Information Technology: Immigration and Customs Enforcement Is	 
Beginning to Address Infrastructure Modernization Program	 
Weaknesses but Key Improvements Still Needed (27-JUL-06,	 
GAO-06-823).							 
                                                                 
The Department of Homeland Security's (DHS) fiscal year 2005	 
appropriations act provided $39.6 million for Immigration and	 
Customs Enforcement's (ICE) program to modernize its information 
technology (IT) infrastructure. The goals of the program--which  
consists of seven projects and is referred to as Atlas--include  
improving information sharing and strengthening security. As	 
mandated by the appropriations act, the department is to develop 
and submit for approval an expenditure plan for Atlas that	 
satisfies certain legislative conditions, including a review by  
GAO. In performing its review of the Atlas plan, GAO was asked to
(1) determine whether the plan satisfies certain legislative	 
conditions, (2) determine the status of our prior		 
recommendations, and (3) provide any other observations about the
plan and management of the program.				 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-06-823 					        
    ACCNO:   A57547						        
  TITLE:     Information Technology: Immigration and Customs	      
Enforcement Is Beginning to Address Infrastructure Modernization 
Program Weaknesses but Key Improvements Still Needed		 
     DATE:   07/27/2006 
  SUBJECT:   Information infrastructure 			 
	     Information security				 
	     Information technology				 
	     Internal controls					 
	     Procurement planning				 
	     Procurement practices				 
	     Program management 				 
	     Strategic planning 				 
	     Technology modernization programs			 
	     Program evaluation 				 
	     DHS Atlas Program					 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-06-823

     

     * Compliance with Legislative Conditions
     * Status of Open Recommendations
     * Other Observations on the Expenditure Plan and Management of
     * Conclusions
     * Recommendations for Executive Action
     * Agency Comments and Our Evaluation
     * Appendix I: Briefing to Staffs Subcommittees on Homeland Sec
     * Appendix II: GAO Contact and Staff Acknowledgments
          * GAO Contact
          * Staff Acknowledgments
               * Order by Mail or Phone

Report to Congressional Committees

United States Government Accountability Office

GAO

July 2006

INFORMATION TECHNOLOGY

Immigration and Customs Enforcement Is Beginning to Address Infrastructure
Modernization Program Weaknesses but Key Improvements Still Needed

GAO-06-823

Contents

Letter 1

Compliance with Legislative Conditions 2
Status of Open Recommendations 2
Other Observations on the Expenditure Plan and Management of Atlas 5
Conclusions 6
Recommendations for Executive Action 6
Agency Comments and Our Evaluation 6
Appendix I Briefing to Staffs Subcommittees on Homeland Security, Senate
and House Committees on Appropriations 8
Appendix II GAO Contact and Staff Acknowledgments 73
Abbreviations

CIO Chief Information Officer

DHS Department of Homeland Security

EA Enterprise Architecture

ICE Immigration and Customs Enforcement

INS Immigration and Naturalization Service

IRB Investment Review Board

IT information technology

OMB Office of Management and Budget

PART Program Assessment Rating Tool

SEI Software Engineering Institute

This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.

United States Government Accountability Office

Washington, DC 20548

July 27, 2006

The Honorable Judd Gregg Chairman The Honorable Robert C. Byrd Ranking
Member Subcommittee on Homeland Security Committee on Appropriations
United States Senate

The Honorable Harold Rogers Chairman The Honorable Martin Olav Sabo
Ranking Member Subcommittee on Homeland Security Committee on
Appropriations House of Representatives

The 2005 Department of Homeland Security Appropriations Act1 provided
$39.6 million for Immigration and Customs Enforcement's (ICE) program to
modernize its information technology (IT) infrastructure. The goals of the
program-which consists of seven related IT projects and is referred to by
ICE as Atlas-include improving information sharing, strengthening
information security, and improving workforce productivity. The act
prohibited the Department of Homeland Security (DHS) from obligating the
$39.6 million until the department developed a plan that satisfied certain
legislative conditions for how the funds are to be spent. The conditions
included, among other things, having us review the plan. On March 15,
2006, DHS submitted its fiscal year 2005 expenditure plan to the Senate
and House Appropriations Subcommittees on Homeland Security. Pursuant to
the act, we reviewed the plan; our objectives were to (1) determine
whether the plan satisfies legislative conditions specified in the act,
(2) determine the status of prior recommendations, and (3) provide any
other observations about the plan and management of the program.

On April 27, 2006, we provided DHS officials, including ICE's Deputy Chief
Information Officer (CIO), a written briefing on our findings,
conclusions, and recommendations. These officials agreed with our
briefing. On May 1, 2006, we provided this briefing to the Senate and
House Homeland Security Subcommittee staffs.2 This report provides the
presentation slides used to brief the staffs and summarizes our findings,
conclusions, and recommendations. The full briefing, including our scope
and methodology, is reprinted in appendix I.

1Pub. L. No. 108-334 (Oct. 18, 2004).

                    Compliance with Legislative Conditions .

DHS has taken actions to address each of the applicable legislative
conditions specified in the appropriations act. In particular, the plan,
including related program documentation and program officials' stated
commitments, satisfied or partially satisfied key aspects of (1) meeting
the capital planning and investment control review requirements of the
Office of Management and Budget (OMB);3 (2) complying with the DHS
enterprise architecture;4 (3) complying with acquisition rules,
requirements, guidelines, and systems acquisition management practices of
the federal government; and (4) having the plan reviewed and approved by
DHS's Investment Review Board, the Secretary of Homeland Security, and
OMB.

                         Status of Open Recommendations

ICE is taking steps to address our open recommendations. Each
recommendation, along with the status of actions to address it, is
summarized as follows:

           o  Recommendation: Revise and update the cost-benefit analysis to
           identify current mission requirements, determine how they will be
           met, and develop an estimate of the program's incremental and
           life- cycle costs, benefits, schedule, and return on investment.

           Status: ICE has partially completed5 implementation of this
           recommendation. A revised cost-benefit analysis was issued in
           December 2005 as part of a business case justification for Atlas
           mission requirements. The analysis included three alternative
           solutions for how requirements would be met, as well as each
           alternative's estimated life-cycle costs, benefits, schedule, and
           return on investment. However, the analysis does not fully adhere
           to our recommendation and key federal practices.6 For example, it
           does not address all key mission requirements, such as sharing law
           enforcement and immigration information with external partners
           (such as the Departments of Justice and State, state and local law
           enforcement). According to the program manager, a long-range
           strategic plan for information sharing will be developed to
           identify requirements, and it will be used to update the analysis
           of costs and benefits related to information sharing and other
           requirements.

           o  Recommendation: Make the program office operational by (1)
           developing a staffing needs assessment to determine the positions
           and the level of staffing needed for all projects to adequately
           manage the program, including a human capital strategy for
           acquiring staff and a timetable for bringing them on board; (2)
           finalizing the roles and responsibilities for the positions
           identified in the staffing assessment and for the projects; and
           (3) implementing and institutionalizing key acquisition management
           controls, including risk management processes where relevant
           responsibilities are assigned and key risks and their status are
           reported to an executive body.

           Status: ICE's implementation of this recommendation is in
           progress.7 First, in April 2006, program officials completed an
           organizational and staffing assessment. The assessment identified
           an organizational structure, functions, and associated positions
           for the program office as well as the staff needed to fill the
           positions. To date, ICE has filled most of the positions (and is
           in the process of filling the others). Second, as part of the
           aforementioned assessment, program officials finalized staff roles
           and responsibilities and assigned high-level tasks for each staff
           member. Third, program officials have begun to implement key
           acquisition management controls. For example, the Atlas program
           completed a risk management plan in January 2006 and hired an
           analyst to manage the risks. However, a complete inventory of
           risks has not been prepared.

           o  Recommendation: Develop and implement an updated security plan
           and privacy impact assessment.

           Status: ICE has partially completed implementing this
           recommendation. The program issued an updated security plan in
           April 2006, but it is missing important IT security management
           practices or only partially addresses them. For example, the
           program did not have a complete inventory of all information
           systems or a complete description of the systems. In addition, the
           program did not define common and system-specific security
           controls. Regarding privacy, the program issued a draft privacy
           impact assessment in August 2005, which is being reviewed by the
           department's Privacy Office. This office has requested additional
           documentation from ICE but did not provide a date for when its
           review would be finalized.

           o  Recommendation: Develop and implement rigorous performance
           management practices for the program that include properly aligned
           goals, benefits, achievements, and anticipated achievements that
           are defined in measurable terms.

           Status: ICE implementation of this recommendation is in progress.
           The program has taken steps to align its goals and other
           indicators and is beginning to implement them. For example, as
           part of the business case (December 2005), the program mapped
           Atlas's mission and goals to ICE's mission and goals. The program
           also developed seven performance goals and associated measures for
           the projects. However, three Atlas projects did not have
           performance goals and measures; the program manager plans to
           develop them by June 2006. In addition, the program has yet to
           implement the seven measures.

           o  Recommendation: Ensure that future expenditure plans fully
           disclose the system capabilities, schedule, cost, and benefits to
           be delivered, as well as the acquisition strategy.

           Status: ICE implementation of this recommendation is in progress.
           The fiscal year 2005 expenditure plan does not show the level of
           detail and program scope for congressional stakeholders to
           understand its plans and commitments relative to system
           capabilities, cost, benefits, and schedule. In addition, it does
           not sufficiently describe progress made against program commitment
           (e.g., expected benefits). Instead, the plan and supporting
           documentation describe, for example, high-level system
           capabilities to be delivered under each project. Our prior
           experience shows that these plans need to disclose a sufficient
           level and scope of information for Congress to understand what the
           system capabilities are to be delivered, by when, at what cost,
           and what progress is being made against the commitments. The
           program manager stated that the program planned to include this
           information in future plans.

           Other Observations on the Expenditure Plan and Management of Atlas
			  
			  Our observations address (1) Atlas project management planning and
           (2) an OMB assessment of the program. An overview of these
           observations follows:

           o  Project management planning does not include key elements.
           Atlas project plans, which are a key aspect of effective project
           planning, are not fully consistent with relevant guidance. For
           example, the plans are at a high level and are not based on a
           detailed work breakdown structure of tasks to be performed, do not
           include information on project cost or budget, and do not identify
           constraints or risks. Further, the plans have not been reviewed
           and approved by management and key stakeholders. According to the
           program manager, missing elements will be incorporated as the
           plans are reviewed and made final.
           o  Efforts are under way to address OMB concerns that Atlas was
           not demonstrating results. An August 2005 OMB assessment found
           that Atlas was not demonstrating expected results.8 In response,
           ICE developed an action plan (dated April 2006) to address the
           concerns. Examples of steps planned and under way include
           establishing an Atlas program management office to manage and
           oversee the program and developing goals and measures that are to
           be finalized by the end of June 2006. Program officials told us
           that the program will not be ready to be reassessed (i.e., agency
           management does not believe that significant improvement could be
           shown) by OMB until-at the earliest-October 2006. Citing this
           assessment, the administration's fiscal year 2007 budget stated
           that no funds were being provided for Atlas until the program
           weaknesses are addressed.

           Conclusions
			  
			  The fiscal year 2005 Atlas expenditure plan, in combination with
           related program documentation and program officials' statements,
           satisfies or partially satisfies the legislative conditions set
           forth by Congress. However, this satisfaction is based on plans
           and commitments that provide for meeting these conditions, rather
           than on completed actions to satisfy the conditions. In addition,
           while steps are being initiated that are intended to address
           program management weaknesses, a number of improvements, including
           those recommended in our past report, have yet to be implemented.

           Thus, there is much that still needs to be accomplished to
           minimize the risks associated with the program's capacity to
           deliver promised IT infrastructure capabilities and benefits on
           time and within budget. Given that hundreds of millions of dollars
           are to be invested, it is essential that DHS follow through on its
           commitments to build the capacity to effectively manage the
           program. Proceeding without this capacity introduces unnecessary
           risks to the program and potentially jeopardizes its viability for
           future investment.

           Moreover, congressional decision makers need reliable information
           about program commitments that are to be met with the expenditure
           plan funds, including the benefits to be produced, the
           capabilities to be delivered, and the cost and schedule estimates
           to be met. By not providing this information in its fiscal year
           2005 expenditure plan, DHS is impeding congressional oversight by
           not providing a meaningful basis for measuring performance and
           ensuring accountability.

           Recommendations for Executive Action
			  
			  To minimize risks to the Atlas program, we recommend that the
           Secretary of Homeland Security direct the Assistant Secretary for
           Immigration and Customs Enforcement to take the following two
           actions:

           o  Report periodically to Senate and House appropriations
           subcommittees regarding the program's progress in implementing our
           recommendations.
           o  Develop and implement Atlas project plans consistent with
           elements of effective project planning.

           Agency Comments and Our Evaluation
			  
			  On June 14, 2006, we provided a draft of this report to DHS for
           comment. On July 10, 2006, DHS's GAO audit liaison told us that
           the department did not intend to provide comments, recognizing
           that DHS officials, including the ICE Deputy CIO, had previously
           agreed with the briefing that this report summarizes. In addition,
           the liaison e-mailed us technical comments updating the status of
           Atlas-related activities of the department's Privacy Office and
           ICE. We incorporated the comments in the report and briefing as
           appropriate.

           We are sending copies of this report to the Chairmen and Ranking
           Members of other Senate and House committees and subcommittees
           that have authorization and oversight responsibilities for
           homeland security. We are also sending copies to the Secretary of
           Homeland Security, Assistant Secretary for Immigration and Customs
           Enforcement, and the Director of OMB. Copies of this report will
           also be available at no charge on our Web site at www.gao.gov .

           Should you or your offices have any questions on matters discussed
           in this report, please contact me at (202) 512-3439 or at
           [email protected] . Contact points for our Offices of Congressional
           Relations and Public Affairs may be found on the last page of this
           report. Key contributions to this report are listed in appendix
           II.

           Randolph C. Hite Director, Information Technology Architecture and
           Systems Issues

           Appendix II: GAO Contact and Staff Acknowledgments
			  
			  GAO Contact
			  
			  Randolph C. Hite (202) 512-3439

           Staff Acknowledgments
			  
			  In addition to the individual named above, Gary Mountjoy,
           Assistant Director; Harold Brumm; Neil Doherty; Nancy Glover;
           James Houtz; Tom Mills; and Tammi Nguyen made key contributions to
           this report.

           Staff Acknowledgments
			  
			  he Government Accountability Office, the audit, evaluation and
           investigative arm of Congress, exists to support Congress in
           meeting its constitutional responsibilities and to help improve
           the performance and accountability of the federal government for
           the American people. GAO examines the use of public funds;
           evaluates federal programs and policies; and provides analyses,
           recommendations, and other assistance to help Congress make
           informed oversight, policy, and funding decisions. GAO's
           commitment to good government is reflected in its core values of
           accountability, integrity, and reliability.

           Obtaining Copies of GAO Reports and Testimony
			  
			  The fastest and easiest way to obtain copies of GAO documents at
           no cost is through GAO's Web site ( www.gao.gov ). Each weekday,
           GAO posts newly released reports, testimony, and correspondence on
           its Web site. To have GAO e-mail you a list of newly posted
           products every afternoon, go to www.gao.gov and select "Subscribe
           to Updates."

           Order by Mail or Phone
			  
			  The first copy of each printed report is free. Additional copies
           are $2 each. A check or money order should be made out to the
           Superintendent of Documents. GAO also accepts VISA and Mastercard.
           Orders for 100 or more copies mailed to a single address are
           discounted 25 percent. Orders should be sent to:

           U.S. Government Accountability Office 441 G Street NW, Room LM
           Washington, D.C. 20548

           To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax:
           (202) 512-6061

           To Report Fraud, Waste, and Abuse in Federal Programs
			  
			  Contact:

           Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail:
           [email protected] Automated answering system: (800) 424-5454 or
           (202) 512-7470

           Congressional Relations
			  
			  Gloria Jarmon, Managing Director, [email protected] (202) 512-4400
           U.S. Government Accountability Office, 441 G Street NW, Room 7125
           Washington, D.C. 20548

           Public Affairs
			  
			  Paul Anderson, Managing Director, [email protected] (202)
           512-4800 U.S. Government Accountability Office, 441 G Street NW,
           Room 7149 Washington, D.C. 20548

2We transmitted the briefing to the staffs on April 28, 2006.

3OMB Circular A-11, part 7, establishes policy for planning, budgeting,
acquiring, and managing federal capital assets.

4An enterprise architecture provides a clear and comprehensive picture of
an organization's operations and its supporting systems and
infrastructure. It is an essential tool for effectively and efficiently
engineering business processes and for implementing and evolving
supporting systems in a manner that maximizes interoperability, minimizes
overlap and duplication, and optimizes performance.

5Partially complete means actions are under way to implement the
recommendation.

6OMB, Guidelines and Discount Rates for Benefits-Cost Analysis of Federal
Programs, Circular A-94. (Washington, D.C.: Oct. 29, 1992).

7In progress means that actions have been initiated to implement the
recommendation.

8OMB made this assessment using its Program Assessment Rating Tool, which
is used to assess how well government programs are performing.

(310625)

This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.

www.gao.gov/cgi-bin/getrpt? GAO-06-823 .

To view the full product, including the scope

and methodology, click on the link above.

For more information, contact Randolph C. Hite at (202) 512-3439 or
[email protected].

Highlights of GAO-06-823 , a report to congressional committees

July 2006

INFORMATION TECHNOLOGY

Immigration and Customs Enforcement Is Beginning to Address Infrastructure
Modernization Program Weaknesses but Key Improvements Still Needed

The Department of Homeland Security's (DHS) fiscal year 2005
appropriations act provided $39.6 million for Immigration and Customs
Enforcement's (ICE) program to modernize its information technology (IT)
infrastructure. The goals of the program-which consists of seven projects
and is referred to as Atlas-include improving information sharing and
strengthening security. As mandated by the appropriations act, the
department is to develop and submit for approval an expenditure plan for
Atlas that satisfies certain legislative conditions, including a review by
GAO. In performing its review of the Atlas plan, GAO was asked to (1)
determine whether the plan satisfies certain legislative conditions, (2)
determine the status of our prior recommendations, and (3) provide any
other observations about the plan and management of the program.

What GAO Recommends

GAO is recommending that DHS minimize Atlas program risks by, among other
things, developing and implementing project plans consistent with elements
of effective project planning. DHS did not provide additional substantive
comments on this report recognizing that ICE had already agreed with the
briefing contained in this report.

DHS's fiscal year 2005 expenditure plan, related documentation, and
program officials' statements and commitments, satisfy or partially
satisfy the legislative conditions set forth by Congress, including (1)
meeting the capital planning and investment control review requirements
established by the Office of Management and Budget (OMB); (2) complying
with the DHS enterprise architecture; (3) complying with the acquisition
rules, requirements, guidelines, and system acquisition management
practices of the federal government; and (4) being reviewed and approved
by DHS's Investment Review Board, the Secretary of DHS, and OMB.

A number of steps to address prior GAO recommendations are in progress or
have been partially implemented (see table). For example, ICE issued a
revised cost-benefit analysis in December 2005. However, this analysis did
not address all key ICE mission requirements, such as sharing law
enforcement and immigration information with external partners. In
addition, it issued an updated security plan in April 2006, but the plan
was missing important security management practices, or only partially
addressed them.

Status of Actions to Implement GAO's Open Recommendations for Atlas

Source: GAO.

GAO also observed that current Atlas project plans do not include
essential elements, such as a work breakdown structure of tasks to be
performed, identification of project costs, analysis of constraints and
risks, and review and approval by management and key stakeholders.

Thus, there is much that remains to be accomplished to minimize the risks
associated with the Atlas program's capacity to deliver promised IT
infrastructure capabilities and benefits on time and within budget. Given
that hundreds of millions of dollars are to be invested, it is essential
that DHS follow through on commitments to build the capacity to
effectively manage the program. Moreover, expenditure plans need to relay
reliable information about program commitments, including the benefits to
be produced, the capabilities to be delivered, and the cost and schedule
estimates to be met. By not providing this information in its fiscal year
2005 expenditure plan, the department is impeding congressional oversight
and not providing a meaningful basis for measuring performance and
ensuring accountability.
*** End of document. ***