General Lack of Uniform Guidance on Risk Management

Although the Homeland Security Act and subsequent strategies advocate  the use of risk management to protect the nation’s critical infrastructure  and key resources, they did not define how this was to be accomplished. Homeland Security Presidential Directive 7 (HSPD-7) directed the  Secretary of the Department of Homeland Security (DHS) to establish  uniform policies, approaches, guidelines, and methodologies integrating  federal infrastructure protection and risk management activities. Although risk  management has long been used for assessing risk in some sectors, such  as environmental issues, health care, finance, and the insurance industry,  the application of risk management principles to the homeland security  area is relatively new. Methodology for Developing a Risk Management Framework

Given that there is no established universally agreed upon set of  requirements or processes for a risk management framework specifically  related to homeland security and combating terrorism, we developed a  framework that would be applicable by reviewing, analyzing, and  synthesizing several sources of information. We consulted the Government Performance and Results  Act (GPRA) of 1993; the Government Auditing Standards, 2003 Revision,  GAO’s Standards for Internal Control in the Federal Government  (November 1999); guidance from the Office of Management and Budget  (OMB); the work of the President’s Commission on Risk Management;  consulting papers; and the enterprise risk management approach of the  Committee of Sponsoring Organizations (COSO) of the Treadway  Commission. Currently, it is difficult to translate plans and actions into a clear sense of  how we are progressing in making our nation more secure. Criticality assessments  are important because they provide, in combination with the framework’s  threat and risk assessments, the basis for prioritizing which assets require  greater protection relative to finite resources and provide information for  later stages in the risk management process. When dealing with Bayesian probability estimates,  this is critical. Ideally, a risk management strategy would also identify appropriate  mechanisms to allocate resources, such as grants based on identified  needs. Cost-benefit analysis—-part of the management decision-making  process in which the costs and benefits of each countermeasure  alternative are compared and the most appropriate alternative is  selected. It is a function of threat, vulnerability, and  consequence. Related GAO Products

Critical Infrastructure Protection: Challenges in Addressing  Cybersecurity. Combating Terrorism: DOD Efforts to Improve Installation  Preparedness Can Be Enhanced with Clarified Responsibilities and  Comprehensive Planning. Information Security: Progress Made, but Challenges Remain to Protect  Federal Systems and the Nation’s Critical Infrastructures. Building Security: Interagency Security Committee Has Had Limited  Success in Fulfilling Its Responsibilities. Maritime Security

Coast Guard: Progress Being Made on Addressing Deepwater Legacy  Asset Condition Issues and Program Management, but Acquisition  Challenges Remain. Coast Guard: Observations on Agency Priorities in Fiscal Year 2006  Budget Request. Homeland Security: Challenges Facing the Department of Homeland  Security in Balancing its Border Security and Trade Facilitation  Missions. Coast Guard: Challenges during the Transition to the Department of  Homeland Security. Homeland Security: Challenges Facing the Coast Guard as It  Transitions to the New Department. Homeland Security: Key Elements of a Risk Management Approach.
Why GAO Did This Study

Congress and the President have called for various homeland security efforts to be based on risk management--a systematic process for assessing threats and taking appropriate steps to deal with them. GAO examined how three Department of Homeland Security (DHS) components were carrying out this charge: the Coast Guard, which has overall responsibility for security in the nation's ports; the Office for Domestic Preparedness (ODP), which awards grants for port security projects; and the Information Analysis and Infrastructure Protection Directorate (IAIP), which has responsibility for developing ways to assess risks across all types of critical infrastructure. GAO's work focused on identifying the progress each DHS component has made on risk management and the challenges each faces in moving further.

What GAO Found

The three DHS components GAO studied varied considerably in their progress in developing a sound risk management framework for homeland security responsibilities. The varied progress reflects, among other things, each component's organizational maturity and the complexity of its task. The Coast Guard, which is furthest along, is the component of longest standing, being created in 1915, while IAIP came into being with the creation of the Department of Homeland Security in 2003. IAIP, which has made the least progress, is not only a new component but also has the most complex task--addressing not just ports but all types of infrastructure. The Coast Guard and ODP have a relatively robust methodology in place for assessing risks at ports; IAIP is still developing its methodology and has had several setbacks in completing the task. All three components, however, have much left to do. In particular, each component is limited in its ability to compare and prioritize risks. The Coast Guard and ODP can do so within a port but not between ports; IAIP has not demonstrated that it can do so either within or between all infrastructure sectors. Each component faces many challenges in making further progress. Success will depend partly on continuing to improve various technical and management processes that are part of risk management. For example, obtaining better quality data from intelligence agencies would help DHS components estimate the relative likelihood of various types of threats--a key element of assessing risks. In the longer term, progress will depend increasingly on how well risk management is coordinated across agencies, because current approaches in many ways are neither consistent nor comparable. Also, weaving risk-based data into the annual budget cycle of program review will be important. Supplying the necessary guidance and coordination is what the Department of Homeland Security was set up to do and, as the Secretary of Homeland Security has stated, what it now needs increasingly to address. This is a key issue for the department as it seeks to identify relative risks and take appropriate actions related to the nation's homeland security activities.