ASA operations consist of ground operations that take place before fighter aircraft take off, including such activities as maintaining the fighter aircraft. They also include those activities that may take place after a unit receives an alert from NORAD, but before the aircraft are airborne. For example, pilots and maintenance personnel may rush from their nearby lodging facility to the alert aircraft facility, where maintenance personnel conduct final preparations while the pilots sit in their aircraft awaiting further instruction (battle station). Alternatively, pilots may taxi the aircraft to the end of the runway and await further instruction (runway alert) or take off in response to the alert (scramble). Once aircraft take off, an Air National Guard pilot converts from Title 32 status under the command and control of the state governor to federal Title 10 status under the command and control of NORAD.NORAD can increase personnel, aircraft, and the number of ASA sites based on changes in the threat conditions. GAO has previously reported that a risk-based management approach helps policymakers make informed decisions and prioritize resource investments. Risk management is a widely endorsed strategy for helping decision makers allocate finite resources and take action under conditions of uncertainty. We have previously recommended a five-phase risk-based management approach as shown in figure 1. The framework is dynamic and new information can be entered at any phase. The framework can be used to inform agency officials and decision makers of the basic components of a risk-based management approach or can be used as a stand-alone guide. The risk-based management approach, as outlined above is designed to be flexible in that the approach may be applied at various organizational levels from a department or a multiagency organization down to specific projects or operations, such as ASA operations. As we previously reported, because there is no one uniformly accepted approach to risk management, terms and activities may differ across applications. For example, the Department of Homeland Security’s 2009 National Infrastructure Protection Plan identifies a six-phase risk- management framework as shown in figure 2. The overall difference between this framework and GAO’s is that the National Infrastructure Protection Plan’s framework splits GAO’s risk-assessment phase into two separate phases. According to the 2009 National Infrastructure Protection Plan, the core criteria for risk assessments include information needed to understand and address each of the following components of risk—threat, vulnerability, and consequence. Any approach that omits the substance of the steps may result in resources that are not targeted to the highest security needs. In addition, failing to monitor the implementation of countermeasures, including those implemented by other agencies, may result in a misallocation of resources. Similarly, failing to conduct routine or periodic assessments of programs or operations could result in missed opportunities to increase their efficiency and effectiveness. DOD, itself, has identified risk management, in this context, as a process of systematically identifying, assessing, and managing risks arising from operational factors and making decisions that balance cost with mission benefits. For example, DOD’s defense critical infrastructure program is a risk-management program that seeks to ensure the availability of certain identified assets critical to DOD missions. Activities include the identification, assessment, and security enhancement of assets essential for executing the National Military Strategy. The Defense Logistics Agency similarly established its enterprise risk-management approach to identify, assess, communicate, and manage risk in a cost-effective manner. The Air Force has fully implemented one recommendation from our 2009 report, but has not fully implemented the remaining four recommendations. In addition, confusion over the definition and scope of the mission perpetuates confusion about the capabilities and expenditures associated with the mission. As of November 2011, the Air Force had fully implemented one of the five recommendations from our 2009 report and taken partial steps to implement the remaining four recommendations, as shown in figure 3 below. We made the following recommendations: (1) to formally assign ASA duties to the appropriate units; (2) to implement ASA as a steady- state mission; (3) to establish a timetable for implementation of the preceding recommendation; (4) to develop and implement a plan to address any projected capability gaps; and (5) to develop and implement a formal method to replace deploying units. We continue to believe that the prior recommendations have merit and that by not fully addressing the recommendations, DOD could leave the long-term sustainability of ASA operations at risk. Since the 2009 report was issued, some issues have arisen that might have been averted had the Air Force implemented the recommendations. For example, since the Air Force canceled the ASA program action directive that clearly identified the service’s Air Combat Command as responsible for programming for ASA operations, the National Guard Bureau assumed programming and budgeting for its ASA sites to ensure that its units that were conducting ASA operations were funded. This in turn has led to the National Guard Bureau having to fund emergent expenses with funds that were programmed for other purposes. For example, according to National Guard Bureau officials, when an ASA site is undergoing certain unplanned construction, the National Guard Bureau must fund the transfer of ASA personnel and equipment to a separate base. Further complicating DOD’s management approach to ASA operations, we found considerable confusion about the capabilities and expenditures associated with ASA operations. In September 2011, NORAD stopped using the term “air sovereignty alert” (ASA) and created a new term, “aerospace control alert” (ACA) without clearly defining ACA or the capabilities that are now included within it. When we asked NORAD officials which capabilities are included under ACA, they told us that ACA includes—but is not limited to—DOD’s traditional scope of ASA operations (i.e., the dedicated fighter aircraft and personnel at 18 steady- state alert sites across the United States), as well as a more- comprehensive list of capabilities used in their aerospace control mission. As figure 4 shows, according to NORAD, ACA capabilities include air defense and air sovereignty operations personnel and equipment at command and control centers at NORAD and elsewhere, ground-based defense systems, air patrols, airborne radar, and air-to-air refuelers—in addition to ASA fighters sitting on ground alert. However, Air Force and National Guard Bureau officials told us that while they were uncertain as to the definition of ACA, they believe the new term is interchangeable with ASA (i.e., the dedicated fighter aircraft and personnel at 18 steady-state alert sites across the United States). While NORAD’s new terminology may better reflect its overall aerospace- control mission, without a clear definition of what capabilities and expenditures are related to ACA—compared to ASA—Congress will lack a complete picture of the funding and other resources needed for DOD to conduct ASA operations (i.e., the dedicated fighter aircraft and personnel at 18 steady-state alert sites across the United States). DOD is required by law to submit a consolidated budget justification document annually that includes all funding requirements for ASA operations. As will be discussed in more detail later in this report, even before the change in terminology, the Air Force and National Guard Bureau faced difficulties providing Congress with complete and accurate information regarding expenditures associated with ASA operations. During our review, officials from NORAD, the Office of the Assistant Secretary of Defense for Homeland Defense and Americas’ Security Affairs, the Joint Chiefs of Staff, U.S. Pacific Command, the Air Force, and the National Guard Bureau could not consistently define what capabilities and expenditures should be considered part of ASA. Until DOD defines ACA; identifies the specific capabilities that support it—including personnel and equipment; and distinguishes the place of ASA within that mission for the purposes of providing consistent information in response to their budget-justification requirement, Congress, NORAD, and other entities within DOD could be making important homeland security decisions based on inconsistent information. DOD has taken a series of actions for ASA operations that are consistent with a risk-based management approach; however, several key actions have yet to be taken to fully implement a risk-based management approach that would enable the department to better balance risk and costs. According to our prior work, an ongoing risk-based management approach is a best practice that enhances an organization’s decision making, including determining operational requirements, and helps to guide the use of limited resources. We have previously recommended a five-phase approach to a risk-management framework, including: strategic goals and objectives, risk assessment, evaluation of alternatives, management selection, and implementation and monitoring. Risk management is a widely endorsed strategy for decision makers to allocate finite resources and take action under conditions of uncertainty. For example, the 2009 National Infrastructure Protection Plan states that its risk management framework integrates and coordinates strategies, capabilities, and governance to enable risk-informed decision making related to the nation’s critical infrastructure and key resources. This framework is applicable to threats such as natural disasters, manmade safety hazards, and terrorism, although different information and methodologies may be used to understand each. DOD’s overarching homeland defense goal is to secure the United States from direct attack, but DOD is unable to measure the extent to which ASA operations help to achieve that goal. In its 2005 Strategy for Homeland Defense and Civil Support, DOD linked homeland defense with several objectives associated with ASA operations—including deterring, detecting, and if necessary, defeating airborne threats. While these actions are initial steps in the first phase of a risk-based management approach, NORAD has not identified performance measures that could identify the extent to which its ASA operations are progressing toward DOD’s homeland defense goal and objectives. While U.S. Pacific Command has established one type of performance measure identified in Joint Chiefs of Staff doctrine on joint planning (measures of effectiveness), the command has not established the other type of performance measure (measures of performance).