IT Is Critical to DHS’s Mission Performance

To accomplish its mission, DHS relies extensively on IT. As mentioned earlier, DHS requested about $4 billion for fiscal year 2008,  which is the third largest planned IT expenditure among federal  departments. DHS has established the management structure to effectively manage its  investments. However, the department has yet to fully define 8 of the 11  related policies and procedures defined by our ITIM framework. Specifically, while DHS has documented the policies and related  procedures for project-level management, some of these procedures do  not include key elements. In addition, the  department has yet to define most of the policies associated with  managing its IT projects as investment portfolios. Officials attributed the  absence of policies and procedures at the portfolio level to other  investment management priorities. Until DHS fully defines and documents  its policies and procedures for investment management, it risks selecting  investments that will not meet mission needs in the most cost-effective  manner. DHS Has Not Fully Executed Key Practices Associated with Effectively Controlling Investments

DHS has not fully implemented any of the key practices needed to control  investments—either at the project level or at the portfolio level. For  example, according to DHS officials and our review of the department’s  control review schedule, the investment boards have not conducted  regular reviews of investments. Further, while control activities are  sometimes performed, they are not performed consistently across  projects. In addition, because the policies and procedures for portfolio  management have yet to be defined, control of the department’s  investment portfolios is ad hoc, according to DHS officials. Officials told  us that to strengthen IT investment management, they have recently hired  a portfolio manager and are recruiting another one. Until DHS fully  implements processes to control its investments, both at the project and  portfolio levels, it increases the risk of not meeting cost, schedule, benefit,  and risk expectations. At a minimum, this should include fully defining and  documenting project-and portfolio-level policies and procedures that  address the following eight areas:    selecting new investments, including specifying the criteria and steps for  prioritizing and selecting these proposals; reselecting ongoing IT investments, including specifying the criteria and  steps for prioritizing and reselecting these investments;   overseeing (i.e., controlling) IT projects and systems, including specifying  the procedural rules for the investment boards’ operations and decision  making during project oversight;  identifying and collecting information about investments, including  assigning responsibility for the process and ownership of the information  and defining the locations for information storage;   creating and modifying IT portfolio selection criteria;    analyzing, selecting, and maintaining the investment portfolios;    assessing portfolio performance at regular intervals to reflect current    conducting postimplementation reviews of IT investments, including  defining roles and responsibilities for doing so, and specifying how  conclusions, lesson learned, and recommended management actions are  to be shared with executives and others. Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to (1) determine whether the  Department of Homeland Security (DHS) has established the management  structure and policies and procedures needed to effectively manage its  information technology (IT) investments and (2) determine whether the  department is implementing key practices needed to effectively control  these investments.
Why GAO Did This Study

The Department of Homeland Security (DHS) relies extensively on information technology (IT) to carry out its mission. For fiscal year 2008, DHS requested about $4 billion--the third largest planned IT expenditure among federal departments. Given the size and significance of DHS's IT investments, GAO's objectives were to determine whether DHS (1) has established the management structure and associated policies and procedures needed to effectively manage these investments and (2) is implementing key practices needed to effectively control them. GAO used its IT Investment Management (ITIM) framework and associated methodology to address these objectives, focusing on the framework's stages related to the investment management provisions of the Clinger-Cohen Act.

What GAO Found

DHS has established the management structure to effectively manage its investments. However, the department has yet to fully define 8 of the 11 related policies and procedures that GAO's ITIM framework defines. Specifically, while DHS has documented the policies and related procedures for project-level management, some of these procedures do not include key elements. For example, procedures for selecting investments do not cite either the specific criteria or steps for prioritizing and selecting new IT proposals. In addition, the department has yet to define most of the policies associated with managing its IT projects as investment portfolios. Officials attributed the absence of policies and procedures at the portfolio level to other investment management priorities. Until DHS fully defines and documents policies and procedures for investment management, it risks selecting investments that will not meet mission needs in the most cost-effective manner. DHS has also not fully implemented the key practices needed to actually control investments--either at the project level or at the portfolio level. For example, according to DHS officials and the department's control review schedule, DHS investment boards have not conducted regular investment reviews. Further, while GAO found that control activities are sometimes performed, they are not performed consistently across projects. In addition, because the policies and procedures for portfolio management have yet to be defined, control of the department's investment portfolios is ad hoc, according to DHS officials. Officials told GAO that they have recently hired a portfolio manager and are recruiting another one to strengthen IT investment management. Until DHS fully implements processes to control its investments, both at the project and portfolio levels, it increases the risk of not meeting cost, schedule, benefit, and risk expectations.