The act defined the department’s missions to include  preventing terrorist attacks within the United States; reducing U.S.  vulnerability to terrorism; and minimizing the damages, and assisting in  the recovery from, attacks that occur within the United States. DHS began operations in March 2003. DHS Has Made Progress in Implementing Its Management Functions, but Has Faced Challenges in Its Implementation Efforts

DHS has made progress in implementing its management functions in the  areas of acquisition, financial, human capital, information technology, and  real property management. DHS has recognized the need to  improve acquisition outcomes and taken some positive steps to organize  and assess the acquisition function, but continues to lack clear  accountability for the outcomes of acquisition dollars spent. In September 2007, we reported on continued acquisition oversight issues  at DHS, identifying that the department has not fully ensured proper  oversight of its contractors providing services closely supporting  inherently government functions. However,  since its establishment, DHS has been unable to obtain an unqualified or  “clean” audit opinion on its financial statements. For fiscal year 2007, the  independent auditor issued a disclaimer on DHS’s financial statements and  identified eight significant deficiencies in DHS’s internal control over  financial reporting, seven of which were so serious that they qualified as  material weaknesses. DHS has taken steps to prepare corrective action  plans for its internal control weaknesses by, for example, developing and  issuing a departmentwide strategic plan for the corrective action plan  process and holding workshops on corrective action plans. Human Capital Management. DHS  has since taken actions to implement its human capital system. For example, DHS has not yet taken  steps to fully link its human capital planning to overall agency strategic  planning nor has it established a market-based and more performance- oriented pay system. DHS’s information technology  management efforts should include:    developing and using an enterprise architecture, or corporate blueprint, as  an authoritative frame of reference to guide and constrain system  investments;    defining and following a corporate process for informed decision making  by senior leadership about competing information technology investment  options;    applying system and software development and acquisition discipline and  rigor when defining, designing, developing, testing, deploying, and  maintaining systems;    establishing a comprehensive, departmentwide information security  program to protect information and systems;    having sufficient people with the right knowledge, skills, and abilities to  execute each of these areas now and in the future; and    centralizing leadership for extending these disciplines throughout the  organization with an empowered Chief Information Officer. DHS has also developed an information technology  human capital plan that is largely consistent with federal guidance and  associated best practices. Real Property Management. However, in August 2007 we reported that DHS had yet to demonstrate full  implementation of its asset management plan and full use of asset  inventory information and performance measures in management decision  making. Cross-cutting Issues Have Hindered DHS’s Implementation Efforts

Our work has identified various cross-cutting issues that have hindered  DHS’s progress in its management areas. DHS has not always  implemented effective strategic planning efforts, has not yet issued an  updated strategic plan, and has not yet fully developed adequate  performance measures or put into place structures to help ensure that the  agency is managing for results. Accountability and transparency are  critical to the department effectively integrating its management functions  and implementing its mission responsibilities. Since we highlighted this issue last year to  this subcommittee, our access to information at DHS has improved. Such a transformation is a difficult  undertaking for any organization and can take, at a minimum, 5 to 7 years  to complete even under less daunting circumstances. Nevertheless, DHS’s 5-year anniversary provides an opportunity for the  department to review how it has matured as an organization. As part of  our broad range of work reviewing DHS management and mission  programs, we will continue to assess in the coming months DHS’s progress  in addressing high-risk issues. In particular, we will continue to assess the  progress made by the department in its transformation and information  sharing efforts, and assessing whether any progress made is sustainable  over the long term.
Why GAO Did This Study

The Department of Homeland Security (DHS) began operations in March 2003 with missions that include preventing terrorist attacks from occurring within the United States, reducing U.S. vulnerability to terrorism, minimizing damages from attacks that occur, and helping the nation recover from any attacks. GAO has reported that the implementation and transformation of DHS is an enormous management challenge. GAO's prior work on mergers and acquisitions found that successful transformations of large organizations, even those faced with less strenuous reorganizations than DHS, can take at least 5 to 7 years to achieve. This testimony addresses (1) the progress made by DHS in implementing its management functions; and (2) key issues that have affected the department's implementation efforts. This testimony is based on GAO's August 2007 report evaluating DHS's progress between March 2003 and July 2007; selected reports issued since July 2007; and GAO's institutional knowledge of homeland security and management issues.

What GAO Found

Within each of its management areas--acquisition, financial, human capital, information technology, and real property management--DHS has made some progress, but has also faced challenges. DHS has recognized the need to improve acquisition outcomes and taken some positive steps to organize and assess the acquisition function, but continues to lack clear accountability for the outcomes of acquisition dollars spent. The department also has not fully ensured proper oversight of its contractors providing services closely supporting inherently government functions. DHS has designated a Chief Financial Officer and taken actions to prepare corrective action plans for its internal control weaknesses. However, DHS has been unable to obtain an unqualified audit opinion of its financial statements, and for fiscal year 2007 the independent auditor identified significant deficiencies in DHS's internal control over financial reporting. DHS has taken actions to implement its human capital system by, for example, issuing a departmental training plan and human capital operational plan. Among other things, DHS still needs to implement a human capital system linked to its strategic plan, establish a market-based and more performance-oriented pay system, and seek more routine feedback from employees. DHS has taken actions to develop information technology management controls, such as developing an information technology human capital plan and developing policies to ensure the protection of sensitive information. However, DHS has not yet fully implemented a comprehensive information security program or a process to effectively manage information technology investments. DHS has developed an Asset Management Plan and established performance measures consistent with Federal Real Property standards. However, DHS has yet to demonstrate full implementation of its Asset Management Plan or full use of asset management inventory information. Various cross-cutting issues have affected DHS's implementation efforts. For example, DHS has not yet updated its strategic plan and put in place structures to help it manage for results. Accountability and transparency are critical to effectively implementingDHS's management functions. GAO has experienced delays in obtaining access to needed information from DHS, though over the past year, GAO's access has improved. GAO is hopeful that planned revisions to DHS's guidance for working with GAO will streamline our access to documents and officials. DHS's 5 year anniversary provides an opportunity for the department to review how it has matured as an organization. As part of our broad range of work, GAO will continue to assess DHS's progress in addressing high-risk issues. In particular, GAO will continue to assess the progress made by the department in its transformation efforts and whether any progress made is sustainable over the long term.