	Government-wide 2013 High Risk Update

		High-Risk Designation Removed

For our 2013 high risk update, we determined that two areas warranted  removal from the High Risk List due to the progress that had been  made—Management of Interagency Contracting and IRS Business  Systems Modernization. New High-Risk Areas

This year, we added two new areas to the High Risk List—Limiting the  Federal Government’s Fiscal Exposure by Better Managing Climate  Change Risks and Mitigating Gaps in Weather Satellite Data. In 2003, we designated implementing  and transforming the Department of Homeland Security (DHS) as high  risk because DHS had to transform 22 agencies—several with major  management challenges—into one department. Further, failure to  effectively address DHS’s management and mission risks could have  serious consequences for U.S. national and economic security. Recognizing DHS’s  progress in transformation and mission implementation, our 2011 high  risk update focused on the continued need to strengthen DHS’s  management functions (acquisition, information technology, financial  management, and human capital) and integrate those functions within  and across the department, as well as the impact of these challenges on  the department’s ability to effectively and efficiently carry out its missions. While challenges remain for DHS to address across its range of missions,  the department has made considerable progress in transforming its  original component agencies into a single cabinet-level department and  positioning itself to achieve its full potential. As a result, we narrowed the  scope of the high-risk area and changed the name from Implementing  and Transforming the Department of Homeland Security to Strengthening  the Department of Homeland Security Management Functions. Additionally, in the financial  management area, DHS has reduced the number of material weaknesses  in internal controls and obtained a qualified audit opinion on its fiscal year  2012 financial statements. We  identified 42 programs that experienced cost growth or schedule slips, or  both, with 16 of the programs’ costs increasing from a total of $19.7 billion  in 2008 to $52.2 billion in 2011—an aggregate increase of 166 percent. Further, while DHS has defined and begun to implement a vision for a  tiered governance structure to improve information technology (IT)  management, we reported in July 2012 that the governance structure  covers less than 20 percent (about 16 of 80) of DHS’s major IT  investments and 3 of its 13 portfolios. DHS has also been unable to  obtain an audit opinion on its internal controls over financial reporting, and  needs to obtain and sustain unqualified audit opinions for at least two  consecutive years on the department-wide financial statements. In doing so, it  will be important for DHS to: make continued progress in addressing the 31 actions and outcomes  and demonstrate that systems, personnel, and policies are in place to  ensure that progress can be sustained over time; maintain its current level of top leadership support and sustained  commitment to ensure continued progress in executing its corrective  actions through completion;  continue to implement its plan for addressing this high-risk area and  periodically report its progress to Congress and GAO;  closely track and independently validate the effectiveness and  sustainability of its corrective actions and make midcourse  adjustments, as needed; and monitor the effectiveness of its efforts to establish reliable resource  estimates at the department and component levels, address and work  to mitigate any resource gaps, and prioritize initiatives as needed to  ensure it has the capacity to implement and sustain its corrective  actions. Sustaining Attention on High-Risk Programs

Overall, the government continues to take high-risk problems seriously  and is making long-needed progress toward correcting them. Congress  has acted to address several individual high-risk areas through hearings  and legislation. OMB is required to provide clear milestones and periodic status reports  on progress being made and actions needed for additional progress. Moving forward, congressional  oversight and sustained attention by top administration officials will be  essential to ensure further improvement in the management and  performance of federal programs and operations and addressing high-risk  areas. IRS Business Systems Modernization

We are removing the Internal Revenue Service’s (IRS) Business Systems  Modernization (BSM) program from the High Risk List because of IRS’s  progress in addressing the significant weaknesses in information  technology (IT) and financial management capabilities that led to the  high-risk designation, and its commitment to sustaining progress in the  future. Because of the significant  progress made in addressing this high-risk area over the years, starting in  fiscal year 2012, Congress did not require the submission of an annual  expenditure plan. FEMA concurred with this  recommendation.
Why GAO Did This Study

The federal government is a large and complex entity, with about $3.5 trillion in outlays in fiscal year 2012 funding a broad array of programs and operations. GAO maintains a program to focus attention on government operations that it identifies as high risk due to their greater vulnerabilities to fraud, waste, abuse, and mismanagement or the need for transformation to address economy, efficiency, or effectiveness challenges. Since 1990, more than one-third of the areas previously designated as high risk have been removed from the list because sufficient progress was made to address the problems identified.
The biennial high risk update describes the status of high-risk areas listed in 2011 and identifies any new high-risk area needing attention by Congress and the executive branch. Solutions to high-risk problems offer the potential to save billions of dollars, improve service to the public, and strengthen the performance and accountability of the U.S. government.

What GAO Found

In the past 2 years, notable progress has been made in the vast majority of areas that were on GAO's 2011 High Risk List. Congress passed several laws and took oversight actions to help address high-risk areas. Top administration officials at the Office of Management and Budget and the individual agencies have continued to show their commitment to ensuring that high-risk areas receive attention and action. Additional progress is both possible and needed in all the high-risk areas on GAO's 2013 list.
Sufficient progress has been made to remove the high-risk designation from two high-risk areas on the 2011 list, Management of Interagency Contracting and Internal Revenue Service Business Systems Modernization . While these two areas have been removed from the list, GAO will continue to monitor them.
This year, GAO also has added two areas, Limiting the Federal Government's Fiscal Exposure by Better Managing Climate Change Risks , and Mitigating Gaps in Weather Satellite Data .
In 2003, GAO designated implementing and transforming the Department of Homeland Security (DHS) as high risk because DHS had to transform 22 agencies--several with major management challenges--into one department, and failure to address associated risks could have serious consequences. While challenges remain across its missions, DHS has made considerable progress in transforming its original component agencies into a single department. As a result, GAO narrowed the scope of the high-risk area and changed the name from Implementing and Transforming the Department of Homeland Security to Strengthening the Department of Homeland Security Management Functions .
To more fully address this high-risk area, DHS needs to further strengthen its acquisition, information technology, and financial and human capital management functions. Of the 31 actions and outcomes GAO identified as important to addressing this area, DHS has fully or mostly addressed 8, partially addressed 16, and initiated 7. Moving forward, DHS needs to, for example, do the following:
Acquisition management . Validate required acquisition documents in a timely manner, and demonstrate measurable progress in meeting cost, schedule, and performance metrics for its major programs. GAO reported in September 2012, for example, that 42 major programs experienced cost growth, schedule slips, or both, and most programs lacked foundational documents needed to manage risk and measure performance.
Information technology management . Demonstrate for at least two consecutive investment increments that actual cost and schedule performance is within established baselines, and that associated mission benefits have been achieved. DHS has begun to implement a governance structure to improve program management consistent with best practices, but the structure covers less than 20 percent of DHS's major information technology investments.
Financial management . Achieve clean opinions for at least two consecutive years on departmentwide financial statements, and implement new or upgrade existing components' financial systems. DHS received a qualified opinion on its fiscal year 2012 financial statements, and is in the early planning stages of its financial systems modernization efforts.

What GAO Recommends

The high risk report contains GAO's views on progress made and what remains to be done to bring about lasting solutions for each high-risk area. Perseverance by the executive branch in implementing GAO's recommended solutions and continued oversight and action by Congress are essential to achieving progress. GAO is dedicated to continue working with Congress and the executive branch to help ensure additional progress is made.