This is the accessible text file for GAO report number GAO-05-824T 
entitled 'Strategic Budgeting: Risk Management Principles Can Help DHS 
Allocate Resources To Highest Priorities' which was released on June 
30, 2005. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. 
Every attempt has been made to maintain the structural and data 
integrity of the original printed product. Accessibility features, such 
as text descriptions of tables, consecutively numbered footnotes placed 
at the end of the file, and the text of agency comment letters, are 
provided but may not exactly duplicate the presentation or format of 
the printed version. The portable document format (PDF) file is an 
exact electronic replica of the printed version. We welcome your 
feedback. Please E-mail your comments regarding the contents or 
accessibility features of this document to 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 


Before the Subcommittee on Management, Integration, and Oversight, 
Committee on Homeland Security, House of Representatives: 

United States Government Accountability Office: 


For Release on Delivery Expected at 3:00 p.m. EST: 

Wednesday, June 29, 2005: 

Strategic Budgeting: 

Risk Management Principles Can Help DHS Allocate Resources To Highest 

Statement of David M. Walker: 
Comptroller General of the United States: 


GAO Highlights: 

Highlights of GAO-05-824T, a testimony before the Subcommittee on 
Management, Integration, and Oversight, House Committee on Homeland 

Why GAO Did This Study: 

Previous GAO work has outlined the nation’s growing fiscal imbalance 
and called for a fundamental reexamination of the base of the federal 
government. The significant resources directed to the Department of 
Homeland Security (DHS) indicate that a robust homeland security 
program is viewed as critical to the protection and prosperity of 
Americans. This testimony addresses the need for a fundamental 
reexamination of the base of government, the role that performance 
budgeting tools can play in helping inform agency activities, and DHS’s 
use of performance budgeting and risk management concepts. It also 
includes examples from GAO work on homeland security issues that 
highlight DHS attempts to define an acceptable and achievable level of 

What GAO Found: 

The nation faces a long-term fiscal imbalance, and the role of the 
federal government is being reshaped by many forces, such as evolving 
defense and homeland security policies and new organizational and 
institutional arrangements for carrying out public activities. Given 
these circumstances, there is a critical need for the federal 
government to reexamine the base of its programs, policies, functions, 
and activities. A periodic reexamination of major federal spending and 
tax policies offers the prospect for the American government to 
eliminate outmoded operations and better align its operations with the 
demands of a changing world. The management and performance reforms 
enacted by Congress in the past 15 years have provided new tools to 
support this kind of reexamination. However, these new tools must be 
implemented by agencies and used by the Congress in its decision making 
in order to be effective.

Performance budgeting can help policymakers address important questions 
about whether and how programs contribute to their stated goals. It can 
help enhance the government’s capacity to assess competing claims for 
federal dollars by arming decision makers with better information on 
the results of individual programs, as well as on various federal 
policies and programs addressing common goals. Performance budgeting, 
however, cannot provide answers to every resource question—particularly 
where allocation is a function of competing values and interests that 
depend on factors other than program performance.

Congress and the President have agreed on DHS’s mission, and DHS has 
established strategic objectives for achieving its mission. However, 
DHS’s strategic plan does not detail the associated resources necessary 
to carry out its mission and achieve its strategic goals. DHS has 
called for using risk-based approaches to prioritize its resource 
investments regarding critical infrastructure, and for developing plans 
and allocating resources in a way that balance security and freedom. It 
must carefully weigh the benefit of homeland security endeavors and 
allocate resources where the benefit of reducing risk is worth the 
additional cost. A comprehensive risk management framework—which 
includes an assessment of risk through threat, vulnerability, and 
criticality assessments—should be applied to guide these decisions. DHS 
has not completed a comprehensive national threat and risk assessment. 
However, some components of DHS have taken initial steps to apply 
elements of risk management to its operations and decision making. For 
example, the Coast Guard has taken actions to assess and mitigate 
vulnerabilities in order to enhance maritime security, and the 
Transportation Security Administration has conducted vulnerability 
assessments at selected general aviation airports. Congress and 
agencies have a shared responsibility for ensuring that performance 
budgeting and risk management approaches are both useful and used.

To view the full product, including the scope and methodology, click on 
the link above. For more information, contact Norman Rabkin at (202) 
512-8777 or

[End of section]

Mr. Chairman and Members of the Subcommittee: 

I am pleased to be here today to discuss how the Department of Homeland 
Security (DHS) can use performance budgeting and risk management 
principles to maximize program performance in an environment of 
increasing fiscal constraints.[Footnote 1]

Today I will touch on the need for a fundamental reexamination of the 
base of government, given our current, imprudent, and unsustainable 
fiscal path. Then I will turn to and discuss the important role that 
performance budgeting and risk management principles can play in 
setting priorities for the department's homeland security activities. 
Finally, I will draw upon our work in DHS on homeland security issues 
to highlight examples of where the department has attempted to define 
an acceptable and achievable level of risk. 

The significant resources directed to homeland security and to DHS in 
particular indicate that a robust homeland security program is viewed 
as critical to the nation's protection and prosperity. It is clear that 
before the events of September 11, 2001, it was difficult to anticipate 
the array of new and challenging demands on federal programs, and to 
envision the claims on future budgets for homeland security concerns. 
Given current trends and challenges facing the nation--including the 
long-term fiscal imbalance--it is critical that the federal government 
reexamine the base of federal spending and tax programs, at the same 
time holding all programs accountable for spending wisely and achieving 
real results. 

By using performance budgeting tools and the priorities outlined in the 
National Strategy for Homeland Security, the department will be in a 
better position to respond to changing circumstances. The Government 
Performance and Results Act of 1993 (GPRA)[Footnote 2] and various 
assessment efforts, such as the Administration's Program Assessment 
Rating Tool (PART), can provide a foundation for a baseline review of 
existing policies, programs, functions, and activities in the 
department. In addition, they have the potential to help decision 
makers assess competing claims by providing better information on the 
results of individual programs, and on policies and programs designed 
to address common goals. 

Just as we know that the threat of terrorism will persist well into the 
21st century, we also know it is unrealistic to expect future funding 
increases for homeland security efforts to occur at the same rate as in 
the recent past. Given the reality that no amount of money can make us 
completely safe from a terrorist attack, the National Strategy for 
Homeland Security provides guidance for considering how to make the 
best use of available funds to mitigate the most serious risks, while 
also assuring that the reduction in risk is worth the amount of 
additional cost. Since we cannot afford to protect everything against 
all threats, GAO has advocated that DHS make clear the link between the 
choices made about protection priorities and the allocation of 
available resources. Proposals to reduce risk must be evaluated on 
numerous dimensions - their dollar cost and their impact on other goals 
and values. Decisions on the level of resources, the allocation of 
those resources, and how to balance security against other societal 
goals and values also need to be considered. 

Our recent work at DHS suggests that developing and using a risk-based 
approach for making resource investment decisions will not be easy. 
Decision makers may not have complete or current information on 
threats, vulnerabilities, consequences, alternatives, and costs. 
Nevertheless, we see benefits in continuing to develop the approach, 
and are prepared to work with the department and others in the 
Administration to make it happen. 

This testimony is based on our wide-ranging work on GPRA, federal 
budget and performance integration, and 21st century challenges; as 
well as our work on homeland security and risk management. We conducted 
our work in accordance with generally accepted government auditing 

The Long-Term Fiscal Challenge Drives the Fiscal Future and the Need 
for Reexamination: 

Known demographic trends, rising health care costs, and lower federal 
revenues as a percentage of the economy are the major drivers of the 
nation's large and growing structural deficits. The nation cannot 
ignore this fiscal large and growing fiscal imbalance--it is not a 
matter of whether the nation deals with the fiscal gap, but how and 
when. GAO's long-term budget simulations illustrate the magnitude of 
this fiscal challenge. Figures 1 and 2 show these simulations under two 
different sets of assumptions. Figure 1 uses the Congressional Budget 
Office's (CBO) January 2005 baseline through 2015. As required by law, 
that baseline assumes no changes in current law, that discretionary 
spending grows with inflation through 2015, and that all tax cuts 
currently scheduled to expire actually do expire. In Figure 2, two 
assumptions about that first 10 years are changed: (1) discretionary 
spending grows with the economy rather than with inflation, and (2) all 
tax cuts currently scheduled to expire are made permanent. In both 
simulations discretionary spending is assumed to grow with the economy 
after 2015 and revenue is held constant as a share of gross domestic 
product (GDP) at the 2015 level. Also in both simulations, long-term 
Social Security and Medicare spending are based on the 2005 trustees' 
intermediate projections, and we assume that benefits continue to be 
paid in full after the trust funds are exhausted. Long-term Medicaid 
spending is based on CBO's December 2003 long-term projections under 
their midrange assumptions. 

Figure 1: Composition of Spending as a Share of GDP Under Baseline 

[See PDF for image]

[End of figure]

Figure 2: Composition of Spending as a Share of GDP Assuming 
Discretionary Spending Grows with GDP After 2005 and All Expiring Tax 
Provisions are Extended: 

[See PDF for image]

[End of figure]

As these simulations illustrate, absent policy changes on the spending 
and/or revenue side of the budget, the growth in spending on federal 
retirement and health entitlements will encumber an escalating share of 
the government's resources. Indeed, when we assume that recent tax 
reductions are made permanent and discretionary spending keeps pace 
with the economy, our long-term simulations suggest that by 2040 
federal revenues may be adequate to pay little more than interest on 
the federal debt. Neither slowing the growth in discretionary spending 
nor allowing the tax provisions to expire--nor both together--would 
eliminate the imbalance. Although federal tax policies will likely be 
part of any debate about our fiscal future, making no changes to Social 
Security, Medicare, Medicaid, and other drivers of the long-term fiscal 
gap would require at least a doubling of federal taxes in the future-- 
and that seems both unrealistic and inappropriate. 

Demographic shifts and rising health care costs are not the only forces 
at work that require the federal government to rethink its entire 
approach to program performance, policy design, public priorities, and 
management practices. Other important forces are working to reshape 
American society, our place in the world, and the role of the federal 
government. These include evolving defense and homeland security 
policies, increasing global interdependence, and advances in science 
and technology. In addition, the federal government increasingly relies 
on new networks and partnerships to develop public policy and achieve 
positive results, often including multiple federal agencies, domestic 
and international non-or quasi-government organizations, for-profit and 
not-for-profit contractors, and state and local governments. 

If government is effectively to address these trends, it cannot treat 
all of its existing programs, policies, and activities as givens. 
Outmoded commitments and operations constitute an encumbrance on the 
future that can and does erode the capacity of the nation to better 
align its government with the needs and demands of a changing world and 
society. Accordingly, reexamining the base of all major existing 
federal spending and tax programs, policies, and activities by 
reviewing their results and testing their continued relevance and 
relative priority for our changing society is an important step in the 
process of assuring fiscal responsibility and facilitating national 
renewal.[Footnote 3]

A periodic reexamination offers the prospect of addressing emerging 
needs by weeding out programs and policies that are redundant, 
outdated, or ineffective. Those programs and policies that remain 
relevant could be updated and modernized by improving their targeting 
and efficiency through such actions as redesigning allocation and cost- 
sharing provisions, consolidating facilities and programs, and 
streamlining and reengineering operations and processes. The tax 
policies and programs financing the federal budget can also be reviewed 
with an eye toward both the overall level of revenues that should be 
raised as well as the mix of taxes that are used. 

Reexamining the base offers compelling opportunities to both redress 
our current and projected fiscal imbalance while better positioning 
government to meet the new challenges and opportunities of the 21st 
century. In this regard, the management and performance reforms enacted 
by Congress in the past 15 years have provided new tools to gain 
insight into the financial, program, and management performance of 
federal agencies and activities. The information being produced as a 
result can provide a strong basis to support the much needed and long 
overdue review, reassessment, and reprioritization process. 

Performance Budgeting Holds Promise for Reassessment and Priority 

With GPRA as their centerpiece, these reforms also laid the foundation 
for performance budgeting by establishing infrastructures in the 
agencies to improve the supply of information on planning, performance 
and costs. GPRA is designed to inform congressional and executive 
decision making by providing objective performance and cost information 
on the effectiveness and efficiency of federal programs and spending. A 
key purpose of GPRA is to create closer and clearer links between the 
process of allocating scarce resources and the expected results to be 
achieved with those resources.[Footnote 4] Importantly, GPRA requires 
both a connection to the structures used in congressional budget 
presentations and consultation between the executive and legislative 
branches on agency strategic plans.[Footnote 5] Because these 
requirements are grounded in statute, Congress has an oversight stake 
in GPRA's success. Over a decade after its enactment, GPRA has 
succeeded in expanding the supply of performance information and 
institutionalizing a culture of performance as well as providing a 
solid foundation for more recent budget and performance 
initiatives.[Footnote 6]

Building on GPRA, the current administration has made the integration 
of performance and budget information one of five top governmentwide 
management priorities. Under the President's Management Agenda (PMA), 
agencies are expected to implement integrated financial and performance 
management systems that routinely produce information that is (1) 
timely--to measure and affect performance, (2) useful--to make more 
informed operational and investing decisions, and (3) reliable--to 
ensure consistent and comparable trend analysis over time and to 
facilitate better performance measurement and decision making. It is 
critical that budgetary investments in this area be viewed as part of a 
broader initiative to improve the accountability and management 
capacity of federal agencies and programs. Over the longer term, 
failing to discover and correct performance problems will be much more 

The Program Assessment and Rating Tool (PART) is a questionnaire that 
is designed to provide a systematic approach to assessing the strengths 
and weaknesses of a program. PART asks, for example, whether a 
program's long-term goals are specific, ambitious, and focused on 
outcomes, and whether annual goals demonstrate progress toward 
achieving the long-term goals. It is intended to be evidence-based, 
drawing on a wide array of information, including authorizing 
legislation, GPRA strategic plans and performance plans and reports, 
financial statements, inspector general and GAO reports, and 
independent program evaluations.[Footnote 7] Importantly, PART can be 
used to identify gaps in information. The fact that a program's PART 
score suffers from the absence of information provides added impetus 
for agencies to enhance their evaluation and information-gathering 
capabilities.[Footnote 8]

PART's program-by-program approach fits with OMB's agency-by-agency 
budget reviews, but it is not well suited to addressing crosscutting 
issues or to looking at broad program areas in which several programs 
address a common goal. It is often critical to understand how each 
program fits with a broader portfolio of tools and strategies--such as 
regulations, direct loans, and tax expenditures--to accomplish federal 
missions and performance goals. 

The credibility of performance information, including related cost 
data, and the ability of federal agencies to produce credible 
evaluations of their programs' effectiveness are key to the success of 
performance budgeting. As I have testified before, this type of 
information is critical for effective performance measurement to 
support decisions in areas ranging from program efficiency and 
effectiveness to sourcing and contract management.[Footnote 9] To be 
effective, this information must be not only timely and reliable, but 
also both useful and used. 

Federal performance and accountability reforms have given much 
attention to increasing the supply of performance information over the 
past several decades. However, improving the supply of performance 
information is in and of itself insufficient to achieve and sustain 
results-based performance budgeting and management approaches. Rather, 
it needs to be accompanied by a demand for and use of that information 
by congressional decision makers and executive managers alike. The 
history of performance budgeting suggests that congressional support 
and use of this information is critical to sustain reforms over time. 
Congress has a number of opportunities to provide its perspective on 
performance issues and performance goals, such as when it establishes 
or reauthorizes a new program, during the annual appropriations 
process, and in its oversight of federal policies and programs. 

Performance budgeting can do a great deal to help policy makers address 
important questions, such as whether programs are contributing to their 
stated goals, are well-coordinated with related initiatives at the 
federal level or elsewhere, and are targeted to the intended 
beneficiaries. However, it should not be expected to provide the 
answers to all resource allocation questions in some automatic or 
formula-driven process. Performance problems may well prompt budget 
cuts, program consolidations, or eliminations. Alternatively, as in the 
case of homeland security, programs that existed before September 11 
may now be deemed to be of sufficiently high priority to the nation 
that they inspire enhanced investments and reforms in program design 
and management. Conversely, even a program that is found to be 
exceeding its performance expectations can be a candidate for budgetary 
cuts if it is a lower priority than other competing claims in the 
process. The determination of priorities is a function of competing 
values and interests that may be informed by performance information 
but also reflects other factors, such as the overall budget situation, 
the state of the economy, security needs, equity considerations, unmet 
societal needs, and the appropriate role of the federal government in 
addressing any such needs. 

Planning and Risk Management Key to Overall Approach for Allocating 
Homeland Security Resources: 

As reflected in the Homeland Security Act of 2002[Footnote 10] (enacted 
in November 2002) and the National Strategy for Homeland Security 
(issued in July 2002), both Congress and the President have agreed that 
DHS should be focused on preventing terrorist attacks, reducing the 
country's vulnerability to terrorism, and minimizing the damage and 
recovering from any attacks that may occur. The President's national 
strategy also notes that the United States "must carefully weigh the 
benefit of each homeland security endeavor and only allocate resources 
where the benefit of reducing risk is worth the amount of additional 
cost." It recognizes that the need for homeland security is not tied 
solely to the current terrorist threat but to enduring vulnerability 
from a range of potential threats that could include weapons of mass 
destruction and bioterrorism. 

Using the national strategy and the act as foundations, the department 
issued its first departmentwide strategic plan in February 2004. The 
strategic plan sets out the following strategic objectives for 
achieving DHS's mission: 

* Awareness--Identify and understand threats, assess vulnerabilities, 
determine potential impacts, and disseminate timely information to our 
homeland security partners and the American public. 

* Prevention--Detect, deter, and mitigate threats to our homeland. 

* Protection--Safeguard our people and their freedoms, and critical 
infrastructure, property and the economy of our nation from acts of 
terrorism, natural disasters, or other emergencies. 

* Response--Lead, manage, and coordinate the national response to acts 
of terrorism, natural disasters, or other emergencies. 

* Recovery--Lead national, state, local, and private sector efforts to 
restore services and rebuild communities after acts of terrorism, 
natural disasters, or other emergencies. 

* Service--Serve the public effectively by facilitating lawful trade, 
travel and immigration. 

* Organizational excellence--Value our most important resource, our 
people. Create a culture that promotes a common identity, innovation, 
mutual respect, accountability and teamwork to achieve efficiencies, 
effectiveness, and operational synergies. 

In a report earlier this year to the House Government Reform 
Subcommittee on National Security, Emerging Threats and International 
Relations, we pointed out that while DHS has made considerable progress 
in its planning efforts, its strategic plan did not address the 
relationship between annual and long-term goals.[Footnote 11] This 
linkage is critical for determining whether DHS has a clear sense of 
how it will assess progress toward achieving the intended results for 
its long-term goals. In addition, the plan does not include specific 
budgetary, human capital, or other resources needed to achieve the long-
term goals. 

Although the strategic plan did not detail the resources DHS believes 
it needs to carry out its mission and achieve its strategic goals, DHS 
has presented some of this information as part of its annual budget 
materials. Congress has required OMB to present a crosscutting 
perspective on homeland security spending as part of the President's 
Budget. The discussion of homeland security spending by strategic goal 
across all federal agencies is an example of the impact that 
congressional oversight can have on budget presentations and analysis. 
As we have previously noted, the structure of appropriations accounts 
and congressional justifications also reflects choices about how 
resource allocation choices are framed and the types of controls and 
incentives considered most important. Given Congress's role in setting 
national priorities and allocating resources to achieve them, 
Congressional comfort with the structure of and analyses in budget 
justifications is critical. The department should work with its 
congressional committees to assure that the information it provides is 
useful to Congress in achieving its legislative, oversight, 
appropriations, and control objectives. 

Risk Management: 

The national strategy and DHS's strategic plan called for the use of 
risk-based decisions to prioritize DHS's resource investments regarding 
homeland security related programs. In addition, Homeland Security 
Presidential Directive/HSPD-7, issued in December 2003, charged DHS 
with integrating the use of risk management into homeland security 
activities related to the protection of critical infrastructure. The 
directive called on the department to develop policies, guidelines, 
criteria, and metrics for this effort. The new DHS Secretary testified 
on June 9, 2005, to the need for managing risk at the homeland security 
level by developing plans and allocating resources in a way that 
balance security and freedom. He noted the importance of assessing the 
full spectrum of threats and vulnerabilities, conducting risk 
management, and setting realistic priorities in guiding decisions about 
how to best organize to prevent, respond to, and recover from an 

Armed with better planning and performance information, the department 
needs to develop a more formal and disciplined approach to risk 
management. Answering questions such as "What is an acceptable level of 
risk to guide homeland security strategies and investments?" and "What 
criteria should be used to target federal funding for homeland security 
to maximize results and mitigate risk within available resource 
levels?" will not be easy. Yet these kinds of questions may also 
provide a window of opportunity to rethink approaches to long-standing 
problems and concerns. 

A risk management framework for making homeland security and 
counterterrorism investment decisions consists of a number of 
components. Assessing risk is a critical component of a risk management 
approach, and it should be reflective of current and future likely 
threats, which should be informed but not driven by past actions. 
Assessing risk involves three key elements--threats, vulnerabilities, 
and criticality (or consequences)--that provide input into the decision-
making process. A threat assessment identifies and evaluates potential 
threats on the basis of factors such as capabilities, intentions, and 
past activities. Threats might be present at the global, national, or 
local level, and their sources include terrorists and criminal 
enterprises. Threat information emanates from "open" sources and 
intelligence (both strategic and tactical). However, we will never know 
if we have identified every threat or event and may not have complete 
information about the threats we have identified. Consequently, two 
other elements of the approach, vulnerability and criticality 
assessments, are essential to better prepare against threats. A 
vulnerability assessment identifies weaknesses that may be exploited by 
identified threats and suggests options to address those weaknesses. A 
criticality assessment evaluates and prioritizes assets and functions 
in terms of specific criteria, such as their importance to public 
safety and the economy, as a basis for identifying which structures or 
processes are relatively more important to protect from attack. 
Information from these three assessments can lead to a risk 
characterization, such as high, medium, or low, and provides input for 
prioritizing security initiatives.[Footnote 12]

For example, an airport that is determined to be a critical asset, 
vulnerable to attack, and a likely target would be at high risk and, 
therefore, would be a higher priority for funding than an airport that 
is less vulnerable to an attack. In this vein, aviation security 
measures shown to reduce the risk to the most critical assets would 
provide the greatest protection for the cost. 

Figure 3 depicts a risk management cycle representing a series of 
analytical and managerial steps, basically sequential, that can be used 
to assess risk, assess alternatives for reducing risks, choose among 
those alternatives, implement the alternatives, monitor their 
implementation, and continually use new information to adjust and 
revise the assessments and actions, as needed. Adoption of a risk 
management framework such as this can aid in assessing risk by 
determining which vulnerabilities should be addressed in what ways 
within available resources.[Footnote 13]

Figure 3: Risk Management Framework: 

[See PDF for image]

[End of figure]

In addition to being dynamic, the approach may be applied at various 
organizational levels, from multiagency or sectoral down to individual 
investments or projects. Some adaptation of the framework may be 
expected--for instance, risk management choices available to site 
managers may entail departmental or statutory constraints. 

In our latest high-risk series, released in January 2005, we noted that 
an area of increasing concern involves the need for the completion of 
comprehensive national threat and risk assessments in a variety of 
areas, including homeland security.[Footnote 14] As GAO reported in its 
review of DHS's first strategic plan, stakeholder involvement was 
limited. Stakeholder involvement in the planning process is important 
to ensure that DHS's efforts and resources are aligned with other 
federal and nonfederal partners with shared responsibilities for 
homeland security and that they are targeted at the highest priorities. 
At the same time, this threat/risk assessment concept can be applied to 
a broad range of existing federal government programs, functions, and 

A viable risk management approach would also affect outcomes beyond the 
federal sector. The choice and design of policy tools, such as grants, 
regulations, and tax incentives, can enhance the capacity of all levels 
of government to target areas of highest risk and greatest need, 
promote shared responsibilities by all parties, and track and assess 
progress toward achieving national preparedness goals. For example, in 
order to promote a stronger federal, state, local, and regional 
partnership to improve homeland security, Congress needs to determine 
how to concentrate federal grant funds in the places with the highest 
risks. Given the significant needs and limited federal resources, it 
will be important to target areas of greatest need. Congressional 
proposals to alter the formula for allocating homeland security funds 
to states reflect attention to this issue. We have noted that the 
formula for federal grant distribution should be based on several 
considerations, including relative threats and vulnerabilities faced by 
states and communities as well as the state or local government's 
capacity to respond to a disaster.[Footnote 15]

Some Elements of Risk Management Being Used at DHS: 

Several DHS component agencies have taken some initial steps toward 
risk management. For example, agencies such as the Coast Guard and 
Customs and Border Protection (CBP) have taken actions to try to 
mitigate vulnerabilities and enhance maritime security. Security plans 
for seaports, facilities, and vessels have been developed based on 
assessments that identify their vulnerabilities. In addition, the Coast 
Guard is using a Port Security Risk Assessment Tool, which is designed 
to prioritize risk according to a combination of possible threat, 
consequence, and vulnerability. Under this approach, seaport 
infrastructure that is determined to be both a critical asset and a 
likely and vulnerable target would be a high priority for security 
enhancements or funding. By comparison, infrastructure that is 
vulnerable to attack but not as critical or infrastructure that is very 
critical but already well protected would be lower in priority. We are 
currently conducting a detailed review of the use of risk management 
for maritime security. 

In the transportation area, the Transportation Security Administration 
(TSA) has conducted limited vulnerability assessments at selected 
general aviation airports based on specific security concerns or 
requests by airport officials. Agency officials told us that conducting 
assessments was costly and, therefore, impractical to do for the 19,000 
general aviation airports nationwide, or even the approximately 4,800 
public-use general aviation airports. TSA intended to implement a risk 
management approach to better assess threats and vulnerabilities of 
general aviation aircraft and airports and, as part of this approach, 
was developing an online vulnerability self-assessment tool to be 
completed by individual airport managers. However, we noted limitations 
to the use of the self-assessment tool, and TSA had not developed a 
plan with specific milestones to implement the assessment, thereby 
making it difficult to monitor the progress of its efforts. Also, TSA 
had not conducted an overall systematic assessment of threats to, or 
vulnerabilities of, general aviation to determine how to better prepare 
against terrorist threats. 

Immigration and Customs Enforcement's Office of Investigations (OI) has 
taken some initial steps to base future budget requests on threat 
assessments. To develop its budget request and workforce plans for 
fiscal year 2007 and beyond, OI field offices conducted baseline threat 
assessments on a regional basis using scenarios such as the presence of 
a business that transports biological materials and may employ 
terrorists. Related performance measures have been developed, but are 
not yet in use. 

CBP had taken some steps to address the risks posed by terrorist 
smuggling of weapons in oceangoing cargo containers. Although CBP's 
strategy incorporated some elements of risk management, we reported 
that CBP had not performed a comprehensive set of threat, criticality, 
vulnerability, and risk assessments that experts said are vital for 
determining levels of risk for each container.[Footnote 16]

With respect to the allocation of homeland security funds to states, 
approximately 40 percent of the $5.1 billion in statewide grant funds 
awarded in fiscal years 2002 through 2005 were shared equally among the 
50 states, the District of Columbia, the Commonwealth of Puerto Rico, 
and U.S. territories. The remaining amount was distributed according to 
state population. Therefore, this formula for allocating money is not 
risk-based. Several congressional proposals have been advanced to alter 
the statewide funding formula to base it more directly on risk 
considerations. This seems to be both appropriate and necessary given 
current and projected deficits. One proposal would largely maintain the 
portion of funds shared equally by the states but would base the 
distribution of the remaining funds on a risk-based formula similar to 
the one currently used for urban area grants. Another proposal (from 
this committee) would reduce the minimum amount of funding shared 
equally by states to approximately 14 percent of total funding and 
establish a board to allocate the remaining funds through an evaluation 
of threat, vulnerability, and the potential consequences of a terrorist 

Concluding observations: 

As the nation faces a long-term fiscal imbalance, and the role of the 
federal government is being reshaped, there is a critical need for the 
federal government to reexamine the base of its programs, policies, 
functions, and activities. Performance budgeting can help enhance the 
government's capacity to assess competing claims for federal dollars by 
providing decision makers with better information on the results of 
individual programs, as well as on various federal policies and 
programs addressing common goals. 

In this context, the importance of DHS' mission cannot be overstated. 
While absolute security for the U.S. homeland is impossible, seeking to 
minimize vulnerability must remain a goal. Much is at stake when 
decisions are made about how to allocate limited resources across a 
large number of programs in multiple DHS agencies. GAO has consistently 
advocated implementation of a risk management approach for prioritizing 
efforts and focusing resources. This kind of approach is especially 
important since we seek to address threats that are seemingly limitless 
with resources that are limited. It is necessary to prioritize both 
risks and the actions taken to reduce risks. Where can resources do the 
most good? How should they be allocated across risks and across risk- 
reducing activities? Risk-based, priority-driven decisions can help 
inform decision makers in allocating finite resources to the areas of 
greatest need. Congress and agencies have a shared responsibility for 
ensuring that performance budgeting and risk management approaches are 
both useful and used. Congress can play an important role by using the 
resulting information in the authorization, appropriations, and 
oversight process. Further, to the extent that Congress wants to 
instill a risk-based approach, it is important to recognize that 
agencies need to have some flexibility in implementing it. 

As the Congress and DHS move to rebalance resource priorities to 
address the relative risks facing the nation, it is important to 
reexamine major existing programs and activities based on their 
relative contribution to reducing the areas of greatest vulnerability. 
This will require making tough choices to identify those activities 
with the greatest potential net benefit for the nation as a whole, 
while reassessing the need for other programs with more limited or less 
nationwide scale and importance. Going forward, we need to rethink 
certain traditional funding strategies, such as per capita based 
formulas and earmarks to determine whether they are consistent with a 
risk based approach. 

We should not expect this effort to be easy or the path forward to be 
smooth. Risk assessment is difficult in many government areas. It is 
especially so in the area of homeland security in which initial 
probabilities and consequences and the effectiveness of countermeasures 
are unusually difficult to determine. Getting relevant, reliable, and 
timely information for risk assessment is also quite difficult. 
Nevertheless, the effort should be made. A comprehensive approach 
should be developed and maintained. The state of the art for risk 
management will take time to mature. This will require sustained 
management commitment--and continued involvement, support, and 
oversight by Congress. Going forward, we need to rethink certain 
traditional funding strategies, such as per capita based formulas and 
earmarks to determine whether they are consistent with a risk based 

This completes my prepared statement. I would be pleased to respond to 
any questions you or other members of the subcommittee may have. 

For future information on this testimony, please contact Norman J. 
Rabkin at 202-512-8777. Other key contributors included Denise Fantone, 
Kimberly Gianopoulos, Susan Irving, Jacqueline Nowicki, Evi Rezmovic, 
and Jonathan Tumin. 


[1] In this testimony, the term performance budgeting refers to any 
linkage between budgeting and expected or actual evidence-based 
performance and results-based information. 

[2] Pub. L. No. 103-62, 107 Stat. 285 (1993). 

[3] For more information on reexamination of federal programs, see GAO, 
21st Century Challenges: Reexamining the Base of the Federal 
Government, GAO-05-325SP (Washington, D.C.: February 2005). 

[4] See Pub. L. No. 103-62, Sec. 2, 107 Stat. at 285 (1993). 

[5] 5 U.S.C. Sec. 306 and 31 U.S.C. Secs. 1115-1116. 

[6] GAO, Results-Oriented Government: GPRA Has Established a Solid 
Foundation for Achieving Greater Results, GAO-04-38 (Washington, D.C.: 
March 10, 2004). 

[7] The Office of Management and Budget (OMB) has used PART to assess 
the performance of 32 programs in DHS reported in the President's 
budgets for fiscal years 2004-2006. The assessment consisted of 
programs operated by the Coast Guard, Transportation and Security 
Administration, Immigration and Customs Enforcement, Customs and Border 
Protection, Office for Domestic Preparedness, Science and Technology, 
and the Federal Emergency Management Agency, among others. On the basis 
of answers to 25 questions relating to a program's purpose, planning, 
management, results and accountability, OMB concluded performance was 
effective for 4 programs, moderately effective for 6 programs, and 
adequate for 6 programs. OMB found that results were not demonstrated 
for the remaining 16 programs. 

[8] For a detailed examination of PART, see GAO, Performance Budgeting: 
Observations on the Use of OMB's Program Assessment Rating Tool for the 
Fiscal Year 2004 Budget, GAO-04-174 (Washington, D.C.: January 30, 

[9] GAO, Management Reform: Assessing the President's Management 
Agenda, GAO-05-574T (Washington, D.C.: April 21, 2005). 

[10] Pub. L. No. 107-296, 116 Stat. 2135 (2002). 

[11] GAO, Results-Oriented Government: Improvements to DHS' Planning 
Process Would Enhance Usefulness and Accountability, GAO-05-300 
(Washington, D.C.: March 31, 2005). 

[12] GAO, Transportation Security: Systematic Planning Needed to 
Optimize Resources, GAO-05-357T (Washington, D.C.: February 15, 2005). 

[13] GAO, Protection of Chemical and Water Infrastructure: Federal 
Requirements, Actions of Sected Facilities, and Remaining Challenges, 
GAO-05-327 (Washington, D.C.: March 28, 2005). 

[14] GAO, High-Risk Series: An Update, GAO-05-207 (Washington, D.C.: 
January 2005). 

[15] GAO, Homeland Security: Reforming Federal Grants to Better Meet 
Outstanding Needs, GAO-03-1146T (Washington, D.C.: September 3, 2003). 

[16] GAO, Homeland Security: Summary of Challenges Faced in Targeting 
Ocean Going Cargo Containers for Inspection, GAO-04-557T (Washington, 
D.C.: March 31, 2004).