	Compliance with Legislative Conditions

The ACE expenditure plan—including related program documentation and  program officials’ statements—satisfies or partially satisfies the six  legislative conditions specified in the appropriations act. Specifically, the  plan satisfies the conditions that it (1) comply with the acquisition rules,  requirements, guidelines, and systems acquisition management practices of  the federal government; (2) include a certification by the DHS Chief  Information Officer that an independent verification and validation agent is  currently under contract for the program; (3) be reviewed by the DHS  Investment Review Board, the Secretary of DHS, and Office of Management  and Budget (OMB); and (4) be reviewed by us. The plan and its supporting  information partially satisfies the conditions that it (5) meet the capital  planning and investment control review requirements established by OMB  (including Circular A-11, part 7) and that it (6) comply with the DHS  enterprise architecture. Status of GAO Recommendations

DHS has implemented some, but not all, of the recommendations  pertaining to ACE that we have made since 2003. The remaining seven recommendations are in the process of being  implemented, as described here. Observations on the Expenditure Plan and Management of ACE

We have three observations about ACE requirements, commercial product  selection, and risk management. Requirements: Redefinition of requirements for several ACE releases is  now under way to address limitations in completeness of originally  defined requirements, and this redefinition is likely to introduce  program schedule delays and cost increases. As a result of these years of effort, the ACE  program is better positioned today for delivering promised capabilities and  benefits than it has been in the past. Nevertheless, key program management practices relating to, for example,  human capital management, requirements management, and risk  management continue to remain a challenge, and other management areas,  such as information security and architecture alignment, continue to  require attention. To further improve ACE management and minimize its exposure  to risk, it is important for CBP and DHS to remain vigilant in their efforts to  satisfy ACE legislative requirements and to fully implement our prior  recommendations. Moreover, it is important that they keep Congress fully  informed on where the program stands and what changes are planned to  address emerging cost overruns and schedule delays. OMB approved the expenditure plan on January 22, 2007. Objective 2: Open Recommendations  The fiscal year 2007 expenditure plan still does not adequately describe the  program’s progress against the commitments that were made in the fiscal year  2006 plan. According to program officials, the new measures will be  combined with existing performance measures. Since then, the program office has reduced this overlap and concurrence. To further strengthen ACE management and promote accountability for ACE performance and results, we are making the following recommendation to the Secretary of Homeland Security to direct the CBP Commissioner to ensure that future quarterly reports to the House and Senate Appropriations Committees disclose

(1)the risks and associated mitigation strategies of not having fully satisfied the  expenditure plan legislative conditions and not having completed implementation of all our prior recommendations;  (2)the status and impacts on the program’s estimated cost and schedule and  lessons learned from ongoing efforts to redefine requirements and to  implement a different COTS product than originally selected; and (3)the program’s plans and actions for improving ACE risk management and its  current inventory of program risks, including their associated mitigation  strategies and the status of the strategies’ implementation. Information Technology: Customs Automated Commercial Environment Program Progressing, but Need for Management Improvements Continues.
Why GAO Did This Study

The Department of Homeland Security (DHS) established the Automated Commercial Environment (ACE) program to replace and supplement existing cargo processing technology. According to the fiscal year 2007 DHS appropriations act, DHS is to develop and submit an expenditure plan for ACE that satisfies certain conditions, including being reviewed by GAO. GAO reviewed the plan to (1) determine whether the expenditure plan satisfies the legislative conditions, (2) determine the status of 15 open GAO recommendations, and (3) provide observations about the expenditure plan and DHS's management of the program. To address the mandate, GAO assessed plans and related documentation against federal guidelines and industry standards and interviewed the appropriate DHS officials.

What GAO Found

The ACE expenditure plan satisfies many--but not all--of the legislative conditions specified in the fiscal year 2007 DHS appropriations act. Specifically, the plan (with related program documentation and officials' statements) complies with acquisition rules, requirements, guidelines, and management practices of the federal government; includes a DHS certification that an independent verification and validation agent is under contract; was reviewed and approved by DHS and the Office of Management and Budget (OMB); and was reviewed by GAO. In addition, it partially satisfies conditions for meeting the capital planning and investment control review requirements established by OMB in Circular A-11 (part 7), including information security, and for complying with the DHS enterprise architecture. DHS has implemented eight open GAO recommendations made during the past 4 years, including those related to performance measures and targets, independent verification and validation, cost estimation, and program reporting. Seven other recommendations made during this time are in the process of being implemented. With respect to these seven, DHS has taken steps to satisfy each, such as establishing an accountability framework, reducing overlap and concurrence among ACE releases, and completing a privacy impact assessment, and actions are under way or planned to more fully address them. GAO is making three new observations about the expenditure plan and the management of ACE. First, the program is taking needed steps to redefine requirements for several ACE releases because of limitations in the completeness of original requirements, but this redefinition is likely to introduce significant program schedule delays and cost increases. Second, the changes to ACE requirements have led to replacement of a key commercial product, but the new product carries the risk of negatively impacting user productivity. Third, the automated database used for managing ACE risks is incomplete and does not contain information needed to adequately inform program decisions. All told, DHS has continued to make progress on ACE, and the program is better positioned today for delivering promised capabilities and benefits than it has been in the past. Nevertheless, key program management practices relating to, for example, human capital management, requirements management, and risk management remain a challenge, and other management areas, such as information security and architecture alignment, continue to require attention. As a result, GAO sees major program schedule delays and cost overruns on the horizon. To improve ACE management and minimize exposure to risk, it is important for DHS to remain vigilant in its efforts to satisfy ACE legislative requirements, fully implement prior GAO recommendations, and keep Congress fully informed about the program's status, plans, and risk.