Risk management has been widely practiced for years in areas such as insurance, construction, and finance. By comparison, its application in homeland security is relatively new—much of it coming in the wake of the terrorist attacks of September 11—and it is a difficult task with little precedent. The goals for using it in homeland security include informing decisions on ways to reduce the likelihood that an adverse event will occur, and mitigate the negative impact of and ensure a speedy recovery from those that do. Achieving these goals involves making decisions about what the nation’s homeland security priorities should be—for example, what the relative security priorities should be among seaports, airports, and rail—and basing spending decisions on where scarce resources will do the most good at narrowing gaps in security. Homeland security is a broad term with connotations resulting from the September 11 attacks and other connotations resonating from the disaster created by Hurricane Katrina in August 2005. Risk management has applications for deliberate attacks of terror and natural disasters, such as hurricanes and earthquakes. My statement today examines the approach used by DHS to deal with both of these areas. Risk management has received widespread support as a tool that can help inform decisions on how to protect the homeland. The Homeland Security Act of 2002 requires DHS to carry out a comprehensive assessment of risk related to vulnerabilities of critical infrastructure and key resources, notably (1) the risk posed by different forms of terrorist attacks, (2) the probability that different forms of an attack might succeed, and (3) the feasibility and efficacy of countermeasures to deter or prevent such attacks. Two congressionally chartered commissions—the 9/11 Commission and the Gilmore Commission—support the use of data on risks to help inform resource allocation decisions. The President has issued policies directing the heads of seven major departments or agencies to assess risks. These policies have made DHS responsible for the national effort at protecting critical infrastructure and they call on DHS to establish uniform policies, approaches, guidelines, and methodologies for integrating risk management within and across federal departments and agencies. In addition, risk management is one of the target capabilities DHS has established to measure state and local emergency preparedness and make homeland security investments in achieving the National Preparedness Goal. DHS's “Target Capabilities List” identifies risk management as one of four common capabilities for incident management—prevention, protection, response and recovery—for major events. While there is widespread support for the use of risk management in homeland security programs, doing so is a complex task that has few precedents and until recently, little specific guidance. To provide a basis for examining efforts at carrying out risk management, we developed a framework for risk management based on best practices and other criteria. The framework is divided into five phases: (1) setting strategic goals and objectives, and determining constraints; (2) assessing the risks; (3) evaluating alternatives for addressing these risks; (4) selecting the appropriate alternatives; and (5) implementing the alternatives and monitoring the progress made and the results achieved (see figure 1). We used this framework to examine many of the programs that I discuss later in this statement. The application of risk management to homeland security is relatively new and the framework will likely evolve as processes mature and lessons are learned. Guidance is also important when agencies integrate a concern for risk into the annual cycle of program and budget review. Doing so within an agency is a difficult task in that traditional ways of reviewing budgets and programs often rely on program data that call for continuing or expanding a program without examining the relative risks that are addressed with the funds that are expended. Shifting organizations toward this nexus of using risk-based data as part of annual management review cycles will take time, attention, and leadership. Even in agencies where much progress has been made in developing risk management techniques, integrating disparate systems such as risk management with budget and program management remains a long-term challenge. Risk management approaches have been applied to DHS’s investments in state and local homeland security through the Homeland Security Grant Program (HSGP). The HSGP includes the Urban Area Security Initiative (UASI), the State Homeland Security Program, Law Enforcement Terrorism Prevention Program, and Citizen Corps Program. In fiscal year 2007, DHS has been appropriated funds to provide over $1.6 billion in federal funding to states, localities, and territories through the HSGP to prevent, protect against, respond to, and recover from acts of terrorism or other catastrophic events. DHS components also use risk management principles to varying degrees to allocate funding to implement their homeland security missions. Key homeland security missions and the associated departmental agencies and organizations include Emergency preparedness and response: The Federal Emergency Management Agency (FEMA) prepares the nation for all hazards and coordinates the federal response and recovery efforts following any incident that requires federal support to state and local emergency responders. Under the statutorily mandated FEMA reorganization that is to take effect by March 31, 2007, FEMA is to include the Office of Grants and Training, which is responsible for allocating homeland security grants to states and localities, including the UASI and State Homeland Security grants. In addition, FEMA will be the responsible for implementing the National Preparedness Goal and other programs that are designed to enhance the nation’s prevention, protection, response and recovery capabilities. Transportation Security: The Transportation Security Administration (TSA) is responsible for security for all modes of transportation and, while TSA’s efforts have historically focused on aviation security due to the events of 9/11, increasing attention has been paid to surface transportation security as a result of more recent international terrorist attacks. Maritime security: The United States Coast Guard (USCG) is the lead federal agency for maritime homeland security. Key objectives of the nation’s maritime security strategy are to prevent terrorist attacks and criminal or hostile acts, protect maritime-related population centers and critical infrastructures, minimize damage and expedite recovery, and safeguard the ocean and its resources. Border Security: U.S. Customs and Border Protection (CBP) was created to protect the nation’s borders in order to prevent terrorists and terrorist weapons from entering or exiting the United States while facilitating the flow of legitimate trade and travel. Immigration Enforcement: Immigration and Customs Enforcement (ICE) was established to enforce immigration and customs laws and to protect the United States against terrorist attacks. Immigration Services: U.S. Citizenship and Immigration Services (USCIS) is responsible for the administration of immigration and naturalization adjudication functions and establishing immigration services policies and priorities. USCIS provides immigration benefits to people who are entitled to stay in the United States on a temporary or permanent basis. Critical infrastructure and key assets protection: The Directorate for Preparedness is responsible for establishing uniform policies, approaches, guidelines, and methodologies to help ensure that critical infrastructure is protected, and using a risk management approach to coordinate protection efforts. The Directorate works with state, local, and private-sector partners to identify threats, determine vulnerabilities, and target resources where risk is greatest, thereby safeguarding our borders, seaports, bridges and highways, and critical information systems. The National Cyber Security Division is charged with identifying, analyzing, and reducing cyber threats and vulnerabilities, disseminating threat warning information, coordinating incident response, and providing technical assistance in continuity of operations and recovery planning. Science and Technology: The Directorate for Science and Technology (S&T Directorate) is the primary research and development arm of DHS. Its mission is to provide federal, state and local officials with the technology and capabilities to protect the homeland. Since 2004, Congress has appropriated over $100 billion for DHS’s homeland security efforts. For example, Congress has appropriated more than $30 billion in fiscal years 2006 and 2007 for some of the key components and agencies GAO has reviewed, as shown in table 1. As the Comptroller General has repeatedly stated, our nation’s fiscal policy is on an unsustainable course. Long-term budget simulations by GAO, the Congressional Budget Office (CBO), and others show that, over the long term, we face a large and growing structural deficit due primarily to known demographic trends and rising health care costs. Continuing on this unsustainable fiscal path will gradually erode, if not suddenly damage, our economy, our standard of living, and ultimately our national security. DHS is responsible for ensuring that the nation’s annual investments of billions of dollars are targeted to the most efficient and effective uses using a sound, comprehensive risk management approach. Today, we issued a report on DHS’s use of risk management in distributing the Urban Area Security Initiative (UASI) grants. For fiscal years 2006 and 2007, DHS has used risk assessments to identify urban areas that faced the greatest potential risk, and were therefore eligible to apply for the UASI grant, and based the amount of awards to all eligible areas primarily on the outcomes of the risk assessment and a new effectiveness assessment. Starting in fiscal year 2006, DHS made several changes to the grant allocation process, including modifying its risk assessment methodology, and introducing an assessment of the anticipated effectiveness of investments. DHS combined the outcomes of these two assessments to make funding decisions (see fig. 2.) DHS used different risk assessment methodologies for the 2006 and 2007 UASI grant process, reflecting the evolving nature of its risk assessment approach. It is important to note that our understanding of the process is based principally on DHS officials' description of their process, including briefings, and limited documentation on the details on the actual data used and the methodology's application. For fiscal year 2006, DHS’s risk assessment included the three components we have identified as essential elements of an effective risk management approach—threat, vulnerability, and consequences—to estimate the relative risk of successful terrorist attacks to urban areas. DHS assessed risk from two perspectives, based on specific locations (asset-based) and based on areas of the country (geographic risk).