    Highlights of a Forum Convened by the Comptroller General of the
    United States: Strengthening the Use of Risk Management
    Principles in Homeland Security (15-APR-08, GAO-08-627SP).

    From the terrorist attacks of September 11, 2001, to Hurricane
    Katrina, homeland security risks vary widely. The nation can
    neither achieve total security nor afford to protect everything
    against all risks. Managing these risks is especially difficult
    in today's environment of globalization, increasing security
    interdependence, and growing fiscal challenges for the federal
    government. It is increasingly important that organizations
    effectively target homeland security funding--totaling nearly $65
    billion in 2008 federal spending alone--to address the nation's
    most critical priorities. GAO convened a forum of experts on
    October 25, 2007, to advance a national dialogue on applying risk
    management to homeland security. Broadly defined, risk management
    is a process that helps policymakers assess risk, strategically
    allocate finite resources, and take actions under conditions of
    uncertainty. Participants included federal, state, and local
    officials and risk management experts from the private sector and
    academia. The forum addressed effective practices, challenges
    federal agencies face in applying risk management to homeland
    security, and actions that can strengthen homeland security risk
    management. Comments expressed during the proceedings do not
    necessarily represent the views of any one participant, the
    organizations they represent, or GAO. Participants reviewed a
    draft of this report and their comments were incorporated, as
    appropriate.
    -------------------------Indexing Terms-------------------------
    REPORTNUM:   GAO-08-627SP
        ACCNO:   A81687
      TITLE:     Highlights of a Forum Convened by the Comptroller General
    of the United States: Strengthening the Use of Risk Management
    Principles in Homeland Security
         DATE:   04/15/2008
      SUBJECT:   Emergency preparedness
    	     Emergency response plans
    	     Homeland security
    	     Policy evaluation
    	     Program evaluation
    	     Program management
    	     Risk assessment
    	     Risk factors
    	     Risk management
    	     Security assessments
    	     Standards evaluation
    	     Strategic planning
    	     Terrorists
    	     program goals or objectives
    	     Program implementation
    	     CG Forum

    ******************************************************************
    ** This file contains an ASCII representation of the text of a  **
    ** GAO Product.                                                 **
    **                                                              **
    ** No attempt has been made to display graphic images, although **
    ** figure captions are reproduced.  Tables are included, but    **
    ** may not resemble those in the printed version.               **
    **                                                              **
    ** Please see the PDF (Portable Document Format) file, when     **
    ** available, for a complete electronic file of the printed     **
    ** document's contents.                                         **
    **                                                              **
    ******************************************************************
    GAO-08-627SP

    This is the accessible text file for GAO report number GAO-08-627SP
    entitled 'Highlights Of A Forum: Strengthening the Use of Risk
    Management Principles in Homeland Security' which was released on April
    15, 2008.

    This text file was formatted by the U.S. Government Accountability
    Office (GAO) to be accessible to users with visual impairments, as part
    of a longer term project to improve GAO products' accessibility. Every
    attempt has been made to maintain the structural and data integrity of
    the original printed product. Accessibility features, such as text
    descriptions of tables, consecutively numbered footnotes placed at the
    end of the file, and the text of agency comment letters, are provided
    but may not exactly duplicate the presentation or format of the printed
    version. The portable document format (PDF) file is an exact electronic
    replica of the printed version. We welcome your feedback. Please E-mail
    your comments regarding the contents or accessibility features of this
    document to Webmaster@gao.gov.

    This is a work of the U.S. government and is not subject to copyright
    protection in the United States. It may be reproduced and distributed
    in its entirety without further permission from GAO. Because this work
    may contain copyrighted images or other material, permission from the
    copyright holder may be necessary if you wish to reproduce this
    material separately.

    United States Government Accountability Office:
    GAO:

    April 2008:

    Highlights Of A Forum:

    Convened by the Comptroller General of the United States:

    Strengthening the Use of Risk Management Principles in Homeland
    Security:

    GAO-08-627SP:

    GAO Highlights:

    Highlights of GAO-08-627SP, a GAO forum.

    Why GAO Convened This Forum:

    From the terrorist attacks of September 11, 2001, to Hurricane Katrina,
    homeland security risks vary widely. The nation can neither achieve
    total security nor afford to protect everything against all risks.
    Managing these risks is especially difficult in today�s environment of
    globalization, increasing security interdependence, and growing fiscal
    challenges for the federal government. It is increasingly important
    that organizations effectively target homeland security
    funding�totaling nearly $65 billion in 2008 federal spending alone�to
    address the nation�s most critical priorities.

    GAO convened a forum of experts on October 25, 2007, to advance a
    national dialogue on applying risk management to homeland security.
    Broadly defined, risk management is a process that helps policymakers
    assess risk, strategically allocate finite resources, and take actions
    under conditions of uncertainty. Participants included federal, state,
    and local officials and risk management experts from the private sector
    and academia.

    The forum addressed effective practices, challenges federal agencies
    face in applying risk management to homeland security, and actions that
    can strengthen homeland security risk management. Comments expressed
    during the proceedings do not necessarily represent the views of any
    one participant, the organizations they represent, or GAO. Participants
    reviewed a draft of this report and their comments were incorporated,
    as appropriate.

    What Participants Said:

    Forum participants discussed risk management practices currently used
    or being considered in the private and public sectors, such as the
    position of chief risk officer (CRO). Private sector CROs communicate
    information about risks to the business executives responsible for
    mitigating risks and steer mitigation efforts. A government CRO could
    address the need for leadership in public sector risk management
    initiatives, such as improving emergency response and disaster recovery
    efforts. Participants also noted differences between the public and
    private sectors. For example, the private sector has the flexibility to
    choose which risks to insure against, while the public sector must
    accommodate the public�s beliefs about risks and preferences for risk
    management.

    Participants identified and ranked the challenges in applying risk
    management principles to homeland security that in their view were the
    most critical to address. The top three challenges were (1) improving
    risk communication, for instance, addressing the lack of a common
    vocabulary to discuss risk management and lack of a public dialogue
    about acceptable levels of risk; (2) political obstacles to risk-based
    resource allocation, such as the reluctance of policymakers, at times,
    to make difficult choices about what to protect; and (3) lack of
    strategic thinking, including lack of a governmentwide discussion and
    strategy related to homeland security investments.

    When asked to rank which challenge should be addressed first,
    participants most often selected improving risk communication followed
    by political obstacles and improving strategic thinking, as shown in
    the figure below. The expert panel proposed a number of actions to
    strengthen the use of risk management principles, such as increasing
    meaningful public outreach to provide fact-based estimates of risk,
    highlighting the importance of risk management to incoming
    policymakers, and identifying effective risk assessment practices.

    Figure: Rankings by Participants of Challenges in the Order They Should
    Be Addressed:

    [See PDF for image]

    This figure is a horizontal bar graph depicting the following data:

    Challenge to be addressed: Improving risk communication;
    Participants' weighted average ranking: 1.0.

    Challenge to be addressed: Political obstacles to risk-based resource
    allocation;
    Participants' weighted average ranking: 0.58.

    Challenge to be addressed: Improving strategic thinking;
    Participants' weighted average ranking: 0.55.

    Challenge to be addressed: Improving risk assessment practices;
    Participants' weighted average ranking: 0.34.

    Challenge to be addressed: Measuring and evaluating risk reduction;
    Participants' weighted average ranking: 0.32.

    Challenge to be addressed: Enhancing public-private partnerships;
    Participants' weighted average ranking: 0.27.

    Challenge to be addressed: Need for consensus on a definition of risk
    management;
    Participants' weighted average ranking: 0.2.

    Challenge to be addressed: Lack of common methodologies at all levels
    of government;
    Participants' weighted average ranking: 0.09.

    Challenge to be addressed: Developing next generation of risk managers;
    Participants' weighted average ranking: 0.01.

    Source: GAO analysis of participants' forum polling responses.

    Note: This presents the weighted average rankings of the participants�
    assessment of the overall order that each of the challenges should be
    addressed on a scale of 1 to 0, with 1 being the highest ranking and 0
    being the lowest.

    [End of figure]

    To view the full product, click on [hyperlink, http://www.gao.gov/cgi-
    bin/getrpt?GAO-08-627SP]. For more information, contact Cathleen
    Berrick at (202) 512-3404 or berrickc@gao.gov.

    [End of section]

    Contents:

    Letter:

    Introduction:

    Current Risk Management Practices in the Private and Public Sectors:

    Homeland Security Risk Management Challenges:

    Addressing Homeland Security Risk Management Challenges:

    Suggested Next Steps:

    Appendix I: Agenda:

    Appendix II: List of Participants:

    Appendix III: Presentation by Norman Rabkin, Managing Director,
    Homeland Security and Justice, GAO:

    Appendix IV: GAO Contacts and Staff Acknowledgments:

    Related GAO Products:

    Figures:

    Figure 1: Pre-Forum Polling�Most Critical Challenge in Applying Risk
    Management to Homeland Security:

    Figure 2: Forum Polling�Most Critical Challenge in Applying Risk
    Management to Homeland Security:

    Figure 3: Forum Polling�Rankings by Participants of Challenges in the
    Order They Should Be Addressed:

    [End of section]

    United States Government Accountability Office:
    Washington, DC 20548:

    Introduction:

    GAO has highlighted the practice of effective risk management as a
    challenge for both Congress and the administration. Broadly defined,
    risk management is a strategic process for helping policymakers make
    decisions about assessing risk, allocating finite resources, and taking
    actions under conditions of uncertainty. Recognizing that risk
    management helps policymakers make informed decisions, Congress and the
    administration have charged federal agencies to use a risk-based
    approach to prioritize resource investments. Nevertheless, federal
    agencies often lack comprehensive risk management strategies that are
    well integrated with program, budget, and investment decisions.

    While integrating a risk management approach into decision-making
    processes is challenging for any organization, GAO has reported that it
    is particularly difficult for the Department of Homeland Security
    (DHS), given its diverse set of responsibilities. The department is
    responsible for dealing with all-hazards homeland security risks--
    ranging from natural disasters to industrial accidents and terrorist
    attacks. The history of natural disasters has provided experts with
    extensive historical data that are used to assess risks. By contrast,
    data about terrorist attacks are comparatively limited, and risk
    management is complicated by the asymmetric and adaptive nature of our
    enemies. Despite these and other challenges, DHS is making progress in
    applying risk management principles to guide its operational and
    resource allocation decisions.

    CGAO has assessed DHS's risk management efforts across a number of
    mission areas--including transportation security, port security,
    border security, critical infrastructure protection, and immigration
    enforcement--and found that risk management principles have been
    considered and applied to varying degrees. However, substantial
    challenges remain in strengthening risk-based efforts and using this
    information to inform strategies and investment decisions. Addressing
    these challenges will take time, leadership, and attention. Moreover,
    risk management needs to be viewed strategically--that is, with a view
    that goes beyond assessing specific risks and integrates a
    consideration for risk into annual budget and program review cycles.

    In addition to helping federal agencies like DHS focus their efforts,
    risk management can assist state and local governments and the private
    sector--which owns over 85 percent of the nation's critical
    infrastructure--with prioritizing their efforts to improve the
    resiliency of our critical infrastructure and make it easier for the
    nation to rebound after a catastrophic event. Congress has recognized
    state and local governments and the private sector as important
    stakeholders in a national homeland security enterprise and has
    directed federal agencies to foster better information sharing with
    these partners. Without effective partnerships, the federal government
    alone will be unable to meet its responsibilities in protecting and
    securing the homeland. A shared national approach--among federal,
    state, and local governments as well as between public and private
    sectors--is needed to manage homeland security risk.

    CGAO convened this forum on October 25, 2007, to assist Congress and
    federal agencies, including DHS, by advancing the national dialogue on
    risk management challenges in homeland security and by helping to
    identify potential solutions to these complex challenges. The forum
    focused on (1) lessons that can be learned from leading organizations
    about the effective use of risk management practices, (2) key
    challenges faced by public and private organizations in adopting and
    implementing a risk-based approach for homeland security, and (3)
    actions that should be taken in the near and long term to address the
    most pressing of these challenges. (See app. I for the agenda.) In
    addition to addressing these objectives, participants spoke generally
    about potential next steps to be taken in the near term to help
    strengthen risk management practices.

    The forum brought together a diverse array of experts, including
    representatives from all levels of government, nonprofit organizations,
    industry, and academia. (See app. II for a list of participants.) The
    forum was designed so that participants could comment on these issues
    openly, without individual attribution, to facilitate a rich, frank,
    and substantive discussion.

    This summary captures the ideas and themes that emerged at the forum,
    the collective discussion of participants, and comments received from
    participants based on a draft of this summary. Thus, the summary does
    not necessarily represent the views of any individual participant or
    the organizations that these participants represent, including GAO.

    I would like to thank the forum participants for taking the time to
    share their knowledge, insights, and perspectives on this important
    topic. Others will benefit from these insights. We look forward to
    working with the participants on these and other issues of mutual
    interest and concern in the future.

    Signed by:

    Gene L. Dodaro:
    Acting Comptroller General of the United States:

    April 15, 2008:

    [End of introduction]

    Current Risk Management Practices in the Private and Public Sectors:

    The forum was opened with two presentations: the first, provided by
    Norman Rabkin of GAO, described the importance of risk management in
    strengthening homeland security resource allocations given current and
    projected fiscal challenges. The second presentation, provided by
    Esther Baur of Swiss Re, set the stage for a group discussion on
    current risk management practices in the private and public sectors.
    Overall, participants discussed the concept of a chief risk officer
    (CRO) and public sector examples of effective risk management practices
    used by organizations such as the U.S. Coast Guard (USCG) and compared
    and contrasted public and private sector risk management practices.

    Presentation by Norman Rabkin, GAOC:

    Norman Rabkin is Managing Director of GAO's Homeland Security and
    Justice Team. Mr. Rabkin presented on behalf of the Comptroller
    General, who was unable to attend the forum. He opened the forum with a
    presentation on the United States' current fiscal crisis--based on the
    Comptroller General's Fiscal Wake-up Tour--and the importance of using
    risk management principles to focus resources on our most pressing
    concerns. (See app. III for Mr. Rabkin's presentation.) He noted that
    homeland security risks are complex and stretch across numerous hazards
    because of either human actions or natural causes, including terrorism,
    natural disasters such as hurricanes Katrina and Rita, and accidents
    such as the I-35W bridge collapse in Minneapolis. Mr. Rabkin stated
    that the nation will never be completely safe, total security is an
    unachievable goal, and we cannot afford to protect everything against
    all threats.

    According to Mr. Rabkin, projections of growing fiscal challenges for
    federal, state, and local governments underscore this issue. He stated
    that in 2006, the United States' costs exceeded revenues by $450
    billion, and cash outlays exceeded cash receipts by $248 billion. Mr.
    Rabkin described the primary source of the problem as the long-range
    liabilities and commitments that have increased during the past 6 years
    from $20 trillion to $50 trillion--or about $440,000 for every U.S.
    household. He noted that state and local governments are also facing
    increasing fiscal pressures--in particular, health care costs such as
    states' obligations under the Medicaid program--and that these in turn
    contribute to the federal government's fiscal challenges. Mr. Rabkin
    added that the country is on an imprudent and unsustainable fiscal path
    and will not grow out of this problem.

    Mr. Rabkin noted that there are some possible ways to address the
    nation's long-term fiscal problems. He said that our nation needs more
    discussion about where we are and where we are headed and that we need
    to reexamine what the government does, how the government does
    business, and who does the government's business. Mr. Rabkin said that
    the application of risk-based principles can help the nation in this
    regard through more informed decision making regarding the allocation
    of federal resources. He noted that Congress and the administration
    have recognized the value of risk management in helping policymakers
    make resource allocation decisions and have charged federal agencies
    with incorporating these principles into program planning and budgeting
    processes. He further noted that DHS is making progress in applying
    risk management to guide its operational and resource allocation
    decisions and cited the creation of the department's Office of Risk
    Management and Analysis in 2007 to lead efforts to address the overall
    management and analysis of homeland security risk.

    Mr. Rabkin described GAO's risk management[Footnote 1] framework that
    the office uses, along with other criteria, in assessing DHS's risk
    management[Footnote 2] efforts. He stated that this framework is based
    on industry best practices and consists of five phases: (1) setting
    strategic goals and objectives, and determining constraints; (2)
    assessing risks;[Footnote 3] (3) evaluating alternatives for addressing
    these risks; (4) selecting the appropriate alternatives; and (5)
    implementing the alternatives and monitoring the progress made and
    results achieved. He said that applying risk management in a homeland
    security context is a relatively new endeavor and that approaches will
    continue to evolve as processes mature and lessons are learned.

    Mr. Rabkin closed his presentation by stating that GAO invited the
    participants to the forum to discuss the most critical challenges in
    applying risk management principles to homeland security and how best
    to address these challenges. He thanked the participants for responding
    to a pre-forum poll and noted that this information was used to shape
    the forum's agenda.

    Presentation by Esther Baur, Swiss Re:

    Esther Baur is Director of Group Communications and Head of Issue
    Management & Messages at Swiss Re, a multinational reinsurance firm
    recognized for expertise in risk and capital management. Ms. Baur began
    the forum's session on risk management practices with a presentation
    entitled "Risk Management in the Private and Public Sectors." Ms. Baur
    noted Swiss Re's participation in the World Economic Forum's (WEF)
    Global Risk Network (GRN), which produced the 2008 Global Risk Report
    for the WEF Annual Meeting in Davos, Switzerland. She noted that the
    GRN members collaborated in workshops to define and assess global risks
    based on their likelihood and severity, and developed a map of 23 core
    risks that the international community faces over the next 10 years.

    Ms. Baur began the presentation by discussing the history of the
    discipline of risk management, beginning with its roots in banking and
    finance. She emphasized its evolution from a discipline based largely
    on intuition into a more quantitative and systematic approach. Ms. Baur
    described Swiss Re's model for applying risk management to reinsurance,
    which is based on three conceptual pillars: (1) quantitative risk
    management, or identifying and assessing risks; (2) risk governance, or
    determining who manages risks and examining lines of defense to prevent
    and mitigate risks; and (3) risk disclosure or transparency, to help
    provide a sound basis for decision making.

    Ms. Baur outlined overall roles and responsibilities in risk management
    as they apply to the public and private sectors. She noted that in both
    sectors overall roles and responsibilities in the risk management
    process should include the systematic identification and assessment of
    risks through scientific efforts; risk mitigation, either through
    direct legislation, executive action, or incentives; and risk
    adaptation to address financial consequences or to allow for effective
    transfer of risk. Ms. Baur stated that the unique role of the private
    sector is to "pre-fund" and diversify risk through insurance, and to
    support risk prevention by reflecting the quality of such measures in
    premiums. Public sector responsibilities include regulating land use
    and building codes; organizing disaster protection, response, and
    recovery measures; setting regulatory frameworks; and supplementing the
    insurance industry. She observed that government decisions are
    influenced by the public's perception of risk and called for better
    management of risk perception through government dissemination of
    factual information.

    Given the interdependent nature of public and private sector roles and
    responsibilities, Ms. Baur emphasized the importance of public-private
    coordination and partnerships in providing insurance for natural
    catastrophes and terrorism. As an example, she described an effort by
    the government of Mexico to seek private sector support to pre-fund
    potential natural disaster losses by issuing earthquake bonds.[Footnote
    4] She stated that terrorism risk is uninsurable without a public-
    private partnership for the following two reasons. First, she explained
    that terrorism risk cannot be quantified as effectively as natural
    disaster risk because historical data are more limited and potentially
    have less predictive relevance. Second, terrorism may impose extreme
    losses correlated over time and types of risks (e.g., to property,
    human lives, and financial markets). As a result, governments play
    important roles in managing terrorism risk, such as regulating
    insurance coverage, providing backstop financing as the "insurer of
    last resort," deploying antiterrorism measures, and providing for
    emergency response and recovery. Ms. Baur noted that public-private
    arrangements exist in several countries--including in the United States
    through the Terrorism Risk Insurance Act--and that Swiss Re supports
    permanent market solutions based on a risk partnership among the
    insured, insurers, reinsurers, capital markets, and governments.

    Ms. Baur concluded her presentation by suggesting an idea for group
    discussion--the establishment of a CRO for government. She noted that
    many private sector organizations, including Swiss Re, have designated
    CROs whose role is to focus on understanding and communicating
    information about risks to the business managers responsible for
    mitigating risk and to steer risk mitigation efforts. A government CRO
    would ideally work jointly with the private sector to identify emerging
    risks, establish a risk landscape of frequency and severity based on
    the best scientific knowledge, communicate this risk landscape to
    policymakers and the general public, steer mitigation efforts toward
    the biggest risks, and pool and manage those risks that cannot be
    carried by the (re)insurance industry alone.

    The Role of a Chief Risk Officer:

    Participants discussed the potential applicability of a CRO in the
    public sector. Participants emphasized the importance of defining
    reporting relationships through an organizational structure that
    provides sufficient authority to a CRO, while also facilitating the
    flow of information. One participant noted that the CRO at his firm
    reported separately to both the chief executive officer and the board
    of directors to help ensure accountability.

    Participants suggested that a public sector CRO could address the need
    for leadership in public sector risk management initiatives. As an
    example, one participant noted that the United Kingdom (U.K.)
    established a cabinet-level risk management unit called the Civil
    Contingencies Secretariat (CCS) in response to the "3 Fs" crises--fuel
    strike, flooding, and foot-and-mouth disease. In response to public
    concerns over the U.K.'s risk preparedness, the CCS developed a risk
    map and defined criteria for assessing losses, and to date, the focus
    of the CCS in the U.K. has been on improving emergency response and
    disaster recovery efforts. According to this participant, planned next
    steps include engaging a broader array of stakeholders in risk
    assessments.

    One participant stated that the Secretary of DHS is analogous to a
    domestic CRO for the federal government. Through Homeland Security
    Presidential Directive 5, the President has designated the Secretary of
    DHS as the principal federal official for domestic incident management,
    responsible for coordinating federal operations within the United
    States and across all federal agencies to prepare for, respond to, and
    recover from terrorist attacks, major disasters, and other emergencies.
    According to this participant, Secretary Chertoff has recently
    designated the new DHS Office of Risk Management and Analysis (RMA) as
    his executive agent for risk management across all DHS components. The
    participant stated that through RMA, the process of establishing a
    domestic risk management function for homeland security has begun and
    is intended to include a coordinating role across other departments and
    agencies outside of DHS in the future.

    Participants identified various challenges associated with the
    development of a CRO position, including (1) balancing the
    responsibilities for protection against seizing opportunities for long-
    range risk reduction, (2) creating a champion but not another silo that
    is not integrated with other components of the organization, and (3)
    generating leadership support for the position.

    Examples of Public Sector Organizations with Effective Risk Practices:

    During the discussion of current risk management practices,
    participants highlighted examples that they believed demonstrated the
    effective integration of risk management into the operations of several
    public sector organizations, including USCG, the U.S. Army Corps of
    Engineers (USACE), the Port Authority of New York and New Jersey
    (PANYNJ), and China's Liquid Natural Gas (LNG) operations.

    Four participants pointed to USCG as an example of an agency that
    effectively uses risk management. According to one participant, since
    September 11, 2001, USCG has expanded its traditional port security
    program to a wide-ranging maritime security strategy that includes an
    enhanced counterterrorism role. This participant stated that USCG uses
    risk analysis and threat assessments from the intelligence community to
    implement a risk-based strategy to concentrate maritime security
    measures when and where relative risk is the greatest. The participant
    stated that USCG uses its long-standing principles of risk management,
    which are continually improved through the risk analysis cycle, at the
    highest levels of the organization to prepare for the impact of high-
    risk scenarios and to balance security needs with the need to ensure an
    efficient flow of commerce. The participant further stated that risk-
    based principles are being institutionalized through Area Maritime
    Security Committees--a routine process for working together with
    regional partners. According to another participant, USCG is pushing
    its processes for managing risk down to its captains to let them work
    with private and public sector partners on implementation of risk
    management initiatives. For example, a participant noted that USCG and
    U.S. Customs and Border Protection (CBP) work together daily when
    boarding vessels to reduce risk as well as to ensure the efficient flow
    of commerce.[Footnote 5]

    Another participant stated that USACE developed flood risk management
    practices that have been used to digest and share critical information
    with the public. For example, after Hurricane Katrina, USACE ran
    supercomputer Advanced Circulation Model programs to model residual
    risk and the potential impact of rebuilding in affected areas.
    According to the participant, these complex models were made available
    to the public through Google Earth, and despite fears of confusion,
    this information-sharing project empowered people to locate their own
    addresses and make informed, risk-based decisions about rebuilding.

    One participant noted that PANYNJ developed and implemented a risk
    assessment program that guided the agency's management in setting
    priorities for a 5-year, $500 million security capital investment
    program. According to the participant, this methodology has since been
    applied to over 30 other transportation and port agencies across the
    country, and PANYNJ itself has moved from conducting individual risk
    assessments to implementing an ongoing program of risk management. The
    participant noted that PANYNJ's risk management program conducts
    security risk assessments on a 2-year cycle, where the risk of an array
    of potential security threats is assessed for a set list of individual
    critical assets and subcomponents of assets. The participant said that
    as each successive risk assessment is conducted, the results are
    compared against the prior assessment, and the change in relative risk
    is calculated to show not only improvement in the agency's risk profile
    as the result of new security investment but also any potential
    worsening in that risk profile as the result of a changing threat
    picture. In this way, the participant stated that PANYNJ has
    successfully compared successive risk assessment results to measure the
    buy-down of risk as a metric for security program performance. PANYNJ
    has also implemented a methodology for risk and cost-benefit analysis
    that facilitates the comparative analysis of competing high-cost
    security alternatives.

    Finally, one participant discussed China as an international example of
    the public sector's use of risk management in homeland security. The
    participant stated that the Chinese government requires security risk
    assessments of maritime LNG shipping operations before granting
    operating permits. According to the participant, this requirement makes
    an important contribution to securing petrochemicals by promoting
    consistent risk management practices from the beginning of operations.

    Comparing and Contrasting Public and Private Sector Risk Management
    Practices:

    Participants compared and contrasted public and private sector risk
    management practices. One participant noted that risk management is
    challenging in both the public and private sectors and is a function
    that tends to evolve over time. Participants suggested that for both
    sectors, the development of risk management capabilities requires a
    multidisciplinary approach, involving a wide range of skills. It was
    further suggested that it is necessary to constantly incorporate new
    skills and to work collaboratively with universities when particular
    specialists do not reside in-house.

    Participants stated that the private sector has the flexibility to
    choose which risks to insure against and tends to naturally consider
    opportunity analysis--or the process of identifying and exploring
    situations to better position an organization to realize desirable
    objectives--as an important part of risk management. For example, the
    private sector actively considers which markets to pursue through an
    analysis of the opportunities they present. By contrast, participants
    stated that the public sector must accommodate the public's beliefs
    about risks and preferences for risk management, which are often based
    on incomplete information and seen through the filter of complex
    political processes. According to one participant, the public sector is
    particularly challenged by the public's unrealistic expectations of
    government--namely, for "total and complete security"--and an
    unrealistically low tolerance for risk. Participants said that in the
    public sector, risk decisions are often influenced by the public's
    perception of risk, regardless of whether those perceptions are
    accurate. As a result, participants stated that there is less incentive
    for the public sector to use risk management to identify and seize
    long-term opportunities to reduce risk, such as investing in
    transportation infrastructure.

    Finally, one participant noted that private organizations must often
    make decisions based on incomplete information because of restricted
    access to classified information. Several participants indicated that
    better information sharing between the public and private sectors would
    be beneficial, as industry relies on government to reveal threats, and
    government relies in part on industry to reveal vulnerabilities.

    Homeland Security Risk Management Challenges:

    Dr. Henry Willis of the RAND Corporation began the forum's second
    session with a presentation entitled "Homeland Security Risk Management
    Challenges Faced by Federal Agencies." A discussion of a variety of
    challenges in applying risk management principles followed, including
    improving risk communication,[Footnote 6] political obstacles to risk-
    based resource allocation, a lack of strategic thinking about managing
    homeland security risks, partnership and coordination challenges, and
    the need for risk management education. Many participants emphasized
    that the nature of these key challenges related primarily to leadership
    rather than technical issues, such as methods used to assess risks.
    Following the discussion, participants were polled on the risk
    management challenges they viewed as most critical.

    Presentation by Dr. Henry Willis, RAND:

    Dr. Willis is a Policy Researcher at the RAND Corporation, a nonprofit
    research and analysis organization recognized for its strategic
    planning and risk management expertise. He discussed risk management
    challenges related to risk analysis at DHS, as well as ideas for
    strengthening the application of risk management in homeland security.
    He began by stating that risk management is fundamental to homeland
    security, whether for protecting emergency responders, defending
    infrastructure, countering Man Portable Air Defense Systems, inspecting
    shipping containers, or documenting travelers.

    Dr. Willis noted that DHS has defined risk as a function of threat,
    vulnerability, and consequence:[Footnote 7] a credible threat of attack
    on a vulnerable target that would result in unwanted consequences. He
    stated that this definition lays a foundation for DHS strategic
    planning, serves as a common starting point for discussions of risk,
    and provides a structure for considering challenges in managing
    terrorism risk. Dr. Willis noted that assessing each factor of
    terrorism risk is challenging. For example, given the uncertainties
    involved, it is difficult to anticipate changes in threats, and one
    challenge is linking intelligence analysis and risk analysis. He
    further stated that vulnerability assessments are very detailed
    analyses and that it is difficult to develop practical methods for
    identifying vulnerabilities of large numbers of potential targets while
    at the same time satisfying technical feasibility and cost constraints.
    Finally, he stated that the consequences of terrorism can spread widely
    because of (1) system linkages through cascading failures in linked
    systems, such as a power outage, and (2) social amplification of risk,
    such as the Washington, D.C., sniper event resulting in school closings
    and changes in purchase patterns, for example, consumers purchasing gas
    outside of the area.[Footnote 8]

    Beyond the challenges in assessing risk, Dr. Willis stated that we have
    to better understand how to manage risk. For example, he noted that
    countermeasures can reduce threats, but we need to be able to estimate
    the level of deterrence resulting from the countermeasures implemented.
    He said that system design and operations can reduce vulnerability, but
    we need to know how security benefits change as adversaries adapt
    technologies and tactics. He stated that effective response can reduce
    consequences, so we need to know how the public will respond during the
    immediate aftermath of a terrorist attack. Finally, he suggested that
    layered defenses provide robustness and flexibility, but we must
    determine how a portfolio of measures, programs, and policies can be
    evaluated.

    Dr. Willis concluded with some observations about addressing terrorism
    risk management challenges. First, he noted that homeland security
    programs should be accountable to standards of effectiveness, using
    metrics such as cost-effectiveness or residual risk (a measure of how
    much a program reduces the level of risk). Second, he offered that risk
    management must be analytic--addressing all three factors of risk--and
    deliberative. He stated that a deliberative process is necessary
    because values and judgment are a part of the process of managing
    homeland security risk and requires transparency and a comprehensive
    public discussion of outcomes. As an example, he asked whether more
    should be spent to protect a skyscraper in downtown Los Angeles from
    terrorism or earthquakes. Dr. Willis said that public discourse is the
    only way to credibly address trade-offs between risks to people from
    risks to property and among risks from a conventional bomb, nuclear
    attack, biological attack, or even hurricane or other natural disaster.
    Third, he stated that sufficient resources must be provided to enable
    capacity within DHS for homeland security risk analysis and strategic
    planning, noting that maturing risk analysis methods and processes
    takes time and that progress is being made. For example, he said that
    shortly after September 11, 2001, decisions about how to make grants to
    protect localities from terrorism were dominated by the use of crude
    indicators, such as population, which were intended to serve as a
    surrogate measure for the consequences of terrorist events. He said
    that this approach failed to differentiate scenarios that were more
    likely because of terrorists' capabilities and intentions or because
    targets were more vulnerable to attack. More recently, he stated that
    the Secretary of DHS has called on the department to adopt risk-based
    decision making and that methods of risk analysis were being
    established.

    Participants Polled on Most Critical Risk Management Challenge:

    Prior to the forum, we polled the participants by asking them what they
    viewed as the single most critical challenge in applying principles of
    risk management to homeland security. Specifically, participants were
    asked to select one challenge from the following list of those that we
    identified during our collective interviews conducted earlier with
    forum participants or to identify any additional challenges not listed
    using the "Other" category:

    * Improving the practice of risk assessment.

    * Overcoming political obstacles to risk-based resource allocation.

    * Enhancing partnerships between the public and private sectors.

    * Ensuring that risk management decisions reflect an understanding of
    the public's perception of and tolerance for risk.

    * Measuring and evaluating the risk reduction achieved by programs and
    countermeasures.

    * Other.

    The results of our pre-forum polling demonstrated a lack of consensus
    regarding what the most critical challenges were, with responses fairly
    evenly distributed among several of the challenges, as illustrated in
    figure 1.

    Figure 1: Pre-Forum Polling--Most Critical Challenge in Applying Risk
    Management to Homeland Security:

    [See PDF for image]

    This figure is a pie-chart depicting the following data:

    Most Critical Challenge in Applying Risk Management to Homeland
    Security:

    * Political obstacles to risk-based resource allocation: 26%;
    * Measuring and evaluating risk reduction: 20%;
    * Improving risk assessment practices: 20%;
    * Ensuring risk management decisions reflect public perception and
    tolerance for risk: 12%;
    * Enhancing public-private partnerships: 10%;
    * Other: 12%.

    Source: GAO analysis of participants' pre-forum polling responses.

    [End of figure]

    On the day of the forum, following the presentation by Dr. Willis and
    subsequent discussion on challenges in applying risk management
    principles to homeland security, participants were polled a second time
    and were asked to choose the most critical challenge in applying the
    principles of risk management to homeland security. The forum poll
    contained the same five close-ended options listed above with three
    changes. First, "Ensuring that risk management decisions reflect an
    understanding of the public's perception of and tolerance for risk" was
    abbreviated as "Improving risk communication." Second, the two most
    common pre-forum responses suggested under the open-ended "Other"
    option were added as close-ended options:

    * Improving strategic thinking.

    * Need for consensus on risk management definition.

    Third, two options discussed by the participants at the forum were
    added:

    * Developing the next generation of risk managers.

    * A lack of common methodologies at all levels of government.

    * The resulting vote identified that a consensus began to emerge during
    the discussion, with a clear plurality of the participants voting that
    the most critical challenge in applying risk management to homeland
    security was improving risk communication. Two challenges tied for the
    second most number of votes: political obstacles to risk-based resource
    allocation and improving strategic thinking about managing homeland
    security risks. The results of the vote are shown in figure 2.

    Figure 2: Forum Polling--Most Critical Challenge in Applying Risk
    Management to Homeland Security:

    [See PDF for image]

    This figure is a pie-chart depicting the following data:

    Most Critical Challenge in Applying Risk Management to Homeland
    Security:

    * Improving risk communication: 35%;
    * Improving strategic thinking: 19%;
    * Political obstacles to risk-based resource allocation: 19%;
    * Measuring and evaluating risk reduction: 12%;
    * Enhancing public-private partnerships: 8%;
    * Need for consensus on a definition of risk management: 4%;
    * Improving risk assessment practices: 4%;
    * Lack of common methodologies at all levels of government: 0%;
    * Developing next generation of risk managers: 0%.

    Source: GAO analysis of participants' forum polling responses.

    Note: Individual percentages may not sum to 100 because of rounding.

    [End of figure]

    Risk Communication Challenges:

    As shown through the forum polling, 35 percent of participants
    responded that improving risk communication was the most critical
    challenge in applying risk management to homeland security.
    Participants discussed several risk communication challenges outlined
    below, including the lack of a common lexicon or vocabulary for risk
    management, a focus on unlikely risks with dramatic consequences, the
    need to engage the public in a dialogue about an acceptable level of
    risk, and a lack of consideration of behavioral impacts.

    * Lack of a common lexicon for risk management. Participants said that
    a lack of a common lexicon for risk management makes communication and
    collaboration particularly challenging. Participants stated that there
    is no common lexicon of terms in use, complicating communication among
    the public and private sectors and other stakeholders.

    * Focus on unlikely risks with dramatic consequences. Participants
    noted that media coverage sensationalizes acts of terrorism, regardless
    of how likely they are to occur, and that terrorism is characterized by
    infrequent but potentially catastrophic events.[Footnote 9]
    Participants stated that this coverage creates fear among the public
    and undermines society's ability to engage in a fact-based discussion
    of risk.

    * Need to engage public in dialogue about an acceptable level of risk.
    Participants suggested that since it is not possible to prevent all
    disasters and catastrophes, it is necessary to engage the public in
    defining an acceptable level of risk in order to make logical resource
    allocation decisions. Participants observed that effective risk
    communication involves information flows that move in both directions
    between government and the public. They explained that while it is
    important that government share information about risks with the
    public, government also needs to obtain the public's input on homeland
    security concerns as well as on the prioritization of risks and
    associated resource allocation decisions. In this regard, participants
    noted the need to increase efforts to share information with the public
    and to obtain information about public opinion. They further observed
    that the government does not always provide the public with sufficient
    information on specific risks or engage the public in decision making
    related to addressing these risks.

    * Lack of consideration of behavioral impacts. Participants noted that
    risk communication is often wrongly viewed as an exercise in public
    relations and press releases. They argued that effective risk
    communication requires input from social science experts to determine
    the communication needs of the public. Participants further noted that
    human behavior affects risks and should be considered explicitly in
    risk assessments and in the development of risk management models. For
    example, one participant noted that Hurricane Katrina demonstrated that
    the efficacy of emergency response efforts depends on how the public
    behaves, as some people chose to shelter in place while others
    evacuated. Another participant noted that human behavior introduces
    unknowns and questioned whether people would venture outside to pick up
    their medications if an anthrax attack were to occur. Participants said
    that risk analysis, including predictive modeling, tends to mistakenly
    neglect to account for the public's expectations and emotions in these
    ways. Participants stated that the identification of behaviors that may
    affect risks will be more effective with the input of behavioral
    scientists.

    Political Obstacles to Risk-Based Resource Allocation:

    Participants agreed that overcoming political obstacles was necessary
    to allocate homeland security resources based on risk. They recommended
    the adoption of risk-informed processes for making federal resource
    allocation decisions and identified a number of political obstacles to
    risk-based resource allocation, including the reluctance of politicians
    and others, at times, to make difficult trade-offs and changes in the
    public's perception of risk, an absence of clarity related to federal
    spending decisions, conflicts between federal grant programs and
    national priorities for homeland security, and inconsistencies in
    resource allocations across the country.

    * Reluctance of politicians and others to focus on long-term trade-offs
    and shifts in perceptions of risk over time. Participants noted that
    elected officials understand that their ability to deliver services to
    constituents directly affects their ability to be elected. According to
    participants, at times this pressure on politicians creates a political
    disincentive for elected leaders to make strategic risk management
    decisions that require trade-offs. Participants suggested that
    individuals--whether they are elected officials, organizational
    decision makers, or the members of the general public--tend to focus on
    short-term returns in deciding on whether to invest in protective
    measures. As a result, there is often a reluctance to incur up-front
    costs of protective measures that would be viewed as cost-effective
    from a long-term perspective. This was designated by one participant as
    the "Not In My Term of Office" or NIMTOF view of the world.
    Participants observed that understanding factors that affect the
    perception of risk is critical for effectively managing risk. They
    agreed that in general, the public's perception of the risk of an
    event, such as a natural disaster, is high immediately following such
    an event but declines over time, irrespective of whether the event is
    likely or unlikely to occur again. Participants suggested that this
    tendency hinders risk mitigation by creating disincentives for
    stakeholders or officials to take actions that are likely to yield only
    long-term benefits. Participants also agreed that organizations must
    overcome this tendency by considering probable future events as well as
    short-term possibilities.

    * Absence of clarity related to federal spending decisions.
    Participants observed that the federal government faces many challenges
    in making decisions about how to direct its spending most effectively
    against today's backdrop of fiscal constraints. Six participants called
    for more information and clarity regarding the level and direction of
    homeland security spending, suggesting that there is insufficient
    understanding of the total amount being invested in homeland security
    and how it is being used. Further, it was suggested that there is no
    clear understanding of where federal dollars should be spent to enhance
    security. Seven participants suggested that federal money has not been
    spent in a cost-effective manner or in a manner that buys down the
    maximum level of risk. For example, two participants criticized
    congressional earmarks and attempts to provide resources equitably
    among all geographic areas as inhibiting a rational risk-based approach
    to resource allocation. One participant remarked that both the public
    and private sectors had overspent on homeland security investments.
    Another suggested that homeland security investment decisions are being
    driven by emotion rather than information and logic.

    * Federal grant programs may conflict with national priorities. Five
    participants stated that national priorities for homeland security may
    conflict with the results of competitive grant processes. In the view
    of two participants, DHS urges state and local governments to
    collaborate on homeland security within regions but also asks the same
    states and localities to compete for federal funding through the grant
    allocation process. As a result, federal grants were described by one
    participant as creating an unhealthy process of gaming and competition,
    and for this reason, grants were criticized as a poor instrument for
    buying down risk. Participants stated that the competition between
    regional, state, and local governments for limited grant funding for
    homeland security investments creates a disincentive for those regional
    stakeholders to coordinate on critical homeland security issues.

    * Inconsistent resource allocation across the country. One participant,
    citing significant variations in port security across the nation,
    suggested that investments in homeland security often reflect local
    politics rather than risk and vary inappropriately across the country.
    For example, this participant noted that while the same LNG tanker from
    St. Croix travels to Savannah and Boston each week, each city responds
    to the same ship and essentially the same risk in very different ways.
    According to this participant, a fleet of escort ships and helicopters
    is deployed in Boston while just two USCG cutters are dispatched to
    escort the tanker in Savannah.

    Lack of Strategic Thinking:

    Participants agreed that a lack of strategic thinking about risk
    management was a key challenge to incorporating risk-based principles
    in homeland security investments. Participants noted, in particular,
    that challenges existed in the following areas: the need for public
    discourse to create a strategy for homeland security, the lack of
    opportunity analysis in the public sector, the lack of a single public
    risk manager, and insufficient governmentwide risk management guidance.

    * Need for public discourse to create a strategy for homeland security.
    One participant noted that the President issued a National Strategy for
    Homeland Security in October 2007, to guide, organize, and unify the
    nation's homeland security efforts.[Footnote 10] However, eight
    participants echoed Dr. Willis's presentation by suggesting that a
    public discourse is needed to strategically address homeland security
    trade-offs. One participant suggested that our nation has managed to
    have a coherent dialogue for national security in which we discuss
    national security issues and decide how to allocate national security
    funding. According to this participant, a similar dialogue has not
    taken place among all stakeholders to create a strategy for homeland
    security, including the general public; the private sector; and
    federal, state, local, and tribal governments. Participants noted that
    in creating a strategy for homeland security, a significant challenge
    will be to balance security concerns within federal government agencies
    that have diverse missions in areas other than security, such as public
    safety and maintaining the flow of commerce.

    * Public sector lacks opportunity analysis. Participants observed that
    the government's unique responsibilities emphasize the downside of
    risks, focusing only on preparing for, responding to, and recovering
    from disasters. As a result, it was noted that the public sector lacks
    the opportunity analysis needed to identify and achieve desirable long-
    range goals, such as measures that simultaneously produce economic
    gains while improving security over the long term. As an example,
    participants suggested that improving transportation system resiliency
    could be achieved by investing in the underlying infrastructure and
    promoting redundancy through the creation of alternate transportation
    systems.

    * Lack of a single public risk manager discourages coordination.
    Participants identified the lack of a single risk manager for the U.S.
    government as a key challenge. One participant suggested that this lack
    of central leadership has resulted in distributed responsibility for
    risk management within the administration and Congress and that this
    distributed responsibility has resulted in uncoordinated spending
    decisions. In addition, participants noted that without any overarching
    risk management framework for the federal government, the federal
    government tends to focus on reacting to immediate demands, without
    giving attention to indirect and long-term costs.

    * Governmentwide risk management guidance is insufficient. Three
    participants described this lack of governmentwide guidance as
    presenting a challenge because different parts of government are at
    various levels of maturity in understanding and applying principles of
    risk management. One participant noted that the proposed risk
    assessment bulletin circulated by the Office of Management and Budget
    (OMB) in 2006[Footnote 11] was found to be fundamentally flawed by a
    National Research Council scientific review.[Footnote 12] According to
    participants, the council's review identified that "one size does not
    fit all," finding OMB's proposed bulletin to be inappropriate as
    across-the-board guidance for all risk assessments conducted throughout
    the federal government, and recommended that the bulletin be withdrawn.
    However, this participant stated that the council also recommended that
    the spirit of the bulletin--increasing the quality and objectivity of
    risk assessment in the federal government--was needed to help guide
    federal agencies in developing their own technical risk assessment
    guidance. Two participants suggested that OMB or another government
    agency could play a role in helping to outline goals and general
    principles of risk assessment and could help agencies to implement
    these principles.

    Partnership and Coordination Challenges:

    Participants agreed that risk management should be viewed as both a
    public and private sector issue, requiring partnerships and
    coordination rather than being an isolated, government-centered
    challenge. Participants identified several challenges related to
    public-private collaboration, including differences in public and
    private sector flexibility and expectations, the need to strengthen
    public-private partnerships, and the lack of intergovernmental
    partnerships.

    * Public and private sector flexibility and expectations differ.
    Participants observed that while the public sector can learn a great
    deal from the private sector about risk management, there are key
    differences between the two. Participants acknowledged that the private
    sector can do some things not possible in the public sector. For
    instance, they said that private organizations have more flexibility
    because they can be selective about pursuing business lines and
    operational locations and can more easily dismiss surplus staff.
    Participants also noted that the private sector is able to transfer
    risk through financial mechanisms, such as insurance. Furthermore,
    participants said that consequences in the private sector can often be
    reduced to costs in dollar terms, whereas expectations for the public
    sector are much broader and complex.

    * Public-private partnerships need to be strengthened. Participants
    observed that homeland security decision-making models in the federal
    government are often not complementary to both private and public
    sector objectives. Participants noted that this situation is caused, in
    part, by a lack of stakeholder involvement in the decision-making
    process, and stated that some DHS decisions have not been made in a
    sufficiently inclusive manner. Participants agreed that when the
    private sector is not sufficiently involved in risk assessments, its
    stakeholders lose faith in government announcements and requirements
    related to new risks and threats. For example, participants stated that
    private sector leaders have found spending DHS grant moneys difficult
    because they did not have access to government information and other
    data on terrorism to help them understand the risks. Three specifically
    noted that they experienced a high level of uncertainty about what
    actions to take to protect against terrorism because of a lack of
    information from the federal government related to the threats posed by
    terrorism. As an example, it was noted that insurers take into account
    regulation and enforcement of building codes in hazard-prone areas in
    determining actuarially based rates that reflect risks. However, state
    insurance regulations may not allow them to charge these premiums.
    Participants agreed that improved coordination between the public and
    private sectors could help to mitigate disasters and improve risk
    management following disasters. One participant suggested that
    insurance premiums reflect risk and that any subsidies provided to
    individuals deserving special treatment should come in the form of
    general public funding and through artificially low insurance premiums.

    * Lack of intergovernmental partnerships. Participants observed that
    intergovernmental partnerships--between federal, state, local, and
    tribal governments--are important for effective homeland security risk
    management. Participants stated that for these partnerships to succeed,
    it will be necessary to develop a common lexicon for communication and
    to reconcile the many existing risk management models that often vary
    by jurisdiction and homeland security mission. Participants further
    stated that there has not been a sufficient mobilization of state and
    local practitioners and experts in applying risk management principles
    to homeland security. They added that this lack of state and local
    involvement was a lost opportunity, since there is a great deal of
    knowledge at these levels that is largely an untapped resource.
    Participants also noted that congressionally authorized DHS Centers of
    Excellence exist, but work independently.[Footnote 13] Even within the
    federal government, approaches to risk management were described as
    fragmented. For example, one participant said that each of the
    Department of Defense combatant commands has its own perspective on
    risk. According to this participant, this lack of consistency requires
    recalculations and adjustments as each command operates without
    coordinating efforts or approaches.

    Need for Risk Management Education:

    Participants identified a need for increased efforts to promote risk
    management education, both to educate future practitioners and to
    inform stakeholders in the short term about the value of applying risk
    management to homeland security decision making. Discussion touched on
    the lack of risk management educators, intelligence analysts needing
    risk analysis training, and the need for the federal government to
    collaborate with state and local governments in risk management
    education.

    * Lack of risk management educators. Participants observed that more
    risk management educators and educated practitioners are needed at all
    levels of government. They stated that a whole new profession needs to
    be developed to deal with long-term risk management challenges.
    However, one participant noted that the nation is not currently
    training such a cadre of the next generation of risk management
    professionals.

    * Intelligence analysts need risk analysis training. One participant
    said that intelligence professionals are not typically trained in risk
    analysis, but rather are trained to focus on fact-based versus
    possibility-based information. In addition, this participant noted a
    lack of appreciation in the intelligence community for the rationales,
    responsibilities, and methodologies of risk assessment. According to
    this participant, the result is a lack of risk-based opportunity
    analysis and strategic awareness within the intelligence community. For
    example, the participant suggested that if you ask a top intelligence
    analyst to explain the strategic reasons for U.S. foreign policy toward
    the country in which they specialize, the analyst may not know.

    * Federal government needs to collaborate with state and local
    governments in risk management education. Participants observed that
    risk management education is a particular challenge from the
    perspective of state and local governments. On the one hand,
    participants said that the federal government has not educated state
    and local government agencies and police departments on the value of
    risk management. On the other hand, participants stated that the
    federal government asks other levels of government to spend money
    according to national priorities and grant specifications. One
    participant said that decision makers at the state and local levels do
    not have visibility over the total threat position and are asked to
    trust the wisdom of the federal government. Participants agreed that
    more effort at the federal level is needed to collaborate with state
    and local governments in developing commonly shared homeland security
    risk management models and training that can work across all levels of
    government and the private sector.

    Addressing Homeland Security Risk Management Challenges:

    After the discussion of homeland security risk management challenges,
    participants discussed how to best address these challenges.
    Participants prioritized the order in which the identified challenges
    should be addressed by ranking them through a poll. Overall,
    participants agreed that risk communication should be addressed before
    all other challenges, and discussed ways in which risk communication
    could be used to educate and inform the public. Participants then
    discussed overcoming political obstacles to risk management, and
    provided additional suggestions to address other challenges that were
    identified in applying risk management principles in homeland security.

    Participants Polled on Ranking the Order in Which Risk Management
    Challenges Should Be Addressed:

    Participants were asked to rank the order in which challenges to
    applying principles of risk management to homeland security should be
    addressed. Specifically, participants were asked to vote on the
    challenges they identified during the previous discussion three times,
    by indicating the challenge they believed should be addressed first,
    second, and third. The results paralleled those from the previous poll,
    with participants choosing risk communication as the challenge to be
    addressed first, political obstacles as the challenge to be addressed
    second, and improving strategic thinking as the challenge to be
    addressed third, as shown in figure 3.

    Figure 3: Forum Polling--Rankings by Participants of Challenges in the
    Order They Should Be Addressed:

    [See PDF for image]

    This figure is a horizontal bar graph depicting the following data:

    Rankings by Participants of Challenges in the Order They Should Be
    Addressed:

    Challenge to be addressed: Improving risk communication;
    Participants' weighted average ranking: 1.0.

    Challenge to be addressed: Political obstacles to risk-based resource
    allocation;
    Participants' weighted average ranking: 0.58.

    Challenge to be addressed: Improving strategic thinking;
    Participants' weighted average ranking: 0.55.

    Challenge to be addressed: Improving risk assessment practices;
    Participants' weighted average ranking: 0.34.

    Challenge to be addressed: Measuring and evaluating risk reduction;
    Participants' weighted average ranking: 0.32.

    Challenge to be addressed: Enhancing public-private partnerships;
    Participants' weighted average ranking: 0.27.

    Challenge to be addressed: Need for consensus on a definition of risk
    management;
    Participants' weighted average ranking: 0.2.

    Challenge to be addressed: Lack of common methodologies at all levels
    of government;
    Participants' weighted average ranking: 0.09.

    Challenge to be addressed: Developing next generation of risk managers;
    Participants' weighted average ranking: 0.01.

    Source: GAO analysis of participants' forum polling responses.

    Note: This presents the weighted average rankings of the participants�
    assessment of the overall order that each of the challenges should be
    addressed on a scale of 1 to 0, with 1 being the highest ranking and 0
    being the lowest.

    [End of figure]

    Using Risk Communication Practices to Educate and Inform the Public:

    Participants suggested increasing the dissemination of factual
    information to help decision makers in all sectors by empowering people
    with fact-based risk analysis, rather than leaving them to make
    decisions based on perceived risk. One participant noted that risk
    analysis is not about making decisions but rather about informing
    decisions, and that it is the role of leaders and policymakers to make
    decisions based on well-defined information. The participant noted that
    information should be provided in a way that is useful for decision
    making. For example, if there is time to allow people to deliberate,
    leaders should provide them with information to allow them to make
    choices; conversely, if there is no time to deliberate, leaders should
    instruct citizens on specific actions to take. Participants stated that
    engaging the public in a meaningful way involves providing sufficient
    information for people to make informed decisions. In doing so, there
    is a need to distinguish between risks to the individual citizen and
    risks to the homeland.

    Participants agreed that outreach to the public will help to inform and
    educate citizens while enhancing risk communications. The participants
    suggested a number of ways to inform the public effectively on risk-
    related issues. One participant stated that risk communication is an
    educational process that can be used to help the public make better
    decisions. Therefore, this participant said that there is a need to
    have a public discourse so that the public understands how risk is
    defined and how risk informs decision making, so that our nation
    ultimately reaches consensus on acceptable risk levels. Similarly,
    another participant noted that given differences in education and
    levels of understanding about risk management, it is important to
    develop a common lexicon that can be used for dialogue with both the
    layman and the subject matter expert. Participants emphasized the
    importance of educating elected officials and the public on risk
    management, including key definitions, such as that risk is a function
    of threat, vulnerability, and consequence. Three participants noted
    that such education is needed to illuminate the distinction between
    risk assessment, involving scientific analysis and modeling, and risk
    management, involving risk reduction and evaluation.

    One participant noted that leadership should effectively communicate
    what the hazards are and the probability of those hazards occurring.
    The participant stated that this information will allow the public and
    private sectors to make informed, intelligent decisions on how to
    allocate resources to manage risk. According to the participant, this
    information will also help the public understand how government actions
    contribute to risk reduction efforts. The participant went on to say
    that leaders need to calm the public's fears while making them aware of
    risk, and suggested that providing this public outreach is important
    since the effectiveness of the government's response to a terrorist
    attack or natural disaster will depend on how the public behaves.
    Another participant offered that the equivalent of an environmental
    impact study could be conducted prior to implementing a new security
    measure or passing a new major initiative to answer questions about the
    long-term effect and impact an initiative will have on homeland
    security. Along these lines, another participant noted that public and
    private sector leaders need to communicate better on issues of
    interdependency, or the ways in which the decisions of an individual or
    an organization affect others. This participant explained that leaders
    need to show the public that if they protect asset A, it will help
    someone else protect asset B, and ultimately benefit everyone.

    Another participant suggested that experts look at existing risk
    communication systems that could be used as models on which to base the
    development of a homeland security risk communication system. For
    example, the government consolidates weather-related information and
    informs public actions through the National Weather Service. The
    participant noted that the service provides both national and local
    weather information, looks at overall risks, and effectively provides
    actionable information to be used by both the public and private
    sectors. Participants objected to the current color-coded DHS Homeland
    Security Advisory System[Footnote 14] as being too general, suggesting
    that the public does not understand what is meant by the recommended
    activities, such as being vigilant. One participant noted the
    importance of developing simple messages that are easy for the public
    to remember and pass on, citing "stop, drop, and roll" as an example of
    what to do if on fire.

    Finally, participants stated that the events of Hurricane Katrina
    showed the importance of and need for a good risk communication
    strategy, and suggested that the nation needs a communications strategy
    that ties back to national homeland security objectives. Another
    participant agreed and added that the United States also needs a
    systematic assessment of threats to the country as well as a periodic
    assessment of the nation's risk strategy. For this, participants
    suggested that stakeholders will need to be engaged to establish an
    acceptable level of risk for the nation.

    Overcoming Political Obstacles to Risk Management:

    Participants were generally sympathetic to the complexity of the
    political process, where leaders must reconcile competing resource
    demands from the public as well as the sometimes conflicting priorities
    of the administration and members of Congress. However, participants
    agreed that political obstacles to applying principles of risk
    management to homeland security can be overcome by highlighting the
    importance of risk management to policymakers. One participant pointed
    out that a new administration and Congress will soon enter office with
    a new set of policy objectives, and it will be important to highlight
    the importance of risk management to incoming policymakers and to
    persuade them to discuss it. Another participant stated that
    policymakers should gain a better understanding of what has worked and
    what has not worked in the private sector to stop simply reacting to
    past events by better anticipating and preparing for probable future
    events. Finally, another participant stated that policymakers are
    actually doing risk management every day; however, corporate executives
    and government officials do not refer to it as such. According to this
    participant, risk is considered within the current political process
    when leaders choose funding levels for the armed services. Recognizing
    the nature of these discussions could open the way to making risk
    management a more widely accepted and applied approach to decision
    making.

    Additional Suggestions to Address Other Identified Challenges:

    Participants discussed additional suggestions to address three other
    homeland security risk management challenges that had been mentioned:
    improving strategic thinking, using risk assessments as a tool for
    decision making, and enhancing information sharing through public-
    private partnerships.

    * Improve strategic thinking. One participant suggested that strategic
    thinking could be improved by defining a problem statement that answers
    several questions, including the purpose for which we are trying to
    develop risk management practices, what decisions leadership must make
    and those they wish to make, and what decisions we as a nation want to
    make and what decisions we are prepared to make. This participant noted
    that effective institutions already know the answers to these questions
    and that risk assessment tools are developed in support of these
    strategic questions. A second participant agreed, suggesting a need to
    focus on defining the problem, a set of principles to guide decisions,
    goals in addressing the problem, and the trade-offs required to achieve
    these goals. Another participant said there is a need for strategic
    planning, and that a short-term goal in this process should be
    identifying the big problems that strategic planning needs to address,
    such as the direct and indirect costs to reducing risk.

    * Use risk assessments as a tool for decision making. Participants
    agreed that risk assessments are useful tools that can be used to
    inform decisions made by business leaders and policymakers. One
    participant proposed the development of models using classified
    information that the public and private sector could use for purposes
    such as determining regional risk indicators--for example, the risk to
    New York City relative to Des Moines. Six participants discussed the
    availability and utility of information required to inform the three
    components of risk--defined as a function of threat, vulnerability, and
    consequence. One participant stated that consequence is the best
    understood variable of risk, while another disagreed, stating that even
    consequence is not well understood within the risk framework. One
    participant noted the importance of specifying the assumptions that are
    made by experts in undertaking risk assessments, the nature of
    disagreements between experts on the assessment of specific risks, and
    the degree of uncertainty surrounding these estimates.

    * Enhance information sharing through public-private partnerships.
    Participants agreed that partnerships between the public and private
    sectors can enhance information sharing and need to result in
    structured communications that address the goals of diverse groups.
    According to one participant, the amount of information the private
    sector receives from governments is extremely important for corporate
    resource allocation decisions. For example, this participant estimated
    that corporate security costs in the retail property industry have
    increased from 5 percent of operating costs before September 11, 2001,
    to 20 percent today. It was suggested that government provide
    businesses with a quarterly or biannual threat briefing, or possibly
    provide direct access to public officials who can provide threat
    information.

    Suggested Next Steps:

    Participants concluded the forum by reasserting the importance of using
    risk-based principles to inform decision making related to homeland
    security. Participants further stated their desire that additional
    action be taken to move forward on the areas discussed at the forum,
    and proposed a number of steps that could be taken in the near future
    to strengthen homeland security risk management practices and stimulate
    public discussion and awareness of risk management concepts.
    Suggestions included the creation of a nonpartisan advisory board,
    identifying effective risk management practices, reviewing DHS's risk
    management efforts, and developing a white paper to guide Congress's
    and the administration's understanding of risk-based principles.

    Create an Advisory Board:

    In general, forum participants agreed that a nonpartisan federal
    advisory board could be created and composed of a subset of the group
    of participants. They suggested that such an advisory board could
    assist the federal government in thinking about risk management
    strategies and in moving forward in applying risk-based principles
    related to homeland security. Participants emphasized that the
    leadership of a group of this kind was essential and must be
    sufficiently positioned so that the board could appropriately support
    decision makers.

    Develop a List of Effective Practices:

    Participants agreed that there is a need for further exchanges of
    effective practices in risk management among stakeholders. The forum
    participants considered reconvening to outline existing effective
    practices, lessons learned, and even risk management models considered
    to be controversial. It was suggested that the audience for the outcome
    of such a meeting could be OMB and the staff of the next
    administration.

    Review DHS's Risk Management Efforts:

    Participants suggested that there would be value in conducting an
    overarching review across all DHS offices to determine the current
    status of all DHS approaches to applying risk management practices in
    homeland security. Participants suggested that DHS could brief the
    advisory board noted above on steps taken and progress made in risk
    management. The advisory board could then provide advice and guidance
    to DHS, for example, by assessing the gap between DHS's current risk
    management efforts and known effective practices, including suggestions
    discussed at the forum.

    Develop an Informational White Paper:

    Participants discussed forming working groups dedicated to developing
    an informational white paper for decision makers prior to the 2008
    elections. Such a white paper would stress the necessity of risk
    management and describe an approach for applying risk management to
    homeland security. More specifically, participants discussed the white
    paper addressing issues such as (1) risk management actions already
    taken by DHS, (2) examples of effective practices used in the private
    sector, and (3) specific issues that appropriations staff should take
    into account before authorizing new expenditures. Participants stated
    that such a document should be written in accessible language free of
    technical jargon and offer concrete actions to inform and empower both
    the public and the private sectors.

    [End of section]

    Appendix I Agenda:

    8:30 a.m.: Check-in/Continental breakfast:

    8:45 a.m.: Opening session; Welcome and Introductions; Setting the
    Stage.

    9:15 a.m.: Session I: Presentation on effective risk management
    practices used by leading organizations.

    9:30 a.m.: Group discussion: What lessons learned from the public and
    private sectors can inform risk management efforts in homeland
    security?.

    10:30 a.m.: Break.

    10:45 a.m.: Session II: Presentation on the homeland security risk
    management challenges faced by federal agencies.

    11:00 a.m.: Group discussion: What are the greatest homeland security
    risk management challenges facing the public and private sectors?.

    12:30 p.m.: Break/Buffet Lunch Open.

    12:45 p.m.: Session III (working lunch): Moderated discussion on ways
    to strengthen homeland security risk management practices.

    2:00 p.m.: Wrap-up.

    2:30 p.m.: Adjournment.

    [End of section]

    Appendix II: List of Participants:

    Moderators:

    Cathleen A. Berrick:
    Director, Homeland Security and Justice:
    U.S. Government Accountability Office.

    Sallyanne Harper:
    Chief Administrative Officer and Chief Financial Officer:
    U.S. Government Accountability Office.

    Norman J. Rabkin:
    Managing Director, Homeland Security and Justice:
    U.S. Government Accountability Office.

    Participants:

    Michael Balboni:
    Deputy Secretary for Public Safety:
    State of New York.

    Esther Baur:
    Director, Group Communications:
    Head of Issue Management & Messages:
    Swiss Re.

    Baruch Fischhoff:
    Howard Heinz University Professor:
    Department of Social and Decision Sciences and Department of
    Engineering and Public Policy:
    Carnegie Mellon University.

    George W. Foresman:
    President:
    Highland Risk & Crisis Solutions, Ltd.
    Former Under Secretary for National Protection and Programs:
    Former Under Secretary for Preparedness:
    U.S. Department of Homeland Security.

    Tina W. Gabbrielli:
    Director, Office of Risk Management and Analysis:
    National Protection and Programs Directorate:
    U.S. Department of Homeland Security.

    James Gilmore:
    Partner, Kelley Drye & Warren, LLP:
    Chairman, Advisory Panel to Assess Domestic Response Capabilities for
    Terrorism Involving Weapons of Mass Destruction:
    Governor of Virginia, 1998-2002.

    Corey D. Gruber:
    Assistant Deputy Administrator:
    National Preparedness Directorate:
    Federal Emergency Management Agency:
    U.S. Department of Homeland Security.

    Brian Michael Jenkins:
    Senior Advisor to the President:
    RAND Corporation.

    RDML Wayne E. Justice:
    Rear Admiral:
    Director of Response Policy:
    United States Coast Guard.

    Kenneth L. Knight, Jr.
    National Intelligence Officer for Warning:
    National Intelligence Council:
    Office of the Director of National Intelligence.

    Howard Kunreuther:
    Cecilia Yen Koo Professor:
    Department of Decision Sciences and Public Policy:
    Wharton School, University of Pennsylvania:
    Co-Director:
    Wharton Risk Management and Decision Processes Center.

    Peter Lowy:
    Group Managing Director:
    Westfield Group.

    Thomas McCool:
    Director of the Center for Economics:
    U.S. Government Accountability Office.

    Susan E. Offutt:
    Chief Economist:
    U.S. Government Accountability Office.

    John Paczkowski:
    Director, Emergency Management and Security:
    Port Authority of New York and New Jersey.

    John Piper:
    Senior Security Consultant:
    Talisman, LLC.

    William G. Raisch:
    Director, International Center for Enterprise Preparedness:
    New York University.

    Joseph A. Sabatini:
    Managing Director:
    Head of Corporate Operational Risk:
    JP Morgan Chase.

    Kenneth H. Senser:
    Senior Vice President for Global Security, Aviation and Travel:
    Wal-Mart Stores, Inc.

    Hemant Shah:
    President and Chief Executive Officer:
    Risk Management Solutions.

    Steven L. Stockton:
    Deputy Director of Civil Works:
    U.S. Army Corps of Engineers.

    William F. Vedra, Jr.
    Executive Director:
    Ohio Homeland Security.

    Detlof von Winterfeldt:
    Professor, Industrial and Systems Engineering:
    Viterbi School of Engineering, University of Southern California:
    Professor of Public Policy and Management:
    School of Policy Planning:
    Director:
    Center for Risk and Economic Analysis of Terrorism Events:
    University of Southern California.

    Scott T. Weidman:
    Director:
    Board on Mathematical Sciences and Their Applications:
    National Research Council.

    Henry H. Willis:
    Policy Researcher:
    RAND Corporation.

    [End of section]

    Appendix III: Presentation by Norman Rabkin, Managing Director,
    Homeland Security and Justice, GAO:

    The forum opened with remarks by Norman Rabkin that provided an
    overview of the United States' current fiscal crisis and the importance
    of using risk management to focus resources on our most pressing
    concerns.

    Figure:

    [See PDF for image]

    Forum: Convened by the Comptroller General of the United States:

    Strengthening the Use of Risk Management Principles in Homeland
    Security:
    Norman Rabkin:
    Managing Director, Homeland Security and Justice Issues:
    October 25, 2007:

    Source: GAO.

    [End of figure]

    Addressing Homeland Security: Risks: Complexities and Costs:

    * The terrorist attacks of September 11, 2001, and the catastrophic
    natural disasters wrought by Hurricanes Katrina and Rita in 2005
    demonstrated the diverse nature of homeland security risks.

    * The nation will never be completely safe, and total security is an
    unachievable goal; we cannot afford to protect everything against all
    threats.

    Potential Fiscal Outcomes Under Baseline Extended (January 2001);
    Revenues and Composition of Spending as a Share of GDP:

    [See PDF for image]

    This is a line/stacked bar graph with one line (revenue) and four
    stacked bars containing four spending items (Net interest, Social
    Security, Medicare and Medicaid, and All other spending). The vertical
    axis represents Percent of GDP and the horizontal axis represents
    fiscal years 2005, 2015[a], 2030[a], and 2040[a].

    The following data is depicted:

    Fiscal year 2005:
    Net interest: 0.8%;
    Social Security: 4.3%;
    Medicare & Medicaid: 3.7%;
    All other spending: 7.994%;
    Revenue: 20.3%.

    Fiscal year 2015:
    Net interest: 0%;
    Social Security: 5.1%;
    Medicare & Medicaid: 4.9%;
    All other spending: 5.574%;
    Revenue: 20.4%.

    Fiscal year 2030:
    Net interest: 0%;
    Social Security: 6.6%;
    Medicare & Medicaid: 9.4%;
    All other spending: 3.991%;
    Revenue: 20.4%.

    Fiscal year 2040:
    Net interest: 0%;
    Social Security: 6.7%;
    Medicare & Medicaid: 9%;
    All other spending: 4.361%;
    Revenue: 20.4%.

    Source: GAO�s January 2001 analysis.

    [a] All other spending is net of offsetting interest receipts.

    [End of graph]

    Potential Fiscal Outcomes Under Alternative Simulation; Revenues and
    Composition of Spending as a Share of GDP:

    [See PDF for image]

    This is a line/stacked bar graph with one line (revenue) and four
    stacked bars containing four spending items (Net interest, Social
    Security, Medicare and Medicaid, and All other spending). The vertical
    axis represents Percent of GDP and the horizontal axis represents
    fiscal years 2006, 2015, 2030, and 2040.

    The following data is depicted:

    Fiscal year 2006:
    Net interest: 1.7%;
    Social Security: 4.2%;
    Medicare & Medicaid: 3.9%;
    All other spending: 10.6%;
    Revenue: 18.4%.

    Fiscal year 2015:
    Net interest: 2.3%;
    Social Security: 4.8%;
    Medicare & Medicaid: 5.7%;
    All other spending: 9.6%;
    Revenue: 18%.

    Fiscal year 2030:
    Net interest: 5.8%;
    Social Security: 6.6%;
    Medicare & Medicaid: 8.8%;
    All other spending: 9.6%;
    Revenue: 18.6%.

    Fiscal year 2040:
    Net interest: 11.6%;
    Social Security: 7.2%;
    Medicare & Medicaid: 10.8%;
    All other spending: 9.6%;
    Revenue: 18.6%.

    Source: GAO�s August 2007 analysis.

    Notes: AMT exemption amount is retained at the 2006 level through 2017
    and expiring tax provisions are extended. After 2017, revenue as a
    share of GDP returns to its historical level of 18.3 percent of GDP
    plus expected revenues from deferred taxes, i.e. taxes on withdrawals
    from retirement accounts. Medicare spending is based on the Trustees
    April 2007 projections adjusted for the Centers for Medicare and
    Medicaid Services alternative assumption that physician payments are
    not reduced as specified under current law.

    [End of graph]

    State and Local Governments Face Increasing Fiscal Challenges:

    [See PDF for image]

    This is a line graph with two lines (Operating Surplus/Deficit Measure
    and Net-lending/Net-borrowing). The vertical axis represents Percent of
    GDP from -6 to +2 and the horizontal axis represents fiscal years 1980
    through 2050. The following data is depicted:

    1980:
    Operating Surplus/Deficit Measure: 0.35873454;
    Net-lending/Net-borrowing: -0.236601541.

    1981:
    Operating Surplus/Deficit Measure: 0.34624089;
    Net-lending/Net-borrowing: -0.169415676.

    1982:
    Operating Surplus/Deficit Measure: 0.363124424;
    Net-lending/Net-borrowing: -0.387096774.

    1983:
    Operating Surplus/Deficit Measure: 0.774990811;
    Net-lending/Net-borrowing: -0.138547233.

    1984:
    Operating Surplus/Deficit Measure: 0.8152395;
    Net-lending/Net-borrowing: 0.223736398.

    1985:
    Operating Surplus/Deficit Measure: 0.810172263;
    Net-lending/Net-borrowing: 0.035542497.

    1986:
    Operating Surplus/Deficit Measure: 0.820186878;
    Net-lending/Net-borrowing: -0.103074303.

    1987:
    Operating Surplus/Deficit Measure: 0.348462918;
    Net-lending/Net-borrowing: -0.346028062.

    1988:
    Operating Surplus/Deficit Measure: 0.415329754;
    Net-lending/Net-borrowing: -0.289980015.

    1989:
    Operating Surplus/Deficit Measure: 0.461047699;
    Net-lending/Net-borrowing: -0.302676683.

    1990:
    Operating Surplus/Deficit Measure: 0.12076304;
    Net-lending/Net-borrowing: -0.649652772.

    1991:
    Operating Surplus/Deficit Measure: -0.002324922;
    Net-lending/Net-borrowing: -0.823896329.

    1992:
    Operating Surplus/Deficit Measure: 0.105991132;
    Net-lending/Net-borrowing: -0.675323856.

    1993:
    Operating Surplus/Deficit Measure: 0.17518701;
    Net-lending/Net-borrowing: -0.573797579.

    1994:
    Operating Surplus/Deficit Measure: 0.15154266;
    Net-lending/Net-borrowing: -0.429852097.

    1995:
    Operating Surplus/Deficit Measure: 0.226784;
    Net-lending/Net-borrowing: -0.446084594.

    1996:
    Operating Surplus/Deficit Measure: 0.382430375;
    Net-lending/Net-borrowing: -0.292955008.

    1997:
    Operating Surplus/Deficit Measure: 0.540310442;
    Net-lending/Net-borrowing: -0.225184543.

    1998:
    Operating Surplus/Deficit Measure: 0.711478221;
    Net-lending/Net-borrowing: -0.113181662.

    1999:
    Operating Surplus/Deficit Measure: 0.528375987;
    Net-lending/Net-borrowing: -0.240602477.

    2000:
    Operating Surplus/Deficit Measure: 0.51757156;
    Net-lending/Net-borrowing: -0.309666904.

    2001:
    Operating Surplus/Deficit Measure: 0.213052923;
    Net-lending/Net-borrowing: -0.800750395.

    2002:
    Operating Surplus/Deficit Measure: -0.212758845;
    Net-lending/Net-borrowing: -1.20443952.

    2003:
    Operating Surplus/Deficit Measure: -0.034231078;
    Net-lending/Net-borrowing: -1.04098241.

    2004:
    Operating Surplus/Deficit Measure: 0.03822412;
    Net-lending/Net-borrowing: -0.899039488.

    2005:
    Operating Surplus/Deficit Measure: 0.262769152;
    Net-lending/Net-borrowing: -0.762696896.

    2006:
    Operating Surplus/Deficit Measure: 0.21944499;
    Net-lending/Net-borrowing: -0.788126765.

    2007:
    Operating Surplus/Deficit Measure: 0.412715768;
    Net-lending/Net-borrowing: -0.638191188.

    2008:
    Operating Surplus/Deficit Measure: 0.345168264;
    Net-lending/Net-borrowing: -0.630180116.

    2009:
    Operating Surplus/Deficit Measure: 0.333020741;
    Net-lending/Net-borrowing: -0.603351831.

    2010:
    Operating Surplus/Deficit Measure: 0.302656141;
    Net-lending/Net-borrowing: -0.605141837.

    2011:
    Operating Surplus/Deficit Measure: 0.257109542;
    Net-lending/Net-borrowing: -0.630946404.

    2012:
    Operating Surplus/Deficit Measure: 0.206218592;
    Net-lending/Net-borrowing: -0.658720463.

    2013:
    Operating Surplus/Deficit Measure: 0.16406332;
    Net-lending/Net-borrowing: -0.681176041.

    2014:
    Operating Surplus/Deficit Measure: 0.119677687;
    Net-lending/Net-borrowing: -0.707576964.

    2015:
    Operating Surplus/Deficit Measure: 0.076206951;
    Net-lending/Net-borrowing: -0.734940534.

    2016:
    Operating Surplus/Deficit Measure: 0.026942361;
    Net-lending/Net-borrowing: -0.769406462.

    2017:
    Operating Surplus/Deficit Measure: -0.032335263;
    Net-lending/Net-borrowing: -0.814653671.

    2018:
    Operating Surplus/Deficit Measure: -0.109446599;
    Net-lending/Net-borrowing: -0.878965311.

    2019:
    Operating Surplus/Deficit Measure: -0.19227354;
    Net-lending/Net-borrowing: -0.950160744.

    2020:
    Operating Surplus/Deficit Measure: -0.28349272;
    Net-lending/Net-borrowing: -1.030954125.

    2021:
    Operating Surplus/Deficit Measure: -0.386388384;
    Net-lending/Net-borrowing: -1.123450085.

    2022:
    Operating Surplus/Deficit Measure: -0.483216203;
    Net-lending/Net-borrowing: -1.211277239.

    2023:
    Operating Surplus/Deficit Measure: -0.557423995;
    Net-lending/Net-borrowing: -1.275859781.

    2024:
    Operating Surplus/Deficit Measure: -0.667104614;
    Net-lending/Net-borrowing: -1.376919803.

    2025:
    Operating Surplus/Deficit Measure: -0.781500085;
    Net-lending/Net-borrowing: -1.482014441.

    2026:
    Operating Surplus/Deficit Measure: -0.866176187;
    Net-lending/Net-borrowing: -1.558258502.

    2027:
    Operating Surplus/Deficit Measure: -0.971014018;
    Net-lending/Net-borrowing: -1.654401786.

    2028:
    Operating Surplus/Deficit Measure: -1.059403133;
    Net-lending/Net-borrowing: -1.733838263.

    2029:
    Operating Surplus/Deficit Measure: -1.167739726;
    Net-lending/Net-borrowing: -1.833479877.

    2030:
    Operating Surplus/Deficit Measure: -1.259948277;
    Net-lending/Net-borrowing: -1.916759702.

    2031:
    Operating Surplus/Deficit Measure: -1.372065386;
    Net-lending/Net-borrowing: -2.020169149.

    2032:
    Operating Surplus/Deficit Measure: -1.467520327;
    Net-lending/Net-borrowing: -2.107108096.

    2033:
    Operating Surplus/Deficit Measure: -1.596865114.
    Net-lending/Net-borrowing: -2.227702996.

    2034:
    Operating Surplus/Deficit Measure: -1.728257684;
    Net-lending/Net-borrowing: -2.350527637.

    2035:
    Operating Surplus/Deficit Measure: -1.829728717;
    Net-lending/Net-borrowing: -2.443203659.

    2036:
    Operating Surplus/Deficit Measure: -1.964429157.
    Net-lending/Net-borrowing: -2.569286091.

    2037:
    Operating Surplus/Deficit Measure: -2.100986709;
    Net-lending/Net-borrowing: -2.697381312.

    2038:
    Operating Surplus/Deficit Measure: -2.205225568;
    Net-lending/Net-borrowing: -2.7928813.

    2039:
    Operating Surplus/Deficit Measure: -2.325201615;
    Net-lending/Net-borrowing: -2.904115765.

    2040:
    Operating Surplus/Deficit Measure: -2.430489372;
    Net-lending/Net-borrowing: -3.00097328.

    2041:
    Operating Surplus/Deficit Measure: -2.569712106;
    Net-lending/Net-borrowing: -3.131648373.

    2042:
    Operating Surplus/Deficit Measure: -2.709424661;
    Net-lending/Net-borrowing: -3.262966376.

    2043:
    Operating Surplus/Deficit Measure: -2.818508477;
    Net-lending/Net-borrowing: -3.363795891.

    2044:
    Operating Surplus/Deficit Measure: -2.947568546;
    Net-lending/Net-borrowing: -3.484450067.

    2045:
    Operating Surplus/Deficit Measure: -3.058317306;
    Net-lending/Net-borrowing: -3.58693672.

    2046:
    Operating Surplus/Deficit Measure: -3.188512473;
    Net-lending/Net-borrowing: -3.709010629.

    2047:
    Operating Surplus/Deficit Measure: -3.300350183;
    Net-lending/Net-borrowing: -3.812861884.

    2048:
    Operating Surplus/Deficit Measure: -3.432143889;
    Net-lending/Net-borrowing: -3.936539309.

    2049:
    Operating Surplus/Deficit Measure: -3.545556545;
    Net-lending/Net-borrowing: -4.041974237.

    2050:
    Operating Surplus/Deficit Measure: -3.686995315;
    Net-lending/Net-borrowing: -4.175627129.

    Sources: Historical data from National Income and Product Accounts.
    Historical data from 1980�2006, GAO projections from 2007�2050 using
    many CBO projections and assumptions, particularly for next 10 years.

    [End of graph]

    State and Local Fiscal Challenges Add to the Federal Government�s
    Fiscal Challenge:

    [See PDF for image]

    This is a line graph with two lines (Federal Surplus/Deficit and
    Combined Surplus/Deficit). The vertical axis represents Percent of GDP
    from -20 to +5 and the horizontal axis represents fiscal years 2000
    through 2050.

    The following data is depicted:

    Fiscal year: 2000:
    Federal Surplus/Deficit: 2.4;
    Combined Surplus/Deficit: 2.141.

    Fiscal year: 2001:
    Federal Surplus/Deficit: 1.3;
    Combined Surplus/Deficit: 0.596.

    Fiscal year: 2002:
    Federal Surplus/Deficit: -1.5;
    Combined Surplus/Deficit: -2.624.

    Fiscal year: 2003:
    Federal Surplus/Deficit: -3.5;
    Combined Surplus/Deficit: -4.577.

    Fiscal year: 2004:
    Federal Surplus/Deficit: -3.6;
    Combined Surplus/Deficit: -4.516.

    Fiscal year: 2005:
    Federal Surplus/Deficit: -2.6;
    Combined Surplus/Deficit: -3.389.

    Fiscal year: 2006:
    Federal Surplus/Deficit: -1.9;
    Combined Surplus/Deficit: -2.677.

    Fiscal year: 2007:
    Federal Surplus/Deficit: -1.2;
    Combined Surplus/Deficit: -1.8.

    Fiscal year: 2008:
    Federal Surplus/Deficit: -1.6;
    Combined Surplus/Deficit: -2.2.

    Fiscal year: 2009:
    Federal Surplus/Deficit: -2;
    Combined Surplus/Deficit: -2.6.

    Fiscal year: 2010:
    Federal Surplus/Deficit: -2.6;
    Combined Surplus/Deficit: -3.2.

    Fiscal year: 2011:
    Federal Surplus/Deficit: -2.9;
    Combined Surplus/Deficit: -3.5.

    Fiscal year: 2012:
    Federal Surplus/Deficit: -2.8
    Combined Surplus/Deficit: -3.5.

    Fiscal year: 2013:
    Federal Surplus/Deficit: -3.3;
    Combined Surplus/Deficit: -4.

    Fiscal year: 2014:
    Federal Surplus/Deficit: -3.6;
    Combined Surplus/Deficit: -4.3.

    Fiscal year: 2015:
    Federal Surplus/Deficit: -3.8;
    Combined Surplus/Deficit: -4.5.

    Fiscal year: 2016:
    Federal Surplus/Deficit: -4.2;
    Combined Surplus/Deficit: -4.9.

    Fiscal year: 2017:
    Federal Surplus/Deficit: -4.4;
    Combined Surplus/Deficit: -5.2.

    Fiscal year: 2018:
    Federal Surplus/Deficit: -4.8;
    Combined Surplus/Deficit: -5.7.

    Fiscal year: 2019:
    Federal Surplus/Deficit: -5.2;
    Combined Surplus/Deficit: -6.1.

    Fiscal year: 2020:
    Federal Surplus/Deficit: -5.6;
    Combined Surplus/Deficit: -6.6.

    Fiscal year: 2021:
    Federal Surplus/Deficit: -6.1;
    Combined Surplus/Deficit: -7.2.

    Fiscal year: 2022:
    Federal Surplus/Deficit: -6.7;
    Combined Surplus/Deficit: -7.8.

    Fiscal year: 2023:
    Federal Surplus/Deficit: -7.2;
    Combined Surplus/Deficit: -8.4.

    Fiscal year: 2024:
    Federal Surplus/Deficit: -7.8;
    Combined Surplus/Deficit: -9.2.

    Fiscal year: 2025:
    Federal Surplus/Deficit: -8.5;
    Combined Surplus/Deficit: -9.9.

    Fiscal year: 2026:
    Federal Surplus/Deficit: -9;
    Combined Surplus/Deficit: -10.6.

    Fiscal year: 2027:
    Federal Surplus/Deficit: -9.7;
    Combined Surplus/Deficit: -11.3.

    Fiscal year: 2028:
    Federal Surplus/Deficit: -10.3;
    Combined Surplus/Deficit: -12.

    Fiscal year: 2029:
    Federal Surplus/Deficit: -10.9;
    Combined Surplus/Deficit: -12.7.

    Fiscal year: 2030:
    Federal Surplus/Deficit: -11.5;
    Combined Surplus/Deficit: -13.4.

    Fiscal year: 2031:
    Federal Surplus/Deficit: -12.2;
    Combined Surplus/Deficit: -14.2.

    Fiscal year: 2032:
    Federal Surplus/Deficit: -12.8;
    Combined Surplus/Deficit: -14.9.

    Fiscal year: 2033:
    Federal Surplus/Deficit: -13.5;
    Combined Surplus/Deficit:-15.7.

    Fiscal year: 2034:
    Federal Surplus/Deficit: -14.2;
    Combined Surplus/Deficit: -16.6.

    Fiscal year: 2035:
    Federal Surplus/Deficit: -14.8;
    Combined Surplus/Deficit: -17.3.

    Fiscal year: 2036:
    Federal Surplus/Deficit: -15.5;
    Combined Surplus/Deficit: -18.1.

    Fiscal year: 2037:
    Federal Surplus/Deficit: -16.3;
    Combined Surplus/Deficit: -18.9.

    Fiscal year: 2038:
    Federal Surplus/Deficit: -16.9;
    Combined Surplus/Deficit: -19.7.

    Fiscal year: 2039:
    Federal Surplus/Deficit: -17.6;
    Combined Surplus/Deficit: -20.5.

    Fiscal year: 2040:
    Federal Surplus/Deficit: -18.3;
    Combined Surplus/Deficit: -21.3.

    Fiscal year: 2041:
    Federal Surplus/Deficit: -19;
    Combined Surplus/Deficit: -22.1.

    Fiscal year: 2042:
    Federal Surplus/Deficit: -19.8;
    Combined Surplus/Deficit: -23.

    Fiscal year: 2043:
    Federal Surplus/Deficit: -20.4;
    Combined Surplus/Deficit: -23.8.

    Fiscal year: 2044:
    Federal Surplus/Deficit: -21.2;
    Combined Surplus/Deficit: -24.6.

    Fiscal year: 2045:
    Federal Surplus/Deficit: -21.9;
    Combined Surplus/Deficit: -25.5.

    Fiscal year: 2046:
    Federal Surplus/Deficit: -22.7;
    Combined Surplus/Deficit: -26.4.

    Fiscal year: 2047:
    Federal Surplus/Deficit: -23.4;
    Combined Surplus/Deficit: -27.2.

    Fiscal year: 2048:
    Federal Surplus/Deficit: -24.2;
    Combined Surplus/Deficit: -28.1.

    Fiscal year: 2049:
    Federal Surplus/Deficit: -24.9;
    Combined Surplus/Deficit:-29.

    Fiscal year: 2050:
    Federal Surplus/Deficit: -25.8;
    Combined Surplus/Deficit: -29.9.

    Source: Historical data from National Income and Product Accounts, GAO
    Analysis.

    Note: Historical data from 2000�2006, projections from 2007�2050; state
    and local balance measure is similar to the federal unified budget
    measure. Federal Simulation Assumptions: Discretionary spending grows
    with GDP after 2007. AMT exemption amount is retained at the 2006 level
    through 2017 and expiring tax provisions are extended. After 2017,
    revenue as a share of GDP returns to its historical level of 18.3
    percent of GDP plus expected revenues from deferred taxes, i.e. taxes
    on withdrawals from retirement accounts. Medicare spending is based on
    the Trustees� April 2007 projections adjusted for the Centers for
    Medicare and Medicaid Services� alternative assumption that physician
    payments are not reduced as specified under current law.

    [End of graph]

    Risk Management Can Improve Resource Allocation:

    * Using approaches that may not consider risk, such as Congressional
    direction (earmarks), compound these potential fiscal outcomes.

    * Congress, the President, and the Secretary of DHS have endorsed risk
    management.

    * DHS is making progress in applying risk management to guide its
    operational and resource allocation decisions.

    GAO's Risk Management Framework:

    * Risk management is a strategic process for helping policy makers
    allocate finite resources.

    * Consists of 5 phases: setting strategic goals and objectives,
    assessing risks, evaluating alternatives, management selection, and
    implementing and monitoring results.

    Moving Forward: Challenges in Using Risk Management:

    * Applying risk management to a homeland security context is a
    relatively new endeavor.

    * Choices must be made about protection priorities given the risk and
    how to best allocate available resources.

    * Strengthening the use of risk management principles in homeland
    security remains a challenge for many stakeholders.

    Using Your Input to Frame the Discussion:

    * We polled you on challenges in applying risk management to homeland
    security and actions to address them.

    * 100 percent response rate.

    * Your input has been used to shape our agenda and discussion sessions.

    * We will share results with you in later sessions.

    Key Issues in Strengthening the Use of Risk Management in Homeland
    Security:

    * What lessons can be learned from leading organizations about the
    effective use of risk management practices?

    * What are the key challenges faced by public and private organizations
    in adopting and implementing a risk-based approach for homeland
    security?

    * What actions should be taken in the near- and long-term to address
    the most pressing of these challenges?

    [End of section]

    Appendix IV: GAO Contacts and Staff Acknowledgments:

    GAO Contacts:

    Norman J. Rabkin, (202) 512-3610, rabkinn@gao.gov:

    Cathleen A. Berrick, (202) 512-3404, berrickc@gao.gov:

    Acknowledgments:

    In addition to the contacts named above, Anne Laffoon, Assistant
    Director; Tony Cheesebrough; Brett Collins; Amber Lopez; and Emily
    Rachman managed all aspects of the work, and Jason Barnosky, Chuck
    Bausell, Kathryn Bolduc, Valerie Colaiaco, Deborah Knorr, Stan
    Kostylya, Flavio Martinez, Linda Miller, Mona Nichols Blake, Jamie
    Roberts, April Thompson, and Adam Vogt made important contributions to
    producing this report.

    [End of section]

    Related GAO Products:

    [End of section]

    Aviation Security: Transportation Security Administration Has
    Strengthened Planning to Guide Investments in Key Aviation Security
    Programs, but More Work Remains. GAO-08-456T. Washington, D.C.:
    February 28, 2008.

    Transportation Security: Efforts to Strengthen Aviation and Surface
    Transportation Security are Under Way, but Challenges Remain. GAO-08-
    140T. Washington, D.C.: October 16, 2007.

    Department of Homeland Security: Progress Report on Implementation of
    Mission and Management Functions. GAO-07-454. Washington, D.C.: August
    17, 2007.

    Homeland Security: Applying Risk Management Principles to Guide Federal
    Investments. GAO-07-386T. Washington, D.C.: February 7, 2007.

    Homeland Security Grants: Observations on Process DHS Used to Allocate
    Funds to Selected Urban Areas. GAO-07-381R. Washington, D.C.: February
    7, 2007.

    Passenger Rail Security: Enhanced Federal Leadership Needed to
    Prioritize and Guide Security Efforts. GAO-07-225T. Washington, D.C.:
    January 18, 2007.

    Critical Infrastructure Protection: Progress Coordinating Government
    and Private Sector Efforts Varies by Sectors' Characteristics. GAO-07-
    39. Washington, D.C.: October 16, 2006.

    Interagency Contracting: Improved Guidance, Planning, and Oversight
    Would Enable the Department of Homeland Security to Address Risks. GAO-
    06-996. Washington, D.C.: September 27, 2006.

    Border Security: Stronger Actions Needed to Assess and Mitigate Risks
    of the Visa Waiver Program. GAO-06-1090T. Washington, D.C.: September
    7, 2006.

    Catastrophic Disasters: Enhanced Leadership, Capabilities, and
    Accountability Controls Will Improve the Effectiveness of the Nation's
    Preparedness, Response, and Recovery System. GAO-06-618. Washington,
    D.C.: September 6, 2006.

    Aviation Security: TSA Oversight of Checked Baggage Screening
    Procedures Could Be Strengthened. GAO-06-869. Washington, D.C.: July
    28, 2006.

    Border Security: Stronger Actions Needed to Assess and Mitigate Risks
    of the Visa Waiver Program. GAO-06-854. Washington, D.C.: July 28,
    2006.

    Passenger Rail Security: Evaluating Foreign Security Practices and Risk
    Can Help Guide Security Efforts. GAO-06-557T. Washington, D.C.: March
    29, 2006.

    Hurricane Katrina: GAO's Preliminary Observations Regarding
    Preparedness, Response, and Recovery. GAO-06-442T. Washington, D.C.:
    March 8, 2006.

    Risk Management: Further Refinements Needed to Assess Risks and
    Prioritize Protective Measures at Ports and Other Critical
    Infrastructure. GAO-06-91. Washington, D.C.: December 15, 2005.

    Passenger Rail Security: Enhanced Federal Leadership Needed to
    Prioritize and Guide Security Efforts. GAO-05-851. Washington, D.C.:
    September 9, 2005.

    Strategic Budgeting: Risk Management Principles Can Help DHS Allocate
    Resources to Highest Priorities. GAO-05-824T. Washington, D.C.: June
    29, 2005.

    Protection of Chemical and Water Infrastructure: Federal Requirements,
    Actions of Selected Facilities, and Remaining Challenges. GAO-05-327.
    Washington, D.C.: March 28, 2005.

    Transportation Security: Systematic Planning Needed to Optimize
    Resources. GAO-05-357T. Washington, D.C.: February 15, 2005.

    Homeland Security: Agency Plans, Implementation, and Challenges
    Regarding the National Strategy for Homeland Security. GAO-05-33.
    Washington, D.C.: January 14, 2005.

    Homeland Security: Observations on the National Strategies Related to
    Terrorism. GAO-04-1075T. Washington, D.C.: September 22, 2004.

    9/11 Commission Report: Reorganization, Transformation, and
    Information Sharing. GAO-04-1033T. Washington, D.C.: August 3, 2004.

    Critical Infrastructure Protection: Improving Information Sharing with
    Infrastructure Sectors. GAO-04-780. Washington, D.C.: July 9, 2004.

    Homeland Security: Communication Protocols and Risk Communication
    Principles Can Assist in Refining the Advisory System. GAO-04-682.
    Washington, D.C.: June 25, 2004.

    Critical Infrastructure Protection: Establishing Effective Information
    Sharing with Infrastructure Sectors. GAO-04-699T. Washington, D.C.:
    April 21, 2004.

    Homeland Security: Summary of Challenges Faced in Targeting Oceangoing
    Cargo Containers for Inspections. GAO-04-557T. Washington, D.C.: March
    31, 2004.

    Rail Security: Some Actions Taken to Enhance Passenger and Freight Rail
    Security, but Significant Challenges Remain. GAO-04-598T. Washington,
    D.C.: March 23, 2004.

    Homeland Security: Risk Communication Principles May Assist in
    Refinement of the Homeland Security Advisory System. GAO-04-538T.
    Washington, D.C.: March 16, 2004.

    Combating Terrorism: Evaluation of Selected Characteristics in National
    Strategies Related to Terrorism. GAO-04-408T. Washington, D.C.:
    February 3, 2004.

    Catastrophe Insurance Risks: Status of Efforts to Securitize Natural
    Catastrophe and Terrorism Risk. GAO-03-1033. Washington, D.C.:
    September 24, 2003.

    Homeland Security: Information Sharing Responsibilities, Challenges,
    and Key Management Issues. GAO-03-1165T. Washington, D.C.: September
    17, 2003.

    Homeland Security: Efforts to Improve Information Sharing Need to Be
    Strengthened. GAO-03-760. Washington, D.C.: August 27, 2003.

    Homeland Security: Information Sharing Responsibilities, Challenges,
    and Key Management Issues. GAO-03-715T. Washington, D.C.: May 8, 2003.

    Transportation Security Research: Coordination Needed in Selecting and
    Implementing Infrastructure Vulnerability Assessments. GAO-03-502.
    Washington, D.C.: May 1, 2003.

    Information Technology: Terrorist Watch Lists Should Be Consolidated to
    Promote Better Integration and Sharing. GAO-03-322. Washington, D.C.:
    April 15, 2003.

    Homeland Security: Voluntary Initiatives Are Under Way at Chemical
    Facilities, but the Extent of Security Preparedness Is Unknown. GAO-03-
    439. Washington, D.C.: March 14, 2003.

    Critical Infrastructure Protection: Challenges for Selected Agencies
    and Industry Sectors. GAO-03-233. Washington, D.C.: February 28, 2003.

    Major Management Challenges and Program Risks: Department of Homeland
    Security. GAO-03-102. Washington, D.C.: January 30, 2003.

    Critical Infrastructure Protection: Efforts of the Financial Services
    Sector to Address Cyber Threats. GAO-03-173. Washington, D.C.: January
    30, 2003.

    Homeland Security: A Risk Management Approach Can Guide Preparedness
    Efforts. GAO-02-208T. Washington, D.C.: October 31, 2001.

    Homeland Security: Key Elements of a Risk Management Approach. GAO-02-
    150T. Washington, D.C.: October 12, 2001.

    Homeland Security: A Framework for Addressing the Nation's Issues. GAO-
    01-1158T. Washington, D.C.: September 21, 2001.

    Combating Terrorism: Need for Comprehensive Threat and Risk Assessments
    of Chemical and Biological Attacks. GAO/NSIAD-99-163. Washington, D.C.:
    September 7, 1999.

    Combating Terrorism: Threat and Risk Assessments Can Help Prioritize
    and Target Program Investments. GAO/NSIAD-98-74. Washington, D.C.:
    April 9, 1998.

    [End of section]

    Footnotes:

    [1] For a description of this framework, see Appendix I of Risk
    Management: Further Refinements Needed to Assess Risks and Prioritize
    Protective Measures at Ports and Other Critical Infrastructure.
    [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-06-91]. Washington,
    D.C.: December 15, 2005.

    [2] Risk management is a continuous process of managing--through a
    series of mitigating actions that permeate an entity's activities--the
    likelihood of an adverse event and its negative impact.

    [3] Risk assessment is the process of qualitatively or quantitatively
    determining the probability of an adverse event and the severity of its
    impact on an asset.

    [4] Given the high risk of earthquakes in Mexico, Swiss Re issued a
    special catastrophe bond for the Mexican government in 2006 to finance
    rescue and rebuilding in the case of a disastrous earthquake. If there
    is no disaster within 3 years, investors who buy the bonds receive the
    premium and the interest. If there is a disastrous earthquake, the
    Mexican government will receive the full value of the bonds.

    [5] USCG carries out two efforts related to vessels entering ports and
    waterways to mitigate the risk that such vessels pose: security code
    compliance examinations and armed security boardings. Armed security
    boardings are conducted on targeted foreign and U.S. vessels that are
    deemed to pose a high relative security risk before they enter U.S.
    ports. The purpose is to inspect a vessel's cargo, documentation, and
    persons on board in order to assess whether any additional security
    measures are warranted to deter acts of terrorism or a security
    incident before permitting the vessel's entry into port. Other law
    enforcement agencies, such as CBP, may also participate if special
    expertise is needed, such as if a closer look is needed at a vessel's
    cargo, or if their mission requires them to board the same vessel.

    [6] According to the National Research Council, risk communication is
    the exchange of information among individuals and groups regarding the
    nature of risk, reactions to risk messages, and legal and institutional
    approaches to risk management.

    [7] White House Homeland Security Council, National Strategy for
    Homeland Security, (Washington, D.C.: October 5, 2007).

    [8] In the fall of 2002, sniper shootings resulted in the deaths of 10
    Washington D.C.-area residents. Some of the shootings took place at gas
    stations, shopping centers, and a school.

    [9] Such acts are often referred to as low probability-high consequence
    events among risk management scholars and practitioners.

    [10] See White House Homeland Security Council, National Strategy for
    Homeland Security, October 5, 2007, Page 41: "The assessment and
    management of risk underlies the full spectrum of our homeland security
    activities�We must apply a risk-based framework across all homeland
    security efforts�A disciplined approach to managing risk will help to
    achieve overall effectiveness and efficiency in securing the Homeland."

    [11] Office of Management and Budget, Proposed Risk Assessment
    Bulletin, January 9, 2006.

    [12] Committee to Review the OMB Risk Assessment Bulletin, National
    Research Council, Scientific Review of the Proposed Risk Assessment
    Bulletin from the Office of Management and Budget (Washington, D.C.:
    2007).

    [13] Centers of Excellence conduct research and education for homeland
    security solutions and are led by universities in collaboration with
    partners from other institutions, agencies, laboratories, think tanks,
    and the private sector.

    [14] Homeland Security Presidential Directive 3 established the
    Homeland Security Advisory System in March 2002 as a mechanism to
    inform and facilitate decisions related to securing the homeland among
    various levels of government, the private sector, and American
    citizens. The Homeland Security Advisory System comprises five color-
    coded threat conditions, which represent levels of risk related to
    potential terror attack: red, or severe alert; orange, or high alert;
    yellow, or elevated alert; blue, or guarded alert; green, or low alert.
    See also GAO, Homeland Security: Communication Protocols and Risk
    Communication Principles Can Assist in Refining the Advisory System,
    [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-04-682] (Washington,
    D.C.: June 25, 2004).

    [End of section]

    GAO's Mission:

    The Government Accountability Office, the audit, evaluation and
    investigative arm of Congress, exists to support Congress in meeting
    its constitutional responsibilities and to help improve the performance
    and accountability of the federal government for the American people.
    GAO examines the use of public funds; evaluates federal programs and
    policies; and provides analyses, recommendations, and other assistance
    to help Congress make informed oversight, policy, and funding
    decisions. GAO's commitment to good government is reflected in its core
    values of accountability, integrity, and reliability.

    Obtaining Copies of GAO Reports and Testimony:

    The fastest and easiest way to obtain copies of GAO documents at no
    cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
    weekday, GAO posts newly released reports, testimony, and
    correspondence on its Web site. To have GAO e-mail you a list of newly
    posted products every afternoon, go to [hyperlink, http://www.gao.gov]
    and select "E-mail Updates."

    Order by Mail or Phone:

    The first copy of each printed report is free. Additional copies are $2
    each. A check or money order should be made out to the Superintendent
    of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
    more copies mailed to a single address are discounted 25 percent.
    Orders should be sent to:

    U.S. Government Accountability Office:
    441 G Street NW, Room LM:
    Washington, D.C. 20548:

    To order by Phone:
    Voice: (202) 512-6000:
    TDD: (202) 512-2537:
    Fax: (202) 512-6061:

    To Report Fraud, Waste, and Abuse in Federal Programs:

    Contact:

    Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
    E-mail: fraudnet@gao.gov:
    Automated answering system: (800) 424-5454 or (202) 512-7470:

    Congressional Relations:

    Ralph Dawn, Managing Director, dawnr@gao.gov:
    (202) 512-4400:
    U.S. Government Accountability Office:
    441 G Street NW, Room 7125:
    Washington, D.C. 20548:

    Public Affairs:

    Chuck Young, Managing Director, youngc1@gao.gov:
    (202) 512-4800:
    U.S. Government Accountability Office:
    441 G Street NW, Room 7149:
    Washington, D.C. 20548:

    *** End of document. ***