This is the accessible text file for GAO report number GAO-09-29 
entitled 'Department Of Homeland Security: Billions Invested in Major 
Programs Lack Appropriate Oversight' which was released on November 20, 
2008.

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Report to the Chairman, Subcommittee on Homeland Security, Committee on 
Appropriations, House of Representatives: 

United States Government Accountability Office: 
GAO: 

November 2008: 

Department Of Homeland Security: 

Billions Invested in Major Programs Lack Appropriate Oversight: 

GAO-09-29: 

GAO Highlights: 

Highlights of GAO-09-29, a report to the Chairman, Subcommittee on 
Homeland Security, Committee on Appropriations, House of 
Representatives. 

Why GAO Did This Study: 

In fiscal year 2007, the Department of Homeland Security (DHS) 
obligated about $12 billion for acquisitions to support homeland 
security missions. DHS’s major investments include Coast Guard ships 
and aircraft; border surveillance and screening equipment; nuclear 
detection equipment; and systems to track finances and human resources. 
In part to provide insight into the cost, schedule, and performance of 
these acquisitions, DHS established an investment review process in 
2003. However, concerns have been raised about how well the process has 
been implemented—particularly for large investments. GAO was asked to 
(1) evaluate DHS’s implementation of the investment review process, and 
(2) assess DHS’s integration of the investment review and budget 
processes to ensure major investments fulfill mission needs. GAO 
reviewed relevant documents, including those for 57 DHS major 
investments (investments with a value of at least $50 million)—48 of 
which required department-level review through the second quarter of 
fiscal year 2008; and interviewed DHS headquarters and component 
officials. 

What GAO Found: 

While DHS’s investment review process calls for executive decision 
making at key points in an investment’s life cycle—including program 
authorization—the process has not provided the oversight needed to 
identify and address cost, schedule, and performance problems in its 
major investments. Poor implementation of the process is evidenced by 
the number of investments that did not adhere to the department’s 
investment review policy—of DHS’s 48 major investments requiring 
milestone and annual reviews, 45 were not assessed in accordance with 
this policy. At least 14 of these investments have reported cost 
growth, schedule slips, or performance shortfalls. Poor implementation 
is largely the result of DHS’s failure to ensure that its Investment 
Review Board (IRB) and Joint Requirements Council (JRC)—the 
department’s major acquisition decision-making bodies—effectively 
carried out their oversight responsibilities and had the resources to 
do so. Regardless, when oversight boards met, DHS could not enforce IRB 
and JRC decisions because it did not track whether components took 
actions called for in these decisions. In addition, many major 
investments lacked basic acquisition documents necessary to inform the 
investment review process, such as program baselines, and two out of 
nine components—which manage a total of 8 major investments—do not have 
required component-level processes in place. DHS has begun several 
efforts to address these shortcomings, including issuing an interim 
directive, to improve the investment review process. 

The investment review framework also integrates the budget process; 
however, budget decisions have been made in the absence of required 
oversight reviews and, as a result, DHS cannot ensure that annual 
funding decisions for its major investments make the best use of 
resources and address mission needs. GAO found almost a third of DHS’s 
major investments received funding without having validated mission 
needs and requirements—which confirm a need is justified—and two-thirds 
did not have required life-cycle cost estimates. At the same time, DHS 
has not conducted regular reviews of its investment portfolios—broad 
categories of investments that are linked by similar missions—to ensure 
effective performance and minimize unintended duplication of effort for 
investments. Without validated requirements, life-cycle cost estimates, 
and regular portfolio reviews, DHS cannot ensure that its investment 
decisions are appropriate and will ultimately address capability gaps. 
In July 2008, 15 of the 57 DHS major investments reviewed by GAO were 
designated by the Office of Management and Budget as poorly planned and 
by DHS as poorly performing. 

Table: DHS Major Investments Lacking Appropriate Oversight: 

Oversight element: DHS review in accordance with policy; 
Applicable investments: 48; 
Number lacking element: 45; 
Percent lacking element: 94. 

Oversight element: Required information at key decision points; 
Applicable investments: 34; 
Number lacking element: 27; 
Percent lacking element: 79. 

Oversight element: Life-cycle cost estimate; 
Applicable investments: 57; 
Number lacking element: 39; 
Percent lacking element: 68. 

Source: GAO. 

[End of table] 

What GAO Recommends: 

GAO is making several recommendations aimed at better ensuring DHS 
fully implements and adheres to its investment review process, 
including tracking major investments and better integrating oversight 
results with budget decisions. DHS generally concurred with these 
recommendations. 

To view the full product, including the scope and methodology, click on 
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-09-29]. For more 
information, contact John Hutton at (202) 512-4841 or huttonj@gao.gov. 

[End of section] 

Contents: 

Letter: 

Results in Brief: 

Background: 

Lack of Adherence to the Investment Review Process Led to Oversight 
Being Seldom Applied to Support Successful Acquisition Outcomes: 

DHS's Investment Review and Budget Processes Are Not Integrated to Help 
Ensure That Major Investments Maximize Resources to Meet Mission Needs: 

Conclusions: 

Recommendations for Executive Action: 

Agency Comments and Our Evaluation: 

Appendix I: Scope and Methodology: 

Appendix II: Comments from the Department of Homeland Security: 

Appendix III: Key Acquisition Documents by Major Investment: 

Appendix IV: Department of Homeland Security Investments Reviewed by 
GAO: 

Tables: 

Table 1: Investment Review Levels and Approval Authorities: 

Table 2: DHS Investment Oversight Entities and Responsibilities: 

Table 3: DHS Major Investments That Reported Cost Growth from Fiscal 
Year 2007 to the Second Quarter of Fiscal Year 2008: 

Table 4: DHS Investments without a Mission Needs Statement in Fiscal 
Year 2008: 

Table 5: Documentation for Investments in Phases That Require All Key 
Acquisition Documents: 

Figures: 

Figure 1: DHS Investment Review Process: 

Figure 2: Traceability of Key Acquisition Documents: 

Figure 3: DHS Planning, Programming, Budgeting, and Execution Phases of 
the Budget Process: 

Abbreviations: 

CBP: Customs and Border Protection: 

CFO: Chief Financial Office: 

CIS: Citizenship and Immigration Services: 

CPO: Chief Procurement Office: 

DHS: Department of Homeland Security: 

DOD: Department of Defense: 

FEMA: Federal Emergency Management Agency: 

ICE: Immigration and Customs Enforcement: 

IRB: Investment Review Board: 

IT: information technology: 

JRC: Joint Requirements Council: 

OMB: Office of Management and Budget: 

TSA: Transportation Security Administration: 

US-VISIT: U.S. Visitor and Immigrant Status Indicator Technology: 

[End of section] 

United States Government Accountability Office:
Washington, DC 20548: 

November 18, 2008: 

The Honorable David E. Price: 
Chairman: 
Subcommittee on Homeland Security: 
Committee on Appropriations: 
House of Representatives: 

Dear Mr. Chairman, 

Since it was established in 2003, the Department of Homeland Security 
(DHS) has been responsible for integrating 22 federal agencies with 
disparate missions into one department. In fiscal year 2007, DHS 
obligated about $12 billion for acquisitions to support homeland 
security missions including responding to threats and hazards to the 
nation and ensuring safe and secure borders. DHS components and offices 
sponsor investments, and this portfolio[Footnote 1] includes Coast 
Guard ships and aircraft; border surveillance and screening equipment; 
nuclear detection equipment; and systems to track finances and human 
resources. DHS plans to spend over $60 billion to acquire and sustain 
such investments. 

To help ensure these broad and complex acquisitions achieve the 
department's national security mission, DHS established two key 
processes in 2003: investment review and budgeting. Where the budget 
process is used to allocate resources for DHS acquisitions, the 
investment review process is intended to provide departmental insight 
at key points in an investment's life cycle to assess the cost, 
schedule, and performance of these acquisitions. However, concerns have 
been raised about how well the investment review process has been 
defined and implemented--particularly for large investments--to achieve 
successful acquisition outcomes. Weaknesses in the investment review 
process can have a rippling effect on the budget process because these 
reviews are expected to inform annual funding decisions for major 
investments. Since 2005, DHS has been revising the investment review 
process and identified completing this effort as a priority in its 2008 
high-risk management plan.[Footnote 2] Over this period, we have made a 
series of recommendations to DHS aimed at strengthening its investment 
review process. 

Because of the large commitment of resources for these investments, you 
asked us to (1) evaluate DHS's implementation of the investment review 
process, and (2) assess DHS's integration of the investment review and 
budget processes to ensure major investments fulfill mission needs. 

To conduct our work, we reviewed relevant GAO and DHS Inspector General 
reports and DHS documents, such as management directives and investment 
oversight guidance provided to components. We reviewed decision memos 
and investment documents for all 57 level 1 and level 2 major 
investments identified by DHS. We specifically determined the level of 
oversight provided for 48 of these major investments--those that 
required department-level review from fiscal year 2004 through the 
second quarter of fiscal year 2008. We compared DHS budget practices 
with GAO and Office of Management and Budget (OMB) guidance on capital 
programming principles. We also interviewed representatives of the 
Chief Procurement Office (CPO), Chief Financial Office (CFO) and Chief 
Information Office as well as nine DHS components and offices that 
manage major investments. We conducted this performance audit from 
September 2007 until November 2008 in accordance with generally 
accepted government auditing standards. Those standards require that we 
plan and perform the audit to obtain sufficient, appropriate evidence 
to provide a reasonable basis for our findings and conclusions based on 
our audit objectives. We believe that the evidence obtained provides a 
reasonable basis for our findings and conclusions based on our audit 
objectives. See appendix I for additional information on our scope and 
methodology. 

Results in Brief: 

DHS has not effectively implemented or adhered to its investment review 
process, which calls for executive decision making at key points in an 
investment's life cycle--including program authorization--due to a lack 
of senior management officials' involvement as well as limited 
monitoring and resources; consequently, DHS has not provided the 
oversight needed to identify and address cost, schedule, and 
performance problems in its major investments. Of 48 major investments 
requiring milestone or annual reviews, 45 were not reviewed in 
accordance with the department's investment review policy, and 18 were 
not reviewed at all. Four of these investments have transitioned into a 
late acquisition phase--production and deployment--without any required 
reviews. Poor implementation is largely the result of DHS's inability 
to ensure that its Investment Review Board (IRB) and Joint Requirements 
Council (JRC)--the department's major acquisition decision-making 
bodies--effectively carried out their oversight responsibilities and 
had sufficient resources such as personnel to support the oversight 
function. Over the past several years, IRB and JRC review activities 
did not keep pace with investments requiring review. Moreover, DHS 
could not enforce decisions that were reached because the department 
did not track whether components took the actions called for by the 
IRB, such as addressing program requirement and performance 
deficiencies. In addition, many major investments lacked required 
acquisition documents necessary to guide and measure program 
performance as well as inform the investment review process, such as 
program baselines and, of those, over a third had cost growth, schedule 
slips, or performance shortfalls from fiscal year 2007 through the 
second quarter of fiscal year 2008. We also found that two components 
that manage 8 major investments do not have required component-level 
review systems in place. DHS has recognized these shortcomings and in 
2007 began several efforts to clarify and better adhere to the 
investment review process and released an interim acquisition 
management directive in November 2008. 

The investment review framework also integrates the budget process; 
however, budget decisions have been made in the absence of oversight 
reviews and, as a result, DHS cannot ensure that annual funding 
decisions for its major investments make the best use of resources and 
address mission needs. DHS officials explained that linking budget 
decisions to investment oversight has been difficult due to the erratic 
investment review schedule and that budget reviews can be the only 
oversight provided. We found almost a third of DHS's 57 major 
investments received funding without having IRB or JRC validated 
mission needs and requirements--a milestone that confirms a need is 
justified. GAO, OMB, and commercial best practices underscore the need 
to validate requirements before allocating resources. In addition, two 
thirds of DHS major investments did not have required life-cycle cost 
estimates, which are essential to making informed budget decisions. At 
the same time, DHS has not conducted regular reviews of its investment 
portfolios--broad categories of investments that are linked by similar 
missions--to ensure effective performance and minimize unintended 
duplication of effort for proposed and ongoing investments. Without 
validated mission needs, life-cycle cost estimates, and regular 
portfolio reviews, DHS cannot ensure that its investments will 
ultimately address capability gaps and avoid funding unintended 
duplication of effort. As of July 2008, more than a quarter of DHS 
major investments were on both the OMB Management Watch List and list 
of high-risk projects with shortfalls, meaning that they are both 
poorly planned and poorly performing. The DHS Undersecretary for 
Management has said that strengthening the links between investment 
review and budget decisions is a top priority. 

To improve investment oversight, we are recommending that the Secretary 
of Homeland Security take several actions to better ensure DHS and its 
components fully implement and adhere to the investment review process, 
including tracking major investments and better integrating oversight 
results with budget decisions. DHS generally concurred with our 
recommendations, citing actions taken and efforts under way to improve 
the investment review process. The department's comments are reprinted 
in appendix II. DHS components provided technical comments which were 
incorporated as appropriate and where supporting documentation was 
provided. 

Background: 

DHS invests in a wide array of complex acquisitions to achieve its 
national security mission. DHS components and offices sponsor 
investments to address mission capability gaps and are the end-users of 
the developed acquisitions. DHS has stated that the Undersecretary for 
Management, as the Chief Acquisition Officer, is responsible for 
acquisition policy. The purpose of DHS's investment review and budget 
processes are to provide oversight of these major investments. 
Specifically, DHS established the investment review process in 2003 to 
help protect its major investments by providing departmental oversight 
of major investments throughout their life cycles and to help ensure 
that funds allocated for investments through the budget process are 
being spent wisely, efficiently, and effectively. In 2005, we reported 
that this process adopted many acquisition best practices that, if 
applied consistently, could help increase the chances for successful 
outcomes.[Footnote 3] However, we noted that incorporating additional 
program reviews and knowledge deliverables into the process could 
better position DHS to make well-informed decisions. In 2007, we 
further reported that DHS had not fully defined and documented policies 
and procedures for investment management or fully implemented key 
practices needed to control its information technology (IT) 
investments.[Footnote 4] To strengthen DHS's investment management 
capability, we recommended that the department fully define and 
document project and portfolio-level policies and procedures and 
implement key control processes. In addition to the investment review 
process, the DHS budget process serves as the framework for decision 
making for ongoing and future DHS programs. The framework is cyclic, 
consisting of planning, programming, budgeting, and execution phases 
that examine existing program funding and link the funding to program 
performance to ensure funds are expended appropriately and that they 
produce the expected results and benefits. 

The investment review process framework manages investment risk 
[Footnote 5] by developing an organized, comprehensive, and iterative 
approach to identifying; assessing; mitigating; and continuously 
tracking, controlling, and documenting risk tailored to each project. 
The investment review process has four main objectives: (1) identify 
investments that perform poorly, are behind schedule, are over budget, 
or that lack capability, so officials can identify and implement 
corrective actions; (2) integrate capital planning and investment 
control with resource allocation and investment management; (3) ensure 
that investment spending directly supports DHS's mission and identify 
duplicative efforts for consolidation; and (4) ensure that DHS conducts 
required management, oversight, control, reporting, and review for all 
major investments.[Footnote 6] The process requires event-driven 
decision making by high-ranking executives at a number of key points in 
an investment's life cycle. The investment review process provides 
guidance to components for all DHS investments, but it requires formal 
[Footnote 7] department-level review and approval only for major 
investments--those that are categorized as level 1 or 2 (see table 1). 
[Footnote 8] 

Table 1: Investment Review Levels and Approval Authorities: 

Level: 1; 
Review/approval: Investment Review Board (IRB) reviews and approves; 
Acquisition costs[A]: Greater than $100 million; 
Life cycle costs[B] (Applies only to IT Investments): Greater than $200 
million. 

Level: 2; 
Review/approval: Joint Requirements Council (JRC) reviews and approves; 
Acquisition costs[A]: Between $50 million and $100 million; 
Life cycle costs[B] (Applies only to IT Investments): Between $100 
million and $200 million. 

Source: DHS Management Directive No. 1400. 

[A] All costs for acquiring, by contract, interagency agreement, or for 
other funding instruments, supplies and/ or services for a designated 
investment through purchase or lease, whether the supplies are already 
in existence or must be created, developed, demonstrated, and 
evaluated, and without regard to the type of funds used, whether 
appropriated or nonappropriated. 

[B] The total cost to the federal government of acquiring, operating, 
supporting, and, if applicable, disposing of the items being acquired. 

[End of table] 

The investment review process has two types of reviews: programmatic 
and portfolio. Programmatic reviews are held at specific milestones and 
require documentation and discussion commensurate with the investment's 
life cycle phase. These reviews contribute to the investment review 
goal of identifying investments that perform poorly, are behind 
schedule, are over budget, or that lack capability so officials can 
identify and implement corrective actions. Portfolio reviews are 
designed to identify efforts for consolidation and mission alignment by 
monitoring and assessing broad categories of investments that are 
linked by similar missions to ensure effective performance, 
minimization of overlapping functions, and proper funding. The IRB and 
JRC are responsible for reviewing, respectively, level 1 and level 2 
investments at key milestone decision points, but no less than 
annually, and provide strategic guidance (see table 2). In addition to 
requiring department-level review, DHS policy directs component heads 
to conduct appropriate management and oversight of investments and 
establish processes to manage approved investments at the component 
level.[Footnote 9] 

Table 2: DHS Investment Oversight Entities and Responsibilities: 

Investment Review Board (IRB): 

Level of review: Department; 
Membership: Investment Review Board (IRB): 
* Deputy Secretary (Chair); 
* Under Secretary for Management (Vice Chair); 
* Chief Financial Officer (CFO), Chief Procurement Officer (CPO), Chief 
Information Officer; 
* Office of the Secretary, Policy Office, Office of the General 
Counsel; 
* Director, Program Analysis and Evaluation (Executive Secretary); 
* Chair, Joint Requirements Council (JRC) (Adjunct Member); 
Examples of responsibilities: 
* Review, validate, and approve all level 1 investments; 
* Review and validate portfolio placement and alignment with the 
strategic mission; 
* Provide strategic guidance for the JRC and programs. 

Joint Requirements Council (JRC): 

Level of review: Department; 
Membership: Investment Review Board (IRB): 
* Chair appointed by the Deputy Secretary; 
* Senior managers from each component and DHS line of business, General 
Counsel designee; 
* Director, Program Analysis and Evaluation (Executive Secretary); 
Examples of responsibilities: 
* Provide milestone reviews and approvals of level 2 investments; 
* Manage investment portfolios, including determining portfolio 
structure for an investment, conducting portfolio reviews, and making 
portfolio-related recommendations to the IRB; 
* Validate requirements through the Mission Needs Statements and review 
projects to identify cross-functional requirements and applications. 

Heads of components and offices: 

Level of review: Component; 
Membership: Investment Review Board (IRB): 
* Chief Operating Officer from each component, for example: 
Undersecretary, Administrator, Director, Chief Operating Officer, or 
designee; 
Examples of responsibilities: 
* Approve all level 3 and 4 investments and ensure they comply with 
DHS's investment review requirements[A]; 
* Establish processes and provide the requisite resources to manage 
approved investments adequately; 
* Submit joint/consolidated investments through the investment review 
process. 

Source: DHS Management Directive No. 1400. 

[A] Level 3 investments have total acquisition costs between $5 million 
and $50 million or IT life cycle costs between $20 million and $100 
million. Level 4 investments have acquisition costs less than $5 
million or IT life cycle costs less than $20 million. 

[End of table] 

The investment review process has three broad life cycle stages, 
covering five investment phases and four decision points or milestones 
(see fig. 1). In the preacquisition stage, gaps are to be identified 
and capabilities to address them defined. In the first phase of the 
acquisition stage--concept and technology development--requirements are 
to be established and alternatives explored. In the next phase-- 
capability development and demonstration--prototypes are to be 
developed. In the final acquisition phase, the assets are produced and 
deployed. With the high dollar thresholds and inherent risk of level 1 
and level 2 investments, IRB or JRC approval at milestone decision 
points is important to ensure that major investment performance 
parameters and documentation are satisfactorily demonstrated before the 
investment transitions to the next acquisition phase. IRB and JRC 
milestone reviews are not required once an investment reaches the 
sustainment phase. 

Figure 1: DHS Investment Review Process: 

[Refer to PDF for image] 

This figure is an illustration of the DHS Investment Review Process, as 
follows: 

Decision point: [Empty]; 
Investment phase: Program initiation; 
Lifecycle phase: Preacqusition. 

Decision point: 1: Program authorization; 
Investment phase: Concept and technology development; 
Lifecycle phase: Acquisition. 

Decision point: 2: Alternative selection; 
Investment phase: Capability development and demonstration; 
Lifecycle phase: Acquisition. 

Decision point: 3: Project decision; 
Investment phase: Production and deployment; 
Lifecycle phase: Acquisition. 

Decision point: 4: Predeployment decision; 
Investment phase: Operations and support; 
Lifecycle phase: Sustainment. 

Source: GAO presentation of DHS data. 

[End of figure] 

As designed, knowledge developed during each investment phase is to be 
captured in key documents and is to build throughout the investment 
life cycle. Performing the disciplined analysis required at each phase 
is critical to achieving successful outcomes. The main goals of the 
first investment phase, program initiation, are to determine gaps in 
capabilities and then describe the capabilities to fill the gap--this 
information is then captured in the mission needs statement. If the 
mission needs statement is approved, the investment then moves to the 
concept and technology development phase, which focuses both on setting 
requirements and important baselines for managing the investment 
throughout its life cycle. A key step in this phase is translating 
needs into specific operational requirements, which are captured in the 
operational requirements document. Operational requirements provide a 
bridge between the functional requirements of the mission needs 
statement and the detailed technical requirements that form the basis 
of the performance specifications, which will ultimately govern 
development of the system. Once the program has developed its 
operational requirements document, it then uses these requirements to 
inform the development of its acquisition program baseline, a critical 
document that addresses the program's critical cost, schedule, and 
performance parameters and is expressed in measurable terms. See figure 
2 for a description of the documents.[Footnote 10] 

Figure 2: Traceability of Key Acquisition Documents: 

[Refer to PDF for image] 

This figure is an illustration of the traceability of key acquisition 
documents, as follows: 

* Mission Needs Statement: 
A formal description of the strategic need for an investment. It links 
the gap in mission capability to the investments that will fill that 
gap. 

The capability gap described in the mission needs statement is 
translated into system level performance capabilities to fill that gap. 

* Operational Requirements Document: 
Describes the operating environment, functions to be performed, the 
need for interoperability with other systems, and other requirements. 
It ultimately drives system performance and capability. 

The performance parameters in the operational requirements document are 
used to establish the performance baseline of the acquisition program 
baseline. 

* Acquisition Program Baseline: 
Used to measure project performance, it summarizes critical cost, 
schedule, and performance parameters, expressed in measurable, 
quantitative terms that must be met to accomplish the goals of the 
investment. 

Must trace directly back to the mission gap expressed in the mission 
needs statement and the requirements detailed in the operational 
requirements document. 

Source: GAO presentation of key acquisition documents. 

[End of figure] 

The department's budget policy has two main objectives: (1) articulate 
DHS goals and priorities, and (2) develop and implement a program 
structure and resource planning to accomplish DHS goals.[Footnote 11] 
DHS uses the process to determine investment priorities and allocate 
resources each year. The budget process emphasizes the importance of 
ensuring investments expend funds appropriately and that investment 
performance produces the expected benefits or results. IRB decisions 
and guidance regarding new investments are to be reflected to the 
extent possible in any iteration of the budget as appropriate. The 
Office of the Chief Financial Officer (CFO) manages the budget process. 

Lack of Adherence to the Investment Review Process Led to Oversight 
Being Seldom Applied to Support Successful Acquisition Outcomes: 

DHS has not effectively implemented or adhered to its investment review 
process due to a lack of involvement by senior officials as well as 
limited resources and monitoring; consequently, DHS has not identified 
and addressed cost, schedule, and performance problems in many major 
investments. Poor implementation largely rests on DHS's inability to 
ensure that the IRB and JRC effectively carried out their oversight 
responsibilities. Of 48 major investments requiring department-level 
review,[Footnote 12] 45 were not reviewed in accordance with the 
department's investment review policy, and 18 were not reviewed at all. 
In the absence of IRB and JRC meetings, investment decisions were 
reached outside of the required review process. Moreover, when IRB 
meetings were held, DHS did not consistently enforce decisions that 
were reached because the department did not track whether components 
and offices took the actions required by the IRB. In addition, 27 major 
investments have not developed or received DHS approval for basic 
acquisition documents required to guide and measure the performance of 
program activities--and the investment review process. Of those, over a 
third reported cost, schedule, or performance breaches in fiscal year 
2007 and second quarter fiscal year 2008. According to DHS 
representatives, acquisition management practices are still new to many 
components, and we found 24 investments lacked certified program 
managers needed to develop basic acquisition documents. We found that 
two out of nine components do not have required component-level review 
processes to adequately manage their major investments. DHS has 
recognized these deficiencies and began efforts in 2007 to clarify and 
better adhere to the investment review process. 

Most Major Investments Lacked Required Departmental Reviews and Many of 
Those Exceeded Cost Estimates: 

Of DHS's 48 major investments requiring department-level review between 
fiscal year 2004 and the second quarter of fiscal year 2008, only three 
had all milestone and annual reviews. Of the 39 level 1 investments 
requiring IRB review and approval[Footnote 13] to proceed to the next 
acquisition phase, as of March 2008, 18 have never been reviewed by the 
IRB--4 of which have already reached production and deployment. The 
remaining 21 level 1 investments received at least one milestone or 
annual review through the investment review process. None of the 9 
level 2 investments had JRC[Footnote 14] review and approval. DHS 
policy provides that its major investments be reviewed no less than 
yearly.[Footnote 15] However, in fiscal year 2007, the most recent year 
for which data were available, only 7 of the 48 required annual reviews 
were conducted. As a result, DHS lacked the information needed to 
address cost, schedule, and performance deficiencies--a problem we 
identified with over one-third of DHS's major investments between 
fiscal year 2007 and the second quarter of fiscal year 2008. In our 
prior work on the Department of Defense (DOD), we found that when such 
reviews are skipped or not fully implemented, programs build momentum 
and move toward product development with little if any early department-
level assessment of the costs and feasibility. Committing to programs 
before they have this knowledge contributes to poor cost, schedule, and 
performance outcomes.[Footnote 16] 

DHS level 1 investments that were never reviewed through the IRB 
process include some of the department's largest investments with 
important national security objectives. For example, the Federal 
Emergency Management Agency's (FEMA) Consolidated Alert and Warning 
System, which has estimated life-cycle costs of $1.6 billion, includes 
programs to update the Emergency Alerting System and other closely 
related projects. In 2007, we reported that FEMA faces technical, 
training, and funding challenges to develop an integrated alert and 
warning system.[Footnote 17] Customs and Border Protection's (CBP) 
Secure Freight Initiative, which has estimated life-cycle costs of $1.7 
billion, is designed to test the feasibility of scanning 100 percent of 
U.S.-bound cargo containers with nonintrusive equipment and radiation 
detection equipment at foreign seaports. Earlier this year, we reported 
that the Secure Freight Initiative faces a number of challenges, 
including measuring performance outcomes, logistical feasibility of 
some aspects of the investment, and technological issues.[Footnote 18] 
While these two investments are still in the concept and technology 
development phase, other major investments that have not been reviewed 
are even further along in the investment life cycle--when problems 
become more costly to fix. For example, CBP's Western Hemisphere Travel 
Initiative, with estimated life-cycle costs of $886 million, is in 
capability development and demonstration. The investment aims to 
improve technologies to identify fraudulent documentation at U.S. ports 
of entry. We recently reported that because key elements of planning 
for the investment's management and execution remain uncertain, DHS 
faces challenges deploying technology, and staffing and training 
officers to use it.[Footnote 19] 

Reviews of the 9 level 2 investments--those with acquisition costs 
between $50 million and $100 million, or $100 million to $200 million 
for information technology--were similarly lacking. While the JRC met 
periodically between fiscal years 2004 and 2006, senior officials 
stated that it did not make approval decisions about any level 2 
investments. As a result, investments such as the following--which are 
all now in the operations and support phase--were not reviewed and 
approved by the JRC: 

* FEMA's Total Asset Visibility, which has $91 million in estimated 
life-cycle costs, aims to improve emergency response logistics in the 
areas of transportation, warehousing, and distribution. 

* Transportation and Security Administration's (TSA) Hazardous Threat 
Assessment Program, which has $181 million in estimated life-cycle 
costs, was developed to perform a security threat assessment on 
applicants for licenses to transport hazardous materials. 

* The National Protection and Programs Directorate's National Security 
and Emergency Preparedness investment, which has $1.8 billion in 
estimated life-cycle costs, aims to provide specially designed 
telecommunications services to the national security and emergency 
preparedness communities in the event of a disaster if conventional 
communication services are ineffective. 

During 2006, the JRC stopped meeting altogether after the chair was 
assigned to other duties within the department. DHS representatives 
recognized that since the JRC stopped meeting in 2006, there has been 
no direction for requirements or oversight of level 2 investments at 
the department level and that strengthening the JRC is a top priority. 
In the meantime, oversight of level 2 investments has devolved to the 
components. 

Without the appropriate IRB and JRC milestone reviews, DHS loses the 
opportunity to identify and address cost, schedule, and performance 
problems and, thereby, minimize program risk. Fourteen of the 
investments that lacked appropriate review through IRB and JRC 
oversight experienced cost growth, schedule delays, and 
underperformance--some of which was substantial. At least 8 investments 
reported cost growth between fiscal year 2007 and the second quarter of 
fiscal year 2008 (see table 3). Other programs experienced schedule 
delays and underperformance. For example, CBP's Automated Commercial 
Environment program reported a 20 percent performance shortfall in the 
first quarter of fiscal year 2008. Moreover, we reported in July 2008 
that the Coast Guard's Rescue 21 program changed its acquisition 
baseline or cost, schedule, and performance goals four times resulting 
in a total 182 percent cost growth and 5-year schedule slip.[Footnote 
20] 

Table 3: DHS Major Investments That Reported Cost Growth from Fiscal 
Year 2007 to the Second Quarter of Fiscal Year 2008: 

Investment: Chief Information Office: Infrastructure Transformation 
Program; 
Cost growth: 31 percent. 

Investment: Coast Guard; Rescue 21; 
Cost growth: 16 percent[A]. 

Investment: Customs and Border Protection (CBP); Border Patrol 
Facilities; 
Cost growth: 16 percent. 

Investment: Customs and Border Protection (CBP); Consolidated Trusted 
Traveler Program; 
Cost growth: 23 percent. 

Investment: Department of Homeland Security (DHS); Homeland Secure Data 
Network; 
Cost growth: 11 percent. 

Investment: Federal Emergency Management Agency (FEMA); Disaster 
Management E-Government; 
Cost growth: 93 percent. 

Investment: Immigration and Customs Enforcement (ICE); Detention and 
Removal Modernization; 
Cost growth: 8 percent. 

Investment: Transportation Security Administration (TSA); Electronic 
Baggage Screening Program; 
Cost growth: 10 percent. 

Source: GAO presentation of DHS data. 

[A] The Coast Guard reported that it subsequently made progress in 
reducing cost growth in the Rescue 21 program. 

[End of table] 

DHS has acknowledged that the IRB and JRC have not conducted oversight 
in accordance with DHS policy--largely because the process has depended 
on direct involvement and availability of high-level leadership as well 
as a lack of sufficient staff resources to organize the review 
meetings. According to DHS representatives, the Deputy Secretary was 
unavailable to commit to the time required to conduct reviews of all 
investments, so only some major investments were reviewed. Our prior 
work shows that this problem existed from the start. For example, in 
2004, we reported that DHS was having difficulty bringing all of its 
information technology programs before the IRB in a timely manner. 
[Footnote 21] We reported in 2005 that key stakeholders, such as the 
Chief Procurement Officer, did not receive materials in time to conduct 
a thorough review and provide meaningful feedback prior to investment 
review meetings and recommended that DHS ensure that stakeholders, 
including CPO officials, have adequate time to review investment 
submissions and provide formal input to decision-making review boards. 
[Footnote 22] Moreover, in 2007, we reported that DHS investment boards 
did not conduct regular investment reviews and control activities were 
not performed consistently across projects.[Footnote 23] DHS Chief 
Procurement Office and Chief Financial Office representatives added 
that the process was not adequately staffed to conduct annual reviews 
of investments as required by the investment review policy. We have 
previously recommended that DHS provide adequate resources, including 
people, funding, and tools, for oversight of major investments. 
[Footnote 24] A 2007 DHS assessment of 37 major investments found that 
many investments are awaiting senior management review. For example, 
FEMA's major investment, the flood map modernization program, requested 
a key investment review decision meeting in 2004 that was subsequently 
scheduled and canceled in 2006. As a result, the program proceeded from 
development to operations and support without IRB review or approval. 

Because of these limitations, alternative approaches to obtaining 
decisions were adopted. Numerous officials reported that rather than 
going through the formal investment review process, in some cases DHS 
component officials began to seek approval directly from the Deputy 
Secretary. For example, in November 2006, the DHS Inspector General 
reported on the CBP's Secure Border Initiative program, noting that the 
investment oversight processes were sidelined in the urgent pursuit of 
SBInet's aggressive schedule and that the IRB and JRC processes were 
bypassed and key decisions about the scope of the program and the 
acquisition strategy were made without rigorous review and analysis or 
transparency.[Footnote 25] DHS officials indicated that some decisions 
were very informal, based on conversations with the Deputy Secretary 
and without input from other IRB members. In such cases, the investment 
review process was bypassed, including consideration of supporting 
reviews and recommendations. DHS CPO and CFO representatives said they 
did not always know whether a decision had been made through this 
informal process. 

Many Programs Lack Required Cost, Schedule, and Performance Data 
Critical to Informing Investment Decisions: 

DHS investment review policy requires programs to develop specific 
documentation that captures key knowledge needed to make informed 
investment decisions.[Footnote 26] This approach is similar to DOD's, 
which requires adequate knowledge at critical milestones to reduce the 
risk associated with each phase of the investment's life cycle and 
enable program managers to deliver timely, affordable, quality 
products.[Footnote 27] GAO's work on commercial best practices for 
major acquisitions has demonstrated that this approach, if effectively 
implemented, can significantly improve program outcomes.[Footnote 28] 
Our prior work has found that inadequate attention to developing 
requirements results in requirements instability, which can ultimately 
cause cost escalation, schedule delays, and fewer end items. 

Many major DHS investments do not have basic acquisition information 
required by investment review policy to guide and measure the 
performance of program activities and the investment review process. In 
particular, mission needs statements, operational requirements 
documents, and acquisition program baselines establish capability gaps, 
requirements needed to address gaps, and cost, schedule, and 
performance parameters, respectively. As of March 2008, of the 57 level 
1 and 2 investments, 34 were in a phase that required all three 
documents, but 27 did not have or only provided an unapproved draft of 
one or more of these documents (see appendix III for the investments 
lacking these approved documents). Of the 27 investments, we found that 
over a third reported cost, schedule, or performance breaches between 
fiscal year 2007 and second quarter fiscal year 2008. For example, the 
Infrastructure Transformation program, which did not have an approved 
operational requirements document or acquisition program baseline, 
reported being up to 19 percent behind schedule in 2007. In another 
instance, the Immigration and Customs Enforcement (ICE) Detention and 
removal modernization program, which also lacked an approved 
operational requirements document and acquisition program baseline, 
reported schedule slippage of about 20 percent. Without required 
development and review of key acquisition data, DHS cannot be sure that 
programs have mitigated risks to better ensure good outcomes. 

CPO representatives explained that department acquisition management 
practices are new to many DHS components. For most investments, CPO 
representatives said that program managers were not familiar with basic 
acquisition documents and investment oversight staff had to work with 
program managers to help them develop these documents prior to 
investment reviews. In addition, we found that in fiscal year 2007, 24 
major investments did not have program managers certified by DHS as 
having the required knowledge and skills to oversee complex acquisition 
programs.[Footnote 29] Moreover, other factors such as pressure to get 
programs up and running, additional external requirements, and 
technological challenges also impact the ability to successfully manage 
acquisitions to support good acquisition outcomes. At the same time, 
some component officials said that they received insufficient and 
inconsistent guidance regarding what information should be included in 
key acquisition documents. This issue is long-standing. For example, we 
reported in 2005 that because of the small number of department 
oversight staff, only limited support was provided to programs to 
assist them in completing their submissions for oversight reviews. 
[Footnote 30] In addition, component officials told us that key 
acquisition documents are sometimes approved at the component level but 
are not reviewed and approved at the department level. For example, TSA 
officials indicated that documents needed for the Secure Flight and 
Passenger Screening Programs were approved by TSA and submitted to DHS 
for approval, but no action was taken to review and approve them. 

Major Investments Move Forward without Addressing Deficiencies 
Identified in Reviews: 

The investment reviews that have been conducted have not always 
provided the discipline needed to help ensure programs achieve cost, 
schedule, and performance goals--even when a review identified 
important deficiencies in an acquisition decision memorandum. DHS has 
not routinely followed up on whether specific actions required by 
acquisition decision memorandums to mitigate potential risks have been 
implemented. 

The IRB issued a 2004 acquisition decision memorandum approving the 
U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT)--a 
program that aims to facilitate travel and trade--to move into the 
capability development and demonstration phase although the IRB found 
the investment's cost, schedule, and performance risk to be high. The 
memorandum stated that more clarity was needed on the program's end- 
state capability, benefits related to life-cycle costs, and how it 
planned to transition to the operations and support phase. We reported 
that in 2006 DHS had yet to develop a comprehensive plan describing 
what the end-state capability would be, and how, when, and at what cost 
it would be delivered.[Footnote 31] In a 2006 decision memorandum, the 
IRB again instructed US-VISIT to address the end-state capability, by 
requiring a comprehensive affordable exit plan for airports, seaports, 
and landports. We subsequently reported that, as of October 2007, US- 
VISIT had yet to establish critical investment management processes, 
such as effective project planning, requirements management, and 
financial management, which are required to ensure that program 
capabilities and expected mission outcomes are delivered on time and 
within budget.[Footnote 32] In addition, DHS had not developed 
capability for the other half of US-VISIT, even though it had allocated 
about one-quarter of a billion dollars to this effort. 

In a May 2006 decision memorandum, the IRB directed the Cargo Advanced 
Automated Radiography System investment to develop within 6 months an 
acquisition program baseline, a concept of operations, and an 
operational requirements document. It also called for the investment to 
be reviewed annually. As of the second quarter of fiscal year 2008, a 
baseline and the concept of operations had been drafted, according to 
program officials. However, an operational requirements document had 
not been developed even though a $1.3 billion contract had been awarded 
for the investment. In addition, the Cargo Advanced Automated 
Radiography System investment had not yet received a follow-on review 
by the IRB. In another example, in a December 2006 decision memorandum, 
the IRB directed ICE's major investment Automation and Modernization to 
update its acquisition program baseline, its cost-benefit analysis and 
its life-cycle cost analysis. Automation and Modernization has since 
updated its acquisition program baseline, but its cost analyses were 
last updated in 2005. 

Current and former CPO and CFO representatives noted that staffing has 
not been sufficient to review investments in a timely manner and 
conduct follow-up to ensure decisions are implemented. They indicated 
that support was needed to undertake a number of functions, including: 
designing the investment review process, collecting and reviewing 
investment documentation, preparing analyses to support investment 
decisions, and organizing review meetings, as well as conducting follow-
up for major investments. According to DHS representatives, from 2004 
to 2007 there were four full-time equivalent DHS employees plus support 
from four contractors to fulfill those responsibilities. Many 
acquisition decision memos provided specific deadlines for components 
to complete action items, but according to CPO and CFO representatives 
IRB action items were not tracked. Without follow-up, the IRB did not 
hold components and major investment program offices accountable for 
addressing oversight concerns. 

Component-Level Review Processes Are Not Fully Developed to Ensure That 
Major Investments Receive Oversight: 

DHS's investment review process requires that component heads establish 
processes and provide the requisite resources to manage approved 
investments adequately. Component heads are also responsible for 
approving all level 3 and level 4 investments and ensuring they comply 
with DHS investment review submission requirements. In the absence of 
sufficient review at the department level, well-designed component- 
level processes are particularly critical to ensuring that investments 
receive some level of oversight. For example, CBP and TSA officials 
reported that they relied on their component investment review 
processes to ensure some level of oversight when the department did not 
review their investments. However, for the nine components we reviewed, 
two did not have a process in place and others had processes that were 
either in development or not focused on the entire investment life 
cycle. For example, the Domestic Nuclear Detection Office and the 
National Protection and Programs Directorate did not have a formal 
investment review process, meaning that in the absence of an IRB or JRC 
review, their eight major investments received no formal review. While 
FEMA has a process to manage contract-related issues, its review 
process does not currently address the entire investment life cycle. 
According to CPO representatives, the department is working with 
components to ensure that components have a process in place to manage 
investments and to have them designate an acquisition officer who is 
accountable for major investments at the component level. 

Gaps in Oversight Have Prompted DHS to Clarify the Investment Review 
Process: 

DHS has acknowledged that the investment review process has not been 
fully implemented. In fact, the process has been under revision since 
2005. DHS has begun to make improvements to the planning, execution, 
and performance of major investments as initial steps to clarify and 
better adhere to the investment review process. To gain an 
understanding and awareness of DHS's major investments, in 2007 during 
the course of our review, the Undersecretary for Management undertook 
an assessment of 37 major investments conducted under the CPO's 
direction. The assessment identified a range of systemic weaknesses in 
the implementation of its investment review process and in the process 
itself. The DHS assessment found: 

* many level 1 investments await leadership decisions; 

* acquisition decision memos lack rigor; 

* a lack of follow-up and enforcement of oversight decisions; 

* inadequate technical support at the investment level; and: 

* unclear accountability for acquisitions at the component level. 

Many of the deficiencies identified are consistent with our findings. 
For example, the DHS assessment of Citizenship and Immigration Services 
(CIS) found that investments were either missing, or using draft or 
unsigned versions of key investment management documents, limiting 
DHS's ability to measure the investments' performance. In one case, DHS 
found that the Verification Information Systems investment is poorly 
defined. In another case, DHS reported that CIS's investment 
Transformation was using draft and unsigned acquisition documents, 
including its mission needs statement, acquisition plan, and 
acquisition program baseline. In 2007, we reported that: CIS had not 
finalized its acquisition strategy for Transformation and cost 
estimates therefore remain uncertain, plans do not sufficiently discuss 
enterprise architecture alignment and expected project performance, and 
these gaps create risks that could undermine Transformation's success 
as it begins to implement its plans.[Footnote 33] In addition, DHS 
found that CIS's investment Customer Service Web Portal did not have 
key investment management documents and that the investment's 
performance cannot be adequately assessed. Similarly, DHS found that 
CIS's investment Integrated Document Production did not have 
performance measures or documentation that performance metrics have 
been implemented to measure program cost, schedule, and performance 
execution. 

To address the findings of its 2007 review, DHS is taking steps to 
reiterate the DHS investment review policy and establish a more 
disciplined and comprehensive investment review process. Beginning in 
February 2008, interim policies were issued by the Undersecretary for 
Management to improve management of major investments pending release 
of a new investment review management directive. Specifically, the 
Undersecretary for Management issued a memorandum in February 2008 on 
initiating efforts to improve the quality of acquisition program 
baselines for level 1 investments, and another in July 2008 on 
improving life-cycle cost estimating for major investments. To help 
address the backlog of investments awaiting review, the CPO has begun 
to review and issue acquisition decision memorandums for each level 1 
program. As of August 2008, acquisition decision memorandums had been 
completed for three programs. The memorandums indicate documentation 
that must be completed, issues that must be addressed, and related 
completion dates before investment approval is given. The memorandums 
also identify any limits or restrictions on the program until those 
actions are completed. Further, the Undersecretary for Management 
signed an interim acquisition management directive in November 2008 to 
improve acquisition management and oversight pending results from a 
formal DHS executive review. 

DHS's Investment Review and Budget Processes Are Not Integrated to Help 
Ensure That Major Investments Maximize Resources to Meet Mission Needs: 

DHS's annual budget process for funding major investments has not been 
appropriately informed by the investment review process--largely 
because the IRB seldom conducts oversight reviews and when it has, the 
two processes have not been aligned to better ensure funding decisions 
fulfill mission needs. While DHS's investment review framework 
integrates the two processes--an approach similarly prescribed by GAO 
and OMB capital planning principles--many major investments received 
funding without determining that mission needs and requirements were 
justified. In addition, two-thirds of DHS major investments did not 
have required life-cycle cost estimates, which are essential to making 
informed budget and capital planning decisions. At the same time, DHS 
has not conducted regular reviews of its investment portfolios--broad 
categories of investments--to ensure effective performance and minimize 
unintended duplication of effort for proposed and ongoing investments. 
In July 2008, more than one-quarter of DHS's major investments were 
designated by OMB as poorly planned and by DHS as poorly performing. 
The DHS Undersecretary for Management has said that strengthening the 
links between investment review and budget decisions is a top priority. 

GAO and OMB Capital Planning Principles Emphasize an Integrated 
Investment Approach to Manage Risk and Costs: 

OMB and GAO capital planning principles underscore the importance of a 
disciplined decision making and requirements process as the basis to 
ensure that investments succeed with minimal risk and lowest life-cycle 
cost.[Footnote 34] This process should provide agency management with 
accurate information on acquisition and life-cycle costs, schedules, 
and performance of current and proposed capital assets. The OMB Capital 
Programming Guide also stresses the need for agencies to develop 
processes for making investment decisions that deliver the right amount 
of funds to the right projects. 

In addition, OMB and GAO guidance provide that an investment review 
policy should seek to use long-range planning and a disciplined, 
integrated budget process for portfolio management to achieve 
performance goals at the lowest life-cycle cost and least risk to the 
taxpayer and the government. Investment portfolios are integrated, 
agencywide collections of investments that are assessed and managed 
collectively based on common criteria. Managing investments as 
portfolios is a conscious, continuous, and proactive approach to 
allocating limited resources among an organization's competing 
initiatives in light of the relative benefits expected from these 
investments. Our prior work at DOD has shown that fragmented decision- 
making processes do not allow for a portfolio management approach to 
make investment decisions that benefit the organization as a whole. The 
absence of an integrated approach can contribute to duplication in 
programs and equipment that does not operate effectively together. 
[Footnote 35] 

GAO best practices work also emphasizes that (1) a comprehensive 
assessment of agency needs should be conducted, (2) current 
capabilities and assets should be identified to determine if and where 
a gap may lie between current and needed capabilities, and (3) a 
decision about how best to meet the identified gap should be evaluated. 
The approved mission needs statement must support the need for a 
project before the project can proceed to the acquisition phase. OMB 
guidance states that in creating capital plans, agencies should 
identify a performance gap between the existing portfolio of agency 
assets and the mission need that is not filled by the agency's asset 
portfolio.[Footnote 36] Moreover, best practices indicate that 
investment resources should match valid requirements before approval of 
investments. 

DHS Budget Decisions for Major Investments Have Generally Not Been 
Informed by Mission Needs and Life-Cycle Cost Estimates: 

The DHS investment review process calls for IRB decisions and program 
guidance regarding new investments to be reflected to the extent 
possible in the budget. The DHS budget process consists of overlapping 
planning, programming, budgeting, and execution phases that examine 
existing program funding and link funding to program performance to 
ensure funds are expended appropriately and produce the expected 
results and benefits (see fig. 3). 

Figure 3: DHS Planning, Programming, Budgeting, and Execution Phases of 
the Budget Process: 

[Refer to PDF for image] 

This figure is an illustration of the DHS Planning, Programming, 
Budgeting, and Execution Phases of the Budget Process, as follows: 

2007 PPBE: 
Planning: Late 2004 through mid-2005; 
Programming and budgeting: Mid-2005 through late 2006; 
Execution (1 to 3 years depending on funding type): Late 2006 through 
2007. 

2008 PPBE: 
Planning: Late 2005 through mid-2006; 
Programming and budgeting: Mid-2006 through late 2007; 
Execution (1 to 3 years depending on funding type): Late 2007 through 
2008. 

2009 PPBE: 
Planning: Late 2006 through mid-2007; 
Programming and budgeting: Mid-2007 through late 2008; 
Execution (1 to 3 years depending on funding type): Late 2008 through 
2009. 

2010 PPBE: 
Planning: Late 2007 through mid-2008; 
Programming and budgeting: Mid-2008 through late 2009; 
Execution (1 to 3 years depending on funding type): Late 2009 through 
2010. 

2011 PPBE: 
Planning: Late 2008 through mid-2009; 
Programming and budgeting: Mid-2009 through late 2010; 
Execution (1 to 3 years depending on funding type): Late 2010 through 
2011. 

Source: DHS (data); GAO (analysis and presentation). 

[End of figure] 

Annually, components submit resource allocation proposals for major 
investments to the CFO for review in March and, in turn, resource 
allocation decisions are provided to components in July. According to 
CFO representatives, information from investment oversight reviews 
would be useful to inform investment annual resource allocation 
decisions. CFO representatives explained that the CFO sought to align 
resource allocation decisions with the IRB approvals in 2006, but this 
was not possible because of the erratic investment review meeting 
schedule. As a result, a number of CFO and CPO representatives 
confirmed that funding decisions for major investments have not been 
contingent upon the outcomes of the investment review process. 

One of the primary functions of the IRB is to review and approve level 
1 investments for formal entry into the annual budget process. However, 
we found that 18 of DHS's 57 major investments did not have an approved 
mission needs statement--a document that formally acknowledges that the 
need is justified and supported. Specifically, the statement summarizes 
the investment requirement, the mission or missions that the investment 
is intended to support, the authority under which the investment was 
begun, and the funding source for the investment. As such, approval of 
the mission needs statement is required at the earliest stages of an 
investment. Lacking information on which major investments have 
validated mission needs, the CFO has allocated funds for major 
investments for which a capability gap has not been established. We 
reported in 2007 that DHS risked selecting investments that would not 
meet mission needs in the most cost-effective manner.[Footnote 37] The 
18 investments that lacked an approved mission needs statement 
accounted for more than half a billion dollars in estimated fiscal year 
2008 appropriations (see table 4). 

Table 4: DHS Investments without a Mission Needs Statement in Fiscal 
Year 2008 (Dollars in millions): 

Citizenship and Immigration Services (CIS): 
Customer Service Web Portal; $15.8; 
Immigration CLAIMS 3.0; $10.9; 
Integrated Document Production; $31.8; 
Naturalization CLAIMS 4.0; $17.7; 
Verification Information System; $37.9. 

Domestic Nuclear Detection Office: 
Advanced Spectroscopic Portal Program; $147.5; 
Cargo Advanced Automated Radiography System Active Radiography 
Detection Systems; $43.0. 

Federal Emergency Management Agency (FEMA): 
Consolidated Alert and Warning System; $25.6; 
Disaster Management E-Government Initiative; $12.5; 
Housing Inspection Services, Inspection Contracts; $40.5; 
Total Asset Visibility (Phase I); $33.8. 

Immigration and Customs Enforcement (ICE): 
Asset Management Construction Account; $16.5; 
Federal Financial Management System; $21.4. 

National Protection and Program Directorate: 
Infrastructure Information Collection Program; $14.2; 
National Security and Emergency Preparedness; $117.6; 
U.S. Computer Emergency Readiness Team; $76.6. 

Office of Health Affairs: 
National Bio-Surveillance Integration System; $5.3. 

Transportation Security Administration (TSA): 
Federal Air Marshall Service Air to Ground Communications System and 
Tactical Information Sharing System; $12.6. 

Total: $681.2. 

Source: GAO analysis of DHS data and total 2008 costs reported in DHS 
fiscal year 2009 capital asset plan and business case summaries. 

[End of table] 

In addition, two thirds of major investment budget decisions were 
reached without a life-cycle cost estimate. A life-cycle cost estimate 
provides an exhaustive and structured accounting of all resources and 
associated cost elements required to develop, produce, deploy, and 
sustain a particular program. Life-cycle costing enhances decision 
making, especially in early planning and concept formulation of 
acquisition and can support budgetary decisions, key decision points, 
milestone reviews, and investment decisions. GAO and OMB guidance 
emphasize that reliable cost estimates are important for program 
approval and continued receipt of annual funding.[Footnote 38] DHS 
policy similarly provides that life-cycle cost estimates are essential 
to an effective budget process and form the basis for annual budget 
decisions. However, 39 of the 57 level 1 and level 2 major DHS 
investments we reviewed did not have a life-cycle cost estimate. 
Moreover, DHS's 2007 assessment of 37 major investments also found 
investments without life-cycle cost estimates and noted poor cost 
estimating as a systemic issue. Without such estimates, DHS major 
investments are at risk of experiencing cost overruns, missed 
deadlines, and performance shortfalls. Cost increases often mean that 
the government cannot fund as many programs as intended. To begin to 
address this issue, the DHS Undersecretary for Management issued a memo 
in July 2008 initiating an effort to review and improve the credibility 
of life-cycle cost estimates for all level 1 investments prior to 
formal milestone approval. 

Lack of Portfolio Reviews Increases Risk of Duplication in DHS's Major 
Investments: 

The JRC is responsible for managing the department's level 1 and level 
2 major investment portfolios and making portfolio-related 
recommendations to the IRB. Managing investments as portfolios is a 
continuous and proactive approach to allocating finite resources among 
an organization's competing initiatives in light of the relative 
benefits expected from these investments. Taking a portfolio 
perspective allows an agency to determine how its collective 
investments can optimally address its strategic goals and objectives. 
As part of this responsibility, the JRC is expected to identify 
crosscutting opportunities and overlapping or common requirements and 
determine how best to ensure that DHS uses its finite resources wisely 
in those areas. Specifically, the JRC reviews investments to identify 
duplicative mission capabilities and to assess redundancies. While a 
certain amount of redundancy can be beneficial, our prior work has 
found that unintended duplication indicates the potential for 
inefficiency and waste.[Footnote 39] The Enterprise Architecture Board 
supports the JRC by overseeing the department's enterprise architecture 
and performing technical reviews of level 1 and level 2 IT investments. 
In 2007, we reported that DHS did not have an explicit methodology and 
criteria for determining program alignment to the architecture. 
[Footnote 40] We further reported that DHS policies and procedures for 
portfolio management had yet to be defined, and as a result, control of 
the department's investment portfolios was ad hoc. 

When it met regularly, the JRC played a key role in identifying several 
examples of overlapping investments, including passenger screening 
programs. Specifically, in March 2006, the JRC identified programs that 
had potential overlaps, including TSA's Secure Flight, TSA's Registered 
Traveler, and CBP's Consolidated Registered Traveler programs, yet the 
programs lacked coordination and were struggling with interoperability 
and information sharing. Because the JRC stopped meeting soon 
thereafter, DHS may have missed opportunities to follow up on these 
cases or identify further cases of potential overlap. In 2007, we 
reported that while TSA and CBP had begun coordinating efforts, they 
had yet to align their passenger prescreening programs to identify 
potential overlaps and minimize duplication.[Footnote 41] We 
recommended that DHS take additional steps and make key policy and 
technical decisions that were necessary to more fully coordinate these 
programs. TSA and CBP have since worked with DHS to develop a strategy 
to align regulatory policies and coordinate efforts to facilitate 
consistency across their programs.[Footnote 42] In another case, we 
reported that CIS's Transformation investment has been conducted in an 
ad hoc and decentralized manner, and, in certain instances, is 
duplicative with other IT investments.[Footnote 43] 

DHS's 2007 assessment of 37 major investments also identified potential 
overlap and duplication of effort between investments. Overall the 
review found that limited communication and coordination across 
components led to overlapping DHS programs. For example, DHS found that 
the CIS Verification Information System had potential duplication of 
requirements implementation with National Protection and Program 
Directorate's U.S. Computer Emergency Readiness Team investment. In 
another instance, DHS found the CIS Integrated Document Production 
investment had an unclear relationship to other DHS credentialing 
investments. 

Limited DHS Investment Oversight Has Led OMB to Designate Many DHS 
Programs as Poorly Planned and Poorly Performing: 

OMB requires all agencies including DHS to submit program justification 
documents[Footnote 44] for major investments to inform both 
quantitative decisions about budgetary resources consistent with the 
administration's program priorities, and qualitative assessments about 
whether the agency's programming processes are consistent with OMB 
policy and guidance. To help ensure that investments of public 
resources are justified and that public resources are wisely invested, 
OMB began using a Management Watch List in the President's fiscal year 
2004 budget request as a means to oversee the justification for and 
planning of agencies' information technology investments. This list was 
derived based on a detailed review of each investment's Capital Asset 
Plan and Business Case. In addition, OMB has established criteria for 
agencies to use in designating high-risk projects that require special 
attention from oversight authorities and the highest levels of agency 
management. These projects are not necessarily at risk of failure, but 
may be on the list because of one or more of the following four 
reasons: 

* The agency has not consistently demonstrated the ability to manage 
complex projects. 

* The project has exceptionally high development, operating, or 
maintenance costs, either in absolute terms or as a percentage of the 
agency's total portfolio. 

* The project is being undertaken to correct recognized deficiencies in 
the adequate performance of an essential mission program or function of 
the agency, a component of the agency, or another organization. 

* Delay or failure of the project would introduce for the first time 
unacceptable or inadequate performance or failure of an essential 
mission function of the agency, a component of the agency, or another 
organization. 

According to DHS officials, without input from investment oversight 
reviews, a limited budget review of program justification documents 
prior to OMB submittal can be the only oversight provided for some DHS 
major investments. CFO representatives told us that in the absence of 
investment review decisions, they rely on the best available 
information provided by program managers in order to determine if 
funding requests are reasonable. As a result, major investment programs 
can proceed regardless of whether the investment has received the 
appropriate IRB review or has required acquisition documents. 

We reported that as of July 2008, 15 DHS major investments are on both 
the OMB Management Watch List and list of high-risk projects with 
shortfalls, meaning that they are both poorly planned and poorly 
performing.[Footnote 45] According to DHS officials, the funding, 
programming, and budget execution process is not integrated into the 
requirements and acquisition oversight process and the DHS 
Undersecretary for Management has said that strengthening these 
processes is a top priority. 

Conclusions: 

The challenges DHS faces in implementing its investment review process 
are long-standing and have generally resulted in investment decisions 
that are inconsistent with established policy and oversight. Concurrent 
with this lack of oversight are acquisition programs worth billions of 
dollars with cost, schedule, and performance deficiencies. Weaknesses 
in some component management practices compound the problem leaving 
investments with little to no scrutiny or review. While the 
department's process has been under revision since 2005, DHS has begun 
new efforts to clarify and better adhere to the investment review 
process. Without validating mission needs, requirements, and program 
baselines including costs, as well as identifying duplicative efforts 
and monitoring progress, DHS cannot appropriately manage investments 
and inform the budget process. Until DHS aligns oversight of major 
investments with annual budget decisions, the department is at risk of 
failing to invest in programs that maximize resources to address 
capability gaps and ultimately help meet critical mission needs. 

Recommendations for Executive Action: 

We recommend that the Secretary of Homeland Security direct the 
Undersecretary for Management to take the following five actions to 
better ensure the investment review process is fully implemented and 
adhered to: 

* Establish a mechanism to identify and track on a regular basis new 
and ongoing major investments and ensure compliance with actions called 
for by investment oversight boards. 

* Reinstate the JRC or establish another departmental joint 
requirements oversight board to review and approve acquisition 
requirements and assess potential duplication of effort. 

* Ensure investment decisions are transparent and documented as 
required. 

* Ensure that budget decisions are informed by the results of 
investment reviews including IRB approved acquisition information and 
life cycle cost estimates. 

* Identify and align sufficient management resources to implement 
oversight reviews in a timely manner throughout the investment life 
cycle. 

To improve investment management, we recommend that the Secretary of 
Homeland Security direct component heads to take the following two 
actions: 

* Ensure that components have established processes to manage major 
investments consistent with departmental policies. 

* Establish a mechanism to ensure major investments comply with 
established component and departmental investment review policy 
standards. 

Agency Comments and Our Evaluation: 

We provided a draft of this report to DHS for review and comment. In 
written comments, the department generally concurred with our findings 
and recommendations, citing actions taken and efforts under way to 
improve the investment review process. The department's comments are 
reprinted in appendix II. DHS components also provided technical 
comments which we incorporated as appropriate and where supporting 
documentation was provided. In addition, several DHS components and 
offices reported additional progress since the time of our review to 
ensure their major investments comply with departmental policies. 

DHS is taking important steps to strengthen investment management and 
oversight. After being under revision since 2005, DHS issued a new 
interim management directive on November 7, 2008, that outlines a 
revised acquisition and investment review process. DHS also cited two 
new offices within the Chief Procurement Office that were established 
to provide better acquisition management and oversight; recently 
completed program reviews; and plans to revise training, standards, and 
certification processes for program managers. While many of these 
efforts are noted in our report, investment management and oversight 
has been an ongoing challenge since the department was established, and 
continued progress and successful implementation of these recent 
efforts will require sustained leadership and management attention. 

DHS stated that the new interim acquisition management directive will 
address many of our recommendations; however, our work has found that 
DHS has not fully implemented similar steps in the past. For example, 
in response to our first recommendation, to establish a mechanism to 
identify and track on a regular basis new and ongoing major investments 
and ensure compliance with actions called for by investment review 
board decisions, DHS's new interim directive requires major programs to 
participate in an acquisition reporting process. While DHS is in the 
process of implementing a Next Generation Periodic Reporting System, it 
is too soon to tell whether this system will be successfully 
implemented. DHS's first-generation periodic reporting system was never 
fully implemented, making it difficult for the department to track and 
enforce investment decisions. 

In response to our second recommendation, to reinstate the JRC or 
establish another departmental joint requirements oversight board to 
review and approve acquisition requirements and assess potential 
duplication of effort, DHS stated it has already developed a new 
Strategic Requirements Review process to assess capability needs and 
gaps; completed pilots; and briefed senior leadership. According to 
DHS's new interim acquisition management directive, the results of this 
process are to be validated by the JRC, which is still in the process 
of being established and for which no timeline was provided. Further, 
as we found in this report, when the JRC was previously established in 
2004, it was never fully implemented due to a lack of senior management 
officials' involvement. 

In response to our third recommendation, that DHS ensure investment 
decisions are transparent and documented as required, DHS stated that 
its new interim acquisition management directive already implements 
this by requiring acquisition documentation for each acquisition 
decision event and capturing decisions and actions in acquisition 
decision memorandums. DHS also reported that it has conducted eight 
Acquisition Review Board meetings with documented Acquisition Decision 
Memorandums. While this progress is notable, our work has found that 
since 2004, DHS's investment review board has not been able to 
effectively carry out its oversight responsibilities and keep pace with 
investments requiring review due to a lack of senior officials' 
involvement as well as limited monitoring and resources. It is too soon 
to tell whether DHS's latest efforts will be sustained to ensure 
investments are consistently reviewed as needed. 

Regarding our fourth recommendation, that the department ensure budget 
decisions are informed by the results of investment reviews, the new 
interim management directive creates a link between the budget and 
requirements processes and describes interfaces with other investment 
processes. While this process is more clearly established in the new 
directive, its implementation will be evidenced in the documents 
produced during upcoming budget cycles. We found in this report that 
the previous investment review process also highlighted links to the 
budget and other investment processes, yet the results of oversight 
reviews did not consistently inform budget decisions. 

In response to our fifth recommendation, to identify and align 
sufficient management resources to implement oversight reviews in a 
timely manner throughout the investment life cycle, DHS stated that it 
has partially implemented the recommendation by establishing a senior 
executive-led Acquisition Program Management Division within the Office 
of the CPO and plans to increase staffing from its current level of 12 
experienced acquisition and program management specialists to 58 by the 
end of fiscal year 2010. Creating a new division to manage oversight 
reviews is a positive step; however, we have found that DHS has been 
challenged to provide sufficient resources to support its acquisition 
oversight function and the CPO's office has had difficulty filling 
vacancies in the past. 

Regarding our two recommendations to improve investment management at 
the component level, DHS noted that the new interim management 
directive requires components to align their internal policies and 
procedures by the end of the third quarter of fiscal year (June) 2009. 
In addition, DHS plans to issue another management directive which will 
instruct component heads to create component acquisition executives in 
their organizations to be responsible for the implementation of 
management and oversight of component acquisition processes. If fully 
implemented, these steps should help to ensure that components have 
established processes to manage major investments. DHS further noted 
that establishment of the Acquisition Program Management Division, the 
new interim acquisition management directive, reestablishment of the 
acquisition review process, and other steps work together to ensure 
major investments comply with established component and departmental 
investment review policy standards. To implement this recommendation, 
the new component acquisition executives will need to be in place and 
successfully implement and ensure compliance with the new processes. 

DHS will continue to face ongoing challenges to implementing an 
effective investment review process identified in this report and 
highlighted in the department's Integrated Strategy for High Risk 
Management. For example, consistent with our findings, the strategy 
cites challenges to ensuring availability of leadership to conduct 
investment reviews; timely collection and assessment of program data; 
and sufficient staff to support the investment review process. 
Sustained leadership focus will be even more critical to implement 
changes and maintain progress on acquisition management challenges as 
the department undergoes its first executive branch transition in 2009. 

As agreed with your offices, unless you publicly announce the contents 
of this report, we plan no further distribution for 30 days from the 
report date. At that time, we will send copies of this report to 
interested congressional committees and the Secretary of Homeland 
Security. We will also make copies available to others upon request. In 
addition, the report will be available at no charge on GAO's Web site 
at [hyperlink, http://www.gao.gov]. 

If you or your staff have questions regarding this report, please 
contact me at (202) 512-4841 or huttonj@gao.gov. Contact points for our 
Offices of Congressional Relations and Public Affairs may be found on 
the last page of this report. Principal contributors to this report 
were Amelia Shachoy, Assistant Director; William Russell; Laura 
Holliday; Nicole Harkin; Patrick Peterson; Karen Sloan; Marie Ahearn; 
and Kenneth Patton. 

Sincerely yours, 

Signed by: 

John Hutton, Director: 
Acquisition and Sourcing Management: 

[End of section] 

Appendix I Scope and Methodology: 

Our objectives were to: (1) evaluate DHS's implementation of the 
investment review process, and (2) assess DHS's integration of the 
investment review and budget processes to ensure major investments 
fulfill mission needs. 

To assess how the investment review process has been implemented, we 
reviewed the DHS Investment Review Process management directive and 
corresponding handbook to determine which major investments required 
DHS review. In doing so, we focused on determining such key factors as 
how frequently major investments required oversight reviews and what 
documents such as mission need statements and acquisition program 
baselines are required to be approved by DHS executive review boards. 
We included in our analyses 57 level 1 and level 2[Footnote 46] 
investments that DHS identified for fiscal year 2008. We determined the 
level of oversight provided to 48 of these major investments--those 
that required department-level review from fiscal year 2004 through the 
second quarter of fiscal year 2008. We also interviewed representatives 
of the Chief Procurement Office (CPO), Chief Financial Office (CFO), 
and Chief Information Office as well as nine DHS components and offices 
that manage major investments. We then collected investment review and 
program documents for each major investment and compared the 
information to investment review policy requirements. We also reviewed 
acquisition decision memorandums from fiscal year 2004 through the 
second quarter of fiscal year 2008. Based on the decision memos and 
investment information, we determined how many investments had been 
reviewed in accordance with DHS policy from fiscal year 2004 through 
the second quarter of fiscal year 2008. We also reviewed prior GAO 
reports on DHS programs as well as commercial best practices for 
acquisition. We reviewed DHS documents such as interim policy memos and 
guidance and interviewed CPO staff regarding planned revisions to the 
investment review process. We also compared our findings with a 2007 
DHS internal assessment of 37 major investments. In addition, we 
reviewed available DHS periodic reports on major investments as well as 
component operational status reports to identify instances of cost 
growth, schedule slips, and performance shortfalls for major 
investments and to determine the status of program manager 
certification in fiscal year 2007 through the second quarter of fiscal 
year 2008. This information is self-reported by DHS major program 
offices and all programs did not always provide complete information, 
and we did not independently verify information in these reports. 

To assess the integration of investment review and the budget process, 
we reviewed DHS management directives for the investment review and the 
planning, programming, budgeting, and execution process as well as 
corresponding guidance. We also interviewed representatives from the 
Chief Procurement Office and Chief Financial Office to discuss how the 
processes have been integrated since 2004. We used investment data and 
acquisition documents from each major investment program to determine 
which had required life-cycle cost estimates and other documents such 
as a validated mission need statements. We also reviewed fiscal year 
2009 DHS budget justification submissions to OMB. We compared DHS 
budget practices with GAO and Office of Management and Budget (OMB) 
guidance on capital programming principles. In addition, we reviewed 
relevant GAO reports. 

We conducted this performance audit from September 2007 until November 
2008 in accordance with generally accepted government auditing 
standards. Those standards require that we plan and perform the audit 
to obtain sufficient, appropriate evidence to provide a reasonable 
basis for our findings and conclusions based on our audit objectives. 
We believe that the evidence obtained provides a reasonable basis for 
our findings and conclusions based on our audit objectives. 

[End of section] 

Appendix II: Comments from the Department of Homeland Security: 

U.S. Department of Homeland Security: 
Washington, DC 20528: 

November 7, 2008: 

Mr. John Hutton: 
Director, Acquisition and Sourcing Management: 
Government Accountability Office: 
Washington, D.C. 20548: 

Dear Mr. Hutton: 

Thank you for the opportunity to review Draft Report GAO-09-29, 
Department of Homeland Security: Billions Invested in Major Programs 
Lack Appropriate Oversight. 

The Department of Homeland Security (DHS) and the Office of the Chief 
Procurement Officer (OCPO) generally concur with and have already 
implemented GAO recommendations, as detailed below. During the past 
year, for example, DHS: 

1) Re-engineered the process for management of the Department's 
Acquisition and Investment review process. New Acquisition Directive 
(102-01), accompanied by an Instruction (102-01-001), replaces MD 1400 
and lays out a comprehensive acquisition lifecycle framework and 
acquisition process. Supporting the instruction are appendices 
providing detailed information on critical acquisition related products 
and processes. These will be implemented as Department Acquisition 
policy at the beginning of November 2008; 

2) Established the Acquisition Program Management Division and the Cost 
Analysis Division within OCPO. These divisions provide departmental 
policy, processes and procedures for DHS Acquisition Programs, as well 
as both oversight of and assistance to our acquisition programs. They 
are currently staffed with 12 experienced Acquisition and Program 
management specialists, with support from the Defense Acquisition 
University and the Homeland Security Institute. Current plans are to 
increase staffing to a total of 58 by the end of FY-10; 

3) Completed 37 quick-look program reviews, two Independent Review Team 
level program reviews, and eight Acquisition Review Boards (ARB, 
formerly Investment Review Boards, IRBs). These ARBs are issue-focused 
and documented via Acquisition Decision Memorandums (ADMs). The revised 
process provides much improved rigor and focus to this vital 
Departmental oversight function, and are supported by the Chief 
Information Officer's (CIO) Enterprise Architecture Board (EAB) and the 
Chief Administrative Officer's (CAO) DHS Asset Review Boards (DARB). 
Both boards provide technical expertise and assistance where needed. As 
of the end of FY-08, eight ARBs have been conducted, with eight more 
scheduled through December 2008; and; 

4) CPO has also established revised training, standards, and 
certification processes for program managers (MD 782) and will 
implement standards for test and evaluation, systems engineering, 
acquisition logistics, and cost analysis by the end of the CY. 

The following is the Departmental response to the recommendations 
outlined in the draft report: 

1) Recommendation: Establish a mechanism to identify and track on a 
regular basis new and ongoing major investments and ensure compliance 
with actions called for by investment oversight boards. 

Status: Recommendation already implemented. The DHS Chief Information 
Office (CIO), in collaboration with the DHS Chief Procurement Office 
(CPO), has reengineered the acquisition program periodic reporting 
process and is implementing a new system, Next Generation Periodic 
Reporting System (nPRS), after completing a successful pilot period. In 
addition to tracking cost, schedule, and performance attributes of a 
program's Acquisition Program Baseline (APB), the system tracks 
Acquisition Decision Memorandum (ADM) action items that result from 
Acquisition Review Boards (ARBs), as well as other pertinent 
information. 

2) Recommendation: Reinstate the JRC or establish another departmental 
joint requirements oversight board to review and approve acquisition 
requirements and assess potential duplication of effort. 

Status: The DHS Office of Policy has already developed a new Strategic 
Requirements Review Process to assess the Departmental capability needs 
and gaps. This process feeds the yearly Integrated Planning Guidance 
(IPG). Pilots of the new process have been completed and the results 
briefed to senior DHS management. 

3) Recommendation: Ensure investment decisions are transparent and 
documented as required. 

Status: Recommendation already implemented. DHS has implemented a new 
Acquisition Management Directive, which identifies the required 
acquisition documentation for each Acquisition Decision Event (ADE). 
The documentation is reviewed by the Acquisition Review Team (ART), 
under the direction of the Acquisition Program Management Division 
(APMD), prior to each ADE. This identifies focused issues that form the 
basis for the ARB review. Immediately following the ARB, the decisions 
and actions are captured in an Acquisition Decision Memorandum (ADM) 
which is staffed and signed by the Acquisition Decision Authority 
(ADA). The new periodic reporting system mentioned above tracks the 
acquisition program documentation including the ADMs. A status report 
is periodically distributed to Department, Component, and program 
office leadership. 

4) Recommendation: Ensure that budget decisions are informed by the 
results of investment reviews including IRB approved acquisition 
information and lifecycle cost estimates. 

Status: Recommendation already implemented. The new Acquisition 
Directive and the accompanying Instruction address the interfacing 
"touch points" with the Department's budgeting and requirements 
decision processes. For example, a Mission Need Statement (MNS) is 
required for Resource Allocation Proposals (RAPs). Additionally, the 
Directive and Instruction describe the interfaces with other processes 
(e.g. OMB Capital Planning and Investment Control (CPIC), DHS 
Enterprise Architecture Board, and DHS Asset Review Board). 

5) Recommendation: Identify and align sufficient management resources 
to implement oversight reviews in a timely manner throughout the 
investment lifecycle. 

Status: Partially implemented. DHS has established a Senior Executive-
led Acquisition Program Management Division (APMD) within the Office of 
the Chief Procurement Officer. Additionally, DHS has established a Cost 
Analysis Division (CAD) also within the Office of the Chief Procurement 
Officer to provide cost estimating guidance and to provide oversight of 
program cost estimates. These divisions are currently staffed with 12 
experienced Acquisition and Program management specialists, with 
support from the Defense Acquisition University and the Homeland 
Security Institute. Current plans are to increase staffing to a total 
of 58 by the end of FY-10. 

6) To improve investment management, we recommend that the Secretary of 
Homeland Security direct component heads to take the following two 
actions: 

a. Ensure that components have established processes to manage major 
investments consistent with departmental policies. 

Status: Recommendation will be fully implemented by end of 3Q09 in the 
new acquisition management directive plus the updated Acquisition Line 
of Business Directive, which require Components to align their internal 
policies and procedures. Additionally, Component Heads are instructed 
to create a Component Acquisition Executive (CAE) position in their 
organizations. This individual will be nominated by the Component Head, 
approved by USM, and is responsible for the implementation of 
management and oversight of their Component acquisition processes. In 
addition to leading their Components through the Acquisition Review 
Process for Level 1 and Level 2 programs at the Department Level, they 
will also be responsible for executing the Acquisition Review Process 
for Level 3 programs within their Component. 

b. Recommendation: Establish a mechanism to ensure major investments 
comply with established component and departmental investment review 
policy standards. 

Status: Recommendation implemented: The establishment of APMD, the new 
Acquisition Directive and Instruction, the reestablishment of the ARB 
process, the integration of the principal Department decision 
processes, as well as the other acquisition initiatives underway (e.g. 
the new periodic reporting system, the Component Acquisition
Executive) work together to ensure compliance with the Department's and 
Component's acquisition policies. 

We thank you again for the opportunity to review the report and provide 
comments. 

Sincerely, 

Signed by: 

Thomas W. Essig: 
Chief Procurement Officer: 
Department of Homeland Security: 

[End of section] 

Appendix III: Key Acquisition Documents by Major Investment: 

Mission needs statements, operational requirements documents, and 
acquisition program baselines establish capability gaps, requirements 
needed to address those gaps, and cost, schedule, and performance 
parameters, respectively. Of the 57 DHS level 1 and 2 investments, 34 
were in an acquisition phase that required all three documents; 27 
either did not develop the document or only provided an unapproved 
draft of one or more of these documents (see table 5). Some major 
investment programs provided acquisition program baselines approved at 
the component level that were submitted but did not receive department 
review and approval. 

Table 5: Documentation for Investments in Phases That Require All Key 
Acquisition Documents: 

[A] Indicates that the program provided: a mission needs statement, an 
operational requirements document, or a department-approved acquisition 
program baseline. 

[B] Indicates the program did not provide: a mission needs statement, 
an operational requirements document, or a department-approved 
acquisition program baseline. 

Investment: Analysis and Operations: Common Operational Picture; 
Mission Needs Statements:[A]; 
Operational Requirements Document: [A]; 
Acquisition Program Baseline: [B]. 

Investment: Analysis and Operations: Homeland Security Information 
System; 
Mission Needs Statements: [A]; 
Operational Requirements Document: [A]; 
Acquisition Program Baseline: [B]. 

Investment: Chief Human Capital Office: HR IT; 
Mission Needs Statements: [A]; 
Operational Requirements Document: [A]; 
Acquisition Program Baseline: [B]. 

Investment: Chief Information Officer Office: Infrastructure; 
Mission Needs Statements: [A]; 
Operational Requirements Document: [B]; 
Acquisition Program Baseline: [B]. 

Investment: Citizenship and Immigration Services: Customer Service Web 
Portal; 
Mission Needs Statements: [B]; 
Operational Requirements Document: [B]; 
Acquisition Program Baseline: [B]. 

Investment: Citizenship and Immigration Services: Integrated Document 
Production; 
Mission Needs Statements: [B]; 
Operational Requirements Document: [B]; 
Acquisition Program Baseline: [B]. 

Investment: Citizenship and Immigration Services: Transformation; 
Mission Needs Statements: [A]; 
Operational Requirements Document: [B]; 
Acquisition Program Baseline: [B]. 

Investment: Coast Guard: Integrated Deepwater System; 
Mission Needs Statements: [A]; 
Operational Requirements Document: [B]; 
Acquisition Program Baseline: [A]. 

Investment: Coast Guard: Nationwide Automatic Identification System; 
Mission Needs Statements: [A]; 
Operational Requirements Document: [A]; 
Acquisition Program Baseline: [A]. 

Investment: Coast Guard: Rescue 21; 
Mission Needs Statements: [A]; 
Operational Requirements Document: [A]; 
Acquisition Program Baseline: [A]. 

Investment: Coast Guard: Response Boat Medium; 
Mission Needs Statements: [A]; 
Operational Requirements Document: [A]; 
Acquisition Program Baseline: [A]. 

Investment: Customs and Border Protection: Strategic Air Plan; 
Mission Needs Statements: [A]; 
Operational Requirements Document: [A]; 
Acquisition Program Baseline: [B]. 

Investment: Customs and Border Protection: Automated Commercial 
Environment; 
Mission Needs Statements: [A]; 
Operational Requirements Document: [A]; 
Acquisition Program Baseline: [A]. 

Investment: Customs and Border Protection: Border Patrol Facilities; 
Mission Needs Statements: [A]; 
Operational Requirements Document: [B]; 
Acquisition Program Baseline: [B]. 

Investment: Customs and Border Protection: Secure Border Initiative 
net; 
Mission Needs Statements: [A]; 
Operational Requirements Document: [A]; 
Acquisition Program Baseline: [B]. 

Investment: Customs and Border Protection: Secure Freight Initiative; 
Mission Needs Statements: [A]; 
Operational Requirements Document: [A]; 
Acquisition Program Baseline: [B]. 

Investment: Customs and Border Protection: Western Hemisphere Travel 
Initiative; 
Mission Needs Statements: [A]; 
Operational Requirements Document: [B]; 
Acquisition Program Baseline: [B]. 

Investment: Domestic Nuclear Detection Office: Advanced Spectroscopic 
Portal (ASP) Program; 
Mission Needs Statements: [B]; 
Operational Requirements Document: [B]; 
Acquisition Program Baseline: [B]. 

Investment: Federal Emergency Management Agency: Disaster Management E-
Government Initiative; 
Mission Needs Statements: [B]; 
Operational Requirements Document: [B]; 
Acquisition Program Baseline: [B]. 

Investment: Immigration and Customs Enforcement: Asset Management 
Construction Account; 
Mission Needs Statements: [B]; 
Operational Requirements Document: [B]; 
Acquisition Program Baseline: [B]. 

Investment: Immigration and Customs Enforcement: Automation and 
Modernization; 
Mission Needs Statements: [A]; 
Operational Requirements Document: [A]; 
Acquisition Program Baseline: [B]. 

Investment: Immigration and Customs Enforcement: Detention and Removal 
Modernization; 
Mission Needs Statements: [A]; 
Operational Requirements Document: [B]; 
Acquisition Program Baseline: [B]. 

Investment: Immigration and Customs Enforcement: Student and Exchange 
Visitor Information System; 
Mission Needs Statements: [A]; 
Operational Requirements Document: [A]; 
Acquisition Program Baseline: [B]. 

Investment: National Protection and Program Directorate: Critical 
Infrastructure Warning Information Network; 
Mission Needs Statements: [A]; 
Operational Requirements Document: [A]; 
Acquisition Program Baseline: [B]. 

Investment: National Protection and Program Directorate: Infrastructure 
Information Collection Program; 
Mission Needs Statements: [B]; 
Operational Requirements Document: [B]; 
Acquisition Program Baseline: [B]. 

Investment: National Protection and Program Directorate: U.S. Computer 
Emergency Readiness Team; 
Mission Needs Statements: [B]; 
Operational Requirements Document: [B]; 
Acquisition Program Baseline: [B]. 

Investment: National Protection and Program Directorate: U.S. Visitor 
and Immigrant Status Indicator Technology; 
Mission Needs Statements: [A]; 
Operational Requirements Document: [A]; 
Acquisition Program Baseline: [A]. 

Investment: Office of Health Affairs: National Bio-Surveillance 
Integration System; 
Mission Needs Statements: [B]; 
Operational Requirements Document: [B]; 
Acquisition Program Baseline: [B]. 

Investment: Science and Technology Directorate: National Bio-defense 
Analysis and Countermeasures Center Facility; 
Mission Needs Statements: [A]; 
Operational Requirements Document: [A]; 
Acquisition Program Baseline: [A]. 

Investment: Transportation Security Administration: Electronic Baggage 
Screening Program; 
Mission Needs Statements: [A]; 
Operational Requirements Document: [B]; 
Acquisition Program Baseline: [A]. 

Investment: Transportation Security Administration: Mission Scheduling 
and Notification System; 
Mission Needs Statements: [A]; 
Operational Requirements Document: [B]; 
Acquisition Program Baseline: [B]. 

Investment: Transportation Security Administration: Passenger Screening 
Program; 
Mission Needs Statements: [A]; 
Operational Requirements Document: [A]; 
Acquisition Program Baseline: [A]. 

Investment: Transportation Security Administration: Secure Flight; 
Mission Needs Statements: [A]; 
Operational Requirements Document: [B]; 
Acquisition Program Baseline: [A]. 

Investment: Transportation Security Administration: Transportation 
Worker Identification Credentialing; 
Mission Needs Statements: [A]; 
Operational Requirements Document: [A]; 
Acquisition Program Baseline: [B]. 

Total Investments Missing at Least One Document: 27. 

Source: GAO analysis of DHS data reported as of March 2008. 

[End of table] 

[End of section] 

Appendix IV: Department of Homeland Security Investments Reviewed by 
GAO: 

Program: Analysis and Operations: Common Operational Picture; 
Description: Provides fusion and visualization of information to create 
timely and accurate situational awareness reports for the Secretary of 
Homeland Security, the White House, and other users to detect, deter, 
and prevent terrorist activities. 

Program: Analysis and Operations: Homeland Security Information System; 
Description: Facilitates information sharing and collaboration across 
DHS and its partners; enables real-time sharing of threat information 
for tactical first-responder support; and supports decision making in a 
real time secure environment. 

Program: Citizenship and Immigration Services: Immigration CLAIMS 3.0; 
Description: Designed to support processing of applications and 
petitions, capture fees and provide funds control, provide case status 
and support, and record the results of the adjudication of each 
application and petition. 

Program: Citizenship and Immigration Services: Naturalization CLAIMS 
4.0; 
Description: Established to provide: naturalization processing, 
interface with associated databases, improved accuracy, and more timely 
and accurate information to the public. 

Program: Citizenship and Immigration Services: Customer Service Web 
Portal; 
Description: Provides resources for all web development and maintenance 
activities. Includes web content management, development of web based 
transactions with Citizenship and Immigration Services customers and 
staff, web site maintenance, and web site hosting. 

Program: Citizenship and Immigration Services: Integrated Document 
Production; 
Description: Provides integrated card production system printers' 
hardware and software, operational contract support, and facilities 
required to print secure cards granting immigration privileges or 
benefits to applicants. 

Program: Citizenship and Immigration Services: Transformation; 
Description: A system to allow all new immigration benefits 
applications and petitions to be filed electronically through a 
Citizenship and Immigration Services Internet web-based portal. 
Citizenship and Immigration Services will have a more comprehensive 
view of the customer and any potentially fraudulent transactions; 
improved audit functionality and record management; better resource 
management; and increased sharing of information within DHS and with 
other agency partners such as Justice and State. 

Program: Citizenship and Immigration Services: Verification Information 
System; 
Description: Supports the Systematic Alien Verification for 
Entitlements Program by providing automated status-verification 
information to federal, state, and local benefit-granting and 
entitlement agencies, and the E-Verify program by allowing 
participating employers to verify their new employees are authorized to 
work in the United States. 

Program: Coast Guard; Integrated Deepwater System; 
Description: Aims to replace and modernize most of the Coast Guard's 
fleet of offshore cutters, boats, aircraft, and command and control 
systems over 25 years. 

Program: Coast Guard; Marine Information for Safety and Law 
Enforcement; 
Description: Supports incident response, contingency planning, 
violation reporting and processing, vessel casualty investigation and 
analysis, vessel documentation, user fee collection, analysis of 
mission performance, monitoring of program effectiveness. 

Program: Coast Guard; Nationwide Automatic Identification System; 
Description: Will implement a nationwide system for tracking and 
exchanging information with identification system equipped vessels 
operating in or approaching U.S. waters to improve homeland security 
and enhance Coast Guard and DHS operational mission performance. 

Program: Coast Guard; Rescue 21; 
Description: Command, control and communication system that improves 
mission execution in coastal zones. Essential to meet Search and Rescue 
program goals. Results in improved response to distress calls and 
better coordination and interoperability with other government agencies 
and first responders. 

Program: Coast Guard; Response Boat Medium; 
Description: Intended to replace the aging 41-foot utility boats and 
other large non-standard boats with assets more capable of meeting all 
of the Coast Guard multi-mission operational requirements. 

Program: Coast Guard; Vessel Logistics System; 
Description: A collection of systems or applications used to provide 
vessel logistics information management capacity to the Coast Guard. 

Program: Customs and Border Protection (CBP): Automated Commercial 
Environment; 
Description: Web-based import and export system that consolidates seven 
systems into one portal. It will provide advanced technology and 
information to decide, before a shipment reaches U.S. borders, what 
cargo should be targeted, and what cargo should be expedited. 

Program: Customs and Border Protection (CBP): Automated Targeting 
System Maintenance; 
Description: Intranet-based enforcement and decision support tool that 
is the cornerstone for all CBP targeting efforts. CBP uses the system 
to improve the collection, use, analysis, and dissemination of 
information to target, identify, and prevent potential terrorists and 
terrorist weapons from entering the United States and identify other 
violations and violators of U.S. law. 

Program: Customs and Border Protection (CBP): Border Patrol Facilities; 
Description: Will build additional facilities to meet the needs of 
CBP's expansion of its Border Patrol agent staffing. The recent 
addition of more agents and technology into enforcement activities has 
exceeded existing facility capacity. 

Program: Customs and Border Protection (CBP): Consolidated Trusted 
Traveler Program; 
Description: Framework used by trusted traveler programs for 
registering enrollees and performing identification and validation 
using automated systems. 

Program: Customs and Border Protection (CBP): Non-Intrusive Inspection 
Systems Program; 
Description: Technologies support the interdiction of weapons of mass 
destruction and effect, contraband, and illegal aliens being smuggled 
across the United States border, while having a minimal impact on the 
flow of legitimate commerce. 

Program: Customs and Border Protection (CBP): Secure Border Initiative 
net; 
Description: Aims to integrate technology and tactical infrastructure 
into a comprehensive border security suite. This system will improve 
agent ability to respond to illegal activity and help DHS manage, 
control, and secure the border. 

Program: Customs and Border Protection (CBP): Secure Freight 
Initiative; 
Description: Phase I will deploy next-generation technology and 
integrated systems to scan maritime containers for radiation or other 
special nuclear material. 

Program: Customs and Border Protection (CBP): Strategic Air Plan; 
Description: Will help develop an integrated and coordinated air and 
marine force to detect, interdict and prevent acts of terrorism arising 
from unlawful movement of people, illegal drugs and other contraband 
toward or across the borders of the United States. The goal is to 
modernize and standardize the existing CBP air and marine fleets and 
will require a specific number of primary and secondary air and marine 
locations and additional personnel to meet growing needs. 

Program: Customs and Border Protection (CBP): Traveler Enforcement 
Compliance System Modernization; 
Description: Consolidated business case between CBP and ICE that will 
modernize: subject record "watch list" processing, inspection support 
at ports of entry, as well as case management. 

Program: Customs and Border Protection (CBP): Western Hemisphere Travel 
Initiative; 
Description: Will fulfill the regulatory requirement to develop and 
implement a system to verify that U.S. and non-U.S. citizens present an 
authorized travel document denoting identity and citizenship when 
entering the United States. 

Program: DHS; Description: Homeland Secure Data Network; 
Description: Provides a state-of-the-art, flexible, secure through 
security certification and accreditation, classified, collateral, 
integrated, and centrally managed enterprise wide-area network. 

Program: DHS Chief Information Office: Infrastructure Transformation; 
Description: Includes the consolidated DHS IT infrastructure 
environments which support the cross-organizational missions of 
protecting the homeland from a myriad of threats. These IT 
infrastructure investments are critical to providing a foundation in 
which information can be disseminated and shared across all DHS 
components, including external customers and intelligence partners, in 
a secure, cost effective, and efficient manner. 

Program: DHS Chief Financial Office: Financial Transformation & Systems 
Consolidation; 
Description: Aims to achieve compliant financial management services 
and optimize financial management operations across the diverse systems 
cobbled together in 2003 when DHS was created from 22 agencies and over 
200,000 people. 

Program: DHS Chief Human Capital Office: Human Resource Information 
Technology; 
Description: Aims to improve and consolidate DHS's vast array of 
payroll and personnel systems. It will provide DHS with a common 
flexible suite of human resource business systems. 

Program: Domestic Nuclear Detection Office: Advanced Spectroscopic 
Portal Program; 
Description: Its systems will develop, procure, and deploy current and 
next generation passive cargo portal units at the nation's borders. 

Program: Domestic Nuclear Detection Office: Cargo Advanced Automated 
Radiography System - Active Radiography Detection Systems; 
Description: Will deliver an advanced imaging system that will 
automatically detect high density material, detecting shielding that 
could be used to hide special nuclear material and highly enriched 
uranium or weapons grade plutonium. The system aims to improve 
throughput rates providing more effective scanning of a higher portion 
of cargo at the nation's ports of entry. 

Program: Domestic Nuclear Detection Office: Joint Analysis Center; 
Description: An integrated system to collect, analyze and distribute 
status, alarms, alert, and spectral data from all radiation portal 
monitors and equipment deployed at the Federal, State, Local, Tribal 
and international levels. 

Program: Federal Emergency Management Agency (FEMA): Consolidated Alert 
& Warning System; 
Description: Provides the president, governors, mayors, tribal 
leadership with the ability to speak to the American people in the 
event of a national emergency by providing an integrated, survivable, 
all-hazards public alert and warning system that leverages all 
available technologies and transmission paths. It will also provide 
"situation awareness" to the public and leadership at multiple levels 
of government in an emergency. 

Program: Federal Emergency Management Agency (FEMA): Disaster 
Management E-Government Initiative; 
Description: Provides information exchange delivery mechanisms through 
a portal for disaster information, an information exchange backbone, 
and data interoperability standards. 

Program: Federal Emergency Management Agency (FEMA): Flood Map 
Modernization; 
Description: Established a technology-based, cost effective process for 
updating, validating, and distributing flood risk data and digitalized 
flood maps throughout the Nation. 

Program: Federal Emergency Management Agency (FEMA): Housing Inspection 
Services, Inspection Contracts; 
Description: Provides inspection staff and logistics at a moment's 
notice to any Presidentially declared disaster. The state of readiness 
is 24 hours a day, 7 days a week, 365 days a year. 

Program: Federal Emergency Management Agency (FEMA): Total Asset 
Visibility (Phase I); 
Description: Provides FEMA, emergency support function partners, and 
state decision makers with visibility of disaster relief assets and 
shipments to help ensure that the right assets are delivered in the 
right quantities to the right locations at the right time. 

Program: Immigration and Customs Enforcement (ICE): Asset Management 
Construction Account; 
Description: Aims to satisfy three fundamental requirements: 1) house a 
growing population of illegal aliens, 2) provide appropriate conditions 
of confinement and 3) maintain its facility infrastructure. These 
requirements must be met through a series of design and build actions 
that begin with establishing facility infrastructure, continue with 
establishing detention capacity and culminate in building secure 
housing facilities. 

Program: Immigration and Customs Enforcement (ICE): Automation and 
Modernization; 
Description: IT modernization and automation initiative that serves as 
the principal ICE program to: enhance ICE's technology foundation, 
maximize workforce productivity, secure the IT environment, and improve 
information sharing across ICE and DHS. 

Program: Immigration and Customs Enforcement (ICE): Detention and 
Removal Modernization; 
Description: Will provide operations management and field personnel the 
technical tools necessary to apprehend, detain, and remove illegal 
aliens in a cost-effective manner. 

Program: Immigration and Customs Enforcement (ICE): Federal Financial 
Management System; 
Description: Provides ICE with core accounting capabilities. 

Program: Immigration and Customs Enforcement (ICE): Student and 
Exchange Visitor Information System; 
Description: Web-based system that manages data on schools, program 
sponsors, foreign students, exchange visitors, and their dependents 
during their approved participation in the U.S. education system so 
that only legitimate visitors enter the US. 

Program: National Protection and Program Directorate: Critical 
infrastructure Warning Information Network; 
Description: Survivable network connecting DHS with sectors that 
restore the infrastructure: electricity, IT and communications; states' 
homeland security advisors; and sector-specific agencies and resources 
for each critical infrastructure sector. 

Program: National Protection and Program Directorate: Infrastructure 
Information Collection Program; 
Description: Collects, catalogs and maintains standardized and 
quantifiable, risk-related infrastructure information to enable the 
execution of national risk management and for prioritizing the data for 
use by DHS partners. 

Program: National Protection and Program Directorate: National Security 
and Emergency Preparedness Priority Telecommunications Service; 
Description: Aims to provide specially designed telecommunications 
services to the national security and emergency preparedness user 
community during natural or man-made disasters when conventional 
communications services are ineffective. These telecommunication 
services are used to coordinate response and recovery efforts and, if 
needed, to assist with facilitating the reconstitution of the 
government. 

Program: National Protection and Program Directorate: US CERT; 
Description: Combines the capabilities of four existing investments to 
form a fully integrated IT system that will help fulfill the 
organization's mission to collect, analyze, and respond to cyber 
security threats and vulnerabilities pursuant to its mission and 
authorities. 

Program: National Protection and Program Directorate: US Visitor and 
Immigrant Status Indicator Technology; 
Description: Program is to collect, maintain, and share information, 
including biometric identifiers, on foreign nationals to determine 
whether an individual (1) should be prohibited from entering the United 
States; (2) can receive, extend, change, or adjust immigration status; 
(3) has overstayed or otherwise violated the terms of admission; (4) 
should be apprehended or detained for law enforcement action; or (5) 
needs special protection/attention (e.g., refugees). The vision of the 
US-VISIT Program is to deploy end-to-end management of data on foreign 
nationals covering their interactions with U.S. immigration and border 
management officials before they enter, when they enter, while they are 
in the U.S., and when they exit. 

Program: Office of Health Affairs: National Bio-Surveillance 
Integration System; 
Description: Information Technology investment with a mission of 
providing early detection and characterization of a biological attack 
on the United States. 

Program: Science and Technology Directorate: National Bio and Agro-
Defense Facility; 
Description: Infrastructure investment to support the Science and 
Technology Chemical and Biological Division program, which provides the 
technologies and systems needed to anticipate, deter, detect, mitigate, 
and recover from possible biological attacks on this nation's 
population, agriculture or infrastructure. The program operates 
laboratories and biological detection systems and conducts research. 

Program: Science and Technology Directorate: National Biodefense 
Analysis and Countermeasures Center Facility; 
Description: Infrastructure investment to support the Science and 
Technology Chemical and Biological Division program, a key component in 
implementing the Presidents National Strategy for Homeland Security by 
addressing the need for substantial research into relevant biological 
and medical sciences to better detect, and mitigate the consequences of 
biological attacks and to conduct risk assessments. The program 
operates laboratories and biological detection systems and conducts 
research. 

Program: Transportation Security Administration (TSA): Electronic 
Baggage Screening Program; 
Description: Implements a national checked-baggage screening system to 
protect against criminal and terrorist threats, while minimizing 
transportation industry and traveling public burdens. 

Program: Transportation Security Administration (TSA): FAMS Air to 
Ground Communications System and Tactical Information Sharing System; 
Description: An airborne communication system of systems (air-to-
ground, ground-to-air, air-to-air and intra-cabin) that will give Air 
Marshall and other Law Enforcement Officers access to wireless 
communications and the ability to share information while in flight. 

Program: Transportation Security Administration (TSA): FAMS Mission 
Scheduling and Notification System; 
Description: System to manage the schedules of federal air marshals 
given the flights available (~25,000 per day) and the complexities of 
last minute changes due to flight cancellations. 

Program: Transportation Security Administration (TSA): Hazmat Threat 
Assessment Program; 
Description: Leverages existing intelligence data to perform threat 
assessments on commercial truck drivers who transport hazardous 
materials to determine threat status to transportation security. 

Program: Transportation Security Administration (TSA): Passenger 
Screening Program; 
Description: Provides the resources required to deploy and maintain 
passenger screening and carry-on baggage screening equipment and 
processes at approximately 451 airports nationwide in order to minimize 
the risk of injury or death of people or damage of property due to 
hostile acts of terrorism. 

Program: Transportation Security Administration (TSA): Secure Flight; 
Description: Will strengthen the security of the nation's 
transportation systems by creating, implementing, and operating a 
threat-based watch list matching capability for approximately 250 
million domestic air carrier passengers per year. 

Program: Transportation Security Administration (TSA): Transportation 
Worker Identification Credentialing; 
Description: Will improve security by establishing a system-wide common 
secure biometric credential, used by all transportation modes, for 
personnel requiring unescorted physical and/or logical access to secure 
areas of the trans system. 

Program: Transportation Security Administration (TSA): TSA Operating 
Platform; 
Description: Provides common environment for hosting applications; 
integrated data infrastructure; content; and a collection of shared 
services. 

Source: DHS information. 

[End of table] 

[End of section] 

Footnotes: 

[1] DHS major investments include those with a total acquisition cost 
of $50 million or above for noninformation technology investments or 
life-cycle costs greater than $100 million for information technology 
investments. 

[2] DHS Integrated Strategy for High-risk Management (2008). 

[3] GAO, Homeland Security: Successes and Challenges in DHS's Efforts 
to Create an Effective Acquisition Organization, [hyperlink, 
http://www.gao.gov/cgi-bin/getrpt?GAO-05-179] (Washington, D.C.: Mar. 
29, 2005). 

[4] GAO, Information Technology: DHS Needs to Fully Define and 
Implement Policies and Procedures for Effectively Managing Investments, 
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-424] (Washington, 
D.C.: Apr. 27, 2007). 

[5] DHS defines investment risk as a measure of the potential inability 
to achieve project objectives within defined cost and schedule 
constraints. It has two components: the probability of failing to 
achieve a particular outcome and the consequences or impact of failing 
to achieve that outcome. 

[6] DHS Management Directive No.1400, Investment Review Process, Draft 
Version 2.0 (March 2006) (interim guidance pending formal clearance, 
hereafter referred to as DHS Management Directive No. 1400). 

[7] DHS Management Directive No. 1400 authorizes DHS and components to 
tailor investment reviews based on the level, type, risk, and 
complexity of the investment and its associated acquisition strategy. 

[8] Investments are categorized into one of four levels based on an 
investment's total acquisition costs, or total life cycle costs for IT 
investments. Investment levels determine the extent and scope of the 
required project and program management, the level of reporting 
requirements, and the review and approval authority. 

[9] Responsibility for the acquisition function at DHS is shared 
between the CPO and each DHS component head. Eight DHS components have 
internal procurement offices with a Head of Contracting Activity who 
reports directly to the component head and is accountable to the CPO. 
The eight components are: Coast Guard, Customs and Border Protection, 
Federal Emergency Management Agency, Federal Law Enforcement Training 
Center, Immigration and Customs Enforcement, Office of Procurement 
Operations, Secret Service, and Transportation Security Administration. 
The Head of Contracting Activity for each component has overall 
responsibility for the day-to-day management of the component's 
acquisition function. 

[10] DHS, Investment Management Handbook, Draft Version 0.14, (March 
2006). 

[11] DHS Management Directive No. 1330, Planning, Programming, 
Budgeting, and Execution. 

[12] DHS Management Directive No. 1400 provides that level 1 and level 
2 programs will have reviews at milestone decision points but no less 
than yearly, depending upon the type and nature of the acquisition. 

[13] For level 1 investments, the IRB is the required review and 
approval authority to proceed to the next acquisition phase. 

[14] For level 2 investments, the JRC is the required review and 
approval authority to proceed to the next acquisition phase. 

[15] DHS Management Directive No. 1400. 

[16] GAO, Best Practices: An Integrated Portfolio Management Approach 
to Weapon System Investments Could Improve DOD's Acquisition Outcomes, 
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-388] (Washington, 
D.C.: Mar. 30, 2007). 

[17] GAO, Emergency Preparedness: Current Emergency Alert System Has 
Limitations, and Development of a New Integrated System Will Be 
Challenging, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-411] 
(Washington, D.C.: Mar. 30, 2007). 

[18] GAO, Supply Chain Security: Challenges to Scanning 100 Percent of 
U.S.-Bound Cargo Containers, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-08-533T] (Washington, D.C.: June 12, 2008). 

[19] GAO, Homeland Security: DHS Has Taken Actions to Strengthen Border 
Security Programs and Operations, but Challenges Remain, [hyperlink, 
http://www.gao.gov/cgi-bin/getrpt?GAO-08-542T] (Washington, D.C.: Mar. 
6, 2008). 

[20] GAO, Information Technology: OMB and Agencies Need to Improve 
Planning, Management, and Oversight of Projects Totaling Billions of 
Dollars, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-1051T] 
(Washington, D.C.: July 31, 2008). 

[21] GAO, Information Technology: OMB and Department of Homeland 
Security Investment Reviews, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-04-323] (Washington, D.C.: Feb. 10, 2004). 

[22] See GAO, Homeland Security: Successes and Challenges in DHS's 
Efforts to Create an Effective Acquisition Organization, [hyperlink, 
http://www.gao.gov/cgi-bin/getrpt?GAO-05-179] (Washington, D.C.: Mar. 
29, 2005). 

[23] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-424]. 

[24] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-424]. 

[25] Department of Homeland Security, Office of the Inspector General, 
Risk Management Advisory for the SBInet Program Initiation, OIG-07-07 
(Washington, D.C.: Nov. 14, 2006). 

[26] DHS Management Directive No. 1400; DHS Investment Management 
Handbook, Draft version 0.14, (March 2006). 

[27] See DOD, Department of Defense Directive Number 5000.1, The 
Defense Acquisition System (May 12, 2003); Department of Defense 
Instruction Number 5000.2, Operation of the Defense Acquisition System 
(May 12, 2003); Defense Acquisition Guidebook, Version 1.0 (Oct. 17, 
2004). 

[28] GAO, Defense Acquisitions: Better Weapon Program Outcomes Require 
Discipline, Accountability, and Fundamental Changes in the Acquisition 
Environment, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-782T] 
(Washington, D.C.: June 3, 2008). 

[29] Per DHS Management Directive No. 0782, Acquisition Certification 
Requirement for Program Managers, DHS Program Managers must be 
certified at a level commensurate with the responsibilities of the 
acquisition being managed or eligible for certification within 18 
months of designation. The DHS CPO may consider temporary waivers to 
training requirements in rare cases. 

[30] See GAO, Homeland Security: Successes and Challenges in DHS's 
Efforts to Create an Effective Acquisition Organization, [hyperlink, 
http://www.gao.gov/cgi-bin/getrpt?GAO-05-179] (Washington, D.C.: Mar. 
29, 2005). 

[31] GAO, Homeland Security: U.S. Visitor and Immigration Status 
Program's Long-standing Lack of Strategic Direction and Management 
Controls Need to Be Addressed, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-07-1065] (Washington, D.C.: Aug. 31, 2007). 

[32] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-542T]. 

[33] GAO, USCIS Transformation: Improvements to Performance, Human 
Capital, and Information Technology Management Needed as Modernization 
Proceeds, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-1013R] 
(Washington, D.C.: July 17, 2007). 

[34] GAO, Executive Guide: Leading Practices in Capital Decision- 
Making, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO/AIMD-99-32] 
(Washington D.C.: December 1998). OMB, Capital Programming Guide: 
Supplement to Circular A-11, Part 7, Preparation, Submission, and 
Execution of the Budget (Washington, D.C.: Executive Office of the 
President, June 2006). 

[35] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-388]. 

[36] OMB, Capital Programming Guide: Supplement to Circular A-11, Part 
7, Preparation, Submission, and Execution of the Budget. 

[37] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-424]. 

[38] GAO, Cost Assessment Guide: Best Practices for Estimating and 
Managing Program Costs, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-07-1134SP] (Washington, D.C.: July 2007). 

[39] GAO, Managing for Results: Using the Results Act to Address 
Mission Fragmentation and Program Overlap, [hyperlink, 
http://www.gao.gov/cgi-bin/getrpt?GAO/AIMD-97-146] (Washington, D.C.: 
Aug. 29, 1997). 

[40] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-424]. 

[41] GAO, Aviation Security: Progress Made in Systematic Planning to 
Guide Key Investment Decisions, but More Work Remains, [hyperlink, 
http://www.gao.gov/cgi-bin/getrpt?GAO-07-448T] (Washington, D.C.: Feb. 
13, 2007). 

[42] GAO, Aviation Security: Transportation Security Administration Has 
Strengthened Planning to Guide Investments in Key Aviation Security 
Programs, but More Work Remains, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-08-456T] (Washington, D.C.: Feb. 28, 2008). 

[43] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-1013R]. 

[44] OMB, Circular No. A-11, Preparation, Submission, and Execution of 
the Budget (Washington, D.C.: Executive Office of the President, June 
2006); Circular No. A-130 Revised, Management of Federal Information 
Resources (Washington, D.C.: Executive Office of the President, Nov. 
28, 2000); and Capital Programming Guide: Supplement to Circular A-11, 
Part 7, Preparation, Submission, and Execution of the Budget. 

[45] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-1051T]. 

[46] DHS major investments include those with a total acquisition cost 
of $50 million or above for noninformation technology investments or 
life-cycle costs greater than $100 million for information technology 
investments. 

[End of section] 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink, http://www.gao.gov] 
and select "E-mail Updates." 

Order by Phone: 

The price of each GAO publication reflects GAO’s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO’s Web site, 
[hyperlink, http://www.gao.gov/ordering.htm]. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional 
information. 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 
E-mail: fraudnet@gao.gov: 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Ralph Dawn, Managing Director, dawnr@gao.gov: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, D.C. 20548: 

Public Affairs: 

Chuck Young, Managing Director, youngc1@gao.gov: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, D.C. 20548: