DHS Acquisitions: Opportunities Exist to Enhance Risk Management

Why GAO Did This Study

DHS and its components acquire systems to help carry out multiple critical missions. In fiscal year 2023, DHS plans to spend over $4 billion on these systems. In May 2019, DHS revised its acquisition policy to better incorporate risk management—a continuous process to systematically track and manage risks.

GAO was asked to review DHS’s acquisition risk management process for its major acquisition programs—those with life-cycle cost estimates of $300 million or more. This report assesses, among other issues, the extent to which DHS has addressed risk management at (1) the program-level, including involving stakeholders and leadership, and (2) the portfolio level.

GAO reviewed acquisition risk management policies and guidance from DHS and the eight components that manage major acquisition programs. GAO also reviewed how a nongeneralizable sample of five programs from within these components managed risks. GAO selected the sample based on a representation of components and a mix of IT and non-IT programs, among other criteria.

What GAO Found

Managing acquisition risks—potential negative effects on a program’s cost, schedule, and performance—is critical for a program to achieve its objectives. GAO previously found that acquisition programs tend to be overly optimistic when assessing their risks, underestimating the resources or time needed to develop and field capabilities. GAO and others identified six leading principles of acquisition risk management that are applicable to programs and portfolios, which are groups of related programs, such as Coast Guard ships.

Recommendations

GAO is making eight recommendations to DHS, including that, as it updates its risk management guidance, it includes steps to enhance programs’ communication with stakeholders, improve direction to programs on providing current risk data to leadership, and address portfolio risk management. DHS agreed with the recommendations.

See the report here.