oversight

Department of Homeland Security: Additional Actions Needed to Strengthen Strategic Planning and Management Functions

Published by the Government Accountability Office on 2012-02-03.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                             United States Government Accountability Office

GAO                          Testimony
                             Before the Subcommittee on Oversight,
                             Investigations, and Management,
                             Committee on Homeland Security, House
                             of Representatives
For Release on Delivery
Expected at 10:00 a.m. EST
Friday, February 3, 2012     DEPARTMENT OF
                             HOMELAND SECURITY
                             Additional Actions Needed
                             to Strengthen Strategic
                             Planning and Management
                             Functions
                             Statement of David C. Maurer, Director
                             Homeland Security and Justice Issues




GAO-12-382T
                                               February 3, 2012

                                               DEPARTMENT OF HOMELAND SECURITY
                                               Additional Actions Needed to Strengthen Strategic
                                               Planning and Management Functions
Highlights of GAO-12-382T, a testimony
before the Subcommittee on Oversight,
Investigations, and Management, Committee
on Homeland Security, House of
Representatives


Why GAO Did This Study                         What GAO Found
The Implementing Recommendations               DHS’s primary strategic planning effort in recent years has been the QHSR. In
of the 9/11 Commission Act of 2007             September 2011, GAO reported on the extent to which DHS consulted with
(9/11 Commission Act) requires that            stakeholders in developing the QHSR. DHS solicited input from various
beginning in fiscal year 2009 and every        stakeholder groups in conducting the first QHSR, but DHS officials, several
4 years thereafter the Department of           stakeholders GAO contacted, and other reviewers of the QHSR noted concerns
Homeland Security (DHS) conduct a              with time frames provided for stakeholder consultations and outreach to
review that provides a comprehensive           nonfederal stakeholders. Specifically, DHS consulted with stakeholders—federal
examination of the homeland security           agencies; department and component officials; state, local, and tribal
strategy of the United States. In
                                               governments; the private sector; academics; and policy experts—through various
February 2010, DHS issued its first
                                               mechanisms, such as the solicitation of papers to help frame the QHSR. DHS
Quadrennial Homeland Security
Review (QHSR) report, outlining a
                                               and these stakeholders identified benefits from these consultations, such as DHS
strategic framework for homeland               receiving varied perspectives. However, stakeholders also identified challenges
security. In July 2010 DHS issued a            in the consultation process, such as concerns about the limited time frames for
report on the results of its Bottom-Up         providing input into the QHSR or BUR and the need to examine additional
Review (BUR), a departmentwide                 mechanisms for including more nonfederal stakeholders in consultations. By
assessment to implement the QHSR               providing more time for obtaining feedback and examining mechanisms to obtain
strategy by aligning DHS’s                     nonfederal stakeholders’ input, DHS could strengthen its management of
programmatic activities, such as               stakeholder consultations and be better positioned to review and incorporate, as
inspecting cargo at ports of entry, and        appropriate, stakeholders’ input during future reviews.
its organizational structure with the
missions and goals identified in the           DHS considered various factors in identifying high-priority BUR initiatives for
QHSR. This testimony addresses                 implementation in fiscal year 2012 but did not include risk information as one of
DHS’s efforts to (1) strategically plan        these factors, as called for in GAO’s prior work and DHS’s risk-management
its homeland security missions through         guidance. Through the BUR, DHS identified 43 initiatives aligned with the QHSR
the QHSR, (2) set strategic priorities         mission areas to serve as mechanisms for implementing those mission areas.
and measure performance, and (3)               According to DHS officials, DHS did not consider risk information in prioritizing
build a unified department. This               initiatives because of differences among the initiatives that made it difficult to
testimony is based on GAO reports
                                               compare risks across them, among other things. In September 2011, GAO
issued in December 2010, February
                                               reported that consideration of risk information during future implementation
2011, and September 2011.
                                               efforts could help strengthen DHS’s prioritization of mechanisms for
What GAO Recommends                            implementing the QHSR. Further, GAO reported that DHS established
                                               performance measures for most of the QHSR objectives and had plans to
GAO made recommendations in prior              develop additional measures. However, with regard to specific programs, GAO’s
reports for DHS to, among other                work has shown that a number of programs and efforts lack outcome goals and
things, provide more time for
                                               measures, hindering the department’s ability to effectively assess results.
consulting with stakeholders during the
QHSR process, examine additional
mechanisms for obtaining input from            In 2003, GAO designated the transformation of DHS as high risk because DHS
nonfederal stakeholders, and examine           had to transform 22 agencies—several with major management challenges—into
how risk information could be used in          one department, and failure to effectively address DHS’s management and
prioritizing future QHSR initiatives.          mission risks could have serious consequences for U.S. national and economic
DHS concurred and has actions                  security. DHS has taken action to implement, transform, and strengthen its
planned or underway to address them.           management functions, such as developing a strategy for addressing this high-
                                               risk area and putting in place common policies, procedures, and systems within
                                               individual management functions, such as human capital, that help to integrate
                                               its component agencies. However, DHS needs to demonstrate measurable,
View GAO-12-382T. For more information,
contact David C. Maurer at (202) 512-9627 or
                                               sustainable progress in implementing its strategy and corrective actions to
maurerd@gao.gov.                               address its management challenges.

                                                                                       United States Government Accountability Office
Chairman McCaul, Ranking Member Keating, and Members of the
Subcommittee:

I am pleased to be here today to discuss Department of Homeland
Security (DHS) strategic planning. Various strategies and plans exist for
guiding homeland security efforts across the homeland security
enterprise. 1 For example, the May 2010 National Security Strategy
outlines key security priorities and the 2007 National Homeland Security
Strategy defined the homeland security mission for the federal
government. More specific to DHS, the Implementing Recommendations
of the 9/11 Commission Act of 2007 (9/11 Commission Act) requires that
beginning in fiscal year 2009 and every 4 years thereafter DHS conduct a
review that provides a comprehensive examination of the homeland
security strategy of the United States. 2 In February 2010, DHS issued its
first Quadrennial Homeland Security Review (QHSR) report, outlining a
strategic framework for homeland security to guide the activities of
homeland security partners, including federal, state, local, and tribal
government agencies; the private sector; and nongovernmental
organizations. 3

In addition to the QHSR, in July 2010 DHS issued a report on the results
of its Bottom-Up Review (BUR), a departmentwide assessment to
implement the QHSR strategy by aligning DHS’s programmatic activities,
such as apprehending fugitive aliens and inspecting cargo at ports of
entry, and its organizational structure with the missions and goals
identified in the QHSR. 4 The BUR report described DHS’s current
activities contributing to (1) QHSR mission performance, (2) departmental
management, and (3) accountability. Subsequent to publishing the BUR
report, DHS identified priority initiatives, such as strengthening aviation



1
 DHS defines the homeland security enterprise as the federal, state, local, tribal, territorial,
nongovernmental, and private-sector entities, as well as individuals, families, and
communities, who share a common national interest in the safety and security of the
United States and the American population.
2
 Pub. L. No. 110-53, § 2401(a), 121 Stat. 266, 543-45 (2007) (codified at 6 U.S.C. § 347).
3
 DHS, Quadrennial Homeland Security Review Report: A Strategic Framework for a
Secure Homeland (Washington, D.C.: February 2010). Although the act requires the first
QHSR to be conducted in 2009—see 6 U.S.C. § 347(c)—the QHSR report was issued in
February 2010 and we refer to it in this statement as the 2010 QHSR.
4
 DHS, Bottom-Up Review Report (Washington, D.C.: July 2010).




Page 1                                                                            GAO-12-382T
security and enhancing the department’s risk management capability, to
strengthen DHS’s mission performance, improve departmental
management, and increase accountability.

DHS’s ongoing efforts to identify strategic goals and align key missions
and resources with those goals are supported by another key
departmental goal: building a unified department. In 2003, GAO
designated implementing and transforming DHS as high risk because
DHS had to transform 22 agencies—several with major management
challenges—into one department. Failure to effectively address DHS’s
management and mission risks could have serious consequences for
U.S. national and economic security. Our prior work, undertaken before
the creation of DHS, found that successful transformations of large
organizations, even those faced with less-strenuous reorganizations than
DHS, can take years to achieve. DHS is now the third-largest federal
department with more than 200,000 employees and $56 billion in budget
authority, and its transformation is critical to achieving its homeland
security missions.

My testimony today focuses on the findings from our prior work in three
key areas:

•   DHS’s efforts to strategically plan its homeland security missions
    departmentwide through the QHSR,
•   DHS’s efforts to set strategic priorities and measure performance
    departmentwide, and
•   DHS’s efforts to build and implement a unified department.

This statement is based on four past reports, issued in December 2010,
February 2011, and September 2011, related to DHS’s QHSR, GAO’s
high-risk series, and DHS mission implementation. 5 For these past
reports, among other things, we interviewed DHS officials; analyzed DHS
strategic documents; and reviewed our past reports, supplemented by


5
 GAO, Quadrennial Homeland Security Review: Enhanced Stakeholder Consultation and
Use of Risk Information Could Strengthen Future Reviews, GAO-11-873 (Washington,
D.C.: Sept. 15, 2011); Department of Homeland Security: Progress Made and Work
Remaining in Implementing Homeland Security Missions 10 Years after 9/11,
GAO-11-881 (Washington, D.C.: Sept. 7, 2011); High-Risk Series: An Update,
GAO-11-278 (Washington, D.C: February 2011); and Quadrennial Homeland Security
Review: 2010 Reports Addressed Many Required Elements, but Budget Planning Not Yet
Completed, GAO-11-153R (Washington, D.C.: Dec. 16, 2010).




Page 2                                                                 GAO-12-382T
                                  DHS Office of Inspector General (IG) reports, issued since DHS began its
                                  operations in March 2003. We conducted this work in accordance with
                                  generally accepted government auditing standards. More detailed
                                  information on the scope and methodology from our previous work can be
                                  found within each specific report.


                                  DHS’s primary strategic planning effort in recent years has been the
DHS Strategically                 QHSR. DHS approached the 9/11 Commission Act requirement for a
Planned Its Homeland              quadrennial homeland security review in three phases.
Security Missions                 •   In the first phase, DHS defined the nation’s homeland security
Departmentwide                        interests, identified the critical homeland security missions, and
                                      developed a strategic approach to those missions by laying out the
through the QHSR,                     principal goals, objectives, and strategic outcomes for the mission
but Stakeholder                       areas. DHS reported on the results of this effort in the February 2010
                                      QHSR report in which the department identified 5 homeland security
Consultations Could                   missions, 14 associated goals, and 43 objectives. The QHSR report
Be Enhanced                           also identified threats and challenges confronting U.S. homeland
                                      security, strategic objectives for strengthening the homeland security
The QHSR identified five              enterprise, and federal agencies’ roles and responsibilities for
homeland security missions—           homeland security.
(1) Preventing Terrorism and
                                  •   In the second phase—the BUR—DHS identified its component
Enhancing Security, (2)
Securing and Managing Our             agencies’ activities, aligned those activities with the QHSR missions
Borders, (3) Enforcing and            and goals, and made recommendations for improving the
                                      department’s organizational alignment and business processes. DHS
Administering Our Immigration
                                      reported on the results of this second phase in the July 2010 BUR
Laws, (4) Safeguarding and
                                      report.
Securing Cyberspace, and (5)
Ensuring Resilience to
                                  •   In the third phase DHS developed its budget plan necessary to
Disasters—and goals and
                                      execute the QHSR missions. DHS presented this budget plan in the
objectives to be achieved             President’s fiscal year 2012 budget request, issued February 14,
within each mission. A sixth          2011, and the accompanying Fiscal Year 2012-2016 Future Years
category of DHS activities—           Homeland Security Program (FYHSP), issued in May 2011.
Providing Essential Support to
National and Economic             In December 2010, we issued a report on the extent to which the QHSR
Security—was added in the         addressed the 9/11 Commission Act’s required reporting elements. 6 We
fiscal year 2012 budget           reported that of the nine 9/11 Commission Act reporting elements for the
request but was not included in
the 2010 QHSR report.
                                  6
                                  GAO-11-153R.




                                  Page 3                                                          GAO-12-382T
QHSR, DHS addressed three and partially addressed six. 7 Elements
DHS addressed included a description of homeland security threats and
an explanation of underlying assumptions for the QHSR report. Elements
addressed in part included a prioritized list of homeland security missions,
an assessment of the alignment of DHS with the QHSR missions, and
discussions of cooperation between the federal government and state,
local, and tribal governments.

In September 2011, we reported on the extent to which DHS consulted
with stakeholders in developing the QHSR. 8 DHS solicited input from
various stakeholder groups in conducting the first QHSR, but DHS
officials, stakeholders GAO contacted, and other reviewers of the QHSR
noted concerns with time frames provided for stakeholder consultations
and outreach to nonfederal stakeholders. DHS consulted with
stakeholders—federal agencies; department and component officials;
state, local, and tribal governments; the private sector; academics; and
policy experts— through various mechanisms, such as the solicitation of
papers to help frame the QHSR and a web-based discussion forum. DHS
and these stakeholders identified benefits from these consultations, such
as DHS receiving varied perspectives. However, stakeholders also
identified challenges in the consultation process. For example:

•   Sixteen of 63 stakeholders who provided comments to GAO noted
    concerns about the limited time frames for providing input into the
    QHSR or BUR.
•   Nine other stakeholders commented that DHS consultations with
    nonfederal stakeholders, such as state, local, and private-sector
    entities, could be enhanced by including more of these stakeholders
    in QHSR consultations.
•   Reports on the QHSR by the National Academy of Public
    Administration, which administered DHS’s web-based discussion
    forum, and a DHS advisory committee comprised of nonfederal
    representatives noted that DHS could provide more time and
    strengthen nonfederal outreach during stakeholder consultations.



7
 We considered an element addressed if all portions of it were explicitly included in either
the QHSR or BUR reports, addressed in part if one or more but not all portions of the
element were included, and not addressed if neither the QHSR nor the BUR reports
explicitly addressed any part of the element.
8
 GAO-11-873.




Page 4                                                                          GAO-12-382T
                       By providing more time for obtaining feedback and examining
                       mechanisms to obtain nonfederal stakeholders’ input, DHS could
                       strengthen its management of stakeholder consultations and be better
                       positioned to review and incorporate, as appropriate, stakeholders’ input
                       during future reviews. We recommended that DHS provide more time for
                       consulting with stakeholders during the QHSR process and examine
                       additional mechanisms for obtaining input from nonfederal stakeholders
                       during the QHSR process, such as whether panels of state, local, and
                       tribal government officials or components’ existing advisory or other
                       groups could be useful. DHS concurred and reported that it will endeavor
                       to incorporate increased opportunities for time and meaningful
                       stakeholder engagement and will examine the use of panels of nonfederal
                       stakeholders for the next QHSR.


                       The 9/11 Commission Act called for DHS to prioritize homeland security
DHS Did Not            missions in the QHSR. 9 As we reported in December 2010, DHS
Prioritize QHSR        identified five homeland security missions in the QHSR, but did not fully
Missions or Use Risk   address the 9/11 Commission Act reporting element because the
                       department did not prioritize the missions. 10 According to DHS officials,
Assessments to Help    the five missions listed in the QHSR report have equal priority—no one
Set Strategic          mission is given greater priority than another. Moreover, they stated that
                       in selecting the five missions from the many potential homeland security
Priorities and Could   mission areas upon which DHS could focus its efforts, the five mission
Improve                areas are DHS’s highest-priority homeland security concerns.

Departmentwide         Risk management has been widely supported by Congress and DHS as a
Performance            management approach for homeland security, enhancing the
                       department’s ability to make informed decisions and prioritize resource
Measures               investments. In September 2011, we also reported that in the 2010 QHSR
                       report, DHS identified threats confronting homeland security, such as
                       high-consequence weapons of mass destruction and illicit trafficking, but
                       did not conduct a national risk assessment for the QHSR. 11 DHS officials
                       stated that at the time DHS conducted the QHSR, DHS did not have a
                       well-developed methodology or the analytical resources to complete a



                       9
                       6 U.S.C. § 347(c)(2)(C).
                       10
                           GAO-11-153R.
                       11
                           GAO-11-873.




                       Page 5                                                           GAO-12-382T
                               national risk assessment that would include likelihood and consequence
                               assessments—key elements of a national risk assessment. The QHSR
                               terms of reference, which established the QHSR process, also stated that
                               at the time the QHSR was launched, DHS lacked a process and a
                               methodology for consistently and defensibly assessing risk at a national
                               level and using the results of such an assessment to drive strategic
                               prioritization and resource decisions. In recognition of a need to develop a
                               national risk assessment, DHS created a study group as part of the
                               QHSR process that developed a national risk assessment methodology.
                               DHS officials plan to implement a national risk assessment in advance of
                               the next QHSR, which DHS anticipates conducting in fiscal year 2013.
                               Consistent with DHS’s plans, we reported that a national risk assessment
                               conducted in advance of the next QHSR could assist DHS in developing
                               QHSR missions that target homeland security risks and could allow DHS
                               to demonstrate how it is reducing risk across multiple hazards.


DHS Could Strengthen Its       DHS considered various factors in identifying high-priority BUR initiatives
Use of Risk Information in     for implementation in fiscal year 2012 but did not include risk information
Prioritizing Initiatives and   as one of these factors as called for in our prior work and DHS’s risk
                               management guidance. 12 Through the BUR, DHS identified 43 initiatives
Planning and Investment
                               aligned with the QHSR mission areas to help strengthen DHS’s activities
Decision Making                and serve as mechanisms for implementing those mission areas (see
                               app. I for a complete list). According to DHS officials, the department
                               could not implement all of these initiatives in fiscal year 2012 because of,
                               among other things, resource constraints and organizational or legislative
                               changes that would need to be made to implement some of the initiatives.

                               In identifying which BUR initiatives to prioritize for implementation in fiscal
                               year 2012, DHS leadership considered (1) “importance,” that is, how soon
                               the initiative needed to be implemented; (2) “maturity,” that is, how soon
                               the initiative could be implemented; and (3) “priority,” that is, whether the
                               initiative enhanced secretarial or presidential priorities. Risk information
                               was not included as an element in any of these three criteria, according to


                               12
                                 See GAO, Risk Management: Further Refinements Needed to Assess Risks and
                               Prioritize Protective Measures at Ports and Other Critical Infrastructure, GAO-06-91
                               (Washington, D.C.: Dec. 15, 2005), and Transportation Security: Comprehensive Risk
                               Assessments and Stronger Internal Controls Needed to Help Inform TSA Resource
                               Allocation, GAO-09-492 (Washington, D.C.: Mar. 27, 2009). For DHS risk-management
                               guidance, see DHS, Risk Management Fundamentals: Homeland Security Risk
                               Management Doctrine (April 2011).




                               Page 6                                                                    GAO-12-382T
DHS officials, because of differences among the initiatives that made it
difficult to compare risks across them, among other things. However,
DHS officials stated that there are benefits to considering risk information
in resource allocation decisions. Consideration of risk information during
future implementation efforts could help strengthen DHS’s prioritization of
mechanisms for implementing the QHSR, including assisting in
determinations of which initiatives should be implemented in the short or
longer term. In our September 2011 report, we recommended that DHS
examine how risk information could be used in prioritizing future QHSR
initiatives. DHS concurred and reported that DHS intends to conduct risk
analysis specific to the QHSR in advance of the next review and will use
the analysis as an input into decision making related to implementing the
QHSR.

Further, in September 2011, we reported on progress made by DHS in
implementing its homeland security missions since 9/11. 13 As part of this
work, we identified various themes that affected DHS’s implementation
efforts. One of these themes was DHS’s efforts to strategically manage
risk across the department. We reported that DHS made important
progress in assessing and analyzing risk across sectors. For example, in
January 2009 DHS published its Integrated Risk Management
Framework, which, among other things, calls for DHS to use risk
assessments to inform decision making. In May 2010, the Secretary
issued a Policy Statement on Integrated Risk Management, calling for
DHS and its partners to manage risks to the nation.

We also reported that DHS had more work to do in using this information
to inform planning and resource-allocation decisions. Our work shows
that DHS has conducted risk assessments across a number of areas, but
should strengthen the assessments and risk management process. For
example:

•     In June 2011, we reported that DHS and Health and Human Services
      could further strengthen coordination for chemical, biological,
      radiological, and nuclear (CBRN) risk assessments. Among other
      things, we recommended that DHS establish time frames and
      milestones to better ensure timely development and interagency
      agreement on written procedures for development of DHS’s CBRN



13
    GAO-11-881.




Page 7                                                           GAO-12-382T
     risk assessments. DHS concurred and stated that the department had
     begun efforts to develop milestones and time frames for its strategic
     and implementation plans for interagency risk assessment
     development. 14

•    In November 2011, we reported that the U.S. Coast Guard used its
     Maritime Security Risk Assessment Model at the national level to
     focus resources on the highest-priority targets, leading to Coast
     Guard operating efficiencies, but use at the local level for operational
     and tactical risk-management efforts has been limited by a lack of
     staff time, the complexity of the risk tool, and competing mission
     demands. 15 Among other things, we recommended that the Coast
     Guard provide additional training for sector command staff and others
     involved in sector management and operations on how the model can
     be used as a risk-management tool to inform sector-level decision
     making. The Coast Guard concurred and stated that it will explore
     other opportunities to provide risk training to sector command staff,
     including online and webinar training opportunities.

•    In November 2011, we reported that the Federal Emergency
     Management Agency (FEMA) used risk assessments to inform
     funding-allocation decisions for its port security grant program. 16
     However, we found that FEMA could further enhance its risk-analysis
     model and recommended incorporating the results of past security
     investments and refining other data inputs into the model. DHS
     concurred with the recommendation, but did not provide details on
     how it plans to implement it.

•    In October 2009, we reported that TSA’s strategic plan to guide
     research, development, and deployment of passenger checkpoint




14
  GAO, National Preparedness: DHS and HHS Can Further Strengthen Coordination for
Chemical, Biological, Radiological, and Nuclear Risk Assessments, GAO-11-606
(Washington, D.C.: June 21, 2011).
15
  GAO, Coast Guard: Security Risk Model Meets DHS Criteria, but More Training Could
Enhance Its Use for Managing Programs and Operations, GAO-12-14 (Washington, D.C.:
Nov. 17, 2011).
16
 GAO, Port Security Grant Program: Risk Model, Grant Management, and Effectiveness
Measures Could Be Strengthened, GAO-12-47 (Washington, D.C.: Nov. 17, 2011).




Page 8                                                                  GAO-12-382T
                                screening technologies was not risk-based. 17 Among other things, we
                                recommended that DHS conduct a complete risk assessment related
                                to TSA’s passenger screening program and incorporate the results
                                into the program’s strategy. DHS concurred, and in July 2011 reported
                                actions underway to address it, such as beginning to use a risk-
                                management analysis process to analyze the effectiveness and
                                efficiency of potential countermeasures and effect on the commercial
                                aviation system.

DHS Has Established        In September 2011, we reported that DHS established performance
Performance Measures,      measures for most of the QHSR objectives and had plans to develop
but Has Not Yet Fully      additional measures. 18 Specifically, DHS established new performance
                           measures, or linked existing measures, to 13 of 14 QHSR goals, and to 3
Developed Outcome-Based
                           of 4 goals for the sixth category of DHS activities—Providing Essential
Measures for Many of Its   Support to National and Economic Security. DHS reported these
Mission Functions          measures in its fiscal years 2010-2012 Annual Performance Report. For
                           goals without measures, DHS officials told us that the department was
                           developing performance measures and planned to publish them in future
                           budget justifications to Congress.

                           In September 2011, we also reported that DHS had not yet fully
                           developed outcome-based measures for assessing progress and
                           performance for many of its mission functions. 19 We recognized that DHS
                           faced inherent difficulties in developing performance goals and measures
                           to address its unique mission and programs, such as in developing
                           measures for the effectiveness of its efforts to prevent and deter terrorist
                           attacks. While DHS had made progress in strengthening performance
                           measurement, our work across the department has shown that a number
                           of programs lacked outcome goals and measures, which may have
                           hindered the department’s ability to effectively assess results or fully
                           assess whether the department was using resources effectively and
                           efficiently. For example, our work has shown that DHS did not have
                           performance measures for assessing the effectiveness of key border
                           security and immigration programs, to include:


                           17
                             GAO. Aviation Security: DHS and TSA Have Researched, Developed, and Begun
                           Deploying Passenger Checkpoint Screening Technologies, but Continue to Face
                           Challenges. GAO-10-128. (Washington, D.C.: Oct. 7, 2009).
                           18
                            GAO-11-873.
                           19
                            GAO-11-881.




                           Page 9                                                               GAO-12-382T
•    In September 2009, we reported that U.S. Customs and Border
     Protection (CBP) had invested $2.4 billion in tactical infrastructure
     (fencing, roads, and lighting) along the southwest border under the
     Secure Border Initiative—a multiyear, multibillion dollar program
     aimed at securing U.S. borders and reducing illegal immigration. 20
     However, DHS could not measure the effect of this investment in
     tactical infrastructure on border security. We recommended that DHS
     conduct an evaluation of the effect of tactical infrastructure on
     effective control of the border. DHS concurred with the
     recommendation and subsequently reported that the ongoing analysis
     is expected to be completed in February 2012.

•    In August 2009, we reported that CBP had established three
     performance measures to report the results of checkpoint operations,
     which provided some insight into checkpoint activity. 21 However, the
     measures did not indicate if checkpoints were operating efficiently and
     effectively, and data reporting and collection challenges hindered the
     use of results to inform Congress and the public on checkpoint
     performance. We recommended that CBP improve the measurement
     and reporting of checkpoint effectiveness. CBP agreed and, as of
     September 2011, reported plans to develop and better use data on
     checkpoint effectiveness.

•    Further, we reported that U.S. Immigration and Customs Enforcement
     (ICE) and CBP did not have measures for assessing the performance
     of key immigration enforcement programs. For example, in April 2011,
     we reported that ICE did not have measures for its overstay
     enforcement efforts, and in May 2010 that CBP did not have
     measures for its alien smuggling investigative efforts, making it
     difficult for these agencies to determine progress made in these areas
     and evaluate possible improvements. 22 We recommended that ICE


20
  GAO, Secure Border Initiative: Technology Deployment Delays Persist and the Impact
of Border Fencing Has Not Been Assessed, GAO-09-1013T (Washington, D.C.: Sept. 17,
2009).
21
 GAO, Border Patrol: Checkpoints Contribute to Border Patrol’s Mission, but More
Consistent Data Collection and Performance Measurement Could Improve Effectiveness,
GAO-09-824 (Washington, D.C.: Aug. 31, 2009).
22
  GAO, Overstay Enforcement: Additional Mechanisms for Collecting, Assessing, and
Sharing Data Could Strengthen DHS’s Efforts but Would Have Costs, GAO-11-411
(Washington, D.C.: Apr. 15, 2011) and Alien Smuggling: DHS Needs to Better Leverage
Investigative Resources to Measure Program Performance along the Southwest Border,
GAO-10-328 (Washington, D.C.: May 24, 2010).




Page 10                                                                  GAO-12-382T
                           and CBP develop performance measures for these two areas. They
                           generally agreed and reported actions underway to develop these
                           measures.

                       In 2003, GAO designated the transformation of DHS as high risk because
DHS Has Taken          DHS had to transform 22 agencies—several with major management
Action to Implement,   challenges—into one department, and failure to effectively address DHS’s
                       management and mission risks could have serious consequences for
Strengthen, and        U.S. national and economic security. This high-risk area includes
Integrate Its          challenges in strengthening DHS’s management functions—financial
Management             management, human capital, information technology, and acquisition
                       management—the impact of those challenges on DHS’s mission
Functions, but Needs   implementation, and challenges in integrating management functions
to Demonstrate         within and across the department and its components. Addressing these
                       challenges would better position DHS to align resources to its strategic
Sustainable Progress   priorities, assess progress in meeting mission goals, enhance linkages
                       within and across components, and improve the overall effectiveness and
                       efficiency of the department.

                       On the basis of our prior work, in September 2010, we identified and
                       provided to DHS 31 key actions and outcomes that are critical to
                       addressing the challenges within the department’s management functions
                       and in integrating those functions across the department. These key
                       actions and outcomes include, among others, validating required
                       acquisition documents at major milestones in the acquisition review
                       process; obtaining and then sustaining unqualified audit opinions for at
                       least 2 consecutive years on the departmentwide financial statements
                       while demonstrating measurable progress in reducing material
                       weaknesses and significant deficiencies; and implementing its workforce
                       strategy and linking workforce planning efforts to strategic and program-




                       Page 11                                                        GAO-12-382T
specific planning efforts to identify current and future human capital
needs. 23

In our February 2011 high-risk update, we reported that DHS had taken
action to implement, transform, and strengthen its management functions,
and had begun to demonstrate progress in addressing some of the
actions and outcomes we identified within each management area. 24 For
example, we reported that the Secretary and Deputy Secretary of
Homeland Security, and other senior officials, have demonstrated
commitment and top leadership support to address the department’s
management challenges. DHS also put in place common policies,
procedures, and systems within individual management functions, such
as human capital, that help to integrate its component agencies. For
example, DHS

•     revised its acquisition management oversight policies to include more
      detailed guidance to inform departmental acquisition decision making.
•     strengthened its enterprise architecture, or blueprint to guide
      information technology acquisitions, and improved its policies and
      procedures for investment management.
•     developed corrective action plans for its financial management
      weaknesses, and, for the first time since its inception, DHS earned a
      qualified audit opinion on its fiscal year 2011 balance sheet; 25 and
•     issued its Workforce Strategy for Fiscal Years 2011-2016, which
      contains the department’s workforce goals, objectives, and
      performance measures for human capital management.

Further, in January 2011, DHS provided us with its Integrated Strategy for
High Risk Management, which summarized the department’s preliminary


23
  A material weakness is a significant deficiency, or a combination of significant
deficiencies, in internal control such that there is a reasonable possibility that a material
misstatement of the entity’s financial statements will not be prevented or detected and
corrected on a timely basis. A significant deficiency is a deficiency, or combination of
deficiencies, in internal control that is less severe than a material weakness, yet important
enough to merit attention by those charged with governance. A deficiency in internal
control exists when the design or operation of a control does not allow management or
employees, in the normal course of performing their assigned functions, to prevent, or
detect and correct, misstatements on a timely basis.
24
    GAO-11-278.
25
  For DHS, obtaining a qualified audit opinion is a first step toward achieving an
unqualified audit opinion.




Page 12                                                                         GAO-12-382T
plans for addressing the high-risk area. Specifically, the strategy
contained details on the implementation and transformation of DHS, such
as corrective actions to address challenges within each management
area, and officials responsible for implementing those corrective actions.
DHS provided us with updates to this strategy in June and December
2011. We provided DHS with written feedback on the January 2011
strategy and the June update, and have worked with the department to
monitor implementation efforts. We noted that both versions of the
strategy were generally responsive to actions and outcomes we identified
for the department to address the high-risk area. For example, DHS
included a management integration plan containing information on
initiatives to integrate its management functions across the department.
Specifically, DHS plans to establish a framework for managing
investments across its components and management functions to
strengthen integration within and across those functions, as well as to
ensure that mission needs drive investment decisions. This framework
seeks to enhance DHS resource decision making and oversight by
creating new department-level councils to identify priorities and capability
gaps, revising how DHS components and lines of business manage
acquisition programs, and developing a common framework for
monitoring and assessing implementation of investment decisions. These
actions, if implemented effectively, should help to further and more
effectively integrate the department and enhance DHS’s ability to
implement its strategies. However, we noted in response to the June
update that specific resources to implement planned corrective actions
were not consistently identified, making it difficult to assess the extent to
which DHS has the capacity to implement these actions. Additionally, for
both versions, we noted that the department did not provide information
on the underlying metrics or factors DHS used to rate its progress,
making it difficult for us to assess DHS’s overall characterizations of
progress. We are currently assessing the December 2011 update and
plan to provide DHS with feedback shortly.

Although DHS has made progress in strengthening and integrating its
management functions, the department continues to face significant
challenges affecting the department’s transformation efforts and its ability
to meet its missions. In particular, challenges within acquisition,
information technology, financial, and human capital management have
resulted in performance problems and mission delays. For example, DHS
does not yet have enough skilled personnel to carry out activities in some
key programmatic and management areas, such as for acquisition
management. DHS also has not yet implemented an integrated financial
management system, impeding its ability to have ready access to


Page 13                                                           GAO-12-382T
                  information to inform decision making, and has been unable to obtain a
                  clean audit opinion on the audit of its consolidated financial statements
                  since its establishment.

                  Going forward, DHS needs to implement its Integrated Strategy for High
                  Risk Management, and continue its efforts to (1) identify and acquire
                  resources needed to achieve key actions and outcomes; (2) implement a
                  program to independently monitor and validate corrective measures; and
                  (3) show measurable, sustainable progress in implementing corrective
                  actions and achieving key outcomes. Demonstrated, sustained progress
                  in all of these areas will help DHS strengthen and integrate management
                  functions within and across the department and its components.


                  Chairman McCaul, Ranking Member Keating, and Members of the
                  Subcommittee, this concludes my prepared statement. I would be
                  pleased to respond to any questions that you may have.


                  For questions about this statement, please contact David C. Maurer at
GAO Contact and   (202) 512-9627 or maurerd@gao.gov. Contact points for our Offices of
Staff             Congressional Relations and Public Affairs may be found on the last page
                  of this statement. Individuals making key contributions to this statement
Acknowledgments   include Rebecca Gambler, Acting Director; Ben Atwater; Scott Behen;
                  Janay Sam; Jean Orland; and Justin Dunleavy. Key contributors for the
                  previous work that this testimony is based on are listed within each
                  individual product.




                  Page 14                                                          GAO-12-382T
              Appendix I: Bottom-Up Review Initiatives
Appendix I: Bottom-Up Review Initiatives


              Initiatives selected by DHS for implementation in fiscal year 2012 listed in
              bold.

              Mission One: Preventing Terrorism and Enhancing Security

                  1. Strengthen counterterrorism coordination across DHS
                  2. Strengthen aviation security
                  3. Create an integrated departmental information sharing
                      architecture
                  4. Deliver infrastructure protection and resilience capabilities to the
                      field
                  5. Set national performance standards for identification verification
                  6. Increase efforts to detect and counter nuclear and biological
                      weapons and dangerous materials
                  7. Leverage the full range of capabilities to address biological and
                      nuclear threats
                  8. Standardize and institutionalize the National Fusion Center
                      Network
                  9. Promote safeguards for access to secure areas in critical
                      facilities
                  10. Establish DHS as a center of excellence for canine training and
                      deployment
                  11. Redesign the Federal Protective Service (FPS) to better match
                      mission requirements

              Mission Two: Securing and Managing Our Borders

                  12. Expand joint operations and intelligence capabilities,
                      including enhanced domain awareness
                  13. Prioritize immigration and customs investigations
                  14. Enhance the security and resilience of global trade and travel
                      systems
                  15. Strengthen and expand DHS-related security assistance
                      internationally (e.g., border integrity and customs enforcement
                      security assistance) consistent with U.S. government security,
                      trade promotion, international travel, and foreign assistance
                      objectives
                  16. Enhance North American security

              Mission Three: Enforcing and Administering Our Immigration Laws

                  17. Comprehensive immigration reform
                  18. Improve DHS immigration services processes
                  19. Focus on fraud detection and national security vetting


              Page 15                                                           GAO-12-382T
Appendix I: Bottom-Up Review Initiatives




    20. Target egregious employers who knowingly exploit illegal workers
    21. Dismantle human smuggling organizations
    22. Improve the detention and removal process
    23. Work with new Americans so that they fully transition to the rights
        and responsibilities of citizenship
    24. Maintain a model detention system commensurate with risk

Mission Four: Safeguarding and Securing Cyberspace

    25. Increase the focus and integration of DHS’s operational cyber
        security and infrastructure resilience activities
    26. Strengthen DHS ability to protect cyber networks
    27. Increase DHS predictive and forensic capabilities for cyber
        intrusions and attacks
    28. Promote cyber security public awareness

Mission Five: Ensuring Resilience to Disasters

    29. Enhance catastrophic disaster preparedness
    30. Improve DHS’s ability to lead in emergency management
    31. Explore opportunities with the private sector to “design-in” greater
        resilience for critical infrastructure
    32. Make individual and family preparedness and critical facility
        resilience inherent in community preparedness

Improving Department Management

    33. Seek restoration of the Secretary’s reorganization authority for
        DHS headquarters
    34. Realign component regional configurations into a single DHS
        regional structure
    35. Improve cross-Departmental management, policy, and functional
        integration
    36. Strengthen internal DHS counterintelligence capabilities
    37. Enhance the Department’s risk management capability
    38. Strengthen coordination within DHS through cross-Departmental
        training and career paths
    39. Enhance the DHS workforce
    40. Balance the DHS workforce by ensuring strong federal control of
        all DHS work and reducing reliance on contractors

Increasing Accountability

    41. Increase Analytic Capability and Capacity


Page 16                                                           GAO-12-382T
Appendix I: Bottom-Up Review Initiatives




    42. Improve Performance Measurement and Accountability
    43. Strengthen Acquisition Oversight




Page 17                                                      GAO-12-382T
             Related GAO Products
Related GAO Products


             Coast Guard: Security Risk Model Meets DHS Criteria, but More Training
             Could Enhance Its Use for Managing Programs and Operations.
             GAO-12-14. Washington, D.C.: November 17, 2011.

             Port Security Grant Program: Risk Model, Grant Management, and
             Effectiveness Measures Could Be Strengthened. GAO-12-47.
             Washington, D.C.: November 17, 2011.

             Quadrennial Homeland Security Review: Enhanced Stakeholder
             Consultation and Use of Risk Information Could Strengthen Future
             Reviews. GAO-11-873. Washington, D.C.: September 15, 2011.

             Department of Homeland Security: Progress Made and Work Remaining
             in Implementing Homeland Security Missions 10 Years after 9/11.
             GAO-11-881. Washington, D.C.: September 7, 2011.

             National Preparedness: DHS and HHS Can Further Strengthen
             Coordination for Chemical, Biological, Radiological, and Nuclear Risk
             Assessments. GAO-11-606. Washington, D.C.: June 21, 2011.

             Overstay Enforcement: Additional Mechanisms for Collecting, Assessing,
             and Sharing Data Could Strengthen DHS’s Efforts but Would Have Costs.
             GAO-11-411. Washington, D.C.: April 15, 2011.

             High-Risk Series: An Update. GAO-11-278. Washington, D.C: February
             2011.

             Alien Smuggling: DHS Needs to Better Leverage Investigative Resources
             to Measure Program Performance along the Southwest Border.
             GAO-10-328. Washington, D.C.: May 24, 2010.

             Quadrennial Homeland Security Review: 2010 Reports Addressed Many
             Required Elements, but Budget Planning Not Yet Completed.
             GAO-11-153R. Washington, D.C.: December 16, 2010.

             Aviation Security: DHS and TSA Have Researched, Developed, and
             Begun Deploying Passenger Checkpoint Screening Technologies, but
             Continue to Face Challenges. GAO-10-128. Washington, D.C.: October
             7, 2009.

             Secure Border Initiative: Technology Deployment Delays Persist and the
             Impact of Border Fencing Has Not Been Assessed. GAO-09-1013T.
             Washington, D.C.: September 17, 2009.


             Page 18                                                        GAO-12-382T
           Related GAO Products




           Border Patrol: Checkpoints Contribute to Border Patrol’s Mission, but
           More Consistent Data Collection and Performance Measurement Could
           Improve Effectiveness. GAO-09-824. Washington, D.C.: August 31, 2009.

           Transportation Security: Comprehensive Risk Assessments and Stronger
           Internal Controls Needed to Help Inform TSA Resource Allocation.
           GAO-09-492. Washington, D.C.: March 27, 2009.

           Risk Management: Further Refinements Needed to Assess Risks and
           Prioritize Protective Measures at Ports and Other Critical Infrastructure.
           GAO-06-91. Washington. D.C.: Dec. 15, 2005.




(441045)
           Page 19                                                           GAO-12-382T
This is a work of the U.S. government and is not subject to copyright protection in the
United States. The published product may be reproduced and distributed in its entirety
without further permission from GAO. However, because this work may contain
copyrighted images or other material, permission from the copyright holder may be
necessary if you wish to reproduce this material separately.
GAO’s Mission         The Government Accountability Office, the audit, evaluation, and
                      investigative arm of Congress, exists to support Congress in meeting its
                      constitutional responsibilities and to help improve the performance and
                      accountability of the federal government for the American people. GAO
                      examines the use of public funds; evaluates federal programs and
                      policies; and provides analyses, recommendations, and other assistance
                      to help Congress make informed oversight, policy, and funding decisions.
                      GAO’s commitment to good government is reflected in its core values of
                      accountability, integrity, and reliability.

                      The fastest and easiest way to obtain copies of GAO documents at no
Obtaining Copies of   cost is through GAO’s website (www.gao.gov). Each weekday afternoon,
GAO Reports and       GAO posts on its website newly released reports, testimony, and
                      correspondence. To have GAO e-mail you a list of newly posted products,
Testimony             go to www.gao.gov and select “E-mail Updates.”

Order by Phone        The price of each GAO publication reflects GAO’s actual cost of
                      production and distribution and depends on the number of pages in the
                      publication and whether the publication is printed in color or black and
                      white. Pricing and ordering information is posted on GAO’s website,
                      http://www.gao.gov/ordering.htm.
                      Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
                      TDD (202) 512-2537.
                      Orders may be paid for using American Express, Discover Card,
                      MasterCard, Visa, check, or money order. Call for additional information.
                      Connect with GAO on Facebook, Flickr, Twitter, and YouTube.
Connect with GAO      Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.
                      Visit GAO on the web at www.gao.gov.
                      Contact:
To Report Fraud,
Waste, and Abuse in   Website: www.gao.gov/fraudnet/fraudnet.htm
                      E-mail: fraudnet@gao.gov
Federal Programs      Automated answering system: (800) 424-5454 or (202) 512-7470

                      Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-
Congressional         4400, U.S. Government Accountability Office, 441 G Street NW, Room
Relations             7125, Washington, DC 20548

                      Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800
Public Affairs        U.S. Government Accountability Office, 441 G Street NW, Room 7149
                      Washington, DC 20548




                        Please Print on Recycled Paper.