This is the accessible text file for GAO report number GAO-06-553T 
entitled 'Financial Management Systems: DHS Has an Opportunity to 
Incorporate Best Practices in Modernization Efforts' which was released 
on March 30, 2006. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Testimony: 

Before Congressional Subcommittees: 

United States Government Accountability Office: 

GAO: 

For Release on Delivery Expected at 3:00 p.m. EST: 

Wednesday, March 29, 2006: 

Financial Management Systems: 

DHS Has an Opportunity to Incorporate Best Practices in Modernization 
Efforts: 

Statement of McCoy Williams: 
Director, Financial Management and Assurance: 

Keith A. Rhodes: 
Chief Technologist, Applied Research and Methods: 
Center for Technology and Engineering: 

GAO-06-553T: 

GAO Highlights: 

Highlights of GAO-06-553T, a testimony before congressional 
subcommittees: 

Why GAO Did This Study: 

Over the years, GAO has reported on various agencies’ financial 
management system implementation failures. GAO’s recent report (GAO-06-
184) discusses some of the most significant problems previously 
identified with agencies’ financial management system modernization 
efforts. For today’s hearing, GAO was asked to provide its perspectives 
on the importance of the Department of Homeland Security (DHS) 
following best practices in developing and implementing its new 
financial management systems and avoiding the mistakes of the past. 
GAO’s testimony (1) discusses the recurring problems identified in 
agencies’ financial management systems development and implementation 
efforts, (2) points out key financial management system modernization 
challenges at DHS, and (3) highlights the building blocks that form the 
foundation for successful financial management system implementation 
efforts. 

What GAO Found: 

GAO’s work and that of agency inspectors general over the years has 
shown that agencies have failed to employ accepted best practices in 
systems development and implementation (commonly referred to as 
disciplined processes) that can collectively reduce the risk associated 
with implementing financial management systems. GAO’s recent report 
identified key causes of failures within several recurring themes 
including (1) disciplined processes, such as requirements management, 
testing, and project management; and (2) human capital management, such 
as workforce planning, human resources, and change management. Prior 
reports have identified costly systems implementation failures 
attributable to problems in these areas at agencies across the federal 
government. 

DHS faces unique challenges in attempting to develop integrated 
financial management systems across the breadth of such a large and 
diverse department. DHS inherited a myriad of redundant financial 
management systems from 22 diverse agencies and about 100 resource 
management systems. Among the weaknesses identified in prior component 
financial audits were insufficient internal controls or processes to 
reliably report financial information such as revenue, accounts 
receivable, and accounts payable; significant system security 
deficiencies; financial systems that required extensive manual 
processes to prepare financial statements; and incomplete policies and 
procedures necessary for conducting basic financial management 
activities. In August 2003, DHS began a program to consolidate and 
integrate DHS financial accounting and reporting systems. DHS officials 
said they recently decided to develop a new strategy for the planned 
financial management systems integration program, referred to as 
eMerge2, because the prior strategy was not meeting its performance 
goals and timeline. DHS’s revised strategy will allow DHS components to 
choose from an array of existing financial management shared service 
providers. 

Based on industry best practices, GAO identified four key concepts that 
will be critical to DHS’s ability to successfully complete its planned 
migration to shared service providers. Careful consideration of these 
four concepts, each one building upon the next, will be integral to the 
success of DHS’s strategy. The four concepts are 
* developing a concept of operations, 
* defining standard business processes, 
* developing a strategy for implementing DHS’s shared services approach 
across the department, and 
* defining and effectively implementing disciplined processes necessary 
to properly manage the specific projects. 

With DHS at an important crossroads in implementing financial 
management systems, it has an excellent opportunity to use these 
building blocks to form a solid foundation on which to base its efforts 
and avoid the problems that have plagued so many other federal 
agencies. 

www.gao.gov/cgi-bin/getrpt?GAO-06-553T. 

To view the full product, including the scope and methodology, click on 
the link above. For more information, contact McCoy Williams at (202) 
512-9095 or Keith Rhodes at (202) 512-6412. 

[End of section] 

Mr. Chairmen and Members of the Subcommittees: 

It is a pleasure to be here today to participate in this joint 
oversight hearing[Footnote 1] on the Department of Homeland Security's 
(DHS) ongoing efforts to effectively manage its information technology 
(IT) projects. Modern financial management systems are a critical 
component to instituting strong financial management as called for by 
the Chief Financial Officers (CFO) Act of 1990, the Federal Financial 
Management Improvement Act of 1996 (FFMIA), and other legislation. As 
we testified[Footnote 2] in November 2005, agencies continue to 
struggle with developing and implementing integrated systems that 
achieve expected functionality within cost and timeliness goals. While 
most CFO Act agencies have obtained clean (or unqualified) audit 
opinions on their financial statements, the underlying financial 
systems remain a serious problem. Hearings such as this one today 
foster meaningful financial management reform. 

Over the years, we have reported on various agencies' financial 
management system implementation failures. Our recent report,[Footnote 
3] which was prepared at the request of the Subcommittee on Government 
Management, Finance, and Accountability, House Committee on Government 
Reform, discusses some of the most significant problems and 
observations we identified with agencies' financial management system 
modernization efforts. Today, we would like to provide our perspectives 
on the importance of DHS following best practices in developing and 
implementing its new financial management systems. Specifically, we 
would like to: 

* discuss the recurring problems we and others have identified in 
agencies' financial management systems development and implementation 
efforts, 

* point out key financial management system modernization challenges at 
DHS, and: 

* highlight the building blocks that form the foundation for successful 
financial management system implementation efforts. 

Our statement is based upon our recently issued report,[Footnote 4] as 
well as our previous reports and testimonies, which were performed in 
accordance with U.S. generally accepted government auditing standards. 
We have not performed a detailed review of DHS's financial management 
transformation efforts. 

Lessons Learned in Recurring Failures of Federal Agency Financial 
Management System Implementations: 

In our recent report,[Footnote 5] we summarize many of the agencies' 
financial management system implementation failures that have been 
previously reported by us and inspectors general (IG). Our work and 
that of the IGs over the years has shown that agencies have failed to 
employ accepted best practices in systems development and 
implementation (commonly referred to as disciplined processes) that can 
collectively reduce the risk associated with implementing financial 
management systems. In our report, we identified key causes of failures 
within several recurring themes, including disciplined processes and 
human capital management. DHS would be wise to study the lessons 
learned through other agencies' costly failures and consider building a 
strong foundation for successful financial management system 
implementation, as we will discuss later in our testimony. 

Disciplined Processes Have Not Been Fully Employed: 

From our review of over 40 prior reports, we identified weaknesses in 
the following areas of disciplined processes. 

* Requirements management. Ill-defined or incomplete requirements have 
been identified by many system developers and program managers as a 
root cause of system failure.[Footnote 6] It is critical that 
requirements--functions the system must be able to perform--be 
carefully defined and flow from the concept of operations (how the 
organization's day-to-day operations are or will be carried out to meet 
mission needs). In our previous work, we have found agencies with a 
lack of a concept of operations, vague and ambiguous requirements, and 
requirements that are not traceable or linked to business processes. 

* Testing. Complete and thorough testing is essential to provide 
reasonable assurance that new or modified systems will provide the 
capabilities in the requirements. Testing is the process of executing a 
program with the intent of finding errors.[Footnote 7] Because 
requirements provide the foundation for system testing, they must be 
complete, clear, and well documented to design and implement an 
effective testing program. Absent this, an organization is taking a 
significant risk that substantial defects will not be detected until 
after the system is implemented. Industry best practices indicate that 
the sooner a defect is recognized and corrected, the cheaper it is to 
fix. In our work, we have found flawed test plans, inadequate timing of 
testing, and ineffective systems testing. 

* Data conversion. In its white paper[Footnote 8] on financial system 
data conversion,[Footnote 9] the Joint Financial Management Improvement 
Program (JFMIP)[Footnote 10] identified data conversion as one of the 
critical tasks necessary to successfully implement a new financial 
system. JFMIP also noted that if data conversion is done right, the new 
system has a much greater opportunity for success. On the other hand, 
converting data incorrectly or entering unreliable data from a legacy 
system has lengthy and long-term repercussions. The adage "garbage in, 
garbage out" best describes the adverse impact. Examples of problems we 
have reported on include agencies that have not properly developed and 
implemented good data conversion plans, have planned the data 
conversion too late in the project, and have not reconciled account 
balances. 

* Risk management. According to leading systems acquisition 
organizations, risk management is a process for identifying potential 
problems before they occur and adjusting the acquisition to decrease 
the chance of their occurrence. Risks should be identified as early as 
possible and a risk management process should be developed and put in 
place. Risks should be identified, analyzed, mitigated, and tracked to 
closure. Effectively managing risks is one way to minimize the chances 
of project cost, schedule, and performance problems from occurring. We 
have reported that agencies have not fully implemented effective risk 
management practices, including shortcomings in identifying and 
tracking risks. 

* Project management. Effective project management is the process for 
planning and managing all project-related activities, such as defining 
how components are interrelated, defining tasks, estimating and 
obtaining resources, and scheduling activities. Project management 
allows the performance, cost, and schedule of the overall program to be 
continually measured, compared with planned objectives, and controlled. 
We have reported on a number of project management problems including 
inadequate project management structure, schedule-driven projects, and 
lack of performance metrics and oversight. 

* Quality assurance. Quality assurance provides independent assessments 
of whether management process requirements are being followed and 
whether product standards and requirements are being satisfied. This 
process includes, among other things, the use of independent 
verification and validation (IV&V). We and others have reported on 
problems related to agencies' use of IV&V including specific functions 
not being performed by the IV&V, the IV&V contractor not being 
independent, and IV&V recommendations not being implemented. 

Inadequate implementation of disciplined processes can manifest itself 
in many ways when implementing a financial management system. While 
full deployment has been delayed at some agencies, specific 
functionality has been delayed or flawed at other agencies. The 
following examples illustrate some of the recurring problems related to 
the lack of disciplined processes in implementing financial management 
systems. 

* In May 2004, we reported[Footnote 11] significant flaws in 
requirements management and testing that adversely affected the initial 
development and implementation of the Army's Logistics Modernization 
Program (LMP), in which the Army estimated that it would invest about 
$1 billion. These flaws also hampered efforts to correct the 
operational difficulties experienced at the Tobyhanna Army Depot. In 
June 2005, we reported[Footnote 12] that the Army had not effectively 
addressed its requirements management and testing problems, and data 
conversion weaknesses had hampered the Army's ability to address the 
problems that needed to be corrected before the system could be fielded 
to other locations. The Army lacked reasonable assurance that (1) 
system problems experienced during the initial deployment and causing 
the delay of future deployments had been corrected and (2) LMP was 
capable of providing the promised system functionality. Subsequent 
deployments of the system have been delayed. 

* We reported[Footnote 13] in February 2005 that our experience with 
major systems acquisitions, such as the Office of Personnel 
Management's (OPM) Retirement Systems Modernization (RSM) program, has 
shown that having sound disciplined processes in place increases the 
likelihood of the acquisitions meeting cost and schedule estimates as 
well as performance requirements. However, we found that many of the 
processes in these areas for RSM were not sufficiently developed, were 
still under development, or were planned for future development. For 
example, OPM lacked needed processes for developing and managing 
requirements, planning and managing project activities, managing risks, 
and providing sound information to investment decision makers. Without 
these processes in place, RSM was at increased risk of not being 
developed and delivered on time and within budget and falling short of 
promised capabilities. 

* In August 2004, the Department of Veterans Affairs (VA) IG 
reported[Footnote 14] that the effect of transferring inaccurate data 
to VA's new core financial system at a pilot location interrupted 
patient care and medical center operations. This raised concerns that 
similar conversion problems would occur at other VA facilities if the 
conditions identified were not addressed and resolved nationwide prior 
to roll out. Some of the specific conditions the IG noted were that 
contracting and monitoring of the project were not adequate, and the 
deployment of the new system encountered multiple problems, including 
those related to software testing, data conversion and system 
interfaces, and project management. As a result of these problems, 
patient care was interrupted by supply outages and other problems. The 
inability to provide sterile equipment and needed supplies to the 
operating room resulted in the cancelation of 81 elective surgeries for 
a week in both November 2003 and February 2004. In addition, the 
operating room was forced to operate at two-thirds of its prior 
capacity. Because of the serious nature of the problems raised with the 
new system, VA management decided to focus on transitioning back to the 
previous financial management software at the pilot location and 
assembled a senior leadership team to examine the results of the pilot 
and make recommendations to the VA Secretary regarding the future of 
the system. 

Human Capital Management Problems Impede Financial Systems Development 
and Deployment: 

We are concerned that federal agencies' human capital problems are 
eroding the ability of many agencies--and threatening the ability of 
others--to perform their IT missions economically, efficiently, and 
effectively. For example, we found[Footnote 15] that in the 1990s, the 
initial rounds of downsizing were set in motion without considering the 
longer-term effects on agencies' IT performance capacity. Additionally, 
a number of individual agencies drastically reduced or froze their 
hiring efforts for extended periods. Consequently, following a decade 
of downsizing and curtailed investments in human capital, federal 
agencies currently face skills, knowledge, and experience imbalances, 
especially in their IT workforces. Without corrective action, these 
imbalances will worsen, especially in light of the numbers of federal 
civilian workers becoming eligible to retire in the coming years. In 
this regard, we are emphasizing the need for additional focus on the 
following three key elements of human capital management. 

* Strategic workforce planning. Having staff with the appropriate 
skills is key to achieving financial management improvements, and 
managing an organization's employees is essential to achieving results. 
It is important that agencies incorporate strategic workforce planning 
by (1) aligning an organization's human capital program with its 
current and emerging mission and programmatic goals and (2) developing 
long-term strategies for acquiring, developing, and retaining an 
organization's total workforce to meet the needs of the future. This 
incorporates a range of activities from identifying and defining roles 
and responsibilities, to identifying team members, to developing 
individual competencies that enhance performance. We have reported on 
agencies without a sufficient human capital strategy or plan, skills 
gap analysis, or training plans. 

* Human resources. Having sufficient numbers of people on board with 
the right mix of knowledge and skills can make the difference between 
success and failure. This is especially true in the IT area, where 
widespread shortfalls in human capital have contributed to demonstrable 
shortfalls in agency and program performance. We have found agency 
projects with significant human resource challenges, including 
addressing personnel shortages, filling key positions, and developing 
and retaining staff with the required competencies. 

* Change management. According to leading IT organizations, 
organizational change management is the process of preparing users for 
the business process changes that will accompany implementation of a 
new system. An effective organizational change management process 
includes project plans and training that prepare users for impacts the 
new system might have on their roles and responsibilities and a process 
to manage those changes. We have reported on various problems with 
agencies' change management, including transition plans not being 
developed, business processes not being reengineered, and customization 
not being limited. 

The following examples illustrate some of the recurring problems 
related to human capital management in implementing financial 
management systems. 

* We first reported in February 2002[Footnote 16] that the Internal 
Revenue Service (IRS) had not defined or implemented an IT human 
capital strategy for its Business Systems Modernization (BSM) program 
and recommended that IRS address this weakness. In June 2003, we 
reported[Footnote 17] that IRS had made important progress in 
addressing our recommendation, but had yet to develop a comprehensive 
multiyear workforce plan. IRS also had not hired, developed, or 
retained sufficient human capital resources with the required 
competencies, including technical skills, in specific mission areas. In 
September 2003, the Treasury Inspector General for Tax Administration 
reported[Footnote 18] that IRS's Modernization and IT Services 
organization had made significant progress in developing its human 
capital strategy but had not yet (1) identified and incorporated human 
capital asset demands for the modernized organization, (2) developed 
detailed hiring and retention plans, or (3) established a process for 
reviewing the human capital strategy development and monitoring its 
implementation. We most recently reported in July 2005[Footnote 19] 
that IRS had taken some steps in the right direction. However, until 
IRS fully implements its strategy, it will not have all of the 
necessary IT knowledge and skills to effectively manage the BSM program 
or to operate modernized systems. Consequently, the risk of BSM program 
and project cost increases, schedule slippages, and performance 
problems is increased. 

* We reported, in September 2004,[Footnote 20] that staff shortages and 
limited strategic workforce planning resulted in the Department of 
Health and Human Services (HHS) not having the resources needed to 
effectively design and operate its new financial management system. HHS 
had taken the first steps in strategic workforce planning. For example, 
the Centers for Disease Control and Prevention (CDC), where the first 
deployment was scheduled, was the only operating division that had 
prepared a competency report, but a skills gap analysis and training 
plan for CDC had not been completed. In addition, many government and 
contractor positions on the implementation project were not filled as 
planned. While HHS and the systems integrator had taken measures to 
acquire additional human resources for the implementation of the new 
financial management system, we concluded that scarce resources could 
significantly jeopardize the project's success and lead to several key 
deliverables being significantly behind schedule. In September 2004, 
HHS decided to delay its first scheduled deployment at CDC by 6 months 
in order to address these and other issues. 

DHS Faces Serious Financial Management Challenges: 

DHS faces unique challenges in attempting to develop integrated 
financial management systems across the breadth of such a large and 
diverse department. DHS was established by the Homeland Security Act of 
2002,[Footnote 21] as the 15th Cabinet Executive Branch Department of 
the United States government. DHS inherited a myriad of redundant 
financial management systems from 22 diverse agencies along with 
180,000 employees, about 100 resource management systems, and 30 
reportable conditions[Footnote 22] identified in prior component 
financial audits. Of the 30 reportable conditions, 18 were so severe 
they were considered material weaknesses.[Footnote 23] Among these 
weaknesses were insufficient internal controls or processes to reliably 
report financial information such as revenue, accounts receivable, and 
accounts payable; significant system security deficiencies; financial 
systems that required extensive manual processes to prepare financial 
statements; and incomplete policies and procedures necessary to 
complete basic financial management activities. 

DHS received a disclaimer of opinion on its financial statements for 
fiscal year 2005,[Footnote 24] and the independent auditors also 
reported that DHS's financial management systems did not substantially 
comply with the requirements of FFMIA. The disclaimer was primarily due 
to financial reporting problems at five components. The five components 
include Immigration and Customs Enforcement (ICE), the United States 
Coast Guard (Coast Guard), State and Local Government Coordination and 
Preparedness (SLGCP),[Footnote 25] the Transportation Security 
Administration (TSA), and Emergency Preparedness and Response (EPR). 
Further, ICE is an accounting service provider for other DHS 
components, and it failed to adequately maintain both its own 
accounting records and those of other DHS components during fiscal year 
2005. 

The auditors' fiscal year 2005 report discusses 10 material weaknesses, 
two other reportable conditions in internal control, and instances of 
noncompliance with seven laws and regulations. Among the 10 material 
weaknesses were inadequate financial management and oversight at DHS 
components, primarily ICE and Coast Guard; decentralized financial 
reporting at the component level; significant general IT and 
application control weaknesses over critical financial and operational 
data; and the lack of accurate and timely reconciliation of fund 
balance with treasury accounts. The results of the auditors' tests of 
fiscal year 2005 compliance with certain provisions of laws, 
regulations, contracts, and grant agreements disclosed instances of 
noncompliance. The DHS auditors reported instances of noncompliance 
with: 

* 31 U.S.C. § 3512(c),(d), commonly known as the Federal Managers' 
Financial Integrity Act of 1982 (FMFIA); 

* the Federal Financial Management Improvement Act of 1996 (FFMIA), 
Pub. L. No. 104-208, div. A, § 101(f), title VIII, 110 Stat. 3009, 3009-
389 (Sept. 30, 1996); 

* the Federal Information Security Management Act of 2002 (FISMA), Pub. 
L. No. 107-347, title III, 116 Stat. 2899, 2946 (Dec. 17, 2002); 

* the Single Audit Act, as amended (codified at 31 U.S.C. §§ 7501-
7507), and other laws and regulations related to OMB Circular No. A-50, 
Audit Follow-up, as revised (Sept. 29, 1982); 

* the Improper Payments Information Act of 2002, Pub. L. No. 107-300, 
116 Stat. 2350 (Nov. 26, 2002); 

* the Department of Homeland Security Financial Accountability Act of 
2004, Pub. L. No. 108-330, 118 Stat. 1275 (Oct. 16, 2004); and: 

* the Government Performance and Results Act of 1993 (GPRA), Pub. L. 
No. 103-62, 107 Stat. 285 (Aug. 3, 1993). 

Although DHS inherited many of the reportable conditions and 
noncompliance issues discussed above, the department's top management, 
including the CFO, is ultimately responsible for ensuring that progress 
is made in the area of financial management. 

In August 2003, DHS began the "electronically Managing enterprise 
resources for government effectiveness and efficiency" (eMerge2) 
program at an estimated cost of $229 million. The eMerge2 program was 
supposed to provide DHS with the financial system functionality to 
consolidate and integrate the department's financial accounting and 
reporting systems, including budget, accounting and reporting, cost 
management, asset management, and acquisition and grants functions. 
According to DHS officials, a systems integrator was hired in December 
2003, and the project was expected to be fully deployed and operational 
in 2006. In July 2004, we reported [Footnote 26] that the acquisition 
of eMerge2 was in the early stages and continued focus and follow 
through, among other things, would be necessary for it to be 
successful. 

According to DHS officials, because the project was not meeting its 
performance goals and timeline, DHS officials began considering whether 
to continue the project and in Spring 2005 started looking at another 
strategy. DHS officials told us they decided to change the strategy for 
its eMerge2 program in October 2005, and focus on leveraging the 
systems already in place. The revised strategy will allow DHS 
components to choose from an array of existing financial service 
providers. DHS officials said that by January 2006, after spending a 
reported $15.2 million, acquisition and development activities on 
eMerge2 had stopped and the blanket purchase agreement with the systems 
integrator expired. DHS officials added that the eMerge2 project would 
not be renamed. However, DHS plans to continue eMerge2 using a shared 
services approach, which allows its components to choose among three 
DHS providers of financial management services[Footnote 27] and the 
Department of the Treasury's Bureau of the Public Debt, which was 
identified by OMB as a governmentwide financial management center of 
excellence. DHS officials told us that although a departmentwide 
concept of operations and migration plan were still under development, 
they expected progress to be made in the next 5 years. As we will 
discuss later, a departmentwide concept of operations document would 
help DHS and others understand such items as how DHS will migrate the 
various entities to these shared service providers and how it will 
obtain the departmental information necessary to manage the agency from 
these disparate operations. DHS officials acknowledged that they needed 
to first address the material weaknesses at the proposed shared service 
providers before component agencies migrate to them. 

The Building Blocks of Successful Financial Management System 
Implementations: 

The key for federal agencies, including DHS, to avoid the long-standing 
problems that have plagued financial management system improvement 
efforts is to address the foremost causes of those problems and adopt 
solutions that reduce the risks associated with these efforts to 
acceptable levels. Although it appears that DHS will adopt a shared 
services approach to meet its needs for integrated financial management 
systems, implementing this approach will be complex and challenging, 
making the adoption of best practices even more important for this 
undertaking. Based on industry best practices, we identified four key 
concepts that will be critical to DHS's ability to successfully 
complete its planned migration to shared service providers. Careful 
consideration of these four concepts, each one building upon the next, 
will be integral to the success of DHS's strategy. The four concepts 
are (1) developing a concept of operations, (2) defining standard 
business processes, (3) developing a migration strategy for DHS 
components, and (4) defining and effectively implementing disciplined 
processes necessary to properly manage the specific projects. We will 
now highlight the key issues to be considered for each of the four 
areas. 

Concept of Operations Provides Foundation: 

As we discussed previously, a concept of operations defines how an 
organization's day-to-day operations are (or will be) carried out to 
meet mission needs. The concept of operations includes high-level 
descriptions of information systems, their interrelationships, and 
information flows. It also describes the operations that must be 
performed, who must perform them, and where and how the operations will 
be carried out. Further, it provides the foundation on which 
requirements definitions and the rest of the systems planning process 
are built. Normally, a concept of operations document is one of the 
first documents to be produced during a disciplined development effort 
and flows from both the vision statement and the enterprise 
architecture. According to the Institute of Electrical and Electronic 
Engineers (IEEE) standards,[Footnote 28] a concept of operations is a 
user-oriented document that describes the characteristics of a proposed 
system from the users' viewpoint. The key elements that should be 
included in a concept of operations are major system components, 
interfaces to external systems, and performance characteristics such as 
speed and volume. 

Another key element of a concept of operations is a transition strategy 
that is useful for developing an understanding of how and when changes 
will occur. Not only is this needed from an investment management point 
of view, it is a key element in the human capital problems discussed 
previously that revolved around change management strategies. 
Describing how to implement DHS's approach for using shared service 
providers for its financial management systems, as well as the process 
that will be used to deactivate legacy systems that will be replaced or 
interfaced with a new financial management system, are key aspects that 
need to be addressed in a transition strategy. 

Key Issues for DHS to Consider; 
* What is considered a financial management system? Are all the 
components using a standard definition? 
* Who will be responsible for developing a DHS-wide concept of 
operations, and what process will be used to ensure that the resulting 
document reflects the departmentwide solution rather than individual 
component agency stove-piped efforts? 
* How will DHS's concept of operations be linked to its enterprise 
architecture? 
* How can DHS obtain reliable information on the costs of its financial 
management systems investments? 

Standard Business Processes Promote Consistency: 

Business process models provide a way of expressing the procedures, 
activities, and behaviors needed to accomplish an organization's 
mission and are helpful tools to document and understand complex 
systems. Business processes are the various steps that must be followed 
to perform a certain activity. For example, the procurement process 
would start when the agency defines its needs, and issues a 
solicitation for goods or services, and would continue through contract 
award, receipt of goods and services, and would end when the vendor 
properly receives payment. The identification of preferred business 
processes would be critical for standardization of applications and 
training and portability of staff. 

To maximize the success of a new system acquisition, organizations need 
to consider the redesign of current business processes. As we noted in 
our Executive Guide: Creating Value Through World-class Financial 
Management,[Footnote 29] leading finance organizations have found that 
productivity gains typically result from more efficient processes, not 
from simply automating old processes. Moreover, the Clinger-Cohen Act 
of 1996 requires agencies to analyze the missions of the agency and, 
based on the analysis, revise mission-related and administrative 
processes, as appropriate, before making significant investments in IT 
used to support those missions.[Footnote 30] Another benefit of what is 
often called business process modeling is that it generates better 
system requirements, since the business process models drive the 
creation of information systems that fit in the organization and will 
be used by end users. Other benefits include providing a foundation for 
agency efforts to describe the business processes needed for unique 
missions, or developing subprocesses to support those at the 
departmentwide level. 

Key Issues for DHS to Consider; 
* Who will be responsible for developing DHS-wide standard business 
processes that meet the needs of its component agencies? 
* How will the component agencies be encouraged to adopt new processes, 
rather than selecting other methods that result in simply automating 
old ways of doing business? 
* How will the standard business processes be implemented by the shared 
service providers to provide consistency across DHS? 
* What process will be used to determine and validate the processes 
needed for DHS agencies that have unique needs? 

Strategy for Implementing the Financial Management Shared Services 
Approach Will Be Key: 

Although DHS has a goal of migrating agencies to a limited number of 
shared service providers, it has not yet articulated a clear and 
measurable strategy for achieving this goal. In the context of 
migrating to shared service providers, critical activities include (1) 
developing specific criteria for requiring component agencies to 
migrate to one of the providers rather than attempting to develop and 
implement their own stove-piped business systems; (2) providing the 
necessary information for a component agency to make a selection of a 
shared service provider for financial management; (3) defining and 
instilling new values, norms, and behaviors within component agencies 
that support new ways of doing work and overcoming resistance to 
change; (4) building consensus among customers and stakeholders on 
specific changes designed to better meet their needs; and (5) planning, 
testing, and implementing all aspects of the transition from one 
organizational structure and business process to another. 

Finally, sustained leadership will be key to a successful strategy for 
moving DHS components towards consolidated financial management 
systems. In our Executive Guide: Creating Value Through World-class 
Financial Management, we found that leading organizations made 
financial management improvement an entitywide priority by, among other 
things, providing clear, strong executive leadership. We also reported 
that making financial management a priority throughout the federal 
government involves changing the organizational culture of federal 
agencies. Although the views about how an organization can change its 
culture can vary considerably, leadership (executive support) is often 
viewed as the most important factor in successfully making cultural 
changes. Top management must be totally committed in both words and 
actions to changing the culture, and this commitment must be sustained 
and demonstrated to staff. As pressure mounts to do more with less, to 
increase accountability, and to reduce fraud, waste, abuse, and 
mismanagement, and efforts to reduce federal spending intensify, 
sustained and committed leadership will be a key factor in the 
successful implementation of DHS's financial management systems. 

Key Issues for DHS to Consider; 
* What guidance will be provided to assist DHS component agencies in 
adopting a change management strategy that reduces the risks of moving 
to a shared service provider? 
* What processes will be put in place to ensure that individual 
component agency financial management system investment decisions focus 
on the benefits of standard processes and shared service providers? 
* What process will be used to facilitate the decision-making process 
used by component agencies to select a provider? 
* How will component agencies incorporate strategic workforce planning 
in the implementation of the shared service provider approach? 

Disciplined Processes Will Help Ensure Successful Implementation: 

Once the concept of operations and standard business processes have 
been defined and a migration strategy is in place, the use of 
disciplined processes, as discussed previously, will be a critical 
factor in helping to ensure that the implementation is successful. The 
key to avoiding long-standing implementation problems is to provide 
specific guidance to component agencies for financial management system 
implementations, incorporating the best practices identified by the 
Software Engineering Institute, the IEEE, the Project Management 
Institute, and other experts that have been proven to reduce risk in 
implementing systems. Such guidance should include the various 
disciplined processes such as requirements management, testing, data 
conversion and system interfaces, risk and project management, and 
related activities, which have been problematic in the financial 
systems implementation projects we and others have reviewed. 

Disciplined processes have been shown to reduce the risks associated 
with software development and acquisition efforts to acceptable levels 
and are fundamental to successful system implementations. The 
principles of disciplined IT systems development and acquisition apply 
to shared services implementation, such as that contemplated by DHS. A 
disciplined software implementation process can maximize the likelihood 
of achieving the intended results (performance) within established 
resources (costs) on schedule. For example, disciplined processes 
should be in place to address the areas of data conversion and 
interfaces, two of the many critical elements necessary to successfully 
implement a new system--the lack of which have contributed to the 
failure of previous agency efforts. Further details on disciplined 
processes can be found in appendix III of our recently issued 
report.[Footnote 31] 

Key Issues for DHS to Consider; 
* How can existing industry standards and best practices be 
incorporated into DHS-wide guidance related to financial management 
system implementation efforts, including migrating to shared service 
providers? 
* What actions will be taken to reduce the risks and costs associated 
with data conversion and interface efforts? 
* What oversight process will be used to ensure that modernization 
efforts effectively implement the prescribed policies and procedures? 

Concluding Observations: 

In closing, the best practices we identified are interrelated and 
interdependent, collectively providing an agency with a better outcome 
for its system deployment--including cost savings, improved service and 
product quality, and ultimately, a better return on investment. The 
predictable result of DHS and other agencies not effectively addressing 
these best practices is projects that do not meet cost, schedule, and 
performance objectives. There will never be a 100 percent guarantee 
that a new system will be fully successful from the outset. However, 
risk can be managed and reduced to acceptable levels through the use of 
disciplined processes, which in short represent best practices that 
have proven their value in the past. We view the application of 
disciplined processes to be essential for DHS's systems modernization 
efforts. Based on industry best practices, the following four concepts 
would help ensure a sound foundation for developing and implementing a 
DHS-wide solution for the complex financial management problems it 
currently faces: (1) developing a concept of operations that expresses 
DHS's view of financial management and how that vision will be 
realized, (2) defining standard business processes, (3) developing an 
implementation strategy, and (4) defining and effectively implementing 
applicable disciplined processes. If properly implemented, the best 
practices discussed here today and in our recently issued 
report[Footnote 32] will help reduce the risk associated with a project 
of this magnitude and importance to an acceptable level. With DHS at an 
important crossroads in the implementation of the eMerge2 program, it 
has the perfect opportunity to use these building blocks to form a 
solid foundation on which to base its efforts and avoid the problems 
that have plagued so many other federal agencies faced with the same 
challenge. 

Mr. Chairmen, this concludes our prepared statement. We would be happy 
to respond to any questions you or other Members of the Subcommittees 
may have at this time. 

Contacts and Acknowledgments: 

For information about this testimony, please contact McCoy Williams, 
Director, Financial Management and Assurance, at (202) 512-9095 or at 
williamsm1@gao.gov, or Keith A. Rhodes, Chief Technologist, Applied 
Research and Methods, who may be reached at (202) 512-6412 or at 
rhodesk@gao.gov. Contact points for our Offices of Congressional 
Relations and Public Affairs may be found on the last page of this 
testimony. Individuals who made key contributions to this testimony 
include Kay Daly, Assistant Director; Chris Martin, Senior-Level 
Technologist; Francine DelVecchio; Mike LaForge; and Chanetta Reed. 
Numerous other individuals made contributions to the GAO reports cited 
in this testimony. 

FOOTNOTES 

[1] Joint hearing held by the Subcommittee on Government Management, 
Finance, and Accountability, House Committee on Government Reform and 
the Subcommittee on Management, Integration, and Oversight, House 
Committee on Homeland Security. 

[2] GAO, CFO Act of 1990: Driving the Transformation of Federal 
Financial Management, GAO-06-242T (Washington, D.C.: Nov. 17, 2005). 

[3] GAO, Financial Management Systems: Additional Efforts Needed to 
Address Key Causes of Modernization Failures, GAO-06-184 (Washington, 
D.C.: Mar. 15, 2006). 

[4] GAO-06-184. 

[5] GAO-06-184. 

[6] Requirements are the blueprint that system developers and program 
managers use to design and develop a system. 

[7] Glenford J. Myers, The Art of Software Testing (John Wiley & Sons, 
Inc., 1979). 

[8] Joint Financial Management Improvement Program, White Paper: 
Financial Systems Data Conversion-Considerations (Washington, D.C.: 
Dec. 20, 2002). 

[9] Data conversion is defined as the modification of existing data to 
enable it to operate with similar functional capability in a different 
environment. 

[10] JFMIP was originally formed under the authority of the Budget and 
Accounting Procedures Act of 1950 and was a joint and cooperative 
undertaking of GAO, the Department of the Treasury, the Office of 
Management and Budget (OMB), and the Office of Personnel Management 
(OPM), working in cooperation with each other to improve financial 
management practices in the federal government. In a December 2004 
memorandum, OMB announced a realignment of JFMIP's responsibilities for 
financial management policy and oversight in the federal government. 
JFMIP ceased to exist as a separate organization, although the 
Principals will continue to meet at their discretion. 

[11] GAO, DOD Business Systems Modernization: Billions Continue to Be 
Invested with Inadequate Management Oversight and Accountability, GAO-
04-615 (Washington, D.C.: May 27, 2004). 

[12] GAO, Army Depot Maintenance: Ineffective Oversight of Depot 
Maintenance Operations and System Implementation Efforts, GAO-05-441 
(Washington, D.C.: June 30, 2005). 

[13] GAO, Office of Personnel Management: Retirement Systems 
Modernization Program Faces Numerous Challenges, GAO-05-237 
(Washington, D.C.: Feb. 28, 2005). 

[14] Department of Veterans Affairs Office of Inspector General, Issues 
at VA Medical Center Bay Pines, Florida and Procurement and Deployment 
of the Core Financial and Logistics System, Report 04-01371-177 
(Washington, D.C.: Aug. 11, 2004). 

[15] GAO, Human Capital: Building the Information Technology Workforce 
to Achieve Results, GAO-01-1007T (Washington, D.C.: July 31, 2001). 

[16] GAO, Business Systems Modernization: IRS Needs to Better Balance 
Management Capacity with Systems Acquisition Workload, GAO-02-356 
(Washington, D.C.: Feb. 28, 2002). 

[17] GAO, Business Systems Modernization: IRS Has Made Significant 
Progress in Improving Its Management Controls, but Risks Remain, GAO-03-
768 (Washington, D.C.: June 27, 2003). 

[18] Treasury Inspector General for Tax Administration, The 
Modernization, Information Technology and Security Services 
Organization Needs to Take Further Action to Complete Its Human Capital 
Strategy, Reference Number 2003-20-209 (Washington, D.C.: Sept. 22, 
2003). 

[19] GAO, Business Systems Modernization: Internal Revenue Service's 
Fiscal Year 2005 Expenditure Plan, GAO-05-774 (Washington, D.C.: July 
22, 2005). 

[20] GAO, Financial Management Systems: Lack of Disciplined Processes 
Puts Implementation of HHS's Financial System at Risk, GAO-04-1008 
(Washington, D.C.: Sept. 23, 2004). 

[21] Pub. L. No. 107-296, § 101(a), 116 Stat. 2135, 2142 (Nov. 25, 
2002) (codified at 6 U.S.C. § 111(a)). 

[22] Under standards issued by the American Institute of Certified 
Public Accountants, "reportable conditions" are matters coming to the 
auditors' attention relating to significant deficiencies in the design 
or operation of internal control that, in the auditors' judgment, could 
adversely affect the department's ability to record, process, 
summarize, and report financial data consistent with the assertions of 
management in the financial statements. 

[23] Material weaknesses are reportable conditions in which the design 
or operation of one or more of the internal control components does not 
reduce to a relatively low level the risk that misstatements in amounts 
that would be material in relation to the financial statements being 
audited may occur and not be detected within a timely period by 
employees in the normal course of performing their assigned functions. 

[24] Office of Inspector General, Independent Auditors' Report on DHS' 
FY 2005 Financial Statements (Nov. 15, 2005). 

[25] SLGCP has since been succeeded by the Office of Grants and 
Training (G&T) within the DHS Preparedness Directorate. 

[26] GAO, Financial Management: Department of Homeland Security Faces 
Significant Financial Management Challenges, GAO-04-774 (Washington, 
D.C.: July 19, 2004). 

[27] The three proposed DHS shared service providers are Customs and 
Border Protection, Coast Guard, and Federal Law Enforcement Training 
Center. 

[28] IEEE Std. 1362-1998. The IEEE is a nonprofit, technical 
professional association that develops standards for a broad range of 
global industries, including the IT and information assurance 
industries and is a leading source for defining best practices. 

[29] GAO, Executive Guide: Creating Value Through World-class Financial 
Management, GAO/AIMD-00-134 (Washington, D.C.: April 2000). 

[30] See 40 U.S.C. § 11303(b)(2)(C). 

[31] GAO-06-184. 

[32] GAO-06-184.