Financial Management Systems: DHS’s Modernization Plans Should Fully Incorporate Key Practices
Fast Facts
The Department of Homeland Security is modernizing the financial management systems affecting many of its component agencies—including the Coast Guard, the Federal Emergency Management Agency, and Immigration and Customs Enforcement.
However, we found that the department’s cost and schedule estimates for these efforts weren’t always reliable. Additionally, DHS’s guidance and plans for modernizing these systems weren’t consistent. We recommended that DHS address these and other issues.
DHS’s IT and financial management are on our High Risk List. This report provides an update to our July 2024 evaluation of DHS's systems modernization.
Sign outside of a Department of Homeland Security office with the departmental seal and title.
Highlights
What GAO Found
The Department of Homeland Security (DHS) is modernizing its financial management systems for the U.S. Coast Guard, Federal Emergency Management Agency (FEMA), and U.S. Immigration and Customs Enforcement (ICE) through three financial systems modernization programs.
Reliable cost estimates and schedule assessments are essential to managing major system modernization efforts. GAO’s review of cost estimates for two of the system modernizations found that one substantially met all four characteristics of a reliable cost estimate; the other substantially met three of four characteristics.
Regarding schedule, GAO determined that two program schedules were unreliable. Without a reliable schedule estimate that follows best practices, DHS increases the risk that management will lack key information for making decisions about its programs, including the impact on future program costs.
DHS’s guidance and financial systems modernization plans varied in consistency with leading practices for data migration, organizational change management, and lessons learned.
Summary of GAO Assessment of DHS Guidance and Financial Systems Modernization Plans Against Leading Practices
|
Leading practice area |
GAO assessment of DHS and program office guidance |
GAO assessment of component planning documents |
|---|---|---|
|
Data migration |
Partially consistent |
Mostly consistent |
|
Organizational change management |
Consistent |
Mostly consistent |
|
Lessons learned process |
Mostly consistent |
–a |
Legend: Consistent = DHS provided evidence that sufficiently satisfied all relevant criterion; Mostly consistent = DHS provided evidence that sufficiently satisfied more than half of the relevant criterion; Partially consistent = DHS provided sufficient evidence that satisfied less than half of the relevant criterion; Not consistent = DHS did not provide sufficient evidence that satisfied the relevant criterion.
Source: GAO analysis of Department of Homeland Security (DHS) documentation. | GAO-26-107863
aFinancial systems modernization programs use guidance to help execute their lessons learned process and apply the lessons in future relevant documentation. Therefore, lessons learned planning documents are not expected.
DHS guidance used for financial systems modernization data migration is partially consistent with leading practices, while component planning documents were mostly consistent. Further, for organizational change management some component planning documents lacked details. For example, both Coast Guard and ICE plans incorporated steps to perform a readiness assessment, but neither included analysis of this assessment or metrics to measure change readiness.
By not fully incorporating leading practices in both guidance and component planning documentation, DHS increases the risk of data errors, time needed to resolve those errors, potential delays in achieving full operational capability, and limiting users’ ability to effectively operate the system.
Why GAO Did This Study
In 2003, GAO designated DHS as high risk. In 2023, GAO narrowed this high-risk area to focus on DHS’s IT and financial management. To address its financial management issues, DHS is executing a multiyear plan to implement new financial management systems through acquisition programs. In 2025, GAO reported that much work remains for DHS to complete these modernization efforts.
GAO was asked to review DHS’s modernization of financial management systems. This report addresses (1) the extent to which DHS ensured a reliable cost estimate and schedule assessment for two key major modernization efforts; (2) whether DHS’s plans and guidance are consistent with leading practices for data migration, organizational change management, and lessons learned; and (3) whether its plans and guidance describe how DHS used the Coast Guard’s implementation experience to inform plans for FEMA’s and ICE’s efforts.
Applying its previously issued guidance, GAO evaluated the cost estimates and schedule assessments for two major DHS system modernizations. GAO also identified applicable criteria and leading practices for data migration, organizational change management, and lessons learned. Using these criteria, GAO evaluated numerous guidance and planning documents. GAO also interviewed numerous DHS officials and Coast Guard, FEMA, and ICE officials.
Recommendations
GAO is making five recommendations, including that DHS develop reliable program schedule estimates for two programs and update guidance and planning documentation to be consistent with leading practices. DHS concurred with the recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Department of Homeland Security | The Secretary of Homeland Security should ensure that DHS's Under Secretary for Management works with the Joint Program Management Office to develop reliable FSM program schedule estimates for FSM-FEMA and FSM-Cube, using best practices defined in GAO's Schedule Assessment Guide to include the schedules being comprehensive, well-constructed, credible, and controlled. (Recommendation 1) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Department of Homeland Security | The Secretary of Homeland Security should ensure that DHS's Under Secretary for Management works with the Joint Program Management Office and relevant offices to update department-wide data migration guidance used for the DHS's FSM efforts to be consistent with data migration leading practices by incorporating planning for post-installation and operations planning. (Recommendation 2) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Department of Homeland Security | The Secretary of Homeland Security should ensure that DHS's Under Secretary for Management works with the Joint Program Management Office to update data migration planning documentation for its FSM-FEMA program to be consistent with data migration leading practices by improving planning for post-installation and operations planning. (Recommendation 3) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Department of Homeland Security | The Secretary of Homeland Security should ensure that DHS's Under Secretary for Management works with the Joint Program Management Office to verify that programs fully apply its guidance in FSM organizational change management plans. (Recommendation 4) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|
| Department of Homeland Security | The Secretary of Homeland Security should ensure that DHS's Under Secretary for Management works with the Joint Program Management Office and other relevant offices to update lessons learned guidance to be consistent with all leading practices by including steps to validate the applicability of lessons identified. (Recommendation 5) |
When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.
|