Under the 9/11 Commission Act, DHS is responsible  for developing the QHSR and for submitting a report that is to include  multiple elements, such as: a description of the threats to the assumed or  defined national homeland security interests of the United States; the  national homeland security strategy, including a prioritized list of the  critical homeland security missions of the United States; an assessment  of the organizational alignment of DHS with the applicable national  homeland security strategy and the homeland security mission areas  outlined; and a discussion of the status of cooperation among federal  agencies in the effort to promote national homeland security, among other  elements. DHS solicited input from various stakeholder groups in conducting the  second QHSR. DHS’s lack of documentation also limits the reproducibility and  defensibility of the results, since the assessment cannot easily be  validated or the assumptions tested, further hindering DHS’s ability to  improve future iterations of the assessment. The 2013 risk management supplement to the NIPP states that  comparing and prioritizing the risks faced by different entities helps  identify where risk mitigation is most needed and determines and helps  justify the selection of the most cost-effective risk management options. The QHSR risk assessment describes a  wide range of homeland security challenges and is a valuable step toward  using risk information to prioritize and select risk management activities. Without determining and communicating prioritized risk analysis  outcomes, DHS is missing an opportunity to more efficiently implement  programs, strategies, and policies to mitigate risk and is limited in its  ability to identify the resources required for addressing different levels and  types of risks. DHS Budget Request and Performance Measures Align with QHSR Mission Goals

		DHS’s Budget Request Aligns with the QHSR, and DHS is Taking Actions to Account for its Spending by Mission Area

The Department’s annual budget request was generally presented in  alignment with the QHSR mission areas, but DHS has faced challenges  accounting for its spending by mission, which it is taking actions to  address. Time Constraints Present in First QHSR Persisted in Second QHSR

In 2011, we recommended that DHS provide more time for consulting  with stakeholders during the QHSR process to help ensure that  stakeholders have the time needed to review QHSR documents and  provide input into the review. Federal and nonfederal survey respondents indicated, however, that  QHSR stakeholder outreach meetings did not allow for interactive  exchange between stakeholders and DHS officials. In the narrative  responses to our survey, 43 of 61 respondents to one question in our  survey stated that collaboration with stakeholders could be improved. For  example, one survey respondent noted that stakeholders were asked to  react to information provided by DHS rather than participating in  formulating the approach and execution of the studies. In addition, DHS’s 2014 QHSR After  Action Report noted that the online tools were used to validate study  findings instead of informing them as originally planned. By not fostering interactive communication with federal and nonfederal  stakeholders, DHS may have missed opportunities to fully engage the  entire homeland security enterprise and thereby may not have fully  informed the QHSR effort. To determine the extent to which DHS has aligned its budget and  performance measures with the mission goals in the QHSR, we analyzed  DHS documents related to the 2014 QHSR and the fiscal years 2014- 2018 Strategic Plan, including: DHS Budget in Brief documents from 2015  through 2017 to determine DHS’s budget priorities since issuance of the  first QHSR; fiscal years 2012 through 2015 Future Years Homeland  Security Program (FYHSP) reports; excerpts from DHS’s fiscal years  2017-2021 and 2018-2022 resource planning guidance to determine the  extent to which budget guidance reflects the DHS missions and goals;  and DHS reports on its progress implementing a new common  appropriations structure. The comments received from these respondents are  not generalizable to the entire group of stakeholders, but the feedback  provided insights into stakeholder perspectives on how QHSR  stakeholder consultations were conducted and how they could be  improved.
Why GAO Did This Study

Homeland security threats continue to evolve and include challenges ranging from terrorist attacks to natural disasters, emphasizing the need for DHS to periodically examine and strengthen the nation's homeland security strategy. Further, the Implementing Recommendations of the 9/11 Commission Act of 2007 requires DHS to conduct such a review every 4 years. GAO reported in 2011 on DHS's first QHSR and recommended DHS provide sufficient time for stakeholder consultations and examine how risk information could be used to prioritize mission efforts. DHS issued its second QHSR in 2014.
GAO was asked to assess the QHSR. This report addresses the extent to which DHS (1) examined and used risk information to inform the QHSR and its implementation, (2) aligned its budget and performance measures to QHSR mission goals, and (3) collaborated with stakeholders to develop the QHSR. GAO analyzed relevant statutes and QHSR documentation; conducted a nongeneralizable survey of DHS-identified federal and nonfederal QHSR stakeholders, receiving responses from 93 of the 182 QHSR stakeholders it contacted; and interviewed officials from DHS, federal, and nonfederal entities.

What GAO Found

The Department of Homeland Security (DHS) assessed risk for the second Quadrennial Homeland Security Review (QHSR) and considered threats, vulnerabilities, and consequences; however, DHS did not document how its various analyses were synthesized to generate results, thus limiting the reproducibility and defensibility of the results. Without sufficient documentation, the QHSR risk results cannot easily be validated or the assumptions tested, hindering DHS's ability to improve future assessments. In addition, the QHSR describes homeland security hazards, but does not rank those hazards or provide prioritized strategies to address them. Comparing and prioritizing risks helps identify where risk mitigation is most needed and helps justify cost-effective risk management options. Without determining prioritized risk outcomes, DHS is missing an opportunity to more efficiently mitigate risk or identify the resources required for addressing different levels and types of risks.
The President's fiscal years 2015 and 2016 budget requests for DHS were generally presented in alignment with the QHSR. However, DHS has faced challenges accounting for its spending by mission, which it is taking actions to address, such as developing a new common appropriation structure to better link the department's funding request to the execution of its missions. DHS also developed performance measures for all of the QHSR mission areas.
DHS expanded its stakeholder outreach efforts, but 43 of 61 stakeholders who provided narrative responses to one question in GAO's survey stated that collaboration with stakeholders could be improved. For example, one respondent reported that stakeholders were asked to react to information provided by DHS rather than assist in formulating the QHSR approach and execution. DHS officials reported being limited by staff, time, and other constraints, and thus directed stakeholders to provide feedback via various web-based forums. Although the online forums allowed DHS to reach 2,000 representatives during its 2014 QHSR development process, DHS's QHSR After Action Report noted that the tools were used to validate study findings instead of informing them. Without fostering interactive communication, DHS may miss opportunities to incorporate stakeholder perspectives from the entire homeland security enterprise and thereby may not have fully informed the QHSR effort.

What GAO Recommends

GAO is making four recommendations, including that for future QHSRs DHS improve its risk assessment documentation, prioritize risks, and ensure stakeholder meetings are interactive. DHS concurred with our recommendations.