Federal Reports

On January 25, 2017, the President issued two Executive Orders directing the Department of Homeland Security to hire an additional 15,000 law enforcement officers. We conducted this audit to determine whether the Department and its components — specifically FLETC, USBP, and ICE — have the training strategies and capabilities in place to train 15,000 new agents and officers. Prior to the start of the hiring surge, FLETC’s capacity is already overextended. FLETC is not only responsible for accommodating the anticipated Department hiring surge, but also for an expected increase in demand from other Partner Organizations. Despite observing ongoing work in the development of hiring surge training plans and strategies, challenges exist due to uncertain funding commitments and current training conditions. Absent remedial action, these challenges may impede consistency and lead to a degradation in training and standards. As a result, trainees will be less prepared for their assigned field environment, potentially impeding mission achievability and increasing safety risk to themselves, other law enforcement officers, and anyone within their enforcement authority.

The enclosed report presents the results of the audit of the Commission’s financial statements for the fiscal year ended September 30, 2018

Following the January 13, 2018, false missile alert in Hawaii, Congress requested we examine the Federal Emergency Management Agency’s (FEMA) role in the incident. We concluded that FEMA has limited responsibility for the sending and canceling of state and local alerts. Following the Hawaii false missile alert, three U.S. Senators proposed legislation to define the federal government’s role during false missile alerts, as well as to direct FEMA to recommend best practices in the alerting process. We also identified two areas of concern regarding FEMA’s overall oversight of IPAWS. Although FEMA maintains IPAWS as a messaging platform, state and local alerting authorities must obtain commercially-available emergency alert software to generate a message which passes through IPAWS for authentication and delivery. However, we found that FEMA does not require that this software perform functions critical to the alerting process, such as the ability to preview or cancel an alert. Instead, FEMA only recommends that software vendors include these capabilities as “best practices.”

Our objective was to assess whether Decision Analysis Reports (DAR) I and II cybersecurity investments’ stated performance metrics aligned with the Corporate Information Security Office (CISO) strategic and cost objectives.