Department of Homeland Security: Continued Progress Made Improving and Integrating Management Areas, but More Work Remains

What GAO Found

The Department of Homeland Security (DHS) has updated and strengthened its strategy for how it plans to address GAO’s high-risk designation and resolve the department’s management challenges. In January 2011, DHS provided GAO with its Integrated Strategy for High Risk Management, which summarized the department’s preliminary plans for addressing the high-risk area. GAO found that this strategy, which was later updated in June and December 2011, was generally responsive to the actions and outcomes needed to address GAO’s high-risk designation. For example, the January 2011 strategy generally identified multiple, specific actions and target completion time frames consistent with the outcomes GAO identified. However, the strategy did not address the root causes of problems, among other things. In its June 2011 strategy, DHS, among other things, identified 10 root causes that cut across the management areas and their integration. GAO identified ways the strategy could be strengthened, including consistently reporting the progress of its initiatives and corrective actions. In its most recent update, DHS better positioned itself to address its management challenges. For example, for the first time, DHS included ratings of the department’s progress addressing its high-risk outcomes. However, GAO believes that DHS could more consistently report on available resources and corrective actions, establish measures and report on progress made for all initiatives, and stabilize its methodology for measuring progress. These changes, if implemented and sustained, provide a path for DHS to address GAO’s high-risk designation.

DHS has made progress, but has considerable work ahead to achieve actions and outcomes critical to addressing this high-risk area. Among other accomplishments, DHS realigned its acquisition management functions within a new office to assess the health of major acquisitions and investments; conducted program and portfolio reviews of hundreds of information technology (IT) investments; and reduced the number of material weaknesses in internal controls. DHS also demonstrated top leadership commitment by identifying roles and responsibilities for its key management initiatives. However, DHS has more work ahead to fully implement its plans and address its management challenges. For example, in June 2010 GAO reported that over half of the programs reviewed awarded contracts to initiate acquisition activities without component or department approval of essential planning documents. In addition, DHS faces challenges fully defining key system investment and acquisition management policies and procedures. Further, as of September 30, 2011, due to material weaknesses in internal controls over financial reporting, DHS was unable to provide assurance that these internal controls were operating effectively. In September 2011 we reported that DHS also continues to face challenges implementing some key human capital initiatives, such as its workforce strategy. DHS also needs to continue to demonstrate sustainable progress in integrating its management functions within and across the department and its components, including making progress with its model for managing investments across components and management functions. GAO will continue to assess DHS’s efforts to address its high-risk designation and will report its findings on the department’s progress in the high-risk update that it expects to issue in early 2013.

Why GAO Did This Study

Since 2003, GAO has designated the implementation and transformation of DHS as high risk because, among other things, DHS had to combine 22 agencies, while ensuring no serious consequences for U.S. national and economic security. This high-risk area includes challenges in DHS’s management functions—financial management, human capital, IT, and acquisitions; the effect of those challenges on implementing DHS’s missions; and integrating the functions. In November 2000, GAO published criteria for removing areas from its high-risk list. In September 2010, GAO identified 31 actions and outcomes critical to addressing this high-risk area. This testimony addresses DHS’s progress in (1) developing a strategy for addressing its high-risk designation and (2) achieving outcomes critical to addressing this high-risk area. This statement is based on GAO products issued from June 2007 through February 2012, including selected updates. It also includes preliminary observations from GAO’s ongoing work reviewing DHS’s IT governance, for which GAO reviewed documents on IT governance and interviewed officials.