Figure 2 provides an overview of CBP’s process for reviewing, approving,  and paying prime contractor invoices under the original SBInet program. Controls over Prime Contractor Payments for SBI Technology Component Need Improvement

Under the original SBInet program, CBP took actions intended to establish  internal controls over contractor payments. These procedures were based on  requirements in the FAR. We identified the need to improve CBP’s  controls in two important areas. Specifically, we identified the need to  improve CBP’s preventative controls over payments to the SBInet program  contractor with respect to requiring  invoices with sufficiently detailed data supporting billed costs to  facilitate effective invoice review and  specific, sufficiently detailed, risk-based invoice review procedures to  enable full, effective, and documented reviews prior to making  payments. Because CBP’s preventative controls were not fully effective, the agency  will continue to (1) be impaired in its ability to provide assurance that the  estimated $780 million already paid the prime contractor under the  original SBInet program was proper and allowable, in the correct amount,  and only for goods and services provided and (2) rely heavily on detective  controls (primarily contract closeout audits) for assurance concerning the  propriety of SBInet program disbursements. However, CBP’s policies and procedures did not require the invoices to  include any additional supporting detail. SBI’s Prime Contractor Reported That It Met Two of Its Six Small Business Subcontracting Goals

SBI’s prime contractor reported to CBP that it met two of its six small  business subcontracting goals that were identified in the prime  contractor’s subcontracting plan for the reporting period ended March 31,  2010. Consequently, the SBI prime  contractor reported that this steel purchase reduced the subcontract  award dollars available such that it was unable meet all of its small  business contract award goals for the SBI program. Additionally,  the SBI prime contractor also established an overall small business goal of  awarding 40 percent of the total SBI program contract dollars to small  businesses, which included, but was not limited to socio-economic small  business goals. As shown in table 1, as of March 31, 2010, the SBI contractor reported that  it met subcontracting participation goals for the HUBZone and Veteran- Owned small business categories. Given our findings on the design of prime contractor payment  controls under the original SBInet program, prompt action to complete  closeout audits related to payments to the prime contractor under the  original SBInet program contract and task orders is imperative. Because  preventative controls are generally more cost-efficient and effective than  detective controls, timely actions to strengthen controls in this area are  particularly important with respect to the remaining $80 million in original  SBInet program funds not yet disbursed. Further, our findings concerning  the design of CBP’s controls over payments to the prime contractor under  the recently ended SBInet program serve as “lessons learned” to be  considered in designing and implementing controls as part of the newly  announced technology portfolio approach. With respect to the new technology portfolio approach:    Document the consideration and incorporation as appropriate, of  lessons learned based on our findings on the design of controls over  payments to the original SBInet contractor in designing and  implementing contract provisions and related policies and procedures  for reviewing and approving prime contractor invoices. For the three recommendations with which it concurred in principle, DHS  expressed concerns with respect to the cost-effectiveness or  appropriateness of the recommended actions. We will  also send copies to the Secretary of Homeland Security, the Commissioner  of U.S. Customs and Border Protection, and the Director of the Office of  Management and Budget.
Why GAO Did This Study

In 2005, the Department of Homeland Security (DHS) initiated a multibillion-dollar contract to secure part of the nation's borders, the Secure Border Initiative (SBI). At that time, SBI was to include a single solution technology component; SBInet. DHS assigned the U.S. Customs and Border Protection (CBP) responsibility for overseeing the SBI contract, including SBInet. In January 2011, DHS announced that it was ending SBInet, and replacing it with a new technology portfolio. GAO was asked to (1) assess CBP's controls over payments to the prime contractor under the original SBInet program, and (2) provide information about the SBI program prime contractor's reporting against small business subcontracting goals. GAO assessed CBP controls against federal standards for internal control and relevant federal regulatory provisions, and summarized data on contractor performance against small business contracting goals.

What GAO Found

GAO's review of CBP's controls over payments to the prime contractor under the original SBInet program identified the need to improve controls in two critical areas. Specifically, GAO found that CBP's design of controls for SBInet contractor payments did not (1) require invoices with sufficiently detailed data supporting billed costs to facilitate effective invoice reviews or (2) provide for sufficiently detailed, risk-based invoice review procedures to enable effective invoice reviews prior to making payments. Although CBP's established procedures were based on the Federal Acquisition Regulation (FAR), GAO identified numerous instances of CBP contracting officers lacking detailed support in the SBInet contractor invoices they received for review. Because CBP's preventative controls were not fully effective, the agency will continue to (1) be impaired in providing assurance that the reported $780 million it already paid to the contractor under the original SBInet program was allowable under the contract, in the correct amount, and only for goods and services provided, and (2) rely heavily on detective controls (such as timely, effective contract closeout audits) for all SBInet funds disbursed. Further, timely action to improve CBP's preventative controls is critical for the estimated $80 million in original SBInet program funds yet to be disbursed. Also, in light of the recent DHS announcement that it is replacing the originally conceived SBInet program with a new technology portfoliobased approach, GAO's findings concerning weaknesses in CBP's design of controls over payments to the prime contractor under the recently ended SBInet program can serve as "lessons learned" to be considered in designing and implementing controls as part of the newly announced portfolio-based approach to providing technological support to border security. With respect to performance against small business contracting goals, the prime contractor reported that it met two of the six small business subcontracting goals for the overall SBI program. Specifically, it reported that it met subcontracting participation goals for Historically Underutilized Business Zone and Veteran-Owned small business categories, but was unable to meet the other four small business goals because a large steel purchase significantly reduced the subcontract dollars available for small businesses to participate in the SBI contract.

What GAO Recommends

GAO makes five recommendations to improve CBP controls over prime contractor payments under the SBInet and the successor technology portfolio, including actions to strengthen invoice review procedures, provide more detailed support, and to better focus closeout audits. DHS concurred in principle with all recommendations, but for some, DHS also commented on the cost-effectiveness or others' role in implementation. GAO addresses these comments in the report.