The Department of Homeland Security (DHS) assessed risks in its second Quadrennial Homeland Security Review (QHSR) and considered threats, vulnerabilities and consequences, but it “did not document how its various analyses were synthesized to generate results, thus limiting there producibility and defensibility of the results,” the Government Accountability Office (GAO) said in its audit review of the QHSR.
And, “Without sufficient documentation, the QHSR risk results cannot easily be validated or the assumptions tested, hindering DHS’s ability to improve future assessments,” GAO stated.
“In addition,” GAO said, “the QHSR describes homeland security hazards, but does not rank those hazards or provide prioritized strategies to address them. Comparing and prioritizing risks helps identify where risk mitigation is most needed and helps justify cost-effective risk management options. Without determining prioritized risk outcomes, DHS is missing an opportunity to more efficiently mitigate risk or identify the resources required for addressing different levels and types of risks.”
GAO further noted that, “DHS has faced challenges accounting for its spending by mission, which it is taking actions to address, such as developing a new common appropriation structure to better link the department’s funding request to the execution of its missions. DHS also developed performance measures for all of the QHSR mission areas.”
While GAO said DHS expanded its stakeholder outreach efforts, 43 of 61 stakeholders “who provided narrative responses to one question in GAO’s survey stated that collaboration with stakeholders could be improved. For example, one respondent reported that stakeholders were asked to react to information provided by DHS rather than assist in formulating the QHSR approach and execution. DHS officials reported being limited by staff, time, and other constraints, and thus directed stakeholders to provide feedback via various web-based forums.”
GAO said the online forums allowed DHS to reach 2,000 representatives during its 2014 QHSR development process, but that “DHS’s QHSR After Action Report noted that the tools were used to validate study findings instead of informing them. Without fostering interactive communication, DHS may miss opportunities to incorporate stakeholder perspectives from the entire homeland security enterprise and thereby may not have fully informed the QHSR effort.”
GAO made four recommendations, including that for future QHSRs DHS improve its risk assessment documentation, prioritize risks and ensure stakeholder meetings are interactive.
DHS concurred with GAO’s recommendations.
