This is the accessible text file for GAO report number GAO-06-462T entitled 'Homeland Security: Better Management Practices Could Enhance DHS's Ability to Allocate Investigative Resources' which was released on March 28, 2006. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Testimony before the Chairman, Subcommittee on National Security, Emerging Threats, and International Relations, Committee on Government Reform, House of Representatives: United States Government Accountability Office: GAO: For Release on Delivery Expected at 2:00 p.m. EST: Tuesday, March 28, 2006: Homeland Security: Better Management Practices Could Enhance DHS's Ability to Allocate Investigative Resources: Statement of Richard Stana, Director: Homeland Security and Justice: GAO-06-462T: GAO Highlights: Highlights of GAO-06-462T, testimony before the Chairman, Subcommittee on National Security, Emerging Threats, and International Relations, Committee on Government Reform, House of Representatives: Why GAO Did This Study: Immigration and Customs Enforcement’s (ICE) mission is to prevent terrorist attacks within the United States and reduce the vulnerability of the United States to terrorism while ensuring its mandated customs, immigration, and federal protective enforcement functions are not diminished. The ICE Office of Investigations (OI) supports that mission by investigating customs and immigration violations. This testimony addresses the following key questions that were answered in GAO-06- 48SU, a restricted report issued with the same title: (1) What structure and activities has OI adopted to address its mission? (2) In fiscal year 2004 and the first half of fiscal year 2005, how did OI use its investigative resources to achieve its goals? (3) How does OI ensure that its resource use contributes to its ability to prevent the exploitation of systemic vulnerabilities in customs and immigration systems? What GAO Found: OI’s organizational structure and investigative activities reflect those of its legacy agencies—the U.S. Customs Service and the Immigration and Naturalization Service—and include activities to prevent terrorism. OI retained responsibility for enforcing customs and immigration laws, and its field structure was created by relying on the strategic priorities of its legacy agencies to determine the composition and locations of field offices. Senior OI officials said that OI seeks to accomplish its homeland security mission by focusing on cases that seem to have a connection to national security. Data from ICE’s case management system indicate that its investigative activities generally relate to legacy missions, with about half of OI resources during fiscal year 2004 and the first half of 2005 used for cases related to drugs, financial crimes, and general alien investigations—investigations unlikely to contain a nexus to national security. Overall, between 10 and 15 percent of investigative resources were used for investigations considered to have a link to national security. OI’s current method of tracking these cases captures data about the cases where a nexus to national security is assumed due to the nature of the violation, primarily investigations of munitions control, illegal exports, visa violations, and terrorism. Additionally, the equivalent of about 400 of its 5,600 special agents worked full time to identify incarcerated aliens who were eligible for removal from the United States, a function that does not require the skills and training of criminal investigators. ICE plans to free investigators for more appropriate duties by shifting these functions to other ICE units and to study whether other functions could be shifted to employees in a noninvestigatory job series. To make resource use decisions in pursuit of OI’s goal to prevent the exploitation of systemic vulnerabilities in customs and immigration systems, OI primarily relies on the judgment of staff in its major field offices, in addition to national programs developed in headquarters that are implemented in multiple field offices. Although GAO found no evidence that OI has failed to investigate any national security-related lead that came to its attention, applying a risk management approach to determine what types of customs and immigration violations represent the greatest risks for exploitation by terrorists and other criminals could provide OI with greater assurance that it is focusing on preventing violations with the greatest potential for harm, while striking a balance among its various objectives. OI has taken some initial steps to introduce principles of risk management into its operations, but has not conducted a comprehensive risk assessment of the customs and immigration systems to determine the greatest risks for exploitation, nor has OI analyzed all relevant data to inform the evaluation of alternatives and allow risk-based resource allocation decisions. OI also lacks outcome-based performance goals that relate to its objective of preventing the exploitation of these systemic vulnerabilities. Finally, OI does not have sufficient systems to help ensure ongoing monitoring and communication of vulnerabilities discovered during its investigations. What GAO Recommends: GAO recommended that Homeland Security implement management practices to support resource allocation decisions, including a risk assessment, revised performance measures, and monitoring and communication systems to provide meaningful data about resource use. The Department of Homeland Security concurred with GAO’s recommendations. www.gao.gov/cgi-bin/getrpt?GAO-06-462T. To view the full product, including the scope and methodology, click on the link above. For more information, contact Richard Stana at (202) 512-8816 or stanar@gao.gov. [End of section] Mr. Chairman and Members of the Subcommittee: I am pleased to be here today to share our views on the progress the Department of Homeland Security's (DHS), U.S. Immigration and Customs Enforcement (ICE) Office of Investigations (OI) has made in pursuing its homeland security mission. OI was formed in March 2003, mainly from legacy INS and Customs investigative components. OI is responsible for conducting investigations covering a broad array of national security, financial, and smuggling violations, including illegal arms exports, financial crimes, trade violations, human trafficking, narcotics smuggling, child pornography/exploitation, and immigration fraud. OI is also responsible for conducting investigations aimed at protecting critical infrastructure industries. This testimony is an unrestricted version of our recent Law Enforcement Sensitive report we did for this subcommittee entitled HOMELAND SECURITY: Better Management Practices Could Enhance DHS's Ability to Allocate Investigative Resources.[Footnote 1] In my testimony today, I will discuss the following topics: * What structure and activities has OI adopted to address its mission? * How did OI use its investigative resources in fiscal year 2004 and the first half of fiscal year 2005? * How does OI ensure that its resource use contributes to its ability to prevent the exploitation of systemic vulnerabilities in customs and immigration systems? To identify OI's structure and the activities it uses to address its mission we met with OI officials and reviewed documents used to support organizational decisions. To determine how OI used its investigative resources to address its goals, we analyzed case management data that showed the types of investigations performed nationally between October 2003 and March 2005--the most recent period for which comparable data were available. In addition, we interviewed the management staff of OI and the special agents-in-charge (SAC) at 7 of the 26 ICE OI field offices to learn how they set investigative priorities and allocate human resources to investigations. We selected the special agent-in- charge offices based on their size (the number of agents) and location, seeking to include a variety of offices representing differing investigative focuses. Because our sample was a nonprobability sample, the opinions of these special agents-in-charge cannot be projected beyond those interviewed.[Footnote 2] We also collected and analyzed data specific to the 7 offices we visited. We assessed the reliability of the investigative resource data--the hours spent on different types of investigations--by reviewing the internal controls of the case management system and through interviews with knowledgeable OI staff about these controls and the quality assurance procedures in place to ensure data reliability. We determined the investigative resource data were sufficiently reliable for our purposes. We determined how OI ensures that its resource use contributes to its ability to prevent the exploitation of systemic vulnerabilities in customs and immigration systems using information collected during interviews with OI officials, including the special-agents-in-charge and by examining documents used to support organizational decisions. We evaluated OI's current approach to resource allocation decision making by comparing this information with the standards for internal control in the federal government and to the risk management approach that we have advocated in our prior work.[Footnote 3] Summary: OI's organizational structure and investigative activities reflect those of its legacy agencies--the U.S. Customs Service and the Immigration and Naturalization Service. OI retained responsibility for enforcing customs and immigration laws and its field structure was created by relying on the strategic priorities of its legacy agencies- -for example, proximity to high-volume smuggling corridors, to state and federal prisons, and significant money laundering infrastructure-- to determine the composition and locations of field offices. Senior OI officials told us that rather than concentrating on any particular category of investigation, OI seeks to accomplish its homeland security mission by focusing on cases that seem to have a connection to national security. This would include placing a priority on activities to prevent terrorism. Data from ICE's case management system indicate between 10 and 15 percent of investigative resources were used for investigations considered by ICE to have a link to national security. These investigations are primarily related to munitions control, illegal exports, compliance enforcement of visa violations, and terrorism. Most of OI's investigative activities generally relate to legacy missions, with roughly half of OI resources during fiscal year 2004 and the first half of 2005 used for cases related to drugs, financial crimes, and general alien investigations. Most of these investigations did not contain a nexus to national security. Moreover, with regard to the resources used for general alien investigations, the equivalent of about 400 of OI's 5,600 special agents were working full time to identify incarcerated aliens who were eligible for removal from the United States, an ICE responsibility. This activity does not require the skills and training of criminal investigators. ICE plans to free investigators for more appropriate duties by shifting these functions to other ICE units, and to submit a plan for the expanded use of a noninvestigatory job series for civil and administrative violations. OI tries to ensure that its resources contribute to the prevention of exploitation of systemic vulnerabilities in customs and immigration systems by making most investigative resource use decisions in OI's major field offices, based on the judgment of the agents in charge, with priority on investigating national security-related cases that arise. Divisions and units within OI headquarters also develop and manage special programs that are implemented in multiple field offices. For example, Project Shield America is a National Security Division program where OI conducts outreach to private sector companies to prevent the illegal export of sensitive U.S. munitions and strategic technology. The Cornerstone program in the Financial and Trade Division is a similar outreach program to the financial industry. Operation Community Shield is a national law enforcement initiative that is designed to bring all of ICE's immigration and customs-related law enforcement powers to bear in the fight against violent street gangs. Although we found no evidence that OI has failed to investigate any national security-related lead that came to its attention, applying a risk management approach to determine what types of customs and immigration violations represent the greatest risks for exploitation by terrorists and other criminals could provide OI with greater assurance that it is focusing on preventing violations with the greatest potential for harm, while striking a balance among its various objectives. OI has taken some initial steps to introduce principles of risk management into its operations, but has not conducted a comprehensive risk assessment of the customs and immigration systems to determine the greatest risks for exploitation, nor analyzed all relevant data to inform the evaluation of alternatives and allow OI to make risk-based resource allocation decisions. OI also lacks outcome- based performance goals that relate to its objective of preventing the exploitation of these systemic vulnerabilities. Finally, OI does not have sufficient systems to help ensure ongoing monitoring and communication of vulnerabilities discovered during its investigations. We made recommendations to address these deficiencies. Background: ICE is the largest investigative arm of DHS. ICE is composed of four offices: (1) Investigations, (2) Intelligence, (3) Detention and Removal Operations (DRO), and (4) the Federal Protective Service. As of September 2005, OI had more than 5,600 special agents; about 94 percent of these are assigned to 26 major field offices, headed by Special Agents-in-Charge (SAC), and OI's foreign attaché offices. These offices and their subordinate units were created using the immigration and customs staff and locations in existence at the time ICE was formed. At headquarters ICE, OI is divided into five divisions as shown in figure 1. Three of the five divisions--National Security, Finance and Trade, and Smuggling and Public Safety--were created to incorporate the core missions and functions of legacy immigration and customs investigations. These divisions and the units within them are to provide a functional line of communication from the Director of OI to the groups in the SAC offices that conduct investigations. Divisions and units within OI headquarters also develop and manage special programs that are implemented in multiple field offices. For example, Project Shield America is a National Security Division program where OI conducts outreach to private sector companies to prevent the illegal export of sensitive U.S. munitions and strategic technology. The Cornerstone program in the Financial and Trade Division is a similar outreach program to the financial industry. Operation Community Shield is a national law enforcement initiative that is designed to bring all of ICE's immigration and customs-related law enforcement powers to bear in the fight against violent street gangs. The Investigative Services Division provides direct forensic, undercover, and other operational support to OI investigations carried out by the three core divisions, and the Mission Support Division provides policy guidance and services to facilitate executive oversight. Figure 1: ICE Office of Investigations Organizational Structure: [See PDF for image] [End of figure] Carryover Organizational Structure and Investigative Activities from Legacy Agencies Affect OI's Investigative Focus: The headquarters and field organizational structures adopted by OI reflect the legacy functions of the customs and immigration services-- e.g. drug investigations, human smuggling, and commercial fraud--and include activities to prevent terrorism within this structure. In April 2005, ICE completed an interim strategic plan that established as its mission to prevent terrorist attacks within the United States and reduce the vulnerability of the United States to terrorism while ensuring all of its mandated trade, immigration, and federal protective functions are not diminished. According to ICE officials, the national security objectives are not accomplished through any particular type or category of investigation. Instead, these objectives are addressed by examining investigations on a case-by-case basis and determining the relationship of any single case to national security. For example, although OI has the authority to investigate any employer that might have violated laws that regulate alien employment eligibility, OI instructs investigators to focus on employers at critical infrastructure sites. When ICE was created, it retained responsibility for enforcing the customs and immigration laws that were the purview of its legacy agencies. These include criminal statutes addressing the illegal import and export of drugs, weapons, child pornography, stolen antiquities, and other contraband, as well as alien smuggling, human trafficking, and the international laundering and smuggling of criminal proceeds. OI also is responsible for legacy customs enforcement of certain intellectual property and trade-related commercial fraud statutes and legacy immigration enforcement of laws prohibiting document fraud, benefit fraud, illegal entry into the United States or violations of the terms and conditions of entry, and employment without authorization.[Footnote 4] OI's field structure was created by merging the existing Customs and INS field offices located primarily in cities near major ports of entry. In addition, ICE relied on the strategic priorities of the legacy agencies to determine the composition and locations of SAC offices--for example, high-volume smuggling corridors, proximity to state and federal prisons, and significant money laundering infrastructure. There are some long-standing functions of the legacy agencies that OI continues to perform, which also drive some of the types of investigative activities that are conducted. For example, OI has continued the legacy Customs practice of responding to violations concerning seized drugs or merchandise or detained persons uncovered at ports of entry by Customs and Border Protection (CBP) inspectors. U.S. Customs had historically been involved with helping to implement the President's National Drug Control Strategy. Consistent with this involvement, DHS now receives funding specifically to support activities related to the strategy. A senior OI official said OI will continue to be responsible for performing a significant level of drug investigations because there simply is no other agency available to conduct the large number of border-related drug investigations U.S. Customs has historically performed and that are now carried out by OI. Another carryover function that OI now performs is the legacy INS practice of identifying aliens incarcerated in prisons and jails that are eligible for removal from the United States. OI Investigative Resources Were Used for Investigations Related to Its Legacy Missions, but Most Were Not Considered to Have a National Security Nexus: Between 10 and 15 percent of investigative hours were classified by OI as having a direct nexus to national security. Although there is no firm standard for how OI should distribute its investigative resources, ICE's interim strategic goals and objectives place a strong emphasis on national security-related activities. According to OI, the majority of the national security-related investigative hours were charged in a few case categories related to munitions control, illegal exports, compliance enforcement of visa violations, and terrorism. Most of the investigative hours within those case types that consumed roughly half of OI resources--drugs, financial, and general alien--were rarely classified as having a direct nexus to national security.[Footnote 5] In its fiscal year 2007 budget justification, DHS requested funds to increase the level of resources dedicated to visa compliance enforcement by more than 40 percent through the addition of over 50 special agent and support staff dedicated to these types of investigations. Roughly half of OI investigative resources during fiscal year 2004 and the first half of fiscal year 2005 were used for cases related to drugs, financial crimes, and general alien violations. The resource use in the other case categories pertains to investigations of a variety of customs and immigration violations including commercial fraud, general smuggling, human smuggling and trafficking, identity fraud, document fraud, and worksite enforcement. None of the investigative categories that apply to these violations individually accounted for more than 8 percent of investigative resource use during the period under study. In most instances these other case categories accounted for 5 percent or less of resource use. Moreover, with regard to general alien investigations, the equivalent of about 400 OI investigators performed, as a central part of their daily duties, functions that are noninvestigative in nature (i.e., not consistent with the position description of a criminal investigator as defined by the Office of Personnel Management.) According to OI officials, some of these noninvestigative activities were formerly performed by legacy INS investigators and include identifying incarcerated criminal aliens who are eligible for removal, an ICE responsibility, and responding to state and local police agencies that have apprehended illegal aliens. According to ICE's interim strategic plan, ICE plans to shift this duty to ICE's Office of Detention and Removal Operations (DRO). A DRO official told us DRO planned to take over this role from OI incrementally by first assuming responsibility for this activity in several major metropolitan areas in 2005 and 2006. OI investigators also perform worksite enforcement, which according to the OI Deputy Assistant Director responsible for this function, includes activities that might be more economically performed by noninvestigatory staff. This function--verifying that employees at critical and noncritical worksites are eligible to work in the United States--was described by OI officials as a compliance function that is not clearly aligned with the criminal investigator job description. Since the late 1990s, the level of investigative resources legacy INS and then ICE dedicated to this function has decreased. Since the terrorist attacks of September 11, 2001, INS and ICE have concentrated worksite investigative resources at critical infrastructure facilities. In its fiscal year 2007 budget justification, DHS requested funds to support the addition of 206 positions--171 of which are special agents-- to conduct worksite enforcement. If these resources are approved and used for worksite enforcement, this would increase OI's worksite enforcement effort significantly compared to what was done in fiscal year 2005. The fiscal year 2006 Department of Homeland Security Appropriations Conference Report[Footnote 6] directs ICE to submit a plan for the expanded use of immigration enforcement agents to focus on civil and administrative violations, raising the possibility that additional noninvestigative duties may be shifted from OI investigators, making them available for criminal investigations. OI Places Priority on National Security Investigations, but Key Management Practices Could Enhance OI's Resource Allocation Decision- Making: OI tries to ensure that its resources contribute to the prevention of the exploitation of systemic vulnerabilities in customs and immigration systems by making most investigative resource use decisions in OI's major field offices, based on the judgment of the agents in charge, with priority on investigating national security-related cases that arise. Although we found no evidence that OI has failed to investigate any national security-related lead that came to its attention, applying a risk management approach to proactively determine what types of customs and immigration violations represent the greatest risks for exploitation by terrorists and other criminals could provide OI with greater assurance that it is focusing most intensely on preventing those violations with the greatest potential for harm while striking an appropriate balance among its various objectives. According to the Standards for Internal Control in the Federal Government, one of the foundational components of a good control environment is risk assessment--including the assessment of risks, estimation of their significance, the likelihoods of their occurrence, and decisions about how to respond to them. OI has taken some initial steps to introduce principles of risk management into its operations--for example, encouraging its field managers to think about violations in terms of vulnerabilities to the customs and immigration systems. In addition, OI classifies each investigation using the numeric designations 1, 2, and 3, with class 1 indicating the highest relative importance within that category of investigation. However, it has not conducted a comprehensive risk assessment of the customs and immigration systems to determine the greatest risks for exploitation or analyzed these data to provide information to evaluate alternative investigative strategies and allow OI to make risk-based resource allocation decisions. Such a system could provide OI with greater assurance that it is striking an appropriate balance among its various objectives while focusing most intensely on preventing those violations with the greatest potential for harm. Application of a risk management approach by OI involves a risk assessment that would provide information in three areas: (1) threat-- what strategic intelligence and experience suggest about how customs and immigration systems might be exploited by terrorists and other criminals; (2) vulnerabilities--the ways that customs and immigration systems are open to exploitations and the kinds of protections that are built into these systems; and (3) consequence--the potential results of exploitation of these systems, including the most dire prospects. For example, ICE's strategic goal to prevent the unlawful movement across U.S. borders of people, money, and materials, includes as one of its strategies giving highest priority to closing those vulnerabilities that pose the greatest threat to our national security. However, OI has not performed a risk assessment to determine which vulnerabilities pose the greatest threat so that it can direct resources to those investigations that best address these vulnerabilities. Figure 2 demonstrates how the risk assessment and investigator's judgment would combine to inform case selection and resource allocation. Figure 2: Potential Decision-Making Approach for Evaluation and Selection of Investigative Resource Allocation Alternatives: [See PDF for image] [End of figure] ICE has begun to incorporate elements of risk management into its resource allocation decision making. OI has several ongoing programs within its National Security Division designed to identify and mitigate national security threats. One is Project Shield America, where special agents conduct outreach to the export industry to educate these businesses about U.S. export laws and to solicit their assistance in preventing the illegal foreign acquisition of their products. OI also uses the Threat Analysis Unit and Compliance Enforcement Unit within the National Security Division to screen nonimmigrant students, exchange students, and other visitors for the purpose of identifying potential national security threats. The value of risk management goes beyond these types of resource allocation, however. Specifically, a more comprehensive risk management approach would enable OI to better ensure that its resources are effectively and efficiently applied to its national security and other missions by giving it a foundation for determining how resources might be best distributed within and across investigation types, for example, (1) how to best allocate its resources among case categories (e.g., visa violations, drug smuggling, and financial crimes); (2) the appropriate level of investment in national-security related investigations; and (3) the appropriate mix of case classifications within each category (i.e., the three-level classification of cases based on relative importance). Effective risk management also requires outcome-based performance measures and goals. We found OI lacks outcome-based performance goals to monitor the full range of its efforts to prevent the systemic vulnerabilities that allow terrorists and other criminals to endanger the United States. Performance goals--consisting of a target (acceptable level of performance) and a measure (a means to assess the performance level)--are an essential management tool in managing programs for results. In addition, our Standards for Internal Control in the Federal Government and the Office of Management and Budget call for agencies to have performance measures and indicators that are linked to mission, goals, and objectives to allow for comparisons to be made among different sets of data (for example, desired performance against actual performance) so that corrective actions can be taken if necessary. Currently, OI relies primarily upon statistics related to investigative resource use--such as arrests, seizures, and convictions--to monitor performance. In fact, ICE reports only one output performance measure for OI on the DHS Performance and Accountability Report--the percentage of investigations that result in an enforcement action (e.g., an arrest, conviction, or fine). Measuring the percentage of investigations that result in enforcement action provides only an indirect indicator of success in preventing systemic vulnerabilities that allow terrorists and other criminals to endanger the United States. Among other things, it lacks the ability to reflect successes of OI's programmatic activities that are designed to deter the exploitation of systemic vulnerabilities before a crime is committed-- for example, a measure of the outcomes of actions taken to close or control identified vulnerabilities. Without outcome-based performance goals, it is difficult for OI to gauge the effectiveness of its operational activities and to use this information to assess what types of corrective actions might be required--such as changes to programs or work processes in order to better align activities with strategic objectives. Finally, OI does not have sufficient systems to help ensure ongoing monitoring and communication of vulnerabilities discovered during its investigations. These controls could enhance OI's ability to take action to eliminate those vulnerabilities or to recommend mitigation practices to entities that control the applicable customs or immigration system. Standards for Internal Control in the Federal Government calls for agencies to establish monitoring and communication systems that assess the quality of performance over time and ensure that findings of deficiencies are corrected and result in improvements to the process. OI officials said they are trying to use Cornerstone--a program to identify and reduce systemic vulnerabilities in financial systems--as a model for creating such a feedback loop (see fig. 3). Cornerstone was created by ICE to encourage coordination with the financial industry. OI officials in headquarters and field offices conduct outreach to the private sector and partner with private industry as well as with state and other federal law enforcement and regulatory agencies. The private sector provides ICE with information regarding the vulnerabilities it has observed, and ICE uses this information to develop criminal investigations. ICE also disseminates information on vulnerabilities to financial sector stakeholders through the Cornerstone Report. When vulnerabilities are identified that cannot be addressed by the private sector alone, ICE officials told us that a joint law enforcement and regulatory approach is utilized to eliminate or minimize vulnerabilities. Figure 3: The Cornerstone Process: [See PDF for image] [End of figure] With the exception of the Cornerstone program for financial investigations, OI does not have a complete system in place to help ensure that information gained during the course of investigations feeds back into the operations of other DHS components, other federal agencies, state and local partners, and relevant private sector entities to proactively reduce the vulnerabilities that facilitate violations. OI has taken initial steps to apply parts of the Cornerstone approach to all its investigative areas. For example, Project Shield America uses the same outreach techniques to the export sector as Cornerstone does to the financial sector, without the emphasis on changing policies and practices to reduce identified vulnerabilities. However, OI officials told us that OI does not have a process to help ensure that action is taken to mitigate the risks from the vulnerability identified during the course of its investigations across all SACs. A systemwide process for capturing the information and ensuring that OI takes appropriate actions in response to information, extending beyond financial crimes, would better support its ability to reduce vulnerabilities in immigration and customs systems by allowing OI to monitor the progress of efforts to reduce vulnerabilities and the identification of those involved in these efforts. Such a process is especially important for OI, since so many of its operations are collaborative, and the vulnerabilities identified through its investigations may require legal or policy changes that are controlled by external stakeholders. Conclusions: Although OI, as the primary investigative agency of the Department of Homeland Security states that it places priority on national security, from a practical standpoint, it is focused on enforcing all laws and regulations governing the customs and immigration systems. Before the creation of the DHS, these efforts, carried out by legacy INS and U.S. Customs service had a limited relation to national security--and indeed even since becoming a part of DHS, cases considered to be directly related to national security have demanded a relatively small portion of OI's resources. Particularly considering its wide-ranging mission, a more comprehensive risk management approach could provide OI with better information to evaluate its alternatives and balance its resource allocations most effectively across the broad array of violations it is responsible for investigating. Although OI has applied some of the principles of risk management to its operations, applying a comprehensive risk management approach would provide a stronger evidence-based foundation to help it ensure that its resource allocation best supports its ability to prevent those systematic vulnerabilities with the most potential to endanger the United States. Specifically, a more comprehensive risk management approach would enable OI to better ensure that its resources are effectively and efficiently applied to its national security and other missions by giving it a foundation for determining how resources might be best distributed within and across investigation types, for example, (1) how to best allocate its resources among case categories (e.g., visa violations, drug smuggling, and financial crimes), (2) the appropriate level of investment in national-security related investigations, and (3) the appropriate mix of case classifications within each category (i.e., the three-level classification of cases based on relative importance). Lacking OI-wide outcome-based performance goals to assess its ability to prevent the exploitation of systematic vulnerabilities in customs and immigration systems that allow terrorists and other criminals to endanger the United States makes it difficult for OI to evaluate the results of its efforts in light of that objective. In addition, this lack may promote a tendency for OI to stay in the functional mindset of its legacy agencies. In particular, using data like the number of arrests, fines, drug and other seizures, prosecutions, and convictions gives OI some ability to assess the outputs of its activities. However, relying primarily on this type of performance data may make it more difficult for OI to determine if it should alter its investigative focus because favorable outputs (e.g., high numbers of arrests) tend to reinforce the current focus whether or not it is helping accomplish the ICE mission. Without outcome-based performance goals that are tied to ICE's mission and objectives, the agency will lack a sufficient basis for assessing the alignment of resources that might offer the greatest contribution to this broad mission. Developing measures that can meaningfully gauge performance related to an expansive deterrence mission like ICE's is not an easy task. However, armed with information about the relative risk to the customs and immigration systems, OI could be in a better position to measure its performance and make resource use decisions based on the potential to mitigate the most crucial identified risks. Finally, a critical part of the ICE mission is to reduce the vulnerability of the United States to terrorism. OI's Cornerstone program and efforts to extend this approach to other investigative areas are intended to reduce vulnerabilities by feeding lessons learned from criminal investigations back into the organization's systems and practices. However, these efforts do not include sufficient monitoring and communication systems to ensure that information is systematically fed back and that it consistently results in corrective actions. A feedback process that includes processes and procedures (for example, clearly established lines of reporting and authority and documented protocols) to help ensure that vulnerabilities OI uncovers during its investigations will result in mitigation measures or in recommendations for such measures to entities responsible for the applicable system would enhance OI's ability to reduce vulnerabilities in customs and immigration systems. Recommendations: To put OI in a better position to allocate its investigative resources in a manner that maximizes their contribution to the achievement of ICE's mission, we recommended that the Secretary of Homeland Security direct the Assistant Secretary of ICE to take the following three actions: * Conduct comprehensive threat, vulnerability, and consequence risk assessments of the customs and immigration systems to identify the types of violations with the highest probability of occurrence and most significant consequences in order to guide resource allocation for OI national programmatic activity and to expand the available information upon which SACs base their decisions to open new cases. * On the basis of the results of the risk assessment, develop outcome- based performance goals (measures and targets) that reflect the contribution of various investigative activities to ICE's mission and objectives and develop a reliable method for tracking national security- related activity and classification criteria for the case management system that express the contributions of each investigation. * Develop an OI-wide system to monitor and communicate the more significant vulnerabilities in customs and immigration systems that are identified during the course of OI investigations. This process should include a method to mitigate the vulnerability internally or to ensure that the vulnerability and associated mitigation recommendations are communicated to external stakeholders with responsibility for the applicable system. In response to our first recommendation, DHS agreed risk management is a valuable tool to establish priorities in a multiple threat environment and said ICE intends to take a broader, component-wide approach to assessing risk. DHS agreed that the ICE Office of Investigations resource decisions should be based on priorities derived from a strategic-planning process in which directors and unit managers from all ICE OI program areas participate, including mission support. DHS said priorities set forth in the strategic plan should be reviewed annually, revised as necessary, and communicated to each SAC. While DHS agreed with our second recommendation, it said that ICE needs to maintain the flexibility to develop performance goals that reflect its mission and may not necessarily be measurable in an outcome-based manner. DHS said the Office of Management and Budget has acknowledged that for certain activities (e.g., law enforcement) "outcome-oriented" performance measures may be difficult to identify and performance may be tracked by using a variety of output as well as qualitative measures. DHS said each division within OI uses standard law enforcement statistics covering all of its program units that can be shared, understood, and compared over the years, including arrests, indictments and convictions, broken out by category. We agree that developing outcome-based performance measures for law enforcement activities can be difficult and that some output measures can be beneficial. However, we continue to believe that where possible OI should seek to develop outcome-based performance measures that would better demonstrate the value of its efforts. OI needs to allocate resources to the types of investigations that have the best chance of mitigating potential vulnerabilities in customs and immigration systems to terrorism. With regard to our third recommendation, DHS said that OI headquarters' program managers regularly communicate with the SAC offices to obtain feedback on significant cases and identified vulnerabilities. This information is documented in reports that are transmitted two times a day to both the OI and DHS leadership. A weekly report also is prepared that summarizes the significant cases of the week. DHS said that OI has established designated liaisons to both U.S. Citizenship and Immigration Services and CBP and they communicate specific vulnerabilities and threats. While these efforts are useful, our recommendation envisions a more comprehensive strategy to identify and mitigate vulnerabilities in customs and immigration systems and processes. We are encouraged that OI intends to continue to expand such outreach and partnership efforts. In implementing our recommendation, we believe that OI should obtain and use feedback from all relevant governmental and nongovernmental organizations in its efforts to mitigate potential vulnerabilities. Mr. Chairman, this concludes my statement. I would be pleased to respond to any questions that you or other members of the Subcommittee may have at this time. GAO Contacts and Staff Acknowledgments: For further information about this testimony, please contact Richard Stana at 202-512-8777. Other Key contributors to this statement were Michael Dino and Tony DeFrank. FOOTNOTES [1] GAO, HOMELAND SECURITY: Better Management Practices Could Enhance DHS's Ability to Allocate Investigative Resources, GAO-06-48SU (Washington, D.C.: December 9, 2005). [2] Nonprobability sampling is a method of sampling where observations are selected in a manner that is not completely random, usually using specific characteristics of the population as criteria. Because each unit in a population does not have an equal chance to be selected, it is possible for a nonprobability sample to contain a systematic bias that limits its ability to describe the entire population. [3] GAO, Homeland Security: Summary of Challenges Faced in Targeting Oceangoing Cargo Containers for Inspection, GAO-04-557T (Washington, D.C.: Mar. 31, 2004); Transportation Security: Systematic Planning Needed to Optimize Resources, GAO-05-357T (Washington, D.C.: Feb. 15, 2005); Strategic Budgeting: Risk Management Principles Can Help DHS Allocate Resources to Highest Priorities, GAO-05-824T (Washington, D.C.: June 29, 2005); Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999). [4] OI also has investigatory responsibilities for certain international terrorism offenses, such as providing material support to foreign terrorist organizations. Although anti-terrorism laws passed before and after the creation of DHS, such as the USA PATRIOT Act of 2001, Pub. L. No. 107-56, 115 Stat. 273, and the Intelligence Reform and Terrorism Prevention Act of 2004, Pub. L. No. 108-458, 118 Stat. 3638, did not give ICE additional authority, they did expand many of the criminal statutes ICE enforces, especially those concerning certain terrorism and money-laundering offenses. [5] Although they do not fall into the categories that OI identified as having a national security link, OI officials told us that there may be other investigative categories that could be considered national security related. National Security Presidential Directive 25 designated international drug trafficking organizations and their linkages to international terrorist organizations as a threat to national security. If the OI resources dedicated to the investigation of drug trafficking that involves major criminal organizations are included in the national security-related measure, then the percentage of investigative resources devoted to national security might be as high as 18 percent in fiscal year 2004 and 19 percent in fiscal year 2005. [6] H.R. Conf. Rep. No. 109-241, at 47 (2005).