[House Hearing, 114 Congress]
[From the U.S. Government Publishing Office]


                  PROBING DHS'S BOTCHED MANAGEMENT OF 
                  THE HUMAN RESOURCES INFORMATION 
                      TECHNOLOGY PROGRAM

=======================================================================

                                HEARING

                               BEFORE THE

                            SUBCOMMITTEE ON
                             OVERSIGHT AND
                         MANAGEMENT EFFICIENCY

                                 OF THE

                     COMMITTEE ON HOMELAND SECURITY
                        HOUSE OF REPRESENTATIVES

                    ONE HUNDRED FOURTEENTH CONGRESS

                             SECOND SESSION

                               __________

                           FEBRUARY 25, 2016

                               __________

                           Serial No. 114-54

                               __________

       Printed for the use of the Committee on Homeland Security
                                     

[GRAPHIC NOT AVAILABLE IN TIFF FORMAT] 
                                     

      Available via the World Wide Web: http://www.gpo.gov/fdsys/

                               __________
                               
                               
                       U.S. GOVERNMENT PUBLISHING OFFICE
21-526 PDF                     WASHINGTON : 2016                       
________________________________________________________________________________________
For sale by the Superintendent of Documents, U.S. Government Publishing Office, 
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center, 
U.S. Government Publishing Office. Phone 202-512-1800, or 866-512-1800 (toll-free). 
E-mail, [email protected].  
2016





                     COMMITTEE ON HOMELAND SECURITY

                   Michael T. McCaul, Texas, Chairman
Lamar Smith, Texas                   Bennie G. Thompson, Mississippi
Peter T. King, New York              Loretta Sanchez, California
Mike Rogers, Alabama                 Sheila Jackson Lee, Texas
Candice S. Miller, Michigan, Vice    James R. Langevin, Rhode Island
    Chair                            Brian Higgins, New York
Jeff Duncan, South Carolina          Cedric L. Richmond, Louisiana
Tom Marino, Pennsylvania             William R. Keating, Massachusetts
Lou Barletta, Pennsylvania           Donald M. Payne, Jr., New Jersey
Scott Perry, Pennsylvania            Filemon Vela, Texas
Curt Clawson, Florida                Bonnie Watson Coleman, New Jersey
John Katko, New York                 Kathleen M. Rice, New York
Will Hurd, Texas                     Norma J. Torres, California
Earl L. ``Buddy'' Carter, Georgia
Mark Walker, North Carolina
Barry Loudermilk, Georgia
Martha McSally, Arizona
John Ratcliffe, Texas
Daniel M. Donovan, Jr., New York
                   Brendan P. Shields, Staff Director
                    Joan V. O'Hara,  General Counsel
                    Michael S. Twinchek, Chief Clerk
                I. Lanier Avant, Minority Staff Director
                                 
                                 
                                 ------                                

          SUBCOMMITTEE ON OVERSIGHT AND MANAGEMENT EFFICIENCY

                  Scott Perry, Pennsylvania, Chairman
Jeff Duncan, South Carolina          Bonnie Watson Coleman, New Jersey
Curt Clawson, Florida                Cedric L. Richmond, Louisiana
Earl L. ``Buddy'' Carter, Georgia    Norma J. Torres, California
Barry Loudermilk, Georgia            Bennie G. Thompson, Mississippi 
Michael T. McCaul, Texas (ex             (ex officio)
    officio)
               Ryan Consaul, Subcommittee Staff Director
                   John Dickhaus, Subcommittee Clerk
         Cedric C. Haynes, Minority Subcommittee Staff Director
                            
                            
                            C O N T E N T S

                              ----------                              
                                                                   Page

                               Statements

The Honorable Scott Perry, a Representative in Congress From the 
  State of Pennsylvania, and Chairman, Subcommittee on Oversight 
  and Management Efficiency:
  Oral Statement.................................................     1
  Prepared Statement.............................................     3
The Honorable Bonnie Watson Coleman, a Representative in Congress 
  From the State of New Jersey, and Ranking Member, Subcommittee 
  on Oversight and Management Efficiency:
  Oral Statement.................................................     4
  Prepared Statement.............................................     5
The Honorable Bennie G. Thompson, a Representative in Congress 
  From the State of Mississippi, and Ranking Member, Committee on 
  Homeland Security:
  Prepared Statement.............................................     6

                               Witnesses

Ms. Carol R. Cha, Director, Information Technology Acquisition 
  Management Issues, U.S. Government Accountability Office:
  Oral Statement.................................................     8
  Prepared Statement.............................................     9
Mr. Chip Fulghum, Deputy Under Secretary for Management, U.S. 
  Department of Homeland Security:
  Oral Statement.................................................    21
  Joint Prepared Statement.......................................    22
Ms. Angela Bailey, Chief Human Capital Officer, U.S. Department 
  of Homeland Security:
  Oral Statement.................................................    24
  Joint Prepared Statement.......................................    22

                                Appendix

Questions From Chairman Scott Perry for Carol R. Cha.............    41
Questions From Ranking Member Bonnie Watson Coleman for Carol R. 
  Cha............................................................    42
Questions From Chairman Scott Perry for Chip Fulghum.............    46
Questions From Ranking Member Bonnie Watson Coleman for Angela 
  Bailey.........................................................    48

 
  PROBING DHS'S BOTCHED MANAGEMENT OF THE HUMAN RESOURCES INFORMATION 
                           TECHNOLOGY PROGRAM

                              ----------                              


                      Thursday, February 25, 2016

             U.S. House of Representatives,
                     Subcommittee on Oversight and 
                             Management Efficiency,
                            Committee on Homeland Security,
                                                    Washington, DC.
    The subcommittee met, pursuant to call, at 10:08 a.m., in 
Room 311, Cannon House Office Building, Hon. Scott Perry 
[Chairman of the subcommittee] presiding.
    Present: Representatives Perry, Carter, Loudermilk, Watson 
Coleman, Richmond, and Torres.
    Mr. Perry. Good morning. The Committee on Homeland Security 
Subcommittee on Oversight and Management Efficiency will come 
to order.
    The purpose of this hearing is to examine mismanagement of 
DHS's Human Resources Information Technology program. The Chair 
recognizes himself for an opening statement.
    The Department of Homeland Security, or DHS, was created in 
2002 to unify our Government's efforts to secure America and 
improve coordination, management, and information sharing 
across numerous Federal agencies. DHS has become the third-
largest Federal department with over 240,000 employees.
    Twelve years ago, DHS began a program to consolidate and 
update fragmented human capital systems and processes known as 
the Human Resources Information Technology program, or HRIT. 
While ostensibly well-intended, this inevitably became a 
disjointed approach and compromised DHS's ability to 
effectively perform its mission.
    For example, the lack of an efficient hiring process 
jeopardized DHS's ability to hire the skilled personnel 
necessary to provide disaster response.
    In 2010, DHS's Office of Inspector General reported that 
HRIT had failed to achieve any meaningful progress. In fact, in 
2011, DHS identified over 400 human capital systems and 
applications still in use simultaneously for 22 agencies--400 
human capital systems in use simultaneously. It is 
breathtaking. I just had to emphasize it.
    In a report being released today, the Government 
Accountability Office, the GAO, found that after 12 years and 
at least $180 million appropriated by the United States 
Congress, DHS is no closer to improving its human capital 
management; 95 percent--95 percent--of the key HRIT strategic 
projects have not been completed, many were to be done 4 years 
ago. Yet today, DHS has absolutely no idea when or if these 
projects will be finished.
    HRIT is a poster child for inept management, in my opinion. 
Senior leaders on the Executive Steering Committee responsible 
for overseeing the work met only once--only once--in almost 2 
years.
    Listen, folks, I don't call that commitment. I don't know 
if you do, but I don't call that commitment.
    DHS didn't maintain a schedule to know when projects would 
be done. Officials failed to estimate the total costs of HRIT 
and failed to track how much has been spent to date. So no 
suspense, no deadline, and we have no idea where the taxpayers' 
money went.
    I mean, pause to think about that. DHS has no idea how $180 
million appropriated by the people's representatives in 
Congress has been spent. It is reprehensible, it is 
unbelievable, it is unacceptable. If businesses managed their 
budgets this way, they would be out of business. If households, 
if anybody, if individuals, nobody does this and gets away with 
it.
    As a result of this botched management, DHS's systems 
remain outdated, inefficient, and at high risk to future waste. 
Of particular concern is DHS's inadequate progress in managing 
how employees separate or off-board from the agency, which 
leaves the Department at high risk of security infractions.
    Given the recent hack of DHS employee data, a poor off-
boarding process makes DHS vulnerable to cyber threats, as well 
as physical breaches at DHS facilities, which threatens 
employees, threatens Americans, threatens sensitive 
information.
    Despite these failures, DHS says it has made progress in 
consolidating its performance management and learning system, 
or PALMS, to track training for employees and maintain 
performance information on its workforce.
    The Department praised its efforts to consolidate these 
systems as a success story in a report required by legislation 
passed by this subcommittee that was signed into law last year.
    Far from it, GAO found that implementation of PALMS remains 
a jumble with some components implementing PALMS, some not and 
others only implementing part of the system.
    DHS was again reckless with taxpayer money by not fully 
estimating the costs, tracking total costs, developing a 
sufficient schedule, or monitoring risks to the project.
    DHS will have to continue to use cumbersome, time-consuming 
and, in 2016, paper-based processes to manage the performance 
and training of its workforce. Without a more robust process 
for documenting employee performance, managers face significant 
hurdles in removing poor performers, if that ever happens at 
all.
    I appreciate the hard work of our watchdogs at GAO to bring 
these issues to light.
    Mr. Fulghum and Ms. Bailey, personally, you know this, 
right, I am outraged on behalf of the citizens that I 
represent, on behalf of all the American taxpayers, by the 
ineptitude laid out in this report. DHS violates the trust of 
the taxpayers when it doesn't know how hundreds of millions of 
tax dollars are spent and have virtually nothing to show for 
it.
    Undoubtedly, we will hear your plans to fix the mess and 
implement GAO's 14--14, not 3 or 2--14 recommendations. But I 
also want to know and everybody wants to know, who has been and 
who will be held accountable for this failure? I mean, we 
wonder, who is in charge? If somebody is in charge, how can 
somebody not be held accountable?
    The American people expect better, we demand and require 
better from DHS 14 years after its creation. We understand it 
is not easy. We understand. I have watched businesses go 
through the transition process to SAP. Has anybody ever heard 
of PeopleSoft? Not to just, you know, name some names. It is 
difficult, but they get through it and they don't take decades 
to do it, and they move on. It is not perfect, but they have 
something to show for it.
    [The statement of Mr. Perry follows:]
                   Statement of Chairman Scott Perry
                           February 25, 2016
    The Department of Homeland Security (DHS) was created in 2002 to 
unify our Government's efforts to secure America and improve 
coordination, management, and information sharing across a multitude of 
Federal agencies. DHS has become the third largest Federal department 
with over 240,000 employees. Twelve years ago, DHS began a program to 
consolidate and update fragmented human capital systems and processes 
known as the Human Resources Information Technology program (HRIT). 
This disjointed approach compromised DHS's ability to effectively 
perform its mission. For example, the lack of an efficient hiring 
process jeopardized DHS's ability to hire the skilled personnel 
necessary to provide disaster response. In 2010, DHS's Office of 
Inspector General reported that HRIT had failed to achieve any 
meaningful progress; in fact, in 2011, DHS identified over 400 human 
capital systems and applications still in use.
    In a report being released today, the Government Accountability 
Office (GAO) found that after 12 years and at least $180 million 
appropriated by Congress, DHS is no closer to improving its human 
capital management; 95 percent of the key HRIT strategic projects have 
not been completed--many were to be done 4 years ago. Yet today, DHS 
has no idea when or if these projects will be finished. HRIT is a 
poster child for inept management:
   Senior leaders on the Executive Steering Committee 
        responsible for overseeing the work met only once in almost 2 
        years;
   DHS didn't maintain a schedule to know when projects would 
        be done; and
   Officials failed to estimate the total costs of HRIT and 
        failed to track how much has been spent to date.
    Let's pause to think about this; DHS has no idea how $180 million 
appropriated by the people's representatives in Congress have been 
spent, which is reprehensible and unacceptable. If businesses managed 
their budgets this way, they would be out of business. As a result of 
this botched management, DHS's systems remain outdated, inefficient, 
and at high risk to future waste. Of particular concern is DHS's 
inadequate progress in managing how employees separate, or ``off-
board,'' from the agency, which leaves the Department at high risk of 
security infractions. Given the recent hack of DHS employee data, a 
poor off-boarding process makes DHS vulnerable to cyber threats, as 
well as physical breaches at DHS facilities, which threatens employees 
and sensitive information.
    Despite these failures, DHS says it has made progress in 
consolidating its performance management and learning system--PALMS--to 
track training for employees and maintain performance information on 
its workforce. The Department praised its efforts to consolidate these 
systems as a ``success story'' in a report required by legislation 
passed by this subcommittee that was signed into law last year. Far 
from it, GAO found that implementation of PALMS remains a jumble with 
some components implementing PALMS, some not, and others only 
implementing part of the system. DHS was again reckless with taxpayer 
money by not fully estimating the costs, tracking total costs, 
developing a sufficient schedule, or monitoring risks to the project. 
DHS will have to continue to use cumbersome, time-consuming, and paper-
based processes to manage the performance and training of its 
workforce. Without a more robust process for documenting employee 
performance, managers face significant hurdles in removing poor 
performers.
    I appreciate the hard work of our watchdogs at GAO to bring these 
issues to light. Mr. Fulghum and Ms. Bailey, I'm outraged by the 
ineptitude laid out in this report. DHS violates the trust of the 
taxpayer when it doesn't know how hundreds of millions of taxpayer 
dollars are spent. Undoubtedly, we'll hear your plans to fix this mess 
and implement GAO's 14 recommendations; but I also want to know who has 
been and will be held accountable for this failure. The American people 
expect better from DHS 14 years after its creation.

    Mr. Perry. With that, the Chair now recognizes the Ranking 
Minority Member of the subcommittee, the gentlelady from New 
Jersey, Mrs. Watson Coleman, for her statement.
    Mrs. Watson Coleman. Thank you, Mr Perry. Thank you for 
holding this committee meeting today.
    Thank you all for being here.
    The report on HRIT released today by the Government 
Accountability Office makes clear that after more than a decade 
of sustained investment in HRIT, the program has provided 
virtually none of the capabilities that DHS leaders initially 
hoped the program would yield.
    The absence of the management tools expected from HRIT has 
created real gaps in human resource management at DHS.
    GAO's new report on HRIT and previous reviews of DHS's 
management have found that a combination of fragmented, 
duplicative and paper-based personnel information systems have 
resulted in high administrative costs, shortfalls in employee 
skills or numbers, great difficulty in strategic management of 
human capital across DHS and potential violations of DHS's 
security policies.
    A recent report prepared by DHS for Congress, required 
under a law reported from the committee last year, echoes these 
same concerns. It leads me to wonder how many times DHS has had 
to improvise to fill gaps that are left by HRIT's failures to 
date.
    Two reports issued last month by the Department's own 
inspector general underscore the toll taken by HRIT 
shortcomings. One of these reports notes that the Department 
will not complete implementation of a Performance and Learning 
Management System, PALMS, developed as part of HRIT, until 
2017. The IG finds that without PALMS operating at full 
capacity, DHS lacks an effective governance structure for 
training and oversight.
    Information I have read indicates that some of the 
components are resistant to even using PALMS, so I need to 
understand how you are addressing that issue, if that is true.
    In another January 2016 report, the DHS IG raises several 
concerns with regard to the $1.2 billion HR access contract 
awarded by the TSA in 2008 to support the recruitment and 
hiring of the workforce responsible for the security of the 
traveling public in the United States. The IG notes that TSA 
will award a similar contract with performance starting next 
year.
    Ms. Bailey, I realize that DHS Chief Information Officer 
Luke McCormack has taken charge of the HRIT investment. But as 
a representative of DHS human capital managers left empty-
handed by HRIT, I very much hope that you will make clear how 
the Department plans to recover from HRIT's performance to date 
and to reinvigorate human resource management at DHS.
    Having said that, gaps in management capability and risks 
associated with these gaps don't just happen by accident.
    Mr. Fulghum, we respect your distinguished service to your 
country for almost 3 decades in uniform and as a leader in the 
Department's management directorate since October 2012. 
Nevertheless, I feel compelled to tell you that the 
Department's HRIT experience must impress upon you and other 
DHS leaders that acquisition management has to improve 
demonstrably for programs at all phases of the acquisition life 
cycle and it must do so now.
    The Department's responsibility to steward public 
resources, even as DHS protects the American people, demands no 
less.
    Mr. Fulghum, I cannot understand how the Department will 
continue a complex, multi-million-dollar acquisition for more 
than a decade without a current schedule, a validated estimate 
of life-cycle costs, a complete accounting of costs incurred, 
or the assurance that the planning document for HRIT reflects 
the Department's current priorities and goals.
    Mr. Chairman, on this past Tuesday, the House passed the 
DHS Acquisition Documentation Integrity Act of 2016 which I 
introduced earlier this month. The bill's language codifies 
best practices already embodied in DHS's acquisition policy and 
builds upon an acquisition decision memorandum issued in April 
2015 to ensure a regular, transparent reporting of acquisition 
programs' performance to DHS leadership and to Congress.
    Mr. Chairman, as we have seen in the case of HRIT, anything 
less than an up-to-date acquisition documentation increases the 
odds of cost and schedule overruns, risks delayed delivery of 
critical capabilities and depletes resources needed to address 
future requirements.
    Congress and the Department simply cannot allow GAO's 
latest report on HRIT or this hearing to fade into a background 
already overpopulated with other reports and hearings on poor 
management at DHS. On so many levels, the American people 
cannot afford that.
    With that, Mr. Chairman, I yield back my time.
    [The statement of Ranking Member Watson Coleman follows:]
           Statement of Ranking Member Bonnie Watson Coleman
                           February 25, 2016
    Today, the subcommittee meets to respond to a serious management 
challenge facing the Department of Homeland Security--specifically, how 
does DHS build and maintain the large, complex workforce needed to keep 
Americans safe? When the Department began its operations in the wake of 
September 11, it was the largest reorganization of the U.S. Government 
since the end of World War II.
    Aware that the Department's critical work would require something 
on the scale of today's DHS--with 240,000 employees working in 16 
operating and support components--leaders within and across these 
functions knew they would need tools for the full range of activities 
involved in managing people in an organization of the Department's 
scale and scope.
    To put management of the new Department's workforce on a solid 
footing, DHS initiated the Human Resource Information Technology or 
``HRIT'' investment in 2003. The report on HRIT released today by the 
Government Accountability Office makes clear that after more than a 
decade of sustained investment in HRIT, the program has provided 
virtually none of the capabilities that DHS leaders initially hoped the 
program would yield.
    The absence of the management tools expected from HRIT has created 
real gaps in human resource management at DHS. GAO's new report on HRIT 
and previous reviews of DHS management have found that a combination of 
fragmented, duplicative, and paper-based personnel information systems 
have resulted in high administrative costs, shortfalls in employee 
skills or numbers, great difficulty in strategic management of human 
capital across DHS, and potential violations of DHS security policies. 
A recent report prepared by DHS for Congress--required under a law 
reported from this committee last year--echoes these same concerns.
    It leaves me to wonder how many times DHS has had to improvise to 
fill gaps left by HRIT's failures to date. Two reports issued last 
month by the Department's own Inspector General underscore the toll 
taken by HRIT's shortcomings:
    One of these reports notes that the Department will not complete 
implementation of a Performance and Learning Management System (PALMS) 
developed as part of HRIT until 2017. The IG finds that without PALMS 
operating at full capacity, DHS lacks an effective governance structure 
for training oversight.
    In another January 2016 report, the DHS IG raises several concerns 
with regard to the $1.2 billion ``HR Access'' contract, awarded by the 
Transportation Security Administration in 2008, to support the 
recruitment and hiring of the workforce responsible for the security of 
the traveling public in the United States. The IG notes that TSA will 
award a similar contract, with performance starting next year.
    Ms. Bailey, I realize that DHS Chief Information Officer Luke 
McCormack has taken charge of the HRIT investment. But as the 
representative of DHS human capital managers left empty-handed by HRIT, 
I very much hope that you will make clear how the Department plans to 
recover from HRIT's performance to date, and to reinvigorate human 
resource management at DHS.
    Having said that, gaps in management capability and the risks 
associated with these gaps don't just happen by accident.
    Mr. Fulghum, we respect your distinguished service to your country 
for almost 3 decades in uniform, and as a leader in the Department's 
management directorate since October 2012.
    Nevertheless, I feel compelled to tell you that the Department's 
HRIT experience must impress upon you and other DHS leaders that 
acquisition management has to improve, demonstrably, for programs at 
all phases of the acquisition life cycle--and it must do so now. The 
Department's responsibility to steward public resources, even as DHS 
protects the American people, demands no less.
    Mr. Fulghum, I cannot understand how the Department would continue 
a complex, multimillion-dollar acquisition for more than a decade 
without a current schedule, a validated estimate of life-cycle costs, a 
complete accounting of costs incurred, or the assurance that the 
planning document for HRIT reflects the Department's current priorities 
and goals.
    Mr. Chairman, on this past Tuesday, the House passed the ``DHS 
Acquisition Documentation Integrity Act of 2016,'' which I introduced 
earlier this month. The bill's language codifies best practices already 
embodied in DHS acquisition policy, and builds upon an Acquisition 
Decision Memorandum issued in April 2015 to ensure regular, transparent 
reporting of acquisition programs' performance to DHS leadership and 
Congress.
    Mr. Chairman, as we've seen in the case of HRIT, anything less than 
up-to-date acquisition documentation increases the odds of cost and 
schedule overruns; risks delayed delivery of critical capabilities; and 
depletes resources needed to address future requirements.
    Congress and the Department simply cannot allow GAO's latest report 
on HRIT or this hearing to fade into a background already overpopulated 
with other reports and hearings on poor management at DHS. On so many 
levels, the American people cannot afford that.

    Mr. Perry. The Chair thanks the gentlelady.
    Other Members of the subcommittee are reminded that opening 
statements may be submitted for the record.
    [The statement of Ranking Member Thompson follows:]
             Statement of Ranking Member Bennie G. Thompson
    It is not shocking that the subject of today's hearing is another 
acquisition failure at the Department. The Government Accountability 
Office has found that DHS has made little progress in implementing its 
Human Resources Information Technology Investment (HRIT). HRIT was 
created to consolidate, integrate, and modernize the Department's 
information technology infrastructure that supports human resources.
    It is no secret that DHS has been plagued with acquisition 
failures. This committee, in a bipartisan fashion, has exercised 
vigorous oversight over DHS acquisitions. The committee has also 
produced bipartisan legislation on DHS acquisitions. Just this week, 
the House passed more common-sense legislation to reform DHS 
acquisitions. H.R. 4398, authored by the Ranking Member of this 
subcommittee, requires regular reporting on the progress of DHS 
acquisitions to Congress. What I do find appalling is that the 
Department official ultimately responsible for both acquisition and 
human resource management at DHS is not appearing today.
    Under Secretary Deyo, the under secretary for management, has not 
appeared before the committee since assuming his duties at DHS. Even 
though the Government Accountability Office has noted that management 
challenges at DHS are among the most serious programmatic risks facing 
the U.S. Government, the under secretary is not here to address GAO's 
findings or receive questions from Members.
    Today's hearing involves significant concerns with respect to the 
management of DHS personnel, information technology, and acquisition 
actions all of which fall squarely within the under secretary's 
responsibilities. The Department's poor performance on the Office of 
Personnel Management's Federal Employee View Point Survey underscores 
DHS's human capital management challenges. Additionally, GAO introduced 
a new high-risk area for DHS in its high-risk update focused on 
``Improving the Management of IT Acquisitions and Operations''.
    Unfortunately, the Department's HRIT investment provides a glaring 
case-in-point: GAO's report on HRIT provides the following box score 
for the program--after more than 12 years of sustained investment, no 
validated program baselines; uncertainty about the validity of 
requirements; virtually no capabilities fully delivered; and no 
complete accounting of program costs to date.
    Finally, GAO's report finds that an executive steering committee 
for HRIT--composed of senior DHS officials--met only once between 
September 2013 and June 2015. This committee has seen too many cases of 
poor program discipline at DHS translating into acquisition programs 
beset by cost overruns and schedule delays. Mr. Chairman, I hope that 
today's hearing offers a full record of the lapses that have left HRIT 
in its current predicament. I also hope that our witnesses will also 
explain the Department's plan to recover value from the HRIT 
investment, and to reform DHS acquisition management.

    Mr. Perry. We are pleased to have a distinguished panel of 
witnesses before us today. The witnesses' entire written 
statements will appear in the record.
    The Chair will introduce all of the witnesses first and 
then recognize each of you for your testimony.
    Ms. Carol Cha is director of the information technology 
acquisition management issues at the Government Accountability 
Office, the GAO. In this position, Ms. Cha oversees GAO's 
evaluation of information technology programs across the 
Federal Government. Ms. Cha is a member of the Senior Executive 
Service and joined GAO in 2002.
    Welcome.
    The honorable Chip Fulghum is the deputy under secretary 
for management and chief financial officer for the Department 
of Homeland Security. Mr. Fulghum joined DHS in October 2012 as 
its budget director. Prior to joining the Department, Mr. 
Fulghum served for 28 years in the United States Air Force, 
retiring with the rank of colonel.
    Thank you for your service, sir.
    Ms. Angela Bailey is the chief human capital officer for 
the Department of Homeland Security. Prior to joining DHS in 
January 2016, Ms. Bailey was the chief operating officer at the 
Office of Personnel Management. Ms. Bailey has almost 35 years 
of public service with more than 25 years in human resources.
    Thank you for your service, Ms. Bailey.
    Thank you all for being here today. The Chair recognizes 
Ms. Cha for her opening statement.

  STATEMENT OF CAROL R. CHA, DIRECTOR, INFORMATION TECHNOLOGY 
 ACQUISITION MANAGEMENT ISSUES, U.S. GOVERNMENT ACCOUNTABILITY 
                             OFFICE

    Ms. Cha. Thank you, Mr. Chairman. Mr. Chairman, Ranking 
Member Watson Coleman and Members of the subcommittee, thank 
you for inviting us to testify today on DHS's human resources 
IT investment.
    As requested, I will briefly summarize the findings from 
our report, completed at your request on this very important IT 
acquisition.
    DHS's human resources environment includes at least 422 
fragmented systems and applications as well as duplicative and 
paper-based processes. HRIT was initiated in 2003 to 
consolidate, integrate, and modernize this infrastructure 
across the Department and its components.
    The objective of this investment is to enable complete 
visibility of all employees in order to strategically manage 
the workforce and best deploy people in support of homeland 
security missions.
    The enterprise-wide business capabilities expected to be 
delivered under HRIT includes end-to-end hiring, payroll action 
processing, training and performance management, among many 
others. Unfortunately, this investment has largely been 
neglected and the Department has not come close to fulfilling 
this objective.
    This morning I would like to highlight 3 key points from 
our report.
    First, the lack of progress made to implement HRIT. While 
DHS initiated HRIT in 2003, the Department redefined its scope 
and implementation time frames in 2011. In particular, DHS 
identified 15 business capabilities to be improved and planned 
for the vast majority of them to be implemented by June 2015.
    As of November 2015, only 1 has been fully implemented, 5 
are partially complete and work has yet to begin on the 
remaining 9. Furthermore, the current expected completion dates 
for these 14 open ones are unknown.
    Additionally, HRIT has made limited progress in achieving 
key performance targets outlined in its strategic plan for 
fiscal year 2012 through 2016. HRIT is expected to reduce 
component-specific services by 46 percent. It is also expected 
to increase Department-wide services by 38 percent. However, 
since 2012, HRIT has achieved improvements in each of these 
target areas by only 8 percent.
    Second, DHS's lack of executive oversight. The HRIT 
Executive Steering Committee, which is the investment's core 
oversight body, was minimally involved for nearly 2 years, 
meeting only once from 2013 through 2015 during a time when 
significant issues were occurring.
    For example, HRIT's only on-going acquisition called the 
Performance and Learning Management System experienced years-
long schedule delays and had 5 different program managers 
during this time.
    The lack of meetings resulted in key governance activities 
not being completed, such as the approval of the investment's 
expenditure plan for fiscal year 2014 through 2019.
    Additionally, the Steering Committee did not ensure HRIT 
had key management controls to effectively monitor performance 
and inform decisions. In particular, HRIT lacked a current 
integrated master schedule, a life-cycle cost estimate and an 
ability to track total actual costs incurred to date.
    More recently, the HRIT Executive Steering Committee met in 
June and October 2015 and DHS officials have indicated that the 
committee will meet quarterly moving forward. However, this 
will likely not be frequent enough to ensure effective delivery 
of the remaining 14 capabilities.
    Given its state, we identified HRIT as one of a handful of 
major IT acquisitions across the Federal Government, in need of 
the most attention on GAO's high-risk list. As such, the 
Department should rethink its decision and consider meeting on 
a monthly basis, an action consistent with its own policies for 
overseeing IT investments designated as high-risk.
    Third, HRIT's acquisition strategy, also known as the 
blueprint, may not reflect the Department's current priorities 
and goals. The blueprint was issued over 4 years ago and has 
not been updated since. As such, the Department does not know 
whether the remaining 14 business capabilities are still valid 
and appropriately prioritized based on current mission needs.
    According to the Department, it is still committed to 
implementing the blueprint, but agree that it should be 
reevaluated. DHS expects to complete this and update the 
blueprint by the end of April 2016.
    In light of these issues, we made a total of 14 
recommendations to address HRIT's poor progress and ineffective 
management. Moving forward, it will be critical for DHS to 
effectively implement them in order to improve HRIT outcomes 
and provide the Department with complete employee information 
necessary to more effectively carry out its mission.
    That concludes my statement and I look forward to 
addressing your questions.
    [The prepared statement of Ms. Cha follows:]
                   Prepared Statement of Carol R. Cha
                           February 25, 2016
                             gao highlights
    Highlights of GAO-16-407T, a testimony before the Subcommittee on 
Oversight and Management Efficiency, Committee on Homeland Security, 
House of Representatives.
Why GAO Did This Study
    DHS's human resources information technology environment includes 
fragmented systems, duplicative and paper-based processes, and little 
uniformity of data management practices, which according to DHS, are 
compromising the Department's ability to effectively carry out its 
mission. DHS initiated HRIT in 2003 to consolidate, integrate, and 
modernize DHS's human resources information technology infrastructure. 
In 2011, DHS redefined HRIT's scope and implementation time frames.
    This statement summarizes GAO's report that is being released at 
today's hearing (GAO-16-253) on, among other objectives, the progress 
DHS has made in implementing the HRIT investment and how effectively it 
managed the investment.
What GAO Recommends
    In its report that is being released today, GAO made 14 
recommendations to DHS to, among other things, address HRIT's poor 
progress and ineffective management. For example, GAO recommended that 
the HRIT executive steering committee be consistently involved in 
overseeing and advising the investment, and that DHS establish time 
frames for re-evaluating HRIT and develop a complete life-cycle cost 
estimate for the investment. DHS concurred with the 14 recommendations 
and provided estimated completion dates for implementing each of them.
   homeland security.--weak oversight of human resources information 
          technology investment needs considerable improvement
What GAO Found
    The Department of Homeland Security (DHS) has made very little 
progress in implementing its Human Resources Information Technology 
(HRIT) investment over the last several years. This investment includes 
15 improvement areas; as of November 2015, DHS had fully implemented 
only 1. 


    HRIT's limited progress was due in part to the lack of involvement 
of its executive steering committee--the investment's core oversight 
and advisory body. Specifically, this committee was minimally involved 
with HRIT, such as meeting only once during a nearly 2-year period when 
major problems were occurring, including schedule delays and the lack 
of a life-cycle cost estimate. As a result, key governance activities, 
such as approval of HRIT's operational plan, were not completed. 
Officials acknowledge that HRIT should be re-evaluated. They have met 
to discuss it; however, specific actions and time frames have not yet 
been determined. Until DHS takes key actions to manage this neglected 
investment, it is unknown when its human capital management weaknesses 
will be addressed.
    Chairman Perry, Ranking Member Watson Coleman, and Members of the 
subcommittee: I am pleased to be here today to discuss the Department 
of Homeland Security's (DHS) efforts to implement the Human Resources 
Information Technology (HRIT) investment. Since DHS was created in 2002 
and merged 22 agencies into 1 department with 8 components, its human 
resources environment has included fragmented systems, duplicative and 
paper-based processes, and little uniformity of data management 
practices. According to DHS, these limitations in its human resources 
environment are compromising the Department's ability to effectively 
and efficiently carry out its mission.\1\ To address these issues, DHS 
initiated HRIT in 2003 to consolidate, integrate, and modernize the 
Department's information technology (IT) infrastructure that supports 
human resources.
---------------------------------------------------------------------------
    \1\ DHS, Human Capital Segment Architecture Blueprint, Version 1.0 
(Aug. 9, 2011).
---------------------------------------------------------------------------
    The information in my testimony is based on our report being 
released at today's hearing on the results of our review of DHS's 
implementation of HRIT.\2\ Specifically, my remarks today summarize key 
findings from that study, which: (1) Evaluated the progress DHS has 
made in implementing the HRIT investment and how effectively DHS 
managed the investment, (2) determined whether the Performance and 
Learning Management System (PALMS)--HRIT's only on-going program--is 
being implemented enterprise-wide, and (3) evaluated the extent to 
which PALMS is implementing selected IT acquisition best practices.
---------------------------------------------------------------------------
    \2\ GAO, Homeland Security: Oversight of Neglected Human Resources 
Information Technology Investment Is Needed, GAO-16-253 (Washington, 
DC: Feb. 11, 2016).
---------------------------------------------------------------------------
    For our report, we, among other things, compared HRIT's goals, 
scope, and implementation time frames to the investment's actual 
accomplishments. Additionally, we analyzed HRIT and PALMS 
documentation, such as program management briefings, the PALMS 
acquisition plan, and cost and schedule estimates, and compared them 
against relevant IT acquisition best practices identified by GAO, the 
Software Engineering Institute at Carnegie Mellon University, and the 
Project Management Institute, Inc.\3\ More details on the objectives, 
scope, and methodology are provided in the report. The work on which 
this statement is based was conducted in accordance with generally 
accepted Government auditing standards.
---------------------------------------------------------------------------
    \3\ GAO, GAO Cost Estimating and Assessment Guide: Best Practices 
for Developing and Managing Capital Program Costs, GAO-09-3SP 
(Washington, DC: March 2009); GAO Schedule Assessment Guide: Best 
Practices for Project Schedules, GAO-16-89G (Washington, DC: Dec. 22, 
2015); Software Engineering Institute, Capability Maturity Model 
Integration for Acquisition (CMMI-ACQ), Version 1.3 (Pittsburgh, PA: 
November 2010); and Project Management Institute, Inc., A Guide to the 
Project Management Body of Knowledge (PMBOK Guide), Fifth Edition, 
(Newton Square, PA: 2013). ``PMBOK'' is a trademark of the Project 
Management Institute, Inc.
---------------------------------------------------------------------------
                               background
    According to DHS, the limitations in its human resources 
environment, which includes fragmented systems and duplicative and 
paper-based processes, were compromising the Department's ability to 
effectively and efficiently carry out its mission.\4\ For example, 
according to DHS, the Department does not have information on all of 
its employees, which reduces its abilities to strategically manage its 
workforce and best deploy people in support of homeland security 
missions. Additionally, according to DHS, reporting and analyzing 
enterprise human capital data are currently time-consuming, labor-
intensive, and challenging because the Department's data management 
largely consists of disconnected, stand-alone systems, with multiple 
data sources for the same content.
---------------------------------------------------------------------------
    \4\ DHS, Human Capital Segment Architecture Blueprint, Version 1.0 
(Aug. 9, 2011).
---------------------------------------------------------------------------
    To address these issues, in 2003, DHS initiated the HRIT 
investment, which is intended to consolidate, integrate, and modernize 
the Department's and its components' human resources IT infrastructure. 
These components include U.S. Customs and Border Protection, the 
Federal Emergency Management Agency, the Federal Law Enforcement 
Training Center, U.S. Immigration and Customs Enforcement, the 
Transportation Security Administration, U.S. Citizenship and 
Immigration Services, the U.S. Coast Guard, and the U.S. Secret 
Service.
    HRIT is managed by DHS's Human Capital Business Systems unit, which 
is within the Office of the Chief Human Capital Officer and has overall 
responsibility for HRIT. Additionally, the Office of the Chief 
Information Officer plays a key supporting role in the implementation 
of HRIT by reviewing headquarters' and components' human resources 
investments, identifying redundancies and efficiencies, and delivering 
and maintaining enterprise IT systems.
    From 2003 to 2010, DHS made limited progress on the HRIT 
investment, as reported by DHS's inspector general.\5\ This was due to, 
among other things, limited coordination with and commitment from DHS's 
components. To address this problem, in 2010 the DHS deputy secretary 
issued a memorandum emphasizing that DHS's wide variety of human 
resources processes and IT systems inhibited the ability to unify DHS 
and negatively impacted operating costs. Accordingly, the deputy 
secretary memorandum prohibited component spending on enhancements to 
existing human resources systems or acquisitions of new solutions, 
unless those expenditures were approved by the offices of the chief 
human capital officer or chief information officer. The memorandum also 
directed these offices to develop a Department-wide human resources 
architecture.
---------------------------------------------------------------------------
    \5\ DHS Office of Inspector General, Management Oversight and 
Component Participation Are Necessary to Complete DHS' Human Resource 
Systems Consolidation Effort, OIG-10-99 (Washington, DC: July 1, 2010).
---------------------------------------------------------------------------
    In 2011, in response to the deputy secretary's direction, the 
Department developed a strategic planning document referred to as the 
Human Capital Segment Architecture blueprint, which redefined the HRIT 
investment's scope and implementation time frames. As part of this 
effort, DHS conducted a system inventory and determined that it had 422 
human resources systems and applications, many of which were single-use 
solutions developed to respond to a small need or links to enable 
disparate systems to work together. DHS reported that these numerous, 
antiquated, and fragmented systems inhibited its ability to perform 
basic workforce management functions necessary to support mission 
critical programs.
    To address this issue, the blueprint articulated that HRIT would be 
comprised of 15 strategic improvement opportunity areas (e.g., enabling 
seamless, efficient, and transparent end-to-end hiring) and outlined 77 
associated projects (e.g., deploying a Department-wide hiring system) 
to implement these 15 opportunities.
    HRIT's only on-going program is called PALMS and is intended to 
fully address the Performance Management strategic improvement 
opportunity area and its 3 associated projects. PALMS is attempting to 
implement a commercial off-the-shelf software product that is to be 
provided as a service \6\ in order to enable, among other things, 
comprehensive enterprise-wide tracking, reporting, and analysis of 
employee learning and performance for DHS headquarters and its 8 
components. Specifically, PALMS is expected to deliver the following 
capabilities:
---------------------------------------------------------------------------
    \6\ For software provided as a service, a consumer uses a 
provider's applications that are accessible from various client devices 
through an interface such as a web browser (e.g., web-based e-mail). 
The consumer does not manage or control the underlying infrastructure 
or the individual application capabilities.
---------------------------------------------------------------------------
   Learning management.--The learning management capabilities 
        are intended to manage the life cycle of learning activities 
        for all DHS employees and contractors. It is intended to, among 
        other things, act as a gateway for accessing training at DHS 
        and record training information when a user has completed a 
        course. Additionally, it is expected to replace 9 disparate 
        learning management systems with 1 unified system.
   Performance management.--The performance management 
        capabilities are intended to move DHS's existing primarily 
        paper-based performance management processes into an electronic 
        environment and capture performance-related information 
        throughout the performance cycle (e.g., recording performance 
        expectations discussed at the beginning of the rating period 
        and performance ratings at the end of it).
    Each component is responsible for its own PALMS implementation 
project, and is expected to issue a task order using a blanket purchase 
agreement that was established in May 2013 with an estimated value of 
$95 million.\7\ The headquarters PALMS program management office is 
responsible for overseeing the implementation projects across the 
Department. Additionally, the office of the chief information officer 
is the component acquisition executive responsible for overseeing 
PALMS.\8\
---------------------------------------------------------------------------
    \7\ A blanket purchase agreement is a method of filling anticipated 
repetitive needs for supplies or services by establishing ``charge 
accounts'' with qualified sources of supply. These agreements between 
agencies and vendors have terms in place for future use and agencies 
issue individual orders to fulfill requirements for goods and services 
as they arise; funds are obligated when orders are placed.
    \8\ DHS classifies its acquisition programs into 3 levels to 
determine the extent and scope of required project and program 
management, the level of reporting requirements, and the acquisition 
decision authority. Component acquisition executives are the senior 
acquisition officials within the components, responsible for, among 
other things, acting as the acquisition decision authority for Level 3 
programs (including PALMS) and establishing component-level acquisition 
policy and processes.
---------------------------------------------------------------------------
    In addition, according to DHS officials, as of September 2014, 
PALMS was expected to address part of our High-Risk Series on 
strengthening DHS's management functions.\9\ Specifically, PALMS is 
intended to address challenges in integrating employee training 
management across all the components, including centralizing training 
and consolidating training data into 1 system.
---------------------------------------------------------------------------
    \9\ GAO, High-Risk Series: An Update, GAO-03-119 (Washington, DC: 
Jan. 1, 2003).
---------------------------------------------------------------------------
  dhs has made very little progress in implementing hrit; investment 
                      lacked effective management
    DHS has made very limited progress in addressing the 15 strategic 
improvement opportunities and the 77 associated projects included in 
HRIT. According to the Human Capital Segment Architecture Blueprint, 
DHS planned to implement 14 of the 15 strategic improvement 
opportunities and 68 of the 77 associated projects by June 2015; and 
the remaining improvement opportunity and 9 associated projects by 
December 2016. However, as of November 2015, DHS had fully implemented 
only 1 of the strategic improvement opportunities, which included 2 
associated projects. Table 1 summarizes the implementation status and 
planned completion dates of the strategic improvement opportunities--
listed in the order of DHS's assigned priority--as of November 2015. 


    DHS has partially implemented 5 of the other strategic improvement 
opportunities, but it is unknown when they will be fully addressed. 
Further, HRIT officials stated that DHS has not yet started to work on 
the remaining 9 improvement opportunities, and the officials did not 
know when they would be addressed.
    Additionally, DHS developed an HRIT strategic plan for fiscal years 
2012 through 2016 that outlined the investment's key goals and 
objectives, including reducing duplication and improving efficiencies 
in the Department's human resources processes and systems. The 
strategic plan identified, among other things, 2 performance metrics 
that were focused on reductions in the number of component-specific 
human resources IT services provided and increases in the number of 
Department-wide HRIT services provided by the end of fiscal year 2016.
    However, DHS has also made limited progress in achieving these 2 
performance targets. Figure 1 provides a summary of HRIT's progress 
towards achieving its service delivery performance targets. 


    Key causes for DHS's lack of progress in implementing HRIT and its 
associated strategic improvement opportunities include unplanned 
resource changes and the lack of involvement of the HRIT executive 
steering committee. These causes are discussed in detail below:
   Unplanned resource changes.--DHS elected to dedicate the 
        vast majority of HRIT's resources to implementing PALMS and 
        addressing its problems, rather than initiating additional HRIT 
        strategic improvement opportunities. Specifically, PALMS--which 
        began in July 2012--experienced programmatic and technical 
        challenges that led to years-long schedule delays.\10\ For 
        example, while the PALMS system for headquarters was originally 
        planned to be delivered by a vendor in December 2013, as of 
        November 2015, the expected delivery date was delayed until the 
        end of February 2016--an over 2-year delay. HRIT officials 
        explained the decision to focus primarily on PALMS was due, in 
        part, to the investment's declining funding. However, in doing 
        so, attention was concentrated on the immediate issues 
        affecting PALMS and diverted from the longer-term HRIT mission.
---------------------------------------------------------------------------
    \10\ PALMS program management office officials attributed these 
slippages to multiple causes, including, among other things, the 
vendor's commercial off-the-shelf system not meeting certain 
requirements that it was expected to meet, thereby requiring the vendor 
to customize the system to meet those requirements. As of November 
2015, according to PALMS headquarters officials, DHS had 483 baseline 
requirements, 32 of which needed customizations, and 5 of these 32 
requirements still needed to be fully addressed by the vendor. DHS 
expected these requirements to be met by the end of February 2016.
---------------------------------------------------------------------------
   Lack of involvement of the HRIT executive steering 
        committee.--The HRIT executive steering committee--which is 
        chaired by the Department's under secretary for management and 
        co-chaired by the chief information officer and chief human 
        capital officer--is intended to be the core oversight and 
        advisory body for all DHS-wide matters related to human capital 
        IT investments, expenditures, projects, and initiatives. In 
        addition, according to the committee's charter, the committee 
        is to approve and provide guidance on the Department's mission, 
        vision, and strategies for the HRIT program.
    However, the executive steering committee only met once from 
        September 2013 through June 2015--in July 2014--and was 
        minimally involved with HRIT for that almost 2-year period. It 
        is important to note that DHS replaced its chief information 
        officer (the executive steering committee's co-chair) in 
        December 2013--during this gap in oversight. Also during this 
        time period HRIT's only on-going program--PALMS--was 
        experiencing significant problems, including schedule slippages 
        and frequent turnover in its program manager position (i.e., 
        PALMS had 5 different program managers during the time that the 
        HRIT executive steering committee was minimally involved). As a 
        result of the executive steering committee not meeting, key 
        governance activities were not completed on HRIT. For example, 
        the committee did not approve HRIT's notional operational plan 
        for fiscal years 2014 through 2019.\11\ Officials from the 
        offices of the chief human capital officer and chief 
        information officer attributed the lack of HRIT executive 
        steering committee meetings and committee involvement in HRIT 
        to the investment's focus being only on the PALMS program to 
        address its issues, as discussed earlier. However, by not 
        regularly meeting and providing oversight during a time when a 
        new co-chair for the executive steering committee assumed 
        responsibility and PALMS was experiencing such problems, the 
        committee's guidance to the troubled program was limited.
---------------------------------------------------------------------------
    \11\ HRIT's notional operational plan for fiscal years 2014 through 
2019 identified the high-level projects and activities that HRIT 
planned to fund each year and the planned phase of each project (e.g., 
planning, acquisition, operations and maintenance).
---------------------------------------------------------------------------
    More recently, the HRIT executive steering committee met in June 
        and October 2015, and officials from the offices of the chief 
        human capital officer and chief information officer stated that 
        the committee planned to meet quarterly going forward. However, 
        while the committee's charter specified that it meet on at 
        least a monthly basis for the first year, the charter does not 
        specify the frequency of meetings following that year. 
        Furthermore, the committee's charter has not been updated to 
        reflect the increased frequency of these meetings.
    As a result of the limited progress in implementing HRIT, DHS is 
unaware of when critical weaknesses in the Department's human capital 
environment will be addressed, which is, among other things, impacting 
DHS's ability to carry out its mission. For example, the end-to-end 
hiring strategic improvement opportunity (which has an unknown 
implementation date) was intended to streamline numerous systems and 
multiple hand-offs in order to more efficiently and effectively hire 
appropriately skilled personnel, thus enabling a quicker response to 
emergencies, catastrophic events, and threats.
    We recommended in our report that DHS's Under Secretary for 
Management update the HRIT executive steering committee charter to 
establish the frequency with which the committee meetings are to be 
held, and ensure that the committee is consistently involved in 
overseeing and advising HRIT. DHS agreed with both of these 
recommendations and stated that the executive steering committee 
charter would be updated accordingly by the end of February 2016; and 
that by April 30, 2016, the under secretary plans to ensure that the 
committee is consistently involved in overseeing and advising HRIT.
HRIT Lacked a Current Schedule, Life-Cycle Cost Estimate, and Cost 
        Tracking
    According to the GAO Schedule Assessment Guide, a key activity in 
effectively managing a program and ensuring progress is establishing 
and maintaining a schedule estimate. Specifically, a well-maintained 
schedule enables programs to gauge progress, identify and resolve 
potential problems, and forecast dates for program activities and 
completion of the program.\12\
---------------------------------------------------------------------------
    \12\ GAO-16-89G.
---------------------------------------------------------------------------
    In August 2011, DHS established initiation and completion dates for 
each of the 15 strategic improvement opportunities within the Human 
Capital Segment Architecture Blueprint. Additionally, HRIT developed a 
slightly more detailed schedule for fiscal years 2014 through 2021 that 
updated planned completion dates for aspects of some strategic 
improvement opportunities, but not all.
    However, DHS did not update and maintain either schedule after they 
were developed. Specifically, neither schedule was updated to reflect 
that DHS did not implement 13 of the 15 improvement opportunities by 
their planned completion dates--several of which should have been 
implemented over 3 years ago. HRIT officials attributed the lack of 
schedule updates to the investment's focus shifting to the PALMS 
program when it started experiencing significant schedule delays. 
Without developing and maintaining a current schedule showing when DHS 
plans to implement the strategic improvement opportunities, DHS and 
Congress will be limited in their ability to oversee and ensure DHS's 
progress in implementing HRIT.
    We recommended that the Department update and maintain a schedule 
estimate for when DHS plans to implement each of the strategic 
improvement opportunities. In response, DHS concurred with our 
recommendation and stated that, by April 30, 2016, the DHS chief 
information officer will update and maintain a schedule estimate for 
each of the strategic improvement opportunities.
            HRIT Did Not Have a Life-Cycle Cost Estimate
    The Office of Management and Budget (OMB) requires that agencies 
prepare total estimated life-cycle costs for IT investments.\13\ 
Program management best practices also stress that key activities in 
planning and managing a program include establishing a life-cycle cost 
estimate and tracking costs expended.\14\ A life-cycle cost estimate 
supports budgetary decisions and key decision points, and should 
include all costs for planning, procurement, and operations and 
maintenance of a program.\15\
---------------------------------------------------------------------------
    \13\ OMB, Fiscal Year 2016, Capital Planning Guidance (Washington, 
DC: May 2014).
    \14\ CMMI-ACQ, Project Planning and Project Monitoring and Control 
Process Areas; PMBOK Guide, Project Cost Management; and GAO-09-3SP.
    \15\ GAO-09-3SP.
---------------------------------------------------------------------------
    Officials from the Office of the Chief Human Capital Officer stated 
that a draft life-cycle cost estimate for HRIT was developed, but that 
it was not completed or finalized because detailed projects plans for 
the associated projects had not been developed or approved. According 
to the Human Capital Segment Architecture blueprint, the Office of the 
Chief Human Capital Officer roughly estimated that implementing all of 
the projects could cost up to $120 million. However, the blueprint 
specified that this figure did not represent the life-cycle cost 
estimate; rather it was intended to be a preliminary estimate to 
initiate projects. Without a life-cycle cost estimate, DHS has limited 
information about how much it will cost to implement HRIT, which 
hinders the Department's ability to, among other things, make budgetary 
decisions and informed milestone review decisions.
    Accordingly, we recommended that DHS develop a complete life-cycle 
cost estimate for the implementation of the HRIT investment. DHS agreed 
with our recommendation and stated that, by June 30, 2016, the DHS 
chief information officer will direct development of a complete life-
cycle cost estimate for the implementation of HRIT's strategic 
improvement opportunities.
DHS Did Not Track All Costs Incurred on HRIT
    According to CMMI-ACQ and the PMBOK Guide, programs should track 
program costs in order to effectively manage the program and make 
resource adjustments accordingly. In particular, tracking and 
monitoring costs enables a program to recognize variances from the plan 
in order to take corrective action and minimize risk.\16\
---------------------------------------------------------------------------
    \16\ CMMI-ACQ, Project Monitoring and Control Process Area; PMBOK 
Guide, Project Cost Management.
---------------------------------------------------------------------------
    However, DHS has not tracked the total actual costs incurred on 
implementing HRIT across the enterprise to date. Specifically, while 
the investment received line item appropriations for fiscal years 2005 
through 2015 which totaled at least $180 million,\17\ DHS was unable to 
provide all cost information on HRIT activities since it began in 2003, 
including all Government-related activities and component costs that 
were financed through the working capital fund, which, according to DHS 
officials from multiple offices, were provided separately from the at 
least $180 million appropriated specifically to HRIT.\18\ Officials 
from the Office of the Chief Human Capital Officer attributed the lack 
of cost tracking to, among other things, the investment's early 
reliance on contractors to track costs, and said that the costs were 
not well-maintained nor centrally-tracked, and included incomplete 
component-provided cost information. The components were also unable to 
provide us with complete information.
---------------------------------------------------------------------------
    \17\ Appropriations acts passed for fiscal years 2003 through 2004 
did not include a line item appropriating specific funds to HRIT and 
DHS officials were unaware of how much had been appropriated for those 
years.
    \18\ The working capital fund is available to DHS for expenses and 
equipment necessary for maintenance and operations of administrative 
services that the Secretary of Homeland Security determines would be 
performed more advantageously as central services. Pub. L. No. 108-90, 
117 Stat. 1137, 1153,  506 (2003).
---------------------------------------------------------------------------
    Consequently, we recommended that the Department document and track 
all costs, including components' costs, associated with HRIT. DHS 
concurred and stated that, by October 31, 2016, the DHS chief 
information officer will direct the HRIT investment to document and 
track all costs associated with HRIT.
hrit's 2011 blueprint may not be valid and reflective of dhs's current 
                          priorities and goals
    According to the HRIT executive steering committee's charter, the 
under secretary for management (as the chair of the committee) is to 
ensure that the Department's human resources IT business needs are met, 
as outlined in the blueprint. Additionally, according to the GPRA 
(Government Performance and Results Act) Modernization Act of 2010, 
agency strategic plans should be updated at least every 4 years. While 
this is a legal requirement for agency strategic plans (the Human 
Capital Segment Architecture blueprint does not fall under the category 
of an ``agency strategic plan''), it is considered a best practice for 
other strategic planning documents, such as the blueprint.
    However, the Department issued the blueprint in August 2011 
(approximately 4.5 years ago) and has not updated it since. As a 
result, the Department does not know whether the remaining 14 strategic 
improvement opportunities and associated projects that it has not fully 
implemented are still valid and reflective of DHS's current priorities, 
and are appropriately prioritized based on current mission and business 
needs. Additionally, DHS does not know whether new or emerging 
opportunities or business needs need to be addressed.
    Officials stated that the Department is still committed to 
implementing the blueprint, but agreed that it should be re-evaluated. 
To this end, following a meeting we had with DHS's under secretary for 
management in October 2015, in which we expressed concern about HRIT's 
lack of progress, officials from the Offices of the Chief Human Capital 
Officer and Chief Information Officer stated that HRIT was asked by the 
deputy under secretary for management in late October 2015 to re-
evaluate the blueprint's strategic improvement opportunities and to 
determine the way forward for those improvement opportunities and the 
HRIT investment. However, officials did not know when this re-
evaluation and a determination for how to move forward with HRIT would 
occur, or be completed.
    Further, according to officials from the Office of the Chief 
Information Officer, DHS has not updated its complete systems inventory 
since it was originally developed as part of the blueprint effort, in 
response to a 2010 Office of Inspector General report that stated that 
DHS had not identified all human resource systems at the components. 
This report also emphasized that without an accurate inventory of human 
resource systems, DHS cannot determine whether components are using 
redundant systems.\19\ Moreover, the officials from the Office of the 
Chief Information Officer were unable to identify whether and how its 
inventory of human resources systems had changed.
---------------------------------------------------------------------------
    \19\ DHS Office of Inspector General, Management Oversight and 
Component Participation Are Necessary to Complete DHS' Human Resource 
Systems Consolidation Effort, OIG-10-99 (July 2010).
---------------------------------------------------------------------------
    Until DHS establishes time frames for re-evaluating the blueprint 
to reflect DHS's HRIT current priorities and updates its human 
resources system inventory, the Department will be limited in 
addressing the inefficient human resources environment that has plagued 
the Department since it was first created. As a result, we recommended 
that DHS establish time frames for re-evaluating the strategic 
improvement opportunities and associated projects in the blueprint and 
determining how to move forward with HRIT; evaluate the opportunities 
and projects to determine whether the goals of the blueprint are still 
valid and update the blueprint accordingly; and update and maintain the 
system inventory. DHS agreed with these recommendations and expects to 
address them by February 2016, April 2016, and October 2016, 
respectively.
selected palms capabilities have been deployed to headquarters and two 
components; but full implementation at four components is not currently 
                                planned
    As previously mentioned, PALMS is intended to provide an 
enterprise-wide system that offers performance management capabilities, 
as well as learning management capabilities to headquarters and each of 
its components. As such, DHS's headquarters PALMS program management 
office and the components estimate that, if fully implemented across 
DHS, PALMS's learning management capabilities would be used by 
approximately 309,360 users, and its performance management 
capabilities would be used by at least 217,758 users.\20\
---------------------------------------------------------------------------
    \20\ According to Federal Emergency Management Agency officials, 
the number of PALMS performance management users would be substantially 
higher if the system is able to accommodate the agency's performance 
management requirements for Reservists, which are a type of incident 
management responder, hired as temporary, intermittent employees.
---------------------------------------------------------------------------
    However, there is uncertainty about whether the PALMS system will 
be used enterprise-wide to accomplish these goals. Specifically, as of 
November 2015, of the 8 components and headquarters, 5 are planning to 
implement both PALMS's learning and performance management capabilities 
(3 of which have already implemented the learning management 
capabilities--discussed later), 2 are planning to implement only the 
learning management capabilities, and 2 components are not currently 
planning to implement either of these PALMS capabilities, as 
illustrated in figure 2. 


    Officials from the Federal Emergency Management Agency, U.S. 
Immigration and Customs Enforcement, the Transportation Security 
Administration, and the U.S. Coast Guard cited various reasons for why 
their components were not currently planning to fully implement PALMS, 
which include:
   Federal Emergency Management Agency and U.S. Immigration and 
        Customs Enforcement officials stated that they were not 
        currently planning to implement the performance management 
        capabilities because the program had experienced critical 
        deficiencies in meeting the performance management-related 
        requirements. Federal Emergency Management Agency officials 
        stated that they do not plan to make a decision on whether they 
        will or will not implement these performance management 
        capabilities until the vendor can demonstrate that the system 
        meets the agency's needs; as such, these officials were unable 
        to specify a date for when they plan to make that decision. 
        U.S. Immigration and Customs Enforcement officials also stated 
        that they do not plan to implement the performance management 
        capabilities of PALMS until the vendor can demonstrate that all 
        requirements have been met. PALMS headquarters officials 
        expected all requirements to be met by the vendor by the end of 
        February 2016.
   Transportation Security Administration officials stated that 
        they were waiting on the results of their fit-gap assessment 
        \21\ of PALMS before determining whether, from a cost and 
        technical perspective, the administration could commit to 
        implementing the learning and performance management 
        capabilities of PALMS. Administration officials expected the 
        fit-gap assessment to be completed by the end of March 2016.
---------------------------------------------------------------------------
    \21\ Before implementing PALMS, each component is completing a fit-
gap assessment to, among other things, identify any requirements and 
critical processes that cannot be met by the preconfigured, commercial 
off-the-shelf system. If such component-specific requirements are 
identified, the component must then decide whether to have the vendor 
customize the system.
---------------------------------------------------------------------------
   U.S. Coast Guard officials stated that, based on the PALMS 
        schedule delays experienced to date, they have little 
        confidence that the PALMS vendor could meet the component's 
        unique business requirements prior to the 2018 expiration of 
        the vendor's blanket purchase agreement. Additionally, these 
        officials stated that the system would not meet all of the 
        Coast Guard's learning management requirements, and likely 
        would not fully meet the performance management requirements 
        for all of its military components. Due to the component's 
        uncertainty, the officials were unable to specify when they 
        plan to ultimately decide on whether they will implement one or 
        both aspects of PALMS.
    As a result, it is unlikely that the Department will meet its goal 
of being an enterprise-wide system. Specifically, as of November 2015, 
the components estimate 179,360 users will use the learning management 
capabilities of PALMS (not the 309,360 expected, if fully implemented), 
and 123,200 users will use the performance management capabilities of 
PALMS (not the 217,758 expected, if fully implemented).
    Of the 7 components and headquarters that are currently planning to 
implement the learning and/or performance management aspects of PALMS, 
as of December 2015, 3 have completed their implementation efforts of 
the learning management capabilities and deployed these capabilities to 
users (deployed to U.S. Customs and Border Protection in July 2015, 
headquarters in October 2015, and the Federal Law Enforcement Training 
Center in December 2015); 2 have initiated their implementation efforts 
on one or both aspects, but not completed them; and 2 have not yet 
initiated any implementation efforts.
    As a result, PALMS's current trajectory is putting the Department 
at risk of not meeting its goals to perform efficient, accurate, and 
comprehensive tracking and reporting of training and performance 
management data across the enterprise; and consolidating its 9 learning 
management systems down to 1. Accordingly, until the Federal Emergency 
Management Agency decides whether it will implement the performance 
management capabilities of PALMS and the Coast Guard decides whether it 
will implement the learning and/or performance management capabilities 
of PALMS, the Department is at risk of implementing a solution that 
does not fully address its problems. Moreover, until DHS determines an 
alternative approach if one or both aspects of PALMS is deemed not 
feasible for U.S. Immigration and Customs Enforcement, the 
Transportation Security Administration, the Federal Emergency 
Management Agency, or the Coast Guard, the Department is at risk of not 
meeting its goal to enable enterprise-wide tracking and reporting of 
employee learning and performance management.
    We recommended that the Department establish a time frame for 
deciding whether PALMS will be fully deployed at the Federal Emergency 
Management Agency and the Coast Guard, and determine an alternative 
approach if the learning and/or performance management capabilities of 
PALMS are deemed not feasible for the Federal Emergency Management 
Agency, U.S. Immigration and Customs Enforcement, the Transportation 
Security Administration, or the Coast Guard. DHS concurred with our 
recommendation and stated that the PALMS program office will establish 
a time frame for a deployment decision of PALMS for these components.
     palms program had made mixed progress in implementing key it 
                       acquisition best practices
    According to GAO's Cost Estimating and Assessment Guide, having a 
complete life-cycle cost estimate is a critical element in the 
budgeting process that helps decision makers to evaluate resource 
requirements at milestones and other important decision points.\22\ 
Additionally, a comprehensive cost estimate should include both 
Government and contractor costs of the program over its full life 
cycle, from inception of the program through design, development, 
deployment, and operation and maintenance to retirement of the program.
---------------------------------------------------------------------------
    \22\ GAO-09-3SP.
---------------------------------------------------------------------------
    However, according to PALMS program management office officials, 
they did not develop a life-cycle cost estimate for PALMS. In 2012, DHS 
developed an independent Government cost estimate to determine the 
contractor-related costs to implement the PALMS system across the 
Department (estimated to be approximately $95 million); however, this 
estimate was not comprehensive because it did not include Government-
related costs. PALMS program office officials stated that PALMS did not 
develop a life-cycle cost estimate because the program is a Level 3 
acquisition program and DHS does not require such an estimate for a 
Level 3 program. However, while DHS acquisition policy does not require 
a life-cycle cost estimate for a program of this size, we maintain that 
such an estimate should be prepared because of the program's risk and 
troubled history. Without developing a comprehensive life-cycle cost 
estimate, DHS is limited in making future budget decisions related to 
PALMS.
    Accordingly, we recommended that the Department develop a 
comprehensive life-cycle cost estimate, including all Government and 
contractor costs, for the PALMS program. DHS concurred with our 
recommendation and stated that, by May 30, 2016, the PALMS program 
office will update the program's cost estimate to include all 
Government and contractor costs.
PALMS's Schedule Was Incomplete and Inaccurate
    As described in GAO's Schedule Assessment Guide, a program's 
integrated master schedule is a comprehensive plan of all Government 
and contractor work that must be performed to successfully complete the 
program. Additionally, such a schedule helps manage program schedule 
dependencies.\23\ Best practices for developing and maintaining this 
schedule include, among other things, capturing all activities needed 
to do the work and reviewing the schedule after each update to ensure 
the schedule is complete and accurate.
---------------------------------------------------------------------------
    \23\ GAO-16-89G.
---------------------------------------------------------------------------
    While DHS had developed an integrated master schedule with the 
PALMS vendor, it did not appropriately maintain this schedule. 
Specifically, the program's schedule was incomplete and inaccurate. For 
example, while DHS's original August 2012 schedule planned to fully 
deploy both the learning and performance management capabilities in one 
release at each component by March 2015, the program's September 2015 
schedule did not reflect the significant change in PALMS's deployment 
strategy and time frames. Specifically, the program now plans to deploy 
the learning management capabilities first and the performance 
management capabilities separately and incrementally to headquarters 
and the components. However, the September 2015 schedule reflected the 
deployment-related milestones (per component) for only the learning 
management capabilities and did not include the deployment-related 
milestones for the performance management capabilities.
    In September 2015, PALMS officials stated that the deployments 
related to performance management were not reflected in the program's 
schedule because the components had not yet determined when they would 
deploy these capabilities. Since then 2 components have determined 
their planned dates for deploying these capabilities, but 7 (including 
headquarters) remain unknown. As a result, the program does not know 
when PALMS will be fully implemented at all components with all 
capabilities.
    Moreover, the schedule did not include all Government-specific 
activities, including tasks for employee union activities (such as 
notifying employee unions and bargaining with them, where necessary) 
related to the proposed implementation of the performance management 
capabilities.\24\
---------------------------------------------------------------------------
    \24\ In accordance with Title 5, Chapter 71 of the United States 
Code, implementing regulations and relevant Executive Order, Federal 
agencies are to notify their unions and offer them the opportunity to 
negotiate on policies and practices that would affect working 
conditions. As such, each DHS component must determine whether 
implementing PALMS would affect working conditions and, if so, notify 
their unions.
---------------------------------------------------------------------------
    Without developing and maintaining a single comprehensive schedule 
that fully integrates all Government and contractor activities, and 
includes all planned deployment milestones related to performance 
management, DHS is limited in monitoring and overseeing the 
implementation of PALMS, and managing the dependencies between program 
tasks and milestones to ensure that it delivers capabilities when 
expected. Consequently, we recommended that DHS develop and maintain a 
single comprehensive schedule. DHS agreed and stated that, by May 30, 
2016, the PALMS program office will develop and maintain a single, 
comprehensive schedule that includes all Government and contractor 
activities, and all planned milestones related to deploying the PALMS 
system's performance management capabilities.
The PALMS Program Management Office Did Not Monitor Total Costs
    According to CMMI-ACQ and the PMBOK Guide, a key activity for 
tracking a program's performance is monitoring the project's costs by 
comparing actual costs to the cost estimate.\25\ The PALMS program 
management office--which is responsible for overseeing the PALMS 
implementation projects across DHS, including all of its components--
monitored task order expenditures on a monthly basis. As of December 
2015, DHS officials reported that they had issued approximately $18 
million in task orders to the vendor.
---------------------------------------------------------------------------
    \25\ CMMI-ACQ, Project Monitoring and Control Process Area, and the 
PMBOK Guide, Project Cost Management.
---------------------------------------------------------------------------
    However, the program management office officials stated that they 
were not monitoring the Government-related costs associated with each 
of the PALMS implementations. The officials stated that they were not 
tracking Government-related implementation costs at headquarters 
because many of the headquarters program officials concurrently work on 
other acquisition projects and these officials are not required to 
track the amount of time spent working specifically on PALMS. The 
officials also said that they were not monitoring the Government-
related costs for each of the component PALMS implementation projects 
because it would be difficult to obtain and verify the cost data 
provided by the components. We acknowledge the Department's 
difficulties associated with obtaining and verifying component cost 
data; however, monitoring the program's costs is essential to keeping 
costs on track and alerting management of potential cost overruns. As 
such, we recommended that DHS track and monitor all costs associated 
with the PALMS program. DHS concurred with our recommendation and 
stated that it plans to have the PALMS program office track and monitor 
all costs associated with the PALMS program by March 30, 2016.
    In summary, although the HRIT investment was initiated about 12 
years ago with the intent to consolidate, integrate, and modernize the 
Department's human resources IT infrastructure, DHS has made very 
limited progress in achieving these goals. HRIT's minimally involved 
executive steering committee during a time when significant problems 
were occurring was a key factor in the lack of progress. Moreover, 
DHS's lack of use of program management best practices for HRIT and 
PALMS also contributed to the neglect this investment has experienced.
    Implementing our recommendations is critical to the Department 
addressing its fragmented and duplicative human resources environment 
that is hindering the Department's ability to efficiently and 
effectively perform its mission.
    Chairman Perry, Ranking Member Watson Coleman, and Members of the 
subcommittee, this concludes my prepared statement. I would be pleased 
to respond to any questions that you may have.

    Mr. Perry. Thank you, Ms. Cha.
    The Chair now recognizes Mr. Fulghum for his opening 
statement.

     STATEMENT OF CHIP FULGHUM, DEPUTY UNDER SECRETARY FOR 
        MANAGEMENT, U.S. DEPARTMENT OF HOMELAND SECURITY

    Mr. Fulghum. Chairman Perry, Ranking Member Watson Coleman, 
distinguished Members of the committee, thank you for the 
opportunity to be here today.
    I had a written statement that I was ready to read to you, 
but I have dispelled with that and we will just get right down 
to what I believe the 4 basic issues are here.
    First and foremost, I agree with GAO. We agreed with every 
recommendation and we appreciate the work that they have done 
on this program to continue to help make the Department 
stronger.
    We have already implemented many of the recommendations as 
the audit was on-going. I and the under secretary for 
management are accountable for seeing them through.
    Second, clearly there is missed opportunity here. There is 
no doubt about it, she has documented that, we agree with that. 
It was an aggressive schedule, not fully baked-out requirements 
as well as some poor documentation. But we did, and I want to 
underscore this, we did deliver capability.
    Since 2009, we have spent $90 million on this program. Here 
is what we got for that $90 million: We got an access business 
intelligence tool that is critical to better analysis and 
decision making in the Department. We have spent $18 million on 
PALMS to get it up and running. We have a medical case 
management system for Workmans Compensation to help process 
cases faster.
    We have spent $10 million on a balanced workforce tool that 
will allow us to make better decisions when looking to whether 
to insource or outsource a particular function. All the while 
while we were continuing to sustain programs that we had 
previously invested in with the money that we have received.
    Two years ago, we made an evaluation of the overall HRIT 
program and we decided to stop the overall program to focus on 
PALMS. But let me be clear, we did not document that well and 
we did not particularly as it relates to the ESC.
    However, we had regular engagements with key members of the 
ESC, to include the CPO of the Department, the chief 
information officer, the chief financial officer, as well as 
the chief human capital officer, to focus on making sure we 
delivered PALMS successfully. That program is now being 
implemented across the Department. By the end of fiscal year 
2016 we will either have it implemented or a decision made on 
the remaining components.
    Fourth, moving forward, an Acquisition Review Board was 
held in December and directed the following actions. First of 
all, we have moved the program from the chief human capital 
officer to the chief information officer, with a new chief 
acquisition executive as well as new program management.
    We have reinvigorated the ESC; I attended the first one 
myself and gave the ESC clear direction on what our 
expectations are moving forward. We have already had a second 
one. I believe that body met yesterday.
    We plan to re-baseline and reevaluate the road map and the 
strategy that was outlined by GAO. We will then work through 
the ESC to the Joint Requirements Council to make sure we are 
solving the right problems and making sure that we are solving 
them in a way that best meets the mission of the Department. We 
will also have quarterly Acquisition Review Board reviews of 
this program.
    Finally, I am confident that we have the right leadership 
in place, in particular with the lady sitting beside me, to get 
this program on the right track to solve her needs and the 
Department's needs.
    We will do that by building on what we have done, leverage 
technology and best practices throughout the Department, better 
business intelligence, consistent data management and smart, 
integrated consolidation where it makes good business sense.
    Thank you, and I stand ready to answer your questions.
    [The joint prepared statement of Mr. Fulghum and Ms. Bailey 
follows:]
       Joint Prepared Statement of Chip Fulghum and Angela Bailey
                           February 25, 2016
    Chairman Perry, Ranking Member Watson Coleman, and other 
distinguished Members of the subcommittee, thank you for the 
opportunity to appear today to discuss the Human Resource Information 
Technology (HRIT) program at DHS. My comments will focus on our 
progress in addressing GAO's recommendations on HRIT.
    We wish to express appreciation to our colleagues from the 
Government Accountability Office (GAO) for their long-standing and 
dedicated work in support of strengthening management functions at DHS. 
Over the past several years, we have forged an excellent working 
relationship with GAO and have reached common ground on many issues.
    In April 2015, I testified before this committee, noting that the 
Department has worked diligently to improve its acquisition processes. 
These efforts have produced more effective governance and significant 
improvements to the future and health of current acquisitions. I also 
noted that the Acquisition Review Board (ARB) has increased its 
oversight reach and has taken action to cancel or pause several poor-
performing or higher-risk programs that were not achieving the pre-
established cost, schedule, and performance goals.
    We have continued our progress since April 2015, holding 27 action-
oriented acquisition review boards for major acquisition programs. As 
of December 31, 2015 all major acquisition program documentation was 
approved, fully addressing GAO High Risk Outcome No. 1. Moreover, the 
Acquisition Management Directive, revision 03 of MD 102-01, was signed 
by the Under Secretary for Management on July 28, 2015. This revision 
was updated to include critical touch points to the Secretary's Joint 
Requirements Council.
    It is now almost 1 year later and our work to increase oversight 
continues to yield key decisions based on the performance of programs. 
This includes our decision to pause the HRIT Executive Steering 
Committee's management and oversight of the HRIT investment in order to 
address challenges associated with the Department's effort to deploy a 
centralized Performance and Learning Management System (PALMS). As 
noted by GAO, DHS agrees that very little progress has been made in 
implementing the HRIT investment in the last several years beyond the 
focus on the PALMS implementation.
    On January 15, 2010, DHS established an executive steering 
committee that included all DHS components, led by the OCIO and OCHCO, 
to rationalize legacy human resource processes and systems into a 
common, Department-wide architecture. At that time, DHS prohibited 
spending to enhance existing human resource systems or to purchase new 
human resource solutions unless approved by the OCIO and the OCHCO. The 
newly formed Executive Steering Committee (ESC) approved the long-term 
strategic plan for HRIT through a Human Capital Segment Architecture 
(HCSA) study, completed in 2011. The HRIT program, under the guidance 
of the ESC, delivered a user-friendly interface with the National 
Finance Center's (NFC) payroll/personnel system for processing 
personnel actions, such as promotions and awards with ``EmpowHR'', a 
time and attendance system with ``webTA'', payroll services with the 
deployment of ``National Finance Center Corporate'', and an electronic 
official personnel file system called ``eOPF''. Additional solutions 
delivered under the ESC guidance includes a Balanced Workforce 
Assessment Tool, the Medical Case Management System, the data 
management Human Capital Analytics Intelligence system (AXIS) and an 
enterprise learning management system called Performance and Learning 
Management System (PALMS).
    PALMS was established to consolidate 9 component-based learning 
management systems and to integrate employee performance management 
requirements into a single Department-wide solution. During the 
deployment of PALMS in the fourth quarter of 2014, DHS Chief 
Information Officer Luke McCormack asked to slow down implementation in 
order to address unexpected challenges with the contract to buy this 
capability as a service. I concurred with the OCIO's decision to 
remediate the PALMS implementation issues, in order to lower the risk 
and associated costs of an implementation that was not on track to meet 
the Department's needs. During this slow down, the HRIT program 
management office addressed concerns with the initial operating 
capability meeting the requirements of the program and worked with the 
Office of the Chief Procurement Officer to ensure timely and effective 
delivery. DHS withheld payment from the vendor until requirements were 
achieved, and DHS executed no-cost extensions until contract 
requirements were met, providing several cure notices to the vendor due 
to non-performance.
    Since addressing the challenges that caused the slowdown, the 
training portion of the PALMS system has been successfully deployed: At 
Customs and Border Protection in July 2015; for DHS Headquarters 
components in October 2015; and most recently at the Federal Law 
Enforcement Training Center (FLETC) in December 2015. In total there 
are over 350,000 learning management system course completions. U.S. 
Citizenship and Immigration Services and Immigration and Customs 
Enforcement are scheduled for deployment in the third quarter of fiscal 
year 2016 and the U.S. Secret Service is scheduled for deployment in 
the fourth quarter of fiscal year 2016. The Transportation Security 
Administration, Federal Emergency Management Agency, and the U.S. Coast 
Guard are performing their analysis and are on schedule for an 
implementation decision by April 30, 2016.
    DHS has moved forward with implementing the performance management 
capabilities in PALMS, conducting an initial pilot within DHS OCIO. 
Barring any unforeseen challenges in meeting the requirements, this 
portion of the project remains on track for implementation.
    DHS agrees with GAO's 14 recommendations to strengthen and improve 
HRIT and had already begun to take corrective actions to address the 
program's management, oversight, and progress. In their report, GAO 
noted that during the 2014 and 2015 period, the oversight and 
management of the overall HRIT portfolio of programs and strategic 
improvement opportunities became a secondary focus and suffered. During 
this period, opportunities for further consolidation and efficiency 
were not addressed. DHS agrees more could have been done to provide 
oversight of the HRIT program during the 2014 and 2015 period. Between 
2010 and 2016, the annual appropriated funding to continue work on 
strategic improvement declined. This decline was due in part due to a 
poor budget justification leaving only $7.778 million in fiscal year 
2016 which is only sufficient to cover the implementation of PALMS as 
currently defined.
    Recognizing the challenges in the investment/program, I convened an 
Acquisition Review Board on December 22, 2015, to begin to provide an 
enhanced focus on HRIT. On January 21, 2016, the under secretary for 
management issued an Acquisition Decision Memorandum (ADM) that 
initiated several actions, the first of which was to move the oversight 
of the HRIT investment from the OCHCO to the OCIO which occurred on 
January 29, 2016. The second major action was to reestablish the 
Executive Steering Committee (ESC), which met on February 4, 2016.
    OCIO is working closely with OCHCO, through the ESC and under the 
guidance of the DHS Acquisition Review Board, to ensure the investment 
continues to address the remaining ADM actions and to deliver the 
fundamental goals of the HRIT program.
    The HRIT ESC will work to ensure the original intent of the 2011 
Human Capital Segment Architecture (HCSA) study is: (1) Still valid/
supported through the Joint Requirements Council; and (2) implemented 
to optimize HRIT capabilities to support efficient human resources 
processes across DHS. In this regard the focus is on: Improving the 
transparency, accountability, and efficiency of HRIT services; 
strengthening and unifying our ability to collect and share actionable 
enterprise HR information in support of DHS's mission; and enhancing 
operational support for enterprise human resources systems and service 
delivery across DHS.
    Continuing the HRIT investment is critical to reducing redundancies 
and increasing the efficient and effective functionality of human 
resources systems across the Enterprise. We appreciate GAO's insight 
into this investment and are working to strengthen oversight for HRIT.

    Mr. Perry. Thank you, Mr. Fulghum.
    The Chair now recognizes Ms. Bailey for her opening 
statement.

 STATEMENT OF ANGELA BAILEY, CHIEF HUMAN CAPITAL OFFICER, U.S. 
                DEPARTMENT OF HOMELAND SECURITY

    Ms. Bailey. Good morning, Chairman Perry, Ranking Member 
Watson Coleman, and distinguished Members of the subcommittee, 
thank you for the opportunity to appear today to discuss human 
resources information technology at the Department.
    To underscore what the deputy under secretary said, the 
under secretary, deputy under secretary, chief information 
officer and I are committed to undertaking concrete steps to 
address the Human Resource Information Technology Program 
management oversight and progress.
    As I stated in my recent response to Congressman Thompson 
and Ranking Member Watson Coleman, my office is working very 
closely with the Office of the Chief Information Officer. 
Effective January 29, the under secretary for management 
directed the realignment of resources and placement of 
operational control and program oversight of HRIT management 
functions under the CIO, to include detailing HRIT personnel to 
them.
    This realignment was essential for the Department to 
address 12 of the GAO's 14 recommendations concerning 
management of the HRIT investment schedule, budget, cost, risk, 
and strategic investment opportunities.
    In addition, the direction of the under secretary for 
management, the chief information officer and I co-chair the 
quarterly meetings of the HRIT Executive Steering Committee 
which last met on February 4 and just yesterday.
    I want to stress that while we have a requirement to meet 
quarterly, the CIO and I are committed to meeting as often as 
necessary. Right now, we believe that is pretty much every 
other week.
    At these meetings, the group, the very first meeting we 
had, we discussed the GAO's recommendations, a time line to 
revise the ESC's charter, initiated a review of the current and 
the future strategic investment opportunities, discussed the 
challenges and next steps in the on-going roll-out of the 
Department's leading HRIT investment, which is PALMS, and 
working through the HRIT ESC and under the guidance of the DHS 
Acquisition Review Board and the DHS Joint Requirements 
Council. We will continue to address the remaining actions in 
the GAO report to ensure DHS meets the fundamental goals of the 
HRIT investment.
    We clearly have work to do and we are leaning forward to 
implement 2 of our top priorities, which is data management and 
business intelligence strategies that we believe actually will 
make a difference. We are going to do so by solving the right 
problems of today, and that means a re-validation of our 
original blueprint and architecture, going back and making sure 
that it actually is solving what problems we are facing today, 
as well as having an eye towards the integration of systems and 
leveraging what already exists.
    I thank you for your leadership and your continued support 
of the Department of Homeland Security and its management's 
programs. I look forward to working together and shaping the 
future and success of DHS.
    I am happy to answer any questions you may have.
    Mr. Perry. Thank you, Ms. Bailey.
    The Chair now recognizes himself for 5 minutes of 
questioning.
    Ms. Cha, is HRIT one of the most mismanaged, highest-risk 
IT programs in the Federal Government? If so, how long has it 
been designated as such?
    Ms. Cha. Mr. Chairman, we have identified HRIT as one of 
the top 10 major IT programs across the Federal Government in 
need of most attention. We did this and we designated this as 
such as part of our latest GAO High-risk Update, which was 
issued February of last year.
    Mr. Perry. February of last year?
    Ms. Cha. That is correct. That was based on the findings 
that we were identifying through the current audit that we were 
doing for you.
    Mr. Perry. Okay.
    Mr. Fulghum, DHS has transferred responsibility for HRIT 
back and forth between Office of the Chief Information Officer 
and Office of the Chief Human Capital Officer multiple times. I 
know Ms. Bailey just went through it. Specifically in 2003, 
OCHCO was assigned responsibility, we call that the OCHCO, it 
was transferred to the OCIO in 2004, it was shifted back to the 
OCHCO in 2009, and as of this month that responsibility is back 
with the OCIO.
    What the hell is going on over there? I mean, is this like, 
you know, hot potato, nobody wants to deal with this thing? Why 
is it going to be any different now than it has been these 
other times?
    Mr. Fulghum. So here is what I will say. First of all, we 
have got what I believe is the right leadership in CIO in terms 
of the information technology expertise that they have.
    They have demonstrated the ability to turn around programs 
like this in the past, while at the same time her job is to 
make sure that they are doing the right thing from a 
requirements perspective to, as she said, solve the right 
problems.
    Mr. Perry. So did we not have the right leadership before 
or the capability? She is 2 weeks on the job, right?
    Mr. Fulghum. Right.
    Mr. Perry. Okay. So what was----
    Mr. Fulghum. But she has got 35 years of experience.
    Mr. Perry. I understand. But what was happening before she 
showed up? Because Ms. Cha said this has been identified for 
over a year now.
    Mr. Fulghum. So what I would tell you, for the past 2 years 
what we have been focused on and focused on solely is 
delivering PALMS. We stopped the investment, any new investment 
in the rest of that portfolio to focus on PALMS.
    As I think she noted, we have had program management 
turnover, which has not helped the problem, but we have got the 
right program management in there now. If we can sustain them 
by keeping them there, we will make progress. I am confident of 
that.
    Mr. Perry. All right. Let me carry on here a little bit. In 
2010, the DHS Office of Inspector General, the OIG, reported 
that DHS made limited progress on the Human Resource 
Information Technology, HRIT, investment because of, among 
other things, a lack of commitment from DHS's components.
    Now GAO is reporting that HRIT has failed because of a lack 
of commitment by DHS oversight officials after almost 13 years. 
This has been a long time.
    You served at the command level, you are an O-6, you are in 
the business of issuing orders and executing and 
accountability. A lack of commitment.
    So you have got 22 directorates that are working underneath 
you, right, and you say this is our program. We have just asked 
the United States Congress, the taxpayers to pay $180 million 
to roll this thing out, bring everybody in, and somebody says 
we are not going to do it, right, that is a lack of commitment, 
or they just kind of slow roll it.
    You have been there for, what, 3 years and about 5 months 
or something, about 3\1/2\ years, is that right, in this 
position?
    Mr. Fulghum. I have been in this position for a little less 
than a year.
    Mr. Perry. Little less than a year, but prior to that you 
have been----
    Mr. Fulghum. I was a part of the Department.
    Mr. Perry. You have been part of even the budget process 
and so on and so forth, right?
    Mr. Fulghum. Yes, sir.
    Mr. Perry. There is no lack of commitment, you issue 
orders. If you don't want to commit to it, go get another job, 
right? This is taxpayers' money. We don't just send $180 
million to 22 different directorates and say, hey, knock 
yourself out, I hope you come back with something.
    I looked at the schedule from the GAO here. Page 1, 
essentially the first page past the opening, 1 through 14, 
completion expected, current expected completion date, 1 
through 14 out of 1 through 15, 1 through 14 unknown.
    Sir, you have issued suspenses, time on target. I don't 
need to go through this with you. But you know what is 
expected. Why is there a lack of commitment? How does that 
happen? Who says no and gets away with it? Tell me, I really 
want to know.
    Mr. Fulghum. So what I will tell you is that at the ESC 
that we just had, there was very clear direction given and I 
expect that that will be carried out.
    Mr. Perry. Well, for the love of God, Mr. Fulghum, this is 
like 10 years on, $180 million pissed away. Really?
    Mr. Fulghum. I would again go back to what I said in my 
opening statement about the $90 million we have spent. It was 
not pissed away.
    Mr. Perry. I have got 14 out of 15 no known time when it is 
going to be complete.
    Mr. Fulghum. What I would say to that is, No. 1, we poorly 
documented the work we have done. If you go look at the 
blueprint and you go look at the SIOs and the recommendations, 
many of those are about process, policy, and training, much of 
which we have done, we just didn't document it.
    Mr. Perry. Well, we will see what GAO says throughout the 
course of this, but I suspect they might differ.
    But with all due respect, we will move on. I am past my 
time, so the Chair now recognizes Ms. Watson Coleman from New 
Jersey.
    Mrs. Watson Coleman. Thank you, Mr. Chairman.
    I want to talk about the Steering Committee, or the ESO?
    Mr. Fulghum. ESC.
    Mrs. Watson Coleman. ESC, because Ms. Cha's recommendation 
is that that committee convenes on a monthly basis.
    Ms. Bailey, you indicated that the proposal is to meet 
every 3 months.
    It seems to me that part of the issue with the failure to 
implement and document is that whatever entity was overseeing 
this was not holding anybody else accountable to whatever the 
time frame should have been.
    It would seem to me that since things are so critical right 
now, you would want that entity to be much more aggressive, 
much more interactive, much more meeting more regularly and 
then having a discussion down the line as to who is not doing 
what and when they can expect to have it. Because it seems to 
me that there has been tremendous lack of, Chairman said, 
commitment, I am saying minimal accountability.
    So why are you proposing 3 months when GAO is proposing a 
monthly meeting and oversight?
    Ms. Bailey. I am actually--I want to correct something if I 
misspoke earlier. I am not trying to propose a quarterly 
meeting. It is just that was the minimum requirement that was 
actually identified I think in the acquisition decision 
memorandum.
    However, the CIO and I have absolutely agreed that we need 
to meet far more often. In fact, we have already met twice. The 
CIO and I talk almost daily. In fact, yesterday after the ESC 
meeting we had a follow-on meeting with regard to the status 
and implementation of PALMS specifically.
    So you have my commitment that we are----
    Mrs. Watson Coleman. You two are the co-chairs of the 
committee, right? Of the----
    Ms. Bailey. Myself and the CIO.
    Mrs. Watson Coleman. Yes.
    Ms. Bailey. Yes.
    Mrs. Watson Coleman. Then who else is on that, how many 
other people?
    Ms. Bailey. We have all of the components.
    Mrs. Watson Coleman. Meaning?
    Ms. Bailey. CHCOs, CIOs, and the chief learning officers, 
because sometimes they are not necessarily within the CHCO 
office. So we have full representation of both the CIO 
community and the CHCO community.
    Mrs. Watson Coleman. So after your discussions, your 
meetings, what is it that happens as a result of that, that 
something gets translated down, some accountability is shared 
through the system?
    Ms. Bailey. Yes, absolutely. One of the first things that 
we do is we take minutes of everything that we have discussed. 
We have a complete action plan. We go through it and we make 
sure that every milestone, on a weekly basis, we go through and 
identify which particular milestones that are due that week, 
what is due the following week, what challenges and barriers do 
we have, what do we need from a resource commitment, where do 
we need to go from an acquisition strategy and what is the 
smartest way to go about this from an IT standpoint?
    So between the two offices we have, it is clearly 
identified that we are both--I want to make sure that everybody 
understands this. This is not a hand-off of the CHCO community 
just over to the CIO and we wash our hands of it. We still 
within the H.R. community have a fundamental responsibility to 
make sure that whatever it is that we are doing, that we are 
asking the IT, the CIO to deliver, actually delivers and solves 
the right problem on behalf of the H.R. community. We are not 
relinquishing that responsibility whatsoever.
    Mrs. Watson Coleman. I wasn't suggesting that you were 
relinquishing anything. My concern is whether or not there is 
follow-up and accountability.
    Ms. Bailey. Absolutely.
    Mrs. Watson Coleman. Because it seems to me that for a 
number of years you all have been doing--I am not suggesting 
that this is not a very busy department with very serious 
mandates, but it just seems to me that this is so vitally 
important to ensuring that there is consistency and that you 
have what you need and you need what you have and you know what 
you have to go after. You have not sort-of met that mandate.
    I want to speak to this whole issue of the Performance and 
Learning Management Systems.
    Because, Mr. Fulghum, you suggested in your remarks that 
this was implemented across the Department. In some of my 
briefing materials, there was an indication that there were 
certain components which were resistant to using this.
    So my question is: Is this something that should be 
uniformly applied across the Department because it ensures 
consistency and certain standards? And (B), what is it that we 
plan to do or you plan to do to ensure that it is followed 
through on at the component level?
    Mr. Fulghum. Okay, a couple of things. I may have misspoke, 
I want to be clear about what I said about PALMS. PALMS is not 
implemented across the Department, so I want to be clear about 
that.
    We have a schedule for several components to come on-board 
by the end of the fiscal year. There are, I think, 3 components 
left that need to make a decision whether PALMS makes sense for 
them, from both an operational perspective as well as from a 
business perspective. We plan to have that done by 30 April.
    Mrs. Watson Coleman. So if they decide that it doesn't work 
for them, do they get to do something entirely different?
    Mr. Fulghum. It is not them deciding, it is the Department 
looking at what their unique operational needs are as well as 
their business needs and then the Department making a 
determination as to whether or not they use the system or not.
    Mrs. Watson Coleman. What is the goal of PALMS? What is it 
that why would you want this Performance and Learning 
Management Systems? What does it tell you or provide you?
    Mr. Fulghum. So it provides a platform to provide education 
and training courses throughout the Department. The performance 
management piece is really about automating that process of 
documenting performance appraisals, the whole performance 
management.
    Mrs. Watson Coleman. So my time is expired, but it just 
seems to me that I don't understand how a Department could 
determine that something that raises these issues and answers 
these questions wouldn't be applicable to their needs.
    Thank you, Mr. Chairman.
    Mr. Perry. The Chair thanks the gentlelady.
    The Chair now recognizes the gentleman from Georgia, Mr. 
Loudermilk.
    Mr. Loudermilk. Thank you, Mr. Chairman.
    I will tell you, I am very concerned here from coming from 
several backgrounds. I was Air Force as well, worked in the 
intelligence community, had an SEI security clearance when I 
was a young man.
    But I also spent 30 years in the IT sector. There are 
several aspects of this report that are gravely concerning to 
me. I have so many questions, I really don't even know where to 
start.
    But based off Ms. Watson Coleman's question, I would like 
to kind of continue that thought on PALMS.
    You said that PALMS is an education and training system, is 
that correct?
    Mr. Fulghum. It provides education and training courses.
    Mr. Loudermilk. Is that the extent of it?
    Mr. Fulghum. That is a piece of it, yes. It also tracks the 
training that has been completed, things of that nature, yes.
    Mr. Loudermilk. Why did you prioritize PALMS as the project 
to focus on? When you read the report, of all the other issues, 
several of which, from looking at it from this report, PALMS 
would probably, in my estimation, be the least critical of 
those systems, why did you prioritize PALMS?
    Mr. Fulghum. We believed it was important to the Department 
to get a consistent approach to how we delivered education and 
training.
    Mr. Loudermilk. So you felt that was more important than 
actually knowing who is an employee of the Department of 
Homeland Security?
    As I read the report here, it says that really the 
dysfunction of what you have is that your fragmented and 
outdated human resource systems, you can't even actually track 
who is--you don't have accurate information on who is employed, 
who is working for the Department of Homeland Security.
    You saw that PALMS, though, was more important than 
addressing those issues.
    Mr. Fulghum. So I would say a couple of things. No. 1, that 
is why we are re-validating the framework and the strategy 
going forward, and we are going to do that very rapidly.
    No. 2, I still believe PALMS was important, yes.
    Mr. Loudermilk. Okay, but it is more important than 
actually knowing details of who is current in Department of 
Homeland Security?
    Mr. Fulghum. So I think that is more about access than it 
is about knowing who is in the Department. We know who is in 
the Department. I am not quite following you.
    Mr. Loudermilk. Okay, well, let me shift a little. Let me 
read what the report says. For example, the Department of 
Homeland Security reported that it did not have information on 
all its employees, which reduced its ability to manage its 
personnel, and this is the part that concerns me the most, or 
deploy the right people to meet a particular mission.
    Now, that tells me you don't have all the information that 
you need about someone.
    Mr. Fulghum. So I think what we are talking about is access 
to that information. One of the things that HRIT did deliver 
was business intelligence, so that regardless of the system 
that you have out and the components, you have the ability to 
pull that information out.
    It is not fully developed yet, but it does provide us 
capability. We have got to continue to build out that business 
intelligence capability to pull out the information we need.
    One of the things I would like to say, as far as systems go 
and consolidation of systems, we have done that in the 
Department before where we have tried to go build what I call 
big-bang systems. We did it in financials, we tried it twice 
with financial systems. It didn't work.
    What we have determined is that we need to consolidate 
where we can consolidate and then put business intelligence on 
top of it to give us the information we need, which is one of 
the things that HRIT did deliver in terms of the access tool 
that we built.
    Mr. Loudermilk. Okay. So what you are indicating is PALMS 
is providing the information that you need to adequately deploy 
the right people to the right mission.
    Mr. Fulghum. That is not what I said. What I said was what 
you are talking about is about access to information.
    Mr. Loudermilk. Right.
    Mr. Fulghum. What we need to do is build business 
intelligence to get to that information, which is one of the 
things that HRIT did deliver. That is what I was trying to say.
    Mr. Loudermilk. Okay. I am still not sure why PALMS was the 
priority that you focused everything on.
    One other thing. Mr. Chairman, are we going to have another 
round of questioning? Is that possible? Okay, I will save a 
couple.
    But to Ms. Cha, I am also on the Science, Space, and 
Technology Committee, a chair of the Oversight Subcommittee, 
the sister committee to this. We had a hearing right after the 
OPM data breach, a devastating incident to our country. I asked 
your counterpart, if he was to rate the cybersecurity risk or 
just rate what the Federal Government's current security status 
is on an elementary school grading level, what would you give 
the Federal Government, and his response was D minus.
    One of the reasons was because of fragmented systems, 
multiple management and no one being in control. What would 
you, just from what you know, rate the current status from a 
security standpoint of the Department of Homeland Security's IT 
systems?
    Ms. Cha. Unfortunately, sir, I am not the best expert to 
provide you with that response. The scope of the review that we 
evaluated for HRIT was focused on the management of the 
program. We did not look at the security protocols or the state 
of security for the Department's H.R. environment or the state 
of DHS's IT systems in general.
    Mr. Loudermilk. Well, let me ask you this, if I may, Mr. 
Chairman.
    Because of the issues with the system, does DHS, because I 
assume that the majority of people in DHS have some level of 
security clearance, which gives them access to Classified 
information, is there a risk that someone who should not have 
access will have access because maybe their security has been 
pulled, maybe they are on disciplinary action, but because the 
system is nonfunctional at this point, are we at risk there?
    Ms. Cha. Yes, I do believe that a risk does exist. The 
reason why I say that is because at this time, as I mentioned 
earlier, at the time that DHS identified 422 fragmented systems 
and applications within their H.R. environment, that study was 
done in 2011. Currently, DHS does not know the state of that 
422-system inventory.
    So until the Department updates that inventory, it could be 
more, it could be less. But until they get a full handle of the 
total number of systems in that inventory, a risk exists.
    Mr. Loudermilk. Thank you, Mr. Chairman. I yield back.
    Mr. Perry. The Chair thanks the gentleman.
    The Chair now recognizes the gentleman from Louisiana, Mr. 
Richmond.
    Mr. Richmond. Let me just comment that it appears that we 
just have an inability to get it done. I guess in my effort to 
figure out how we just get to progress or competency, have you 
all even explored the possibility of using shared services, 
like the National Finance Center?
    Mr. Fulghum. So we do use the National Finance Center for 
payroll.
    Mr. Richmond. Well, why don't you use them for H.R.?
    Mr. Fulghum. So as a part of reevaluating the road map and 
strategy, that is absolutely a part of what we are going to 
look at, shared services where it makes sense, just like we 
have done in financial management.
    Mr. Richmond. Well, how is your payroll going? Are you 
satisfied with the National Finance Center, how they do 
payroll?
    Mr. Fulghum. They do a good job.
    Mr. Richmond. Well, they are interested in doing your H.R. 
I don't know if they have contacted you, but they met with me 
to say we don't understand why DHS won't let us do their H.R. 
because we think we can do it better than them, we think we can 
do it for a lower cost than they do it.
    Now, let me--full disclosure, the National Finance Center 
is located in my district. They employ a bunch of people. But 
they do payroll for over 650,000 people in the Federal 
Government and now they do H.R. Everybody is happy with them.
    So it would just seem to me that, look, we can try to get 
it right, but if we have people who do it and they are part of 
the Federal Government, then we might want to really look at 
seeing if we can't get together and figure out a way that they 
can help you all, because at the end of the day we just want it 
to work.
    Whether it is the National Finance Center or someone else 
doesn't matter as much as the fact that it has to get done.
    I would just encourage you to at least entertain the 
director of the National Finance Center and see if you all 
can't find some understanding if they can help or if they can't 
help. But at least what they advocate to me is that they think 
they can solve your problems. If they can solve your problems, 
then let us use them.
    But I would love to hear your thoughts on it.
    Mr. Fulghum. I absolutely support the use of shared 
services. As I said before, that is exactly what we are doing 
with our financial systems modernization is leveraging the work 
and the systems that are in place at places like DOI. So we are 
absolutely open to doing that.
    Mr. Richmond. Thank you, and I will yield back.
    Mr. Perry. The Chair thanks the gentleman.
    The Chair now recognizes the gentleman from Georgia, Mr. 
Carter.
    Mr. Carter. Thank you, Mr. Chairman.
    Ladies and gentlemen, I hope you understand why this is so 
concerning to us. I mean, this is very, very disturbing.
    The General Accounting Office said, ``The Department does 
not have information on all its employees, which reduces its 
ability to strategically manage its workforce and best deploy 
people in support of homeland security missions.'' That is from 
the GAO.
    You can imagine how concerning that is to us, especially 
when we talk about internal threats. We are talking about the 
Department of Homeland Security. We are talking about the 
people that we put our faith in, that we are depending on.
    Mr. Fulghum, how can the Department of Homeland Security 
vet effectively and identify individuals that may have links to 
terrorism when you don't have all the information on your 
employees? How can you do that?
    Mr. Fulghum. Again, I believe we are talking about access 
to certain information at the Department level. We have very 
good, solid procedures in place to vet employees.
    Mr. Carter. But do you have all the information?
    Ms. Cha, what information does the Department not have on 
employees or not have access to? You want to talk about we have 
got it, but we don't have access. I don't care. I just want to 
know why we are not getting the job done.
    Ms. Cha. Mr. Carter, the statement that you cite in our 
report, that particular one actually comes from DHS's own 
business justification for HRIT. So that is not even a GAO 
conclusion, that is a conclusion of the Department itself.
    Mr. Carter. So that makes it even worse.
    Mr. Fulghum. But again, that is why we built the business 
intelligence to get that information.
    As far as the security vetting goes that goes on throughout 
the Department, we are confident in the procedures that we have 
in place and the vetting procedures that we use, which includes 
the security clearance process.
    Mr. Carter. All right. Well, tell me what information you 
are lacking on employees. Are you lacking any information or do 
you not have access to any information? I want to leave today 
assured that you can tell me that we don't have any internal 
threats from any of our employees. Are you going to be able to 
do that?
    Mr. Fulghum. So the specifics of what information we are 
lacking that was cited back in that report, I am not familiar 
with. That said, what I will say is the following, again, that 
I believe we have very solid, secure procedures and processes 
in place to vet employees.
    Mr. Carter. So you are assuring me that we will not have 
any internal threats as a result of us not having information 
on employees.
    Mr. Fulghum. Sir, what I am assuring you of is that we have 
the best procedures we can in place. That is what I am assuring 
you of.
    Mr. Carter. But that is not what we are getting in this 
report here. What we are getting is that you have got 
fragmented systems and that you are not utilizing everything 
you could be utilizing. Am I wrong? Am I reading this wrong?
    Mr. Fulghum. What you are reading is is that we have got 
more work to do in terms of making smart business--
    Mr. Carter. You know what the problem is with that? We 
haven't got time. We need it and we need it now.
    Mr. Fulghum. We agree with you.
    Mr. Carter. Okay, all right. Let me shift real quick. Let 
me ask you, when you were developing the HRIT, at any point, 
did any senior management get any kind of bonuses?
    Mr. Fulghum. Sir, I don't have that information.
    Mr. Carter. Any of you all know? Do you all know if anybody 
got bonuses as a result of this? Anybody know? I am looking for 
volunteers.
    Mr. Fulghum. Bonus information of senior executives is 
publicly available. We can certainly get that.
    Mr. Carter. Well, can you get that for me? Because I would 
sure like to know.
    Mr. Fulghum. Yes, sir.
    Mr. Carter. Well, if you can, I sure would appreciate it.
    You know, look, guys, this is serious, this is really 
serious. I hope you all understand how serious it is. We are 
depending on you. People are depending on us and we are 
depending on you.
    Mr. Chairman, I yield.
    Mr. Perry. The Chair thanks the gentleman.
    The Chair now recognizes himself. I have just got a few 
more to wrap up and then we can if Mr. Loudermilk and Mrs. 
Watson Coleman have some more.
    The DHS initially estimated that HRIT would cost $120 
million according to what I have got here. Congress has 
appropriated at least $180 million, which is another issue in 
and of itself, right? They asked for $120 million, you get $180 
million. I am not here to defend that.
    But how much at this point does DHS estimate the cost to 
be, do you know?
    Mr. Fulghum. So that is exactly why we are doing a life-
cycle cost estimate to make sure we get it right.
    Mr. Perry. So we don't know right now, but I suspect at 
some point somebody is going to be asking for more money for 
this, right? How many years on are we?
    Mr. Fulghum. So that is what, again, that is what we are 
going through right now to make sure we do it smartly and as 
quickly as we can. But a key piece of that will be the life-
cycle cost estimate that we are going to do.
    Mr. Perry. When will that be done?
    Mr. Fulghum. By the end of this year.
    Mr. Perry. The end of the fiscal year or the calendar?
    Mr. Fulghum. End of the fiscal year.
    Mr. Perry. So by the end of September, you are going to 
know what the actual cost is.
    Mr. Fulghum. We are going to know what the estimated cost 
is to move forward, yes, sir.
    Mr. Perry. You know that our National debt is $19 trillion 
right now, right? You know this?
    Mr. Fulghum. I am aware of that.
    Mr. Perry. We have got about somewhere, some people 
estimate $200 trillion in unfunded liability. Now, I am 
privileged to serve on this committee. You know, I hear the 
Secretary saying that his legacy is going to be of improved 
management.
    But from this hearing to the last one to the one before, we 
don't know how many vehicles we have got, we have got too many 
vehicles, we can't track their mileage without asking them 
through programs and so on and so forth.
    Now, quite honestly, I just don't see it. But you can make 
the claim, I suppose, but I don't see things that have 
improved. There has been a long time getting here.
    I will tell you this, sir, I do appreciate your service. 
You know, you folks are operating at the Senior Executive 
Service level or the Executive schedule. We demand your 
leadership if you are going to be paid for it. Leadership 
requires making hard decisions, hard choices, and making people 
accountable.
    We don't, I certainly don't deign to understand the 
intricacies of what you have got to do. I kind-of get that vibe 
from Ms. Bailey, like you are asking questions you don't 
understand how hard this is.
    I hate to put it this way. We don't care how hard it is, 
right? You wanted the job, you got the job. Congress has 
appropriated the money and we demand the results, right? The 
taxpayers, the poor folks are out there working everyday trying 
to put their kids through college and pay a mortgage and we 
don't have $180 million to throw down the tank and having 
nothing really appreciable to show for it.
    When I say I don't deign to know your business, I don't. 
But the GAO does and they have given us these recommendations 
in this report and they countervail most of what you tell us 
except for what you have been working on recently, because they 
have been babysitting.
    We don't hire people in the Senior Executive Schedule to be 
babysat. You are the leaders, you are the heavies. We hire the 
heavies to get things done, not to come in here and--you don't 
want to be here and I don't want to be here, but I have got a 
feeling that if I am in Congress in a couple of years and you 
are in your position for a couple more years, we are going to 
be right back here with the same problem. That is the feeling I 
have got and I don't want to have that feeling.
    With all due respect, you haven't given me any confidence 
in your testimony today that anything is really going to 
change. Right? I hope I am wrong.
    I would say this. At a time of great need and reduced 
budgets because there is reduced income, we have got a 2 
percent economy, when you come back and ask for more money and 
people vote against your budget, you think about this hearing 
and think about what we did here today and the answers you gave 
us and ask yourself, if you were in my position to take money 
out of the pockets of the people that you live around and give 
it to you and this organization that has done this with it, 
what would you vote?
    I want you to think about that. Then, you know, look, I am 
not here to scold you, sir, you are a grown man, right? But 
this is our job and we have got to beseech you about the 
importance of this, the gravity of this, the security concerns 
that we have, the financial concerns we have.
    This isn't just going to work today and, well, you know, I 
am going to take it as far as I can and the next poor slob will 
get the job and hopefully he can take it to the next level. You 
have a commitment that you have made. If you can't get the job 
done, we have got to find somebody that will.
    With that, I yield to Mrs. Watson Coleman.
    Mrs. Watson Coleman. Thank you, Mr. Chairman.
    I really do get the sense that there is a wake-up call here 
and that we recognize how important it is to standardize, 
document, and move forward with this.
    I think that the ESC is vitally important in this. I am 
wondering what role it plays in establishing those in answer to 
those unknowns that we have for those 14 or 15 items that have 
been identified by GAO as outstanding.
    So I have a two-pronged question. Is it the ESC where that 
information would come? And (B), when do you think you would 
have that information for us? Which is simply, you know, when 
you think these various things would be fully implemented, 
partially implemented or whatever.
    Mr. Fulghum. So what I would say, first of all, is yes, it 
is the ESC's job, but the ESC is going to take it to the Joint 
Requirements Council, which is one of the things or one of the 
bodies that Secretary Johnson initiated and you guys have 
passed legislation on, codifying that Joint Requirements 
Council, which we greatly appreciate, in the House.
    So to answer your second question, we expect to take that 
through the ESC to the JRC by the 30th of April.
    Mrs. Watson Coleman. When do you think that you would have 
feedback back so that you could fill in those boxes in terms 
of----
    Mr. Fulghum. So I believe in early May we will be able to 
share with you and your staff exactly what the plan is moving 
forward.
    Mrs. Watson Coleman. So I really think that we are helpful 
to you in raising these issues and asking you to come here, 
because it kind-of keeps the stuff in the forefront of what you 
are doing. So I would be interested in the Chairman even asking 
Mister--is it Deyo?
    Mr. Fulghum. Deyo.
    Mrs. Watson Coleman. Deyo, Mr. Deyo and Mr. McCormack to 
come and sort-of give us progress reports at some point.
    But I would also be interested in you all supplying us 
information as to how you are moving through these expectations 
and how the ESC is working with you on hopefully more than the 
minimum of every 3 months, so we can really understand that 
there is progress that is being made.
    We know that you all do really important work and that this 
is an important Department, but we also know that there are 
places like TSA that have internal concerns and threats right 
now as it relates to employees, credentialing, recovering 
credentials and all. So there are very, very serious problems 
that exist and concerns that exist in this Department that we 
depend upon to keep us safe.
    So I for one would be very interested in ensuring that we 
had more contact, more feedback, just so that we help you in 
your need to make sure that the Department is accountable, 
being accountable on a more routine basis.
    Thank you.
    Mr. Fulghum. If I could, sir?
    Mr. Perry. Yes, sir.
    Mr. Fulghum. You have our commitment that you will get it.
    If I could, one more thing, sir?
    Last year I sat in front of this committee and I said 
various things about acquisition, improving acquisition in the 
Department, to include making sure that every major program had 
documentation, that we got our system where we track investment 
costs for major acquisitions current and certified, and a 
variety of other things. I sat right here and told you we would 
do it.
    I think that you are going to see in April that when GAO 
issues its report that we did a lot of those things.
    When you asked me about my leadership as a can-do, get-it-
done guy, I pride myself on that. When I sat here last year and 
said we would get life-cycle cost estimates for every one of 
those programs, we got them.
    So when I am sitting here today telling you we are going to 
make progress on this, you have my word we are going to make 
progress on this.
    Mr. Perry. I understand. On behalf of the American 
taxpayer, I hope you are right, sir. I appreciate your input.
    The Chair now recognizes Mr. Loudermilk.
    Mr. Loudermilk. Thank you, Mr. Chairman.
    Again, I appreciate you guys being here. I know this isn't 
easy, but we are in such a time in this Nation. Through 
history, I don't know that I have ever even read about such a 
time that the people of our Nation so depended on the 
Government for its National security, but so distrusted the 
Government because of things like this.
    This is where we are today with a $19 trillion debt, with 
$90 million that we can't really positively go back to our 
constituents and say, you know, all that tax money that you 
paid and you couldn't buy Johnny a new pair of cleats for 
baseball practice, well, at least here is what happened. I 
can't do that.
    So this is part of the concern. Representative Carter who 
represents the Port of Savannah which is very dependent upon 
homeland security adequately doing its job with the very best 
people there to do it, and this is our concern. It is nothing 
against anyone here personally. I know you have got a 
tremendous job to do. I appreciate your commitment to make 
progress.
    But I could argue that this is progress because out of 15 
we have completed 1. I mean, that is more progress than 
completing none.
    When I was in the Air Force it was during the Cold War. If 
we needed to get an aircraft on time to support the Army, that 
aircraft had to be there at that time no matter what, or lives 
could be cost. So we did whatever it took to get an aircraft 
into the battlefield, in position to provide the support for 
our brothers and sisters who were on the ground.
    The same things happened when my children were growing up. 
I could tell them to clean their room, but unless I gave them a 
deadline the room never got cleaned.
    Where are our deadlines? We keep shifting, shifting, 
shifting. I see all these unknowns. What the American people 
want to see is not progress, they want to see action, they want 
to see these things done. What does it take?
    When we get together this time next year, what are we going 
to be looking at?
    I know, Colonel, you said that you agreed and appreciated 
the report by the GAO. I think in a management position of 
yours, that is the right approach. Yes, we need to know the 
things that we are doing wrong. Lord knows we have constituents 
that call us continually expressing their thoughts about us and 
Government.
    But where will we be this time next year? At least give me 
dates, deadline dates of when these are going to be 
accomplished. Because when I look at some of these, such as 
off-boarding process, to me that is as critical as an on-
boarding process.
    Here is why. We had a bill that I actually passed out of 
this committee. It has passed the House, it is in the Senate. 
It was addressing a problem that we have in the Department of 
Homeland Security to the tune of $380 million--$380 million. 
That is how much homeland security has been spending to pay its 
employees to stay at home and not come to work.
    Why, you have so many people that are on administrative 
leave, some of them for as much as 2 years. What the Department 
of Homeland Security said part of the problem was we don't have 
a good IT system. There is your money, $380 million paying 
homeland security people to be at home because we have not 
concluded their off-boarding process. Most of them are for 
disciplinary action.
    So if there is some frustration here, it is because we are 
the funnel from the American people, as I said, who rely on 
you, but don't trust you. That is a very bad position to be in.
    So if you would like to comment I would really love to know 
when we are going to have some deadlines--deadlines--to get 
these things done.
    Mr. Fulghum. So as Angie said, that is what the ESC is 
doing right now. Once we get through the Joint Requirements 
Council on the 30th of April, in early May you will have more 
of that integrated schedule that you are looking for, which are 
deadlines, when we say we are going to deliver things by. We 
are going to share that with this committee.
    Then, again, I will tell you this, that we are laser-
focused on this effort. You have got my assurance that we are 
going to hold ourselves accountable and do something, take 
action and do something to deliver what we need to help her do 
her job better.
    Mr. Loudermilk. Well, thank you.
    Again, Mr. Chairman, thank you for this hearing.
    I am glad to hear that, but I am not ready to trust it yet. 
I think that is what the American people are looking for. We 
need to continue this oversight.
    We need to be laser-focused as they are laser-focused, Mr. 
Chairman.
    Thank you.
    Mr. Perry. The Chair thanks the gentleman.
    The Chair also thanks the witnesses for their valuable 
testimony, and the Members for their questions.
    Members may have some additional questions for the 
witnesses and we will ask you to respond to these in writing.
    Pursuant to committee rule 7(e), the hearing record will 
remain open for 10 days. Without objection, the subcommittee 
stands adjourned.
    [Whereupon, at 11:16 a.m., the subcommittee was adjourned.]



                            A P P E N D I X

                              ----------                              

          Questions From Chairman Scott Perry for Carol R. Cha
    Question 1. Mr. Fulghum's testimony indicated that DHS made the 
deliberate decision to halt other HRIT strategic improvement 
opportunities in order to pursue PALMS. However, GAO's report indicates 
that this was not the case. Please explain the discrepancy.
    Answer. We agree with the Department that officials elected to 
dedicate a vast majority of the Human Resources Information Technology 
(HRIT) investment resources to the Performance and Learning Management 
System (PALMS) in order to address significant schedule delays and 
technical challenges, rather than initiating additional HRIT strategic 
improvement opportunities. This is consistent with our February 2016 
report.\1\ We also reported that HRIT officials explained the decision 
to focus primarily on PALMS was due, in part, to the investment's 
declining funding stream.
---------------------------------------------------------------------------
    \1\ GAO, Homeland Security: Oversight of Neglected Human Resources 
Information Technology Investment Is Needed, GAO-16-253 (Washington, 
DC: Feb. 11, 2016).
---------------------------------------------------------------------------
    We do not agree with Mr. Fulghum's written statement that DHS made 
a ``decision to pause the HRIT executive steering committee's 
management and oversight,'' in order to deploy PALMS. During the course 
of our review, DHS officials did not provide documentation that 
indicated the Department deliberately paused the HRIT executive 
steering committee management. On the contrary, the HRIT executive 
steering committee charter specifies that it is intended to be the core 
oversight and advisory body for all DHS-wide matters related to human 
capital IT investments, expenditures, and projects, which includes 
HRIT's PALMS program. However, as we reported, the committee did not 
perform its oversight responsibilities. Specifically, the committee 
only met once over a 2-year period when HRIT's only on-going program--
PALMS--was experiencing significant problems (including frequent 
turnover in its program manager position).
    Question 2. GAO reported that DHS made limited progress in 
achieving its 2 performance metrics and associated targets for the HRIT 
program. These included reducing the number of component-specific human 
resource IT systems by 46 percent and increasing the number of 
Department-wide HRIT services by 38 percent by the end of fiscal year 
2016. However, DHS has barely made progress in meeting these goals. How 
realistic are these goals? What type of performance metrics or goals 
would better reflect DHS's intended performance for HRIT?
    Answer. To determine whether the HRIT performance metrics and 
associated targets are realistic or need to be updated, the Department 
should first implement our recommendation to re-evaluate HRIT's 
strategic improvement opportunities to decide whether they are still 
valid and reflective of DHS's current needs. Once this is complete, the 
Department should implement our recommendation to re-prioritize the 
improvement opportunities to determine the highest-priority areas, and 
determine how to move forward with HRIT, including deciding if the 
performance metrics are appropriate and whether updating them is 
necessary.
    Question 3. GAO reported that DHS anticipates that, of the total 
number of users, less than half would actually use either the learning 
or performance management capabilities. As a result, would implementing 
PALMS ultimately address the problems that it is intended to address 
when about 200,000 users will not use either system?
    Answer. According to DHS, the PALMS program was to enable 
enterprise-wide tracking and reporting of employee learning and 
performance management data across DHS headquarters and its 8 
components in order to, among other things, automate paper-based 
performance management processes, consolidate duplicative learning 
management systems, and ensure consistency across the Department.
    However, as of November 2015, the Federal Emergency Management 
Agency and U.S. Immigration and Customs Enforcement were not yet 
committed to implementing the PALMS performance management 
capabilities, and the Transportation Security Administration and the 
U.S. Coast Guard were not yet committed to implementing either of the 
PALMS learning and performance management capabilities. As we reported 
in February, until these components implement our recommendation to 
determine whether they will adopt the learning and/or performance 
management capabilities of PALMS, the Department is at risk of 
implementing a solution that does not fully address its problems. 
Moreover, until DHS decides on an alternative viable solution for any 
component that deems PALMS as not feasible, the Department is at risk 
of not meeting its goal to enable enterprise-wide tracking and 
reporting of employee learning and performance management.
    Question 4. DHS's effort to field PALMS includes implementing a 
commercial off-the-shelf software product that is to be provided as a 
service. If the system is a commercial off-the-shelf system, why is has 
it been so challenging to implement? To what extent did the Department 
properly determine the requirements for the system prior to selecting a 
vendor to deliver the capability?
    Answer. Although PALMS was intended to provide an enterprise-wide 
commercial off-the-shelf system, the program experienced implementation 
challenges because it did not follow several key IT acquisition best 
practices. Specifically, DHS did not maintain a complete and accurate 
program schedule, or implement key risk management practices, including 
regularly tracking the status of its risks and mitigation efforts, and 
prioritizing its risks. To help DHS monitor and oversee the 
implementation of PALMS, and ensure that the program's attention and 
resources for risk mitigation are used in the most effective manner, 
the Department should promptly address our 5 recommendations that we 
made on each of these areas in our February report.\2\
---------------------------------------------------------------------------
    \2\ GAO-16-253.
---------------------------------------------------------------------------
    We have not conducted the necessary work to answer the question 
regarding the extent to which DHS properly determined the requirements 
for the system prior to selecting a vendor. However, we reported that, 
as of November 2015, according to PALMS officials, the vendor's 
commercial off-the-shelf system did not meet requirements that it was 
expected to meet, which required the vendor to customize the system to 
meet those requirements. According to PALMS officials, DHS had 483 
baseline requirements, 32 of which needed customizations, and 5 of 
these 32 requirements still needed to be fully addressed by the vendor, 
as of November 2015. DHS expected these requirements to be met by the 
end of February 2016.
  Questions From Ranking Member Bonnie Watson Coleman for Carol R. Cha
    Question 1. Based on GAO's analysis, only 1 out of 15 improvement 
opportunities were fully implemented by DHS as of November 2015, 
specifically the HRIT intake process. Of the 14 remaining, was it 
reasonable for DHS to have fully implemented any the improvement 
opportunities by November 2015? If so, which ones? What do you believe 
is a reasonable time line for full implementation of the remaining 14 
improvement areas?
    Answer. Through DHS's extensive effort to develop the Human Capital 
Segment Architecture, which began in 2010 and was completed in August 
2011, DHS considered it reasonable to fully implement 14 of the 15 HRIT 
strategic improvement opportunities within an approximately 4-year 
period (i.e., by June 2015). The only improvement opportunity that DHS 
determined would take longer than that was the End-to-End Hiring 
improvement opportunity, which DHS had planned to implement by December 
2016 (5\1/2\ years following the completion of the architecture).
    Moving forward, we believe a reasonable time line for full 
implementation of the 14 remaining improvement opportunities cannot be 
determined until the Department implements our recommendation to 
evaluate the strategic improvement opportunities and projects within 
the blueprint. Specifically, we recommended that DHS complete this 
evaluation to determine whether the opportunities, projects, and the 
goals of the blueprint are still valid and reflective of DHS's current 
priorities.\3\ Once this is complete, DHS should implement an 
additional recommendation we made to update and maintain a schedule 
estimate on when it plans to implement each of the strategic 
improvement opportunities.
---------------------------------------------------------------------------
    \3\ GAO, Homeland Security: Oversight of Neglected Human Resources 
Information Technology Investment Is Needed, GAO-16-253 (Washington, 
DC: Feb. 11, 2016).
---------------------------------------------------------------------------
    Question 2. GAO briefly discusses the Performance and Learning 
Management System or PALMS implementation at the Department. Please 
describe the Department's progress in implementing the PALMS software. 
Are there any components in particular that are behind in its 
implementation plan?
    Answer. PALMS is intended to provide an enterprise-wide commercial 
off-the-shelf system that offers performance management capabilities, 
as well as learning management capabilities to headquarters and each of 
its 8 components. As of January 2016, of the 8 components and 
headquarters, 5 (U.S. Customs and Border Protection, the Federal Law 
Enforcement Training Center, headquarters, U.S. Citizenship and 
Immigration Services, and the U.S. Secret Service) were planning to 
implement both PALMS's learning and performance management 
capabilities, 2 (the Federal Emergency Management Agency and U.S. 
Immigration and Customs Enforcement) were planning to implement only 
the learning management capabilities, and 2 components (the 
Transportation Security Administration and the U.S. Coast Guard) were 
not currently planning to implement either of these PALMS capabilities.
    As of February 2016, the learning management capabilities had been 
deployed to DHS headquarters and 2 components (the Federal Law 
Enforcement Training Center and U.S. Customs and Border Protection). If 
the system was deployed to all of its expected users for these 3 
organizations, approximately 110,860 should be currently using the 
learning management capabilities (approximately 36 percent of the total 
number of expected users for these capabilities).
    Regarding PALMS's performance management capabilities, as we 
reported in February, these capabilities have not been fully deployed 
to any of the components or headquarters, and it was unknown when they 
would be fully deployed at most of the components.\4\
---------------------------------------------------------------------------
    \4\ GAO-16-253.
---------------------------------------------------------------------------
    When compared to the program's original August 2012 delivery 
schedule (which included deploying both the learning and performance 
management capabilities in one release), headquarters and all of the 
components have experienced significant schedule slippages. For 
example, DHS headquarters was originally planning to implement both the 
learning and performance management capabilities by June 2013; however, 
it did not deploy the learning management capabilities until over 2 
years later--in October 2015. Moreover, as of January 2016, DHS did not 
have a date for when it planned to fully deploy the performance 
management capabilities to headquarters. PALMS program management 
office officials attributed these slippages to multiple causes, 
including the vendor's commercial off-the-shelf system not meeting 
requirements, thereby requiring the vendor to customize the system in 
order to satisfy them.
    As a result, PALMS's current trajectory is putting the Department 
at risk of not meeting its goals to perform efficient, accurate, and 
comprehensive tracking and reporting of training and performance 
management data across the enterprise; and consolidating its 9 learning 
management systems into 1. Accordingly, it is important for DHS to 
implement our recommendations to:
   establish a time frame for deciding whether PALMS will be 
        fully deployed at the Federal Emergency Management Agency and 
        the U.S. Coast Guard; and
   determine an alternative approach if the learning and/or 
        performance management capabilities of PALMS are deemed not 
        feasible for U.S. Immigration and Customs Enforcement, the 
        Federal Emergency Management Agency, the Transportation 
        Security Administration, or the U.S. Coast Guard.
    Question 3. Please describe how HRIT implementation, particularly 
the PALMS program, fell short on IT acquisition best practices. What 
areas should the Department focus on to get the program back on track 
in the most cost-effective and efficient manner?
    Answer. The Department did not fully implement several key IT 
acquisition practices on HRIT and PALMS. Specifically, regarding the 
overall HRIT investment, the Department did not:
   update and maintain a schedule estimate for implementing 
        HRIT's strategic improvement opportunities;
   develop a life-cycle cost estimate for the investment; or
   track all costs incurred on the investment.
    Additionally, for the PALMS program, DHS did not:
   develop a complete life-cycle cost estimate for the program;
   maintain a complete and accurate program schedule;
   monitor total program costs; or
   implement key risk management practices, such as regularly 
        tracking the status of its risks and mitigation efforts.
    To get HRIT and PALMS back on track in the most cost-effective and 
efficient manner, DHS should promptly address our 14 recommendations 
that we made on each of these areas in our February report.\5\ To begin 
with, DHS should focus in particular on re-evaluating its HRIT 
strategic planning document (the Human Capital Segment Architecture 
Blueprint) to determine whether the improvement opportunities and goals 
of the plan are still valid and reflective of DHS's current priorities. 
DHS should also re-prioritize the strategic improvement opportunities 
to ensure that it is investing in and implementing the highest-priority 
items first. Full implementation of our recommendations will help to 
ensure that the overall investment receives necessary oversight and 
attention, and will help address the ineffective management that HRIT 
and PALMS have experienced to date.
---------------------------------------------------------------------------
    \5\ GAO-16-253.
---------------------------------------------------------------------------
    Question 4. One area GAO attributes to the limited progress of HRIT 
implementation is the lack of involvement from the Executive Steering 
Committee. Please state for this committee how you feel the Executive 
Steering Committee can assist in HRIT implementation, for example, how 
frequently should they be meeting, how frequently should they receive 
status reports on the implementation, etc.?
    Answer. As the HRIT investment's core oversight and advisory body, 
the Executive Steering Committee can assist HRIT implementation by 
ensuring the implementation of our 14 recommendations, such as being 
consistently involved in overseeing and advising HRIT and approving key 
program management documents, including HRIT's operational plan, 
schedule, and planned cost estimate.
    Regarding frequency of committee meetings and status reports, 
consistent with DHS's guidance on oversight of high-risk investments, 
the committee should be meeting and receiving status reports on the 
HRIT investment at least on a monthly basis. DHS's Capital Planning and 
Investment Control Guidance specifies that high-risk investments are to 
be reviewed monthly. In our February 2015 High-Risk Report,\6\ we 
highlighted the HRIT investment as a high-risk initiative with 
significant issues requiring attention.
---------------------------------------------------------------------------
    \6\ Every 2 years at the start of a new Congress, GAO calls 
attention to agencies and program areas that are high risk due to their 
vulnerabilities to fraud, waste, abuse, and mismanagement, or are most 
in need of transformation. As part of a new entry into the February 
2015 update to our High-Risk Series focused on improving the management 
of IT acquisitions and operations, HRIT was identified as an IT 
investment--among others across the Federal Government--in need of the 
most attention. See GAO, High-Risk Series: An Update, GAO-15-290 
(Washington, DC: Feb. 11, 2015).
---------------------------------------------------------------------------
    Question 5. GAO lists 1 of out 15 improvement opportunities that 
DHS fully implemented by November 2015, the HRIT intake process. Is the 
Department close to full implementation on any of the remaining 14 
opportunities? Of the remaining 14, which areas should DHS place 
primary focus?
    Answer. Of the 14 improvement opportunity areas that DHS has not 
yet fully implemented, it has partially implemented 5 and has not yet 
started to work on the other 9. Officials did not know when any of 
these 14 improvement opportunity areas would be fully addressed. As we 
reported in February, DHS has been primarily focused on implementing 
PALMS--which aims to address the performance management improvement 
opportunity area--rather than initiating additional HRIT strategic 
improvement opportunities. Nevertheless, DHS is still far from fully 
implementing this improvement area, as DHS has not determined when the 
performance management capabilities of PALMS will be fully implemented 
at headquarters and at most of the components.
    To determine which improvement areas DHS should focus on going 
forward, the Department needs to first implement our recommendation to 
re-evaluate HRIT's strategic improvement opportunities to determine 
whether they are still valid and reflective of DHS's current needs. 
Once the Department has completed this evaluation, it should implement 
our recommendation to re-prioritize the improvement opportunities to 
determine the highest priority areas.
    Question 6. The Department initiated the HRIT investment in 2003. 
From 2003 to 2010, DHS made limited progress on the HRIT investment, as 
reported by DHS's inspector general. In the IG's report, 11 
recommendations were made to the chief human capital officer. We are 
now in 2016 and still discussing shortcomings in HRIT implementation. 
What is the Department doing wrong? Should its focus be shifted in 
another area?
    Answer. The Department's neglect of the HRIT investment and lack of 
implementation of key IT acquisition practices, including developing 
and maintaining a life-cycle cost and schedule estimate, have resulted 
in DHS making very limited progress on the investment. In particular, a 
key cause for the Department's minimal progress in implementing HRIT 
was the lack of involvement of the HRIT executive steering committee--
the investment's core oversight and advisory body.
    As DHS described in its business justification for the HRIT 
investment, limitations in the Department's human resources 
environment, including fragmented systems and duplicative and paper-
based processes, are compromising the Department's ability to 
effectively and efficiently carry out its mission. As such, it is 
critical for the Department to maintain focus on this area and address 
these issues. In particular, the Department needs to make the 
implementation of our 14 recommendations a high priority to help the 
investment address the long-standing issues in DHS's human resources 
environment.
    Question 7. GAO cites ``unplanned resource changes'' as one of the 
reasons for the lack of progress made in the implementation of HRIT. 
Please describe for the committee examples of the resources changes you 
are referring to. What can the Department do better to fully implement 
the remaining 14 improvement area opportunities in the appropriate rate 
of time?
    Answer. As we reported in February 2016, DHS elected to dedicate 
the vast majority of HRIT's resources to implementing PALMS and 
addressing its problems, rather than initiating additional HRIT 
strategic improvement opportunities. Specifically, PALMS--which began 
in July 2012--experienced programmatic and technical challenges that 
led to years-long schedule delays. For example, while the PALMS system 
for headquarters was originally planned to be delivered by a vendor in 
December 2013, as of November 2015, the expected delivery date was 
delayed until the end of February 2016--an over 2-year delay. HRIT 
officials explained the decision to focus primarily on PALMS was due, 
in part, to the investment's declining funding stream. However, in 
doing so, attention was concentrated on the immediate issues affecting 
PALMS and diverted from the other goals of HRIT.
    To effectively implement the remaining 14 improvement opportunity 
areas, DHS needs to fully implement our recommendations by taking 
several key actions, including:
   ensuring that the HRIT Executive Steering Committee is 
        consistently involved in overseeing and advising HRIT,
   re-evaluating HRIT's strategic improvement opportunities to 
        determine whether they are still valid and reflective of DHS's 
        current needs,
   re-prioritizing the improvement opportunities as needed to 
        determine on which ones to focus first,
   developing a complete life-cycle cost estimate, and
   updating and maintaining a schedule estimate for 
        implementation of the improvement opportunities.
    Question 8. Of the 8 components, 2 components are not currently 
planning to implement PALMS and another 2 components are only 
implementing one of PALMS learning capabilities. Based on your review 
of PALMS, is it necessary for every component to implement the program 
in order to achieve maximum success? What impacts, if any, will the 
Department see due to its lack of full participation from all the 
components?
    Answer. According to DHS, the Department initiated the PALMS 
program to implement an enterprise-wide employee performance management 
and appraisal solution that is to automate the Department's primarily 
paper-based performance management processes. In addition, PALMS was to 
provide a system to consolidate 9 existing learning management systems 
into 1 system and enable comprehensive training reporting and analysis 
across the Department. Such an approach can save resources and ensure 
consistency across the Department.
    However, as of November 2015, the Federal Emergency Management 
Agency and U.S. Immigration and Customs Enforcement were not yet 
committed to implementing the PALMS performance management 
capabilities, while the Transportation Security Administration and the 
U.S. Coast Guard were not yet committed to implementing either of the 
PALMS learning and performance management capabilities. As we reported, 
until these components determine whether they will implement the 
learning and/or performance management capabilities of PALMS, the 
Department is at risk of implementing a solution that does not fully 
address its problems. Moreover, until DHS determines an alternative 
approach if one or both aspects of PALMS is deemed not feasible for all 
components, the Department is at risk of not meeting its goal to enable 
enterprise-wide tracking and reporting of employee learning and 
performance management.
    Question 9. Given the nature of the HRIT investment, explain to the 
committee the effect this investment's non-performance has on the 
capabilities and mission of the Department of Homeland Security as a 
whole.
    Answer. The HRIT investment is intended to address the fragmented 
systems, duplicative and paper-based processes, and little uniformity 
of data management practices that have plagued the Department since it 
was first created in 2002. According to DHS, these issues with its 
human resources environment are compromising the Department's ability 
to effectively and efficiently carry out its mission. For example, 
according to DHS, reporting and analyzing enterprise human capital data 
are currently time-consuming, labor-intensive, and challenging because 
the Department's data management largely consists of disconnected, 
stand-alone systems, with multiple data sources for the same content. 
Additionally, according to DHS, the Department does not have 
information on all of its employees, which reduces its abilities to 
strategically manage its workforce and best deploy people in support of 
Homeland Security missions.
    Further, the Department's strategic planning document noted that, 
based on its current human resources environment, DHS, among other 
things,
   is unable to support enterprise reporting and has data 
        quality issues;
   does not have enterprise-level performance information 
        available and lacks standardized performance measures across 
        the components;
   incurs significant costs associated with maintaining 7 
        different systems for personnel action requests, and loses 
        efficiency due to duplicative data entry into multiple systems; 
        and
   does not have a standardized approach to off-boarding at DHS 
        and there are time lags before selected systems recognize that 
        an employee has left DHS, which poses a risk of security 
        infractions.
    Without successfully implementing HRIT or a similar Department-wide 
solution, DHS will be limited in its ability to address the issues 
described above.
          Questions From Chairman Scott Perry for Chip Fulghum
    Question 1. Mr. Fulghum's testimony indicated that DHS made the 
deliberate decision to halt other HRIT strategic improvement 
opportunities in order to pursue PALMS. However, GAO's report indicates 
that this was not the case. Please explain the discrepancy.
    Answer. The GAO Report cites, ``DHS elected to dedicate the vast 
majority of HRIT's resources to implementing PALMS and addressing its 
problems, rather than initiating additional HRIT strategic improvement 
opportunities'' (pg. 18). Additionally the report cites, ``HRIT 
officials attributed the lack of schedule updates to the investment's 
focus shifting to the PALMS program when it started experiencing 
significant schedule delays (pg. 21).'' These statements/assertions 
agree with the testimony of the DUSM. PALMS implementation was the No. 
1 priority of the HRIT program since it began in 2012.
    Question 2. In May 2013, DHS established a blanket purchase 
agreement that obligates funds when orders are placed for each 
component to use when implementing PALMS. This agreement was valued at 
$95 million. However, GAO reported that only a handful of components 
expected to implement any part of PALMS services. As a result of the 
delayed implementation, has the estimated value increased in the last 3 
years since the blanket purchase agreement was established?
    Answer. At the time of the ETMS award, based on the schedule 
included in the acquisition and procurement documentation, it was 
always expected that all components would implement all of the ETMS/
PALMS services. Currently, 3 years after contract award, PALMS value 
has limitations that prevent the entire systems' implementation. PALMS 
is comprised of 2 modules; Learning Management and Performance 
Management. PALMS deployed in; CBP, HQ, and FLETC in 2015 with ICE, 
CIS, and USSS implementations scheduled for 2016 and includes; only the 
LMS module. The performance management module currently is in pilot and 
scheduled for full performance evaluation life cycle completion by 
September 2016. Once the system is complete with both modules, then a 
value assessment of PALMS services can be achieved.
    Question 3. Did any senior officials receive performance 
compensation/bonuses for their management of HRIT at any point? If so, 
who approved such awards?
    Answer. Yes, senior officials who were responsible for HRIT 
received performance-related compensation based not just on HRIT 
responsibilities, but on all of the core competencies and performance 
objectives for which they were responsible. Awards were recommended by 
chief human capital officers who are no longer employed at DHS. 
Performance awards for all senior executives must also receive the 
concurrence of a Performance Review Board (PRB).
    Question 4. DHS reported that HRIT was necessary to address 
security risks that employees separating from the Department pose. 
Specifically, DHS reported that there are no automated triggers that 
notify when an employee separated from the Department and that it 
relies largely on the initiative of the departing employee to make such 
notification. DHS concluded that this could allow employees access to 
sensitive systems after they have separated from the agency.
    How often do these instances occur?
    What is DHS's current ``off-boarding'' process for employees?
    What steps has the Department taken to mitigate this type of 
security risk?
    How does the use of multi-factor authentication mitigate this 
significant problem?
    Answer. DHS is not aware of any specific instances where a departed 
employee has accessed sensitive systems.
    The Department's progress in multi-factor authentication requires 
the use of not only a DHS-issued badge, but an accompanying pin or 
other unique identifier. By ensuring the badge is turned in as a part 
of the exit procedures, this eliminates one critical element of the 
multi-factor authentication.
    Each component takes this risk seriously, and monitors internally. 
As an initiative under the cyber work within OCIO, the Department is 
currently conducting a pilot to deactivate all departing employees and 
contractors upon separation.
    DHS components have the flexibility to tailor their individual off-
boarding processes. These processes typically include a current 
employee receiving and certifying the employee has turned in their 
equipment, badges, and other DHS-issued equipment. The components 
submit the Standard Form 52 to human resources to process their 
separation action in all human resources systems and the badges are 
turned in, and access to DHS offices and systems are inactivated.
    Question 5. GAO reported that DHS made limited progress in 
achieving its 2 performance metrics and associated targets for the HRIT 
program. These included reducing the number of component-specific human 
resource IT systems by 46% and increasing the number of Department-wide 
HRIT services by 38% by the end of fiscal year 2016. However, DHS has 
barely made progress in meeting these goals. How realistic are these 
goals? What specific steps does DHS plan to take to meet these targets?
    Answer. We agree that the original performance goals are 
unrealistic. The Strategic Improvement Opportunities (SIOs) are 
currently under review and are in the process of being re-baselined and 
evaluated by the Executive Steering Committee. DHS expects revised 
performance metrics to be available at the end of June 2016.
    Question 6. Because PALMS encompasses 2 separate projects and 
delivers 2 distinct capabilities, it is easy for progress in one area 
to appear to count as progress in the other area. However, when viewed 
separately, it is clear that the implementation of learning management 
capabilities has just begun, while performance management capabilities 
have not yet been implemented at all. When does DHS expect to fully 
implement the learning management capabilities of PALMS as well as the 
performance management capabilities?
    Answer. PALMS full functionality is expected to be completed by 
fiscal year 2017. Since addressing the challenges that caused the 
slowdown, the learning management capabilities of the PALMS system were 
deployed at Customs and Border Protection (CBP) in July 2015; at DHS 
Headquarters (HQ) in October 2015; and most recently at the Federal Law 
Enforcement Training Center (FLETC) in December 2015. As such, the 
PALMS learning management capabilities are fully implemented at CBP, 
HQ, and FLETC. In total, the usage of the PALMS learning management 
module at CBP, HQ, and FLETC has resulted in more than 350,000 course 
completions. Immigration and Customs Enforcement (ICE) is scheduled for 
deployment in the third quarter of fiscal year 2016. U.S. Citizenship 
and Immigration Services (USCIS) and U.S. Secret Service (USSS) are 
scheduled for deployment in the first quarter of fiscal year 2017. The 
Transportation Security Administration (TSA), Federal Emergency 
Management Agency (FEMA), and the U.S. Coast Guard (USCG) are 
performing their analyses and are on schedule for an implementation 
decision by May 30, 2016. DHS has moved forward with the implementation 
of the performance management capabilities in PALMS, with an initial 
pilot being conducted within the Headquarters. This Pilot includes a 
full year performance evaluation period (October through September) 
Performance Plan development, mid-year reviews, and final evaluation. 
Barring any unforeseen challenges in meeting the requirements, this 
portion of the project remains on track for the delivery of the full 
operating capability per the current schedule of September 2016.
    Question 7. DHS's effort to field PALMS includes implementing a 
commercial off-the-shelf software product that is to be provided as a 
service. If the system is a commercial off-the-shelf system, why is has 
it been so challenging to implement? To what extent did the Department 
determine the requirements for the system, prior to selecting a vendor 
to deliver the capability?
    Answer. We agree that implementing PALMS has been a challenge to 
the Department. Invoking a Commercial Off-the-shelf Software (COTS) or 
Software as a Service (SaaS)--commercially-available software for 
customers delivered over the web means that all component business 
processes would be standardized since all components would be using the 
same application. Unfortunately, the business processes for the LMS and 
Performance Management are performed differently at the component level 
which caused the delay in implementation.
    Question 8. The HRIT investment is currently rated as being a 
``medium-risk'' investment on the Office of Management and Budget's IT 
Dashboard; however, this rating is representative of only HRIT's 
Performance and Learning Management System (PALMS) and not the entirety 
of the HRIT investment. Why is this rating not representative of the 
entire HRIT investment, including reflecting the lack of progress made 
to date in implementing HRIT and the lack of a plan to date for how to 
proceed with the investment?
    According to DHS's guidance, investments that are designated by DHS 
as being ``high-risk'' are to be evaluated by OCIO on a monthly basis, 
and ``medium-risk'' investments are to be evaluated on a quarterly 
basis. Based on the issues reported by GAO on HRIT and PALMS, it does 
not appear as though ``medium-risk'' is an accurate designation. Why is 
this investment not designated a ``high-risk'' investment?
    Answer. We agree that the HRIT investment, including but not 
limited to the PALMS project, should be designated a high risk and will 
make the appropriate changes.
    Question 9. In January 2015, DHS shifted its IT strategy from 
acquiring assets to acquiring services. According to DHS, this shift 
will require a significant change in DHS's IT workforce's skillsets. 
GAO concluded that this shift will need to be closely managed in order 
to succeed. Why did DHS shift its strategy? What, if any, are the 
impacts on costs? What steps will DHS take to oversee this shift in 
strategy? Who within DHS will own this process?
    Answer. OCIO shifted its strategy to better leverage the open 
market place for the delivery of enterprise systems and services, based 
in part by the increase in FedRamp approved commercial cloud services 
and offerings, and based on best practices learned working with the 
U.S. Digital Services.
    Based on pilots and early implementations using commercial cloud 
offerings, OCIO anticipates that this shift in strategy will result in 
lower overall total cost and reduce the time for higher-quality 
services.
    Progress on this shift in strategy will be overseen and managed by 
the OCIO along with its governing body, the DHS CIO Council. Progress 
on reduction in costs or decrease in time to delivery services will be 
measured and reported using the PortfolioStat process and our 
Performance Measures Implementation.
 Questions From Ranking Member Bonnie Watson Coleman for Angela Bailey
    Question 1. The Department has identified a wide range of human 
capital needs, particularly the size of the workforce, its deployment 
across the Department and components, and the knowledge, skills, 
abilities, and diversity needed within the workforce. However, as of 
September 2015, DHS had yet to fully implement a workforce-planning 
model to properly plan for current and future organizational and 
workforce needs. Please describe for the committee the current time 
line for completing a comprehensive workforce plan. What areas do you 
anticipate being primary areas of focus, whether it be hiring needs, 
employee morale improvement, and/or diversity?
    Answer. Response was not received at the time of publication.
    Question 2. In 2011, the Department established a human capital 
strategic plan and has made some progress in its implementation. 
However, the Department has considerable work ahead to improve employee 
morale, which has decreased each year since the plan was implemented in 
2011. Please describe to the committee what you've done to address 
employee morale since your appointment and how you plan on addressing 
it further in the future?
    Answer. Response was not received at the time of publication.
    Question 3. PALMS intended to provide an enterprise-wide system 
that offers performance management capabilities as well as learning 
management capabilities to headquarters and each of its components. 
However, there is uncertainty about whether the PALMS system will be 
used Department-wide to accomplish these goals. Of the 8 components, 2 
components are not currently planning to implement PALMS and another 2 
components are only implementing one of PALMS learning capabilities. 
Can PALMS be beneficial to the Department if every component does not 
implement the software? If the goal is to provide across-the-board 
performance management, is that even possible without each component's 
involvement?
    Answer. Response was not received at the time of publication.
    Question 4. One particular area in the 15 strategic improvement 
opportunities addresses end-to-end hiring, a seamless, efficient, and 
transparent hiring process. According to GAO, this area has not even 
been partially implemented by the Department, which may have resulted 
in delayed hiring. Please provide the committee with an update on this 
improvement area and your plan to ensure its full implementation as 
quickly as possible.
    Answer. Response was not received at the time of publication.
    Question 5. In 2015, the Department shifted its IT paradigm from 
acquiring assets to acquiring services. This shift will require a major 
transition in the skill sets of DHS's IT workforce. The Department will 
need to effectively hire, train, and manage those new skill sets. 
Please provide your strategy in addressing the Department's new focus 
on services, discussing in particular recruitment and retention 
efforts.
    Answer. Response was not received at the time of publication.
    Question 6. According to GAO, the PALMS PMO, which is responsible 
for overseeing the PALMS implementation projects across DHS, conducted 
reviews to monitor the program's performance, but did not consistently 
document the results of the program's progress and milestone reviews. 
Please update the committee on the status of PALMS, particularly its 
performance in milestone and progress reviews. Do you still believe 
PALMS will be beneficial for the Department's tracking of personnel 
performance?
    Answer. Response was not received at the time of publication.
    Question 7. According to the GAO report, DHS's off-boarding process 
poses an unacceptably high risk of security infractions, including 
former employees continuing to log on to the network, use email 
accounts, and access information that is considered off-limits to the 
general public, due to its paper-based and manual process. Please tell 
the committee what steps have been implemented to improve the off-
boarding process. What is the length of time former employees maintain 
system credentials?
    Answer. Response was not received at the time of publication.
    Question 8. The Office of Personnel Management's Federal Employee 
Viewpoint Survey data continues to show that DHS's scores steadily 
decrease in all four dimensions of the survey's index for human capital 
accountability and assessment. Do you believe the PALMS program will 
assist in employee morale and accountability? What other areas do you 
feel can help improve morale at the Department?
    Answer. Response was not received at the time of publication.
    Question 9. This committee has asked DHS components and the 
Inspector General questions about personnel data. Some of these 
questions could not be answered mainly because DHS did not have the 
data. What are you doing in your capacity as chief human capital 
officer to ensure that the components with which you are working are 
now keeping the adequate records to track personnel data?
    Answer. Response was not received at the time of publication.
    Question 10. This committee understands that a bulk of reforming 
the HRIT investment has been delegated to the chief information 
officer, who was not present for the hearing. Since you have been named 
chief human capital officer, have you been able to give your input into 
reforming the HRIT investment? What type of input have you given and 
when do you expect the committee to see improvements?
    Answer. Response was not received at the time of publication.

                                 [all]