	High-Risk Areas for Which DHS Has Sole Responsibility Strengthening DHS Management Functions

DHS has made progress in addressing high-risk areas for which it has  sole responsibility, but significant work remains. DHS has made important progress in implementing, transforming,  strengthening, and integrating its management functions in human  capital, acquisition, financial management, and IT. This has included  taking numerous actions specifically designed to address our criteria for  removing areas from the high-risk list. As shown in table 1, DHS has  met two of our criteria for removal from the high-risk list (leadership  commitment and a corrective action plan), and has partially met the  remaining three criteria (a framework to monitor progress; capacity; and  demonstrated, sustained progress). Capacity (partially met). is more than the government-wide decrease of 4 percentage points  over the same time period. Accordingly, DHS has considerable  work ahead to improve its employee morale. These assessments focus on occupations DHS identifies as critical to  its mission, including emergency management specialists and cyber- focused IT management personnel. However, DHS needs to improve its acquisition  management. DHS’s acquisition policy largely reflects key  acquisition management practices, but the department has not  implemented it consistently. In March 2014, we reported that the  Transportation Security Administration does not collect or analyze  available information that could be used to enhance the effectiveness  of its advanced imaging technology. In March 2014, we also found  that U.S. Customs and Border Protection (CBP) did not fully follow  DHS policy regarding testing for the integrated fixed towers being  deployed on the Arizona border. As a result, DHS does not have  complete information on how the towers will operate once they are  fully deployed. About half of major programs lack an approved baseline, and 77  percent lack approved life cycle cost estimates. However, a significant amount of work remains to  be completed on the other seven outcomes related to DHS’s financial  statements, internal control over financial reporting, and modernizing  financial management systems. For  example, one of the material weaknesses involves deficiencies in  property, plant, and equipment. However, DHS needs to
DHS also needs to effectively manage the modernization of financial  management systems at the U.S. Coast Guard (USCG), U.S.  Immigration and Customs Enforcement (ICE), and the Federal  Emergency Management Agency (FEMA). IT Management. While important steps have been taken to define IT investment  management processes generally consistent with best practices, work  is needed to demonstrate progress in implementing these processes  across DHS’s 13 IT investment portfolios. In July 2012, we  recommended that DHS finalize the policies and procedures  associated with its new tiered IT governance structure and continue to  implement key processes supporting this structure. DHS agreed  with these recommendations; however, as of April 2014, the  department had not finalized the key IT governance directive, and the  draft structure has been implemented across only 5 of the 13  investment portfolios. In addition, in April 2014, the Secretary of Homeland Security  issued a memorandum committing to improving DHS’s planning,  programming, budgeting, and execution processes through strengthened  departmental structures and increased capability.and most significant outcome—implement actions and outcomes in each  management area to develop consistent or consolidated processes and  systems within and across its management functional areas—DHS needs  to continue to demonstrate sustainable progress integrating its  management functions within and across the department and its  components and take additional actions to further and more effectively  integrate the department. As we reported in March 2013, to more fully address the Strengthening  DHS Management Functions high-risk area, DHS needs to continue  implementing its Integrated Strategy for High Risk Management and show  measurable, sustainable progress in implementing its key management  initiatives and corrective actions and achieving outcomes. In doing so, it  will be important for DHS to maintain its current level of top leadership support and sustained  commitment to ensure continued progress in executing its corrective  actions through completion;  continue to implement its plan for addressing this high-risk area and  periodically report its progress to Congress and GAO; monitor the effectiveness of its efforts to establish reliable resource  estimates at the department and component levels, address and work  to mitigate any resource gaps, and prioritize initiatives as needed to  ensure it has the capacity to implement and sustain its corrective  actions;  closely track and independently validate the effectiveness and  sustainability of its corrective actions and make midcourse  adjustments, as needed; and make continued progress in addressing the 30 actions and  outcomes—for the majority of which significant work remains—and  demonstrate that systems, personnel, and policies are in place to  ensure that progress can be sustained over time. National Flood Insurance Program

FEMA has made progress in all of the areas required for removal of the  NFIP from the high-risk list, but needs to initiate or complete additional  actions; also, recent legislation has created challenges for FEMA in  addressing the financial exposure created by the program. For example, FEMA has not completed actions in certain  areas, such as modernizing its claims and policy management system  and overseeing compensation of insurers that sell NFIP policies. As of December 2013, FEMA owed the  Treasury $24 billion—primarily to pay claims associated with Superstorm  Sandy (2012) and Hurricane Katrina (2005)—and had not made a  principal payment since 2010. Capacity (partially met). Government-wide High-Risk Areas in Which DHS Plays a Critical Role

Progress has been made in the government-wide high-risk areas in which  DHS plays a critical role, but significant work remains. Information Security and Cyber Critical Infrastructure Protection

As we reported in our February 2013 high-risk update, the White House  and federal agencies, including DHS, have taken a variety of actions that  were intended to enhance federal and critical infrastructure cybersecurity. For  example, H.R. Continue to develop continuous diagnostics and mitigation  capabilities and assist agencies in developing and acquiring  them. This effort is intended to protect networks and enhance an  agency’s ability to see and counteract day-to-day cyber threats. Protecting Cyber Critical Infrastructure

DHS, in conjunction with other executive branch entities, has taken steps  to enhance the protection of cyber critical infrastructure. Enhancing the Sharing of Terrorism-Related Information

DHS has made significant progress in enhancing the sharing of  information on terrorist threats and in supporting government-wide efforts  to improve such sharing. Overall, the federal government has made progress in addressing the  terrorism-related information-sharing high-risk area. DHS is also taking steps to  measure the extent to which fusion centers are coordinating and sharing  information with other field-based task forces and centers—such as  Federal Bureau of Investigation Joint Terrorism Task Forces—and assess   In April 2013, we reported that  opportunities to improve coordination. DHS information-sharing mission. Our report,  expected to be issued later this month, will address (1) the extent to  which the intelligence analysis activities of the enterprise are integrated to  support departmental strategic intelligence priorities, and are  unnecessarily overlapping or duplicative; (2) the extent to which Office of  Intelligence and Analysis customers report that they find products and  other analytic services to be useful, and what steps, if any, the office has  taken to address any concerns customers report; and (3) challenges the  Office of Intelligence and Analysis has faced in maintaining a skilled  analytic workforce and steps it has taken to address these challenges.
Why GAO Did This Study

Since 1990, GAO has regularly reported on government operations identified as high risk because of their greater vulnerability to fraud, waste, abuse, and mismanagement, or the need for transformation to address economy, efficiency, or effectiveness challenges. DHS has sole or critical responsibility for four GAO high-risk areas—(1) strengthening its management functions, (2) NFIP, (3) information security and cyber critical infrastructure protection, and (4) terrorism-related information sharing. This statement addresses DHS's progress and work remaining in addressing high-risk areas for which (1) it has sole responsibility and (2) it has critical, but shared responsibility.
This statement is based on GAO's February 2013 high-risk update, reports and testimonies issued from March 2013 through April 2014, and analyses from GAO's ongoing assessment of DHS's efforts since February 2013 to address its high-risk designations. For these analyses, GAO examined DHS documents and interviewed DHS officials.

What GAO Found

The Department of Homeland Security (DHS) has made progress in addressing high-risk areas for which it has sole responsibility, but significant work remains.
Strengthening management functions. In this area, DHS has met two and partially met three of GAO's five criteria for removing areas from the high-risk list. Specifically, DHS has met the criteria for having (1) demonstrated leadership commitment, and (2) a corrective action plan for addressing its management risks. However, it has partially met GAO's criteria for (1) capacity (having sufficient resources); (2) having a framework to monitor progress; and (3) demonstrated, sustained progress. DHS has made important progress, but to more fully address GAO's high-risk designation, DHS needs to show measurable, sustainable progress in implementing key management initiatives. For example:
Human capital management. DHS has developed and demonstrated progress in implementing a strategic human capital plan. However, DHS needs to improve other aspects of its human capital management. As GAO reported in December 2013, the Office of Personnel Management's 2013 Federal Employee Viewpoint Survey data showed that DHS ranked 36th of 37 federal agencies in a measure of employee job satisfaction. In addition, employee satisfaction had decreased 7 percentage points since 2011, which is more than the government-wide decrease. Accordingly, DHS has considerable work ahead to improve its employee morale. Further, DHS is finalizing its analysis of skill gaps in key portions of its workforce including emergency management specialists and cyber-focused IT management personnel.
Acquisition management. DHS has made progress in initiating efforts to validate required acquisition documents. However, about half of DHS major programs lack an approved baseline, 77 percent lack approved life cycle cost estimates, and the department has not implemented its acquisition policy consistently. In March 2014, GAO reported that the Transportation Security Administration does not collect or analyze available information that could be used to enhance the effectiveness of its advanced imaging technology. In March 2014, GAO also found that the U.S. Customs and Border Protection (CBP) did not fully follow DHS policy regarding testing for the integrated fixed towers being deployed on the Arizona border. As a result, DHS does not have complete information on how the towers will operate once they are fully deployed.
Financial management. DHS has made progress toward improving its financial management, but a significant amount of work remains to be completed. For example, DHS needs to eliminate all material weaknesses at the department level in areas such as property, plant, and equipment before its financial auditor can assert that the controls are effective. DHS also needs to effectively manage the modernization of financial management systems at the U.S. Coast Guard, U.S. Immigration and Customs Enforcement, and the Federal Emergency Management Agency (FEMA).
Information Technology (IT) Management. While important steps have been taken to define IT investment management processes, work is needed to demonstrate progress in implementing these processes across DHS's 13 IT investment portfolios. In July 2012, GAO recommended that DHS finalize the policies and procedures associated with its new tiered IT governance structure and continue to implement key processes supporting this structure. DHS agreed with these recommendations; however, as of April 2014, the department had not finalized the key IT governance directive, and the draft structure has been implemented across only 5 of the 13 investment portfolios.
National Flood Insurance Program (NFIP) . DHS's FEMA, which manages the NFIP, has partially met the five criteria for NFIP removal from the high-risk list, but needs to initiate or complete additional actions. For example, FEMA has not completed actions in certain areas, such as modernizing its claims and policy management system and overseeing compensation of insurers that sell NFIP policies. In addition, FEMA is unlikely to generate sufficient revenue to cover future catastrophic losses or repay billions of dollars borrowed from the Department of the Treasury. As of December 2013, FEMA owed the Treasury $24 billion—primarily to pay claims associated with Superstorm Sandy (2012) and Hurricane Katrina (2005)—and had not made a principal payment since 2010.
Progress has been made in the following government-wide high-risk areas in which DHS plays a critical role, but significant work remains.
Information security and cyber critical infrastructure protection. Federal agencies, including DHS, have taken a variety of actions that were intended to enhance federal and critical infrastructure cybersecurity, but more efforts are needed. DHS needs to take several actions to better oversee and assist agencies in improving information security practices. For instance, DHS should continue to assist agencies in developing and acquiring continuous diagnostic and mitigation capabilities to protect networks and counteract day-to-day cyber threats. In addition, DHS has taken steps to enhance the protection of cyber critical infrastructure but could do more to enhance coordination with the private sector.
Terrorism-related information sharing. The federal government faces significant challenges in sharing terrorism-related information. However, DHS has made significant progress in enhancing the sharing of this information. For example, DHS is taking steps to measure the extent to which fusion centers—collaborative efforts within states that investigate and respond to criminal and terrorist activity—are coordinating with other field-based task forces and centers to share terrorism-related information, and assessing opportunities to improve coordination and information sharing. The federal government has important work ahead to address the high risk issue, such as developing metrics that measure the homeland security results achieved from improved information sharing.

What GAO Recommends

This testimony contains no new recommendations. GAO has made over 2,100 recommendations to DHS since its establishment in 2003 to strengthen its management and integration efforts, among other things. DHS has implemented more than 65 percent of these recommendations and has actions under way to address others.