DHS’s Use of a Risk Management Approach to Guide Investments through the Homeland Security Grant Allocation Process Is Evolving

		DHS Uses a Risk-Based Approach in Distributing Urban Area Security Initiative Grants

Today, we issued a report on DHS’s use of risk management in distributing  the Urban Area Security Initiative (UASI) grants. For fiscal years 2006 and  2007, DHS has used risk assessments to identify urban areas that faced the  greatest potential risk, and were therefore eligible to apply for the UASI  grant, and based the amount of awards to all eligible areas primarily on the  outcomes of the risk assessment and a new effectiveness assessment. 2.) For the 2007 grant cycle, DHS no longer estimated asset-based  and geographic risk separately, considered most areas of the country  equally vulnerable to a terrorist attack, given freedom of movement within  the nation, and focused on the seriousness of the consequences of a  successful terrorist attack. We will initiate work later this year to assess the  steps TSA has taken to better prioritize its homeland security  investments in this area. While TSA has  begun to establish a methodology for determining how to analyze  and characterize the risks identified, the agency has not completed  a comprehensive risk assessment of the U.S. passenger rail system. DHS’s Progress in Using a Risk Management Approach in Making Port Security Investments Can Be Linked to Each of Three Component’s Organizational Maturity and Task Complexity

In December 2005, we reported that three DHS components responsible  for port security or infrastructure protection varied considerably in their  progress in developing a sound risk management framework for homeland  security. Our work reviewed the risk management approaches used by  three DHS components prior to DHS’s Second Stage Review and  departmental reorganization:    the Coast Guard, the lead federal agency for the security of the  nation’s ports;    Office of Domestic Preparedness (ODP), the former DHS  component responsible for administering federal homeland  security assistance programs for states and localities, including the  port security grant program, and   the Information Analysis and Infrastructure Protection Directorate  (IAIP), the former DHS component responsible for, among other  things, identifying and assessing current and future threats to the  homeland, mapping those threats against known vulnerabilities,  and offering advice on preventive and protective action. Finally, with regard to the scope of its risk  management activities, the Coast Guard’s work is specific to port  locations, where it has direct and primary responsibility for carrying out  security responsibilities. DHS Use of Risk Management in Making Investments in Other Mission Areas Varies by Degree and Application

We have assessed DHS’s risk management efforts across a number of  other mission areas in the 4 years since the department was established-- including border security, immigration enforcement, immigration services,  critical infrastructure protection, and science and technology—and found  varying degrees of consideration and application of risk management  principles in DHS’s investments in homeland security. DHS Has Not Provided Guidance for a Coordinated Risk Management Approach and More Work Remains to be done in Carrying Out Such an Approach

		DHS Has Identified the Need for a Risk-based Approach, but Efforts to Develop Guidance to Coordinate Such an Approach Have Been Hampered by Organizational Restructuring

The need for and difficulties associated with creating a coordinated,  coherent risk management approach to the nation’s homeland security  have been widely acknowledged since the events of September 11, 2001,  and the creation of DHS. Coordinating efforts across the federal government. It has taken further steps by incorporating risk management  principles to at least some degree into making homeland security grant  allocations, funding transportation and port security enhancements, and  targeting federal funding across other DHS mission areas. Strategic Budgeting: Risk Management Principles Can Help DHS  Allocate Resources to Highest Priorities. Transportation Security: Systematic Planning Needed to Optimize  Resources.
Why GAO Did This Study

Since the terrorist attacks of September 11, 2001, and the subsequent creation of the Department of Homeland Security (DHS), the federal government has provided DHS with more than $130 billion in budget authority to make investments in homeland security. However, as GAO has reported, this federal financial assistance has not been guided by a clear risk-based strategic plan that fully applies risk management principles. This testimony discusses the extent to which DHS has taken steps to apply risk management principles to target federal funding for homeland security investments (1) in making grant allocations, (2) in funding transportation and port security enhancements, (3) in other DHS mission areas, and (4) at a strategic level across DHS. This testimony summarizes previous GAO work in these areas.

What GAO Found

Risk management, a strategy for helping policymakers make decisions about assessing risk, allocating resources, and taking actions under conditions of uncertainty, has been endorsed by Congress, the President, and the Secretary of DHS as a way to strengthen the nation against possible terrorist attacks. DHS has used risk management principles to invest millions of dollars at the state and local level as part of its Urban Area Security Initiative (UASI) grants. For fiscal year 2006, DHS adopted a risk management approach to determine which UASI areas were eligible for funding. For the fiscal year 2007 grant process, DHS made substantial changes to its 2006 risk assessment model, simplifying its structure, reducing the number of variables considered, and incorporating the intelligence community's assessment of threats in candidate urban areas. The fiscal year 2007 model considers most areas of the country equally vulnerable to attack; its analysis focuses on the expected impact and consequences of successful attacks occurring in specific areas. DHS and the components of DHS responsible for transportation and port security have taken steps to apply risk management principles with varying degrees of progress. The Transportation Security Administration has not completed a methodology for assessing risk, and until the overall risk to the entire transportation sector is identified, it will be difficult to determine where and how to target limited resources to achieve the greatest security gains. The progress of each of DHS's three components responsible for port security varies according to organizational maturity and the complexity of its risk management task. The Coast Guard, created in 1915, was the most advanced in implementing a risk-based approach. Meanwhile, the Office for Domestic Preparedness (responsible for grants) and the Information Analysis and Infrastructure Protection Directorate (responsible for all sectors of the nation's critical infrastructure) were brought to or established with DHS in 2003 and lagged behind the Coast Guard in applying risk management to port security. Other DHS mission areas GAO has assessed include border security, immigration enforcement, immigration services, critical infrastructure protection, and science and technology; the extent to which a risk management approach has been implemented in each area varies. While DHS has called for using risk-based approaches to prioritize its resource investments, and for developing plans and allocating resources in a way that balances security and freedom, DHS has not comprehensively implemented a risk management approach--a difficult task. However, adoption of a comprehensive risk management framework is essential for DHS to assess risk by determining which elements of risk should be addressed in what ways within available resources.