According to CBP,  it is one of the largest, most important law enforcement systems currently  in use, and is the primary system available to CBP officers and agents  from other departments for use in determining the admissibility of persons  wishing to enter the country. TECS’ obsolescence also makes it difficult and expensive to  maintain and support. DHS agreed with our recommendation. CBP TECS Modernization Scope Defined, Schedule and Cost of Both Modernization Programs Are Unclear

CBP has defined the scope for its modernization program, but its  schedule and cost continue to change and are being revised. Further, ICE  is overhauling the scope, schedule, and cost of its program after  discovering that its initial solution is not technically viable. Thus, it is  unclear whether these programs are on track to deliver planned  functionality by September 2015. According to CBP, this project’s functionality  was fully deployed to all air and sea ports of entry in 2011, and was  fully deployed to all land ports of entry in 2013. Specifically, the program is revising  its acquisition program baseline for a second time in under a year. According to program officials in June 2013, CBP is in the process of  again revising its program baseline, and plans to do so by September  2013. TECS Modernization’s Risk Management Is Generally Consistent with Leading Practices, but Requirements Management Has Had Mixed Results

Both agencies have generally implemented risk management practices,  but they have had mixed results in managing requirements for their  programs. While they have managed many of the risks in accordance  with recognized leading practices, neither agency has identified all known  risks and escalated them for timely review by senior management. Further, while CBP’s requirements management processes and practices  are largely consistent with leading practices, key requirements activities  were well underway before such practices were established. In addition,  ICE was operating without documented requirements management  guidance for several years, and its requirements development and  management activities were mismanaged as a result. ICE has recently  developed guidance that is consistent with leading practices, but has not  yet implemented it. In order to meet its schedule  commitments, ICE decided to eliminate or defer about 70 percent of the  original requirements for Release 1. DHS’s Governance Bodies Have Taken Actions Aligned with Leading Practices, but Incomplete and Inaccurate Data Have Limited Their Effectiveness

Leading practices that we and others have identified note that oversight  is a critical element of an investment’s life cycle, and that to be effective,  oversight and governance bodies should, among other things, monitor a project’s performance and progress toward predefined cost ensure that corrective actions are identified and assigned to the  appropriate parties at the first sign of cost, schedule, and/or  performance problems; ensure that these corrective actions are tracked until the desired  outcomes are achieved; and  rely on complete and accurate data to review the performance of IT  projects and systems against stated expectations, including  comparing estimated schedule time frames to actual schedule  (including schedule slippages and/or compressions) and comparing  estimated costs with funds spent or obligated to date, any changes in  funding, and the impact of these changes. In its most recent program health  assessments, the Enterprise Business Management Office partially  based its rating of moderately low risk on CBP’s use of earned value  management; however, the program manager stated to us that the  CBP program is not utilizing earned value management because  neither they nor their development contractor had the capability to do  so. Until these governance bodies base their reviews of performance on  timely, complete, and accurate data, they will be limited in their ability to  effectively provide oversight and to make timely decisions. It is  therefore imperative that the agency quickly develop and execute its  revised strategy for implementing TECS Mod—including the functionality  to be delivered, when it will be delivered, and how much it will cost. Moreover, while DHS’s various governance bodies are generally following  leading practices, they rely on data that are sometimes incomplete or  inaccurate. Recommendations for Executive Action

To improve DHS’s efforts to develop and implement its TECS Mod  programs, we recommend that the Secretary of Homeland Security direct  the CBP Commissioner to ensure that the appropriate individuals take the  following four actions:  1.  develop an integrated master schedule that accurately reflects all of  the program’s work activities, as well as the timing, sequencing, and  dependencies between them;  2.  ensure that all significant risks associated with the TECS Mod  acquisition are documented in the program’s risk and issue inventory  inventory—including acquisition risks mentioned in this report report— and are briefed to senior management, as appropriate;  3.  revise and implement the TECS Mod program’s risk management  strategy and guidance to include clear thresholds for when to escalate  risks to senior management, and implement as appropriate; and  4.  revise and implement the TECS Mod program’s requirements  management guidance to include the validation of requirements to  ensure that each is unique, unambiguous, and testable. The department described  actions planned and underway to address the seven recommendations,  and noted that it is committed to continuing its work toward full  operational capability of its TECS Mod programs to enhance functionality  for CBP, ICE, and other departments and agencies that have access to  the system. GAO staff who made  major contributions to this report are listed in appendix V.

Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to (1) determine the scope and status  of the two Department of Homeland Security (DHS) TECS Modernization  (TECS Mod) programs, (2) assess selected Customs and Border  Protection (CBP) and Immigration and Customs Enforcement (ICE)  program management practices for TECS Mod, and (3) assess the extent  to which DHS is executing effective executive oversight and governance  of the two TECS Mod programs.
Why GAO Did This Study

DHS's border enforcement system, known as TECS, is the primary system available for determining admissibility of persons to the United States. It is used to prevent terrorism, and provide border security and law enforcement, case management, and intelligence functions for multiple federal, state, and local agencies. It has become increasingly difficult and expensive to maintain because of technology obsolescence and its inability to support new mission requirements. Accordingly, in 2008, DHS began an effort to modernize the system. It is being managed as two separate programs working in parallel by CBP and ICE.
GAO's objectives were to (1) determine the scope and status of the two TECS Mod programs, (2) assess selected CBP and ICE program management practices for TECS Mod, and (3) assess the extent to which DHS is executing effective executive oversight and governance of the two TECS Mod programs.
To do so, GAO reviewed requirements documents and cost and schedule estimates, and determined the current scope, completion dates, and life cycle expenditures. GAO also reviewed risk management and requirements management plans, as well as governance bodies' meeting minutes.

What GAO Found

Customs and Border Protection (CBP) has defined the scope for its TECS (not an acronym) modernization (TECS Mod) program, but its schedule and cost continue to change; while Immigration and Customs Enforcement (ICE) is overhauling the scope, schedule, and cost of its program after discovering that its initial solution is not technically viable. CBP's $724 million program intends to modernize the functionality, data, and aging infrastructure of legacy TECS and move it to DHS's data centers. CBP plans to develop, deploy, and implement these capabilities between 2008 and 2015. To date, CBP has deployed functionality to improve its secondary inspection processes to air and sea ports of entry and, more recently, to land ports of entry in 2013. However, CBP is in the process of revising its schedule baseline for the second time in under a year. Further, portions of CBP's schedule remain undefined and the program does not have a fully developed master schedule. These factors increase the risk of CBP not delivering TECS Mod by its 2015 deadline. Regarding ICE's $818 million TECS Mod program, it is redesigning and replanning its program, having determined in June 2013 that its initial solution was not viable and could not support ICE's needs. As a result, ICE halted development and is now assessing design alternatives and will revise its schedule and cost estimates. Program officials stated the revisions will be complete in December 2013. Until ICE completes the replanning effort, it is unclear what functionality it will deliver, when it will deliver it, or what it will cost to do so, thus putting it in jeopardy of not completing the modernization by its 2015 deadline.
CBP and ICE have managed many risks in accordance with some leading practices, but they have had mixed results in managing requirements for their programs. In particular, neither program identified all known risks and escalated them for timely management review. Further, CBP's guidance defines key practices associated with effectively managing requirements, but important requirements development activities were underway before these practices were established. ICE, meanwhile, operated without requirements management guidance for years, and its requirements activities were mismanaged as a result. For example, ICE did not complete work on 2,600 requirements in its initial release, which caused testing failures and the deferral and deletion of about 70 percent of its original requirements. ICE issued requirements guidance in March 2013 that is consistent with leading practices, but it has not yet been implemented.
The Department of Homeland Security's (DHS) governance bodies have taken actions to oversee the two TECS Mod programs that are generally aligned with leading practices. Specifically, DHS's governance bodies have monitored TECS Mod performance and progress and have ensured that corrective actions have been identified and tracked. However, the governance bodies' oversight has been based on sometimes incomplete or inaccurate data, and therefore the effectiveness of these efforts is limited. For example, one oversight body rated CBP's program as moderately low risk, based partially on the program's use of earned value management, even though program officials stated that neither they nor their contractor had this capability. Until these governance bodies base their performance reviews on timely, complete, and accurate data, they will be constrained in their ability to effectively provide oversight.

What GAO Recommends

GAO is recommending DHS improve its efforts to manage requirement and risk, as well as its governance of the TECS Mod programs. DHS agreed with all but one of GAO's eight recommendations, and described actions planned and underway to address them.