As table 3 illustrates, the majority of the OIG’s audit and inspection  reports issued in fiscal years 2012 and 2013 addressed issues at the  Federal Emergency Management Agency (FEMA). Of these 200  reports, 166 reports involved audits of FEMA grants, including 118 reports  on Disaster Assistance Grants. OIG Reports Covered All Reported DHS Management Challenges and High-Risk Areas

Of the 361 audit and inspection reports issued during fiscal years 2012  and 2013, we found that 355 OIG reports pertained to the department’s  management challenges reported by the OIG. However, we identified three areas—coordinating  with the FBI, protecting employees’ identities, and obtaining legal  advice—in which the OIG’s policies and procedures could be improved to  better meet its responsibilities. For example, the DHS OIG has its own Office of Counsel, which is  currently headed by a Deputy Counsel to the IG. DHS OIG’s Roles and Responsibilities Are Generally in Accordance with the IG Act

The DHS OIG’s policies and procedures contained in its manuals and  directives indicate that the OIG’s roles and responsibilities are generally  consistent with selected requirements of the IG Act. The IG Act requires OIGs to  recommend policies for, and to conduct, supervise, or coordinate  relationships between, the OIG and other federal agencies with respect to  the identification and prosecution of participants in fraud or abuse. OIG Lacks Adequate Controls to Protect Identities of Employees Filing Complaints

The OIG receives and reviews complaints filed by DHS employees and  the public regarding allegations of misconduct, including criminal  misconduct, by DHS employees. The IG Act requires that IGs shall not, after receipt of a  complaint or information from an employee, disclose the identity of the  employee without his or her consent unless the IG determines that such  disclosure is unavoidable during the course of an investigation. In its recent report on an investigation into allegations of misconduct by  the former Acting IG, the Subcommittee on Financial and Contracting  Oversight, Senate Committee on Homeland Security and Governmental  Affairs, reported that the former Acting IG inappropriately sought advice  from the department’s counsel, according to former OIG officials.interviewed former and current OIG officials and reviewed various e-mails  provided that indicated the former Acting IG sought legal advice from a  counsel at the department on several occasions. The  OIG’s Deputy Counsel stated that he was considering whether to develop  a policy and that he has asked a working group to draft guidelines on  consultations between the OIG and the department’s counsel. The OIG Audit Manual describes how OIG audit staff should document  their independence. For example, as a result of an  impairment to the former Acting IG’s independence that was not identified  in a timely manner, several audits and inspections were affected in fiscal  year 2012. The OIG has made some meaningful changes to its structure to  try to address concerns about the integrity and independence of the OIG. Although the former Acting IG  was required to sign an annual certificate of independence reminding him  of independence requirements, the OIG did not have a policy that these  certificates be collected and maintained centrally, which would improve  management’s ability to monitor compliance with independence  requirements. To help avoid any impairment to independence when seeking legal  advice, we recommend that the OIG develop a policy for obtaining  legal advice from counsel reporting either directly to the IG or another  IG and work with the IG’s counsel to establish guidelines for when it  would be appropriate for the OIG to consult with the department’s  counsel. GAO staff members who made key contributions to  this report are listed in appendix V.

Appendix I: Objectives, Scope, and Methodology

The joint explanatory statement accompanying the Department of  Homeland Security (DHS) Appropriations Act, 2013, directed GAO to  review the Office of Inspector General’s (OIG) organizational structure  and whether its audit, investigation, and inspection functions are  organizationally structured to ensure that independence standards are  met. This report provides the results of our review to  determine (1) the coverage that the OIG’s audits and inspections  provided of DHS’s key component agencies, management challenges,  and high-risk areas; (2) the extent to which the OIG’s organizational  structure and roles and responsibilities were consistent with the Inspector  General Act of 1978, as amended (IG Act); and (3) the extent to which the  design of OIG’s policies and procedures for planning, reviewing, and  reporting on audit, inspection, and investigation results was consistent  with applicable independence standards.
Why GAO Did This Study

The DHS OIG plays a critical role in strengthening accountability throughout DHS. The OIG received about $141 million in fiscal year 2013 appropriations to carry out this oversight.
The joint explanatory statement to the Department of Homeland Security Appropriations Act, 2013, directed GAO to review the OIG and its organizational structure for meeting independence standards. This report examines (1) the coverage the OIG's audits and inspections provided of DHS's component agencies, management challenges, and high-risk areas; (2) the extent to which the OIG's organizational structure, roles, and responsibilities were consistent with the IG Act; and (3) the extent to which the design of the OIG's policies and procedures was consistent with applicable independence standards.
To address these objectives, GAO obtained relevant documentation, such as selected reports and OIG policies and procedures, and compared this information to the IG Act and independence standards. GAO also interviewed officials from the OIG, DHS components, and the FBI.

What GAO Found

During fiscal years 2012 and 2013, the Department of Homeland Security's (DHS) Office of Inspector General (OIG) issued 361 audit and inspection reports that collectively cover key components, management challenges identified by the OIG, and relevant high-risk areas identified by GAO. Of the 361 reports, 200 pertained solely to the Federal Emergency Management Agency (FEMA)—the DHS component with the largest budget. Of those FEMA reports, 118 reports involved audits of disaster assistance grants.
The OIG's organizational structure, roles, and responsibilities are generally consistent with the Inspector General (IG) Act of 1978, as amended (IG Act). In 2013, the OIG made changes to its structure to enhance independence and oversight, including establishing an Office of Integrity and Quality Oversight. However, areas for improvement exist for the OIG to better meet its responsibilities.
The OIG has not reached agreement with the Federal Bureau of Investigation (FBI) on coordinating and sharing border corruption information. The IG Act requires OIGs to recommend policies for and to conduct, supervise, or coordinate relationships with other federal agencies regarding cases of fraud or abuse. The Senate Appropriations Committee directed DHS to report jointly with the OIG and other DHS components on plans for working with the FBI.
The OIG lacks adequate controls to protect identities of employees filing complaints because its process for recording complaints involves significant manual procedures, without review, that can be subject to human error. The IG Act requires that OIGs not disclose the identity of an employee filing a complaint without the employee's consent unless such disclosure is unavoidable during the course of an investigation. The OIG is aware of these issues and is developing standard operating procedures.
The OIG does not have a policy for obtaining legal advice from its own counsel or guidelines specifying when it is appropriate to consult with the department's counsel. The former Acting IG requested legal help from a counsel at the department for 4 months, and it was not clear if this request was for appropriate matters. The IG Act requires the IG to obtain legal advice from a counsel reporting directly to the IG or another IG. The OIG Deputy Counsel has asked a working group to draft guidelines on consultations with the department's counsel.
The OIG's policies and procedures are consistent with independence standards. However, OIG senior executives did not always comply with the policy to annually complete certificates of independence. Because the OIG does not centrally maintain the certifications, management's ability to monitor compliance is hindered. For example, no certificate of independence could be found for the former Acting IG. As a result of an impairment to the former Acting IG's independence that was not identified in a timely manner, the OIG had to reissue six reports for fiscal year 2012 to add an explanatory statement about the impairment. External peer reviews of the OIG's audit function, completed in 2009 and 2012, also found that OIG staff, including senior executives, had not documented their independence as required.

What GAO Recommends

GAO is making three recommendations for improving controls over processing complaints, obtaining legal advice, and monitoring compliance with independence standards. The IG concurred with GAO's recommendations and described actions being taken to address them.