DHS’s primary strategic planning effort in recent years has been the QHSR. DHS approached the 9/11 Commission Act requirement for a quadrennial homeland security review in three phases. In the first phase, DHS defined the nation’s homeland security interests, identified the critical homeland security missions, and developed a strategic approach to those missions by laying out the principal goals, objectives, and strategic outcomes for the mission areas. DHS reported on the results of this effort in the February 2010 QHSR report in which the department identified 5 homeland security missions, 14 associated goals, and 43 objectives. The QHSR report also identified threats and challenges confronting U.S. homeland security, strategic objectives for strengthening the homeland security enterprise, and federal agencies’ roles and responsibilities for homeland security. The QHSR identified five homeland security missions— (1) Preventing Terrorism and Enhancing Security, (2) Securing and Managing Our Borders, (3) Enforcing and Administering Our Immigration Laws, (4) Safeguarding and Securing Cyberspace, and (5) Ensuring Resilience to Disasters—and goals and objectives to be achieved within each mission. A sixth category of DHS activities— Providing Essential Support to National and Economic Security—was added in the fiscal year 2012 budget request but was not included in the 2010 QHSR report. In the second phase—the BUR—DHS identified its component agencies’ activities, aligned those activities with the QHSR missions and goals, and made recommendations for improving the department’s organizational alignment and business processes. DHS reported on the results of this second phase in the July 2010 BUR report. In the third phase DHS developed its budget plan necessary to execute the QHSR missions. DHS presented this budget plan in the President’s fiscal year 2012 budget request, issued February 14, 2011, and the accompanying Fiscal Year 2012-2016 Future Years Homeland Security Program (FYHSP), issued in May 2011. In December 2010, we issued a report on the extent to which the QHSR addressed the 9/11 Commission Act’s required reporting elements. We reported that of the nine 9/11 Commission Act reporting elements for the QHSR, DHS addressed three and partially addressed six. Elements DHS addressed included a description of homeland security threats and an explanation of underlying assumptions for the QHSR report. Elements addressed in part included a prioritized list of homeland security missions, an assessment of the alignment of DHS with the QHSR missions, and discussions of cooperation between the federal government and state, local, and tribal governments. In September 2011, we reported on the extent to which DHS consulted with stakeholders in developing the QHSR. DHS solicited input from various stakeholder groups in conducting the first QHSR, but DHS officials, stakeholders GAO contacted, and other reviewers of the QHSR noted concerns with time frames provided for stakeholder consultations and outreach to nonfederal stakeholders. DHS consulted with stakeholders—federal agencies; department and component officials; state, local, and tribal governments; the private sector; academics; and policy experts— through various mechanisms, such as the solicitation of papers to help frame the QHSR and a web-based discussion forum. DHS and these stakeholders identified benefits from these consultations, such as DHS receiving varied perspectives. However, stakeholders also identified challenges in the consultation process. For example: Sixteen of 63 stakeholders who provided comments to GAO noted concerns about the limited time frames for providing input into the QHSR or BUR. Nine other stakeholders commented that DHS consultations with nonfederal stakeholders, such as state, local, and private-sector entities, could be enhanced by including more of these stakeholders in QHSR consultations. Reports on the QHSR by the National Academy of Public Administration, which administered DHS’s web-based discussion forum, and a DHS advisory committee comprised of nonfederal representatives noted that DHS could provide more time and strengthen nonfederal outreach during stakeholder consultations. By providing more time for obtaining feedback and examining mechanisms to obtain nonfederal stakeholders’ input, DHS could strengthen its management of stakeholder consultations and be better positioned to review and incorporate, as appropriate, stakeholders’ input during future reviews. We recommended that DHS provide more time for consulting with stakeholders during the QHSR process and examine additional mechanisms for obtaining input from nonfederal stakeholders during the QHSR process, such as whether panels of state, local, and tribal government officials or components’ existing advisory or other groups could be useful. DHS concurred and reported that it will endeavor to incorporate increased opportunities for time and meaningful stakeholder engagement and will examine the use of panels of nonfederal stakeholders for the next QHSR. The 9/11 Commission Act called for DHS to prioritize homeland security missions in the QHSR. As we reported in December 2010, DHS identified five homeland security missions in the QHSR, but did not fully address the 9/11 Commission Act reporting element because the department did not prioritize the missions. According to DHS officials, the five missions listed in the QHSR report have equal priority—no one mission is given greater priority than another. Moreover, they stated that in selecting the five missions from the many potential homeland security mission areas upon which DHS could focus its efforts, the five mission areas are DHS’s highest-priority homeland security concerns. Risk management has been widely supported by Congress and DHS as a management approach for homeland security, enhancing the department’s ability to make informed decisions and prioritize resource investments. In September 2011, we also reported that in the 2010 QHSR report, DHS identified threats confronting homeland security, such as high-consequence weapons of mass destruction and illicit trafficking, but did not conduct a national risk assessment for the QHSR. DHS officials stated that at the time DHS conducted the QHSR, DHS did not have a well-developed methodology or the analytical resources to complete a national risk assessment that would include likelihood and consequence assessments—key elements of a national risk assessment. The QHSR terms of reference, which established the QHSR process, also stated that at the time the QHSR was launched, DHS lacked a process and a methodology for consistently and defensibly assessing risk at a national level and using the results of such an assessment to drive strategic prioritization and resource decisions. In recognition of a need to develop a national risk assessment, DHS created a study group as part of the QHSR process that developed a national risk assessment methodology. DHS officials plan to implement a national risk assessment in advance of the next QHSR, which DHS anticipates conducting in fiscal year 2013. Consistent with DHS’s plans, we reported that a national risk assessment conducted in advance of the next QHSR could assist DHS in developing QHSR missions that target homeland security risks and could allow DHS to demonstrate how it is reducing risk across multiple hazards. DHS considered various factors in identifying high-priority BUR initiatives for implementation in fiscal year 2012 but did not include risk information as one of these factors as called for in our prior work and DHS’s risk management guidance. Through the BUR, DHS identified 43 initiatives aligned with the QHSR mission areas to help strengthen DHS’s activities and serve as mechanisms for implementing those mission areas (see app. I for a complete list). According to DHS officials, the department could not implement all of these initiatives in fiscal year 2012 because of, among other things, resource constraints and organizational or legislative changes that would need to be made to implement some of the initiatives. In identifying which BUR initiatives to prioritize for implementation in fiscal year 2012, DHS leadership considered (1) “importance,” that is, how soon the initiative needed to be implemented; (2) “maturity,” that is, how soon the initiative could be implemented; and (3) “priority,” that is, whether the initiative enhanced secretarial or presidential priorities. Risk information was not included as an element in any of these three criteria, according to DHS officials, because of differences among the initiatives that made it difficult to compare risks across them, among other things. However, DHS officials stated that there are benefits to considering risk information in resource allocation decisions. Consideration of risk information during future implementation efforts could help strengthen DHS’s prioritization of mechanisms for implementing the QHSR, including assisting in determinations of which initiatives should be implemented in the short or longer term. In our September 2011 report, we recommended that DHS examine how risk information could be used in prioritizing future QHSR initiatives. DHS concurred and reported that DHS intends to conduct risk analysis specific to the QHSR in advance of the next review and will use the analysis as an input into decision making related to implementing the QHSR. Further, in September 2011, we reported on progress made by DHS in implementing its homeland security missions since 9/11. As part of this work, we identified various themes that affected DHS’s implementation efforts. One of these themes was DHS’s efforts to strategically manage risk across the department. We reported that DHS made important progress in assessing and analyzing risk across sectors. For example, in January 2009 DHS published its Integrated Risk Management Framework, which, among other things, calls for DHS to use risk assessments to inform decision making. In May 2010, the Secretary issued a Policy Statement on Integrated Risk Management, calling for DHS and its partners to manage risks to the nation. We also reported that DHS had more work to do in using this information to inform planning and resource-allocation decisions. Our work shows that DHS has conducted risk assessments across a number of areas, but should strengthen the assessments and risk management process. For example: In June 2011, we reported that DHS and Health and Human Services could further strengthen coordination for chemical, biological, radiological, and nuclear (CBRN) risk assessments.