DHS Has Made Limited Progress in Implementing Our Prior Recommendations

In June 2007, we made six recommendations to DHS to help the  department reduce the risks associated with acquiring and implementing a  departmentwide financial management system. Our preliminary analysis  indicates that DHS has begun to take actions toward the implementation  of four of the recommendations, as shown in table 1. However, it is unclear how the DHS-prepared concept of operations  document will relate to the selected contractor’s concept of operations  document called for in the request for proposal. The concept of  operations for TASC should, among other things:    define how DHS’ day-to-day financial management operations are and  will be carried out to meet mission needs;  clarify which component and departmentwide systems are considered  financial management systems;  include a transition strategy that is useful for developing an  understanding of how and when changes will occur;    develop an approach for obtaining reliable information on the costs of  its financial management systems investments; and  link DHS’ concept of operations for the TASC program to its enterprise  architecture. While we recognize that the actual development and  implementation of these plans cannot be completed until the TASC  contractor and system have been selected, it will be critical for DHS to  ensure that these plans are completed and effectively implemented prior  to moving forward with the implementation of the new system. DHS Has Not Yet Identified All Business Processes Needing Reengineering and Standardization Across the Department

Although, DHS has identified nine end-to-end business processes that  will be addressed as part of the TASC program, the department has not yet  identified all of its existing business processes that will be reengineered  and standardized as part of the TASC program. While the actual migration approach will depend on the selected system  and events that occur during the TASC program implementation, critical  activities include (1) developing specific criteria requiring component  agencies to migrate to the new system rather than attempting to maintain  legacy business systems; (2) defining and instilling new values, norms, and  behaviors within component agencies that support new ways of doing  work and overcoming resistance to change; (3) building consensus among  customers and stakeholders on specific changes designed to better meet  their needs; and (4) planning, testing, and implementing all aspects of the  migration of the new system. Planned TASC Implementation Efforts Pose Unnecessary Risks

While updating the status of the six prior recommendations, we identified  two issues that pose unnecessary risks to the success of the TASC  program. These risks are DHS’ significant reliance on contractors to define  and implement the new system and the lack of independence of DHS’ V&V  function for the TASC program. Significant Reliance Placed on Contractors to Define and Implement the TASC Program

The department plans to have the selected contractor prepare a number of  key documents including plans needed to carry out disciplined processes,  define additional business processes to be standardized, and propose a  migration approach. Work with other systems acquisition and implementation efforts have  shown that placing too much reliance on contractors can result in systems  efforts plagued with serious performance and management problems. As a result, according to the OIG  report, contractors were performing functions that should have been  performed by government workers. On October 21, 2009, DHS officials indicated  that they have restructured the V&V contract to address our concerns by  changing the reporting relationship and the organization that is  responsible for managing the V&V contract. It is important that V&V is technically,  managerially, and financially independent of the organization in charge of  the system development and/or acquisition it is assessing. DHS has started, but not completed  implementation of the six recommendations we made in June 2007, aimed  at helping the department to reduce risk to acceptable levels, while  acquiring and implementing an integrated departmentwide financial  management system.
Why GAO Did This Study

In June 2007, GAO reported that the Department of Homeland Security (DHS) had made little progress in integrating its existing financial management systems and made six recommendations focused on the need for DHS to define a departmentwide strategy and embrace disciplined processes. In June 2007, DHS announced its new financial management systems strategy, called the Transformation and Systems Consolidation (TASC) program. GAO's testimony provides preliminary analysis of the status of its prior recommendations and whether there were additional issues identified that pose challenges to the successful implementation of the TASC program. GAO reviewed relevant documentation, such as the January 2009 Request for Proposal and its attachments, and interviewed key officials to obtain additional information. GAO provided a draft report that this testimony is based on to DHS on September 29, 2009, for review and comment. After reviewing and considering DHS' comments, GAO plans to finalize and issue the report including providing appropriate recommendations aimed at improving the department's implementation of the TASC program.

What GAO Found

GAO's preliminary analysis shows that DHS has begun to take actions to implement four of the six recommendations made in the 2007 report; however, none of these recommendations have been fully implemented. GAO recognizes that DHS cannot fully implement some of the recommendations aimed at reducing the risk in accordance with best practices until the contract for TASC is awarded. DHS has taken, but not completed, actions to (1) define its financial management strategy and plan, (2) develop a comprehensive concept of operations, (3) incorporate disciplined processes, and (4) implement key human capital practices and plans for such a systems implementation effort. DHS has not taken the necessary actions on the remaining two recommendations, to standardize business processes across the department, including applicable internal control, and to develop detailed consolidation and migration plans since DHS will not know the information necessary to develop these items until a contractor is selected. While some of the details of the department's standardization of business processes and migration plans depend on the selected new system, DHS would benefit from performing critical activities, such as identifying all of its affected current business processes so that DHS can analyze how closely the proposed system will meet the department's needs. GAO's preliminary analysis during this review also identified two issues that pose challenges to the TASC program--DHS' significant risks related to the reliance on contractors to define and implement the new system and the lack of independence of the contractor hired to perform the verification and validation (V&V) function for TASC. DHS plans to rely on the selected contractor to complete key process documents for TASC such as detailed documentation that governs activities such as requirements management, testing, data conversion, and quality assurance. The extent of DHS' reliance on contractors to define and implement key processes needed by the TASC program, without the necessary oversight mechanisms to ensure that (1) the processes are properly defined and (2) effectively implemented, could result in system efforts plagued with serious performance and management problems. Further, GAO identified that DHS' V&V contractor was not independent with regard to the TASC program. DHS management agreed that the V&V function should be performed by an entity that is technically, managerially, and financially independent of the organization in charge of the system development and/or acquisition it is assessing. Accordingly, DHS officials indicated that they have restructured the contract to address our concerns by changing the organization that is responsible for managing the V&V function.