	DHS Has Made Progress in Addressing Its Management Challenges, but Has Significant Work Ahead to Achieve High-Risk Outcomes

Since we designated the implementation and transformation of DHS as  high risk in 2003, DHS has made progress addressing management  challenges and senior department officials have demonstrated  commitment and top leadership support for addressing the department’s  management challenges. However, the department has significant work  ahead to achieve positive outcomes in resolving high-risk issues. For  example, DHS faces challenges in modernizing its financial systems,  implementing acquisition management controls, and improving employee  satisfaction survey results, among other things. As DHS continues to  mature as an organization, it will be important for the department to  continue to strengthen its management functions, since the effectiveness  of these functions affects its ability to fulfill its homeland security and  other missions. DHS has made progress in addressing its  financial management and internal controls weaknesses, but has been  unable to obtain an unqualified audit opinion on its financial statements  since the department’s creation and faces challenges in modernizing its  financial management systems. Acquisition management. DHS has made progress in the acquisition  management area by enhancing the department’s ability to oversee major  acquisition programs. Human capital management. Information technology management. Based on preliminary observations from our review of DHS’s major at-risk  IT acquisitions we are performing for the committee, these improvements  may be having a positive effect. For example, the  department needs to:  finalize the policies and procedures associated with its new tiered  governance structure and continue to implement this structure, as we  recommended in our July 2012 report;  continue to implement its IT human capital plan, which DHS believed  would take 18 months to fully implement as of June 2012; and continue its efforts to enhance IT security by, among other things,  effectively addressing material weaknesses in financial systems  security, developing a plan to track and promptly respond to known  vulnerabilities, and implementing key security controls and activities. DHS has made progress in integrating its  individual management functions across the department and its  component agencies. Although these actions are important, DHS needs to continue to  demonstrate sustainable progress in integrating its management  functions within and across the department and its components and take  additional actions to further and more effectively integrate the department. DHS strategy for addressing GAO’s high-risk designation. In January  2011, DHS issued an agencywide management integration strategy—the  Integrated Strategy for High Risk Management—as we recommended in  our March 2005 report on DHS’s management integration efforts. DHS’s  most recent version of the strategy, issued in June 2012, greatly  improved upon prior versions and addressed feedback we previously  provided by, for example, identifying key measures and progress ratings  for the 18 initiatives included in the strategy and the 31 outcomes.believe the June 2012 strategy, if implemented and sustained, provides a  path for DHS to address our high-risk designation. DHS can further strengthen or clarify its Integrated Strategy for High Risk  Management to better enable DHS, Congress, and GAO to assess the  department’s progress in implementing its management initiatives by,  among other things: determining the resource needs for all of the  corrective actions in the strategy; communicating to senior leadership  critical resource gaps across all initiatives; and identifying program and  project risks in a supporting risk mitigation plan for all initiatives. We will continue to monitor, assess, and  provide feedback on DHS’s implementation and transformation efforts  through our ongoing and planned work, including the 2013 high-risk  update that we expect to issue in January 2013. Key contributors for the previous  work that this testimony is based on are listed within each individual  product. Appendix I: Summary of Actions and Outcomes for Addressing the Implementing and Transforming the Department of Homeland Security High-Risk Area

Related GAO Reports

Homeland Security: DHS Requires More Disciplined Investment  Management to Help Meet Mission Needs. Department of Homeland Security: Additional Actions Needed to  Strengthen Strategic Planning and Management Functions. High-Risk Series: Strategic Human Capital Management. Washington, D.C.: November 2000.
Why GAO Did This Study

This testimony discusses the Department of Homeland Security's (DHS) efforts to strengthen and integrate its management functions. DHS now has more than 200,000 employees and an annual budget of almost $60 billion, and its transformation is critical to achieving its homeland security and other missions. Since 2003, GAO has designated the implementation and transformation of DHS as high risk because DHS had to combine 22 agencies--several with major management challenges--into one department, and failure to effectively address DHS's management and mission risks could have serious consequences for our national and economic security. This high-risk area includes challenges in strengthening DHS's management functions--financial management, acquisition management, human capital, and information technology (IT)--the effect of those challenges on DHS's mission implementation, and challenges in integrating management functions within and across the department and its components. In November 2000, we published our criteria for removing areas from the high-risk list. This high-risk area includes challenges in strengthening DHS's management functions--financial management, acquisition management, human capital, and information technology (IT)--the effect of those challenges on DHS's mission implementation, and challenges in integrating management functions within and across the department and its components. Specifically, agencies must have (1) a demonstrated strong commitment and top leadership support to address the risks; (2) the capacity (that is, the people and other resources) to resolve the risks; (3) a corrective action plan that identifies the root causes, identifies effective solutions, and provides for substantially completing corrective measures in the near term, including but not limited to steps necessary to implement solutions we recommended; (4) a program instituted to monitor and independently validate the effectiveness and sustainability of corrective measures; and (5) the ability to demonstrate progress in implementing corrective measures. On the basis of our prior work, in a September 2010 letter to DHS, we identified, and DHS agreed to achieve, 31 actions and outcomes that are critical to addressing the challenges within the department's management areas and in integrating those functions across the department to address the high-risk designation. These key actions and outcomes include, among others, obtaining and then sustaining unqualified audit opinions for at least 2 consecutive years on the departmentwide financial statements; validating required acquisition documents in accordance with a department-approved, knowledge-based acquisition process; and demonstrating measurable progress in implementing its IT human capital plan and accomplishing defined outcomes. In January 2011, DHS issued its initial Integrated Strategy for High Risk Management, which included key management initiatives (e.g., financial management controls, IT program governance, and procurement staffing model) to address challenges and the outcomes we identified for each management area. DHS provided updates of its progress in implementing these initiatives in later versions of the strategy--June 2011, December 2011, and June 2012. Achieving and sustaining progress in these management areas would demonstrate the department's ability and ongoing commitment to addressing our five criteria for removing issues from the high-risk list. As requested, this testimony will discuss our observations, based on prior and ongoing work, on DHS's progress in achieving outcomes critical to addressing its high-risk designation for the implementation and transformation of the department.

What GAO Found

Since we designated the implementation and transformation of DHS as high risk in 2003, DHS has made progress addressing management challenges and senior department officials have demonstrated commitment and top leadership support for addressing the department's management challenges. However, the department has significant work ahead to achieve positive outcomes in resolving high-risk issues. For example, DHS faces challenges in modernizing its financial systems, implementing acquisition management controls, and improving employee satisfaction survey results, among other things. As DHS continues to mature as an organization, it will be important for the department to continue to strengthen its management functions, since the effectiveness of these functions affects its ability to fulfill its homeland security and other missions.