Mgmt

We determined that the Transportation Security Administration (TSA) did not manage the Recruitment and Hiring (R&H) contract in a fiscally responsible manner.  Specifically, TSA did not properly plan contract requirements prior to awarding the contract and did not develop accurate cost estimates for all contract modifications.  We recommended TSA establish a cross-functional requirements working group for planning and awarding the R&H re-compete efforts as well as other Personnel Futures Program contract requirements.  The working group should develop a holistic and forward-thinking acquisition strategy, as well as implement a comprehensive process for reviewing and determining requirements.  We also recommended TSA ensure Human Capital improves contract management activities including, but not limited to, requirements planning and realistic cost estimate development by obtaining additional expert resources or leveraging existing expertise.  We made two recommendations to improve TSA’s contract management.  TSA concurred with both recommendations.

We determined DHS had not yet strengthened its cybersecurity posture by implementing a Continuous Diagnostics and Mitigation (CDM) Program.  DHS spent more than $180 million between 2013 and 2020 to design and deploy a department-wide continuous monitoring solution but faced setbacks.  DHS initially planned to deploy its internal CDM solution by 2017 using a “One DHS” approach that restricted components to a standard set of common tools.  We attributed DHS’ limited progress to an unsuccessful initial implementation strategy, significant changes to its deployment approach, and continuing issues with component data collection and integration.  As of March 2020, DHS had developed a key element of the program, its internal CDM dashboard.  However, the dashboard contained less than half of the required asset management data.  As a result, the Department cannot leverage intended benefits of the dashboard to manage, prioritize, and respond to cyber risks in real time.  Finally, we identified vulnerabilities on CDM servers and databases.  This occurred because DHS did not clearly define patch management responsibilities and had not yet implemented required configuration settings.  Consequently, databases and servers could be vulnerable to cybersecurity attack, and the integrity, confidentiality, and availability of the data could be at risk.  We made three recommendations for DHS to update its program plan, address vulnerabilities, and define patch management responsibilities

We determined that U.S. Customs and Border Protection (CBP) and Border Patrol headquarters officials were only aware of a few of the 83 CBP employees’ cases of social media misconduct.  CBP and Border Patrol senior officials only responded to one of those cases, upon direction from DHS.  In contrast, the senior Office of Field Operations (OFO) headquarters leader issued guidance to remind OFO employees of acceptable use of social media.  With regard to the posts media outlets published in July 2019, we found no evidence that senior CBP headquarters or field leaders were aware of them until they were made public by the media.  We also found some senior leaders questioned the legality or the application of CBP policies, which may undermine CBP’s ability to enforce the policies.  We made two recommendations to help reduce the incidence of social media misconduct.  First, we recommended the Commissioner ensures CBP uniformly applies social media misconduct policies, and establishes social media training for new recruits and annual refresher training for all employees.  CBP concurred with all recommendations.

We determined DHS did not comply with Payment Integrity Information Act of 2019 (PIIA)  in fiscal year 2020 because it did not achieve and report an improper payment rate of less than 10 percent for 2 of 12 programs reported in its FY 2020 Agency Financial Report.  DHS complied with Executive Order 13520 by properly compiling and making available to the public its FY 2020 Quarterly High-Dollar Overpayment reports.  We made two recommendations to DHS to follow Office of Management and Budget requirements and ensure the Federal Emergency Management Agency continues its remediation process to reduce improper payments.  DHS concurred with both recommendations. 

We determined that DHS’ Countering Weapons of Mass Destruction Office (CWMD) BioWatch has information sharing challenges that reduce nationwide readiness to respond to biological terrorism threats.  We made four recommendations that, when implemented, will improve BioWatch. CWMD concurred with all four recommendations. 

Based on our review of 45 judgmentally sampled awards (15 non-competitive grants and 30 other than full and open competition [OTFOC] contracts), we found DHS complied with applicable laws and regulations.  We made two recommendations to help improve DHS’ procedures and ensure future reporting submissions are accurate.  The Department concurred with the two recommendations.  

DHS has not fulfilled most of the 13 responsibilities of the Geospatial Data Act.  To comply with one responsibility, DHS has a Geospatial Information Officer and a dedicated Geospatial Management Office whose duties include overseeing the Act’s implementation and to coordinate with other agencies.  However, DHS has only partially met, or not met, the remaining 12 responsibilities in the Act.  DHS’ lack of progress in complying with the responsibilities outlined in the Act can be attributed to multiple external and internal factors.  External factors include the need for additional guidance from the Federal Geographic Data Committee and the Office of Management and Budget to properly interpret and implement certain responsibilities.  Internal factors include competing priorities that diverted resources away from fulfilling the Act’s 13 responsibilities.  We made three recommendations that focus on increasing the resources necessary to comply with DHS’ 13 responsibilities under the Act.  The Department concurred with all three recommendations.

Since 2017, DHS has continued to make progress in meeting its Digital Accountability and Transparency Act of 2014 (DATA Act) reporting requirements, but challenges remain.  To enable more effective tracking of Federal spending, DHS must continue to take action to accurately align its budgetary data with the President’s budget, reduce award misalignments across DATA Act files, improve the timeliness of financial assistance reporting, implement and use government-wide data standards, and address risks to data quality.  Without these actions, DHS will continue to experience challenges in meeting its goal of achieving the highest possible data quality for submission to USAspending.gov.  We made five recommendations to help strengthen DHS’ controls for ensuring complete, accurate, and timely spending data.  The Department concurred with all five recommendations. 

Two years since enactment, DHS and its components have mostly complied with SAVE Act requirements.  The SAVE Act requires the Office of the Chief Readiness Support Officer (OCRSO), as delegated by DHS, to collect and review components’ vehicle use data, including their analyses of the data and plans for achieving the right types and sizes of vehicles to meet mission needs.  Most components developed their plans as required.  However, only two of the 12 components we reviewed fully met requirements to analyze and document vehicle use and cost data to help them achieve the right type and size of fleet vehicles to meet their missions.  This occurred because DHS did not require components to include data analyses in their OCRSO-reviewed submissions, as mandated by the SAVE Act.  Had ORSCO thoroughly evaluated component submissions, it would have identified that components did not fully comply with SAVE Act requirements.  DHS concurred with all four recommendations that, when implemented, should improve the Department’s oversight over its vehicle fleets. 

DHS complied with the Improper Payments Elimination and Recovery Act (IPERA) in fiscal year 2019 by meeting all six of the IPERA requirements.  DHS also complied with Executive Order 13520, Reducing Improper Payments.  Additionally, we reviewed DHS’ processes and procedures for estimating its annual improper payment rates.  Based on our review, we determined DHS did not provide adequate oversight of the components’ improper payment testing and reporting.  We made one recommendation to DHS’ Risk Management and Assurance Division to properly follow the requirements in the DHS Improper Payment Reduction Guidebook.