# Presentation: 411744

## OMB A-11 IT Management and Reporting

- Office of Management and Budget Staff
- May 6 and 7, 2003

## Agenda

- Building Better Business Cases
- High level discussion of changes for FY05
- Individual Areas of the Business Cases
- IT Security and Privacy
- Integration into the Budget Process
- Federal Enterprise Architecture
- View from the Resource Management Office (Budget)
- Financial Management Reporting

## Changes from FY04 to FY05

- Section 53
- All terminology changed from IT project to IT Investment
- Requirement for Draft Exhibit 53 (Summer)
- Federal Enterprise Architecture is added
- What it means to be Green added
- Linkage to the FEA is added to the Unique Investment Identifiers

## Changes from FY04 to FY05

- Exhibit 53
- Unique Investment Identifier
- Unique Investment Identifier (FY2004 Process)
- Investment Title
- Investment Description
- Total Investments for 2003, 2004, and 2005
- Financial percentage
- IT Security percentage
- Homeland Security Priority Identifier
- Development, modernization, enhancement for 2003, 2004, 2005
- Steady State for 2003, 2004, 2005

## Changes from FY04 to FY05

- Major Investment definition:
- investment was a major investment in the FY 04 submission and is continuing;
- investment is financial management and spends more than $500,000;
-  investment is directly tied to the top two layers of the Federal Enterprise Architecture (Services to Citizens and Mode of Delivery);
- investment is an integral part of the agency’s modernization blueprint (EA);
- investment has significant program or policy implications;
- investment has high executive visibility;
- investment is defined as major by the agency’s capital planning and investment control process;
-  OMB may work with the agency to declare other projects as major investments.

## Changes from FY04 to FY05

- Section 300
- Location in the budget added to the introduction
- PART Review Questions
- All terminology for IT changed to investments
- Federal Enterprise Architecture added
- More specificity in every section
- Multi-Agency Business Cases and requirements
- One business case for office automation, infrastructure, and telecommunications
- All 300s must be in XML in order to be part of the budget submission
- Government FTE added to the summary of spending
- Intro added for each section identifying how to successfully address the section

## Building Better Business Cases

- I.A.  Investment Description & I.B.  Justification
- A collaborative investment that includes multiple agencies, state, local, or tribal governments
- Supports the President’s Management Agenda
- uses e-business technologies
- investment is governed by citizen needs
- supports the Federal Business Architecture published by OMB
- If investment is a steady state investment, then an E-Gov strategy review is underway and includes all of the necessary elements
- If appropriate, this investment is fully aligned with one or more of the President's E-Gov initiatives
- I.C. Performance Goals and Measures
- FEA will be discussed later in the presentation

## Building Better Business Cases

- I.D. Project Management
- Project is very strong and has resources in place to manage it.
- Project Managers are in place and successfully managing the project
- Integrated Project Teams are in place and include the correct skill sets
- Members, Roles, qualifications, and contact information for in-house and contract managers
- Identification of a Project Manager
- Identification of a Contracting
- Integrated Project Team
- Sponsor/Owner Assigned?  Identified?
- Additional Information:
- OMB Capital Programming Guide
- OPM

## Building Better Business Cases

- I.F. Risk Inventory & Assessment
- All 19 items addressed
- Risk Assessment performed at outset & managed throughout the life-cycle
- Status of Risk as of the date of the business case
- In column for status: If not completed, show the milestone(s) for completion of risk mitigation
- Date of the most recent Risk Management Plan

## Building Better Business Cases

- I.E. Alternative Analysis
- Identify all viable alternatives
- Select the top 3 Viable Alternatives
- Market Research
- Discuss the market research that was done to identify innovative solutions for this investment (e.g., used an RFI to obtain 4 different solutions to evaluate, held open meetings with contractors to discuss investment scope, etc.,).  Also describe what data was used to make estimates:  past or current contract prices for similar work, contractor provided estimates from RFIs or meetings, general market publications, etc.

## Building Better Business Cases

- Life cycle costs analysis for each alternative
- – Provide Assumptions. What data was used to make the estimates
- Chosen alternative and why
- Define return on investment
- Risk adjusted/Quantitative benefits-savings, other
- Net Present Value by Year and Payback Period Calculations
- Date of the Benefits Costs Analysis

## Investments not assessing 3 viable alternatives 

- Consequences:
- Most cost effective solution providing greatest benefits not chosen
- Opportunities to collaborate are missed
- Innovative solutions are not pursued
- No backup plan if alternative chosen isn’t the right one

- Steps For Strengthening:
- Identify all possible alternatives and then down-select
- Increase Market research to identify innovative solutions
- Benchmark against private industry
- Use consistent financial criteria across alternatives

## Building Better Business Cases

- Acquisition Strategy
- Single or Several Contracts
- What type of contract/task order if single
- If multiple contract/task orders will be used discuss the type, how they relate to each other to reach the investment outcomes, and how much each contributes to the achievement of the investment cost, schedule and performance goals.
- Discuss the contract/task order solicitation or contract provisions that allow the contractor to provide innovative, transformational solutions.

## Building Better Business Cases

- Acquisition Strategy Continued
- Performance-Based – if not why not.
- For other that firm-fixed price, performance-based contracts, define the risk not sufficiently mitigated in the risk mitigation plan, for that contract/task order, that requires the Government to assume the risk of contract achievement of cost, schedule and performance goals.  Explain the amount of risk the government will assume.
- Will you use financial incentives to motivate contractor performance (e.g. incentive fee, award fee, etc.)?
- Discuss the competition process used for each contract/task order?
- Full and Open – Limited using schedule or commercial item, etc.

## Building Better Business Cases

- Acquisition Strategy Continued
- Will you use commercially available or COTS products for this investment?
- If yes, to what extent will these items be modified to meet the unique requirements of this investment?
- What prevented the use of COTS without modification?
- If no.  Why?

## Building Better Business Cases

- Acquisition Strategy Continued...
- How will you ensure Section 508 compliance?
- What is the date of your acquisition plan?
- Keep it updated
- Percentage of hardware acquisition
- Percentage of software acquisition
- Percentage of services acquisition

## Investments not adequately planning and managing acquisitions

- Consequences:
- Unclear contracts do not mitigate risk to the government
- Relationship between primes and subcontractors not well designed thereby adding to the risk
- Failure to include procurement experts may not identify smartest choices

- Steps For Strengthening:
- Increase the use of performance based contracts
- Reduce use of Time and Material contracts
- Ensure that modernization strategies include performance based criteria
- Ensure the procurement shop is an integral player

## Building Better Business Cases

- I.H. Investment and Funding Plan
- Provides Project Management information on total project – Both Contractor and Government Efforts
- Government personnel costs = salaries plus fringe benefits of 32.5% of government personnel considered to be direct and indirect labor in support of the project.  Includes the project management IPT and any other government effort (e.g., programming effort for part of the overall project development effort) that contributes to the success of the project.

## Building Better Business Cases

- I.H.  Investment and Milestone Funding Plan
- Must use Earned Value Management System that meets ANSI/EIA Standard 748
- Must demonstrate that the investment is meeting the planned cost, schedule and performance goals
- Use Operational Analysis for Steady State
- Use both for mixed life-cycle
- Lots of information about EVMS at www.acq.osd.mil/pm

## Government Establishes the Framework for the Investment

- Agency contract defines outcome/output requirements
- Contract requires contractor to use EVMS - ANSI/EIA 748, to build proposal, manage  contract performance, and submit EVMS data to Government.
- Contract defines EVMS software Government will use.
- Process Govt will use to verify 748 system

## ESTABLISH THE BASELINE	

**1.****  ****DEFINE THE WORK**

- TIME

**2.  SCHEDULE THE WORK**

**3.  ALLOCATE BUDGETS**

- $

- 100

- 80

- 60

- 20

- 40

- 15

- 40

## I.H.2 Original Baseline

- Cost and schedule goals for phase or segment/module of investment
- Major investment milestones
- When will they occur and cost
- Funding agency for each milestone
- This baseline is include in all subsequent reports, even when OMB has approved changes shown in I.H.3

## I.H.3 Proposed/Current Baseline

- When there are changes needed to original baseline or current OMB approved baseline.
- Shows new milestones and costs
- BLANK if no changes to original baseline.

## I.H.4.A  Actual Performance and Variance

**All of I.H.4 is always filled in to show current status of investment.**
- Compares OMB approved baseline and actual outcomes for phase, segment/module by milestone
- Shows baseline completion date and new estimated completion date, baseline costs and new estimate to complete.

## I.H.4.B Investment Summary 

- As of date___  Must show:
- Budgeted Cost of Work Scheduled (BCWS)
- Budgeted Cost of Work Performed (BCWP)
- Actual Cost of Work Performed (ACWP)
- Cost curve plotting BCWS, BCWP and ACWP on monthly basis

## COST PERFORMANCE REPORTINGKEY DATA ELEMENTS

## Earned Value Trend Analysis

## I.H.4.B.4 (Cont.) Provide the following EVMS Analysis

- Cost Variance $ and  %
- Cost performance index
- Schedule Variance $ and %
- Schedule Performance Index
- Two independent Estimate At Completion
- Variance at Completion for both EACs

## I.H.4.C and D 

- C - Analysis of the reasons for cost and schedule variances of 10% or more at time of report or EAC is projected to by 10% or more
- D – Provide performance variance
-   Explain whether IPT still expects to achieve performance goals.  If not, explain reasons

## I.H.4.E, F and G

- E - Discuss estimate to complete (EAC)
- Contractor
- Two commonly used EAC formulas
- Rationale for the EAC chosen by IPT
- F - Corrective actions with risk - How close to original goals will be result
- G - Agency Head concurrence to continue

## Operating investments

- Must be monitored with an Operational Analysis System to track:
- How close actual annual operating and maintenance costs are to the original life-cycle estimates
- Whether level or quality of performance /capability meets performance goals and continues to meet user needs

## Addressing IT Security, Homeland Security, and Privacy in IT Budget Materials

- Kamela White
- Information Policy and Technology
- Office of Management and Budget
- kgwhite@omb.eop.gov

## IT Budget Materials	

- Exhibit 53, IT Portfolio
- IT Security
- Homeland Security
- 300, Capital Asset Plan and Business Case
- IT Security
- Homeland Security
- Privacy

## Exhibit 53 

- IT Security
- Must report security costs per system
- Associate spending with level of performance
- 0 = no security controls
- Provide additional information where necessary
- What should security costs consist of?
- Products, procedures, personnel, etc. that are primarily dedicated to or used for provision of security controls:
- employee training, security inspections and audits, vulnerability and penetration testing.

## Exhibit 53 – IT Security (continued)

- Products, procedures, personnel, etc. that have as an integral component a quantifiable benefit to security:
- privacy training, system/program evaluations.
*Supports Homeland Security* means an IT investment that supports the homeland security mission areas of:
- Intelligence and Warning,
- Border and Transportation Security,
- Defending Against Catastrophic Threats,
- Protecting Critical Infrastructure and Key Assets,
- Emergency Preparedness and Response, and
- Other.

## Exhibit 300 – Part I. Capital Asset Plan and Business Case	

- IT Security
- Was this investment reviewed as part of the FY03 Federal Information Security Management Act review process?
- If yes, were any weaknesses found?
- Have the weaknesses been incorporated into the agency’s corrective action plans?

## Part I. (continued)

- Has this investment been identified as a national critical operation or asset by a Project Matrix review or other agency determination?
- If no, is this an agency mission critical or essential service, system, operation, or asset (such as those documented in the agency's COOP Plan), other than those identified as above as national critical infrastructures?

## Part I. (continued)

- Homeland Security
*Supports Homeland Security* means an IT investment that supports the homeland security mission areas of:
- Intelligence and Warning,
- Border and Transportation Security,
- Defending Against Catastrophic Threats,
- Protecting Critical Infrastructure and Key Assets,
- Emergency Preparedness and Response, and
- Other.
- Privacy
- Was a privacy impact assessment performed for this IT investment?

## Part I. (continued)

- Section I.F. Risk Inventory and Assessment** **
- Identify security and privacy risks, also provide information of the level of risk (high, medium, or basic); and
- What factor determined the risk level (confidentiality, integrity, or availability)

## Part II.  Additional Business Case Criteria for IT

- Section II.B. Security and Privacy
- How is security funded?
- Level of risk and security controls?
- Does the IT investment meet security requirements:
- up-to-date security plan?
- fully certified and accredited?
- security controls tested?
- users trained?
- incident response capability?
- security in contracts?

## Part II. (continued)

- Privacy
- Appropriate controls to protect privacy for systems that promote or permit public access?
- Agency ensure that handling of personal information is consistent with gov’t-wide and agency policies?
- Performed a privacy impact assessment?

## Privacy Impact Assessment (PIA)

- A PIA is a process for examining the risks and ramifications of collecting, maintaining, and disseminating personally identifiable information in an information system; and for identifying and evaluating alternatives and protections to mitigate the impact to privacy of collecting personal information.
- PIAs are required for all major IT systems and all new systems that are requesting funding
- PIAs are required for new online information collections under the Paperwork Reduction Act.

## RMO’s Viewpoint

- 1.  **Negotiated Process.  IT and Programmatic Considerations.**
- 	Emphasize that OMB-agency negotiate the process.  Investments can be disapproved on either IT (300) grounds, or programmatic grounds -- or sustained for programmatic reasons while a "get well" plan is pursued with respect to weaknesses in the IT business case.
- 2.   **IT and Overall Budget Justifications Should Be Integrated.  Integration Should Be Built Into An Agency's Budget Formulation Process (just as it is increasing at OMB).  In FY 2005, IT justifications will matter more.**
- 	IT shops and budget shops should understand well how both aspects of agency budget requests relate.  More OMB account examiners and OMB analysis will be devoted to reviewing IT justifications in FY 2005 than ever before, and final budget decisions will depend on these reviews.  OMB needs to understand how IT fits into overall programmatic requests across the agency.  Agencies should work with their RMO on IT integration into the overall Budget Submission.  E-Gov Plans should be integrated with the other PMA initiatives (Financial Management, Human Capital, Competitive Sourcing, and Budget and Performance Integration).
- 3.   **Early Submission of "Draft Exhibit 53s and Exhibit 300s." **
- 	OMB will be discussing with agencies "draft Exhibit 53" submissions, to clarify early such things as expected lists of major investments, how mapping IT investments to the FEA lines of business is being addressed, how consolidated infrastructure requests will be handled, and other issues.

## RMO’s Viewpoint

- 4.  **Relation of Exhibit 300s and PARTs****.**
- 	If an IT investment contributes to a program with a PART, A-11 calls for addressing whether the IT investment relates to closing a gap identified in the PART.
- 5.  **Joint Business Cases.**
- 	When two or more partners are working together on a investment or elements of a investment, it should be clear not just what is being done, but what unnecessary things are not being done. That is really the true test of joint business case***. ***The managing partner will take the lead for the business case and capital asset planning, including submitting the joint 300 to OMB.  Partnering agencies should ensure their collaboration and funding are appropriately represented in the 300 prior to submission to OMB. All participants will reflect multi-agency investments as specific line items on their exhibit 53s.