Component Officials Identified Billions in Non-Major Acquisitions, but Most Could Not Confidently Identify the Full Scope

DHS’s component agencies lack the information needed to effectively  oversee their non-major acquisitions because they cannot confidently  identify all of them. Several  officials indicated that their focus had been on major acquisitions  historically, and they had not turned their attention to non-major  acquisitions until more recently. Many component officials said they were  still in the process of identifying all of their non-major acquisitions, but it  was unclear when they would complete these efforts. DHS headquarters  had not established time frames for components to do so, which may  have resulted in components losing traction in their efforts. Federal  internal controls standards establish that management should obtain  relevant data from reliable sources in a timely manner. Another key  challenge involves the use of baselines, which establish a program’s  critical cost, schedule, and performance parameters. Component officials  identified 38 non-major acquisitions that were active at the start of fiscal  year 2017 (as opposed to acquisitions that have been delivered to end  users and are considered to be non-active). We found that most of the  active non-major acquisitions (23 of 38) did not have approved baselines,  and that the value of the acquisitions without baselines constituted nearly  half of the total value of the active acquisitions. At the beginning of fiscal  year 2017, some components did not require approved baselines. However, in response to our preliminary findings, in February 2017, DHS  required component leadership approve baselines for non-major  acquisitions, which should help components oversee them more  effectively. Officials from 8 of the 11 DHS components told us  they could not identify all of their non-major acquisitions. DHS leadership has also added new reporting requirements  for these acquisitions, and, in response, all components have started  entering non-major acquisition data into INVEST, DHS’s central  acquisition information system. Additionally, in response to our preliminary findings, a new policy that  DHS finalized in February 2017 includes a requirement that component  leadership approve baselines for non-major acquisitions that have not yet  achieved FOC, and states that PARM’s Executive Director will leverage  its reviews to assess whether CAEs are (a) baselining these acquisitions  in accordance with the requirement; and (b) tracking the acquisitions’  progress against cost, schedule, and performance parameters from  approved baselines. Components Have Started Entering Non-Major Acquisition Data into INVEST and Headquarters Is Taking Steps to Improve Data Reliability

As part of its efforts to increase oversight of non-major acquisitions, DHS  leadership now requires components to enter data into the INVEST  system for all non-major acquisitions valued at greater than $50 million  that have not yet reached FOC. Recommendation for Executive Action

To improve the management of DHS’s non-major acquisitions, we  recommended that the Secretary of Homeland Security direct the Under  Secretary for Management to establish a time frame for components to  identify all of their non-major acquisitions. Specifically, this  report assesses (1) the extent to which component leadership is  effectively overseeing non-major acquisitions and (2) the extent to which  DHS headquarters has helped components establish effective  management controls for non-major acquisitions. Citizenship and Immigration Services,
U.S. Coast Guard, and
U.S. Secret Service. To identify the extent to which DHS headquarters has helped components  establish effective management controls for non-major acquisitions, we  reviewed draft and final department acquisition policy, guidance, and  memos to identify how PARM and other headquarters entities contribute  to non-major acquisition management. To assess the reliability of the data in the INVEST system, we traced non- major acquisition data from INVEST to available source documents.
Why GAO Did This Study

Each year, DHS acquires a wide array of systems intended to help its component agencies execute their many critical missions. GAO has previously reported that DHS's process for managing its major acquisitions is maturing. However, non-major acquisitions (generally those with cost estimates of less than $300 million) are managed by DHS's component agencies and have not received as much oversight. Recently GAO reported on a non-major acquisition that was executed poorly, limiting DHS's ability to address human capital weaknesses.
GAO was asked to examine DHS's management of non-major acquisitions. This report assesses: (1) the extent to which component leadership is effectively overseeing non-major acquisitions; and (2) the extent to which DHS headquarters has helped components establish effective management controls for non-major acquisitions.
GAO reviewed policy and component guidance, and interviewed officials from DHS headquarters and 11 components responsible for managing non-major acquisitions. GAO also traced non-major acquisition data from DHS's central acquisition data system to source documents to assess data reliability.

What GAO Found

The Department of Homeland Security's (DHS) component agencies—such as the U.S. Coast Guard and Customs and Border Protection—lack the information needed to effectively oversee their non-major acquisitions because they cannot confidently identify all of them. They identified over $6 billion in non-major acquisitions; however, GAO found 8 of the 11 components could not identify them all. Several officials indicated that their focus had been on major acquisitions historically, and they had not turned their attention to non-major acquisitions until more recently. Many component officials said they were still in the process of identifying all of these acquisitions, but it was unclear when they would complete these efforts. DHS headquarters had not established time frames for components to do so, which may have resulted in components losing traction in their efforts. Federal internal controls standards establish that management should obtain relevant data from reliable sources in a timely manner. Another key challenge involves the use of baselines, which establish a program's critical cost, schedule, and performance parameters. Component officials identified 38 non-major acquisitions that were active at the start of fiscal year 2017 (as opposed to acquisitions that have been delivered to end users and are considered to be non-active). GAO found that most of the active non-major acquisitions (23 of 38) did not have approved baselines, and that the value of the acquisitions without baselines constituted nearly half of the total value of the active acquisitions.
At the beginning of fiscal year 2017, some components did not require approved baselines. However, in response to GAO's preliminary findings, in February 2017, DHS required component leadership to approve baselines for non-major acquisitions, which should help components oversee them more effectively.
DHS headquarters is taking steps to help components establish more effective management controls for non-major acquisitions. In 2015, DHS headquarters officials established a process to review them annually. In February 2017, in response to GAO's preliminary findings, DHS established that components shall use the annual reviews to assess the extent to which non-major acquisitions are on track to meet cost, schedule, and performance parameters from approved baselines. DHS leadership has also established ongoing reporting requirements for non-major acquisitions. All components have started entering non-major acquisition data into DHS's central acquisition information system, and headquarters officials are taking steps to improve the reliability of these data.

What GAO Recommends

GAO recommended that DHS headquarters establish time frames for components to identify all non-major acquisitions. DHS concurred with GAO's recommendation and directed components to identify all non-major acquisitions by October 31, 2017.