DHS Has Made Important Progress in Strengthening Its Management, but Considerable Work Remains DHS Has Met 3 of 5 Criteria for Removal from the High-Risk List DHS’s efforts to strengthen and integrate its acquisition, IT, financial, and human capital management functions have resulted in the department meeting 3 out of 5 criteria for removal from the High-Risk List—leadership commitment, action planning, and monitoring progress. DHS has partially met the remaining two criteria—capacity and demonstrated, sustained progress, as shown in figure 1. With regard to leadership commitment, DHS’s top leadership, including the Secretary and Deputy Secretary of Homeland Security, has continued to demonstrate commitment and support for addressing the department’s management challenges. They have also taken actions to institutionalize this commitment to help ensure the long-term success of the department’s efforts. One such effort is the Under Secretary for Management’s Integrated Priorities initiative to strengthen the integration of DHS’s business operations across the department. During monthly leadership meetings with the Under Secretary for Management, the department’s Chief Executive Officers have been providing status updates on their respective actions to address this high-risk designation. Furthermore, top DHS leaders, such as the Under Secretary for Management and the department’s Chief Executive Officers, routinely meet with GAO management to discuss progress on high-risk areas. With regard to having an action plan and monitoring effectiveness, in January 2011, DHS produced its first Integrated Strategy for High-Risk Management and has issued 14 updated versions, most recently in September 2018. The September 2018 strategy describes DHS’s progress to-date, planned corrective actions to further strengthen its management functions, and includes performance measures to monitor key management initiatives. DHS’s Management Directorate leads this ongoing effort and DHS’s strategy and approach, if effectively implemented and sustained, provides a path for DHS to be removed from our High-Risk List. DHS has partially met the criteria for capacity but needs to make additional progress identifying and allocating resources in certain areas— namely acquisition, IT, and financial management—to fully demonstrate its capacity. DHS has analyzed components’ acquisition program staffing assessments but has yet to conduct an in-depth analysis across components or develop a plan to address any gaps. With regard to IT staffing, DHS has not fully identified or reported to Congress or the Office of Personnel Management (OPM) on its department-wide cybersecurity specialty areas of critical needs, such as cybersecurity management or incident response, as required by law. Additionally, DHS’s financial statement auditor has identified several capacity-related issues, including resource limitations and inadequate management and staff training, as causes for the material weaknesses reported. The final criterion is demonstrated progress, which remains partially met. In 2010, we identified, and DHS agreed, that achieving 30 specific outcomes in the areas of acquisition management, IT management, financial management, human capital management, and management integration would be critical to addressing the department’s management challenges. As such, these 30 outcomes became the key criteria by which we gauge DHS’s demonstrated progress. We reported in March 2019 that DHS has fully addressed 17 of the 30 needed outcomes, mostly addressed four, partially addressed six, and initiated actions to address the remaining three, as shown in table 1. In the last 2 years, DHS has made particular progress in the areas of human capital and IT management. Specifically, since 2017 DHS has taken steps to fully address 4 outcomes. The department fully addressed two key human capital outcomes by (1) demonstrating that components are basing hiring decisions and promotions on human capital competencies and (2) strengthening employee engagement efforts. In addition, in the last 2 years DHS has fully addressed two IT outcomes by (1) providing ongoing oversight and support to troubled IT investments to help improve their cost, schedule, and performance; and (2) demonstrating significant progress in implementing its IT strategic workforce planning initiative. Important progress and remaining work in all of the five key areas include: Acquisition management. DHS continues to face challenges in funding its acquisition portfolio. In May 2018, we found that recent enhancements to DHS’s acquisition management, resource allocation, and requirements policies largely reflect key portfolio management practices. However, we also found that of the 24 major acquisition programs we assessed with approved schedule and cost goals, 10 were on track to meet those goals during 2017—a decrease from 2016. In addition, we found that DHS’s portfolio of major acquisition programs was not affordable from fiscal years 2018 to 2022 because the planned costs exceeded the planned budget. DHS has taken steps to strengthen acquisition requirements development across the department, such as reestablishing the Joint Requirements Council in June 2014 to review and validate DHS acquisition requirements. However, opportunities remain to further strengthen DHS’s acquisition process by, for example, using the Joint Requirements Council to (1) identify overlapping or common requirements and (2) make recommendations to senior leadership to help ensure that DHS uses its finite investment resources wisely and maintains a balanced portfolio of investments that combine near-term operational improvements with long-term strategic planning. IT management. DHS has updated its approach for managing its portfolios of IT investments across all components. As part of the revised approach, the department is using its capital planning and investment control process and the Joint Requirements Council to assess IT investments across the department on an ongoing basis. For example, as part of its capital planning process for the fiscal year 2020 budget, the Office of the Chief Information Officer worked with the components to assess each major IT investment to ensure alignment with DHS’s functional portfolios, and to identify opportunities to share capabilities across components. This updated approach should enable DHS to identify potentially duplicative investments and opportunities for consolidating investments, as well as reduce component-specific investments. Additionally, DHS has continued to take steps to enhance its information security program. In November 2018, the department’s financial statement auditor reported that DHS had made progress in correcting its prior year IT security weaknesses. However, for the 15th consecutive year, the auditor designated deficiencies in IT systems controls as a material weakness for financial reporting purposes. Work also remains in implementing our six open recommendations concerning DHS’s cybersecurity workforce assessment requirements. DHS also faces challenges in fulfilling its pivotal role in government- wide cybersecurity efforts, as identified in our Ensuring the Cybersecurity of the Nation high-risk area. DHS has established the National Cybersecurity and Communications Integration Center, which functions as the 24/7 cyber monitoring, incident response, and management center for the federal civilian government. However, DHS has continued to be challenged in measuring how the center is performing its functions in accordance with mandated implementing principles. Financial management. DHS received a clean audit opinion on its financial statements for 6 consecutive years—fiscal years 2013 to 2018. However, in fiscal year 2018, its auditor reported two material weaknesses in the areas of financial reporting and information technology controls and financial systems, as well as instances of non-compliance with laws and regulations. These deficiencies hamper DHS’s ability to provide reasonable assurance that its financial reporting is reliable and the department is in compliance with applicable laws and regulations. Further, DHS components’ financial management systems and business processes need to be modernized; the current systems affect the department’s ability to have ready access to reliable information for informed decision-making. As we reported in 2017, DHS officials have faced various challenges in their efforts to address this—lack of sufficient resources, aggressive schedule, complex requirements, and increased costs. Effectively modernizing financial management systems for the Coast Guard, Federal Emergency Management Agency, and Immigration and Customs Enforcement would help address DHS’s risk in this area. Human capital management. DHS has continued to strengthen its employee engagement efforts by implementing our 2012 recommendation to establish metrics of success within components’ action plans for addressing its employee satisfaction problems. Further, DHS has conducted audits to better ensure components are basing hiring decisions and promotions on human capital competencies. OPM’s 2018 Federal Employee Viewpoint Survey data showed that in the past 2 years, DHS’s score on the Employee Engagement Index increased by 4 points—from 56 in 2016 to 60 in 2018—which was 1 point more than the government wide increase over the same period. While this improvement is notable, DHS’s 2018 score ranked 20th among 20 large and very large federal agencies. Increasing employee engagement and morale is critical to strengthening DHS’s mission and management functions. Management integration. Since 2015, DHS has focused its efforts to address crosscutting management challenges through the establishment and monitoring of its Integrated Priorities initiative. The department updated these priorities in September 2017. Each priority includes goals, objectives, and measurable action plans that are discussed at monthly leadership meetings led by senior DHS officials, including the Under Secretary for Management. DHS needs to continue to demonstrate sustainable progress integrating its management functions within and across the department. What Remains to be Done In closing, it is clear that significant effort is required to build and integrate a department as large and complex as DHS, which has grown to more than 240,000 employees and approximately $74 billion in budget authority. Continued progress for this high-risk area depends primarily on addressing the remaining outcomes. In the coming years, DHS needs to continue implementing its Integrated Strategy for High-Risk Management to show measurable, sustainable progress in implementing corrective actions and achieving outcomes. In doing so, it remains important for DHS to maintain its current level of top leadership support and sustained commitment to ensure continued progress in executing its corrective actions through completion; continue to identify the people and resources necessary to make progress towards achieving outcomes, work to mitigate shortfalls and prioritize initiatives as needed, and communicate to senior leadership critical resource gaps; continue to implement its plan for addressing this high-risk area and periodically provide assessments of its progress to us and Congress; closely track and independently validate the effectiveness and sustainability of its corrective actions, and make midcourse adjustments as needed; and make continued progress in achieving the 13 outcomes it has not fully addressed and demonstrate that systems, personnel, and policies are in place to ensure that progress can be sustained over time. We will continue to monitor DHS’s efforts in this high-risk area to determine if the outcomes are achieved and sustained over the long term. Madam Chairwoman Torres Small, Ranking Member Crenshaw, and Members of the Subcommittee, this completes my prepared statement. I would be happy to respond to any questions you may have at this time. GAO Contacts and Staff Acknowledgments If you or your staff members have any questions about this testimony, please contact me at (404) 679-1875 or curriec@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Other individuals making key contributions to this work include Claudia Becker, Assistant Director; Imoni Hampton, Analyst-in-Charge; Michele Fejfar, Melissa Greenaway, James Lawson, and Tom Lombardi. Key contributors for the previous work that this is based on are listed in each product. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.


DHS Has Made Progress Addressing Past Challenges, But Some Actions are Still Under Way Our past work has identified progress and challenges in a number of areas related to DHS’s management of the CFATS program, including (1) the process for identifying high-risk chemical facilities; (2) how it assesses risk and prioritizes facilities; (3) reviewing and approving facility site security plans; (4) inspecting facilities and ensuring compliance; and (5) efforts to conduct outreach with stakeholders and first responders. Identifying High-Risk Chemical Facilities In May 2014, we found that more than 1,300 facilities had reported having ammonium nitrate to DHS. However, based on our review of state data and records, there were more facilities with ammonium nitrate holdings than those that had reported to DHS under the CFATS program. Thus, we concluded that some facilities weren’t required to report to DHS and some that were required may have failed to do so. We recommended that DHS work with other agencies, including the Environmental Protection Agency (EPA), to develop and implement methods of improving data sharing among agencies and with states as members of a Chemical Facility Safety and Security Working Group. DHS agreed with our recommendation and has since addressed it. Specifically, DHS compared DHS data with data from other federal agencies, such as EPA, as well as member states from the Chemical Facility Safety and Security Working Group to identify potentially noncompliant facilities. As a result of this effort, in July 2015, DHS officials reported that they had identified about 1,000 additional facilities that should have reported information to comply with CFATS and subsequently contacted these facilities to ensure compliance. DHS officials told us that they continue to engage with states to identify potentially non-compliant facilities. For example, as of June 2018, DHS officials stated that they have received 43 lists of potentially noncompliant facilities from 34 state governments, which are in various stages of review by DHS. DHS officials also told us that they hired an individual to serve as the lead staff member responsible for overseeing this effort. DHS has also taken action to strengthen the accuracy of data it uses to identify high-risk facilities. In July 2015, we found that DHS used self- reported and unverified data to determine the risk categorization for facilities that held toxic chemicals that could threaten surrounding communities if released. At the time, DHS required that facilities self- report the Distance of Concern—an area in which exposure to a toxic chemical cloud could cause serious injury or fatalities from short-term exposure—as part of its Top-Screen. We estimated that more than 2,700 facilities with a toxic release threat had misreported the Distance of Concern and therefore recommended that DHS (1) develop a plan to implement a new Top-Screen to address errors in the Distance of Concern submitted by facilities, and (2) identify potentially miscategorized facilities that could cause the greatest harm and verify that the Distance of Concern of these facilities report is accurate. DHS has fully addressed both of these recommendations. Specifically, in response to the first recommendation, DHS implemented an updated Top-Screen survey in October 2016 and now collects data from facilities and conducts more accurate modeling to determine the actual area of impact (formerly called the Distance of Concern), rather than relying on the facilities’ calculation. In response to the second recommendation, DHS officials reported in November 2016 that they reassessed all facility Top-Screens that reported threshold quantities of chemicals posing a toxic release threat, and identified 158 facilities with the potential to cause the greatest harm. In April 2018, DHS officials reported that all of these facilities have since been reassessed using updated Top-Screen information and, where appropriate, assigned a risk tier. Assessing Risk and Prioritizing Facilities DHS has also taken actions to better assess regulated facilities’ risks in order to place the facilities into the appropriate risk tier. In April 2013, we reported that DHS’s risk assessment approach did not consider all of the elements of threat, vulnerability, and consequence associated with a terrorist attack involving certain chemicals. Our work showed that DHS’s CFATS risk assessment methodology was based primarily on consequences from human casualties, but did not consider economic consequences, as called for by the National Infrastructure Protection Plan (NIPP) and the CFATS regulation. We also found that (1) DHS’s approach was not consistent with the NIPP because it treated every facility as equally vulnerable to a terrorist attack regardless of location or on-site security and (2) DHS was not using threat data for 90 percent of the tiered facilities—those tiered for the risk of theft or diversion—and using 5-year-old threat data for the remaining 10 percent of those facilities that were tiered for the risks of toxic chemical release or sabotage. We recommended that DHS enhance its risk assessment approach to incorporate all elements of risk and conduct an independent peer review after doing so. DHS agreed with our recommendations and has implemented actions to address both of them. Specifically, with regard to our recommendation that DHS enhance its risk assessment approach to incorporate all elements of risk, DHS worked with Sandia National Laboratories to develop a model to estimate the economic consequences of a chemical attack. In addition, DHS worked with Oak Ridge National Laboratory to devise a new tiering methodology, called the Second Generation Risk Engine. In so doing, DHS revised the CFATS threat, vulnerability, and consequence scoring methods to better cover the range of CFATS security issues. Additionally, with regard to our recommendation that DHS conduct a peer review after enhancing its risk assessment approach, DHS conducted peer reviews and technical reviews with government organizations and facility owners and operators, and worked with Sandia National Laboratories to verify and validate the CFATS program’s revised risk assessment methodology. To further enhance its risk assessment approach, in the fall of 2016, DHS also revised its Chemical Security Assessment Tool (CSAT), which supports DHS efforts to gather information from facilities to assess their risk. According to DHS officials, the new tool—called CSAT 2.0—is intended to eliminate duplication and confusion associated with DHS’s original CSAT. DHS officials told us that they have improved the tool by revising some questions in the original CSAT to make them easier to understand; eliminating some questions; and pre-populating data from one part of the tool to another so that users do not have to retype the same information multiple times. DHS officials also told us that the facilities that have used the CSAT 2.0 have provided favorable feedback that the new tool is more efficient and less burdensome than the original CSAT. Finally, DHS officials told us that, as of June 2018, DHS completed all notifications and processed tiering results for all but 226 facilities. DHS officials did not provide an estimated target completion date for these pending risk assessments, noting that completing the assessments is highly dependent on the facilities providing the necessary Top-Screen information. Reviewing and Approving Facility Site Security Plans DHS has also made progress reviewing and approving facility site security plans by reducing the time it takes to review these plans and eliminating the backlog of plans awaiting review. In April 2013, we reported that DHS revised its procedures for reviewing facilities’ security plans to address DHS managers’ concerns that the original process was slow, overly complicated, and caused bottlenecks in approving plans. We estimated that it could take DHS another 7 to 9 years to review the approximately 3,120 plans in its queue at that time. We also estimated that, given the additional time needed to do compliance inspections, the CFATS program would likely be implemented in 8 to 10 years. We did not make any recommendations for DHS to improve its procedures for reviewing facilities’ security plans because DHS officials reported that they were exploring ways to expedite the process, such as reprioritizing resources and streamlining inspection requirements. In July 2015, we reported that DHS had made substantial progress in addressing the backlog—estimating that it could take between 9 and 12 months for DHS to review and approve security plans for the approximately 900 remaining facilities. DHS officials attributed the increased approval rate to efficiencies in DHS’s review process, updated guidance, and a new case management system. Subsequently, DHS reported in its December 2016 semi-annual report to Congress that it had eliminated its approval backlog. Finally, we found in our 2017 review that DHS took action to implement an Expedited Approval Program (EAP). The CFATS Act of 2014 required that DHS create the EAP as another option that tier 3 and tier 4 chemical facilities may use to develop and submit security plans to DHS. Under the program, these tier 3 and 4 facilities may develop a security plan based on specific standards published by DHS (as opposed to the more flexible performance standards using the standard, non- expedited process). DHS issued guidance intended to help facilities prepare and submit their EAP security plans to DHS, which includes an example that identifies prescriptive security measures that facilities are to have in place. According to committee report language, the EAP was expected to reduce the regulatory burden on smaller chemical companies, which may lack the compliance infrastructure and the resources of large chemical facilities, and help DHS to process security plans more quickly. If a tier 3 or 4 facility chooses to use the expedited option, DHS is to review the plan to determine if it is facially deficient, pursuant to the reporting requirements of the CFATS Act of 2014. If DHS approves the EAP site security plan, it is to subsequently conduct a compliance inspection. In 2017, we found that DHS had implemented the EAP and had reported to Congress on the program, as required by the CFATS Act of 2014. In addition, as of June 2018, according to DHS officials, only 18 of the 3,152 facilities eligible to use the EAP had opted to use it. DHS officials attributed the low participation to several possible factors including: DHS had implemented the expedited program after most eligible facilities already submitted standard (non-expedited) security plans to DHS; facilities may consider the expedited program’s security measures to be too strict and prescriptive, not providing facilities the flexibility of the standard process; and the lack of an authorization inspection may discourage some facilities from using the expedited program because this inspection provides useful information about a facility’s security. We also found in 2017 that recent changes made to the CFATS program could affect the future use of the expedited program. As discussed previously, DHS has revised its methodology for determining the level of each facility’s security risk, which could affect a facility’s eligibility to participate in the EAP. Inspecting Facilities and Ensuring Compliance In our July 2015 report, we found that DHS began conducting compliance inspections in September 2013, and by April 2015, had conducted inspections of 83 of the inspected 1,727 facilities that had approved security plans. Our analysis showed that nearly half of the facilities were not fully compliant with their approved site security plans and that DHS had not used its authority to issue penalties because DHS officials found it more productive to work with facilities to bring them into compliance. We also found that DHS did not have documented processes and procedures for managing the compliance of facilities that had not implemented planned measures by the deadlines outlined in their plans. We recommended that DHS document processes and procedures for managing compliance to provide more reasonable assurance that facilities implement planned measures and address security gaps. DHS agreed and has since taken steps toward implementing this recommendation. Specifically, DHS revised CFATS Standard Operating Procedures that, as of February 2019, we are reviewing to determine if they sufficiently document the processes and procedures currently being used to track noncompliant facilities and ensure facilities implement planned measures as outlined in their approved site security plans. In August 2018, we reported that our analysis of DHS data since our 2015 report showed that DHS has made substantial progress in conducting and completing compliance inspections. Specifically, our analysis showed that DHS increased the number of compliance inspections completed per year since DHS began conducting compliance inspections in 2013 and that, for the 2,466 high-risk facilities with an approved site security plan as of May 2018, DHS had conducted 3,553 compliance inspections. Of these, DHS issued corrective actions to two facilities that were not in compliance with their approved site security plan. In our August 2018 report, we also found that DHS developed a new methodology and performance measure for the CFATS program in order to evaluate security changes made by high-risk chemical facilities, but that the methodology does not measure the program’s impact on reducing a facility’s vulnerability to an attack. We found that DHS could take steps to evaluate vulnerability reduction resulting from the CFATS compliance inspection process. We recommended that DHS incorporate vulnerability into the new methodology to help measure the reduction in the vulnerability of high-risk facilities to a terrorist attack, and use that data in assessing the CFATS program’s performance in lowering risk and enhancing national security. DHS agreed and is taking steps to implement this recommendation. Specifically, in September 2018, DHS reported making progress towards the implementation of two new performance metrics by the end of the first quarter of fiscal year 2019. DHS officials stated that these metrics should, among other things, evaluate the progress of individual facilities in enhancing their security while part of the CFATS program and be used to demonstrate an increase in the security posture across the population of CFATS facilities. Conducting Stakeholder and First Responder Outreach In April 2013, we reported that DHS took various actions to work with facility owners and operators, including increasing the number of visits to facilities to discuss enhancing security plans, but that some trade associations had mixed views on the effectiveness of DHS’s outreach. We found that DHS solicited informal feedback from facility owners and operators in its efforts to communicate and work with them, but did not have an approach for obtaining systematic feedback on its outreach activities. We recommended that DHS take action to solicit and document feedback on facility outreach consistent with DHS efforts to develop a strategic communication plan. DHS agreed and has implemented this recommendation by developing a questionnaire to solicit feedback on outreach with industry stakeholders and began using the questionnaire in October 2016. In August 2018, we reported that DHS shares some CFATS information with first responders and emergency planners, but these stakeholders may not have all of the information they need to minimize the risk of injury or death when responding to incidents at high-risk facilities. While certain facilities are required under the Emergency Planning and Community Right-to-Know Act of 1986 to report some chemical inventory information, which local officials told us they rely on to prepare for and respond to incidents at chemical facilities, we found over 200 chemicals covered by CFATS that may not be covered by these reporting requirements. We also reported that DHS developed a secure interface called the Infrastructure Protection (IP) Gateway that provides access to CFATS facility-specific information that may be missing from required reporting. However, we found that the IP Gateway is not widely used at the local level and officials from 13 of 15 selected Local Emergency Planning Committees we contacted—consisting of first responders and covering 373 CFATS high-risk facilities—said they did not have access to CFATS data in the IP Gateway. We recommended that DHS should take actions to encourage access to and wider use of the IP Gateway and explore other opportunities to improve information-sharing with first responders and emergency planners. DHS concurred with this recommendation and reported in September 2018 that they are taking actions to implement it. Specifically, DHS has revised three fact sheets and an outreach presentation to include information on the IP Gateway and how to request access to it. In addition, DHS plans to ensure contact is made with first responders representing the top 25 percent of CFATS high-risk chemical facilities by no later than March 2019 so that they are properly prepared to respond to incidents at these facilities. Chairman Thompson, Ranking Member Rogers, and Members of the Committee, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time. GAO Contact and Staff Acknowledgements If you or your staff members have any questions about this testimony, please contact me at (202) 512-3841 or andersonn@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Other individuals making key contributions to this work include Ben Atwater, Assistant Director; Hugh Paquette, Analyst-in-Charge; Chuck Bausell, Michele Fejfar, Tracey King, and Tom Lombardi. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.


DHS Has Taken Steps to Improve Its Employee Engagement Scores but Still Falls below the Government-Wide Average In connection with the Strengthening DHS Management Functions high- risk area, we monitor DHS’s progress in the area of employee morale and engagement. In 2010, we identified, and DHS agreed, that achieving 30 specific outcomes would be critical to addressing the challenges within the department’s high-risk management areas. These 30 outcomes are the criteria by which we gauge DHS’s demonstrated progress. We rate each outcome on a scale of not-initiated, initiated, partially addressed, mostly addressed, or fully addressed. Several of these outcome criteria relate to human capital actions needed to improve employee morale. Specifically, we monitor DHS’s progress to: seek employees’ input on a periodic basis and demonstrate measurable progress in implementing strategies to adjust human capital approaches; base hiring decisions, management selections, promotions, and performance evaluations on human capital competencies and individual performance; enhance information technology security through improved workforce planning of the DHS cybersecurity workforce; and improve DHS’s FEVS scores related to employee engagement. Since we began monitoring DHS’s progress on these outcomes, DHS has worked to strengthen employee engagement through several efforts both at DHS headquarters and within its component agencies. In this statement, we discuss nine recommendations related to DHS employee engagement and workforce planning, eight of which have been implemented by the department. Within DHS, the Office of the Chief Human Capital Officer (OCHCO) is responsible for implementing policies and programs to recruit, hire, train, and retain DHS’s workforce. As the department-wide unit responsible for human capital issues within DHS, OCHCO also provides guidance and oversight related to morale issues to the DHS components. Seeking employees’ input and demonstrating progress to adjust human capital approaches. DHS, OCHCO, and the components have taken action to use employees’ input from the FEVS to inform and implement initiatives targeted at improving employee engagement. For example, in 2017 and 2018 DHS implemented our two recommendations for OCHCO and DHS components to establish metrics of success within their action plans for addressing employee satisfaction problems and to better use these plans to examine the root causes of morale challenges. DHS components have continued to develop these employee engagement action plans and several components report implementing initiatives to enhance employee engagement. For example, the U.S. Secret Service’s action plan details a sponsorship program for all newly hired and recently relocated employees. In addition, one division of U.S. Immigration and Customs Enforcement (ICE) used FEVS survey data to identify a need for increased engagement between employees and component leadership. ICE’s employee action plan includes goals with milestones, timelines, and metrics to improve this engagement through efforts such as leadership town halls and leadership site visits. At the headquarters level, DHS and OCHCO have also established employee engagement initiatives across the department. For example, DHS established initiatives for employees and their families that aim to increase awareness and access to support programs, benefits, and resources. Through another initiative—Human Resources (H.R.) Academy—DHS provides education, training, and career development opportunities to human resource professionals within the department. DHS uses an Employee Engagement Steering Committee to guide and monitor implementation of these DHS-wide employee engagement initiatives. As a result of these steps, among other actions, we have considered this human capital outcome area fully addressed since 2018. Basing hiring decisions and promotions on competencies and performance. OCHCO has conducted audits to better ensure components are basing hiring decisions and promotions on human capital competencies and individual performance and we have considered this outcome fully addressed since 2017. Our past work has highlighted the importance of selecting candidates based on qualifications, as doing otherwise can negatively affect morale. Working to ensure that components’ human capital decisions are based on performance and established competencies helps create a connection between individual performance and the agency’s success. Enhancing information technology security through improved workforce planning for cybersecurity positions. In February 2018, we made six recommendations to DHS to take steps to identify its position and critical skill requirements among its cybersecurity workforce. Since then, DHS has implemented all six recommendations. For example, in fiscal year 2019, regarding its cybersecurity position identification and coding efforts, we verified that DHS had identified individuals in each component who are responsible for leading those efforts, developed procedures, established a process to review each component’s procedures, and developed plans for reporting critical needs. However, DHS has not yet implemented a recommendation we made in March 2019 to review and correct its coding of cybersecurity positions and assess the accuracy of position descriptions. Specifically, we stated that DHS had not correctly categorized its information technology/cybersecurity/cyber-related positions. We noted that having inaccurate information about the type of work performed by 28 percent of the department’s information technology/cybersecurity/cyber-related positions is a significant impediment to effectively examining the department’s cybersecurity workforce, identifying work roles of critical need, and improving workforce planning. DHS officials stated that they plan to implement this recommendation by March 2020. As a result, this outcome remains mostly addressed. Until DHS accurately categorizes its positions, its ability to effectively identify critical staffing needs will be impaired. Improving FEVS scores on employee engagement. Since our last High-Risk report in March 2019, DHS has demonstrated additional progress in its employee engagement scores, as measured by the FEVS Employee Engagement Index (EEI). The EEI is one of three indices OPM calculates to synthesize FEVS data. The EEI measures conditions that lead to engaged employees and is comprised of three sub-indices related to employees’ views on leadership, supervisors, and intrinsic work experience. As a result of continued improvement on DHS’s EEI score, we have moved this outcome rating from partially addressed to mostly addressed based on DHS’s 2019 score. As shown in figure 1, DHS increased its EEI score across 4 consecutive years, from a low of 53 percent in 2015 to 62 percent in 2019. In particular, DHS improved its score by two points between 2018 and 2019 while the government average remained constant over the same period. With its 2019 score, DHS also regained the ground that it lost during an 8-point drop between 2010 and 2015. While DHS has made progress in improving its scores including moving toward the government average, it remains below the government average on the EEI and on other measures of employee morale. For example, in 2019 DHS remained six points below the government-wide average for the EEI. In addition to the EEI and other indices OPM calculates, the Partnership for Public Service uses FEVS data to produce an index of the Best Places to Work in the Federal Government®. The Partnership for Public Service’s analysis of FEVS data indicates low levels of employee satisfaction and commitment for DHS employees relative to other large federal agencies. In 2019, the Partnership for Public Service ranked DHS 17th out of 17 large federal agencies for employee satisfaction and commitment. Across the department, employee satisfaction scores vary by component. Some DHS components have EEI scores above the government average and rank highly on the Partnership for Public Service’s index. For example, the U.S. Coast Guard and U.S. Citizenship and Immigration Services have EEI scores of 76 and 74, respectively, and rank 85th and 90th, respectively, out of 420 subcomponent agencies on the Partnership for Public Service’s index. Further, some DHS component agencies have improved their scores in recent years. The U.S. Secret Service raised its EEI score 7 points between 2018 and 2019, and it moved from the last place among all subcomponent agencies on the Partnership for Public Service’s Ranking in 2016 to 360th out of 420 subcomponent agencies in 2019. However, other DHS component agencies continue to rank among the lowest across the federal government in the Partnership for Public Service rankings of employee satisfaction and commitment. For example, in 2019 out of 420 subcomponent agencies across the federal government, the DHS Countering Weapons of Mass Destruction office ranked 420th, the DHS Office of Intelligence and Analysis ranked 406th, and the Transportation Security Administration ranked 398th for employee satisfaction and commitment. As a result, continuing to increase employee engagement and morale remains important to strengthening DHS’s management functions and ability to implement its missions. DHS employee concerns about senior leadership, among other things, is one area that negatively affects DHS’s overall employee morale scores. In 2015, we identified effective management practices agencies can use to improve employee engagement across the government. One of these practices is the direct involvement of top leadership in organizational improvement efforts. When top leadership clearly and personally leads organizational improvement efforts, it provides an identifiable source for employees to rally around and helps processes stay on course. A DHS analysis of its 2012 FEVS scores indicated DHS low morale issues may persist because of employee concerns about senior leadership and supervisors, among other things, such as whether their talents were being well-used. Within the 2019 FEVS results for both DHS and government wide, leadership remains the lowest of the three sub-indices of the EEI. In addition, for several years DHS components have identified several root causes of engagement scores. For example, in 2019, the Transportation Security Administration identified the performance of managers, time constraints and understaffing, and lack of manager and leadership accountability for change as root causes of the component’s engagement scores in recent years. Another component, U.S. Citizenship and Immigration Services, identified in 2019 that the areas of leadership performance, accountability, transparency, and training and development opportunities were 2018 engagement score root causes. We have previously reported that DHS’s top leadership, including the Secretary and Deputy Secretary, have demonstrated commitment and support for addressing the department’s management challenges. Continuing to identify and address the root causes of employee engagement scores and addressing the human capital management challenges we have identified in relation to the DHS management high- risk area could help DHS maintain progress in improving employee morale. Implementing our recommendation to review and correct DHS coding of cybersecurity positions and assess the accuracy of position descriptions will assist the department in identifying critical staffing needs. In addition, as we reported in May 2019, vacancies in top leadership positions could pose a challenge to addressing aspects of DHS’s high- risk area, such as employee morale. There are currently acting officials serving in ten positions requiring Senate confirmation. Filling vacancies—including top DHS leadership positions and the heads of operational components—with confirmed appointees, as applicable, could help ensure continued leadership commitment across DHS’s mission areas. We will continue to monitor DHS’s progress in strengthening management functions, and may identify additional actions DHS leadership could take to improve employee morale and engagement. In conclusion, DHS has made notable progress in the area of human capital management, specifically in improving employee engagement and morale, but still falls behind other federal agencies. It is essential for DHS to continue improving employee morale and engagement given their impact on agency performance and the importance of DHS’s missions. Continued senior leadership commitment to employee engagement efforts and filling critical vacancies could assist DHS in these efforts. Madam Chairwoman Torres Small, Ranking Member Crenshaw, and Members of the Subcommittee, this completes my prepared statement, I would be happy to respond to any questions that you may have at this time. GAO Contact and Staff Acknowledgments If you or your staff have any questions concerning this statement, please contact Christopher P. Currie at (404) 679-1875 or curriec@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Key contributors to this statement were Alana Finley (Assistant Director), Mara McMillen (Analyst-in-Charge), Nina Daoud, Michele Fejfar, Andrew Howard, and Tom Lombardi. In addition, Colette Alexander, Richard Cederholm, Ben Crossley, Eric Essig, Laura Ann Holland, Tammi Kalugdan, Neelaxi Lakhmani, Shannin O’Neill, Kevin Reeves, John Sawyer, and Julia Vieweg made contributions to this statement. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.


DHS Uses Multiple Information Sources to Identify Potential EEO Barriers DHS generally uses the information sources that EEOC guidance recommends to help identify potential barriers. As directed by EEOC guidance, DHS analyzes its workforce data to help identify triggers or indicators of potential EEO barriers by comparing the racial, national origin, gender, and disability profiles of its total workforce, and for various occupational categories to relevant civilian labor workforce data. In addition to analyzing workforce data, in each of the fiscal years 2014 through 2017, DHS utilized the U.S. Office of Personnel Management’s Federal Employee Viewpoint Survey and DHS’s employee exit survey results to help identify and address barriers. To further help identify barriers, EEOC guidance states that agencies must solicit input from agency employee and advocacy groups, and union officials. During our small group discussions, DHS employee groups told us that through the MD-715 report development process, they helped identify and address triggers and barriers. For example, Special Emphasis Program Managers we spoke with told us that DHS components conduct climate surveys to obtain input from employees on workforce practices every 1 or 2 years. Further, several DHS components’ MD-715 reports referenced soliciting employee input, such as obtaining Disability Employment Program Managers’ input via quarterly disability employment advisory council meetings where they share best practices and discuss issues and topics including barriers. DHS Reports Some Improvements in Employee Engagement and Representation of Minorities and Women, but Lacks Performance Metrics for Tracking Progress DHS reports some improvements in employee engagement and representation of minorities and women. DHS’s employee engagement scores in the Federal Employee Viewpoint Survey increased from 54 percent in 2014 to 62 percent in 2019. In addition, our review of DHS’s workforce data from fiscal years 2014 through 2017 showed that every minority group as well as individuals with disabilities and individuals with targeted disabilities had been trending in a positive direction since fiscal year 2014. Further, DHS officials told us that minority representation was up 3 percent and female representation was up 2 percent from 2015 to February 2019. According to EEOC, one important tool in examining the fairness and inclusiveness of an agency’s recruitment efforts is applicant flow data. EEOC guidance states that having department-wide applicant flow data could aid in analyzing differences in selection rates among different groups for a particular job. In July 2017, EEOC informed DHS that the agency’s applicant flow data were incomplete, which makes it difficult to pinpoint barriers. DHS has reported challenges in collecting department- wide data because the department does not have a consolidated applicant flow data system. According to DHS, four of its components use one system (USA Staffing), while five other components use a different system (Monster Government Solutions). CRCL officials told us that DHS is developing a new system to integrate applicant flow data department-wide. However, the officials could not give us a time frame for when the system is expected to be completed. In its fiscal year 2018 MD-715 report, DHS reported that it continues to work towards developing a central repository for all applicant flow data. As a work-around, DHS officials said that it obtains these data directly from each component that uses Monster Government Solutions. In its fiscal year 2018 MD-715 report, DHS reported that it used applicant flow data to complete analyses, but it also reported a number of limitations, including that data were not available. In February 2020, CRCL officials told us that they plan to report complete applicant flow data in DHS’s fiscal year 2019 MD-715 report. DHS does not have complete performance metrics or mechanisms for tracking progress towards eliminating its identified EEO barriers, such as workplace satisfaction of white females or the retention rate of women in law enforcement positions. According to CRCL officials, they are not required to establish performance metrics or mechanisms for tracking progress towards eliminating barriers beyond what is included in the department-wide MD-715 report. However, Standards for Internal Control in the Federal Government states that management should establish specific and measureable objectives, and ways to assess progress including performance metrics and milestones. Further, EEOC guidance states that agencies are not prevented from establishing additional practices that exceed its requirements. Implementing performance metrics could help DHS assess its progress in eliminating EEO barriers. Accordingly, our July 2019 report included a recommendation that the Secretary of Homeland Security should develop performance metrics for the department’s EEO program including a mechanism for tracking progress towards eliminating barriers. DHS concurred with the recommendation and stated that it would implement it by April 30, 2020. In February 2020, CRCL officials told us they are working with DHS’s Management Directorate to develop a potential overarching performance metric that, if approved, would be implemented beginning in fiscal year 2021. DHS and Its Components Have Identified Various Deficiencies in Their EEO Programs, but in Some Cases Lack Action Plans to Address Them Our analysis of DHS’s MD-715 reports found that the department-wide EEO program did not meet about a quarter of the compliance measures for a model EEO program for each fiscal year from 2014 through 2017. For example, in each of the fiscal years 2015 through 2018, DHS reported that senior managers at DHS components did not successfully implement EEO action plans and incorporate EEO action plan objectives into agency strategic plans. In addition, our analysis of components’ MD- 715 reports showed that component EEO programs did not meet 9 percent of the compliance measures for a model EEO program from fiscal years 2014 through 2017. DHS components did not have action plans to address nearly half (179 out of 369) of the deficiencies self-reported by all components from fiscal years 2014 through 2017. For example, in fiscal year 2017, four DHS components did not have action plans to ensure that their EEO directors report directly to their agency heads. EEOC guidance requires that for each deficient measure, agencies are to develop an action plan for correcting the deficiency. CRCL officials told us that DHS and its components’ MD-715 reports met EEOC requirements for action plans for fiscal years 2014 through 2017 by providing explanations for, or briefly stating plans to address, the majority of their deficiencies rather than developing action plans identifying how each deficiency would be addressed. Developing policies and procedures to help ensure components’ EEO programs have action plans for addressing deficiencies could help DHS components better comply with EEOC requirements. DHS and its components lack adequate staffing to address EEO program deficiencies, in part, because CRCL and component EEO officials told us that they do not have formal staffing models to assess appropriate staffing of their EEO program sections. CRCL officials said that each component EEO program section is unique with its own assessments and measures by the leaders in charge of their funding and staffing resources. However, EEOC MD-715 guidance states that an agency must provide its EEO program with sufficient budget and staffing to be able to successfully implement various activities. Developing and utilizing formal staffing models—a tool to determine the number of staff required—for their EEO programs could help DHS and its components to identify, request, and obtain the staff they need. Thus, in our recently issued report, we recommended that (1) DHS component EEO Directors, in consultation with the Deputy Officer for EEO and Diversity, should develop policies and procedures to help ensure that their component EEO programs have action plans for addressing deficiencies in their MD-715 reports, and (2) the Deputy Officer for EEO and Diversity should develop a formal staffing model for its EEO program. DHS concurred with the recommendations and stated that it would implement them by April 30, 2020. In February 2020, CRCL officials told us that they are developing policies and procedures for components to consider. They also told us that they are collaborating with the DHS Management Directorate to develop a formal staffing model for DHS’s department-wide EEO program. In addition, we recommended that DHS component EEO Directors, in collaboration with the Deputy Officer for EEO and Diversity, develop component formal staffing models. DHS concurred with the recommendation and stated that it would implement it by July 31, 2020. In February 2020, CRCL officials told us that the DHS Management Directorate plans to work with components to develop formal staffing models for their individual EEO programs after the agency develops a formal staffing model for the department-wide EEO program. DHS Has Plans to Address the Nine Areas of EEOC Identified Noncompliance DHS has plans to address the nine areas of noncompliance in its EEO program identified by EEOC. For example, in its July 2017 review of DHS compliance with EEOC requirements, EEOC identified that DHS did not provide complete demographic data on new hires and promotions in its fiscal year 2016 report to EEOC. In April 2019, DHS officials told us that the department plans to report the data by collecting complete data from DHS components in fiscal year 2019. In its fiscal year 2018 MD-715 report, which DHS sent to EEOC in July 2019, DHS stated that it had collected and analyzed demographic data on new hires and promotions. DHS’s EEO and Human Capital Offices Use a Variety of Means to Oversee and Support Components in Identifying and Addressing EEO Barriers, but Need to Strengthen Oversight Efforts DHS’s EEO and human capital offices assist and support DHS components in identifying and addressing EEO barriers. For example, CRCL meets with each component to obtain updates on their EEO efforts and provide verbal feedback as they develop their MD-715 reports. DHS components told us that they are generally satisfied with CRCL’s collaboration practices to identify and address EEO barriers. For example, all nine components required to submit MD-715 reports told us that CRCL regularly meets with them and provides guidance on identifying and addressing barriers. From fiscal years 2014 through 2017, EEOC found areas of noncompliance in DHS and its components’ EEO programs. We found that DHS components had not responded timely and completely to areas of noncompliance identified in EEOC feedback letters. According to CRCL officials, CRCL does not have policies and procedures to ensure that components have addressed EEOC’s feedback letters in a complete and timely manner. However, EEOC MD-715 guidance states that an agency’s EEO Director ultimately is responsible for ensuring equal opportunity throughout the entire agency. In addition, Standards for Internal Control in the Federal Government states that management should implement control activities through policies. Developing policies and procedures for responding completely and timely to EEOC’s feedback letters may help the department comply with EEOC guidance. CRCL officials said they lack authority to ensure components’ compliance with EEOC requirements. Standards for Internal Control in the Federal Government states that an effective management practice includes periodically evaluating the agency’s organizational structure to ensure that it meets its objectives. DHS has not taken steps—in consultation with EEOC and other agencies as relevant—to analyze options to address EEO program management weaknesses. Specifically, it has not analyzed alternatives for granting additional authorities to the Deputy Officer for EEO and Diversity to ensure DHS components comply with MD-715 guidance, or assessed benefits and trade-offs of each alternative. Without addressing these issues, DHS may not be effectively positioned to manage its EEO program. In our report, we recommended that the (1) Deputy Officer for EEO and Diversity develop policies and procedures for responding in a complete and timely manner to EEOC’s feedback letters, and (2) the Secretary of Homeland Security—in consultation with CRCL and EEOC, and other agencies and components, as relevant—analyze options for granting additional authorities to the Deputy Officer for EEO and Diversity to ensure DHS components comply with MD-715 guidance, including the authority of the Deputy Officer for EEO and Diversity to certify components’ MD-715 reports. DHS concurred with the recommendations and stated that it plans to implement them by April 30, 2020. In February 2020, CRCL officials told us they are developing policies and procedures for responding in a complete and timely manner to EEOC’s feedback letters. They also told us that a cross-component working group, with input from EEOC subject- matter experts, is developing a report benchmarking best practices at similar federal agencies that it expects to complete by the end of March 2020. In conclusion, as the third largest U.S. government department, the challenges DHS has faced to fully implement effective EEO programs may result in widespread negative consequences such as (1) monetary expenses borne by the agency in connection with workplace disputes and (2) decreased morale and productivity resulting from ineffective and inefficient use of human capital resources. We found areas for improvement in DHS and its components’ EEO programs that could help ensure success and compliance with MD-715. The commitment of DHS’s leadership is essential to successfully addressing these issues. By focusing leadership attention on developing performance metrics, policies and procedures, and staffing models, DHS and its components can help improve their EEO programs by making progress towards eliminating barriers, obtaining sufficient staffing, and addressing areas of noncompliance. Madam Chairwoman Torres Small, Ranking Member Crenshaw, and Members of the Subcommittee, this completes my prepared statement. I would be pleased to respond to any questions you may have at this time. GAO Contacts and Staff Acknowledgments If you or your staff have any questions about this testimony, please contact Yvonne D. Jones at (202) 512-6806 or jonesy@gao.gov, or Christopher P. Currie at (404) 679-1875 or curriec@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals making key contributions to this testimony include Clifton G. Douglas, Jr. (Assistant Director), Luis E. Rodriguez (Analyst-in-Charge), Andrew Howard, Kate Lenane, Steven Putansu, and Rachel Whitaker. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.


DOD Faces Substantial Supply Chain Challenges First, DOD is facing substantial supply chain challenges that are hindering the readiness of the F-35 fleet. Specifically, spare parts shortages throughout the F-35 supply chain are contributing to F-35 aircraft being unable to perform as many missions or to fly as often as the warfighter requires. The F-35’s unique supply chain is central to DOD’s strategy to sustain the growing fleet. Rather than owning the spare parts for their aircraft, the Air Force, Navy, and Marine Corps, along with international partners and foreign military sales customers, share a common, global pool of parts. This construct for the F-35 supply chain was intended to ease the logistical burden and provide economies of scale for the military services and international partners; however, the global pool does not have enough spare parts. Specifically, from May through November 2018, F-35 aircraft across the fleet were unable to fly about 30 percent of the time due to parts shortages, as compared with a program target of 10 percent. Below is pictured an F-35B aircraft conducting training aboard a ship. Our work found that several factors contribute to these parts shortages, including F-35 parts that are breaking more often than expected, and DOD’s limited capability to repair parts when they break. Specifically, as of April 2019, the F-35 program was failing to meet four of its eight reliability and maintainability targets—which determine the likelihood that the aircraft will be in maintenance rather than available for operations— including metrics related to part removals and part failures. For instance, we reported at that time that the special coating on the F-35 canopy that enables the aircraft to maintain its stealth had failed more frequently than expected, and the manufacturer was unable to produce enough canopies to meet demands. These reliability challenges are exacerbated by DOD’s limited capability to repair broken parts at the military depots. The capabilities to repair parts are currently 8 years behind schedule. DOD originally planned to have repair capabilities at the depots ready by 2016, but as we reported in April 2019, the depots will not have the capability to repair all parts at expected demand rates until 2024. As a result, the average time taken to repair an F-35 part was more than 6 months, or about 188 days, for repairs completed between September and November 2018—more than twice as long as planned. At that time, there was a backlog of about 4,300 spare parts awaiting repair at depots or manufacturers. We have also reported on other challenges that DOD faces related to its supply chain, including challenges in supporting deployed F-35 aircraft around the world, in clarifying how scarce parts will be distributed, in establishing a plan for a global supply chain network, and in maintaining accountability for spare parts. Figure 2 depicts many of these and other challenges that DOD faces related to the F-35 supply chain. DOD has not fully implemented seven of our recommendations related to its supply chain challenges: Revise sustainment plans: In October 2017, we reported that DOD’s reactive approach to planning for and funding the capabilities needed to sustain the F-35 resulted in significant readiness challenges— including delays in the establishment of part repair capabilities at the depots—and placed DOD at risk of being unable to leverage the capabilities of the aircraft it had purchased. We recommended that DOD revise its sustainment plans to ensure that they include the key requirements and funding needed to fully implement the F-35 sustainment strategy. Conduct a comprehensive review of the F-35 supply chain: While DOD had ongoing efforts to increase the availability of spare parts, we found in April 2019 that DOD would likely continue to face challenges because the program was not planning for the quantity of parts necessary in its spare parts projections to meet warfighter requirements. Simply purchasing more F-35 parts may not be a viable solution for DOD, given the affordability concerns the program faces. These complex problems necessitate a comprehensive approach by DOD, or it is at risk that the F-35 will not be able to conduct the full range of intended missions. We recommended that DOD conduct a comprehensive review of the F-35 supply chain to determine what additional actions are needed to close the gap between warfighter requirements for aircraft performance and the capabilities that the F- 35 supply chain can deliver, in light of the U.S. services’ affordability constraints. Develop a process to modify the afloat and deployment spare parts packages: DOD purchases certain packages of F-35 parts years in advance to support aircraft on deployments, including on ships—called afloat and deployment spare parts packages. In April 2019, we reported that continued modifications to parts and aircraft can make such packages out-of-date by the time F-35 units deploy, and that the F-35 program did not have a process and funding in place to change out mismatched parts. This could put the military services at risk of not having the parts they need to support future deployments. We recommended that DOD develop a process to modify afloat and deployment spare parts packages, to include reviewing the parts within the packages to ensure that they match deploying aircraft and account for updated parts demand, and aligning any necessary funding needed for the parts updates. Mitigate risks related to operating and sustaining the F-35 in the Pacific: In March 2018, we issued a classified report on DOD’s initial transfer of F-35s to a Marine Corps base in Japan that, among other things, described the warfighting capabilities the F-35 brought to the Pacific and assessed operational challenges the Marine Corps faced. In April 2018, we publicly reported on the recommendations from this classified report, including our recommendation that the Marine Corps assess the risks associated with key supply chain-related challenges related to operating and sustaining the F-35 in the Pacific, and that it determine how to address those risks. Revise the business rules for prioritizing scarce F-35 parts: In April 2019, we reported that there was uncertainty about how the program will prioritize scarce F-35 parts among global participants. While the F-35 program had developed a set of business rules, those rules lacked clarity and detail. Absent comprehensive business rules, the F-35 program could face challenges in transparently allocating parts to support competing U.S. and international requirements. We recommended that DOD revise the business rules for the prioritization of scarce F-35 parts across all program participants so as to clearly define the roles and responsibilities of all stakeholders, the process for assigning force activity designations, and the way in which deviations from the business rules will be conducted. Complete a detailed plan for the establishment of the global network for moving F-35 parts: In April 2019, we reported that DOD’s networks to move F-35 parts around the world to the United States and international participants were immature. Because the F- 35 program did not fully recognize the complexity of establishing a global network for moving F-35 parts, this network is now several years behind schedule and there is risk that it will not be fully capable to support an expanding fleet. We recommended that DOD complete a detailed plan for the establishment of the global network for moving F-35 parts that outlines clear requirements and milestones to reach full operational capability, and that includes mechanisms to identify and mitigate risks to the F-35 global spares pool. Clearly establish how DOD will maintain accountability for F-35 parts: In April 2019, we reported that in its rush to field aircraft and its heavy reliance on the prime contractor, DOD had not consistently followed DOD guidance for property accountability. Simply put, DOD did not have records of all the F-35 spare parts it had purchased; where those parts were located; and how much the military services had paid for them. We recommended that DOD issue a policy consistent with DOD guidance that clearly establishes how DOD will maintain accountability for F-35 parts within the supply chain, and identify the steps needed to implement the policy retrospectively and prospectively. DOD concurred with these recommendations and has made some progress in addressing them, including issuing a revised life cycle sustainment plan in January 2019. In addition, DOD has taken actions to increase the availability of spare parts, such as efforts to improve the reliability of parts and incentivize manufacturers to repair parts. Autonomic Logistics Information System Remains Immature Second, DOD continues to face challenges with the F-35’s Autonomic Logistics Information System (ALIS). ALIS is a complex information technology system supporting operations, mission planning, supply-chain management, maintenance, and other processes. It is intended to provide the necessary logistics tools to F-35 users as they operate and sustain the aircraft. For supply chain management, for example, ALIS is supposed to automate a range of supply functions—including updating the status of parts, generating supply work orders, and communicating critical data about parts. However, we reported in April 2019 that these capabilities were immature, resulting in numerous challenges and the need for maintainers and supply personnel at military installations to perform time-consuming, manual workarounds in order to manage and track parts. We reported that one Air Force unit estimated that it spent the equivalent of more than 45,000 hours per year performing additional tasks and manual workarounds because ALIS was not functioning as needed. In our prior work we identified several challenges associated with ALIS, including the following examples (see table 1). We have made six recommendations since 2014 to help DOD address ALIS-related challenges. DOD generally concurred with these recommendations. It addressed two by developing a plan that prioritizes ALIS risks and creating a training plan for ALIS. However, DOD has not taken action on four of our recommendations. These are: Establish a performance-measurement process: In September 2014, we reported that ALIS had experienced recurring problems, including user issues and schedule delays, and was a risk that could adversely affect DOD’s sustainment strategy. But we found that DOD did not have a process to determine and address the most significant performance issues with ALIS based on user requirements, which could limit its ability to effectively and efficiently address performance issues and identify root causes of those issues. We recommended that DOD establish a performance-measurement process for ALIS that includes, but is not limited to, performance metrics and targets that (1) are based on intended behavior of the system in actual operations and (2) tie system performance to user requirements. Incorporate cost-estimating best practices: In April 2016, we reported that DOD’s $16.7 billion life cycle cost estimate for ALIS was not fully credible since DOD had not performed key analyses as part of the cost-estimating process. We recommended that DOD conduct uncertainty and sensitivity analyses consistent with cost-estimating best practices. Ensure that future cost estimates use historical data: In April 2016, we also reported that DOD’s ALIS cost estimate was not fully accurate because DOD did not use historical cost data, including actual cost data from ALIS and data from other comparable programs. We recommended that DOD ensure that future estimates of ALIS costs use historical data as available and reflect significant program changes consistent with cost-estimating best practices. Test the operation of the F-35 when disconnected from ALIS: In March 2018, we issued a classified report on DOD’s initial transfer of F-35s to a Marine Corps base in Japan that, among other things, described the warfighting capabilities the F-35 brought to the Pacific and assessed any operational challenges the Marine Corps faced. In April 2018, we publicly reported on the recommendations from this classified report, including our recommendation that the F-35 program test operating the F-35 disconnected from ALIS for extended periods of time in a variety of scenarios, to assess the risks related to operating and sustaining the aircraft, and determine how to mitigate any identified risks. We are currently conducting a review of ALIS, assessing how DOD is managing current and future issues related to the system. We plan to complete this review in early 2020. DOD Lacks Critical Information to Effectively Plan for Long-term F-35 Sustainment Third, at the core, DOD’s current sustainment challenges have largely resulted from insufficient planning. We have found that DOD lacks information about the technical characteristics and costs of the F-35, which will impair its ability to plan for the long-term sustainment of the F- 35 fleet. The current F-35 sustainment strategy states that the primary contractor will provide logistics support for the aircraft. In October 2017, we reported that while DOD planned to enter into 5-year, fixed-price, performance-based contracts with the prime contractor in the next few years, DOD did not have full information on F-35 technical characteristics or costs to enable it to effectively negotiate those contracts. Specifically, certain technical aspects of the aircraft remained immature or uncertain, including reliability measures that are lagging behind operational requirements. As previously discussed, in April 2019 we reported that the F-35 program was still not on track to meet its targets for four out of eight reliability and maintainability metrics, and that the program had not taken adequate steps to ensure that those targets would be met. DOD officials told us that there would be inherent risk in signing a long-term, performance-based contract before reliability and maintainability data were more fully known, as those data would influence how much aircraft performance should cost. In addition, DOD did not have full visibility into the actual costs of some key sustainment requirements that are considered cost-drivers within the program, such as the actual costs of parts and repairs. Thus, DOD had relied on projected parts reliability and pricing to formulate cost estimates. Actual costs of sustainment requirements can change significantly from initial projections. For instance, we reported that, between the program’s 2014 and its 2015 estimates, the costs of initial spare parts over the life cycle increased by $447 million. The lack of cost information continues to be a challenge for DOD, as we reported in April 2019. DOD officials have stated that they need to know actual costs in order to improve both their confidence in the estimates and their understanding of how cost is related to performance. Below is pictured an F-35A aircraft being refueled. Further, DOD lacks the technical data from the prime contractor needed to fully understand the technical characteristics of the F-35 aircraft and enable potential competition of future sustainment contracts. Technical data include the blueprints, drawings, photographs, plans, instructions, and other documentation required to adequately produce, operate, and sustain weapon systems. Technical data are critical for weapon systems such as F-35 aircraft, as they provide DOD with the information necessary to support the fleet. In April 2019, we found that challenges related to readiness and costs were driving DOD to begin to develop an option for DOD-led supply chain management as a potential alternative to the performance-based contracts through which the prime contractor would provide logistics support. The DOD-led option would require the department to obtain significant amounts of technical data on F-35 parts from the manufacturers of those parts; however, at that time DOD was facing challenges in obtaining the needed data. DOD has not fully implemented 10 of our recommendations related to these issues: Develop a long-term Intellectual Property strategy: In September 2014, we reported that DOD had not identified all of the technical data it needs from the contractor, and at what cost, to enable competition of future sustainment contracts, which put the program at risk of not having the flexibility to make changes to its sustainment strategy. We recommended that DOD develop a long-term Intellectual Property strategy to include, but not be limited to, the identification of current levels of technical data rights ownership by the federal government and all critical technical data needs and their associated costs. Assess whether the program reliability and maintainability targets are still feasible: In April 2019, we reported that the F-35 program continued to fall short of meeting performance targets for half of its reliability and maintainability metrics. Program officials said that those targets need to be reevaluated to determine more realistic performance targets, but they had not taken action to do so. We recommended that DOD assess whether the program’s reliability and maintainability targets are still feasible, and revise accordingly. Identify specific and measurable reliability and maintainability objectives: In April 2019, we reported that the F-35 program’s plan for improving reliability and maintainability did not address the four under-performing metrics. Specifically, the guidance the program has used to implement this plan does not define specific, measurable objectives for what the desired goals for F-35 reliability and maintainability performance should be. As long as these metrics continue to fall short, the military services may have to settle for aircraft that are less reliable and more costly to maintain than originally planned. We recommended that DOD identify specific and measurable reliability and maintainability objectives in its guidance. Link reliability and maintainability improvement projects to the associated objectives: In April 2019, we reported that the F-35 program had not aligned its planned reliability and maintainability improvement projects with reliability and maintainability goals, which could put the program at risk of not meeting those goals. We recommended that DOD identify and document in guidance which reliability and maintainability improvement projects will achieve the identified objectives. Prioritize funding for reliability and maintainability improvement: In April 2019, we reported that the F-35 program office had estimated potential life-cycle cost savings of more than $9.2 billion from implementing the reliability and maintainability improvement projects in its plan, but had not prioritized or dedicated funding in its budget necessary to carry out the projects. As a result, projects had been prematurely suspended or delayed. We recommended that the F-35 program office prioritize funding for the reliability and maintainability improvement plan. Re-examine the metrics DOD will use to hold the contractor accountable: In October 2017, we reported that DOD might not be using the appropriate performance metrics under trial performance- based agreements to achieve desired outcomes or hold the contractor accountable for performance. We recommended that DOD re- examine the metrics that it will use to hold the contractor accountable under the fixed-price, performance-based contracts, to ensure that such metrics are objectively measurable, are fully reflective of processes over which the contractor has control, and drive desired behaviors by all stakeholders. Delay entering into multi-year, fixed-price, performance-based contracts: In October 2017, we reported that DOD was moving quickly toward negotiating longer-term performance-based contracts without a sufficient understanding of the actual costs and technical characteristics of the aircraft, which put DOD at risk of overpaying for sustainment support that is not sufficient to meet warfighter requirements. We recommended that, before DOD enters into multi- year, fixed-price, performance-based contracts, it ensure that it has sufficient knowledge of the actual costs of sustainment and technical characteristics of the aircraft at system maturity. Obtain comprehensive cost information for F-35 spare parts: In April 2019, we reported that DOD did not have comprehensive cost information for individual F-35 spare parts, and that it faced challenges in obtaining this information from the prime contractor. This lack of cost information impedes DOD’s ability to develop a complete understanding of the costs for the F-35 system and to effectively negotiate with the prime contractor for sustainment support. We recommended that DOD develop a methodical approach to consistently obtain comprehensive cost information from the prime contractor for F-35 spare parts within the supply chain. Formalize a methodology for recording military service funds spent on F-35 parts: In April 2019, we reported that the military services could not track the funds that they had spent for the purchase of F-35 spare parts to the actual parts on their financial statements, thereby hindering DOD’s financial improvement and audit readiness efforts. We recommended that DOD complete and formalize a methodology for the U.S. services to use in recording on their financial statements the funds spent on F-35 parts within the global spares pool. Clearly define the F-35 supply chain management strategy: In April 2019, we reported that DOD was caught between two distinct sustainment concepts—the program’s official contractor-provided logistics support construct and DOD’s effort to develop options for DOD-led supply chain management. Until DOD clearly defines its strategy for managing the F-35 supply chain in the future, the F-35 program will lack the certainty and unity of effort necessary to meaningfully improve supply chain performance and reduce costs. We recommended that DOD clearly define the strategy by which it will manage the F-35 supply chain in the future and update key strategy documents accordingly, to include any additional actions and investments necessary to support that strategy. DOD concurred with all of these recommendations. Seven of the preceding recommendations were made earlier this year, and we recognize that it will take time for DOD to implement them. However, DOD’s attention to each of these recommendations is important to improving its long-term sustainment planning. In summary, DOD’s costs to purchase the F-35 are expected to exceed $406 billion, and the department expects to spend more than $1 trillion to sustain its F-35 fleet. Thus, DOD must continue to grapple with affordability as it takes actions to increase the readiness of the F-35 fleet and improve its sustainment efforts to deliver an aircraft that the military services and partner nations can successfully operate and maintain over the long term within their budgetary realities. DOD’s continued attention to our recommendations will be important as it balances these goals. We will continue to monitor DOD’s efforts to implement our recommendations. Chairmen Garamendi and Norcross, Ranking Members Lamborn and Hartzler, and Members of the Subcommittees, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time. GAO Contact and Staff Acknowledgments If you or your staff have questions about this testimony, please contact Diana Maurer, Director, Defense Capabilities and Management, at (202) 512-9627 or maurerd@gao.gov. Contact points for our offices of Congressional Relations and Public Affairs may be found on the last page of this statement. GAO staff who made key contributions to this testimony are Alissa Czyz and Kasea Hamar (Assistant Directors); Jon Ludwigson, Vincent Buquicchio, Tracy Burney, Desiree Cunningham, Jeff Hubbard, Justin Jaynes, Amie Lesser, Sean Manzano, Jillena Roberts, Michael Silver, Maria Staunton, Tristan T. To, Cheryl Weissman, and Elisa Yoshiara. Related GAO Products F-35 Joint Strike Fighter: Action Needed to Improve Reliability and Prepare for Modernization Efforts. GAO-19-341. Washington, D.C.: April 29, 2019. F-35 Aircraft Sustainment: DOD Needs to Address Substantial Supply Chain Challenges. GAO-19-321. Washington, D.C.: April 25, 2019. F-35 Joint Strike Fighter: Development Is Nearly Complete, but Deficiencies Found in Testing Need to Be Resolved. GAO-18-321. Washington, D.C.: June 5, 2018. Warfighter Support: DOD Needs to Share F-35 Operational Lessons Across the Military Services. GAO-18-464R. Washington, D.C.: April 25, 2018. Military Aircraft: F-35 Brings Increased Capabilities, but the Marine Corps Needs to Assess Challenges Associated with Operating in the Pacific. GAO-18-79C. Washington, D.C.: March 28, 2018. F-35 Aircraft Sustainment: DOD Needs to Address Challenges Affecting Readiness and Cost Transparency. GAO-18-75. Washington, D.C.: October 26, 2017. F-35 Joint Strike Fighter: DOD’s Proposed Follow-on Modernization Acquisition Strategy Reflects an Incremental Approach Although Plans Are Not Yet Finalized. GAO-17-690R. Washington, D.C.: August 8, 2017. F-35 Joint Strike Fighter: DOD Needs to Complete Developmental Testing Before Making Significant New Investments. GAO-17-351. Washington, D.C.: April 24, 2017. F-35 Joint Strike Fighter: Continued Oversight Needed as Program Plans to Begin Development of New Capabilities. GAO-16-390. Washington, D.C.: April 14, 2016. F-35 Sustainment: DOD Needs a Plan to Address Risks Related to Its Central Logistics System. GAO-16-439. Washington, D.C.: April 14, 2016. F-35 Joint Strike Fighter: Preliminary Observations on Program Progress. GAO-16-489T. Washington, D.C.: March 23, 2016. F-35 Joint Strike Fighter: Assessment Needed to Address Affordability Challenges. GAO-15-364. Washington, D.C.: April 14, 2015. F-35 Sustainment: Need for Affordable Strategy, Greater Attention to Risks, and Improved Cost Estimates. GAO-14-778. Washington, D.C.: September 23, 2014. F-35 Joint Strike Fighter: Slower Than Expected Progress in Software Testing May Limit Initial Warfighting Capabilities. GAO-14-468T. Washington, D.C.: March 26, 2014. F-35 Joint Strike Fighter: Problems Completing Software Testing May Hinder Delivery of Expected Warfighting Capabilities. GAO-14-322. Washington, D.C.: March 24, 2014. F-35 Joint Strike Fighter: Restructuring Has Improved the Program, but Affordability Challenges and Other Risks Remain. GAO-13-690T. Washington, D.C.: June 19, 2013. F-35 Joint Strike Fighter: Program Has Improved in Some Areas, but Affordability Challenges and Other Risks Remain. GAO-13-500T. Washington, D.C.: April 17, 2013. F-35 Joint Strike Fighter: Current Outlook Is Improved, but Long-Term Affordability Is a Major Concern. GAO-13-309. Washington, D.C.: March 11, 2013. Joint Strike Fighter: DOD Actions Needed to Further Enhance Restructuring and Address Affordability Risks. GAO-12-437. Washington, D.C.: June 14, 2012. Joint Strike Fighter: Restructuring Added Resources and Reduced Risk, but Concurrency Is Still a Major Concern. GAO-12-525T. Washington, D.C.: March 20, 2012. Joint Strike Fighter: Implications of Program Restructuring and Other Recent Developments on Key Aspects of DOD’s Prior Alternate Engine Analyses. GAO-11-903R. Washington, D.C.: September 14, 2011. Joint Strike Fighter: Restructuring Places Program on Firmer Footing, but Progress Is Still Lagging. GAO-11-677T. Washington, D.C.: May 19, 2011. Joint Strike Fighter: Restructuring Places Program on Firmer Footing, but Progress Still Lags. GAO-11-325. Washington, D.C.: April 7, 2011. Joint Strike Fighter: Restructuring Should Improve Outcomes, but Progress Is Still Lagging Overall. GAO-11-450T. Washington, D.C.: March 15, 2011. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.