Information Technology: Immigration and Customs Enforcement Is
Beginning to Address Infrastructure Modernization Program
Weaknesses but Key Improvements Still Needed (27-JUL-06,
GAO-06-823).
The Department of Homeland Security's (DHS) fiscal year 2005
appropriations act provided $39.6 million for Immigration and
Customs Enforcement's (ICE) program to modernize its information
technology (IT) infrastructure. The goals of the program--which
consists of seven projects and is referred to as Atlas--include
improving information sharing and strengthening security. As
mandated by the appropriations act, the department is to develop
and submit for approval an expenditure plan for Atlas that
satisfies certain legislative conditions, including a review by
GAO. In performing its review of the Atlas plan, GAO was asked to
(1) determine whether the plan satisfies certain legislative
conditions, (2) determine the status of our prior
recommendations, and (3) provide any other observations about the
plan and management of the program.
-------------------------Indexing Terms-------------------------
REPORTNUM: GAO-06-823
ACCNO: A57547
TITLE: Information Technology: Immigration and Customs
Enforcement Is Beginning to Address Infrastructure Modernization
Program Weaknesses but Key Improvements Still Needed
DATE: 07/27/2006
SUBJECT: Information infrastructure
Information security
Information technology
Internal controls
Procurement planning
Procurement practices
Program management
Strategic planning
Technology modernization programs
Program evaluation
DHS Atlas Program
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO Product. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
******************************************************************
GAO-06-823
* Compliance with Legislative Conditions
* Status of Open Recommendations
* Other Observations on the Expenditure Plan and Management of
* Conclusions
* Recommendations for Executive Action
* Agency Comments and Our Evaluation
* Appendix I: Briefing to Staffs Subcommittees on Homeland Sec
* Appendix II: GAO Contact and Staff Acknowledgments
* GAO Contact
* Staff Acknowledgments
* Order by Mail or Phone
Report to Congressional Committees
United States Government Accountability Office
GAO
July 2006
INFORMATION TECHNOLOGY
Immigration and Customs Enforcement Is Beginning to Address Infrastructure
Modernization Program Weaknesses but Key Improvements Still Needed
GAO-06-823
Contents
Letter 1
Compliance with Legislative Conditions 2
Status of Open Recommendations 2
Other Observations on the Expenditure Plan and Management of Atlas 5
Conclusions 6
Recommendations for Executive Action 6
Agency Comments and Our Evaluation 6
Appendix I Briefing to Staffs Subcommittees on Homeland Security, Senate
and House Committees on Appropriations 8
Appendix II GAO Contact and Staff Acknowledgments 73
Abbreviations
CIO Chief Information Officer
DHS Department of Homeland Security
EA Enterprise Architecture
ICE Immigration and Customs Enforcement
INS Immigration and Naturalization Service
IRB Investment Review Board
IT information technology
OMB Office of Management and Budget
PART Program Assessment Rating Tool
SEI Software Engineering Institute
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.
United States Government Accountability Office
Washington, DC 20548
July 27, 2006
The Honorable Judd Gregg Chairman The Honorable Robert C. Byrd Ranking
Member Subcommittee on Homeland Security Committee on Appropriations
United States Senate
The Honorable Harold Rogers Chairman The Honorable Martin Olav Sabo
Ranking Member Subcommittee on Homeland Security Committee on
Appropriations House of Representatives
The 2005 Department of Homeland Security Appropriations Act1 provided
$39.6 million for Immigration and Customs Enforcement's (ICE) program to
modernize its information technology (IT) infrastructure. The goals of the
program-which consists of seven related IT projects and is referred to by
ICE as Atlas-include improving information sharing, strengthening
information security, and improving workforce productivity. The act
prohibited the Department of Homeland Security (DHS) from obligating the
$39.6 million until the department developed a plan that satisfied certain
legislative conditions for how the funds are to be spent. The conditions
included, among other things, having us review the plan. On March 15,
2006, DHS submitted its fiscal year 2005 expenditure plan to the Senate
and House Appropriations Subcommittees on Homeland Security. Pursuant to
the act, we reviewed the plan; our objectives were to (1) determine
whether the plan satisfies legislative conditions specified in the act,
(2) determine the status of prior recommendations, and (3) provide any
other observations about the plan and management of the program.
On April 27, 2006, we provided DHS officials, including ICE's Deputy Chief
Information Officer (CIO), a written briefing on our findings,
conclusions, and recommendations. These officials agreed with our
briefing. On May 1, 2006, we provided this briefing to the Senate and
House Homeland Security Subcommittee staffs.2 This report provides the
presentation slides used to brief the staffs and summarizes our findings,
conclusions, and recommendations. The full briefing, including our scope
and methodology, is reprinted in appendix I.
1Pub. L. No. 108-334 (Oct. 18, 2004).
Compliance with Legislative Conditions .
DHS has taken actions to address each of the applicable legislative
conditions specified in the appropriations act. In particular, the plan,
including related program documentation and program officials' stated
commitments, satisfied or partially satisfied key aspects of (1) meeting
the capital planning and investment control review requirements of the
Office of Management and Budget (OMB);3 (2) complying with the DHS
enterprise architecture;4 (3) complying with acquisition rules,
requirements, guidelines, and systems acquisition management practices of
the federal government; and (4) having the plan reviewed and approved by
DHS's Investment Review Board, the Secretary of Homeland Security, and
OMB.
Status of Open Recommendations
ICE is taking steps to address our open recommendations. Each
recommendation, along with the status of actions to address it, is
summarized as follows:
o Recommendation: Revise and update the cost-benefit analysis to
identify current mission requirements, determine how they will be
met, and develop an estimate of the program's incremental and
life- cycle costs, benefits, schedule, and return on investment.
Status: ICE has partially completed5 implementation of this
recommendation. A revised cost-benefit analysis was issued in
December 2005 as part of a business case justification for Atlas
mission requirements. The analysis included three alternative
solutions for how requirements would be met, as well as each
alternative's estimated life-cycle costs, benefits, schedule, and
return on investment. However, the analysis does not fully adhere
to our recommendation and key federal practices.6 For example, it
does not address all key mission requirements, such as sharing law
enforcement and immigration information with external partners
(such as the Departments of Justice and State, state and local law
enforcement). According to the program manager, a long-range
strategic plan for information sharing will be developed to
identify requirements, and it will be used to update the analysis
of costs and benefits related to information sharing and other
requirements.
o Recommendation: Make the program office operational by (1)
developing a staffing needs assessment to determine the positions
and the level of staffing needed for all projects to adequately
manage the program, including a human capital strategy for
acquiring staff and a timetable for bringing them on board; (2)
finalizing the roles and responsibilities for the positions
identified in the staffing assessment and for the projects; and
(3) implementing and institutionalizing key acquisition management
controls, including risk management processes where relevant
responsibilities are assigned and key risks and their status are
reported to an executive body.
Status: ICE's implementation of this recommendation is in
progress.7 First, in April 2006, program officials completed an
organizational and staffing assessment. The assessment identified
an organizational structure, functions, and associated positions
for the program office as well as the staff needed to fill the
positions. To date, ICE has filled most of the positions (and is
in the process of filling the others). Second, as part of the
aforementioned assessment, program officials finalized staff roles
and responsibilities and assigned high-level tasks for each staff
member. Third, program officials have begun to implement key
acquisition management controls. For example, the Atlas program
completed a risk management plan in January 2006 and hired an
analyst to manage the risks. However, a complete inventory of
risks has not been prepared.
o Recommendation: Develop and implement an updated security plan
and privacy impact assessment.
Status: ICE has partially completed implementing this
recommendation. The program issued an updated security plan in
April 2006, but it is missing important IT security management
practices or only partially addresses them. For example, the
program did not have a complete inventory of all information
systems or a complete description of the systems. In addition, the
program did not define common and system-specific security
controls. Regarding privacy, the program issued a draft privacy
impact assessment in August 2005, which is being reviewed by the
department's Privacy Office. This office has requested additional
documentation from ICE but did not provide a date for when its
review would be finalized.
o Recommendation: Develop and implement rigorous performance
management practices for the program that include properly aligned
goals, benefits, achievements, and anticipated achievements that
are defined in measurable terms.
Status: ICE implementation of this recommendation is in progress.
The program has taken steps to align its goals and other
indicators and is beginning to implement them. For example, as
part of the business case (December 2005), the program mapped
Atlas's mission and goals to ICE's mission and goals. The program
also developed seven performance goals and associated measures for
the projects. However, three Atlas projects did not have
performance goals and measures; the program manager plans to
develop them by June 2006. In addition, the program has yet to
implement the seven measures.
o Recommendation: Ensure that future expenditure plans fully
disclose the system capabilities, schedule, cost, and benefits to
be delivered, as well as the acquisition strategy.
Status: ICE implementation of this recommendation is in progress.
The fiscal year 2005 expenditure plan does not show the level of
detail and program scope for congressional stakeholders to
understand its plans and commitments relative to system
capabilities, cost, benefits, and schedule. In addition, it does
not sufficiently describe progress made against program commitment
(e.g., expected benefits). Instead, the plan and supporting
documentation describe, for example, high-level system
capabilities to be delivered under each project. Our prior
experience shows that these plans need to disclose a sufficient
level and scope of information for Congress to understand what the
system capabilities are to be delivered, by when, at what cost,
and what progress is being made against the commitments. The
program manager stated that the program planned to include this
information in future plans.
Other Observations on the Expenditure Plan and Management of Atlas
Our observations address (1) Atlas project management planning and
(2) an OMB assessment of the program. An overview of these
observations follows:
o Project management planning does not include key elements.
Atlas project plans, which are a key aspect of effective project
planning, are not fully consistent with relevant guidance. For
example, the plans are at a high level and are not based on a
detailed work breakdown structure of tasks to be performed, do not
include information on project cost or budget, and do not identify
constraints or risks. Further, the plans have not been reviewed
and approved by management and key stakeholders. According to the
program manager, missing elements will be incorporated as the
plans are reviewed and made final.
o Efforts are under way to address OMB concerns that Atlas was
not demonstrating results. An August 2005 OMB assessment found
that Atlas was not demonstrating expected results.8 In response,
ICE developed an action plan (dated April 2006) to address the
concerns. Examples of steps planned and under way include
establishing an Atlas program management office to manage and
oversee the program and developing goals and measures that are to
be finalized by the end of June 2006. Program officials told us
that the program will not be ready to be reassessed (i.e., agency
management does not believe that significant improvement could be
shown) by OMB until-at the earliest-October 2006. Citing this
assessment, the administration's fiscal year 2007 budget stated
that no funds were being provided for Atlas until the program
weaknesses are addressed.
Conclusions
The fiscal year 2005 Atlas expenditure plan, in combination with
related program documentation and program officials' statements,
satisfies or partially satisfies the legislative conditions set
forth by Congress. However, this satisfaction is based on plans
and commitments that provide for meeting these conditions, rather
than on completed actions to satisfy the conditions. In addition,
while steps are being initiated that are intended to address
program management weaknesses, a number of improvements, including
those recommended in our past report, have yet to be implemented.
Thus, there is much that still needs to be accomplished to
minimize the risks associated with the program's capacity to
deliver promised IT infrastructure capabilities and benefits on
time and within budget. Given that hundreds of millions of dollars
are to be invested, it is essential that DHS follow through on its
commitments to build the capacity to effectively manage the
program. Proceeding without this capacity introduces unnecessary
risks to the program and potentially jeopardizes its viability for
future investment.
Moreover, congressional decision makers need reliable information
about program commitments that are to be met with the expenditure
plan funds, including the benefits to be produced, the
capabilities to be delivered, and the cost and schedule estimates
to be met. By not providing this information in its fiscal year
2005 expenditure plan, DHS is impeding congressional oversight by
not providing a meaningful basis for measuring performance and
ensuring accountability.
Recommendations for Executive Action
To minimize risks to the Atlas program, we recommend that the
Secretary of Homeland Security direct the Assistant Secretary for
Immigration and Customs Enforcement to take the following two
actions:
o Report periodically to Senate and House appropriations
subcommittees regarding the program's progress in implementing our
recommendations.
o Develop and implement Atlas project plans consistent with
elements of effective project planning.
Agency Comments and Our Evaluation
On June 14, 2006, we provided a draft of this report to DHS for
comment. On July 10, 2006, DHS's GAO audit liaison told us that
the department did not intend to provide comments, recognizing
that DHS officials, including the ICE Deputy CIO, had previously
agreed with the briefing that this report summarizes. In addition,
the liaison e-mailed us technical comments updating the status of
Atlas-related activities of the department's Privacy Office and
ICE. We incorporated the comments in the report and briefing as
appropriate.
We are sending copies of this report to the Chairmen and Ranking
Members of other Senate and House committees and subcommittees
that have authorization and oversight responsibilities for
homeland security. We are also sending copies to the Secretary of
Homeland Security, Assistant Secretary for Immigration and Customs
Enforcement, and the Director of OMB. Copies of this report will
also be available at no charge on our Web site at www.gao.gov .
Should you or your offices have any questions on matters discussed
in this report, please contact me at (202) 512-3439 or at
hiter@gao.gov . Contact points for our Offices of Congressional
Relations and Public Affairs may be found on the last page of this
report. Key contributions to this report are listed in appendix
II.
Randolph C. Hite Director, Information Technology Architecture and
Systems Issues
Appendix II: GAO Contact and Staff Acknowledgments
GAO Contact
Randolph C. Hite (202) 512-3439
Staff Acknowledgments
In addition to the individual named above, Gary Mountjoy,
Assistant Director; Harold Brumm; Neil Doherty; Nancy Glover;
James Houtz; Tom Mills; and Tammi Nguyen made key contributions to
this report.
Staff Acknowledgments
he Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in
meeting its constitutional responsibilities and to help improve
the performance and accountability of the federal government for
the American people. GAO examines the use of public funds;
evaluates federal programs and policies; and provides analyses,
recommendations, and other assistance to help Congress make
informed oversight, policy, and funding decisions. GAO's
commitment to good government is reflected in its core values of
accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony
The fastest and easiest way to obtain copies of GAO documents at
no cost is through GAO's Web site ( www.gao.gov ). Each weekday,
GAO posts newly released reports, testimony, and correspondence on
its Web site. To have GAO e-mail you a list of newly posted
products every afternoon, go to www.gao.gov and select "Subscribe
to Updates."
Order by Mail or Phone
The first copy of each printed report is free. Additional copies
are $2 each. A check or money order should be made out to the
Superintendent of Documents. GAO also accepts VISA and Mastercard.
Orders for 100 or more copies mailed to a single address are
discounted 25 percent. Orders should be sent to:
U.S. Government Accountability Office 441 G Street NW, Room LM
Washington, D.C. 20548
To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax:
(202) 512-6061
To Report Fraud, Waste, and Abuse in Federal Programs
Contact:
Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail:
fraudnet@gao.gov Automated answering system: (800) 424-5454 or
(202) 512-7470
Congressional Relations
Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400
U.S. Government Accountability Office, 441 G Street NW, Room 7125
Washington, D.C. 20548
Public Affairs
Paul Anderson, Managing Director, AndersonP1@gao.gov (202)
512-4800 U.S. Government Accountability Office, 441 G Street NW,
Room 7149 Washington, D.C. 20548
2We transmitted the briefing to the staffs on April 28, 2006.
3OMB Circular A-11, part 7, establishes policy for planning, budgeting,
acquiring, and managing federal capital assets.
4An enterprise architecture provides a clear and comprehensive picture of
an organization's operations and its supporting systems and
infrastructure. It is an essential tool for effectively and efficiently
engineering business processes and for implementing and evolving
supporting systems in a manner that maximizes interoperability, minimizes
overlap and duplication, and optimizes performance.
5Partially complete means actions are under way to implement the
recommendation.
6OMB, Guidelines and Discount Rates for Benefits-Cost Analysis of Federal
Programs, Circular A-94. (Washington, D.C.: Oct. 29, 1992).
7In progress means that actions have been initiated to implement the
recommendation.
8OMB made this assessment using its Program Assessment Rating Tool, which
is used to assess how well government programs are performing.
(310625)
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.
www.gao.gov/cgi-bin/getrpt? GAO-06-823 .
To view the full product, including the scope
and methodology, click on the link above.
For more information, contact Randolph C. Hite at (202) 512-3439 or
hiter@gao.gov.
Highlights of GAO-06-823 , a report to congressional committees
July 2006
INFORMATION TECHNOLOGY
Immigration and Customs Enforcement Is Beginning to Address Infrastructure
Modernization Program Weaknesses but Key Improvements Still Needed
The Department of Homeland Security's (DHS) fiscal year 2005
appropriations act provided $39.6 million for Immigration and Customs
Enforcement's (ICE) program to modernize its information technology (IT)
infrastructure. The goals of the program-which consists of seven projects
and is referred to as Atlas-include improving information sharing and
strengthening security. As mandated by the appropriations act, the
department is to develop and submit for approval an expenditure plan for
Atlas that satisfies certain legislative conditions, including a review by
GAO. In performing its review of the Atlas plan, GAO was asked to (1)
determine whether the plan satisfies certain legislative conditions, (2)
determine the status of our prior recommendations, and (3) provide any
other observations about the plan and management of the program.
What GAO Recommends
GAO is recommending that DHS minimize Atlas program risks by, among other
things, developing and implementing project plans consistent with elements
of effective project planning. DHS did not provide additional substantive
comments on this report recognizing that ICE had already agreed with the
briefing contained in this report.
DHS's fiscal year 2005 expenditure plan, related documentation, and
program officials' statements and commitments, satisfy or partially
satisfy the legislative conditions set forth by Congress, including (1)
meeting the capital planning and investment control review requirements
established by the Office of Management and Budget (OMB); (2) complying
with the DHS enterprise architecture; (3) complying with the acquisition
rules, requirements, guidelines, and system acquisition management
practices of the federal government; and (4) being reviewed and approved
by DHS's Investment Review Board, the Secretary of DHS, and OMB.
A number of steps to address prior GAO recommendations are in progress or
have been partially implemented (see table). For example, ICE issued a
revised cost-benefit analysis in December 2005. However, this analysis did
not address all key ICE mission requirements, such as sharing law
enforcement and immigration information with external partners. In
addition, it issued an updated security plan in April 2006, but the plan
was missing important security management practices, or only partially
addressed them.
Status of Actions to Implement GAO's Open Recommendations for Atlas
Source: GAO.
GAO also observed that current Atlas project plans do not include
essential elements, such as a work breakdown structure of tasks to be
performed, identification of project costs, analysis of constraints and
risks, and review and approval by management and key stakeholders.
Thus, there is much that remains to be accomplished to minimize the risks
associated with the Atlas program's capacity to deliver promised IT
infrastructure capabilities and benefits on time and within budget. Given
that hundreds of millions of dollars are to be invested, it is essential
that DHS follow through on commitments to build the capacity to
effectively manage the program. Moreover, expenditure plans need to relay
reliable information about program commitments, including the benefits to
be produced, the capabilities to be delivered, and the cost and schedule
estimates to be met. By not providing this information in its fiscal year
2005 expenditure plan, the department is impeding congressional oversight
and not providing a meaningful basis for measuring performance and
ensuring accountability.
*** End of document. ***