must be performed, who must perform them, and where and how the operations will be carried out. Our review10 of the concept of operations prepared as part of the eMerge2 project found that it lacked several key attributes called for by best practices. For example, the eMerge2 concept of operations did not take into consideration the over 500 financial management and related legacy systems in operation at DHS. Because of the large number of systems, DHS needs to define in its concept of operation (1) which legacy systems will be migrated to the new environment and (2) how this transition is envisioned to occur in order to achieve an integrated environment. Not only is this needed from an investment management point of view, it is a key element in addressing human capital challenges relating to change management strategies. DHS has recognized the importance of a well-defined concept of operations and is drafting one that it expects to address component- specific legacy systems and how they will interact or be replaced.
4. During the Emerge2 program, the Department had identified over 7,000 system and business requirements. Department officials believe many of these requirements are reusable for future information technology projects. However, GAO raised concerns about whether any of the 7,000 requirements are salvageable. You have raised concerns about the ability of the Department to use some of the 7,000 requirements developed during its Emerge2 program for another project.
What are your concerns and could you outline possible remedies?
If the Department purchases a commercially available system, would this
eliminate the need to develop requirements?
Although DHS officials told us that they expect the requirements developed for eMerge2 to be salvageable and provide a foundation for its future efforts, our review found that key requirements developed for eMerge2 did not have attributes associated with good requirements developed using best practices. The attributes of good requirements include being correct, unambiguous, complete, consistent, ranked for order of importance, verifiable, modifiable, and traceable. Some of the missing attributes of the eMerge2 requirements were clarity, traceability, and completeness. Most importantly, the eMerge2 requirements were not based on (1) a good concept of operations, (2) reengineered business processes, and (3) an appropriate internal control structure. For example, we were unable to identify critical requirements relating to inventory in the eMerge2 documentation, even though DHS’s fiscal year 2006 financial statements identified approximately $677 million in inventory and supplies. To help reduce the risks associated with consolidating its financial management systems, we recommended11 that DHS implement a disciplined requirements management process. DHS concurred with this recommendation, and we are encouraged that DHS recognized that attention is needed and is developing plans to address these financial management systems issues.
Such detailed requirements are still necessary even with the acquisition of a commercial off-the-shelf (COTS) system to make sure the implementation decisions that are required to make the COTS package operational result in a system that
GAO-07-1157R DHS Posthearing Questions