, such as how to address a program breach. DHS’s Deputy Secretary and Under Secretary for Management serve as the acquisition decision authorities for the department’s largest acquisition programs, those with life-cycle cost estimates of $1 billion or more. The Under Secretary for Management also serves as DHS’s Chief Acquisition Officer, and in this role is responsible for the management and oversight of the department’s acquisition policies and procedures. To assist in the acquisition oversight process, the Under Secretary for Management is supported by two offices within the department. The Office of Program Accountability and Risk Management (PARM) is responsible for DHS’s overall acquisition governance process. The Office of the Chief Information Officer (OCIO) is responsible for, among other things, setting departmental information technology (IT) policies, processes, and standards. It is also responsible for ensuring that IT acquisitions comply with DHS IT management processes, technical requirements, and the approved enterprise architecture. Within the OCIO, the Enterprise Business Management Office is to ensure that the department’s IT investments align with its missions and objectives. As part of its responsibilities, this office periodically assesses IT investments to gauge how well they are performing through a review of program risk, human capital, cost and schedule, and requirements. These assessments serve as the criteria for reporting to the IT Dashboard for oversight by the Office of Management and Budget (OMB). In March 2015, we reported that DHS acquisition policy does not define the differences in the role of PARM and the OCIO’s Enterprise Business Management Office in oversight of major IT acquisitions. In particular, the functions of PARM and the Enterprise Business Management Office may overlap. Further, we reported that programs report to PARM and the Enterprise Business Management Office through two separate information systems, which further complicate the distinction. In order to ensure consistent, effective oversight of DHS’s acquisition programs, we recommended that the Secretary of DHS direct the Under Secretary for Management to develop written guidance to clarify the roles and responsibilities of PARM and OCIO Enterprise Business Management Office for conducting oversight of major acquisition programs. DHS concurred with our recommendations. DHS Acquisition Management Directive 102-01 establishes that a major acquisition program’s decision authority is responsible for reviewing and approving the movement of the program through four phases of the acquisition life cycle at a series of five acquisition decision events.