Strategic Budgeting: Risk Management Principles Can Help DHS	 
Allocate Resources to Highest Priorities (29-JUN-05,		 
GAO-05-824T).							 
                                                                 
Previous GAO work has outlined the nation's growing fiscal	 
imbalance and called for a fundamental reexamination of the base 
of the federal government. The significant resources directed to 
the Department of Homeland Security (DHS) indicate that a robust 
homeland security program is viewed as critical to the protection
and prosperity of Americans. This testimony addresses the need	 
for a fundamental reexamination of the base of government, the	 
role that performance budgeting tools can play in helping inform 
agency activities, and DHS's use of performance budgeting and	 
risk management concepts. It also includes examples from GAO work
on homeland security issues that highlight DHS attempts to define
an acceptable and achievable level of risk.			 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-05-824T					        
    ACCNO:   A28398						        
  TITLE:     Strategic Budgeting: Risk Management Principles Can Help 
DHS Allocate Resources to Highest Priorities			 
     DATE:   06/29/2005 
  SUBJECT:   Accountability					 
	     Budget functions					 
	     Budgeting						 
	     Fiscal policies					 
	     Homeland security					 
	     Information resources management			 
	     Policy evaluation					 
	     Risk management					 
	     Strategic planning 				 
	     Performance-based budgeting			 
	     Policies and procedures				 
	     OMB Program Assessment Rating Tool 		 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-05-824T

United States Government Accountability Office

GAO Testimony

Before the Subcommittee on Management, Integration, and Oversight,
Committee on Homeland Security, House of Representatives

For Release on Delivery

Expected at 3:00 p.m. EST STRATEGIC BUDGETING

Wednesday, June 29, 2005

Risk Management Principles Can Help DHS Allocate Resources To Highest Priorities

Statement of David M. Walker Comptroller General of the United States

GAO-05-824T

[IMG]

June 29, 2005

STRATEGIC BUDGETING

Risk Management Principles Can Help DHS Allocate Resources to Highest Priorities

  What GAO Found

The nation faces a long-term fiscal imbalance, and the role of the federal
government is being reshaped by many forces, such as evolving defense and
homeland security policies and new organizational and institutional
arrangements for carrying out public activities. Given these
circumstances, there is a critical need for the federal government to
reexamine the base of its programs, policies, functions, and activities. A
periodic reexamination of major federal spending and tax policies offers
the prospect for the American government to eliminate outmoded operations
and better align its operations with the demands of a changing world. The
management and performance reforms enacted by Congress in the past 15
years have provided new tools to support this kind of reexamination.
However, these new tools must be implemented by agencies and used by the
Congress in its decision making in order to be effective.

Performance budgeting can help policymakers address important questions
about whether and how programs contribute to their stated goals. It can
help enhance the government's capacity to assess competing claims for
federal dollars by arming decision makers with better information on the
results of individual programs, as well as on various federal policies and
programs addressing common goals. Performance budgeting, however, cannot
provide answers to every resource question-particularly where allocation
is a function of competing values and interests that depend on factors
other than program performance.

Congress and the President have agreed on DHS's mission, and DHS has
established strategic objectives for achieving its mission. However, DHS's
strategic plan does not detail the associated resources necessary to carry
out its mission and achieve its strategic goals. DHS has called for using
riskbased approaches to prioritize its resource investments regarding
critical infrastructure, and for developing plans and allocating resources
in a way that balance security and freedom. It must carefully weigh the
benefit of homeland security endeavors and allocate resources where the
benefit of reducing risk is worth the additional cost. A comprehensive
risk management framework-which includes an assessment of risk through
threat, vulnerability, and criticality assessments-should be applied to
guide these decisions. DHS has not completed a comprehensive national
threat and risk assessment. However, some components of DHS have taken
initial steps to apply elements of risk management to its operations and
decision making. For example, the Coast Guard has taken actions to assess
and mitigate vulnerabilities in order to enhance maritime security, and
the Transportation Security Administration has conducted vulnerability
assessments at selected general aviation airports. Congress and agencies
have a shared responsibility for ensuring that performance budgeting and
risk management approaches are both useful and used.

                 United States Government Accountability Office

Mr. Chairman and Members of the Subcommittee:

I am pleased to be here today to discuss how the Department of Homeland
Security (DHS) can use performance budgeting and risk management
principles to maximize program performance in an environment of increasing
fiscal constraints. 1

Today I will touch on the need for a fundamental reexamination of the base
of government, given our current, imprudent, and unsustainable fiscal
path. Then I will turn to and discuss the important role that performance
budgeting and risk management principles can play in setting priorities
for the department's homeland security activities. Finally, I will draw
upon our work in DHS on homeland security issues to highlight examples of
where the department has attempted to define an acceptable and achievable
level of risk.

The significant resources directed to homeland security and to DHS in
particular indicate that a robust homeland security program is viewed as
critical to the nation's protection and prosperity. It is clear that
before the events of September 11, 2001, it was difficult to anticipate
the array of new and challenging demands on federal programs, and to
envision the claims on future budgets for homeland security concerns.
Given current trends and challenges facing the nation-including the
long-term fiscal imbalance--it is critical that the federal government
reexamine the base of federal spending and tax programs, at the same time
holding all programs accountable for spending wisely and achieving real
results.

By using performance budgeting tools and the priorities outlined in the
National Strategy for Homeland Security, the department will be in a
better position to respond to changing circumstances. The Government
Performance and Results Act of 1993 (GPRA)2 and various assessment
efforts, such as the Administration's Program Assessment Rating Tool
(PART), can provide a foundation for a baseline review of existing
policies, programs, functions, and activities in the department. In
addition, they have the potential to help decision makers assess competing
claims

1In this testimony, the term performance budgeting refers to any linkage
between budgeting and expected or actual evidence-based performance and
results-based information.

2Pub. L. No. 103-62, 107 Stat. 285 (1993).

by providing better information on the results of individual programs, and
on policies and programs designed to address common goals.

Just as we know that the threat of terrorism will persist well into the
21st century, we also know it is unrealistic to expect future funding
increases for homeland security efforts to occur at the same rate as in
the recent past. Given the reality that no amount of money can make us
completely safe from a terrorist attack, the National Strategy for
Homeland Security provides guidance for considering how to make the best
use of available funds to mitigate the most serious risks, while also
assuring that the reduction in risk is worth the amount of additional
cost. Since we cannot afford to protect everything against all threats,
GAO has advocated that DHS make clear the link between the choices made
about protection priorities and the allocation of available resources.
Proposals to reduce risk must be evaluated on numerous dimensions - their
dollar cost and their impact on other goals and values. Decisions on the
level of resources, the allocation of those resources, and how to balance
security against other societal goals and values also need to be
considered.

Our recent work at DHS suggests that developing and using a risk-based
approach for making resource investment decisions will not be easy.
Decision makers may not have complete or current information on threats,
vulnerabilities, consequences, alternatives, and costs. Nevertheless, we
see benefits in continuing to develop the approach, and are prepared to
work with the department and others in the Administration to make it
happen.

This testimony is based on our wide-ranging work on GPRA, federal budget
and performance integration, and 21st century challenges; as well as our
work on homeland security and risk management. We conducted our work in
accordance with generally accepted government auditing standards.

  The Long-Term Fiscal Challenge Drives the Fiscal Future and the Need for
  Reexamination

Known demographic trends, rising health care costs, and lower federal
revenues as a percentage of the economy are the major drivers of the
nation's large and growing structural deficits. The nation cannot ignore
this fiscal large and growing fiscal imbalance-it is not a matter of
whether the nation deals with the fiscal gap, but how and when. GAO's
long-term budget simulations illustrate the magnitude of this fiscal
challenge. Figures 1 and 2 show these simulations under two different sets
of assumptions. Figure 1 uses the Congressional Budget Office's (CBO)
January 2005 baseline through 2015. As required by law, that baseline
assumes no changes in current law, that discretionary spending grows

with inflation through 2015, and that all tax cuts currently scheduled to
expire actually do expire. In Figure 2, two assumptions about that first
10 years are changed: (1) discretionary spending grows with the economy
rather than with inflation, and (2) all tax cuts currently scheduled to
expire are made permanent. In both simulations discretionary spending is
assumed to grow with the economy after 2015 and revenue is held constant
as a share of gross domestic product (GDP) at the 2015 level. Also in both
simulations, long-term Social Security and Medicare spending are based on
the 2005 trustees' intermediate projections, and we assume that benefits
continue to be paid in full after the trust funds are exhausted. Long-term
Medicaid spending is based on CBO's December 2003 long-term projections
under their midrange assumptions.

Figure 1

Figure 2

As these simulations illustrate, absent policy changes on the spending
and/or revenue side of the budget, the growth in spending on federal
retirement and health entitlements will encumber an escalating share of
the government's resources. Indeed, when we assume that recent tax
reductions are made permanent and discretionary spending keeps pace with
the economy, our long-term simulations suggest that by 2040 federal
revenues may be adequate to pay little more than interest on the federal
debt. Neither slowing the growth in discretionary spending nor allowing
the tax provisions to expire-nor both together-would eliminate the
imbalance. Although federal tax policies will likely be part of any debate
about our fiscal future, making no changes to Social Security, Medicare,
Medicaid, and other drivers of the long-term fiscal gap would require at
least a doubling of federal taxes in the future-and that seems both
unrealistic and inappropriate.

Demographic shifts and rising health care costs are not the only forces at
work that require the federal government to rethink its entire approach to
program performance, policy design, public priorities, and management
practices. Other important forces are working to reshape American

society, our place in the world, and the role of the federal government.
These include evolving defense and homeland security policies, increasing
global interdependence, and advances in science and technology. In
addition, the federal government increasingly relies on new networks and
partnerships to develop public policy and achieve positive results, often
including multiple federal agencies, domestic and international non- or
quasi-government organizations, for-profit and not-for-profit contractors,
and state and local governments.

If government is effectively to address these trends, it cannot treat all
of its existing programs, policies, and activities as givens. Outmoded
commitments and operations constitute an encumbrance on the future that
can and does erode the capacity of the nation to better align its
government with the needs and demands of a changing world and society.
Accordingly, reexamining the base of all major existing federal spending
and tax programs, policies, and activities by reviewing their results and
testing their continued relevance and relative priority for our changing
society is an important step in the process of assuring fiscal
responsibility and facilitating national renewal.3

A periodic reexamination offers the prospect of addressing emerging needs
by weeding out programs and policies that are redundant, outdated, or
ineffective. Those programs and policies that remain relevant could be
updated and modernized by improving their targeting and efficiency through
such actions as redesigning allocation and cost-sharing provisions,
consolidating facilities and programs, and streamlining and reengineering
operations and processes. The tax policies and programs financing the
federal budget can also be reviewed with an eye toward both the overall
level of revenues that should be raised as well as the mix of taxes that
are used.

Reexamining the base offers compelling opportunities to both redress our
current and projected fiscal imbalance while better positioning government
to meet the new challenges and opportunities of the 21st century. In this
regard, the management and performance reforms enacted by Congress in the
past 15 years have provided new tools to gain insight into the financial,
program, and management performance of federal

3For more information on reexamination of federal programs, see GAO, 21st
Century Challenges: Reexamining the Base of the Federal Government,
GAO-05-325SP (Washington, D.C.: February 2005).

  Performance Budgeting Holds Promise for Reassessment and Priority Setting

agencies and activities. The information being produced as a result can
provide a strong basis to support the much needed and long overdue review,
reassessment, and reprioritization process.

With GPRA as their centerpiece, these reforms also laid the foundation for
performance budgeting by establishing infrastructures in the agencies to
improve the supply of information on planning, performance and costs. GPRA
is designed to inform congressional and executive decision making by
providing objective performance and cost information on the effectiveness
and efficiency of federal programs and spending. A key purpose of GPRA is
to create closer and clearer links between the process of allocating
scarce resources and the expected results to be achieved with those
resources.4 Importantly, GPRA requires both a connection to the structures
used in congressional budget presentations and consultation between the
executive and legislative branches on agency strategic plans.5 Because
these requirements are grounded in statute, Congress has an oversight
stake in GPRA's success. Over a decade after its enactment, GPRA has
succeeded in expanding the supply of performance information and
institutionalizing a culture of performance as well as providing a solid
foundation for more recent budget and performance initiatives.6

Building on GPRA, the current administration has made the integration of
performance and budget information one of five top governmentwide
management priorities. Under the President's Management Agenda (PMA),
agencies are expected to implement integrated financial and performance
management systems that routinely produce information that is (1)
timely-to measure and affect performance, (2) useful-to make more informed
operational and investing decisions, and (3) reliable-to ensure consistent
and comparable trend analysis over time and to facilitate better
performance measurement and decision making. It is critical that budgetary
investments in this area be viewed as part of a broader initiative to
improve the accountability and management capacity of federal

4See Pub. L. No. 103-62, Sec. 2, 107 Stat. at 285 (1993).

55 U.S.C. Sec. 306 and 31 U.S.C. Secs. 1115-1116.

6GAO, Results-Oriented Government: GPRA Has Established a Solid Foundation
for Achieving Greater Results, GAO-04-38 (Washington, D.C.: March 10,
2004).

agencies and programs. Over the longer term, failing to discover and
correct performance problems will be much more costly.

The Program Assessment and Rating Tool (PART) is a questionnaire that is
designed to provide a systematic approach to assessing the strengths and
weaknesses of a program. PART asks, for example, whether a program's
long-term goals are specific, ambitious, and focused on outcomes, and
whether annual goals demonstrate progress toward achieving the long-term
goals. It is intended to be evidence-based, drawing on a wide array of
information, including authorizing legislation, GPRA strategic plans and
performance plans and reports, financial statements, inspector general and
GAO reports, and independent program evaluations.7 Importantly, PART can
be used to identify gaps in information. The fact that a program's PART
score suffers from the absence of information provides added impetus for
agencies to enhance their evaluation and information-gathering
capabilities.8

PART's program-by-program approach fits with OMB's agency-by-agency budget
reviews, but it is not well suited to addressing crosscutting issues or to
looking at broad program areas in which several programs address a common
goal. It is often critical to understand how each program fits with a
broader portfolio of tools and strategies-such as regulations, direct
loans, and tax expenditures-to accomplish federal missions and performance
goals.

The credibility of performance information, including related cost data,
and the ability of federal agencies to produce credible evaluations of
their programs' effectiveness are key to the success of performance
budgeting. As I have testified before, this type of information is
critical for effective

7The Office of Management and Budget (OMB) has used PART to assess the
performance of 32 programs in DHS reported in the President's budgets for
fiscal years 2004-2006. The assessment consisted of programs operated by
the Coast Guard, Transportation and Security Administration, Immigration
and Customs Enforcement, Customs and Border Protection, Office for
Domestic Preparedness, Science and Technology, and the Federal Emergency
Management Agency, among others. On the basis of answers to 25 questions
relating to a program's purpose, planning, management, results and
accountability, OMB concluded performance was effective for 4 programs,
moderately effective for 6 programs, and adequate for 6 programs. OMB
found that results were not demonstrated for the remaining 16 programs.

8For a detailed examination of PART, see GAO, Performance Budgeting:
Observations on the Use of OMB's Program Assessment Rating Tool for the
Fiscal Year 2004 Budget, GAO-04-174 (Washington, D.C.: January 30, 2004).

performance measurement to support decisions in areas ranging from program
efficiency and effectiveness to sourcing and contract management. 9 To be
effective, this information must be not only timely

and reliable, but also both useful and used.

Federal performance and accountability reforms have given much attention
to increasing the supply of performance information over the past several
decades. However, improving the supply of performance information is in
and of itself insufficient to achieve and sustain resultsbased performance
budgeting and management approaches. Rather, it needs to be accompanied by
a demand for and use of that information by congressional decision makers
and executive managers alike. The history of performance budgeting
suggests that congressional support and use of this information is
critical to sustain reforms over time. Congress has a number of
opportunities to provide its perspective on performance issues and
performance goals, such as when it establishes or reauthorizes a new
program, during the annual appropriations process, and in its oversight of
federal policies and programs.

Performance budgeting can do a great deal to help policy makers address
important questions, such as whether programs are contributing to their
stated goals, are well-coordinated with related initiatives at the federal
level or elsewhere, and are targeted to the intended beneficiaries.
However, it should not be expected to provide the answers to all resource
allocation questions in some automatic or formula-driven process.
Performance problems may well prompt budget cuts, program consolidations,
or eliminations. Alternatively, as in the case of homeland security,
programs that existed before September 11 may now be deemed to be of
sufficiently high priority to the nation that they inspire enhanced
investments and reforms in program design and management. Conversely, even
a program that is found to be exceeding its performance expectations can
be a candidate for budgetary cuts if it is a lower priority than other
competing claims in the process. The determination of priorities is a
function of competing values and interests that may be informed by
performance information but also reflects other factors, such as the
overall budget situation, the state of the economy, security needs, equity
considerations, unmet societal needs, and the appropriate role of the
federal government in addressing any such needs.

9GAO, Management Reform: Assessing the President's Management Agenda,
GAO-05-574T (Washington, D.C.: April 21, 2005).

  Planning and Risk Management Key to Overall Approach for Allocating Homeland
  Security Resources

As reflected in the Homeland Security Act of 200210 (enacted in November
2002) and the National Strategy for Homeland Security (issued in July
2002), both Congress and the President have agreed that DHS should be
focused on preventing terrorist attacks, reducing the country's
vulnerability to terrorism, and minimizing the damage and recovering from
any attacks that may occur. The President's national strategy also notes
that the United States "must carefully weigh the benefit of each homeland
security endeavor and only allocate resources where the benefit of
reducing risk is worth the amount of additional cost." It recognizes that
the need for homeland security is not tied solely to the current terrorist
threat but to enduring vulnerability from a range of potential threats
that could include weapons of mass destruction and bioterrorism.

Using the national strategy and the act as foundations, the department
issued its first departmentwide strategic plan in February 2004. The
strategic plan sets out the following strategic objectives for achieving
DHS's mission:

o  	Awareness-Identify and understand threats, assess vulnerabilities,
determine potential impacts, and disseminate timely information to our
homeland security partners and the American public.

o  Prevention-Detect, deter, and mitigate threats to our homeland.

o  	Protection-Safeguard our people and their freedoms, and critical
infrastructure, property and the economy of our nation from acts of
terrorism, natural disasters, or other emergencies.

o  	Response-Lead, manage, and coordinate the national response to acts of
terrorism, natural disasters, or other emergencies.

o  	Recovery-Lead national, state, local, and private sector efforts to
restore services and rebuild communities after acts of terrorism, natural
disasters, or other emergencies.

o  	Service-Serve the public effectively by facilitating lawful trade,
travel and immigration.

o  	Organizational excellence-Value our most important resource, our
people. Create a culture that promotes a common identity, innovation,

10Pub. L. No. 107-296, 116 Stat. 2135 (2002).

mutual respect, accountability and teamwork to achieve efficiencies,
effectiveness, and operational synergies.

In a report earlier this year to the House Government Reform Subcommittee
on National Security, Emerging Threats and International Relations, we
pointed out that while DHS has made considerable progress in its planning
efforts, its strategic plan did not address the relationship between
annual and long-term goals.11 This linkage is critical for determining
whether DHS has a clear sense of how it will assess progress toward
achieving the intended results for its long-term goals. In addition, the
plan does not include specific budgetary, human capital, or other
resources needed to achieve the long-term goals.

Although the strategic plan did not detail the resources DHS believes it
needs to carry out its mission and achieve its strategic goals, DHS has
presented some of this information as part of its annual budget materials.
Congress has required OMB to present a crosscutting perspective on
homeland security spending as part of the President's Budget. The
discussion of homeland security spending by strategic goal across all
federal agencies is an example of the impact that congressional oversight
can have on budget presentations and analysis. As we have previously
noted, the structure of appropriations accounts and congressional
justifications also reflects choices about how resource allocation choices
are framed and the types of controls and incentives considered most
important. Given Congress's role in setting national priorities and
allocating resources to achieve them, Congressional comfort with the
structure of and analyses in budget justifications is critical. The
department should work with its congressional committees to assure that
the information it provides is useful to Congress in achieving its
legislative, oversight, appropriations, and control objectives.

Risk Management 	The national strategy and DHS's strategic plan called for
the use of riskbased decisions to prioritize DHS's resource investments
regarding homeland security related programs. In addition, Homeland
Security Presidential Directive/HSPD-7, issued in December 2003, charged
DHS with integrating the use of risk management into homeland security

11GAO, Results-Oriented Government: Improvements to DHS' Planning Process
Would Enhance Usefulness and Accountability, GAO-05-300 (Washington, D.C.:
March 31, 2005).

activities related to the protection of critical infrastructure. The
directive called on the department to develop policies, guidelines,
criteria, and metrics for this effort. The new DHS Secretary testified on
June 9, 2005, to the need for managing risk at the homeland security level
by developing plans and allocating resources in a way that balance
security and freedom. He noted the importance of assessing the full
spectrum of threats and vulnerabilities, conducting risk management, and
setting realistic priorities in guiding decisions about how to best
organize to prevent, respond to, and recover from an attack.

Armed with better planning and performance information, the department
needs to develop a more formal and disciplined approach to risk
management. Answering questions such as "What is an acceptable level of
risk to guide homeland security strategies and investments?" and "What
criteria should be used to target federal funding for homeland security to
maximize results and mitigate risk within available resource levels?" will
not be easy. Yet these kinds of questions may also provide a window of
opportunity to rethink approaches to long-standing problems and concerns.

A risk management framework for making homeland security and
counterterrorism investment decisions consists of a number of components.
Assessing risk is a critical component of a risk management approach, and
it should be reflective of current and future likely threats, which should
be informed but not driven by past actions. Assessing risk involves three
key elements-threats, vulnerabilities, and criticality (or
consequences)-that provide input into the decision-making process. A
threat assessment identifies and evaluates potential threats on the basis
of factors such as capabilities, intentions, and past activities. Threats
might be present at the global, national, or local level, and their
sources include terrorists and criminal enterprises. Threat information
emanates from "open" sources and intelligence (both strategic and
tactical). However, we will never know if we have identified every threat
or event and may not have complete information about the threats we have
identified. Consequently, two other elements of the approach,
vulnerability and criticality assessments, are essential to better prepare
against threats. A vulnerability assessment identifies weaknesses that may
be exploited by identified threats and suggests options to address those
weaknesses. A criticality assessment evaluates and prioritizes assets and
functions in terms of specific criteria, such as their importance to
public safety and the economy, as a basis for identifying which structures
or processes are relatively more important to protect from attack.
Information from these

three assessments can lead to a risk characterization, such as high,
medium, or low, and provides input for prioritizing security
initiatives.12

For example, an airport that is determined to be a critical asset,
vulnerable to attack, and a likely target would be at high risk and,
therefore, would be a higher priority for funding than an airport that is
less vulnerable to an attack. In this vein, aviation security measures
shown to reduce the risk to the most critical assets would provide the
greatest protection for the cost.

Figure 3 depicts a risk management cycle representing a series of
analytical and managerial steps, basically sequential, that can be used to
assess risk, assess alternatives for reducing risks, choose among those
alternatives, implement the alternatives, monitor their implementation,
and continually use new information to adjust and revise the assessments
and actions, as needed. Adoption of a risk management framework such as
this can aid in assessing risk by determining which vulnerabilities should
be addressed in what ways within available resources. 13

12GAO, Transportation Security: Systematic Planning Needed to Optimize
Resources, GAO-05-357T (Washington, D.C.: February 15, 2005).

13GAO, Protection of Chemical and Water Infrastructure: Federal
Requirements, Actions of Sected Facilities, and Remaining Challenges,
GAO-05-327 (Washington, D.C.: March 28, 2005).

Figure 3: Risk Management Framework

In addition to being dynamic, the approach may be applied at various
organizational levels, from multiagency or sectoral down to individual
investments or projects. Some adaptation of the framework may be
expected-for instance, risk management choices available to site managers
may entail departmental or statutory constraints.

In our latest high-risk series, released in January 2005, we noted that an
area of increasing concern involves the need for the completion of
comprehensive national threat and risk assessments in a variety of areas,
including homeland security. 14 As GAO reported in its review of DHS's
first strategic plan, stakeholder involvement was limited. Stakeholder
involvement in the planning process is important to ensure that DHS's
efforts and resources are aligned with other federal and nonfederal
partners with shared responsibilities for homeland security and that they
are targeted at the highest priorities. At the same time, this threat/risk
assessment concept can be applied to a broad range of existing federal
government programs, functions, and activities.

A viable risk management approach would also affect outcomes beyond the
federal sector. The choice and design of policy tools, such as grants,
regulations, and tax incentives, can enhance the capacity of all levels of
government to target areas of highest risk and greatest need, promote

14GAO, High-Risk Series: An Update, GAO-05-207 (Washington, D.C.: January
2005).

  Some Elements of Risk Management Being Used at DHS

shared responsibilities by all parties, and track and assess progress
toward achieving national preparedness goals. For example, in order to
promote a stronger federal, state, local, and regional partnership to
improve homeland security, Congress needs to determine how to concentrate
federal grant funds in the places with the highest risks. Given the
significant needs and limited federal resources, it will be important to
target areas of greatest need. Congressional proposals to alter the
formula for allocating homeland security funds to states reflect attention
to this issue. We have noted that the formula for federal grant
distribution should be based on several considerations, including relative
threats and vulnerabilities faced by states and communities as well as the
state or local government's capacity to respond to a disaster.15

Several DHS component agencies have taken some initial steps toward risk
management. For example, agencies such as the Coast Guard and Customs and
Border Protection (CBP) have taken actions to try to mitigate
vulnerabilities and enhance maritime security. Security plans for
seaports, facilities, and vessels have been developed based on assessments
that identify their vulnerabilities. In addition, the Coast Guard is using
a Port Security Risk Assessment Tool, which is designed to prioritize risk
according to a combination of possible threat, consequence, and
vulnerability. Under this approach, seaport infrastructure that is
determined to be both a critical asset and a likely and vulnerable target
would be a high priority for security enhancements or funding. By
comparison, infrastructure that is vulnerable to attack but not as
critical or infrastructure that is very critical but already well
protected would be lower in priority. We are currently conducting a
detailed review of the use of risk management for maritime security.

In the transportation area, the Transportation Security Administration
(TSA) has conducted limited vulnerability assessments at selected general
aviation airports based on specific security concerns or requests by
airport officials. Agency officials told us that conducting assessments
was costly and, therefore, impractical to do for the 19,000 general
aviation airports nationwide, or even the approximately 4,800 public-use
general aviation airports. TSA intended to implement a risk management
approach to better assess threats and vulnerabilities of general aviation
aircraft and

15GAO, Homeland Security: Reforming Federal Grants to Better Meet
Outstanding Needs, GAO-03-1146T (Washington, D.C.: September 3, 2003).

airports and, as part of this approach, was developing an online
vulnerability self-assessment tool to be completed by individual airport
managers. However, we noted limitations to the use of the self-assessment
tool, and TSA had not developed a plan with specific milestones to
implement the assessment, thereby making it difficult to monitor the
progress of its efforts. Also, TSA had not conducted an overall systematic
assessment of threats to, or vulnerabilities of, general aviation to
determine how to better prepare against terrorist threats.

Immigration and Customs Enforcement's Office of Investigations (OI) has
taken some initial steps to base future budget requests on threat
assessments. To develop its budget request and workforce plans for fiscal
year 2007 and beyond, OI field offices conducted baseline threat
assessments on a regional basis using scenarios such as the presence of a
business that transports biological materials and may employ terrorists.
Related performance measures have been developed, but are not yet in use.

CBP had taken some steps to address the risks posed by terrorist smuggling
of weapons in oceangoing cargo containers. Although CBP's strategy
incorporated some elements of risk management, we reported that CBP had
not performed a comprehensive set of threat, criticality, vulnerability,
and risk assessments that experts said are vital for determining levels of
risk for each container.16

With respect to the allocation of homeland security funds to states,
approximately 40 percent of the $5.1 billion in statewide grant funds
awarded in fiscal years 2002 through 2005 were shared equally among the 50
states, the District of Columbia, the Commonwealth of Puerto Rico, and
U.S. territories. The remaining amount was distributed according to state
population. Therefore, this formula for allocating money is not
risk-based. Several congressional proposals have been advanced to alter
the statewide funding formula to base it more directly on risk
considerations. This seems to be both appropriate and necessary given
current and projected deficits. One proposal would largely maintain the
portion of funds shared equally by the states but would base the
distribution of the remaining funds on a risk-based formula similar to the
one currently used for urban area grants. Another proposal (from this
committee) would reduce the minimum

16GAO, Homeland Security: Summary of Challenges Faced in Targeting Ocean
Going Cargo Containers for Inspection, GAO-04-557T (Washington, D.C.:
March 31, 2004)

Concluding observations

amount of funding shared equally by states to approximately 14 percent of
total funding and establish a board to allocate the remaining funds
through an evaluation of threat, vulnerability, and the potential
consequences of a terrorist attack.

As the nation faces a long-term fiscal imbalance, and the role of the
federal government is being reshaped, there is a critical need for the
federal government to reexamine the base of its programs, policies,
functions, and activities. Performance budgeting can help enhance the
government's capacity to assess competing claims for federal dollars by
providing decision makers with better information on the results of
individual programs, as well as on various federal policies and programs
addressing common goals.

In this context, the importance of DHS' mission cannot be overstated.
While absolute security for the U.S. homeland is impossible, seeking to
minimize vulnerability must remain a goal. Much is at stake when decisions
are made about how to allocate limited resources across a large number of
programs in multiple DHS agencies. GAO has consistently advocated
implementation of a risk management approach for prioritizing efforts and
focusing resources. This kind of approach is especially important since we
seek to address threats that are seemingly limitless with resources that
are limited. It is necessary to prioritize both risks and the actions
taken to reduce risks. Where can resources do the most good? How should
they be allocated across risks and across risk-reducing activities?
Risk-based, priority-driven decisions can help inform decision makers in
allocating finite resources to the areas of greatest need. Congress and
agencies have a shared responsibility for ensuring that performance
budgeting and risk management approaches are both useful and used.
Congress can play an important role by using the resulting information in
the authorization, appropriations, and oversight process. Further, to the
extent that Congress wants to instill a risk-based approach, it is
important to recognize that agencies need to have some flexibility in
implementing it.

As the Congress and DHS move to rebalance resource priorities to address
the relative risks facing the nation, it is important to reexamine major
existing programs and activities based on their relative contribution to
reducing the areas of greatest vulnerability. This will require making
tough choices to identify those activities with the greatest potential net
benefit for the nation as a whole, while reassessing the need for other
programs with more limited or less nationwide scale and importance. Going

forward, we need to rethink certain traditional funding strategies, such
as per capita based formulas and earmarks to determine whether they are
consistent with a risk based approach.

We should not expect this effort to be easy or the path forward to be
smooth. Risk assessment is difficult in many government areas. It is
especially so in the area of homeland security in which initial
probabilities and consequences and the effectiveness of countermeasures
are unusually difficult to determine. Getting relevant, reliable, and
timely information for risk assessment is also quite difficult.
Nevertheless, the effort should be made. A comprehensive approach should
be developed and maintained. The state of the art for risk management will
take time to mature. This will require sustained management commitment-and
continued involvement, support, and oversight by Congress.

This completes my prepared statement. I would be pleased to respond to any
questions you or other members of the subcommittee may have.

For future information on this testimony, please contact Norman J. Rabkin
at 202-512-8777. Other key contributors included Denise Fantone, Kimberly
Gianopoulos, Susan Irving, Jacqueline Nowicki, Evi Rezmovic, and Jonathan
Tumin.

This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.

  GAO's Mission

Obtaining Copies of GAO Reports and Testimony

The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting its
constitutional responsibilities and to help improve the performance and
accountability of the federal government for the American people. GAO
examines the use of public funds; evaluates federal programs and policies;
and provides analyses, recommendations, and other assistance to help
Congress make informed oversight, policy, and funding decisions. GAO's
commitment to good government is reflected in its core values of
accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost
is through GAO's Web site (www.gao.gov). Each weekday, GAO posts newly
released reports, testimony, and correspondence on its Web site. To have
GAO e-mail you a list of newly posted products every afternoon, go to
www.gao.gov and select "Subscribe to Updates."

Order by Mail or Phone 	The first copy of each printed report is free.
Additional copies are $2 each. A check or money order should be made out
to the Superintendent of Documents. GAO also accepts VISA and Mastercard.
Orders for 100 or more copies mailed to a single address are discounted 25
percent. Orders should be sent to:

U.S. Government Accountability Office 441 G Street NW, Room LM Washington,
D.C. 20548

To order by Phone: 	Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061

  To Report Fraud, Contact:

Waste, and Abuse in Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: [email protected] Programs Automated answering system: (800)
424-5454 or (202) 512-7470

Gloria Jarmon, Managing Director, [email protected] (202)
512-4400Congressional U.S. Government Accountability Office, 441 G Street
NW, Room 7125 Relations Washington, D.C. 20548

Public Affairs 	Paul Anderson, Managing Director, [email protected] (202)
512-4800 U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, D.C. 20548

                           PRINTED ON RECYCLED PAPER
*** End of document. ***