The number and cost of acquisition programs  vary by component. We recommended,  among other things, that DHS require that major acquisition programs’  technical requirements be well-defined and conduct key technical  reviews prior to approving programs to initiate product development,  in accordance with acquisition best practices. DHS concurred with our  recommendation, but has not yet implemented it. One of the Seven Selected Components Has a Policy for Requirements Development

Among the seven DHS components we reviewed, each of which is  responsible for managing major acquisition programs, only the U.S. Coast  Guard has a formalized policy in place for developing requirements. For example:
Border Patrol finalized a requirements management process policy on  June 12, 2018 that defined roles and responsibilities throughout the  process. Without Requirements Policies, Components Risk Failing to Meet Mission Needs

In the absence of component-level policies, we found that components  are less likely to establish the base of knowledge needed for  requirements development. Without a focus on the capability, the program risked not  meeting the capability gap and end user need. The three components that established requirements organizations did so  at various times. Officials from  Immigration and Customs Enforcement, National Protection and  Programs Directorate, and U.S. Regardless of size, components  need to ensure that requirements development is independent of  acquisitions in order to guard against possible bias by acquisition officials  toward a specific materiel solution. A Separate, Independent Requirements Organization Is Critical to Addressing Capability Gaps

According to federal standards for internal controls, independent lines of  authority should develop requirements and manage acquisitions  separately. Without a requirements development office to guide  development, program officials stated that they generated  approximately 25,000 requirements, which consisted of both technical  and operational requirements to address the capability gaps that they  were unable to prioritize. The document from 2015 did not contain this parameter. Majority of Selected Components Have Not Assessed Workforce Needs or Established Training for Requirements Development

We found that two components have assessed requirements workforce  needs, and one has provided requirements specific training. We have  previously found the importance of having the appropriate workforce as a  factor in meeting an agency’s mission. Until the components assess  their needs and take appropriate action, acquisition programs may  continue to be at risk of not meeting end user needs, as they will not have  a trained workforce to develop requirements. However, DHS remains at risk until such training  and certification are fully implemented throughout DHS and its  components. Rather, components have  prioritized obtaining funding and starting acquisition programs over  requirements development. Appendix I: Objectives, Scope, and Methodology

This report discusses (1) how often selected Department of Homeland  Security (DHS) programs changed requirements; and assesses the  extent to which the selected components have (2) developed policies for  requirements development, (3) established independent requirements  organizations, and (4) taken steps to assess and train a requirements  workforce. We selected a non-generalizable sample of  programs based on different factors, including their acquisition phase,  component, acquisition level, and whether they were information  technology (IT) or non-IT. We also interviewed component-level officials  to understand the extent to which they have implemented requirements  development policies, organizations, and training for their components.
Why GAO Did This Study

GAO has previously found that DHS's components had acquisition programs that did not meet requirements and that those requirements were, in some cases, poorly defined. Poorly defined requirements increase the risk that acquisitions will not meet the needs of users in the field—for example, border patrol agents or emergency responders.
GAO was asked to examine DHS components' practices for developing requirements. This report addresses the policies, organizations, and workforce that selected DHS components use to develop requirements for their acquisition programs.
GAO selected seven DHS components with significant acquisition programs and a non-generalizable sample of programs—based on cost, component, and acquisition phase—as case studies. GAO analyzed policies and program documentation; and interviewed DHS and component officials, as well as end users of DHS programs. GAO compared components' practices to industry best practices and federal internal control standards.

What GAO Found

GAO has identified several best practices to ensure that operational requirements for acquisitions are well-defined and found some Department of Homeland Security's (DHS) components met them while others did not. These practices include a formal policy for developing requirements, an independent requirements organization, and an understanding of workforce needs and training. The table below shows GAO's assessment of seven of DHS's components against these practices.
Establishing a formal policy to guide the process is critical to developing well-defined requirements. However, only the Coast Guard has an approved policy for requirements development among the seven components reviewed. Without well-defined requirements, components are at risk of acquiring capabilities that will not meet mission needs. DHS officials told GAO that components have generally prioritized obtaining funding and starting programs over developing requirements.
Three components have a requirements development organization, separating requirements from acquisition in addressing capability gaps. Officials from components without such organizations told GAO that they have fewer major acquisitions and rely on DHS to assist in requirements development. DHS policy and best practices, however, maintain the importance of this separation regardless of the number of major acquisitions to guard against possible bias by acquisition officials toward a specific materiel solution.
Two components have assessed requirements development workforce needs, but both need to be updated; and one component has provided requirements development training and certification. Other component officials told GAO that they lack the resources necessary to take these steps. Best practices indicate that without an appropriately sized and trained workforce, components remain at risk of acquiring capabilities that fail to meet end user needs.

What GAO Recommends

GAO is making 25 recommendations, including to individual components to establish policies and independent organizations for requirements development, assess workforce needs, and establish training and certifications. DHS concurred with all the recommendations.