Financial Management Systems: DHS Should Improve Plans for Addressing Its High-Risk Area and Guidance for Independent Reviews
Fast Facts
The Department of Homeland Security has a multi-year plan to address its long-standing financial management issues. This includes acquiring modern financial management systems for its component agencies.
This Q&A report provides an update to our Feb. 2023 evaluation of DHS's systems modernization efforts. DHS:
Has guidance for developing cost and schedule estimates that follows best practices
Doesn't have a comprehensive strategy for addressing its financial management issues
Could incorporate key elements for independent reviews in guidance for its systems modernization efforts
DHS financial management remains a topic on our High Risk List.
Highlights
What GAO Found
GAO previously identified the Department of Homeland Security's (DHS) financial management as being at high risk in 2003—that is, vulnerable to fraud, waste, abuse, and mismanagement or in need of transformation. DHS needs to take two key actions to resolve this high-risk area: (1) modernize its financial management systems and (2) obtain an unmodified (clean) opinion on internal controls over financial reporting. Significant deficiencies in DHS's internal control and financial management systems have hampered its ability to effectively manage its financial operations. To help address its high-risk area, DHS is acquiring and implementing modern financial management systems through multiple acquisition programs.
GAO found that DHS does not have a comprehensive strategy that fully incorporates leading practices for performance management and addresses its high-risk financial management area. Without a comprehensive strategy and guidance, DHS diminishes its ability to adequately address challenges or set priorities that help to successfully implement its efforts.
GAO also found that DHS's guidance for developing cost and schedule estimates for these programs generally incorporates GAO's leading practices. Reliable cost and schedule estimates are invaluable for any acquisition program, helping managers evaluate trade-offs in a program's cost, schedule, and scope.
GAO has long recognized independent verification and validation as a leading practice for federal agencies to use in the acquisition of programs that are complex, large-scale, or high risk. DHS's acquisition management and systems engineering guidance does not fully incorporate any of the key elements of effective independent verification and validation. For example, this guidance does not include specific, risk-based criteria to facilitate deciding whether, or the extent to which, a program would use independent verification and validation. Without such guidance, DHS does not have an adequate framework for planning and managing its independent verification and validation efforts, making it less likely that it will meet its cost, schedule, and mission goals for these programs.
Why GAO Did This Study
Since DHS's creation in 2003, it has faced significant internal control and financial management systems deficiencies. To address its financial management issues, DHS is executing a multiyear plan to implement new financial management systems at the U.S. Coast Guard, Federal Emergency Management Agency, and U.S. Immigration and Customs Enforcement.
Given DHS's long-standing financial management systems issues, GAO was asked to provide oversight of the agency's financial systems modernization efforts. This report provides an update on GAO's assessment of DHS's efforts, including its strategies for addressing its high-risk financial management area, as well as its guidance for cost and schedule estimation and incorporating independent verification and validation. This report is one in a series of GAO reports addressing DHS's efforts to modernize its financial management systems.
GAO met with DHS officials, reviewed key strategy documentation related to DHS's efforts to address its high-risk financial management area, and reviewed DHS's guidance for cost and schedule estimation and independent verification and validation. GAO also assessed the extent to which these guidance documents incorporated leading practices.
Recommendations
GAO is recommending that DHS (1) fully incorporate performance management leading practices in its high-risk financial management area strategies and guidance and (2) fully incorporate key elements of effective independent verification and validation in its systems engineering guidance. DHS concurred with the recommendations and described actions it will take to address them.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Department of Homeland Security |
Priority Rec.
The Under Secretary for Management should ensure that the Chief Financial Officer works with the relevant DHS offices to fully incorporate performance management leading practices in its high-risk financial management area strategies and guidance. (Recommendation 1) |
DHS concurred with this recommendation and described actions they planned to take. For example, DHS stated that the Office of the Chief Financial Officer's (OFCO) Risk Management and Assurance (RM&A) Division will conduct a review to identify current resourcing levels and capabilities, and crosswalk that information to the high-risk areas related to DHS's ability to obtain and sustain an unmodified (clean) internal controls over financial reporting (ICOFR) opinion. As of May 2025, DHS stated that the OCFO is in progress of completing the resourcing review related to DHS's ability to obtain and maintain an unmodified ICOFR opinion. This effort has been prioritized to review resourcing for the DHS headquarters and components ICOFR oversight and management offices. Recent Executive Orders and the Fiscal Year 2026 budget process continue to adjust current resourcing levels and alignment within the department, as such, the current state resourcing levels remain in fluctuation. In order to reduce repetitive performance of this resourcing review, DHS extended the timeline for completion to December 31, 2025 to allow additional time for the current resourcing environment to stabilize and an accurate resourcing analysis to be completed. We will continue to monitor the department's progress towards implementing this recommendation.
|
| Department of Homeland Security |
Priority Rec.
The Under Secretary for Management should ensure that the Director of the Office of Program Accountability and Risk Management fully incorporates key elements of effective IV&V in DHS's systems engineering guidance. (Recommendation 2) |
DHS concurred with this recommendation. In June 2025, DHS provided an updated copy of DHS's "Systems Engineering Life Cycle Guidebook (SELC)." This document fully incorporates the key elements of effective independent verification and validation (IV&V). The additional procedures described in the SELC Guidebook, as well as management's continued focus in this area, address this recommendation. This updated guidance will help DHS maximize the value of its investment in IV&V, and contribute towards DHS meeting its cost, schedule, and mission goals for its system acquisition programs. This will also help ensure the success of its financial systems modernization efforts.
|