This is the accessible text file for GAO report number GAO-05-805 
entitled 'Information Technology: Management Improvements Needed on 
Immigration and Customs Enforcement's Infrastructure Modernization 
Program' which was released on September 7, 2005. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Report to Congressional Committees: 

September 2005: 

Information Technology: 

Management Improvements Needed on Immigration and Customs Enforcement's 
Infrastructure Modernization Program: 

[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-05-805]: 

GAO Highlights: 

Highlights of GAO-05-805, a report to congressional committees: 

Why GAO Did This Study: 

The Department of Homeland Security’s (DHS) Atlas program is intended 
to modernize Immigration and Customs Enforcement’s (ICE) information 
technology (IT) infrastructure. By congressional mandate, DHS is to 
develop and submit for approval an expenditure plan for Atlas that 
satisfies certain legislative conditions, including a review by GAO. 
GAO was asked to determine whether the plan satisfied certain 
legislative conditions and to provide observations on the plan and 
management of the program. 

What GAO Found: 

DHS’s fiscal year 2004 Atlas expenditure plan, related documentation, 
and program officials’ statements satisfied all conditions imposed by 
Congress, including (1) meeting the capital planning and investment 
control review requirements established by the Office of Management and 
Budget (OMB); (2) complying with the DHS enterprise architecture; (3) 
complying with the acquisition rules, requirements, guidelines, and 
systems acquisition management practices of the federal government; and 
(4) being reviewed and approved by ICE’s Investment Review Board, DHS, 
and OMB. However, this satisfaction is based more on plans and 
commitments that provide for meeting these conditions than on completed 
actions. As such, much remains to be accomplished for Atlas planning 
and management efforts to be considered effective and thereby minimize 
the risks associated with the program’s capacity to deliver promised IT 
infrastructure capabilities and benefits on time and within budget. 

GAO developed a number of observations about the expenditure plan and 
DHS’s management of the program. The observations address the need for 
economic justification of Atlas, rigorous and disciplined program 
management practices, performance measurements that are linked to goals 
and benefits, and an expenditure plan that provides sufficient 
information on program commitments for it to be a useful accountability 
tool. For example, Atlas’s existing economic justification does not 
reflect recent and planned changes in the program’s scope and purpose, 
including plans to expand the program beyond IT infrastructure 
upgrades. In addition, program management controls and capabilities 
have yet to be established. While ICE has begun to establish an Atlas 
program office, this office is not yet operational and is not 
adequately staffed. For example, while ICE has assigned a program 
manager and three contracting staff, it has not yet determined how many 
staff will be needed on the Atlas projects. In addition, while the 
program manager recently assessed staffing needs for program support 
positions, and identified several, none have been filled (see graphic). 

Proposed Program Management Office: 

[See PDF for image] 

[End of figure]

What GAO Recommends: 

To strengthen Atlas planning and management, GAO recommends that the 
Secretary of DHS ensure that ICE follows through on commitments to 
implement effective management controls and capabilities by, among 
other things, revising and updating the cost-benefit analysis; making 
the program office operational; developing and implementing rigorous 
performance program management practices; and ensuring that future 
expenditure plans fully disclose the system capabilities, schedule, 
cost, and benefits to be delivered. In its written comments on this 
report, DHS concurred with GAO’s recommendations and
stated actions that it was taking to implement them. 

www.gao.gov/cgi-bin/getrpt?GAO-05-805. 

To view the full product, including the scope and methodology, click on 
the link above. For more information, contact Randy Hite, (202) 512-
3439, HiteR@gao.gov. 

[End of section] 

Contents: 

Letter: 

Compliance with Legislative Conditions: 

Other Observations on the Expenditure Plan and Management of Atlas: 

Conclusions: 

Recommendations for Executive Action: 

Agency Comments: 

Appendixes: 

Appendix I: Briefing to the Staffs of the Subcommittees on Homeland 
Security, Senate and House Committees on Appropriations: 

Appendix II: Comments from the U.S. Department of Homeland Security: 

Appendix III: GAO Contact and Staff Acknowledgments: 

Abbreviations: 

DHS: Department of Homeland Security: 

ICE: Immigration and Customs Enforcement: 

IT: information technology: 

OMB: Office of Management and Budget: 

Letter September 7, 2005: 

The Honorable Judd Gregg: 
Chairman: 
The Honorable Robert C. Byrd: 
Ranking Member: 
Subcommittee on Homeland Security: 
Committee on Appropriations: 
United States Senate: 

The Honorable Harold Rogers: 
Chairman: 
The Honorable Martin Olav Sabo: 
Ranking Member: 
Subcommittee on Homeland Security: 
Committee on Appropriations: 
House of Representatives: 

The 2004 Department of Homeland Security Appropriations Act[Footnote 1] 
provided $40 million for Immigration and Customs Enforcement's (ICE) 
program to modernize its information technology (IT) 
infrastructure.[Footnote 2] The goals of the program--which ICE refers 
to as "Atlas"--are to, among other things, improve information sharing, 
strengthen information security, and improve workforce productivity. 
The act provided that the Department of Homeland Security (DHS) was 
prohibited from obligating the $40 million until it developed a plan 
for how the funds are to be spent that satisfied certain legislative 
conditions, including having the plan reviewed by us. On March 16, 
2005, DHS submitted its fiscal year 2004 expenditure plan to the Senate 
and House Appropriations Subcommittees on Homeland Security. Pursuant 
to the act, we reviewed the plan; our objectives were to (1) determine 
whether the plan satisfies legislative conditions specified in the act 
and (2) provide any other observations about the plan and management of 
the program. 

On May 10 and 24, 2005, we briefed the Senate and House Homeland 
Security Subcommittee staffs, respectively, on the results of our 
review. This report transmits the results of that work. The full 
briefing, including our scope and methodology, is reprinted in appendix 
I. 

Compliance with Legislative Conditions: 

DHS satisfied each of the applicable legislative conditions specified 
in the act. In particular, the plan, including related program 
documentation and program officials' statements, satisfied or provided 
for satisfying all key aspects of (1) meeting the capital planning and 
investment control review requirements of the Office of Management and 
Budget (OMB);[Footnote 3] (2) complying with the DHS enterprise 
architecture;[Footnote 4] (3) complying with acquisition rules, 
requirements, guidelines, and systems acquisition management practices 
of the federal government; and (4) having the plan reviewed and 
approved by ICE's Investment Review Board, DHS, and OMB. 

However, satisfaction of these legislative conditions is based in large 
part on plans and oral commitments by program officials that provide 
for meeting the conditions. To illustrate, OMB capital planning 
requirements direct agencies planning to make a major IT investment, 
like Atlas, to among other things (1) summarize the investment's life- 
cycle costs; (2) analyze costs and benefits, including return on 
investment; (3) establish performance goals and measures; and (4) 
develop security and privacy plans. The Atlas program does not have a 
current life-cycle cost estimate nor a current cost-benefit analysis 
showing return on investment. It also does not have a complete set of 
performance measures. Further, the program does not have an up-to-date 
security plan that includes Atlas, and officials have yet to develop a 
privacy impact assessment for the program. The program manager 
acknowledged these shortfalls and either planned or orally committed to 
fully satisfy the requirements when expenditure plan funds become 
available. 

Other Observations on the Expenditure Plan and Management of Atlas: 

Our observations address the need for economic justification of Atlas, 
rigorous and disciplined program management practices, performance 
measurements that are linked to goals and benefits, and an expenditure 
plan that provides sufficient information on program commitments to 
make the plan a useful accountability tool. An overview of specific 
observations follows: 

* Economic justification (i.e., analysis of costs and benefits) does 
not reflect recent and planned changes in the program's scope and 
purpose. The existing cost-benefit analysis--which was developed in 
2002--has not yet been revised to reflect changes in the program's 
scope and purpose. Since ICE became responsible for Atlas in 2003 
(inherited from the Immigration and Naturalization Service) it has 
materially changed the program's scope, purpose, and priorities. 
Specifically, Atlas was expanded to (1) support additional law 
enforcement units[Footnote 5] (and their business requirements) that 
were merged into ICE and (2) provide the flexibility to support new ICE 
priorities, such as integrating future antiterrorism programs and 
projects and facilitating information sharing with domestic and 
international law enforcement organizations. In addition, the program 
is also being expanded beyond infrastructure upgrades to include 
efforts to streamline and reengineer core business functions with the 
application of IT. According to the fiscal year 2004 expenditure plan 
and program manager, revising the analysis is a "next step" to be taken 
and the goal is to have a contractor complete an updated cost-benefit 
analysis on or about September 30, 2005. 

* Program management controls and capabilities have yet to be 
established. ICE has begun to establish an Atlas program office; 
however, the program office is not yet operational. Specifically, the 
bureau has drafted a management structure and plan, which includes 
staff roles and responsibilities. However, the structure and plan are 
currently being reviewed by ICE management and have not been made 
final. Moreover, of the $63.52 million that ICE reported was obligated 
for Atlas in fiscal years 2002 and 2003, only about $900,000 (or about 
1.4 percent of the total amount) was obligated for program management 
capabilities. In contrast, our work on other IT modernization programs 
(including two in DHS) show that 19 percent was invested in such 
management capabilities. In addition, while key acquisition management 
processes have been defined in ICE's System Development Life Cycle 
methodology, the program office has yet to implement these processes. 

Further, the program office is not adequately staffed.[Footnote 6] 
Currently, the office has staffed the program manager position, and it 
has three contracting staff performing functions such as developing 
staffing needs assessments and other program management-related 
activities. While the program manager recently assessed staffing needs 
for program support positions (e.g., financial management, contracting, 
and enterprise architecture), he has not yet performed a needs 
assessment to determine the staffing needs for the five of the six 
projects that comprise the Atlas program. Moreover, of the seven 
program support positions that the program manager has determined are 
needed, none have been filled, according to program officials. The 
program manager stated that ICE plans to strengthen program management 
controls and capabilities once funds provided for in the expenditure 
plan are available. 

* Program goals, expected benefits, and reported achievements are not 
fully aligned. The Atlas expenditure plan and documentation show that 
the program has defined goals and expected benefits and has reported 
actual achievements accomplished during fiscal years 2002 and 2003. 
However, the relationships among goals, benefits, and achievements have 
not been defined and are not apparent in all cases. Moreover, the 
reported achievements are not expressed in terms of measurable outcomes 
or results, but rather as activities completed. The program manager 
stated that the 2002 and 2003 achievements were not analyzed and 
aligned to program goals and benefits, and that outcome-based measures 
were not developed in part because the emphasis at the time was on 
buying and deploying long overdue infrastructure upgrades as quickly as 
possible. He stated that in the future, the program intends to define, 
ensure, and disclose the linkage among program goals, benefits, and 
results. 

* Fiscal year 2004 expenditure plan does not provide sufficient 
information on program commitments to permit effective congressional 
oversight. The Atlas expenditure plan does not show the level of detail 
and scope of the program needed for Congress to understand its plans 
and commitments relative to system capabilities, cost, benefits, and 
schedule. Further, it does not sufficiently describe progress made 
against program commitments (e.g., expected benefits). According to the 
program manager, the state of the plan reflects the program's 
uncertainty about the appropriate level of detail in expenditure plans. 
He stated that future plans will include missing content. 

Conclusions: 

The fiscal year 2004 Atlas expenditure plan, in combination with 
related program documentation and program officials' statements, 
satisfies the legislative conditions set forth by Congress. However, 
this satisfaction is based more on plans and commitments that provide 
for meeting these conditions than on completed actions. As such, much 
remains to be accomplished for Atlas planning and management efforts to 
be considered effective and thereby minimize the risks associated with 
the program's capacity to deliver promised IT infrastructure 
capabilities and benefits on time and within budget. 

The current state of planning and management puts the program at risk. 
While this is partially due to events beyond the program's control, 
such as the department's decision to reprogram Atlas funding and to 
redeploy Atlas staff to competing DHS priorities, as well as to change 
the program's scope and purpose when it transitioned from the 
Immigration and Naturalization Service to ICE, it is also due to the 
program's decision not to use fiscal years 2002 and 2003 funds to 
invest in program management capabilities. 

Given that more than $60 million has reportedly been obligated to date 
on the program, resources have been available to strengthen planning 
and management capabilities in key areas, but investment in these areas 
has been deferred. Deferral of establishing such program planning and 
management controls and capabilities--such as having reliable and 
current economic justification for the program; a capable program 
office; and clearly aligned program goals, benefits, and performance 
measures--introduce unnecessary risk to the program. 

Moreover, not providing congressional decision makers with the 
information that they need about program commitments to be met with the 
expenditure plan funds--including the benefits to be produced, the 
capabilities to be delivered, and the cost and schedule estimates to be 
met--impedes congressional oversight. 

Recommendations for Executive Action: 

To minimize risks to the Atlas program, we recommend that the Secretary 
of Homeland Security, through the Under Secretary for Border and 
Transportation Security, direct the Assistant Secretary for Immigration 
and Customs Enforcement to ensure that ICE follows through on 
commitments to implement effective management controls and capabilities 
by taking the following five steps: 

* Revising and updating the cost-benefit analysis, to identify current 
mission requirements; how they will be met; and an estimate of the 
program's incremental and life-cycle costs, benefit, schedule, and 
return on investment. This should also include establishing plans, 
associated tasks, and milestones for accomplishing this effort. 

* Making the Atlas program office operational by (1) developing a 
staffing needs assessment to determine the positions and the level of 
staffing needed for all projects to adequately manage the program, 
including a human capital strategy and timetable for acquiring the 
staff and bringing them on board; (2) finalizing the roles and 
responsibilities for the positions identified in the staffing 
assessment and for the projects; and (3) implementing and 
institutionalizing key acquisition management controls, including risk 
management processes where relevant responsibilities are assigned and 
key risks and their status are reported to an executive body. 

* Developing and implementing an updated Atlas security plan and 
privacy impact assessment. This should also include establishing plans, 
associated tasks, and milestones for accomplishing this effort. 

* Developing and implementing rigorous performance management practices 
for the Atlas program that include properly aligned goals, benefits, 
achievements, and anticipated achievements that are defined in 
measurable terms. This should also include establishing plans, 
associated tasks, and milestones for accomplishing this effort. 

* Ensuring that future expenditure plans fully disclose the system 
capabilities, schedule, cost, and benefits to be delivered, as well as 
the acquisition strategy for Atlas. 

Agency Comments: 

In the department's written comments on a draft of this report, which 
were contained in a letter signed by the director, DHS Departmental 
GAO/Office of Inspector General Liaison, DHS concurred with all of our 
recommendations and stated actions it was taking to implement them. 
DHS's comments are reprinted in appendix II. 

We are sending copies of this report to the Chairmen and Ranking 
Members of other Senate and House committees and subcommittees that 
have authorization and oversight responsibilities for homeland 
security. We are also sending copies to the Secretary of Homeland 
Security and the Director of OMB. Copies of this report will also be 
available at no charge on our Web site at [Hyperlink, 
http://www.gao.gov]. 

Should you or your offices have any questions on matters discussed in 
this report, please contact me at (202) 512-3439 or at [Hyperlink, 
hiter@gao.gov]. Contact points for our Offices of Congressional 
Relations and Public Affairs may be found on the last page of this 
report. Key contributors to this report are listed in appendix III. 

Signed by: 

Randolph C. Hite: 
Director, Information Technology Architecture and Systems Issues: 

[End of section]

Appendixes: 

Appendix I: Briefing to the Staffs of the Subcommittees on Homeland 
Security, Senate and House Committees on Appropriations: 

GAO: 

Appendix I: 

Information Technology: Management Improvements Needed on Immigration 
and Customs Enforcement's Infrastructure Modernization Program: 

Briefing to the Staffs of the Subcommittees on Homeland Security, 
Senate and House Committees on Appropriations: 

May 10 and May 24, 2005: 

* Introduction; 

* Objectives; 

* Results in Brief; 

* Background; 

* Results: 
- Legislative Conditions 
- Observations: 

* Conclusions; 

* Recommendations; 

* Agency Comments; 

* Attachment I: Scope and Methodology. 

Introduction: 

The Department of Homeland Security's (DHS) Bureau of Immigration and 
Customs Enforcement (ICE) [NOTE 1] is responsible for enforcing border 
security, trade, and other laws by, for example, investigating and 
collecting intelligence on individuals and groups who act to violate 
these laws. ICE is also responsible for detecting and deterring hostile 
acts on U.S. commercial aviation and protecting federal facilities. 

Atlas is an ICE program to modernize the bureau's information 
technology (IT) infrastructure. IT infrastructure includes the hardware 
(e.g., servers, routers, storage devices, communication lines) and 
system software (e.g., database management and operating systems and 
network management) that provide an environment for operating and 
maintaining software applications. 

According to ICE, the goals of Atlas include improving information 
sharing, strengthening information security, and improving workforce 
productivity. 

[NOTE 1] ICE was formed from the former Immigration and Naturalization 
Service, U.S. Customs Service, and other entities. Atlas began in 2002 
under the former INS. 

The fiscal year 2004 Department of Homeland Security Appropriations Act 
[NOTE 2] appropriated $40 million for Atlas and provided that DHS was 
prohibited from obligating these funds until the department submitted a 
plan for how the funds were to be spent that satisfied the following 
legislative conditions: 

* meets the capital planning and investment control review requirements 
established by the Office of Management and Budget (OMB), including OMB 
Circular A-11, part 3, [NOTE 3] 

* complies with DHS's enterprise architecture,
* complies with the acquisition rules, requirements, guidelines, and 
systems acquisition management practices of the federal government,
* is reviewed and approved by ICE's Investment Review Board (IRB), 
[NOTE 5] DHS, and OMB, and: 

* is reviewed by GAO. 

During fiscal year 2004, DHS reprogrammed about $30.2 million of the 
Atlas funds to cover other ICE priorities, leaving $9.8 million for the 
program. 

DHS submitted its fiscal year 2004 expenditure plan for $9.8 million on 
March 16, 2005, to its Senate and House Appropriations Subcommittees on 
Homeland Security. 

[NOTE 2] Pub.L. No. 108-90 (Oct. 1, 2003). 

[NOTE 3] OMB Circular A-11 establishes policy for planning, budgeting, 
acquisition, and management of federal capital assets. Capital 
investment and control requirements are now found in OMB Circular A-11, 
part 7, rather than part 3. 

[NOTE 4] As agreed with the staffs of the appropriations subcommittees, 
we assessed compliance with the DHS enterprise architecture in lieu of 
the ICE enterprise architecture. 

[NOTE 5] The purpose of the IRB is to integrate capital planning and 
investment control, budgeting, and acquisition. It is also to ensure 
that spending on investments directly supports and furthers the mission 
and that this spending provides optimal benefits and capabilities to 
stakeholders and customers. 

Objectives: 

As agreed, our objectives were to: 

1. determine whether the Atlas fiscal year 2004 expenditure plan 
satisfies the legislative conditions, and: 

2. provide any other observations about the expenditure plan and DHS's 
management of the Atlas program. 

We conducted our work at DHS and ICE headquarters in Washington, D.C. 
from March 2005 through May 2005 in accordance with generally accepted 
government auditing standards. Details of our scope and methodology are 
provided in attachment I. 

Results in Brief: 

Objective 1: Satisfaction of Legislative Conditions: 

Legislative condition: 1. Meets the capital planning and investment 
control review requirements established by OMB, including OMB Circular 
A-11, part 7 [NOTE 6]; 
Status: Satisfied. 

Legislative condition: 2. Complies with the DHS enterprise 
architecture; 
Status: Satisfied. 

Legislative condition: 3. Complies with the acquisition rules, 
requirements, guidelines, and systems acquisition management practices 
of the federal government; 
Status: Satisfied. 

Legislative condition: 4. Is reviewed and approved by ICE IRB, DHS, and 
OMB; 
Status: Satisfied. 

Legislative condition: 5. Is reviewed by GAO; 
Status: Satisfied. 

[End of table] 

[NOTE 6] Capital investment and control requirements are now found in 
OMB Circular A-11, part 7, rather than part 3. [7] Satisfied: Satisfied 
or provides for satisfying every aspect of the condition that we 
reviewed. 

Objective 2: Other Observations: 

Economic justification does not reflect recent and planned changes in 
the program's scope and purpose. 

Program management controls and capabilities have yet to be 
established. 

Program goals, expected benefits, and reported achievements are not 
fully aligned. 

Fiscal year 2004 expenditure plan does not provide sufficient 
information on program commitments to permit effective congressional 
oversight. 

Recommendations: 

We are making recommendations to the Secretary of DHS to improve Atlas 
expenditure planning and program management. 

In commenting on a draft of this briefing, ICE's chief information 
officer and the Atlas program manager agreed with our findings and 
conclusions and stated that our recommendations were reasonable. 

Background: 

ICE: 

ICE was formed as a component agency of DHS in 2003 when the law 
enforcement functions of the Justice Department's former Immigration 
and Naturalization Service (INS) and the Treasury Department's former 
Customs Service, among other agencies, were merged into DHS. 

The ICE mission is to ensure the security of the American people and 
homeland by investigating violators of, and thereby, enforcing the 
nation's immigration and customs laws; protecting U.S. commercial air 
carriers, airports, passengers, and crews; policing and securing 
federal buildings and other facilities; and collecting, analyzing, and 
disseminating intelligence to assist it in these endeavors. 

Headed by the Assistant Secretary of Immigration and Customs 
Enforcement, ICE has approximately 15,000 employees in over 400 offices 
domestically and in other countries. 

The Atlas program was started by INS in 2002. Responsibility for the 
program was transferred to ICE in 2003 as part of the establishment of 
DHS. 

The figure on the following page shows ICE and Atlas organizational 
placement within the department. 

Background: 

ICE and Atlas Organizational Placement: 

Simplified DHS organizational chart showing ICE and Atlas program: 

[See PDF for image] 

Source: GAO analysis of DHS data. 

[End of figure] 

Background: 

Impetus for Atlas: 

According to ICE officials, Atlas was initiated to address information 
sharing and security limitations within the former INS caused by, for 
example,
* obsolete hardware/software that needed refreshing;

* incompatible, non-interoperable information systems; and: 

* uneven system security capabilities. 

These officials stated that these challenges were exacerbated by the 
formation of ICE because the organizations that merged into ICE had 
different hardware/software environments (e.g., multiple e-mail 
systems) and different mission and customer needs. 

Background: 

Goals of Atlas: 

The stated goals of Atlas are, among other things, to: 

* enhance workforce productivity,
* strengthen integrity, security, and privacy of information and data 
assets, and: 

* promote information sharing and collaboration. 

Background: 

Atlas Projects: 

The fiscal year 2004 expenditure plan states that Atlas consists of 
seven interrelated projects, which are briefly described below. 

Project: Common Computing Environment; 
Description: 
- Acquire and deploy a common e-mail application (MS Exchange) to 
replace multiple and disparate e-mail applications currently in use 
across ICE organizations. 

- Implement hardware and software (i.e., Active Directory) that enables 
the common e-mail application to operate on multiple local area 
networks. 

- Install new desktop computers. 

Project: Integration (Connectivity); 
Description: 
- Connect new bureau organizations (e.g., Federal Protective Service, 
Federal Air Marshal Service) to ICE's communications network to, among 
other things, provide investigators and other staff quicker access to 
information used to accomplish mission duties. 

-Identify a solution for optimizing the integration and performance of 
these connections and develop a plan to implement it. 

Project: Electronic Access and E-Government; 
Description: 
- According to the program manager, Electronic Access and E-Government 
has recently been merged with the Enterprise Information project, which 
is described on the next slide. 

Project: Enterprise information; 
Description: 
- Develop and prototype an approach to integrate systems and 
information across ICE, including developing a central data repository 
with the capabilities to access, navigate, and search information 
across multiple sources (referred to as Enterprise Query) and share 
information across existing systems on a real time basis (referred to 
as Enterprise Interoperability). 

- Establish infrastructure to support implementation of Web-based 
applications (i.e., electronic government). 

Project: Information Assurance; 
Description: 
- Strengthen security of ICE's information, network, and systems by 
expanding the capabilities of the bureau's Security Operations Center 
in the following areas: audit log management, intrusion detection, 
firewall management, cryptographic services, computer forensics, 
vulnerability scanning, and penetration testing. 

Project: Infrastructure Engineering; 
Description: 
- Provide engineering facilities (e.g., interoperability laboratory) 
and automated tools and procedures to manage and operate ICE 's IT 
infrastructure and evaluate and test new technologies before deploying 
them in the operational environment. 

Project: Transformation planning; 
Description: 
- Implement program management structures, policies, and processes to 
stand up the program office. 

- Provide adequate program office staffing. 

- Centralize and streamline procurement planning and procedures to 
enable more efficient purchasing of hardware and software products and 
services. 

- Manage and oversee Atlas projects and contractors, including 
developing tools to help in these endeavors. 

- Ensure compliance with DHS's enterprise architecture. 

- Monitor adherence to cost, schedule, and performance goals. 

Source: DHS data. 

[End of table] 

Background: 

Atlas Funding: 

Since fiscal year 2002, Atlas has been provided $143.17 million in 
appropriated funds. 

* $39.1 million from INS counterterrorism funding in fiscal year 2002. 
[NOTE 8] 

* $24.47 million from INS investment and operations and maintenance 
funding in fiscal year 2003. 

* $40 million from DHS appropriations in fiscal year 2004, [NOTE 9] of 
which $30.2 million was reprogrammed by DHS to cover other ICE 
priorities, leaving $9.8 million. 

* $39.6 million from DHS appropriations in fiscal year 2005. [NOTE 10] 

[NOTE 8] Counterterrorism funding came from the Department of Defense 
and Emergency Supplemental Appropriations for Recovery from and 
Response to Terrorist Attacks on the United States Act, 2002. Pub. L. 
No. 107-117 (Jan. 10, 2002); H.R. Report 107-350 (Dec. 19, 2001). 

[NOTE 9] Pub.L. No. 108-90 (Oct. 1, 2003). 

[NOTE 10] Pub.L. No. 108-334 (Oct. 18, 2004). 

Background: 

Atlas Expenditures: 

As shown in the table below, ICE reports that it has obligated $63.5211 
million in fiscal years 2002 and 2003 appropriated funds on various 
Atlas projects. 

[See PDF for image]

Source: DHS data. 

[End of table] 

[11] According to the program manager, of the $63.57 million that 
Congress appropriated in fiscal years 2002 and 2003, $63.52 million was 
obligated to Atlas projects and the remainder .05 million was 
reprogrammed to other ICE priorities. 

Background: 

Planned Use of Fiscal Year 2004 Funding: 

According to the fiscal year 2004 expenditure plan, the $9.8 million 
will be spent on five projects that are immediate needs of the program. 

[See PDF for image] 

Source: DHS data. 

[End of table] 

[NOTE 12] According to the program manager, the project Electronic 
Access and E-Government was recently merged with Enterprise 
Information. 

Objective 1 Results: 

Legislative Conditions: 

The Atlas expenditure plan satisfies each of the legislative 
conditions. 

Condition 1 Satisfied. The expenditure plan, including related program 
documentation and statements from the program manager, either satisfies 
or provides for satisfying the capital planning and investment control 
review requirements established by OMB, including Circular A-11, part 
3, [NOTE 13] which establishes policy for planning, budgeting, 
acquisition, and management of federal capital assets. 

Examples of our analysis are in the following table. As the table 
shows, not all OMB requirements have been satisfied, but oral 
commitments have been made for doing so. Given that ICE has reportedly 
already invested $63.52 million on Atlas projects and plans to invest 
another $9.8 million this year, it is important for ICE to follow 
through on these commitments. 

Examples of OMB Circular A-11 requirements: Indicate whether the 
investment was approved by an investment review committee; 
Results of our findings: The plan was approved on November 16, 2004, by 
the ICE IRB chair and on January 12, 2005, by the chief information 
officer, who chairs the DHS Enterprise Architecture Board. 

Examples of OMB Circular A-11 requirements: Provide justification and 
describe acquisition strategy; 
Results of our findings: The plan and supporting documentation justify 
the program on the basis of current capability deficiencies and mission 
needs. However, neither includes an analysis of costs and benefits or 
return on investment. These documents also provide some aspects of a 
high-level acquisition strategy, such as identifying the five contracts 
that have been, and are to be used to acquire hardware and software 
products and program support services. The program manager stated that 
a current cost-benefit analysis and a more detailed acquisition 
strategy will be developed once expenditure plan funds become 
available. 

Examples of OMB Circular A-11 requirements: Summarize life cycle costs 
and cost-benefit analysis, including the return on investment; 
Results of our findings: The program does not have a current life-cycle 
cost estimate nor a current cost-benefit analysis showing return on 
investment. Program officials stated they intend to revise and update 
by September 2005 Atlas’s cost-benefit and other analyses (dated 2002). 
However, the officials did not have documentation defining how this was 
to be accomplished. The program manager stated that a current cost and 
benefit analysis will be developed once expenditure plan funds become 
available. [NOTE 14] 

Examples of OMB Circular A-11 requirements: Provide performance goals 
and measures; 
Results of our findings: The plan and supporting documentation identify 
one preliminary performance metric for each of Atlas’s planned 
projects. According to the program manager, these are the program’s 
initial performance measures and additional measures, linked to program 
goals, will be developed once expenditure plan funds become available. 
Performance goals and measures were not used to track the $63 million 
invested in Atlas during fiscal years 2002 and 2003. [NOTE 14] 

Examples of OMB Circular A-11 requirements: Address security and 
privacy; 
Results of our findings: The plan and supporting documentation state 
the importance of security and privacy and provide high-level 
information on intended security measures, including one proposed 
project—Information Assurance—that is intended to implement a 
bureauwide security program. In addition, ICE has a December 2003 
bureau-wide security plan. However, plans for the Information Assurance 
project have not been developed, and the expenditure plan does not 
allocate any fiscal year 2004 funding to the project. Further, ICE’s 
December 2003 bureauwide security plan does not mention Atlas or the 
Information Assurance project. Moreover, ICE has not developed an Atlas 
privacy impact assessment. According to the program manager, ICE 
intends to update the security plan and prepare a privacy impact 
assessment, but existing plans do not provide for how and when this 
will be accomplished. 

Examples of OMB Circular A-11 requirements: Provide risk inventory and 
assessment; 
Results of our findings: Assessments performed on risks were via ad hoc 
meetings. A draft risk management plan was developed from these 
meetings and the plan contains an inventory of risks. It does not, 
however, identify, among other things, how the risks will be monitored. 
The Atlas program manager stated that the program office is in the 
process of developing more effective risk management and oversight 
processes and intends to add a risk analyst position when Atlas funding 
is received. 

[End of table]

Condition 2 Satisfied. The plan, including related program 
documentation and DHS officials' statements, either satisfies or 
provides for satisfying the condition that the department ensure Atlas 
is compliant with DHS's enterprise architecture (EA). 

An EA provides a clear and comprehensive picture of an organization's 
operations and its supporting systems and infrastructure. It is an 
essential tool for effectively and efficiently engineering business 
processes and for implementing and evolving supporting systems in a 
manner that maximizes interoperability, minimizes overlap and 
duplication, and optimizes performance. We have worked with the 
Congress, OMB, and the federal Chief Information Officers Council to 
highlight the importance of architectures for both organizational 
transformation and IT management. An important element of EA management 
is ensuring that IT investments are compliant with EA, including basing 
such assessments on documented analysis. 

On August 6, 2004, we reported on version 1.0 of DHS's EA, stating that 
DHS's initial EA provides a partial foundation but was missing key 
elements expected to be found in a well-defined architecture. [NOTE 15] 
DHS has since developed version 2.0 of its EA. We have not reviewed 
this version of DHS's EA. 

DHS's Enterprise Architecture Board and Enterprise Architecture Center 
of Excellence [NOTE 16] are responsible for determining whether 
programs comply with the EA. On December 8, 2004, Atlas's program 
manager requested the center to assess the program's compliance with 
the EA. On January 10, 2005, the center reported the results of its 
assessment to the board, stating that Atlas was in compliance. On 
January 12, 2005, the board approved this compliance determination. 

The center based its determination on documentation submitted by the 
program manager and discussions among center staff, including officials 
from DHS's Infrastructure Transformation Office and IT Security Office. 
However, the determination was not based on documented analysis mapping 
Atlas's infrastructure architecture to the EA. Such analysis is 
necessary to make informed alignment determinations. According to the 
center's chair, who also serves as DHS's chief architect, because Atlas 
is in the early stages of its life-cycle and therefore is not very well 
defined, such an analysis was not required, and when Atlas is more 
defined, a thorough and documented analysis will be performed. 

Given the critical role that Atlas is to play in contributing to DHS's 
strategic information sharing and interoperability goals, it is 
important for ICE and DHS to follow through on the stated provision to 
base future Atlas compliance determinations on documented and 
verifiable analysis. 

Condition 3 Satisfied. The plan, including related program 
documentation and statements from the Atlas program manager, either 
satisfies or provides for satisfying the condition to comply with the 
acquisition rules, requirements, guidelines, and systems acquisition 
management practices of the federal government. These practices provide 
a management framework based on the use of rigorous and disciplined 
processes for planning, managing, and controlling the acquisition of IT 
resources, including: 

* acquisition planning, which ensures, among other things, that 
reasonable plans, milestones, and schedules are developed and that all 
aspects of the acquisition effort are included in these plans;

* solicitation, which involves making sure that a request for proposal 
that delineates a project's requirements is prepared and, consistent 
with relevant solicitation laws and regulations, that a contractor is 
selected that can most cost-effectively satisfy these requirements;

* requirements development and management, which includes establishing 
and maintaining a common and unambiguous definition of requirements 
among the acquisition team, the system users, and the development 
contractor;

* project management, provides for management of the activities within 
the project office and supporting contractors to ensure a timely, 
efficient, and cost-effective acquisition;

* contract tracking and oversight, which ensures that the development 
contractor performs according to the terms of the contract; needed 
contract changes are identified, negotiated, and incorporated into the 
contract; and contractor performance issues are identified early, when 
they are easier to address; and: 

* evaluation, which determines whether the acquired products and 
services satisfy contract requirements before acceptance. 

These acquisition management processes are also embodied in published 
best practices models, such as the Software Engineering Institute 
(SEI)'s Software Acquisition Capability Maturity Model®. [NOTE 17] 
Examples of our analysis of ICE performance of these processes and 
practices are shown on the following table. They show that not all 
aspects of the processes and practices have been implemented, but that 
oral commitments have been made for doing so. Given that ICE has 
already invested $63.52 million on Atlas projects and plans to invest 
another $9.8 million this year, it is important for ICE to follow 
through on these commitments. 

Examples of practices: Acquisition planning; [NOTE 18] 
Ensures that reasonable planning for the acquisition is conducted 
including, among other things, developing an acquisition strategy and 
plan, determining the cost and schedule, and identifying risks, and 
defining requirements. 
Results of our analysis: 
The expenditure plan and supporting documents (e.g., the fiscal year 
2005 Atlas budget submission to OMB known as an Exhibit 300) provide 
aspects of a high-level acquisition strategy, such as identifying the 
five contracts that have been, and are to be used, to acquire products 
and program support services. According to the program manager, a 
detailed acquisition strategy will be developed when expenditure plan 
funds become available and current program life cycle cost and schedule 
estimates will be developed by September 2005. A draft risk management 
plan for the program has been developed that contains an inventory of 
risks, and according to the fiscal year 2004 expenditure plan and the 
Atlas program manager, the program will follow the bureau's 2002 System 
Development Life Cycle, which we have previously reported addresses key 
system acquisition planning and requirements definition activities. 
[NOTE 19] 

Examples of practices: Project management; [NOTE 20] 
Provides for the management of activities within the project office and 
supporting contractors to ensure a timely, efficient, and cost-
effective acquisition. 
Results of our analysis: 
ICE has begun to establish a program office with responsibility for 
managing the acquisition, deployment, operation, and sustainment of 
Atlas. However, current staffing consists of a program manager and 
three contractor support staff, leaving key program office positions 
not staffed (e.g., project managers, EA analyst, business analyst, risk 
analyst). The expenditure plan states that the program office will 
comply with the bureau's 2002 System Development Life Cycle, which 
includes activities to promote a timely, efficient, and cost-effective 
acquisition, such as implementing key acquisition management processes 
advocated by Software Engineering Institute's acquisition model, and 
monitoring progress through monthly reports on project cost, schedule, 
and performance. 

Condition 4 Satisfied. DHS and OMB satisfied the legislative condition 
requiring that the plan be reviewed and approved by the ICE IRB, DHS, 
and OMB. 

The ICE IRB chair approved the fiscal year 2004 expenditure plan on 
November 16, 2004. 

The DHS chief information officer, who also chairs the Enterprise 
Architecture Board, approved the plan on January 12, 2005. 

OMB approved the plan on January 4, 2005. 

Condition 5 Satisfied. GAO satisfied the condition that it review the 
plan. 

Our review was completed on May 5, 2005. 

[NOTE 13] Capital investment and control requirements are now found in 
OMB Circular A-11, part 7, rather than part 3. 

[NOTE 14] These areas are more fully discussed in the observation 
sections of the briefing. 

[NOTE 15] GAO, Homeland Security. Efforts Under Way to Develop 
Enterprise Architecture, but Much Work Remains, GAO-04-777 (Washington, 
D.C.: August 6, 2004). 

[NOTE 16] A review group made of subject manner experts that recommends 
EA compliance to the DHS Enterprise Architecture Board and ultimately 
to the DHS IRB. 

[NOTE 17] Developed by Carnegie Mellon Software Engineering Institute 
(SEI), Software Acquisition Capability Maturity Model (SA-CMM®), 
Version 1.03 (March 2002). 

[NOTE 18] For example see, Carnegie Mellon Software Engineering 
Institute, Software Acquisition Capability Maturity Model (SA-CMM®), 
Version 1.03 (March 2002). 

[NOTE 19] For example see, GAO, Information Technology. Homeland 
Security Needs to Improve Entry Exit System Expenditure Planning, GAO-
03-563 (Washington, D.C.: June 9, 2003). 

[NOTE 20] For example see, Carnegie Mellon Software Engineering 
Institute, Software Acquisition Capability Maturity Model (SA-CMM®), 
Version 1.03 (March 2002). 

Objective 2 Results: 

Observations: Economic Justification: 

Observation 1: Economic justification does not reflect recent and 
planned changes in the program's scope and purpose. 

Cost-benefit analyses are essential tools for making informed program 
investment selection and control decisions and for establishing the 
return on investment benchmark against which to measure whether 
investments are delivering intended business value. Accordingly, the 
Clinger-Cohen Act, OMB guidance, [NOTE 21] and investment management 
best practices recognize the importance of having reliable and current 
cost- benefit analyses. 

INS developed an analysis of Atlas's costs and benefits in 2002. The 
analysis estimated that the program would cost about $800 million to 
implement over a 6-year period and would provide benefits of 
approximately $1.1 billion dollars, primarily through better system 
response times and reduced operations and maintenance costs, as shown 
in the following figure. 

Objective 2 Results: 

Observations: Economic Justification: 

Sources of Atlas program benefits: 

Enhanced help desk operations: 3%: 
Improved reliability: 5%: 
Reduced operations/maintenance costs: 43%; 
Better response time: 49%. 

Source: DHS. 

[End of figure] 

As we have previously reported, [NOTE 22] it is important for cost-
benefit analyses to be updated to reflect material changes to a 
program's scope, purpose, cost, timeframes, etc., so that agency 
officials will have a reliable basis for program investment decisions. 

Since ICE became responsible for Atlas in 2003, the bureau has 
materially changed the program's scope, purpose, and priorities. 
Specifically, Atlas was expanded to: 

* support additional law enforcement units (and their business 
requirements) that were merged into ICE (e.g., Federal Air Marshals 
Service, Federal Protective Service, Customs investigations, Customs 
intelligence); and: 

* provide the flexibility to support new ICE priorities (e.g., 
integrating future anti-terrorism programs and projects, facilitating 
information sharing with domestic and international law enforcement 
organizations). 

In addition, the program manager said that the program is to include 
efforts to streamline and reengineer core business functions with the 
application of information technology. According to this official, 
details of these efforts are to be defined in the fiscal year 2005 
Atlas expenditure plan. 

According to the Atlas program manager, the cost benefit analysis has 
not yet been revised to reflect changes to the program's scope and 
purpose because doing so has not been a priority. According to the 
fiscal year 2004 expenditure plan, revising the analysis is a "next 
step" to be taken. However, existing plans do not identify a date for 
doing so. The program manager stated that a current cost-benefit 
analysis will be developed once funds provided for in the expenditure 
plan become available. He also stated that the goal is to have a 
contractor complete an updated cost benefit analysis on or about 
September 30, 2005. 

Until the cost benefit analysis is revised to reflect recent and 
planned changes to the program, DHS will not have a reliable basis for 
making informed Atlas investment decisions. 

[NOTE 21] Clinger-Cohen Act of 1996, 40 U.S.C. 11101-11704; and Office 
of Management and Budget (OMB) Circular A-130, Management of Federal 
Information Resources (November 30, 2000). 

[NOTE 22] For example, see GAO, Information Technology. Greater Use of 
Best Practices Can Reduce Risks in Acquiring Defense Health Care 
System, GAO-02-345 (Washington, D.C.: September 26, 2002). 

Objective 2 Results: 

Observations: Program Management Controls and Capabilities: 

Observation 2: Program management controls and capabilities have yet to 
be established. 

As we have previously reported, [NOTE 23] the success of major 
modernization programs such as Atlas depends on having an operational 
program office that has, among other things, effectively implemented 
rigorous and disciplined program management process controls and 
adequately filled key human capital positions. Two activities key to 
strategically managing human capital are performing staffing needs 
assessments and defining staff roles and responsibilities. 

The SEI's Software Acquisition Capability Maturity Model (SA-CMM®)[NOTE 
24] has defined a suite of key acquisition process areas that are 
necessary to manage the system acquisition program in a rigorous and 
disciplined fashion. As described earlier in the briefing, these 
process areas include: 

* acquisition planning, 
* solicitation, 
* requirements development and management, 
* project management,
* contract tracking and oversight, and 
* evaluation. 

ICE has begun to establish an Atlas program office. For example, the 
bureau has drafted a management structure and plan, which includes 
staff roles and responsibilities. However, the structure and plan are 
currently being reviewed by ICE management and the program office is 
not yet operational. Moreover, while key acquisition management 
processes have been defined in the System Development Life Cycle 
methodology, which our previous work [NOTE 25] has shown adequately 
defines the critical management processes needed to successfully 
acquire systems, the program office has yet to implement these 
processes. 

In addition, the program office is not adequately staffed. [NOTE 26] 
Currently, the office has staffed the program manager position and it 
has three contracting staff performing such functions as developing 
staffing needs assessments and other program management related 
activities. Further, while the program manager recently assessed 
staffing needs for program support positions (e.g., financial 
management, contracting, EA), he has not yet determined the staffing 
needs for five Atlas projects. Specifically, the program manager 
recently asked, and the project managers provided estimates of, 
staffing needed, but these estimates were not based on an estimating 
methodology or staffing needs assessment. Instead, the project managers 
provided estimates of the staff that could be obtained given the 
funding provided in the plan. Moreover, of the seven program support 
positions that the program has determined it needs, none have been 
filled. (The figure on the next slide shows the proposed office 
structure, along with the organizational areas where staffing needs 
have and have not been assessed, and where staffing needs have and have 
not been filled.) 

Proposed Program Management Office: 

[See PDF for image] 

Source: GAO analysis of DHS data. 

Image contains footnotes 27-29. 

[End of figure] 

The program manager attributes the state of the program office, 
including controls and capabilities, to competing DHS priorities. He 
stated that ICE plans to strengthen program management controls and 
capabilities once funds provided for in the expenditure plan are 
available. In particular, he cited two projects (Transformation 
Planning and Infrastructure Engineering) in the expenditure plan that 
have this goal. However, existing program documentation does not 
describe how and when these projects are to achieve this goal. 
Moreover, it should be noted that of the $63.52 million obligated for 
Atlas in fiscal years 2002 and 2003, $900,000 (or about 1.4 percent of 
the total) was obligated for these two projects. While the current 
expenditure plan proposes investing $2.17 of the $9.8 million on these 
two projects, this still represents but 4 percent of the $73.37 million 
Atlas funding to date going to improving program management. By 
contrast, our work on other IT modernization programs, such as US- 
VISIT, shows that roughly 19 percent was invested in program 
management. 

Until the above program management controls and capabilities are in 
place and functioning, ICE faces the increased likelihood that Atlas 
will not meet its objectives on schedule and within budget. 

[NOTE 23] For example, see GAO, Information Technology. Homeland 
Security Needs to Improve Entry Exit System Expenditure Planning, GAO-
03-563 (Washington, D.C.: June 9, 2003). 

[NOTE 24] Carnegie Mellon Software Engineering Institute, Software 
Acquisition Capability Maturity Model (SA-CMM®), Version 1.03 (March 
2002). 

[NOTE 25] For example, see GAO, Information Technology. Homeland 
Security Needs to Improve Entry Exit System Expenditure Planning, GAO-
03-563 (Washington, D.C.: June 9, 2003). 

[NOTE 26] According to the program manager, Atlas staff were 
transferred to the US-Visitor and Immigrant Status Indicator Technology 
program in 2003, which is managed by the DHS Under Secretary for Border 
and Transportation Security. 

[NOTE 27] Government full-time employees. 

[NOTE 28] Contracting full-time employees. 

[NOTE 29] According to the program manager, the staff for the 
Transformation Planning project also serve as the staff for the program 
office. 

GAO Objective 2 Results: 

Observations: Performance Goals and Measures: 

Observation 3: Program goals, expected benefits, and reported 
achievements are not fully aligned. 

The Clinger-Cohen Act [NOTE 30] requires the use of effective IT 
management practices, including measuring the contributions of IT 
investments to achieving agency mission outcomes. To this end, OMB 
states [NOTE 31] that agencies should, among other things: 

* establish program performance goals and expected benefits,
* develop outcome-based measures to assess actual program performance 
(i.e., achievements) against expected benefits, and: 

* ensure that goals, expected benefits, and achievements are properly 
aligned. 

The Atlas expenditure plan and documentation show that the program has 
defined goals and expected benefits and has reported actual 
achievements accomplished during 2002 and 2003. The stated goals 
include: 

* enhancing productivity, and: 
* assuring integrity, security, and privacy of information and data 
assets, and promoting information sharing and collaboration. 

The stated benefits include: 

* better response time, 
* reduced operations/maintenance costs,
* improved reliability, and: 
* enhanced help desk operations. 

In addition, examples of stated achievements are: 

* purchased Active Directory hardware and software for the e-mail 
system,
* initiated an interim Security Operations Center, and: 

* developed a data encryption approach for the network. 

However, the relationships among goals, benefits, and achievements have 
not been defined, and are not otherwise apparent in all cases. For 
example, it is not clear how the following reported achievements relate 
to Atlas goals. 

* improving the capacity of the network,
* implementing tools to monitor network performance, and: 

* completing an Enterprise Information Concept of Operations document. 
Moreover, the reported achievements are not expressed in terms of 
measurable outcomes or results, but rather as activities completed. 

The program manager stated that the 2002 and 2003 achievements were not 
analyzed and aligned to program goals and benefits and outcome-based 
measures were not developed because the emphasis at the time was on 
buying and deploying long-overdue infrastructure upgrades as quickly as 
possible. However, he also stated that the program intends to define, 
ensure, and disclose the linkage among program goals, benefits, and 
results in the future. To this end, the program manager stated that one 
performance measure for each project has been defined as a starting 
point and that other outcome-based performance measures will be defined 
and used to assess program progress. However, existing program plans 
and documentation do not specify how and when this will be done. 

The program manager also told us that the state of Atlas's performance 
practices are due to competing DHS priorities limiting the resources 
that have been devoted to the program. Until the program aligns its 
goals, benefits, and performance measures, it will not have the 
necessary means for measuring progress, ensuring accountability, and 
making well-informed investment decisions. 

[NOTE 30] Clinger-Cohen Act of 1996, Public Law 104-106; and Office of 
Management and Budget (OMB) Circular A-130, Management of Federal 
Information Resources (November 30, 2000). 

[NOTE 31] OMB Circular No. A-11, Part 7 (revised July 2004). 

Objective 2 Results: 

Observations: Expenditure Plan Lacks Detail: 

Observation 4: Fiscal year 2004 expenditure plan does not provide 
sufficient information on program commitments to permit effective 
congressional oversight. 

As we have previously reported, [NOTE 32] the legislative requirement 
to submit expenditure plans for major IT modernization programs, like 
Atlas, to the Appropriations Committees is intended to provide 
lawmakers with a sufficient understanding of the programs to permit 
informed decision- making about the use of the appropriated funds and 
provide a mechanism for holding the agency accountable for results. Our 
prior experience in working with Congress and other agencies on 
developing and implementing expenditure plans shows that these plans 
need to disclose a sufficient level and scope of information for 
Congress to understand what the system capabilities and benefits are to 
be delivered, by when, at what cost, and what progress is being made 
against the commitments. 

The Atlas expenditure plan does not show the level of detail and scope 
of the program for Congress to understand its plans and commitments 
relative to system capabilities, cost, benefits, and schedule. Further, 
it does not sufficiently describe progress made against program 
commitments (e.g., expected benefits). 

Instead, the expenditure plan and supporting documentation describe, 
for example, high-level system capabilities to be delivered under each 
project, planned expenditure aggregated by project (not linked to 
system capabilities). It does not link planned expenditures to system 
capabilities, set milestones for delivery of system capabilities, or 
discuss benefits to be realized as a result of planned system 
investments. 

According to the Atlas program manager, the state of the plan reflects 
the program's uncertainty about the appropriate level of detail in 
expenditure plans. This official also stated that future plans will 
reflect GAO's published work on the content of program expenditure 
plans. If it does not, the Congress will not have essential information 
needed to make informed decisions about expenditure plan approval and 
to oversee progress. 

[NOTE 32] For example, see GAO, Information Technology. Homeland 
Security Needs to Improve Entry Exit System Expenditure Planning, GAO-
03-563 (Washington, D.C.: June 9, 2003). 

Conclusions: 

The fiscal year 2004 Atlas expenditure plan, in combination with 
related program documentation and program officials' statements, 
satisfies the legislative conditions set forth by Congress. However, 
this satisfaction is based on plans and commitments that provide for 
meeting these conditions, rather than on completed actions to satisfy 
the conditions. As such, much remains to be accomplished before Atlas 
planning and management efforts can be considered effective and thereby 
minimize the risks associated with the program's capacity to deliver 
promised IT infrastructure capabilities and benefits on time and within 
budget. 

The current state of planning and management puts the program at risk. 
While this is partially due to events beyond the program's control, 
such as the department's decision to reprogram Atlas funding and to 
redeploy Atlas staff to competing DHS priorities, as well as changes to 
the program's scope and purpose when it transitioned from INS to ICE, 
it is also due to the program's decision to not use fiscal year 2002 
and 2003 funds to invest in program management capabilities. 

Given that more than $60 million has been reportedly obligated to date 
on the program, resources have been available to strengthen planning 
and management capabilities in key areas, but investment in these areas 
has been deferred. Deferral of establishing such program planning and 
management controls and capabilities, such as having reliable and 
current economic justification for the program, a capable program 
office, and clearly aligned program goals, benefits, and performance 
measures, introduce unnecessary risk to the program. 

Moreover, not providing congressional decision-makers with the 
information that they need about program commitments to be met with the 
expenditure plan funds, including the benefits to be produced, the 
capabilities to be delivered, and the cost and schedule estimates to be 
met, impedes congressional oversight. 

Recommendations for Executive Action: 

To minimize risks to the Atlas program, we recommend that the Secretary 
of Homeland Security, through the Under Secretary for Border and 
Transportation Security, direct the Assistant Secretary for Immigration 
and Customs Enforcement to ensure that ICE follows through on 
commitments to implement effective management controls and capabilities 
by: 

* Revising and updating the cost-benefit analysis to identify current 
mission requirements, how they will be met, and an estimate of the 
program's incremental and life-cycle costs, benefit, schedule, and 
return on investment. This should also include establishing plans, 
associated tasks, and milestones for accomplishing this effort. 

* Making the Atlas program office operational by (1) developing a 
staffing needs assessment to determine the positions and the level of 
staffing needed for all projects to adequately manage the program, 
including a human capital strategy for acquiring the staff and a 
timetable for bringing them on board; (2) finalizing the roles and 
responsibilities for the positions identified in the staffing 
assessment and for the projects; and (3) implementing and 
institutionalizing key acquisition management controls, including risk 
management processes where relevant responsibilities are assigned and 
key risks and their status are reported to an executive body. 

Recommendations for Executive Action: 

* Developing and implementing an updated Atlas security plan and 
privacy impact assessment. This should also include establishing plans, 
associated tasks, and milestones for accomplishing this effort. 

* Developing and implementing rigorous performance management practices 
for the Atlas program that include properly aligned goals, benefits, 
and achievements, and anticipated achievements that are defined in 
measurable terms. This should also include establishing plans, 
associated tasks, and milestones for accomplishing this effort. 

* Ensuring that future expenditure plans fully disclose the system 
capabilities, schedule, cost-benefits to be delivered, as well as the 
acquisition strategy for Atlas. 

Agency Comments: 

In providing oral comments on a draft of this briefing, ICE's chief 
information officer and the Atlas program manager agreed with our 
findings and conclusions and stated that our recommendations were 
reasonable. They also provided technical comments, which we 
incorporated in the briefing as appropriate. 

Attachment I: Scope and Methodology: 

To accomplish our objectives, we: 

* analyzed the fiscal year 2004 Atlas expenditure plan and supporting 
documents against legislative conditions and other relevant federal 
requirements, guidance, and best practices to determine whether the 
conditions were met, and in doing so, considered the conditions met 
when the expenditure plan, including supporting program documentation 
and program officials' representations, either satisfied or provided 
for satisfying the conditions, and: 

* assessed supporting documentation and interviewed program and other 
involved ICE and DHS officials to determine capabilities in key program 
management areas, such as: 

- acquisition planning,
- enterprise architecture,
- project management,
- human capital planning, and: 

- risk management. 

For DHS data that we did not substantiate, we have made appropriate 
attribution indicating that data's source. 

We conducted our work at ICE and DHS headquarters in Washington, D.C. 
from March 2005 through May 2005 in accordance with generally accepted 
government auditing standards. 

[End of slide presentation] 

[End of section]

Appendix II: Comments from the U.S. Department of Homeland Security: 

U.S. Department of Homeland Security: 
Washington, DC 20528: 

August 18, 2005: 

Mr. Randolph C. Hite:
Director, Information Technology Architecture and System Issues: 
U.S. Government Accountability Office:
Washington, DC 20548: 

The Department of Homeland Security (DHS) appreciates the opportunity 
to review and comment on the Government Accountability Office's (GAO) 
draft report GAO-05-805 entitled, "INFORMATION TECHNOLOGY: Management 
Improvements Needed in Immigration and Customs Enforcement's 
Infrastructure Modernization Program". The Department concurs with all 
recommendations for executive action contained in the report. 

To minimize risks to the Atlas program, GAO made the following 
recommendations to ensure Immigration and Customs Enforcement (ICE) 
follows through on commitments to implement effective management 
controls and capabilities. 

It should also be noted that with the recent release of expenditure 
authority for the ATLAS FY04 funds, ICE is now better positioned to 
aggressively address the concerns identified in the GAO Draft Report. 
Some of the immediate steps already taken are described below. 

GAO Recommendation 1: Revising and updating the cost-benefit analysis, 
to identify current mission requirements, how they will be met, and an 
estimate of the program's incremental and life cycle costs, benefit, 
schedule and return on investment. This should also include 
establishing plans, associated tasks and milestones for accomplishing 
this effort. 

Response: An Atlas Preliminary Business Case was completed on June 21, 
2005. It reflects a high-level statement of the planned functionality 
and environment established by Atlas. The Atlas Comprehensive Business 
Case is being developed and is scheduled for completion by September 
30, 2005. The Atlas Comprehensive Business Case will include a detailed 
cost benefit analysis, operations and maintenance costs for all six 
Atlas projects. 

GAO Recommendation 2: Making the Atlas Program office operational by 
(1) developing a staffing needs assessment to determine the positions 
and the level of staffing needed for all projects to adequately manage 
the program, including a human capital strategy for acquiring the staff 
and a timetable for bringing them on board; (2) finalizing the roles 
and responsibilities for the positions identified in the staffing 
assessment and for the projects; and (3) implementing and 
institutionalizing key acquisition management controls, including risk 
management processes where relevant responsibilities are assigned and 
key risks and their status are reported to an executive body. 

Response: The Atlas Program Management Office (PMO) has been 
established and full project staffing for the Atlas PMO has been 
initiated. A draft organizational assessment for the Atlas PMO is 
complete and undergoing review by ICE management. The draft 
organizational assessment includes a detailed description of functional 
roles and responsibilities for each Atlas PMO position. A comprehensive 
Atlas staffing plan will be completed by September 30, 2005. Full 
project staffing for the Atlas PMO will begin immediately. 

Atlas acquisition strategies are reflected in the FY 2005 Atlas 
Expenditure Plan, currently undergoing formal DHS management review. 
The required Atlas Program Management Plan, Atlas Risk Management Plan, 
Atlas Acquisition Plan, and Atlas Acquisition Program Baseline are 
scheduled for completion by October 31, 2005. 

GAO Recommendation 3: Developing and implementing an updated atlas 
security plan and privacy impact assessment. This should also include 
establishing plans, associated tasks and milestones for accomplishing 
this effort. 

Response: A Systems Security Plan, and Systems Security Test Plan, are 
being developed and will be completed by December 31, 2005. The Atlas 
Privacy Impact Assessment was submitted to the DHS Privacy Office on 
August 2, 2005 for review. 

GAO Recommendation 4: Developing and implementing rigorous performance 
management practices for the Atlas program that include properly 
aligned goals, benefits and achievements, and anticipated achievements 
that are defined in measurable terms. This should also include 
establishing plans, associated tasks and milestones for accomplishing 
this effort. 

Response: The FY 2005 Atlas Expenditure Plan includes a section 
containing outcome measures and an appendix containing proposed Atlas 
performance measures. ICE submitted the proposed Atlas performance 
measures to the Office of Management and Budget (OMB) on July 13, 2005, 
with its PART review. 

The Atlas PMO is in the process of developing policies and procedures 
to track these performance measures, and acquiring project management 
tools to be used to support tracking program/project costs, schedules, 
and performance. 

GAO Recommendation 5: Ensuring that future expenditure plans fully 
disclose the system capabilities, schedule, cost and benefits to be 
delivered, as well as the acquisition strategy for Atlas. 

Response: The FY 2005 Atlas Expenditure Plan, currently being reviewed 
by DHS management, is a 74-page document consisting of an Executive 
Summary, six sections and six appendices, and addresses planned 
outcomes for each project, including system capabilities, project 
schedule, costs, planned budget obligations and Atlas program benefits. 
The FY 2005 Atlas Expenditure Plan also outlines acquisition 
strategies. Future Atlas Expenditure Plans will be further improved 
based upon lessons learned. 

We thank you for the opportunity to provide comments on this draft 
report and look forward to working with you on future homeland security 
issues. 

Sincerely,
Signed by: 

Steven J. Pecinovsky: 
Director, Departmental GAO/OIG Liaison: 

[End of section]

Appendix III: GAO Contact and Staff Acknowledgments: 

GAO Contact: 

Randolph C. Hite, (202) 512-3439: 

Staff Acknowledgments: 

In addition to the individual named above, Gary Mountjoy, Assistant 
Director; Nancy Glover; James Houtz; and Tammi Nguyen made key 
contributions to this report. 

(310605): 

FOOTNOTES

[1] Pub. L. No. 108-90 (Oct. 1, 2003). 

[2] During fiscal year 2004, the Department of Homeland Security 
reprogrammed about $30.2 million of the $40 million to address other 
ICE priorities, thereby leaving $9.8 million for the program. 

[3] OMB Circular A-11 establishes policy for planning, budgeting, 
acquiring, and managing federal capital assets. Capital investment and 
control requirements are now found in OMB Circular A-11, part 7, rather 
than in part 3. 

[4] An enterprise architecture provides a clear and comprehensive 
picture of an organization's operations and its supporting systems and 
infrastructure. It is an essential tool for effectively and efficiently 
engineering business processes and for implementing and evolving 
supporting systems in a manner that maximizes interoperability, 
minimizes overlap and duplication, and optimizes performance. 

[5] The units include the Federal Air Marshals Service, Federal 
Protective Service, Customs investigations, and Customs intelligence. 

[6] According to the program manager, Atlas staffs were transferred to 
the US-Visitor and Immigrant Status Indicator Technology program in 
2003, which is managed by the DHS Under Secretary for Border and 
Transportation Security. 

GAO's Mission: 

The Government Accountability Office, the investigative arm of 
Congress, exists to support Congress in meeting its constitutional 
responsibilities and to help improve the performance and accountability 
of the federal government for the American people. GAO examines the use 
of public funds; evaluates federal programs and policies; and provides 
analyses, recommendations, and other assistance to help Congress make 
informed oversight, policy, and funding decisions. GAO's commitment to 
good government is reflected in its core values of accountability, 
integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through the Internet. GAO's Web site ( www.gao.gov ) contains 
abstracts and full-text files of current reports and testimony and an 
expanding archive of older products. The Web site features a search 
engine to help you locate documents using key words and phrases. You 
can print these documents in their entirety, including charts and other 
graphics. 

Each day, GAO issues a list of newly released reports, testimony, and 
correspondence. GAO posts this list, known as "Today's Reports," on its 
Web site daily. The list contains links to the full-text document 
files. To have GAO e-mail this list to you every afternoon, go to 
www.gao.gov and select "Subscribe to e-mail alerts" under the "Order 
GAO Products" heading. 

Order by Mail or Phone: 

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to: 

U.S. Government Accountability Office

441 G Street NW, Room LM

Washington, D.C. 20548: 

To order by Phone: 

Voice: (202) 512-6000: 

TDD: (202) 512-2537: 

Fax: (202) 512-6061: 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470: 

Public Affairs: 

Jeff Nelligan, managing director,
NelliganJ@gao.gov

(202) 512-4800

U.S. Government Accountability Office,
441 G Street NW, Room 7149

Washington, D.C. 20548: