Summary
The Department of Homeland Security's (DHS) Atlas program is intended to modernize Immigration and Customs Enforcement's (ICE) information technology (IT) infrastructure. By congressional mandate, DHS is to develop and submit for approval an expenditure plan for Atlas that satisfies certain legislative conditions, including a review by GAO. GAO was asked to determine whether the plan satisfied certain legislative conditions and to provide observations on the plan and management of the program.
DHS's fiscal year 2004 Atlas expenditure plan, related documentation, and program officials' statements satisfied all conditions imposed by Congress, including (1) meeting the capital planning and investment control review requirements established by the Office of Management and Budget (OMB); (2) complying with the DHS enterprise architecture; (3) complying with the acquisition rules, requirements, guidelines, and systems acquisition management practices of the federal government; and (4) being reviewed and approved by ICE's Investment Review Board, DHS, and OMB. However, this satisfaction is based more on plans and commitments that provide for meeting these conditions than on completed actions. As such, much remains to be accomplished for Atlas planning and management efforts to be considered effective and thereby minimize the risks associated with the program's capacity to deliver promised IT infrastructure capabilities and benefits on time and within budget. GAO developed a number of observations about the expenditure plan and DHS's management of the program. The observations address the need for economic justification of Atlas, rigorous and disciplined program management practices, performance measurements that are linked to goals and benefits, and an expenditure plan that provides sufficient information on program commitments for it to be a useful accountability tool. For example, Atlas's existing economic justification does not reflect recent and planned changes in the program's scope and purpose, including plans to expand the program beyond IT infrastructure upgrades. In addition, program management controls and capabilities have yet to be established. While ICE has begun to establish an Atlas program office, this office is not yet operational and is not adequately staffed. For example, while ICE has assigned a program manager and three contracting staff, it has not yet determined how many staff will be needed on the Atlas projects. In addition, while the program manager recently assessed staffing needs for program support positions, and identified several, none have been filled.
Recommendations
Our recommendations from this work are listed below with a Contact for more information. Status will change
from "In process" to "Implemented" or "Not implemented" based on our follow up work.
Director:
Team:
Phone:
Randolph C. Hite
Government Accountability Office: Information Technology
(202) 512-6256
Recommendations for Executive Action
Recommendation: To minimize risks to the Atlas program, the Secretary of Homeland Security, through the Under Secretary for Border and Transportation Security, should direct the Assistant Secretary for Immigration and Customs Enforcement to ensure that ICE follows through on commitments to implement effective management controls and capabilities by revising and updating the cost-benefit analysis, to identify current mission requirements; how they will be met; and an estimate of the program's incremental and life-cycle costs, benefit, schedule, and return on investment. This should also include establishing plans, associated tasks, and milestones for accomplishing this effort.
Agency Affected: Department of Homeland Security: Directorate of Border and Transportation Security: Bureau of Immigration and Customs Enforcement
Status: In process
Comments: As we reported on July 31, 2006, (see GAO-06-823), ICE revised and updated its Atlas cost-benefit analysis in December 2005. The analysis included three alternatives for meeting current requirements and estimates of each alternative's life cycle costs, benefits, schedule, and return on investment and described notionally the respective solutions for meeting them. Since then, ICE reported that the Atlas program's mission priorities had changed and the December 2005 cost benefit analysis would be updated to reflect the change in priorities. The updated analysis is targeted for issuance in April 2009.
Recommendation: To minimize risks to the Atlas program, the Secretary of Homeland Security, through the Under Secretary for Border and Transportation Security, should direct the Assistant Secretary for Immigration and Customs Enforcement to ensure that ICE follows through on commitments to implement effective management controls and capabilities by making the Atlas program office operational by (1) developing a staffing needs assessment to determine the positions and the level of staffing needed for all projects to adequately manage the program, including a human capital strategy and timetable for acquiring the staff and bringing them on board; (2) finalizing the roles and responsibilities for the positions identified in the staffing assessment and for the projects; and (3) implementing and institutionalizing key acquisition management controls, including risk management processes where relevant responsibilities are assigned and key risks and their status are reported to an executive body.
Agency Affected: Department of Homeland Security: Directorate of Border and Transportation Security: Bureau of Immigration and Customs Enforcement
Status: Implemented
Comments: Consistent with our recommendation, ICE established an Atlas program management office (PMO). In doing so, it also developed a staffing needs assessment, defined roles and responsibilities for the positions identified in the assessment, and has begun implementing key acquisition controls such as risk management. Specifically, in early 2006, ICE stood up the PMO, which is headed by a program manager that reports to ICE's Chief Information Officer, to manage and oversee the program. In addition, in April 2006, ICE developed an Atlas PMO Organizational Assessment that defined the program office's hierarchical structure and functions. As part of the assessment, ICE performed a staffing needs assessment to determine the positions and level of staffing need to adequately manage the program. According to the assessment, the program needed, among other things, a program manager, seven project managers, and a contracting officer's technical representative (COTR). As of early 2007, ICE had hired staff for all of these positions. In the assessment, ICE also defined roles and responsibilities for the positions identified in its staffing assessment as well as for staff associated with each of its seven projects. With respect to key acquisition management controls, ICE has, for example, developed a risk management plan and process, and has begun to implement the risk management plan and process by developing an inventory of risks and hiring a risk management coordinator to maintain and update the risk management plan, facilitate risk assessments, track efforts to reduce risks to acceptable levels, and develop and conduct risk management training.
Recommendation: To minimize risks to the Atlas program, the Secretary of Homeland Security, through the Under Secretary for Border and Transportation Security, should direct the Assistant Secretary for Immigration and Customs Enforcement to ensure that ICE follows through on commitments to implement effective management controls and capabilities by developing and implementing an updated Atlas security plan and privacy impact assessment. This should also include establishing plans, associated tasks, and milestones for accomplishing this effort.
Agency Affected: Department of Homeland Security: Directorate of Border and Transportation Security: Bureau of Immigration and Customs Enforcement
Status: In process
Comments: In July 2006, we reported that while the plan included key practices called for by federal IT security guidance, it was also missing or only partially addressed others. Since then, ICE has adopted the management approach that it will develop security plans for Atlas systems as they are preparing to become operational. For the one Atlas system that has thus far been made operational (called ADEX), ICE has developed a security plan that is consistent with federal IT guidance. In conjunction with DHS's Privacy Office, ICE also performed a privacy threshold analysis to identify which Atlas projects will use and store privacy data, thus requiring a privacy impact assessment. The threshold analysis identified that only one Atlas system investment (called ICE Integrated Decision Support) was to use and store privacy data. According to the Atlas program manager, the privacy impact assessment (PIA) for this project is under development and is to be completed by April 2009.
Recommendation: To minimize risks to the Atlas program, the Secretary of Homeland Security, through the Under Secretary for Border and Transportation Security, should direct the Assistant Secretary for Immigration and Customs Enforcement to ensure that ICE follows through on commitments to implement effective management controls and capabilities by developing and implementing rigorous performance management practices for the Atlas program that include properly aligned goals, benefits, achievements, and anticipated achievements that are defined in measurable terms. This should also include establishing plans, associated tasks, and milestones for accomplishing this effort.
Agency Affected: Department of Homeland Security: Directorate of Border and Transportation Security: Bureau of Immigration and Customs Enforcement
Status: Implemented
Comments: ICE has taken steps to implement performance management practices that are consistent with our recommendation. Specifically, as of April 2007, ICE had developed performance measures for all seven Atlas projects and is using these measures at its quarterly Program Management Reviews to manage and oversee the program. In addition, ICE has developed (and reported in its 2006 and 2007 expenditure plans), benefits and achievements, in measurable terms, for each of the projects. The expenditure plans also describe how the performance measures, benefits, and achievements support and are linked to the program's goals of enhancing productivity, strengthening security of information and data assets, and promoting information sharing and collaboration.
Recommendation: To minimize risks to the Atlas program, the Secretary of Homeland Security, through the Under Secretary for Border and Transportation Security, should direct the Assistant Secretary for Immigration and Customs Enforcement to ensure that ICE follows through on commitments to implement effective management controls and capabilities by ensuring that future expenditure plans fully disclose the system capabilities, schedule, cost, and benefits to be delivered, as well as the acquisition strategy for Atlas.
Agency Affected: Department of Homeland Security: Directorate of Border and Transportation Security: Bureau of Immigration and Customs Enforcement
Status: Implemented
Comments: Consistent with our recommendations, ICE's fiscal year 2007 Atlas expenditure plan included a profile for each Atlas project that included a description of the system capabilities, schedule, cost, and benefits to be delivered as well as how they were to be acquired. For example, for system capabilities, the expenditure plan profile provided a summary for each project, of the funding to be provided and the capabilities to be delivered. This summary also included the milestones for when the capabilities were to be provided. In addition, with regard to benefits, the plan profile described the benefits to be realized as a result of each planned system investment. Furthermore, each profile described how each project was to be acquired in accordance with guidance in the acquisition plan developed by the Atlas program. According to ICE officials, including the Atlas Program Manager, they plan to include this information in future expenditure plans.
