One element of SBI is SBInet, the  program within CBP that is responsible for developing a comprehensive  border protection system. The SBInet program is managed by the SBInet  Program Management Office (PMO). Moreover, the expenditure plan did not include a baseline measure of  miles under control of the border. SBInet Has Followed Some but Not All Federal Acquisition Requirements and Related Best Practices

Our statement will now focus on DHS’s use of federal acquisition  requirements and related program management best practices. As of December 2006, SBInet was using several acquisition best practices. However, we reported that the SBInet systems integration contract did  fully satisfy an acquisition requirement to contain a specific number of  units that may be ordered or a maximum dollar value. However, he stated that he was committed to putting these processes in  place and further stated that the program plans to develop a plan for  defining and implementing critical acquisition planning processes by the  spring of 2007. SBInet’s Acquisition Approach Calls for Considerable Concurrency that Introduces Additional Risk

The SBInet PMO plans to execute SBInet activities through a series of  concurrent task orders that will be managed by a mix of government and  contractor staff. SBI and  SBInet officials told us that they understand the risks inherent in  concurrency and are addressing these risks. However, as of December  2006, they had not provided evidence that identified the dependencies  among their concurrent activities and that they were proactively managing  the associated risk. We found that Congress and DHS are not in the best  position to use the plan as a basis for measuring program success,  accounting for the use of current and future appropriations, and holding  program managers accountable for achieving effective control of the  southwest border because the plan has not provided information on  explicit and measurable commitments relative to the capabilities,  schedule, costs, and benefits associated with individual SBInet program  activities. Specifically, DHS needs to provide sufficient details on such  things as planned activities and milestones, anticipated costs and staffing  levels, and expected mission outcomes. DHS has not fully established the capabilities needed to effectively  mitigate risks and to successfully manage the program. We reported that  although the SBInet contract was generally competed in accordance with  federal requirements, the contract does not fully satisfy federal  regulations. DHS’s approach to SBInet introduces additional risk because the  program’s schedule entails a high level of concurrency. With multiple  related and dependent projects being undertaken simultaneously, SBInet  is exposed to possible cost and schedule overruns and performance  problems. Without assessing this level of concurrency and how it affects  project implementation, SBInet runs the risk of not delivering promised  capabilities and benefits on time and within budget.
Why GAO Did This Study

This testimony summarizes GAO's February 2007 report on SBInet, one element of the Department of Homeland Security's (DHS) Secure Border Initiative (SBI). SBInet is responsible for developing a comprehensive border protection system. By legislative mandate, GAO reviewed SBInet's fiscal year 2007 expenditure plan. This testimony focuses on (1) the extent that the plan provided explicit and measurable commitments relative to schedule and costs, (2) how DHS is following federal acquisition regulations and management best practices, and (3) concurrency in SBInet's schedule. GAO assessed the plan against federal guidelines and industry standards and interviewed program officials.

What GAO Found

SBInet's December 2006 expenditure plan offered a high-level and partial outline of a large and complex program that forms an integral component of the broader multiyear initiative. However, the SBInet expenditure plan, including related documentation and program officials' statements, lacked specificity on such things as planned activities and milestones, anticipated costs and staffing levels, and expected mission outcomes. This, coupled with the large cost and ambitious time frames, adds risk to the program. Without sufficient and reliable information on program goals, status and results, Congress and DHS are not in the best position to use the plan as a basis for assessing program outcomes, accounting for the use of current and future appropriations, and holding program managers accountable for achieving effective control of the border. As of December 2006, SBInet was using, at least to some extent acquisition best practices, but DHS had not fully established the range of capabilities needed to effectively mitigate risks and to successfully manage the program. To its credit, the SBInet contract was generally competed in accordance with federal requirements. However, the SBInet contract does not fully satisfy the federal regulatory requirement to specify a maximum dollar value or the number of units that may be ordered. We also reported that important management controls provided for in Office of Management and Budget (OMB) guidance and best practices were not yet in place, although the program manager stated that he was committed to doing so. Until they are in place, the program is at increased risk of failure. DHS's plan to execute SBInet activities through a series of concurrent task orders introduces additional risk. With multiple related and dependent projects being undertaken simultaneously, SBInet is exposed to possible cost and schedule overruns and performance problems. Without assessing this level of concurrency and how it affects project implementation, SBInet runs the risk of not delivering promised capabilities and benefits on time and within budget. SBI and SBInet officials told us that they understand the risks inherent in concurrency and are addressing these risks. However, as of December 2006, they had not provided evidence that identified the dependencies among their concurrent activities and that they were proactively managing the associated risk.