Financial Management Systems: DHS Should Improve Plans for Addressing Its High-Risk Area and Guidance for Independent Reviews

What GAO Found

GAO previously identified the Department of Homeland Security's (DHS) financial management as being at high risk in 2003—that is, vulnerable to fraud, waste, abuse, and mismanagement or in need of transformation. DHS needs to take two key actions to resolve this high-risk area: (1) modernize its financial management systems and (2) obtain an unmodified (clean) opinion on internal controls over financial reporting. Significant deficiencies in DHS's internal control and financial management systems have hampered its ability to effectively manage its financial operations. To help address its high-risk area, DHS is acquiring and implementing modern financial management systems through multiple acquisition programs.

GAO found that DHS does not have a comprehensive strategy that fully incorporates leading practices for performance management and addresses its high-risk financial management area. Without a comprehensive strategy and guidance, DHS diminishes its ability to adequately address challenges or set priorities that help to successfully implement its efforts.

GAO also found that DHS's guidance for developing cost and schedule estimates for these programs generally incorporates GAO's leading practices. Reliable cost and schedule estimates are invaluable for any acquisition program, helping managers evaluate trade-offs in a program's cost, schedule, and scope.

GAO has long recognized independent verification and validation as a leading practice for federal agencies to use in the acquisition of programs that are complex, large-scale, or high risk. DHS's acquisition management and systems engineering guidance does not fully incorporate any of the key elements of effective independent verification and validation. For example, this guidance does not include specific, risk-based criteria to facilitate deciding whether, or the extent to which, a program would use independent verification and validation. Without such guidance, DHS does not have an adequate framework for planning and managing its independent verification and validation efforts, making it less likely that it will meet its cost, schedule, and mission goals for these programs.

Why GAO Did This Study

Since DHS's creation in 2003, it has faced significant internal control and financial management systems deficiencies. To address its financial management issues, DHS is executing a multiyear plan to implement new financial management systems at the U.S. Coast Guard, Federal Emergency Management Agency, and U.S. Immigration and Customs Enforcement.

Given DHS's long-standing financial management systems issues, GAO was asked to provide oversight of the agency's financial systems modernization efforts. This report provides an update on GAO's assessment of DHS's efforts, including its strategies for addressing its high-risk financial management area, as well as its guidance for cost and schedule estimation and incorporating independent verification and validation. This report is one in a series of GAO reports addressing DHS's efforts to modernize its financial management systems.

GAO met with DHS officials, reviewed key strategy documentation related to DHS's efforts to address its high-risk financial management area, and reviewed DHS's guidance for cost and schedule estimation and independent verification and validation. GAO also assessed the extent to which these guidance documents incorporated leading practices.