IT Is Critical to Achieving DHS’s Mission

To accomplish its mission, DHS relies extensively on IT. Specifically, of 27 key practices in OPM’s framework, the  department’s plan and related documentation fully address 15 practices  and partially address the other 12, meaning that these 12 are missing  elements that are essential to having a well-defined and executable plan. DHS officials responsible for developing the plan attributed the missing  elements to, among other things, the department’s decision to focus its  resources on other IT priorities. These officials also stated that until the  missing elements are fully addressed, it is unlikely that the plan will be  effectively and efficiently implemented, which in turn will continue to put  DHS at risk of not having sufficient people with the right knowledge,  skills, and abilities to manage and deliver its mission-critical IT systems. In addition, the plan calls for  involving key stakeholders—such as the CIO, the CHCO, and their  component agency counterparts—in carrying out a range of workforce  planning activities, such as conducting a workforce analysis, developing  an inventory of current staff skills, and identifying the future skills that are  needed for mission-critical positions. For example, they do not include specific milestones for  when most defined activities and steps are to be completed. DHS’s plan and supporting  documentation provide for a number of leadership and knowledge  management practices. However, the plan does not fully address other  accountability-related practices. According to these officials, the agency is in  the process of developing a strategy to implement the plan. Specifically,  the department and its components are required to report quarterly to  OMB on progress in meeting certain human capital goals, such as filling  mission-critical positions and delivering training to strengthen key IT  knowledge, skills, and abilities. In this regard, we recommend that  the Secretary direct the Under Secretary and the component agency heads  to ensure that (1) IT human capital planning efforts fully satisfy relevant  federal guidance and related best practices, (2) roles and responsibilities  for implementing the resulting IT human capital plan and all supporting  plans are clearly defined and understood, (3) resources needed to  effectively and efficiently implement the plans are made available, and  (4) progress in implementing the plans is regularly measured and  periodically reported to DHS leadership and Congress. Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to determine (1) whether the  Department of Homeland Security’s (DHS) information technology (IT)  human capital plan is consistent with federal guidance and associated best  practices and (2) the status of the plan’s implementation. We evaluated this plan and supporting  documentation against selected practices in the Office of Personnel  Management’s (OPM) Human Capital Assessment and Accountability  Framework. We also interviewed (1) officials from DHS’s Offices of  the Chief Information Officer (CIO) and the Chief Human Capital Officer  (CHCO); (2) the CIO Council executive sponsor for Human Capital issues;  and (3) officials from the department’s IT Human Capital Resource Center,  which helped develop the IT human capital plan and supporting  documentation. For our second objective, we reviewed plan implementation activities  within the DHS Offices of the CIO and the CHCO and three DHS  component agencies: the Coast Guard, Customs and Border Protection,  and the Federal Emergency Management Administration. In  addition, although the supporting documents and the plan  provide for involving key stakeholders, they do not assign  stakeholders responsibility and accountability for specific  activities.
Why GAO Did This Study

In performing its missions, the Department of Homeland Security (DHS) relies extensively on information technology (IT). Recognizing this, DHS's fiscal year 2006 appropriations act required its Chief Information Officer (CIO) to submit a report to congressional appropriations committees that includes, among other things, an IT human capital plan, and the act directs GAO to review the report. GAO's review addressed (1) whether the IT human capital plan is consistent with federal guidance and associated best practices and (2) the status of the plan's implementation. In performing its review, GAO compared DHS's plan and supporting documentation with 27 practices in the Human Capital Assessment and Accountability Framework of the Office of Personnel Management, and examined plan implementation activities at three DHS component agencies.

What GAO Found

DHS's IT human capital plan is largely consistent with federal guidance and associated best practices; however, it does not fully address a number of important practices that GAO examined. Specifically, the plan and supporting documentation fully address 15 practices; for example, they provide for developing a complete inventory of existing staff skills, identifying IT skills that will be needed to achieve agency goals, determining skill gaps, and developing plans to address such gaps. They also provides for involving key stakeholders--such as the CIO, the Chief Human Capital Officer (CHCO), and component agency CIOs and human capital directors--in carrying out the skill gap analyses and other workforce planning activities. Nevertheless, elements of 12 of the 27 practices are not included in the plan or related documentation. For example, although the plan and supporting documents describe the department's IT human capital goals and steps necessary to implement them, most steps do not include associated milestones. In addition, although the plan and supporting documents provide for involving key stakeholders, they do not specifically assign these stakeholders responsibility and accountability for carrying out planned activities. These and other missing elements of the practices are important because they help ensure that the plan is implemented efficiently and effectively. DHS officials provided various reasons why the missing practices were omitted, including uncertainty surrounding the source of resources for implementing the plan and the demands of other IT priorities, such as consolidating component agency data centers. To date, DHS has made limited progress in implementing the plan, according to officials from the offices of the department's CIO and CHCO and three DHS agencies (the Coast Guard, Customs and Border Protection, and the Federal Emergency Management Agency). These officials said that they are nonetheless following several of the practices because they are required to report quarterly to the Office of Management and Budget on progress in meeting such human capital goals as filling mission-critical positions and delivering key IT training. DHS officials stated that the department's limited progress in implementing the plan was due to its focus on other priorities, and ambiguity surrounding plan implementation roles and responsibilities. Until DHS has a complete plan that fully addresses all practices and the department and components implement the plan, DHS will continue to be at risk of not having sufficient people with the right knowledge, skills, and abilities to manage and deliver the IT systems that are essential to executing the department's mission and achieving its transformation goals.