	Compliance with Legislative Conditions

The US-VISIT expenditure plan partially satisfies 8 of the 11 legislative  conditions required of DHS. include a certification by the DHS Chief Procurement Officer that the  program was reviewed and approved in accordance with the department’s  investment management process and that this process fulfilled all capital  planning and investment control requirements and reviews established by  the Office of Management and Budget (OMB). While the plan did include  such a certification, it was based on information that pertains to the fiscal  year 2007 expenditure plan and the fiscal year 2009 budget submission,  rather than on the fiscal year 2008 expenditure plan, as required by the act. While the plan did provide an  accounting of operations and maintenance, and program management  costs, it did not separately identify the program’s contractor costs, as  required by the act. The plan does not satisfy the remaining three conditions that apply to  DHS. Public comments on the proposed air and sea exit solution raise a range of  additional concerns. Beyond the expenditure plan, other program planning and execution  limitations and weaknesses also confront DHS in its quest to deliver US- VISIT capabilities and value in a timely and cost-effective manner. Overall, while DHS has taken steps to implement a significant  percentage of our prior recommendations aimed at improving  management of US-VISIT, additional management improvements are  needed to effectively define, justify, and deliver a system solution that  meets program goals, reflects stakeholder input, minimizes exposure to  risk, and provides Congress with the means by which to oversee program  execution. Until these steps are taken, US-VISIT program performance,  transparency, and accountability will suffer. U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT) is a Department of  Homeland Security (DHS) program for collecting, maintaining, and sharing information on  foreign nationals who enter and exit the United States. 4  control requirements and reviews established by the Office of Management and  Budget (OMB), including Circular A-11, part 7;   a certification by the DHS Chief Information Officer (CIO) that an independent  verification and validation agent is currently under contract for the project;     a certification by the DHS CIO that the system architecture of the program is  sufficiently aligned with the department’s information systems enterprise architecture  to minimize future rework, including a description of all aspects of the architectures  that were and were not assessed in making the alignment determination, the date of  the alignment determination, and any known areas of misalignment, along with the  associated risks and corrective actions to address any such areas;  a certification by the DHS CPO that the plans for the program comply with federal  acquisition rules, requirements, guidelines, and practices, and a description of the  actions being taken to address any areas of noncompliance, the risks associated with  them, along with any plans for addressing these risks and the status of their  implementation;  a certification by the DHS CIO that the program has a risk management process that  regularly identifies, evaluates, mitigates, and monitors risks throughout the system  life cycle, and communicates high-risk conditions to agency and DHS investment  decision makers, as well as a listing of all the program’s high risks, and a status of  efforts to address them;  5   a certification by the DHS Chief Human Capital Officer (CHCO) that the human  capital needs of the program are being strategically and proactively managed, and  that current human capital capabilities are sufficient to execute the plans discussed in  the report;   a complete schedule for the full implementation of a biometric exit program or a  certification that such a program is not possible within 5 years;  a detailed accounting of operations and maintenance, contractor services, and  program management costs associated with the program. However, the plan  does not provide milestones for addressing these recommendations. In addition, the plan does not include two OIG recommendations. Observation 2: DHS reports that proposed solution would provide less security and privacy than other alternatives. However, DHS's proposed solution would have more privacy and security risks than  alternative solutions. The plan does not fully satisfy any of the  conditions that apply to DHS, either because it does not address key aspects of the  condition or because what it does address is not adequately supported or is otherwise not  reflective of known program weaknesses. To assist DHS in planning and executing US-VISIT, we recommend that the Secretary of  Homeland Security direct the department’s Investment Review Board to immediately hold  a review of the US-VISIT program that, at a minimum, addresses   The reasons for the fiscal year 2008 expenditure plan not fully addressing each of the  legislative conditions and corrective action to ensure that this does not occur for  future expenditure plans;   The adequacy of the basis for any future Air and Sea Exit solution, including the  reliability of cost estimates, implication of privacy and security issues, and addressing  key concerns raised in comments to the proposed rule;   The weaknesses in the program’s implementation of risk management, and  The weaknesses in the prime contractor’s implementation of earned value  management, including the limitations in the quality of the schedule baselines and  the schedule variance measurements. Our objectives were to (1) determine whether the plan satisfies the legislative conditions specified in the fiscal year 2008 Consolidated Appropriations Act, and (2) provide observations about the expenditure plan and management of US-VISIT.
Why GAO Did This Study

The Department of Homeland Security (DHS) has established a program known as U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT) to collect, maintain, and share information, including biometric identifiers, on certain foreign nationals who travel to and from the United States. By congressional mandate, DHS is to develop and submit an expenditure plan for US-VISIT that satisfies certain conditions, including being reviewed by GAO. GAO's objectives were to (1) determine if the plan satisfies the twelve legislative conditions and (2) provide observations about the plan and management of the program. To accomplish this, GAO assessed the plan and related DHS certification letters against each aspect of each legislative condition and assessed program documentation against federal guidelines and industry standards.

What GAO Found

The fiscal year 2008 US-VISIT expenditure plan does not fully satisfy any of the eleven conditions required of DHS by the Consolidated Appropriations Act, 2008, either because the plan does not address key aspects of the condition or because what it does address is not adequately supported or is otherwise not reflective of known program weaknesses. More specifically, of the eleven conditions, the plan partially satisfies eight. For example, while the plan includes a listing of GAO recommendations, it does not provide milestones for addressing these recommendations, as required by the act. Further, although the plan includes a certification by the DHS Chief Procurement Officer that the program has been reviewed and approved in accordance with the department's investment management process, and that this process fulfills all capital planning and investment control requirements and reviews established by the Office of Management and Budget, the certification is based on information that pertains to the fiscal year 2007 expenditure plan and fiscal year 2009 budget submission, rather than to the fiscal year 2008 expenditure plan. Moreover, even though the plan provides an accounting of operations and maintenance and program management costs, the plan does not separately identify the program's contractor services costs, as required by the act. With regard to the remaining three legislative conditions, the plan does not satisfy any of them. For example, the plan does not include a certification by the DHS Chief Human Capital Officer that the program's human capital needs are being strategically and proactively managed and that the program has sufficient human capital capacity to execute the expenditure plan. Further, the plan does not include a detailed schedule for implementing an exit capability or a certification that a biometric exit capability is not possible within 5 years. The twelfth legislative condition was satisfied by our review of the expenditure plan. Beyond the expenditure plan, GAO observed that other program planning and execution limitations and weaknesses also confront DHS in its quest to deliver US-VISIT capabilities and value in a timely and cost-effective manner. Concerning DHS's proposed biometric air and sea exit solution, for example, the reliability of the cost estimates used to justify the proposed solution is not clear, the proposed solution would provide less security and privacy than other alternatives, and public comments on the proposed solution raise additional concerns, including the impact the solution would have on the industry's efforts to improve passenger processing and travel. Moreover, the program's risk management database shows that key risks are not being managed. Finally, frequent rebaselining of one of the program's task orders has minimized the significance of schedule variances. Collectively, this means that additional management improvements are needed to effectively define, justify, and deliver a US-VISIT system solution that meets program goals, reflects stakeholder input, minimizes exposure to risk, and provides Congress with the means by which to oversee program execution. Until these steps are taken, US-VISIT program performance, transparency, and accountability will suffer.