	DHS Has Updated Its Strategy for Addressing Its High- Risk Designation

Since January 2011, DHS has continued to update and strengthen its  strategy for how the department plans to address our high-risk  designation and resolve its management challenges. In January 2011,  DHS provided us with its initial Integrated Strategy for High Risk  Management, which summarized the department’s preliminary plans for  addressing the high-risk area. The January 2011 strategy, which DHS  later updated in June 2011 and December 2011, was generally  responsive to the actions and outcomes we identified for the department  to address this high-risk area. Specifically, in our March 2011 written  response to DHS’s January 2011 update, we stated that  the strategy generally identified multiple, specific actions and target  completion time frames consistent with the outcomes we identified; designated senior officials to be responsible for implementing most  actions; and  included scorecards to depict, at a high level, the department’s views  of its progress in addressing each high-risk area and a framework for  monitoring implementation of corrective actions through, among other  things, quarterly meetings between DHS and us. The update demonstrated the department’s continued  leadership commitment to address the high-risk designation and  represented continued progress. For example:
DHS identified 10 root causes that cut across the four management  functions and management integration. However, elements of the update could be strengthened or  clarified to better address our high-risk criteria and the actions and  outcomes we previously identified, including (1) better defining the root  causes of its management problems; (2) clarifying the resources available  to implement corrective actions; (3) consistently reporting the progress of  its corrective actions; and (4) more clearly and consistently reporting the  progress of its key management initiatives. For example:
DHS updated its initiatives—removing two initiatives from the  management integration area and adding four new initiatives,  including human resources information technology, management  health assessment, strategic sourcing, and acquisition workforce  development;
DHS included, for the first time, ratings of the department’s progress  addressing the 31 high-risk outcomes; and
DHS enhanced its reporting and rating methodology for its key  management initiatives. Establish measures and report on progress for all initiatives. Stabilize its methodology for measuring progress. By strengthening these four aspects, we believe the December 2011  strategy, if implemented and sustained, provides a path for DHS to  address our high-risk designation. DHS Has Made Progress, but More Work Remains to Achieve High-Risk Outcomes

DHS has made progress addressing management challenges and  achieving high-risk outcomes in some key areas. Specifically, in 2010 and 2011, the DHS CIO conducted  program and portfolio reviews of hundreds of IT investments and  systems. We also reported in February 2012 that  DHS had initiated a Senior Executive Service Candidate Development  Program in May 2011 to build its senior leadership pipeline within the  department—consolidating what had been four individual leadership  programs into a single DHS-wide program—and lowered its senior  leadership vacancy rates from a peak of 25 percent in 2006 to 10  percent at the end of fiscal year 2011.In February 2011, we reported that the department put in place  common policies, procedures, and systems within individual  management functions, such as human capital, that help to integrate  its component agencies.commitment by identifying roles and responsibilities at the  departmental level for the key management initiatives it has included  in the December 2011 strategy. DHS has also demonstrated top leadership  In its December 2011 strategy, DHS presented detailed plans to address  a number of management challenges. However, in many instances, DHS  has considerable work ahead to fully implement these plans and address  these challenges. For example, in June 2010 we reported that over half  of the programs we reviewed awarded contracts to initiate acquisition  activities without component or department approval of documents  essential to planning acquisitions, such as mission need statements  outlining the specific functional capabilities required to accomplish  DHS’s mission and objectives; operational requirements; and  acquisition program baselines. For example, as we  reported in 2011, DHS faces challenges fully defining key system  investment and acquisition management policies and procedures for  IT. Due to material weaknesses in internal controls over financial  reporting, DHS was unable to provide assurance that internal controls  over financial reporting were operating effectively as of September 30,  2011. DHS continues to face challenges implementing some of its key  human capital initiatives and functions. DHS needs to continue to demonstrate sustainable progress in  integrating its management functions within and across the  department and its components and take additional actions to further  and more effectively integrate the department. We will continue to monitor  and assess DHS’s implementation and transformation efforts through our  ongoing and planned work, including the 2013 high-risk update that we  expect to issue in early 2013. Department of Homeland Security: Assessments of Selected Complex  Acquisitions.
Why GAO Did This Study

Since 2003, GAO has designated the implementation and transformation of DHS as high risk because, among other things, DHS had to combine 22 agencies, while ensuring no serious consequences for U.S. national and economic security. This high-risk area includes challenges in DHSs management functionsfinancial management, human capital, IT, and acquisitions; the effect of those challenges on implementing DHSs missions; and integrating the functions. In November 2000, GAO published criteria for removing areas from its high-risk list. In September 2010, GAO identified 31 actions and outcomes critical to addressing this high-risk area. This testimony addresses DHSs progress in (1) developing a strategy for addressing its high-risk designation and (2) achieving outcomes critical to addressing this high-risk area. This statement is based on GAO products issued from June 2007 through February 2012, including selected updates. It also includes preliminary observations from GAOs ongoing work reviewing DHSs IT governance, for which GAO reviewed documents on IT governance and interviewed officials.

What GAO Found

The Department of Homeland Security (DHS) has updated and strengthened its strategy for how it plans to address GAOs high-risk designation and resolve the departments management challenges. In January 2011, DHS provided GAO with its Integrated Strategy for High Risk Management, which summarized the departments preliminary plans for addressing the high-risk area. GAO found that this strategy, which was later updated in June and December 2011, was generally responsive to the actions and outcomes needed to address GAOs high-risk designation. For example, the January 2011 strategy generally identified multiple, specific actions and target completion time frames consistent with the outcomes GAO identified. However, the strategy did not address the root causes of problems, among other things. In its June 2011 strategy, DHS, among other things, identified 10 root causes that cut across the management areas and their integration. GAO identified ways the strategy could be strengthened, including consistently reporting the progress of its initiatives and corrective actions. In its most recent update, DHS better positioned itself to address its management challenges. For example, for the first time, DHS included ratings of the departments progress addressing its high-risk outcomes. However, GAO believes that DHS could more consistently report on available resources and corrective actions, establish measures and report on progress made for all initiatives, and stabilize its methodology for measuring progress. These changes, if implemented and sustained, provide a path for DHS to address GAOs high-risk designation.
DHS has made progress, but has considerable work ahead to achieve actions and outcomes critical to addressing this high-risk area. Among other accomplishments, DHS realigned its acquisition management functions within a new office to assess the health of major acquisitions and investments; conducted program and portfolio reviews of hundreds of information technology (IT) investments; and reduced the number of material weaknesses in internal controls. DHS also demonstrated top leadership commitment by identifying roles and responsibilities for its key management initiatives. However, DHS has more work ahead to fully implement its plans and address its management challenges. For example, in June 2010 GAO reported that over half of the programs reviewed awarded contracts to initiate acquisition activities without component or department approval of essential planning documents. In addition, DHS faces challenges fully defining key system investment and acquisition management policies and procedures. Further, as of September 30, 2011, due to material weaknesses in internal controls over financial reporting, DHS was unable to provide assurance that these internal controls were operating effectively. In September 2011 we reported that DHS also continues to face challenges implementing some key human capital initiatives, such as its workforce strategy. DHS also needs to continue to demonstrate sustainable progress in integrating its management functions within and across the department and its components, including making progress with its model for managing investments across components and management functions. GAO will continue to assess DHSs efforts to address its high-risk designation and will report its findings on the departments progress in the high-risk update that it expects to issue in early 2013.

What GAO Recommends

This testimony contains no new recommendations. GAO has made over 100 recommendations to DHS since 2003 to strengthen the departments management and integration efforts. DHS has implemented many of these recommendations and is in the process of implementing others.