This is the accessible text file for GAO report number GAO-05-824T entitled 'Strategic Budgeting: Risk Management Principles Can Help DHS Allocate Resources To Highest Priorities' which was released on June 30, 2005. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Testimony: Before the Subcommittee on Management, Integration, and Oversight, Committee on Homeland Security, House of Representatives: United States Government Accountability Office: GAO: For Release on Delivery Expected at 3:00 p.m. EST: Wednesday, June 29, 2005: Strategic Budgeting: Risk Management Principles Can Help DHS Allocate Resources To Highest Priorities: Statement of David M. Walker: Comptroller General of the United States: GAO-05-824T: GAO Highlights: Highlights of GAO-05-824T, a testimony before the Subcommittee on Management, Integration, and Oversight, House Committee on Homeland Security: Why GAO Did This Study: Previous GAO work has outlined the nation’s growing fiscal imbalance and called for a fundamental reexamination of the base of the federal government. The significant resources directed to the Department of Homeland Security (DHS) indicate that a robust homeland security program is viewed as critical to the protection and prosperity of Americans. This testimony addresses the need for a fundamental reexamination of the base of government, the role that performance budgeting tools can play in helping inform agency activities, and DHS’s use of performance budgeting and risk management concepts. It also includes examples from GAO work on homeland security issues that highlight DHS attempts to define an acceptable and achievable level of risk. What GAO Found: The nation faces a long-term fiscal imbalance, and the role of the federal government is being reshaped by many forces, such as evolving defense and homeland security policies and new organizational and institutional arrangements for carrying out public activities. Given these circumstances, there is a critical need for the federal government to reexamine the base of its programs, policies, functions, and activities. A periodic reexamination of major federal spending and tax policies offers the prospect for the American government to eliminate outmoded operations and better align its operations with the demands of a changing world. The management and performance reforms enacted by Congress in the past 15 years have provided new tools to support this kind of reexamination. However, these new tools must be implemented by agencies and used by the Congress in its decision making in order to be effective. Performance budgeting can help policymakers address important questions about whether and how programs contribute to their stated goals. It can help enhance the government’s capacity to assess competing claims for federal dollars by arming decision makers with better information on the results of individual programs, as well as on various federal policies and programs addressing common goals. Performance budgeting, however, cannot provide answers to every resource question—particularly where allocation is a function of competing values and interests that depend on factors other than program performance. Congress and the President have agreed on DHS’s mission, and DHS has established strategic objectives for achieving its mission. However, DHS’s strategic plan does not detail the associated resources necessary to carry out its mission and achieve its strategic goals. DHS has called for using risk-based approaches to prioritize its resource investments regarding critical infrastructure, and for developing plans and allocating resources in a way that balance security and freedom. It must carefully weigh the benefit of homeland security endeavors and allocate resources where the benefit of reducing risk is worth the additional cost. A comprehensive risk management framework—which includes an assessment of risk through threat, vulnerability, and criticality assessments—should be applied to guide these decisions. DHS has not completed a comprehensive national threat and risk assessment. However, some components of DHS have taken initial steps to apply elements of risk management to its operations and decision making. For example, the Coast Guard has taken actions to assess and mitigate vulnerabilities in order to enhance maritime security, and the Transportation Security Administration has conducted vulnerability assessments at selected general aviation airports. Congress and agencies have a shared responsibility for ensuring that performance budgeting and risk management approaches are both useful and used. www.gao.gov/cgi-bin/getrpt?GAO-05-824T. To view the full product, including the scope and methodology, click on the link above. For more information, contact Norman Rabkin at (202) 512-8777 or rabkinn@gao.gov. [End of section] Mr. Chairman and Members of the Subcommittee: I am pleased to be here today to discuss how the Department of Homeland Security (DHS) can use performance budgeting and risk management principles to maximize program performance in an environment of increasing fiscal constraints.[Footnote 1] Today I will touch on the need for a fundamental reexamination of the base of government, given our current, imprudent, and unsustainable fiscal path. Then I will turn to and discuss the important role that performance budgeting and risk management principles can play in setting priorities for the department's homeland security activities. Finally, I will draw upon our work in DHS on homeland security issues to highlight examples of where the department has attempted to define an acceptable and achievable level of risk. The significant resources directed to homeland security and to DHS in particular indicate that a robust homeland security program is viewed as critical to the nation's protection and prosperity. It is clear that before the events of September 11, 2001, it was difficult to anticipate the array of new and challenging demands on federal programs, and to envision the claims on future budgets for homeland security concerns. Given current trends and challenges facing the nation--including the long-term fiscal imbalance--it is critical that the federal government reexamine the base of federal spending and tax programs, at the same time holding all programs accountable for spending wisely and achieving real results. By using performance budgeting tools and the priorities outlined in the National Strategy for Homeland Security, the department will be in a better position to respond to changing circumstances. The Government Performance and Results Act of 1993 (GPRA)[Footnote 2] and various assessment efforts, such as the Administration's Program Assessment Rating Tool (PART), can provide a foundation for a baseline review of existing policies, programs, functions, and activities in the department. In addition, they have the potential to help decision makers assess competing claims by providing better information on the results of individual programs, and on policies and programs designed to address common goals. Just as we know that the threat of terrorism will persist well into the 21st century, we also know it is unrealistic to expect future funding increases for homeland security efforts to occur at the same rate as in the recent past. Given the reality that no amount of money can make us completely safe from a terrorist attack, the National Strategy for Homeland Security provides guidance for considering how to make the best use of available funds to mitigate the most serious risks, while also assuring that the reduction in risk is worth the amount of additional cost. Since we cannot afford to protect everything against all threats, GAO has advocated that DHS make clear the link between the choices made about protection priorities and the allocation of available resources. Proposals to reduce risk must be evaluated on numerous dimensions - their dollar cost and their impact on other goals and values. Decisions on the level of resources, the allocation of those resources, and how to balance security against other societal goals and values also need to be considered. Our recent work at DHS suggests that developing and using a risk-based approach for making resource investment decisions will not be easy. Decision makers may not have complete or current information on threats, vulnerabilities, consequences, alternatives, and costs. Nevertheless, we see benefits in continuing to develop the approach, and are prepared to work with the department and others in the Administration to make it happen. This testimony is based on our wide-ranging work on GPRA, federal budget and performance integration, and 21st century challenges; as well as our work on homeland security and risk management. We conducted our work in accordance with generally accepted government auditing standards. The Long-Term Fiscal Challenge Drives the Fiscal Future and the Need for Reexamination: Known demographic trends, rising health care costs, and lower federal revenues as a percentage of the economy are the major drivers of the nation's large and growing structural deficits. The nation cannot ignore this fiscal large and growing fiscal imbalance--it is not a matter of whether the nation deals with the fiscal gap, but how and when. GAO's long-term budget simulations illustrate the magnitude of this fiscal challenge. Figures 1 and 2 show these simulations under two different sets of assumptions. Figure 1 uses the Congressional Budget Office's (CBO) January 2005 baseline through 2015. As required by law, that baseline assumes no changes in current law, that discretionary spending grows with inflation through 2015, and that all tax cuts currently scheduled to expire actually do expire. In Figure 2, two assumptions about that first 10 years are changed: (1) discretionary spending grows with the economy rather than with inflation, and (2) all tax cuts currently scheduled to expire are made permanent. In both simulations discretionary spending is assumed to grow with the economy after 2015 and revenue is held constant as a share of gross domestic product (GDP) at the 2015 level. Also in both simulations, long-term Social Security and Medicare spending are based on the 2005 trustees' intermediate projections, and we assume that benefits continue to be paid in full after the trust funds are exhausted. Long-term Medicaid spending is based on CBO's December 2003 long-term projections under their midrange assumptions. Figure 1: Composition of Spending as a Share of GDP Under Baseline Extended: [See PDF for image] [End of figure] Figure 2: Composition of Spending as a Share of GDP Assuming Discretionary Spending Grows with GDP After 2005 and All Expiring Tax Provisions are Extended: [See PDF for image] [End of figure] As these simulations illustrate, absent policy changes on the spending and/or revenue side of the budget, the growth in spending on federal retirement and health entitlements will encumber an escalating share of the government's resources. Indeed, when we assume that recent tax reductions are made permanent and discretionary spending keeps pace with the economy, our long-term simulations suggest that by 2040 federal revenues may be adequate to pay little more than interest on the federal debt. Neither slowing the growth in discretionary spending nor allowing the tax provisions to expire--nor both together--would eliminate the imbalance. Although federal tax policies will likely be part of any debate about our fiscal future, making no changes to Social Security, Medicare, Medicaid, and other drivers of the long-term fiscal gap would require at least a doubling of federal taxes in the future-- and that seems both unrealistic and inappropriate. Demographic shifts and rising health care costs are not the only forces at work that require the federal government to rethink its entire approach to program performance, policy design, public priorities, and management practices. Other important forces are working to reshape American society, our place in the world, and the role of the federal government. These include evolving defense and homeland security policies, increasing global interdependence, and advances in science and technology. In addition, the federal government increasingly relies on new networks and partnerships to develop public policy and achieve positive results, often including multiple federal agencies, domestic and international non-or quasi-government organizations, for-profit and not-for-profit contractors, and state and local governments. If government is effectively to address these trends, it cannot treat all of its existing programs, policies, and activities as givens. Outmoded commitments and operations constitute an encumbrance on the future that can and does erode the capacity of the nation to better align its government with the needs and demands of a changing world and society. Accordingly, reexamining the base of all major existing federal spending and tax programs, policies, and activities by reviewing their results and testing their continued relevance and relative priority for our changing society is an important step in the process of assuring fiscal responsibility and facilitating national renewal.[Footnote 3] A periodic reexamination offers the prospect of addressing emerging needs by weeding out programs and policies that are redundant, outdated, or ineffective. Those programs and policies that remain relevant could be updated and modernized by improving their targeting and efficiency through such actions as redesigning allocation and cost- sharing provisions, consolidating facilities and programs, and streamlining and reengineering operations and processes. The tax policies and programs financing the federal budget can also be reviewed with an eye toward both the overall level of revenues that should be raised as well as the mix of taxes that are used. Reexamining the base offers compelling opportunities to both redress our current and projected fiscal imbalance while better positioning government to meet the new challenges and opportunities of the 21st century. In this regard, the management and performance reforms enacted by Congress in the past 15 years have provided new tools to gain insight into the financial, program, and management performance of federal agencies and activities. The information being produced as a result can provide a strong basis to support the much needed and long overdue review, reassessment, and reprioritization process. Performance Budgeting Holds Promise for Reassessment and Priority Setting: With GPRA as their centerpiece, these reforms also laid the foundation for performance budgeting by establishing infrastructures in the agencies to improve the supply of information on planning, performance and costs. GPRA is designed to inform congressional and executive decision making by providing objective performance and cost information on the effectiveness and efficiency of federal programs and spending. A key purpose of GPRA is to create closer and clearer links between the process of allocating scarce resources and the expected results to be achieved with those resources.[Footnote 4] Importantly, GPRA requires both a connection to the structures used in congressional budget presentations and consultation between the executive and legislative branches on agency strategic plans.[Footnote 5] Because these requirements are grounded in statute, Congress has an oversight stake in GPRA's success. Over a decade after its enactment, GPRA has succeeded in expanding the supply of performance information and institutionalizing a culture of performance as well as providing a solid foundation for more recent budget and performance initiatives.[Footnote 6] Building on GPRA, the current administration has made the integration of performance and budget information one of five top governmentwide management priorities. Under the President's Management Agenda (PMA), agencies are expected to implement integrated financial and performance management systems that routinely produce information that is (1) timely--to measure and affect performance, (2) useful--to make more informed operational and investing decisions, and (3) reliable--to ensure consistent and comparable trend analysis over time and to facilitate better performance measurement and decision making. It is critical that budgetary investments in this area be viewed as part of a broader initiative to improve the accountability and management capacity of federal agencies and programs. Over the longer term, failing to discover and correct performance problems will be much more costly. The Program Assessment and Rating Tool (PART) is a questionnaire that is designed to provide a systematic approach to assessing the strengths and weaknesses of a program. PART asks, for example, whether a program's long-term goals are specific, ambitious, and focused on outcomes, and whether annual goals demonstrate progress toward achieving the long-term goals. It is intended to be evidence-based, drawing on a wide array of information, including authorizing legislation, GPRA strategic plans and performance plans and reports, financial statements, inspector general and GAO reports, and independent program evaluations.[Footnote 7] Importantly, PART can be used to identify gaps in information. The fact that a program's PART score suffers from the absence of information provides added impetus for agencies to enhance their evaluation and information-gathering capabilities.[Footnote 8] PART's program-by-program approach fits with OMB's agency-by-agency budget reviews, but it is not well suited to addressing crosscutting issues or to looking at broad program areas in which several programs address a common goal. It is often critical to understand how each program fits with a broader portfolio of tools and strategies--such as regulations, direct loans, and tax expenditures--to accomplish federal missions and performance goals. The credibility of performance information, including related cost data, and the ability of federal agencies to produce credible evaluations of their programs' effectiveness are key to the success of performance budgeting. As I have testified before, this type of information is critical for effective performance measurement to support decisions in areas ranging from program efficiency and effectiveness to sourcing and contract management.[Footnote 9] To be effective, this information must be not only timely and reliable, but also both useful and used. Federal performance and accountability reforms have given much attention to increasing the supply of performance information over the past several decades. However, improving the supply of performance information is in and of itself insufficient to achieve and sustain results-based performance budgeting and management approaches. Rather, it needs to be accompanied by a demand for and use of that information by congressional decision makers and executive managers alike. The history of performance budgeting suggests that congressional support and use of this information is critical to sustain reforms over time. Congress has a number of opportunities to provide its perspective on performance issues and performance goals, such as when it establishes or reauthorizes a new program, during the annual appropriations process, and in its oversight of federal policies and programs. Performance budgeting can do a great deal to help policy makers address important questions, such as whether programs are contributing to their stated goals, are well-coordinated with related initiatives at the federal level or elsewhere, and are targeted to the intended beneficiaries. However, it should not be expected to provide the answers to all resource allocation questions in some automatic or formula-driven process. Performance problems may well prompt budget cuts, program consolidations, or eliminations. Alternatively, as in the case of homeland security, programs that existed before September 11 may now be deemed to be of sufficiently high priority to the nation that they inspire enhanced investments and reforms in program design and management. Conversely, even a program that is found to be exceeding its performance expectations can be a candidate for budgetary cuts if it is a lower priority than other competing claims in the process. The determination of priorities is a function of competing values and interests that may be informed by performance information but also reflects other factors, such as the overall budget situation, the state of the economy, security needs, equity considerations, unmet societal needs, and the appropriate role of the federal government in addressing any such needs. Planning and Risk Management Key to Overall Approach for Allocating Homeland Security Resources: As reflected in the Homeland Security Act of 2002[Footnote 10] (enacted in November 2002) and the National Strategy for Homeland Security (issued in July 2002), both Congress and the President have agreed that DHS should be focused on preventing terrorist attacks, reducing the country's vulnerability to terrorism, and minimizing the damage and recovering from any attacks that may occur. The President's national strategy also notes that the United States "must carefully weigh the benefit of each homeland security endeavor and only allocate resources where the benefit of reducing risk is worth the amount of additional cost." It recognizes that the need for homeland security is not tied solely to the current terrorist threat but to enduring vulnerability from a range of potential threats that could include weapons of mass destruction and bioterrorism. Using the national strategy and the act as foundations, the department issued its first departmentwide strategic plan in February 2004. The strategic plan sets out the following strategic objectives for achieving DHS's mission: * Awareness--Identify and understand threats, assess vulnerabilities, determine potential impacts, and disseminate timely information to our homeland security partners and the American public. * Prevention--Detect, deter, and mitigate threats to our homeland. * Protection--Safeguard our people and their freedoms, and critical infrastructure, property and the economy of our nation from acts of terrorism, natural disasters, or other emergencies. * Response--Lead, manage, and coordinate the national response to acts of terrorism, natural disasters, or other emergencies. * Recovery--Lead national, state, local, and private sector efforts to restore services and rebuild communities after acts of terrorism, natural disasters, or other emergencies. * Service--Serve the public effectively by facilitating lawful trade, travel and immigration. * Organizational excellence--Value our most important resource, our people. Create a culture that promotes a common identity, innovation, mutual respect, accountability and teamwork to achieve efficiencies, effectiveness, and operational synergies. In a report earlier this year to the House Government Reform Subcommittee on National Security, Emerging Threats and International Relations, we pointed out that while DHS has made considerable progress in its planning efforts, its strategic plan did not address the relationship between annual and long-term goals.[Footnote 11] This linkage is critical for determining whether DHS has a clear sense of how it will assess progress toward achieving the intended results for its long-term goals. In addition, the plan does not include specific budgetary, human capital, or other resources needed to achieve the long- term goals. Although the strategic plan did not detail the resources DHS believes it needs to carry out its mission and achieve its strategic goals, DHS has presented some of this information as part of its annual budget materials. Congress has required OMB to present a crosscutting perspective on homeland security spending as part of the President's Budget. The discussion of homeland security spending by strategic goal across all federal agencies is an example of the impact that congressional oversight can have on budget presentations and analysis. As we have previously noted, the structure of appropriations accounts and congressional justifications also reflects choices about how resource allocation choices are framed and the types of controls and incentives considered most important. Given Congress's role in setting national priorities and allocating resources to achieve them, Congressional comfort with the structure of and analyses in budget justifications is critical. The department should work with its congressional committees to assure that the information it provides is useful to Congress in achieving its legislative, oversight, appropriations, and control objectives. Risk Management: The national strategy and DHS's strategic plan called for the use of risk-based decisions to prioritize DHS's resource investments regarding homeland security related programs. In addition, Homeland Security Presidential Directive/HSPD-7, issued in December 2003, charged DHS with integrating the use of risk management into homeland security activities related to the protection of critical infrastructure. The directive called on the department to develop policies, guidelines, criteria, and metrics for this effort. The new DHS Secretary testified on June 9, 2005, to the need for managing risk at the homeland security level by developing plans and allocating resources in a way that balance security and freedom. He noted the importance of assessing the full spectrum of threats and vulnerabilities, conducting risk management, and setting realistic priorities in guiding decisions about how to best organize to prevent, respond to, and recover from an attack. Armed with better planning and performance information, the department needs to develop a more formal and disciplined approach to risk management. Answering questions such as "What is an acceptable level of risk to guide homeland security strategies and investments?" and "What criteria should be used to target federal funding for homeland security to maximize results and mitigate risk within available resource levels?" will not be easy. Yet these kinds of questions may also provide a window of opportunity to rethink approaches to long-standing problems and concerns. A risk management framework for making homeland security and counterterrorism investment decisions consists of a number of components. Assessing risk is a critical component of a risk management approach, and it should be reflective of current and future likely threats, which should be informed but not driven by past actions. Assessing risk involves three key elements--threats, vulnerabilities, and criticality (or consequences)--that provide input into the decision- making process. A threat assessment identifies and evaluates potential threats on the basis of factors such as capabilities, intentions, and past activities. Threats might be present at the global, national, or local level, and their sources include terrorists and criminal enterprises. Threat information emanates from "open" sources and intelligence (both strategic and tactical). However, we will never know if we have identified every threat or event and may not have complete information about the threats we have identified. Consequently, two other elements of the approach, vulnerability and criticality assessments, are essential to better prepare against threats. A vulnerability assessment identifies weaknesses that may be exploited by identified threats and suggests options to address those weaknesses. A criticality assessment evaluates and prioritizes assets and functions in terms of specific criteria, such as their importance to public safety and the economy, as a basis for identifying which structures or processes are relatively more important to protect from attack. Information from these three assessments can lead to a risk characterization, such as high, medium, or low, and provides input for prioritizing security initiatives.[Footnote 12] For example, an airport that is determined to be a critical asset, vulnerable to attack, and a likely target would be at high risk and, therefore, would be a higher priority for funding than an airport that is less vulnerable to an attack. In this vein, aviation security measures shown to reduce the risk to the most critical assets would provide the greatest protection for the cost. Figure 3 depicts a risk management cycle representing a series of analytical and managerial steps, basically sequential, that can be used to assess risk, assess alternatives for reducing risks, choose among those alternatives, implement the alternatives, monitor their implementation, and continually use new information to adjust and revise the assessments and actions, as needed. Adoption of a risk management framework such as this can aid in assessing risk by determining which vulnerabilities should be addressed in what ways within available resources.[Footnote 13] Figure 3: Risk Management Framework: [See PDF for image] [End of figure] In addition to being dynamic, the approach may be applied at various organizational levels, from multiagency or sectoral down to individual investments or projects. Some adaptation of the framework may be expected--for instance, risk management choices available to site managers may entail departmental or statutory constraints. In our latest high-risk series, released in January 2005, we noted that an area of increasing concern involves the need for the completion of comprehensive national threat and risk assessments in a variety of areas, including homeland security.[Footnote 14] As GAO reported in its review of DHS's first strategic plan, stakeholder involvement was limited. Stakeholder involvement in the planning process is important to ensure that DHS's efforts and resources are aligned with other federal and nonfederal partners with shared responsibilities for homeland security and that they are targeted at the highest priorities. At the same time, this threat/risk assessment concept can be applied to a broad range of existing federal government programs, functions, and activities. A viable risk management approach would also affect outcomes beyond the federal sector. The choice and design of policy tools, such as grants, regulations, and tax incentives, can enhance the capacity of all levels of government to target areas of highest risk and greatest need, promote shared responsibilities by all parties, and track and assess progress toward achieving national preparedness goals. For example, in order to promote a stronger federal, state, local, and regional partnership to improve homeland security, Congress needs to determine how to concentrate federal grant funds in the places with the highest risks. Given the significant needs and limited federal resources, it will be important to target areas of greatest need. Congressional proposals to alter the formula for allocating homeland security funds to states reflect attention to this issue. We have noted that the formula for federal grant distribution should be based on several considerations, including relative threats and vulnerabilities faced by states and communities as well as the state or local government's capacity to respond to a disaster.[Footnote 15] Some Elements of Risk Management Being Used at DHS: Several DHS component agencies have taken some initial steps toward risk management. For example, agencies such as the Coast Guard and Customs and Border Protection (CBP) have taken actions to try to mitigate vulnerabilities and enhance maritime security. Security plans for seaports, facilities, and vessels have been developed based on assessments that identify their vulnerabilities. In addition, the Coast Guard is using a Port Security Risk Assessment Tool, which is designed to prioritize risk according to a combination of possible threat, consequence, and vulnerability. Under this approach, seaport infrastructure that is determined to be both a critical asset and a likely and vulnerable target would be a high priority for security enhancements or funding. By comparison, infrastructure that is vulnerable to attack but not as critical or infrastructure that is very critical but already well protected would be lower in priority. We are currently conducting a detailed review of the use of risk management for maritime security. In the transportation area, the Transportation Security Administration (TSA) has conducted limited vulnerability assessments at selected general aviation airports based on specific security concerns or requests by airport officials. Agency officials told us that conducting assessments was costly and, therefore, impractical to do for the 19,000 general aviation airports nationwide, or even the approximately 4,800 public-use general aviation airports. TSA intended to implement a risk management approach to better assess threats and vulnerabilities of general aviation aircraft and airports and, as part of this approach, was developing an online vulnerability self-assessment tool to be completed by individual airport managers. However, we noted limitations to the use of the self-assessment tool, and TSA had not developed a plan with specific milestones to implement the assessment, thereby making it difficult to monitor the progress of its efforts. Also, TSA had not conducted an overall systematic assessment of threats to, or vulnerabilities of, general aviation to determine how to better prepare against terrorist threats. Immigration and Customs Enforcement's Office of Investigations (OI) has taken some initial steps to base future budget requests on threat assessments. To develop its budget request and workforce plans for fiscal year 2007 and beyond, OI field offices conducted baseline threat assessments on a regional basis using scenarios such as the presence of a business that transports biological materials and may employ terrorists. Related performance measures have been developed, but are not yet in use. CBP had taken some steps to address the risks posed by terrorist smuggling of weapons in oceangoing cargo containers. Although CBP's strategy incorporated some elements of risk management, we reported that CBP had not performed a comprehensive set of threat, criticality, vulnerability, and risk assessments that experts said are vital for determining levels of risk for each container.[Footnote 16] With respect to the allocation of homeland security funds to states, approximately 40 percent of the $5.1 billion in statewide grant funds awarded in fiscal years 2002 through 2005 were shared equally among the 50 states, the District of Columbia, the Commonwealth of Puerto Rico, and U.S. territories. The remaining amount was distributed according to state population. Therefore, this formula for allocating money is not risk-based. Several congressional proposals have been advanced to alter the statewide funding formula to base it more directly on risk considerations. This seems to be both appropriate and necessary given current and projected deficits. One proposal would largely maintain the portion of funds shared equally by the states but would base the distribution of the remaining funds on a risk-based formula similar to the one currently used for urban area grants. Another proposal (from this committee) would reduce the minimum amount of funding shared equally by states to approximately 14 percent of total funding and establish a board to allocate the remaining funds through an evaluation of threat, vulnerability, and the potential consequences of a terrorist attack. Concluding observations: As the nation faces a long-term fiscal imbalance, and the role of the federal government is being reshaped, there is a critical need for the federal government to reexamine the base of its programs, policies, functions, and activities. Performance budgeting can help enhance the government's capacity to assess competing claims for federal dollars by providing decision makers with better information on the results of individual programs, as well as on various federal policies and programs addressing common goals. In this context, the importance of DHS' mission cannot be overstated. While absolute security for the U.S. homeland is impossible, seeking to minimize vulnerability must remain a goal. Much is at stake when decisions are made about how to allocate limited resources across a large number of programs in multiple DHS agencies. GAO has consistently advocated implementation of a risk management approach for prioritizing efforts and focusing resources. This kind of approach is especially important since we seek to address threats that are seemingly limitless with resources that are limited. It is necessary to prioritize both risks and the actions taken to reduce risks. Where can resources do the most good? How should they be allocated across risks and across risk- reducing activities? Risk-based, priority-driven decisions can help inform decision makers in allocating finite resources to the areas of greatest need. Congress and agencies have a shared responsibility for ensuring that performance budgeting and risk management approaches are both useful and used. Congress can play an important role by using the resulting information in the authorization, appropriations, and oversight process. Further, to the extent that Congress wants to instill a risk-based approach, it is important to recognize that agencies need to have some flexibility in implementing it. As the Congress and DHS move to rebalance resource priorities to address the relative risks facing the nation, it is important to reexamine major existing programs and activities based on their relative contribution to reducing the areas of greatest vulnerability. This will require making tough choices to identify those activities with the greatest potential net benefit for the nation as a whole, while reassessing the need for other programs with more limited or less nationwide scale and importance. Going forward, we need to rethink certain traditional funding strategies, such as per capita based formulas and earmarks to determine whether they are consistent with a risk based approach. We should not expect this effort to be easy or the path forward to be smooth. Risk assessment is difficult in many government areas. It is especially so in the area of homeland security in which initial probabilities and consequences and the effectiveness of countermeasures are unusually difficult to determine. Getting relevant, reliable, and timely information for risk assessment is also quite difficult. Nevertheless, the effort should be made. A comprehensive approach should be developed and maintained. The state of the art for risk management will take time to mature. This will require sustained management commitment--and continued involvement, support, and oversight by Congress. Going forward, we need to rethink certain traditional funding strategies, such as per capita based formulas and earmarks to determine whether they are consistent with a risk based approach. This completes my prepared statement. I would be pleased to respond to any questions you or other members of the subcommittee may have. For future information on this testimony, please contact Norman J. Rabkin at 202-512-8777. Other key contributors included Denise Fantone, Kimberly Gianopoulos, Susan Irving, Jacqueline Nowicki, Evi Rezmovic, and Jonathan Tumin. FOOTNOTES [1] In this testimony, the term performance budgeting refers to any linkage between budgeting and expected or actual evidence-based performance and results-based information. [2] Pub. L. No. 103-62, 107 Stat. 285 (1993). [3] For more information on reexamination of federal programs, see GAO, 21st Century Challenges: Reexamining the Base of the Federal Government, GAO-05-325SP (Washington, D.C.: February 2005). [4] See Pub. L. No. 103-62, Sec. 2, 107 Stat. at 285 (1993). [5] 5 U.S.C. Sec. 306 and 31 U.S.C. Secs. 1115-1116. [6] GAO, Results-Oriented Government: GPRA Has Established a Solid Foundation for Achieving Greater Results, GAO-04-38 (Washington, D.C.: March 10, 2004). [7] The Office of Management and Budget (OMB) has used PART to assess the performance of 32 programs in DHS reported in the President's budgets for fiscal years 2004-2006. The assessment consisted of programs operated by the Coast Guard, Transportation and Security Administration, Immigration and Customs Enforcement, Customs and Border Protection, Office for Domestic Preparedness, Science and Technology, and the Federal Emergency Management Agency, among others. On the basis of answers to 25 questions relating to a program's purpose, planning, management, results and accountability, OMB concluded performance was effective for 4 programs, moderately effective for 6 programs, and adequate for 6 programs. OMB found that results were not demonstrated for the remaining 16 programs. [8] For a detailed examination of PART, see GAO, Performance Budgeting: Observations on the Use of OMB's Program Assessment Rating Tool for the Fiscal Year 2004 Budget, GAO-04-174 (Washington, D.C.: January 30, 2004). [9] GAO, Management Reform: Assessing the President's Management Agenda, GAO-05-574T (Washington, D.C.: April 21, 2005). [10] Pub. L. No. 107-296, 116 Stat. 2135 (2002). [11] GAO, Results-Oriented Government: Improvements to DHS' Planning Process Would Enhance Usefulness and Accountability, GAO-05-300 (Washington, D.C.: March 31, 2005). [12] GAO, Transportation Security: Systematic Planning Needed to Optimize Resources, GAO-05-357T (Washington, D.C.: February 15, 2005). [13] GAO, Protection of Chemical and Water Infrastructure: Federal Requirements, Actions of Sected Facilities, and Remaining Challenges, GAO-05-327 (Washington, D.C.: March 28, 2005). [14] GAO, High-Risk Series: An Update, GAO-05-207 (Washington, D.C.: January 2005). [15] GAO, Homeland Security: Reforming Federal Grants to Better Meet Outstanding Needs, GAO-03-1146T (Washington, D.C.: September 3, 2003). [16] GAO, Homeland Security: Summary of Challenges Faced in Targeting Ocean Going Cargo Containers for Inspection, GAO-04-557T (Washington, D.C.: March 31, 2004).