Key Issues > High Risk > Strengthening Department of Homeland Security Management Functions
High Risk Medallion

Strengthening Department of Homeland Security Management Functions

This information appears as published in the 2015 High Risk Report.

View the 2015 Report

  1. Share with Facebook 
  2. Share with Twitter 
  3. Share with LinkedIn 
  4. Share with mail 

In 2003, we designated implementing and transforming the Department of Homeland Security (DHS) as high risk because DHS had to transform 22 agencies—several with major management challenges—into one department. Further, failure to effectively address DHS’s management and mission risks could have serious consequences for U.S. national and economic security. Given the significant effort required to build and integrate a department as large and complex as DHS, our initial high-risk designation addressed the department’s initial transformation and subsequent implementation efforts to include associated management and programmatic challenges. At that time, we reported that the creation of DHS was an enormous undertaking that would take time to achieve, and that the successful transformation of large organizations, even those undertaking less strenuous reorganizations, could take years to implement.

Over the past 12 years, the focus of this high-risk area has evolved in tandem with DHS’s maturation and evolution. The overriding tenet has consistently remained DHS’s ability to build a single, cohesive, and effective department that is greater than the sum of its parts—a goal that requires effective collaboration and integration of its various components and management functions. In 2007, in reporting on DHS’s progress since its creation, as well as in our 2009 high-risk update, we reported that DHS had made more progress in implementing its range of missions than its management functions—information technology (IT), acquisition, financial, and human capital—and that continued work was needed to address an array of programmatic and management challenges. As we reported in September 2011, DHS’s initial focus on mission implementation was understandable given the critical homeland security needs facing the nation after the department’s establishment, and the challenges posed by its creation, integration, and transformation.

As DHS continued to mature, and as we reported in our assessment of DHS’s progress and challenges in the 10 years following 9/11, we found that the department implemented key homeland security operations and achieved important goals in many areas to create and strengthen a foundation to reach its potential.[1] For example, DHS developed strategic and operational plans to guide its efforts, such as the National Response Framework that outlines disaster response guiding principles; and successfully hired, trained, and deployed workforces, including the federal screening workforce to assume screening responsibilities at airports nationwide. However, we also identified that more work remained for DHS to address weaknesses in its operational and implementation efforts, and to strengthen the efficiency and effectiveness of those efforts. For example, we reported in 2011 that DHS had not yet determined how to implement a biometric exit capability, had taken action to address a small portion of the estimated overstay population in the United States, and needed to strengthen efforts to assess capabilities for all-hazards preparedness. We further reported that a key theme impacting the department’s implementation efforts was the continuing weaknesses in DHS’s management functions.

Recognizing DHS’s progress in transformation and mission implementation, our 2011 high-risk update focused on the continued need to strengthen DHS’s management functions and integrate those functions within and across the department, as well as the impact of these challenges on the department’s ability to effectively and efficiently carry out its missions. In our 2013 high-risk update, we found that DHS had made considerable progress in strengthening and integrating its management functions. However, the 2013 high-risk update also noted that challenges remained and progress was needed to mitigate the risks that management weaknesses posed to mission accomplishment and the efficient and effective use of the department’s resources. Therefore, in 2013 we narrowed the scope of the high-risk area and changed the name from Implementing and Transforming DHS to Strengthening DHS Management Functions to reflect this focus.



[1] GAO, Department of Homeland Security: Progress Made and Work Remaining in Implementing Homeland Security Missions 10 Years after 9/11, GAO‑11‑881 (Washington, D.C.: Sept. 7, 2011). This report addressed DHS’s progress in implementing its homeland security missions since it began operations, work remaining, and issues affecting implementation efforts. Drawing from more than 1,000 GAO reports and congressional testimony issued related to DHS programs and operations, and approximately 1,500 recommendations made to strengthen mission and management implementation, this report addressed progress and remaining challenges in such areas as border security and immigration, transportation security, and emergency management, among others.

Strengthening Department of Homeland Security Management Functions

DHS’s efforts to strengthen and integrate its acquisition, IT, financial, and human capital management functions have resulted in progress addressing our criteria for removal from the high-risk list. In particular, DHS has met two criteria (leadership commitment and a corrective action plan) and partially met the remaining three criteria (capacity; a framework to monitor progress; and demonstrated, sustained progress).

Leadership Commitment: The Secretary and Deputy Secretary of Homeland Security, the Under Secretary for Management at DHS, and other senior officials have continued to demonstrate commitment and top leadership support for addressing the department’s management challenges. They have also taken actions to institutionalize this commitment to help ensure the long-term success of the department’s efforts. For example, in May 2012, the Secretary of Homeland Security modified the delegations of authority between the Management Directorate and its counterparts at the component level to clarify and strengthen the authorities of the Under Secretary for Management across the department. In addition, in April 2014, the Secretary of Homeland Security issued a memorandum entitled, Strengthening Departmental Unity of Effort, committing to, among other things, improving DHS’s planning, programming, budgeting, and execution processes through strengthened departmental structures and increased capability. This memorandum identified several initial areas of focus intended to build organizational capacity, such as DHS headquarters’ strategy, planning, and analytical capability.[1] Senior DHS officials have also routinely met with us over the past 6 years to discuss the department’s plans and progress in addressing this high-risk area. During this time, we provided specific feedback on the department’s efforts. According to these officials, and as demonstrated through their progress, the department is committed to demonstrating measurable, sustained progress in addressing this high-risk area. It will be important for DHS to maintain its current level of top leadership support and commitment to ensure continued progress in successfully executing its corrective actions through completion.

Corrective Action Plan: DHS has established a plan for addressing this high-risk area. Specifically, in a September 2010 letter to DHS, we identified and DHS agreed to achieve 31 actions and outcomes that are critical to addressing the challenges within the department’s management areas and in integrating those functions across the department. In March 2014, we updated the actions and outcomes in collaboration with DHS to reduce overlap and ensure their continued relevance and appropriateness. These updates resulted in a reduction from 31 to 30 total actions and outcomes. Toward achieving the actions and outcomes, DHS issued its initial Integrated Strategy for High Risk Management in January 2011 and has since provided updates to its strategy in seven later versions, most recently in October 2014. The integrated strategy includes key management initiatives and related corrective actions plans for addressing DHS’s management challenges and the actions and outcomes we identified. DHS’s strategy and approach to continuously refining actionable steps to implementing the outcomes, if implemented effectively and sustained, provides a path for DHS to be removed from our high-risk list.

Capacity: In October 2014, DHS identified that it had resources needed to implement 7 of the 11 initiatives the department had under way to achieve the actions and outcomes, but did not identify sufficient resources for the 4 remaining initiatives. In addition, our prior work has identified specific capacity gaps that could undermine achievement of management outcomes. For example, in September 2012, we reported that 51 of 62 acquisition programs we surveyed reported that they faced workforce shortfalls in program management, cost estimating, engineering, and other areas. We concluded that this increased the likelihood that the programs will perform poorly in the future. Since that time, DHS has appointed component acquisition executives at the components and progressed in filling staff positions. In April 2014, however, we reported that DHS needed to increase its cost-estimating capacity and that the department had not approved baselines for 21 of 46 major acquisition programs. These baselines—which establish cost, schedule, and capability parameters—are necessary to accurately assess program performance. DHS needs to continue to identify resources for the remaining initiatives, work to mitigate shortfalls and prioritize initiatives, as needed, and communicate to senior leadership critical resource gaps.

Framework to Monitor Progress: DHS established a framework for monitoring its progress in implementing the integrated strategy it identified for addressing the 30 actions and outcomes. In the June 2012 update to the Integrated Strategy for High Risk Management, DHS included, for the first time, performance measures to track its progress in implementing all of its key management initiatives. DHS continued to include performance measures in its October 2014 update. Additionally, in March 2014, the Deputy Secretary of Homeland Security began meeting monthly with the DHS management team to discuss DHS’s progress in strengthening its management functions. According to senior DHS officials, as part of these meetings, attendees discuss a report that senior DHS officials update monthly which identifies corrective actions for each outcome, as well as projected and actual completion dates. However, the department can strengthen this framework. In particular, according to DHS officials, as of November 2014, they were establishing a monitoring program that will include assessing whether financial management systems modernization projects for key components that DHS plans to complete in 2019 are following industry best practices and meet users’ needs. Effective implementation of these modernizations projects is important because, until they are complete, the department’s current systems will not effectively support financial management operations. Moving forward, DHS will need to closely track and independently validate the effectiveness and sustainability of its corrective actions and make midcourse adjustments, as needed.

Demonstrated, Sustained Progress: DHS has made important progress in strengthening its management functions, but needs to demonstrate sustainable, measurable progress in addressing key challenges that remain within and across these functions. DHS has implemented a number of actions demonstrating the department’s progress in strengthening its management functions, with 14 actions and outcomes that are either fully or mostly addressed. For example, DHS has increased component-level acquisition capability by, among other things, initiating monthly Component Acquisition Executive staff forums to provide guidance and share best practices. DHS has also strengthened its enterprise architecture program (or blueprint) to guide and constrain IT acquisitions, and obtained a clean opinion on its financial statements for 2 consecutive years, fiscal years 2013 and 2014. Further, the Secretary of Homeland Security signed a human capital strategic plan in 2011 that DHS has since made sustained progress in implementing.

However, DHS continues to face significant management challenges that hinder the department’s ability to meet its missions. For example, DHS does not have the acquisition management tools in place to consistently demonstrate whether its major acquisition programs are on track to achieve their cost, schedule, and capability goals. In addition, DHS does not have modernized financial management systems. This affects its ability to have ready access to reliable information for informed decision making. Further, it is important that DHS can retain and attract the talent required to complete its work. But, the department continues to face significant employee morale challenges. Addressing these and other management challenges will be a significant undertaking that will likely require several years, but will be critical for the department to mitigate the risks that management weaknesses pose to mission accomplishment.

Key to addressing the department’s management challenges is DHS demonstrating the ability to achieve sustained progress across the 30 actions and outcomes we identified and DHS agreed were needed to address the high-risk area. Achieving sustained progress across the actions and outcomes, in turn, requires leadership commitment, effective corrective action planning, adequate capacity (that is, the people and other resources), and monitoring the effectiveness and sustainability of supporting initiatives. The 30 key actions and outcomes include, among others, validating required acquisition documents in accordance with a department-approved, knowledge-based acquisition process, and sustaining clean audit opinions for at least 2 consecutive years on department-wide financial statements and internal controls.

DHS has made important progress across all of its management functions and significant progress in the area of management integration. In particular, DHS has made important progress in several areas to fully address nine actions and outcomes, five of which it has sustained as fully implemented for at least 2 years. For instance, DHS fully met one outcome for the first time by establishing sufficient component-level acquisition capability. It also sustained full implementation of another outcome by continuing to use performance measures to assess progress made in achieving department-wide management integration. DHS has also mostly addressed an additional five actions and outcomes, meaning that a small amount of work remains to fully address them. DHS’s progress is further evident in the number of actions and outcomes with increased ratings since our 2013 high-risk update.[2]

Considerable work remains, however, in several areas for DHS to fully achieve the remaining actions and outcomes and thereby strengthen its management functions. Specifically, we determined that DHS has partially addressed 12 and initiated 4 of the actions and outcomes. As previously mentioned, addressing some of these actions and outcomes, such as those pertaining to improving employee morale and modernizing the department’s financial management systems, are significant undertakings that will likely require multiyear efforts. Table 7 summarizes DHS’s progress in addressing the 30 actions and outcomes and is followed by selected examples.

Table 7: GAO Assessment of Department of Homeland Security Progress in Addressing Key Actions and Outcomes

Key Outcomes

Fully Addresseda

Mostly Addressedb

Partially Addressedc

Initiatedd

Total

Acquisition management

1

 

3

1

5

Information technology management

2

3

1

 

6

Financial managemente

2

 

3

3

8

Human capital management

1

2

4

 

7

Management integration

3

 

1

 

4

Total

9

5

12

4

30

Source: GAO analysis of DHS documents, interviews, and prior GAO reports. | GAO-15-290.

a”Fully addressed: outcome is fully addressed.

b”Mostly addressed: progress is significant and a small amount of work remains.

c”Partially addressed: progress is measurable, but significant work remains.

d”Initiated: activities have been initiated to address outcome, but it is too early to report progress.

eAlthough March 2014 updates to most functional areas were minor, there were more significant revisions to the financial management actions and outcomes, with some outcomes revised or dropped and others added. These revisions prevent the financial management actions and outcomes from being comparable on a one-for-one basis to prior years. Accordingly, our ratings of DHS’s progress in addressing financial management actions and outcomes are not an indication of a downgrade to the department’s progress.

 

  • Acquisition Management. DHS has fully addressed one of the five acquisition management outcomes, partially addressed three outcomes, and initiated actions to address the remaining outcome. For example, DHS has taken a number of recent actions to fully address establishing effective component-level acquisition capability. These actions include initiating (1) monthly Component Acquisition Executive staff forums in March 2014 to provide guidance and share best practices and (2) assessments of component policies and processes for managing acquisitions. In addition, DHS continues to assess and address whether appropriate numbers of trained acquisition personnel are in place at the department and component levels, an outcome it has partially addressed. Further, while DHS has initiated efforts to demonstrate that major acquisition programs are on track to achieve their cost, schedule, and capability goals, DHS officials have acknowledged it will be years before this outcome has been fully addressed. Much of the necessary program information is not yet consistently available or up to date.
  • IT Management. DHS has fully addressed two of the six IT management outcomes, mostly addressed another three, and partially addressed the remaining one. For example, DHS has finalized a directive to establish its tiered governance and portfolio management structure for overseeing and managing its IT investments, and annually reviews each of its portfolios and the associated investments to determine the most efficient allocation of resources within each of the portfolios. DHS has also implemented its IT Strategic Human Capital Plan at the enterprise level. This includes developing an IT specialist leadership competency gap workforce analysis and a DHS IT career path pilot. However, as DHS has not yet determined the extent to which the component chief information officers have implemented the enterprise human capital plan’s objectives and goals, DHS’s capacity to achieve this outcome is unclear. Additionally, DHS continues to take steps to enhance its information security program. However, while the Department obtained a clean opinion on its financial statements, in November 2014, the department’s financial statement auditor reported that continued flaws in security controls such as those for access controls, configuration management, and segregation of duties were a material weakness for fiscal year 2014 financial reporting.[3] Thus, the department needs to remediate the material weakness in information security controls reported by its financial statement auditor.
  • Financial Management. DHS has fully addressed two financial management outcomes, partially addressed three, and initiated three.[4] Most notably, DHS received a clean audit opinion on its financial statements for 2 consecutive years, fiscal years 2013 and 2014, fully addressing two outcomes. As of November 2014, DHS was working toward addressing a third outcome—establishing effective internal control over financial reporting. We reported in September 2013 that DHS needs to eliminate all material weaknesses at the department level, including weaknesses related to financial management systems, before its financial auditor can affirm that controls are effective. However, DHS has yet to identify and commit the resources needed for remediating the remaining material weaknesses. DHS also needs to modernize key components’ financial management systems and comply with financial management system requirements. The components’ financial management system modernization efforts are at various stages due, in part, to a bid protest and the need to resolve critical stability issues with a legacy financial system before moving forward with system modernization efforts. Without sound controls and systems, DHS faces long-term challenges in obtaining and sustaining a clean audit opinion on internal control over financial reporting, and ensuring its financial management systems generate reliable, useful, and timely information for day-to-day decision making.
  • Human Capital Management. DHS has fully addressed one human capital management outcome, mostly addressed two, and partially addressed the remaining four. For example, the Secretary of Homeland Security signed a human capital strategic plan in 2011 that DHS has since made sustained progress in implementing, fully addressing this outcome. DHS also has actions underway to identify current and future human capital needs. However, DHS has considerable work ahead to improve employee morale. For example, the Office of Personnel Management’s 2014 Federal Employee Viewpoint Survey data showed that DHS’s scores continued to decrease in all four dimensions of the survey’s index for human capital accountability and assessment—job satisfaction, talent management, leadership and knowledge management, and results-oriented performance culture. DHS has taken steps to identify where it has the most significant employee satisfaction problems and developed plans to address those problems. In September 2012, we recommended, among other things, that DHS improve its root-cause analysis efforts related to these plans. In December 2014, DHS reported actions underway to address our recommendations but had not fully implemented them. Given the sustained decrease in DHS employee morale indicated by Federal Employee Viewpoint Survey data, it is particularly important that DHS implement these recommendations and thereby help identify appropriate actions to take to improve morale within its components and department wide.
  •  Management Integration. DHS has sustained its progress in fully addressing three of four outcomes we identified and agreed they are key to the department’s management integration efforts. For example, in January 2011, DHS issued a comprehensive action plan to guide its management integration efforts—the Integrated Strategy for High Risk Management. Since then, DHS has generally made improvements to the strategy with each update based on feedback we provided. DHS has also shown important progress in addressing the last and most significant management integration outcome—to implement actions and outcomes in each management area to develop consistent or consolidated processes and systems within and across its management functional areas. But, considerable work remains. For example, the Secretary’s April 2014 Strengthening Departmental Unity of Effort memorandum highlighted a number of initiatives designed to allow the department to operate in a more integrated fashion, such as the Integrated Investment Life Cycle Management initiative, to manage investments across the department’s components and management functions. DHS completed its pilot for a portion of this initiative in March 2014 and, according to DHS’s Executive Director for Management Integration, has begun expanding its application to new portfolios, such as border security and information sharing, among others. However, given that these main management integration initiatives are in the early stages of implementation and contingent upon DHS following through with its plans, it is too early to assess their impact. To achieve this outcome, DHS needs to continue to demonstrate sustainable progress integrating its management functions within and across the department and its components.


[1] DHS, Secretary of Homeland Security, Strengthening Departmental Unity of Effort, Memorandum for DHS Leadership(Washington, D.C.: Apr. 22, 2014).

[2] Although the March 2014 revisions we made to the actions and outcomes in most management areas were minor, there were more significant revisions to the now 8 financial management actions and outcomes that prevent their comparison across years. Excluding these 8 actions and outcomes, as well as the 4 nonfinancial management actions and outcomes for which the department had already earned the highest possible rating of “fully addressed,” DHS had the opportunity to increase its ratings in 18 of 30 nonfinancial management actions and outcomes that were not fully addressed in our 2013 high-risk update. Of these 18 actions and outcomes, DHS increased its ratings in 10 over the last 2 years.

[3] A material weakness is a deficiency, or a combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented, or detected and corrected, on a timely basis. A significant deficiency is a deficiency, or combination of deficiencies, in internal control that is less severe than a material weakness, but is important enough to merit attention by those charged with governance.

[4] As previously discussed, in March 2014, we updated the actions and outcomes in collaboration with DHS to reduce overlap and ensure their continued relevance and appropriateness. These updates resulted in a reduction from nine to eight total financial management actions and outcomes.

In the coming years, DHS needs to continue implementing its Integrated Strategy for High Risk Management and show measurable, sustainable progress in implementing its key management initiatives and corrective actions and achieving outcomes. In doing so, it will be important for DHS to:

  • maintain its current level of top leadership support and sustained commitment to ensure continued progress in executing its corrective actions through completion;
  •  continue to implement its plan for addressing this high-risk area and periodically report its progress to us and Congress;
  • identify and work to mitigate any resource gaps, and prioritize initiatives as needed to ensure it can to implement and sustain its corrective actions;
  •  closely track and independently validate the effectiveness and sustainability of its corrective actions and make midcourse adjustments as needed; and
  • make continued progress in achieving the 21 actions and outcomes it has not fully addressed and demonstrate that systems, personnel, and policies are in place to ensure that progress can be sustained over time.

We will continue to monitor DHS’s efforts in this high-risk area to determine if the actions and outcomes are achieved and sustained over the long term.

Looking for our recommendations? Click on any report to find each associated recommendation and its current implementation status.
  • portrait of David C. Maurer
    • David C. Maurer
    • Director, Homeland Security and Justice
    • maurerd@gao.gov
    • (202) 512-9627