Strengthening Department of Homeland Security Management Functions
In 2003, GAO designated implementing and transforming the Department of Homeland Security (DHS) as high risk because DHS had to transform 22 agencies—several with major management challenges—into one department. Further, failure to effectively address DHS’s management and mission risks could have serious consequences for U.S. national and economic security. Given the significant effort required to build and integrate a department as large and complex as DHS, GAO’s initial high-risk designation addressed the department’s initial transformation and subsequent implementation efforts, to include associated management and programmatic challenges. At that time, GAO reported that the creation of DHS was an enormous undertaking that would take time to achieve, and that the successful transformation of large organizations, even those undertaking less strenuous reorganizations, could take years to implement.
Over the past 10 years, the focus of this high-risk area has evolved in tandem with DHS’s maturation and evolution. The overriding tenet has consistently remained the department’s ability to build a single, cohesive and effective department that is greater than the sum of its parts—a goal that requires effective collaboration and integration of its various components and management functions. In 2007, in reporting on DHS’s progress since its creation, as well as in GAO’s 2009 high risk update, GAO reported that DHS had made more progress in implementing its range of missions rather than its management functions, and that continued work was needed to address an array of programmatic and management challenges. DHS’s initial focus on mission implementation was understandable given the critical homeland security needs facing the nation after the department’s establishment, and the challenges posed by its creation, integration and transformation.
As DHS continued to mature, and as GAO reported in its assessment of DHS’s progress and challenges 10 years after 9/11, GAO found that the department implemented key homeland security operations and achieved important goals in many areas to create and strengthen a foundation to reach its potential.[1] For example, DHS developed strategic and operational plans to guide its efforts, such as the National Response Framework that outlines disaster response guiding principles; successfully hired, trained, and deployed workforces, including the federal screening workforce to assume screening responsibilities at airports nationwide; and established new, or expanded existing, offices and programs to implement its homeland security responsibilities, such as the National Cybersecurity and Communications Integration Center to help coordinate efforts to address cybersecurity threats. However, GAO also identified that more work remained for DHS to address weaknesses in its operational and implementation efforts, and to strengthen the efficiency and effectiveness of those efforts. GAO further reported that continuing weaknesses in DHS’s management functions had been a key theme impacting the department’s implementation efforts. Recognizing DHS’s progress in transformation and mission implementation, GAO’s 2011 high risk update focused on the continued need to strengthen DHS’s management functions and integrate those functions within and across the department, as well as the impact of these challenges on the department’s ability to effectively and efficiently carry out its missions.
While challenges remain for DHS to address across its range of missions, the department has made considerable progress in transforming its original component agencies into a single cabinet-level department and positioning itself to achieve its full potential. Important strides have also been made in strengthening the department’s management functions and in integrating those functions across the department, particularly in recent years. However, continued progress is needed in order to mitigate the risks that management weaknesses pose to mission accomplishment and the efficient and effective use of the department’s resources. In particular, the department needs to demonstrate continued progress in implementing and strengthening key management initiatives and addressing corrective actions and outcomes. Therefore, GAO is narrowing the scope of the high-risk area and changing the name from Implementing and Transforming DHS to Strengthening DHS Management Functions to reflect this focus.
[1] GAO, Department of Homeland Security: Progress Made and Work Remaining in Implementing Homeland Security Missions 10 Years after 9/11, GAO-11-881 (Washington, D.C.: Sept. 7, 2011). This report addressed DHS’s progress in implementing its homeland security missions since it began operations, work remaining, and issues affecting implementation efforts. Drawing from over 1,000 GAO reports and congressional testimony issued related to DHS programs and operations, and approximately 1,500 recommendations made to strengthen mission and management implementation, this report addressed progress and remaining challenges in such areas as border security and immigration, transportation security, and emergency management, among others.
As outlined in the following paragraphs, DHS has made important progress in implementing, transforming, strengthening, and integrating its management functions, including taking numerous actions specifically designed to address GAO’s criteria for removing areas from the High Risk List; however, this area remains high risk because the department has significant work ahead.
Leadership commitment: The Secretary, Deputy Secretary, and Under Secretary for Management of Homeland Security and other senior officials have continued to demonstrate commitment and top leadership support for addressing the department’s management challenges. They have also taken actions to institutionalize this commitment to help ensure the long-term success of the department’s efforts. For example, in May 2012, the Secretary of Homeland Security modified the delegations of authority between the Management Directorate and its counterparts at the component level to clarify and strengthen the authorities of the Under Secretary for Management across the department. Senior DHS officials have also periodically met with GAO over the past 4 years to discuss the department’s plans and progress in addressing this high-risk area, during which GAO provided feedback on the department’s efforts. According to these officials, and as demonstrated through their progress, the department is committed to demonstrating measurable, sustained progress in addressing this high-risk area.
Corrective action plan: DHS has established a plan for addressing this high-risk area. Specifically, in a September 2010 letter to DHS, GAO identified and DHS agreed to achieve 31 actions and outcomes that are critical to addressing the challenges within the department’s management areas and in integrating those functions across the department. These key actions and outcomes include, among others, validating required acquisition documents in accordance with a department-approved, knowledge-based acquisition process, and obtaining and then sustaining unqualified audit opinions for at least 2 consecutive years on the department-wide financial statements. In January 2011, DHS issued its initial Integrated Strategy for High Risk Management, which included key management initiatives and related corrective action plans for addressing its management challenges and the outcomes GAO identified. DHS provided updates of its progress in implementing these initiatives and corrective actions in its later versions of the strategy—June 2011, December 2011, June 2012, and September 2012. The comprehensive strategy, if implemented and sustained, provides a path for DHS to be removed from GAO’s High Risk List.
Framework to monitor progress: DHS has established a framework for monitoring its progress in implementing its corrective actions and addressing the 31 actions and outcomes. In the June 2012 update to the Integrated Strategy for High Risk Management, DHS included, for the first time, performance measures to track its progress in implementing all of its key management initiatives. Additionally, the Under Secretary for Management holds quarterly internal progress review meetings with senior officials from each management function to discuss progress toward achieving milestones and meeting performance goals. It will be important for DHS to continue to track progress toward achieving its goals and monitor and refine its measures and corrective actions, as needed.
Capacity: In June 2012, DHS identified the resources needed to implement most (154 of 173) of its corrective actions, but needs to continue to identify resources for the remaining corrective actions; determine that sufficient resources and staff are committed to initiatives; work to mitigate shortfalls and prioritize initiatives, as needed; and communicate to senior leadership critical resource gaps. DHS also identified ways in which it is leveraging resources to implement corrective actions, which is particularly important in light of constrained budgets. For example, in October 2012, DHS reported that it is pooling resources and working across functional lines to create cross functional, matrixed teams and executive steering committees to ensure timely implementation of the strategy. However, it is too soon to determine whether this approach is a sustainable way for DHS to address the resource challenges and capacity gaps that have affected its implementation efforts at the department and component levels.
Demonstrated, sustained progress: DHS has made important progress in implementing corrective actions across its management functions, but it has not yet demonstrated sustainable, measurable progress in addressing key challenges that continue to remain within these functions and in the integration of those functions. DHS has implemented a number of actions demonstrating the department’s progress in improving its management functions. For example, DHS established the Office of Program Accountability and Risk Management in October 2011 to be responsible for the department’s overall acquisition governance process. DHS also established a formal IT Program Management Development Track and staffed Centers of Excellence with subject matter experts to assist major and nonmajor programs. In September 2012, GAO reported that as of March 2012, approximately two-thirds of the department’s major IT investments GAO reviewed (47 of 68) were meeting current cost and schedule commitments (i.e., goals). Additionally, in the financial management area, DHS has reduced the number of material weaknesses in internal controls and obtained a qualified audit opinion on its fiscal year 2012 financial statements. DHS has also implemented common policies, procedures, and systems, such as those related to human capital, across its management functions.
However, DHS continues to face significant management challenges that hinder the department’s ability to meet its missions. Specifically, challenges within acquisition, information technology, financial, and human capital management have resulted in performance problems and mission delays. For example, because of acquisition management challenges, some currently deployed technologies were not appropriately tested and evaluated or do not meet intended requirements, such as Advanced Imaging Technology and explosives detection systems. Additionally, DHS does not have modernized financial management systems, affecting its ability to have ready access to reliable information for informed decision making. Further, human capital management challenges at DHS’s Federal Protective Service, such as the lack of assurance that its contract guards received the training and certifications required to stand post at federal facilities, hampered the agency’s ability to protect federal facilities. Moving forward, addressing such management challenges will be critical for DHS’s success.
Key to addressing the department’s management challenges and this high-risk area is DHS demonstrating continued progress implementing its high-risk plan and the ability to achieve sustained progress across the 31 actions and outcomes GAO identified. DHS has made important progress across all of its management functions and significant progress in the area of management integration. However, DHS still has considerable work ahead in many areas. Specifically, GAO believes DHS has fully addressed 6, mostly addressed 2, partially addressed 16, and initiated 7 of the 31 key actions and outcomes (see table 5).
Table 5: GAO’s Assessment of DHS’s Progress in Addressing Key Actions and Outcomes
Key Outcomes | Fully addresseda | Mostly addressedb | Partially addressedc | Initiatedd | Total |
|---|---|---|---|---|---|
Acquisition management |
|
| 2 | 3 | 5 |
IT management | 1 | 1 | 4 |
| 6 |
Financial management | 2 |
| 3 | 4 | 9 |
Human capital management |
| 1 | 6 |
| 7 |
Management integration | 3 |
| 1 |
| 4 |
Total | 6 | 2 | 16 | 7 | 31 |
Source: GAO analysis of DHS documents, interviews, and prior GAO reports.
a”Fully addressed”: outcome is fully addressed.
b”Mostly addressed”: progress is significant and a small amount of work remains.
c”Partially addressed”: progress is measurable, but significant work remains.
d”Initiated”: activities have been initiated to address outcome, but it is too early to report progress.
Acquisition Management
DHS has partially addressed two of the five outcomes GAO identified in the acquisition management area and initiated actions to address the remaining three. For example, in March 2012, DHS created a Procurement Staffing Model to determine optimal numbers of personnel to properly award and administer contracts. Additionally, as of August 2012, DHS had chartered eight Centers of Excellence to enhance component acquisition capabilities and improve insight into program management challenges before they become major problems, and has also taken some steps to improve investment management. Each DHS component also established a Component Acquisition Executive to provide oversight and support to programs within the component’s portfolio. Additionally, in October 2011, DHS began to operate a business intelligence system, known as the Decision Support Tool, which integrates information from multiple source databases. This tool is intended to improve the flow of information from component program offices to the Management Directorate to support its governance efforts. However, according to DHS, senior executives are not confident enough in the reliability of the database to use it to help make acquisition decisions.
Further, in September 2012, GAO reported that DHS’s acquisition policy reflects many key management practices that could help mitigate risks and increase chances for successful outcomes. However, most of DHS’s major acquisition programs continue to cost more than expected, take longer to deploy than planned, or deliver less capability than promised. GAO identified 42 programs that experienced cost growth, schedule slips, or both, with 16 of the programs’ costs increasing from a total of $19.7 billion in 2008 to $52.2 billion in 2011—an aggregate increase of 166 percent. GAO found that these outcomes are largely the result of DHS’s lack of adherence to key knowledge-based program management practices, even though many are reflected in the department’s own acquisition policy.
Finally, while DHS has initiated efforts to validate required acquisition documents in a timely manner at major milestones, GAO reported in September 2012 that DHS leadership has authorized and continued to invest in major acquisition programs even though the vast majority of those programs lack foundational documents demonstrating the knowledge needed to help manage risks and measure performance. GAO recommended that DHS modify acquisition policy to better reflect key program and portfolio management practices and ensure acquisition programs fully comply with DHS acquisition policy. DHS concurred with GAO’s recommendations and reported taking actions to address some of them.
IT Management
DHS has fully addressed one, mostly addressed one, and partially addressed the remaining four of the six IT management outcomes GAO identified. DHS has taken steps to strengthen its enterprise architecture program (or blueprint) to guide IT acquisitions. Specifically, a recent independent assessment of the department’s enterprise architecture program showed that DHS has achieved stage four of GAO’s Enterprise Architecture Framework (that is, completing and using an enterprise architecture for targeted results)—fully addressing this outcome. DHS has also continued to improve and strengthen its information security program by developing and implementing the Fiscal Year 2012 Information Security Performance Plan, which, among other areas, identified plans of action and milestones weakness remediation. It will be important for the department to fully implement its plan and ensure that progress can be sustained over time. DHS’s financial statement auditor reported in November 2012 that weaknesses in the security controls over the department’s financial systems were a material weakness for financial reporting purposes.
DHS has also defined and begun to implement a vision for a tiered governance structure intended to improve IT program and portfolio management, which is generally consistent with best practices. However, the governance structure covers less than 20 percent (about 16 of 80) of DHS’s major IT investments and 3 of its 13 portfolios, and the department has not yet finalized the policies and procedures associated with this structure. In July 2012, GAO recommended that DHS finalize the policies and procedures and continue to implement the structure. DHS agreed with these recommendations and estimated it would address them by September 2013. It will be important for DHS to continue to strengthen its investment management and systems acquisition practices for progress to be sustained. Further, DHS developed an IT human capital plan and implementation roadmap in response to a 2007 GAO recommendation, and has begun to demonstrate progress in implementing this plan.
Financial Management
DHS has fully addressed two, partially addressed three, and initiated four of the nine financial management outcomes GAO identified. Specifically, DHS has maintained top management commitment to addressing weaknesses in this management area, implemented a corrective action plan process, and demonstrated measurable progress in correcting reported audit qualifications and internal control deficiencies—fully addressing two outcomes. Additionally, DHS reduced the number of material weaknesses in internal controls from 10 in 2005 to 5 in 2012, and obtained a qualified audit opinion on its fiscal year 2012 financial statements. In fiscal year 2011, the department established a goal of obtaining an unqualified audit opinion on all of its financial statements for fiscal year 2013. DHS has efforts underway to resolve certain elements of Coast Guard’s general property, plant, and equipment and heritage and stewardship assets, which were the main obstacles to DHS obtaining an unqualified or “clean” audit opinion for fiscal year 2012. However, it has been unable to obtain an audit opinion on its internal controls over financial reporting because of the remaining material weaknesses in internal controls.
Further, although DHS has initiated actions to achieve the outcomes related to financial systems modernization, much work remains to be done. DHS components are currently in the early planning stages of their financial systems modernization efforts, and until these efforts are complete, their current systems will continue to inadequately support effective financial management, in part because of their lack of substantial compliance with key federal financial management requirements. Without sound controls and systems, DHS faces long-term challenges in obtaining and sustaining an audit opinion on internal controls over financial reporting, and ensuring its financial management systems generate reliable, useful, and timely information for day-to-day decision making.
Human Capital Management
DHS has mostly addressed one of the seven human capital management outcomes and partially addressed the remaining six. For example, DHS has developed and demonstrated progress in implementing a strategic human capital plan, mostly addressing this outcome. Specifically, DHS issued a workforce strategy and a revised workforce planning guide to help the department plan for its workforce needs, and its components are in various stages of implementing these workforce planning efforts. However, in December 2012, GAO identified several factors that have hampered DHS’s strategic workforce planning efforts and recommended that DHS, among other things, identify and document additional performance measures to assess workforce planning efforts, integrate audit results with components’ operational plans, and provide timely feedback on those plans. DHS agreed with these recommendations and stated that it plans to take actions to address them.
Additionally, DHS has taken steps to seek employees’ input to strengthen human capital approaches and activities. For example, DHS established an Employee Engagement Executive Steering Committee in January 2012 to identify actions for improving employee engagement, but these actions are not yet under way. Moreover, DHS has made efforts to improve employee morale, such as determining the root causes of morale problems. Despite these efforts, federal surveys have consistently found that DHS employees are less satisfied with their jobs than the government-wide average. In September 2012, GAO recommended, among other things, that DHS improve its root cause analysis efforts of morale issues. DHS agreed with these recommendations and noted actions it plans to take to address them.
Management Integration
DHS has made substantial progress integrating its management functions, fully addressing three of the four outcomes GAO identified as key to the department’s management integration efforts. Specifically, as mentioned above, DHS issued a comprehensive plan to guide its management integration efforts—theIntegrated Strategy for High Risk Management—in January 2011, and has generally improved upon this plan with each update. In addition, the department has implemented mechanisms to promote accountability for management integration among department and component management chiefs, such as requiring department management chiefs to provide input into component chiefs’ annual performance evaluations. Further, DHS has put into place common policies, procedures, and systems within individual management functions, such as human capital, that help to integrate its component agencies. Additionally, according to DHS, the modified delegations of authority between the Management Directorate and its counterparts at the component level should provide increased standardization of operating guidelines, policies, structures, and oversight of programs; and clarify the roles between the department and components.
To achieve the last and most significant outcome—implement actions and outcomes in each management area to develop consistent or consolidated processes and systems within and across its management functional areas—DHS needs to continue to demonstrate sustainable progress integrating its management functions within and across the department and its components and take additional actions to further and more effectively integrate the department. For example, DHS recognizes the need to better integrate its lines of business and is establishing an initiative to manage investments across the department’s components and management functions. In September 2012, DHS reported that it has developed draft policy and procedural guidance to support implementation of the initiative and now plans to begin using aspects of this new approach to develop portions of the department’s fiscal years 2015 through 2019 budget. However, the effectiveness of this key integration effort is dependent upon DHS following through with its plans, and it is therefore too early to assess its impact.
In recognition of the evolution of this high-risk area, GAO is narrowing its scope and changing the name from Implementing and Transforming the Department of Homeland Security to Strengthening Department of Homeland Security Management Functions to reflect a focus on the department’s remaining management challenges.
Going forward, DHS needs to continue implementing its Integrated Strategy for High Risk Management and show measurable, sustainable progress in implementing its key management initiatives and corrective actions and achieving outcomes. In doing so, it will be important for DHS to
- make continued progress in addressing the 31 actions and outcomes and demonstrate that systems, personnel, and policies are in place to ensure that progress can be sustained over time;
- maintain its current level of top leadership support and sustained commitment to ensure continued progress in executing its corrective actions through completion;
- continue to implement its plan for addressing this high-risk area and periodically report its progress to Congress and GAO;
- closely track and independently validate the effectiveness and sustainability of its corrective actions and make midcourse adjustments, as needed; and
- monitor the effectiveness of its efforts to establish reliable resource estimates at the department and component levels, address and work to mitigate any resource gaps, and prioritize initiatives as needed to ensure it has the capacity to implement and sustain its corrective actions.
GAO will continue to monitor DHS’s efforts in this high-risk area to determine if the actions and outcomes are achieved and sustained.
DHS Strategic Workforce Planning
Department of Homeland Security
GAO-12-940, Sep 28, 2012
Information Technology
Department of Homeland Security
GAO-12-1041T, Sep 20, 2012
Homeland Security
GAO-12-833, Sep 18, 2012
Information Technology
Federal Emergency Management Agency
GAO-12-487, Apr 26, 2012
DHS Human Capital
GAO-12-264, Feb 10, 2012
Department of Homeland Security
GAO-11-881, Sep 7, 2011
Financial Management Systems
GAO-10-76, Dec 4, 2009
-
- David C. Maurer
- Director, Homeland Security and Justice
- maurerd@gao.gov
- (202) 512-9627