In support of its diverse missions, DHS plans to spend  about $5.6 billion in fiscal year 2012 to deploy and maintain over 360 IT  programs to perform both mission-critical and support functions, which  frequently must be coordinated among components, as well as among  external entities. DHS’s New IT Governance Process Is Generally Consistent with Best Practices

DHS has defined a vision for its new IT governance process, which  includes a three-tiered oversight structure that defines distinct roles and  responsibilities from the program through the department. While it is important to conduct pilots to test processes and  identify lessons learned, until DHS finalizes its procedures associated  with the new IT governance, it will have less assurance that the  governance will be consistent with best practices and address previously  identified weaknesses in investment management. The  program health assessments look at individual programs’ health in  executing and carrying out the program. Specifically, consistent with OMB guidance calling for the  CIO to play a significant role in the oversight of the portfolio of IT  programs, DHS’s draft procedures note that ESCs overseeing IT  programs must include the DHS CIO, a component CIO, or a designated  executive representative from a CIO office. In addition, DHS’s new IT governance framework and the associated  policies and procedures are generally consistent with best practices for  managing projects and portfolios identified in GAO’s ITIM framework, with  two practices partially addressed and seven others fully addressed;  however, the procedures have not been finalized. According to officials, the policies and procedures supporting DHS’s new  IT governance have not been finalized because the focus has been on  piloting the new governance process. While the use of pilots is valuable  in testing processes and identifying lessons learned, until DHS finalizes  the policies and procedures associated with the new IT governance, the  department will have less assurance that its new IT governance will be  consistent with best practices and address previously identified  weaknesses in investment management. DHS Has Implemented Aspects of Its New Structure, but Has Not Fully Followed Best Practices

DHS has begun to implement components of the IT governance  framework. However, the department has not yet developed an implementation plan. DHS Has Yet to Fully Define Processes for Evaluating Its Implementation Efforts

According to best practices, when implementing an IT governance  framework, it is important to evaluate the implementation efforts by,  among other things, developing measures to assess progress in meeting  objectives. To the department’s credit, the vision is  generally consistent with guidance and with best practices for managing  projects and portfolios. Recommendations for Executive Action

To implement an effective IT governance strategy, we recommend that  the Secretary of Homeland Security direct the appropriate officials to  finish defining the new IT governance process by  finalizing the IT governance policies and procedures and ensuring  they fully address or reference existing documents that address the  following: how the IRB is to maintain responsibility for lower-level board  activities; and investment selection and prioritization criteria. Agency Comments and Our Evaluation

DHS’s Director for the Departmental GAO-OIG Liaison Office provided  written comments on a draft of this report (reprinted in appendix II). He also stated that the  department concurred with the recommendations and estimated it would  address them by September 30, 2013. Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to (1) describe the Department of  Homeland Security’s (DHS) new information technology (IT) governance  process and associated policies and procedures, and assess them  against best practices; and (2) determine progress made in implementing  the new approach and how DHS’s implementation efforts comport with  relevant best practices.
Why GAO Did This Study

DHS has one of the largest IT budgets in the federal government. In fiscal year 2012, DHS plans to spend about $5.6 billion to, among other things, acquire, implement, and operate approximately 360 IT programs, including about 83 major programs, which are intended to assist in carrying out its diverse missions. With such a large portfolio of IT programs, it is important to ensure that the appropriate governance exists so that the programs meet their cost, schedule, and performance goals and continue to support the departments strategies and objectives. In line with this, DHS has been working to define and implement a new IT governance process.
GAO was asked to (1) describe DHS's new IT governance process and associated policies and procedures, and assess them against best practices; and (2) determine progress made in implementing the new process and how DHSs implementation efforts comport with relevant best practices. To do so, GAO analyzed relevant documentation and interviewed DHS officials responsible for defining and implementing the new governance process.

What GAO Found

The Department of Homeland Security (DHS) has defined a vision for its new information technology (IT) governance process, which includes a tiered oversight structure that defines distinct roles and responsibilities throughout the department. The new governance framework and the associated policies and procedures are generally consistent with recent Office of Management and Budget (OMB) guidance and with best practices for managing projects and portfolios identified in GAOs IT Investment Management framework, with two practices partially addressed and seven others fully addressed. For example, consistent with OMB guidance calling for the Chief Information Officer (CIO) to play a significant role in overseeing programs, DHSs draft procedures require that lower-level boards overseeing IT programs include the DHS CIO, a component CIO, or a designated executive representative from a CIO office. In addition, consistent with practices identified in GAOs IT Investment Management framework, DHSs draft procedures identify key performance indicators for gauging portfolio performance. However, DHSs policies and procedures have not yet been finalized, because, according to officials, the focus has been on piloting the new governance process. While it is important to conduct pilots to test processes and identify lessons learned, until the department finalizes the policies and procedures associated with the new IT governance, it will have less assurance that its new IT governance will be consistent with best practices and address previously identified weaknesses in investment management.
DHS has begun to implement aspects of its new governance process. For example, it has established several governance entities and conducted program health assessment reviews for all of its major IT programs. In implementing its new governance, the department has generally followed key industry best practices, such as establishing an implementation team; however, the department has not fully followed other practices, including developing a mechanism to capture lessons learned. The table below summarizes GAOs assessment of DHSs implementation efforts. Until the department fully addresses these practices, its implementation approach may be less effective than intended.

What GAO Recommends

To implement an effective IT governance process, GAO recommends that DHS finalize associated policies and procedures, and fully follow best practices for implementing the process. In comments on a draft of this report, DHS concurred with GAOs recommendations and estimated it would address them by September 2013.