Audit Report 

U.S. Department of Energy 

Office of Inspector General 

Office of Audit Services 

The Department’s Efforts to Implement 

Common Information Technology 

Services at Headquarters 

DOE/IG-0763 March 2007 
Department of Energy 

Vvashlngton, Cji iu565 

March 30, 2007 

MEMORANDUM FOR THCSECRETARY 

FROM: 

Inspector General 

SUBJECT: INFORMATION: Audit Report on "The Department's 

Efforts to Implement Common Information Technology 

Services at Headquarters" 

BACKGROUND 

The Department of Energy invested more than $980 million on consolidated 

infrastn~cture, office automation, and telecommunications in Fiscal Year (FY) 2006. 

In an effort to increase efficiency and purchasing power and reduce overall 

expenditures, the Department launched an initiative in FY 2003 to consolidate all 

aspects of common information technology (IT) systems including: computer 

desktop support, application hosting, and equipment distribution services that had 

previously been managed separately by various Headquarters organizations. The 

initiative, originally known as the Extended Common Integrated Technology 

Environment, is now known as the Department of Energy's Common Operating 

Environment (DOE-COE). 

5OE-COE was based largely on a Secretarial initiative to implement a single, 

integrated IT infrastructure across the Department. In the first phase of that effort, the 

Chief Information Officer was tasked with consolidating information technology 

services and providing standard desktop, e-mail, and related services at Headquarters. 

Because of the importance of the project to improving the economy and efficiency of 

the information technology environment, we conducted this audit to determine 

whether the DOE-COE initiative was meeting planned goals and objectives. 

RESULTS OF AUDIT 

Although the Department had made progress in implementing DOE-COE at 

Headquarters, it had not fully achieved the goals and objectives envisioned by the 

original initiative. In particular, we observed that: 

Five major organizations, accounting for 40 percent (2,473 of 6,199) of the 

total potential user population, were not migrated to the common operating 

envirorlment within the first year as planned, thereby preventing realization of 

the full $1 5 million of first year savings through expected economies of scale; 

and, 

For certain organizations in which implementation was completed, services 

were not disabled for terminated employees in a timely manner, resulting in 

the payment of over $700,000 in unnecessary user fees and creating potential 

cvber secuntv vulnerabilities. 2 

Prllltcd wlth soy ~nk on rtcyclcd p:lpcr 
These problems occurred because officials responsible for implementation did not 

always follow Department and Federal project management practices, such as 

developing formal migration plans and conducting requirements analyses. In 

addition, procedures relating to user account termination were not adequate. As a 

consequence, the Department was unable to conlplete the Headquarters conversion 

within established timeframes and is unlikely to realize originally anticipated cost 

savings. 

To its credit, the Office of the Chief Information Officer (OCIO) has accomplished 

some of the project's goals. For example, 23 of 28 Headquarters organizations - 

representing 60 percent of the potential users - had been migrated within 12 months 

of implementation. IT hardware was also procured at a lower price than that of the 

General Services Administration's Supply Schedule and standardization of a number 

of platforms and applications had taken place. While these are positive steps, 

additional action is necessary to ensure that all consolidation objectives are satisfied. 

As such, we have made recommendations designed to help improve the continuing 

implementation and operation of the DOE-COE initiative. 

Although the scope of our review was limited to Headquarters, resolving the issues 

identified in our report may be critical to the success of the Department's planned 

extension of the common operating environment to field activities. That effort, 

according to an OCIO official, is scheduled to be completed 18 months from the date 

that a support service contractor is selected and will involve Federal systems at most 

of the Department's sites. Given that this contracting process is underway, the 

Department needs to ensure that all implementation issues are understood and 

resolved prior to proceeding. 

MANAGEMENT REACTION 

The OCIO provided comments to the draft and concurred with the report's findings 

and recommendations. They indicated that steps had been taken relative to our 

recommendations and that envisioned economies of scale from these efforts are 

beginning to be realized. Management also indicated that emphasis is being placed 

on disabling and closing accounts in a timely manner and on ensuring that program 

organizations understand the implications of not doing so. 

Management's comments are included in their entirety in Appendix 3. 

Attachment 

cc: Deputy Secretary 

Acting Administrator, National IVuclear Security Administration 

llnder Secretary for Science 

Acting Under Secretary of Energy 

Chief of Staff 

Chief Information Officer 
REPORT ON THE DEPARTMENT'S EFFORTS TO IMPLEMENT 

COMMON INFORMATION TECHNOLOGY SERVICES AT 

HEADQUARTERS 

TABLE OF 

CONTENTS 

Consolidation of Information Technoloqy Services 

Details of Finding ................................................................... 1 

Recommendations and Comments .......................................... 6 

Appendices 

I. Objective, Scope, and Methodology .................................. 8 

2. Prior Repol-ts ................................................................... .I0 

3. Management Comments .................................................. 12 
CONSOLIDATION OF INFORMATION TECHNOLOGY SERVICES 

________________________________________________________________ 

Page 1 Details of Finding

Goals and Objectives While the Department of Energy (Department) had made 

progress toward implementing the initiative at 

Headquarters, it had not fully satisfied several significant 

goals and objectives. Specifically, the Department had not 

migrated the National Nuclear Security Administration 

(NNSA) and four other major organizations within 

established timeframes. We also noted that the Department 

of Energy's Common Operating Environment (DOE-COE) 

services were not always being terminated for departing 

employees in a timely fashion. 

Migration of Headquarters Organizations

The Office of the Chief Information Officer (OCIO) did not 

meet its goal of migrating all Headquarters organizations to 

DOE-COE within the first year. As originally conceived, 

DOE-COE services were to have been fully implemented at 

Headquarters within 12 months of project inception – 

October 2003. However, as of September 2006, the OCIO 

had been unable to fully complete the migration of NNSA, 

and the Offices of Science (Science), Civilian Radioactive 

Waste Management (OCRWM), and Energy Efficiency and 

Renewable Energy (Energy Efficiency). According to an 

OCIO official, these remaining organizations, for which 

implementation remained incomplete, represented about 34 

percent (2,123 of 6,199 users) of the total potential 

population at Headquarters. 

Despite the Deputy Secretary reaffirming his commitment 

to the DOE-COE initiative and requiring the 

implementation of a single integrated information 

technology (IT) environment, several organizations resisted 

participation in the initiative. The original concept of the 

initiative, to facilitate savings through consolidation, called 

for each participating organization to provide previously 

allocated IT funding to the OCIO in return for delivery of 

needed services. However, certain organizations were 

reluctant to participate, citing concerns about the cost and 

quality of services provided versus providing those services 

themselves. In particular: 

• A Science official indicated that his program could 

provide IT services cheaper and at a greater level of 

satisfaction than the OCIO. Based on that belief, 

the Director, Office of Science, attempted to retain 

separate IT support services for his office rather 

than migrate. Even though the request was 
 

________________________________________________________________ 

Page 2 Details of Finding

disapproved, Science has yet to agree to a migration 

plan. At the conclusion of our field work, we noted 

that the OCIO had developed and provided Science 

with a proposed migration plan; however, while 

negotiations are currently on-going, Science has not 

yet accepted this plan. 

• NNSA was also reluctant to migrate to DOE-COE. 

Even though cyber security protections were 

sufficient to satisfy 23 of 28 organizations and the 

costs of migrating individual users at Headquarters 

was well known, an NNSA official indicated that 

they would not agree to implementation until its 

security concerns were addressed and until NNSA 

knew what the services would cost – including the 

costs to support their field offices. During our 

discussions with OCIO officials, we learned NNSA 

accepted a plan and completed migration of its 

Headquarters personnel by the end of January 2007. 

The migrations of the remaining two organizations had also 

been significantly delayed. OCRWM and Energy 

Efficiency had originally been scheduled – as the other 

organizations – to be migrated within the first 12 months of 

project inception. However, migration plans for these 

organizations were not even developed until July 2006. 

The plan of action and milestones for OCRWM called for 

full migration by mid-August 2006. This target date was 

later moved to the end of November 2006, then to 

December, but by the end of January 2007, OCRWM's 

migration was not fully complete. While a specific date 

had not been set by the OCIO for migration of Energy 

Efficiency, it is projected to occur sometime in Fiscal Year 

2007. 

User Account Management 

User accounts and DOE-COE services were not always 

suspended for terminated employees in a timely manner. 

Our analysis revealed that, as of May 2006, 165 former 

Federal and contractor employees still had active user 

accounts even though their association with the Department 

had ended. The chart below summarizes the number of 

accounts open following the employees' departure from the 

Department. 
 

________________________________________________________________ 

Page 3 Details of Finding

 Months 

Outstanding

 Number of 

Accounts 

 Cost of 

Accounts 

≤ 2 8 4,500 

3 to 6 27 36,600 

7 to 10 20 51,300 

11 to 16 10 42,000 

17 to 20 78 414,900 

21 to 26 16 106,200 

27 to 32 6 51,000 

Total 165 $706,500 

Since Department organizations are obligated to pay for 

DOE-COE services of active accounts at the rate of $300 

per month, over $700,000 was unnecessarily incurred for 

these users. Presumably, users with active accounts also 

could have been able to access the Department's systems, 

obtain data to which they were not entitled, and, as trusted 

users, introduce malicious programs such as viruses or 

trojans. Once notified of the results of our testing, 

management initiated action to disable the unneeded 

accounts. 

Implementation and Project implementation and operation issues existed, 

Operating Practices at least in part, because officials had not always adhered to 

Department and Federal project management practices 

when implementing the initiative. In addition, adequate 

user account termination procedures had not been 

developed. 

Project Management Practices

Efforts to complete migrations to the common operating 

environment within the initiative's first year of operation 

were not completed because the OCIO officials had not 

always followed Departmental and Federal project 

management practices. Specifically, formal migration 

plans were not always developed prior to the beginning of 

project implementation – in some cases migrations plans 

were not developed until three years after migration had 

begun – and organizational and functional requirement 

analyses were not always conducted as required. As 

outlined in Departmental guidance, plans such as these are 

essential to guiding project execution and achieving 

initiative goals. Until recently, formal migration plans for 

some individual organizations had not been prepared. 

Migration plans should have contained details on work 
 

________________________________________________________________ 

Page 4 Details of Finding

scope and projections regarding resources and schedules. 

While migration plans for Science, NNSA, Energy 

Efficiency, and OCRWM have now been developed, not all 

of them have been fully implemented. For example, as 

noted earlier, a proposed migration plan for Science was 

developed by the OCIO and presented in January 2007, but 

Science has yet to agree to implementation. Negotiations 

between the Science and the OCIO are ongoing. 

 

Organizational and functional requirements analyses, 

required by DOE Order 413.3, also were not conducted 

prior to the implementation of the initiative. These 

analyses could have identified organization specific issues 

and problems in advance and could have allowed for 

individual tailoring of migration plans. For example, had 

such an analysis been completed for NNSA, their stated 

concerns might have been addressed prior to the 

Departments transition to DOE-COE. Instead, these 

concerns did not surface until the initiative was well 

underway. 

Another factor that may have affected the willingness of 

organizations to migrate their systems within the originally 

prescribed window was the lack of a complete systems 

lifecycle cost benefit analysis. At the inception of the 

project, the OCIO only provided an estimated cost savings 

for the first year of the initiative, and did not estimate 

savings that the initiative was expected to realize over its 

lifecycle. A cost benefit analysis, required by 

documentation supporting DOE Order 200.1, would have 

assisted organizations in understanding the benefits of 

accepting the initiative, helped during budget planning and 

execution, and may have ensured a timely migration to the 

common operating environment. 

Account Termination Procedures

Services for departing employees and contractors were not 

always terminated in a timely manner because employee 

departure procedures were either not effective or did not 

exist. While procedures required that program officials 

notify the OCIO of an employee's departure, an additional 

control to ensure that notification was made – linking the 

notification to the employee departure clearance or 

checkout process – was not always effective in the case of 

Federal employees and did not exist for contractors. Even 

though the Office of Human Capital Management 
 

________________________________________________________________ 

Page 5 Details of Finding

developed a checklist requiring the OCIO to be notified of 

an employee's departure, specifically in the area of account 

access, accounts for 44 Federal employees were not 

terminated as required. As is evident by the number of 

contractor accounts that had not been disabled as required – 

121 or about 73 percent of the total active accounts we 

discovered – a formal checkout process was not in place for 

contractors. An OCIO official indicated that user accounts 

were normally kept open for 60 days – a potentially risky 

practice not outlined in current procedures. 

Use of Resources Because of implementation delays, the Department did not 

realize the anticipated savings of $15 million in the first 

year of DOE-COE and has not actively tracked program 

savings in subsequent years. Without full migration, the 

Department will continue to miss opportunities for cost 

savings. The Department's organizations also incurred 

unnecessary costs of about $700,000 over the last two years 

for active, but unneeded user accounts. Absent 

improvements in procedures, the Department could incur 

similar costs in the future from failing to terminate user 

accounts in a timely manner. Additionally, user account 

terminations are directly related to how IT assets are 

retrieved by the OCIO. Failure to retrieve IT assets in a 

timely manner could result in equipment not being 

available for re-distribution to new users. Furthermore, as 

previously noted, the existence of the user accounts in 

question could pose a cyber security risk to the Department 

by allowing unauthorized access to and use of information 

resources. 

Follow-on Efforts The Department has announced that it plans to extend its 

common operating environment to field activities. This 

effort will involve providing services similar to those 

deployed under the DOE-COE initiative to Federal 

personnel at most of the Department's sites. This phase of 

the effort is scheduled to be completed 18 months after the 

selection of a support contractor. Although the scope of 

our review was limited to Headquarters, the issues we 

identified are relevant to the upcoming effort and may be 

critical to a successful and timely deployment. Given the 

scope of this ambitious effort, the Department needs to 

ensure that all DOE-COE implementation issues are 

understood and resolved before proceeding. 
 

________________________________________________________________ 

Page 6 Recommendations and Comments

RECOMMENDATIONS To address issues with DOE-COE implementation, we 

recommend that the OCIO, in conjunction with responsible 

NNSA and other program officials: 

1. Complete the Headquarters migration to DOE-COE. 

To facilitate this effort, ensure that: 

a. Migration plans are completed; and, 

b. Requirements analyses are conducted. 

2. Prior to extending the initiative to the field, ensure that: 

a. Formal migration plans are developed; 

b. Functional requirements analyses are conducted; 

and, 

c. Cost benefit analyses are performed. 

 

3. Revise account management procedures to ensure 

account termination in a timely manner. 

MANAGEMENT Management concurred with our findings and 

REACTION recommendations and indicated that proactive steps had 

been taken, or are planned relative to our recommendations. 

Specifically, in their response to a draft of this report and in 

subsequent technical comments, the OCIO acknowledged 

the need to complete migration plans and conduct a 

comprehensive requirements analysis in order to facilitate 

the conversion of the remaining organizations. 

 The OCIO added that 80 percent of the user population has 

now migrated to the Common Operating Environment. A 

plan for EE is expected to be completed by June 2007, with 

migration December 2007. The final office, Science, will 

be migrated as soon as Science management agrees to do 

so. In addition, the OCIO committed to developing formal 

migration plans, requirement analyses, and cost benefit 

analyses prior to extending this initiative to the 

Department's field locations. Finally, the OCIO indicated 

that actions had been recently taken to remove user account 

access in a timely manner through the establishment of 

additional policy, improvement of existing procedures, 

and/or frequent verification and validation of user account 

access. 
 

________________________________________________________________ 

Page 7 Recommendations and Comments

 Related to the unnecessary user costs, the OCIO noted that 

these charges may have occurred because responsible 

officials did not always notify them of employee departures 

or because inactive workstations might have been 

transitioned into "offices of convenience" within that 

organization. 

AUDITOR Management's comments, including corrective actions 

COMMENTS taken and planned, are responsive to our recommendations. 

Management's comments to the draft report are included in 

their entirety as Appendix 3. 
Appendix 1 

________________________________________________________________ 

Page 8 Objective, Scope, and Methodology

OBJECTIVE To determine whether the Department of Energy's 

(Department) Common Operating Environment (DOECOE) initiative was being effectively managed and was 

meeting Department goals and objectives. 

SCOPE This audit was performed between December 2005 and 

January 2007 at Departmental Headquarters in Washington, 

DC, and Germantown, MD. 

METHODOLOGY To accomplish our audit objective, we: 

 

• Reviewed applicable laws and regulations 

pertaining to development of the DOE-COE 

initiative. We also reviewed guidance issued by the 

Office of Management and Budget; 

• Reviewed reports issued by the Office of Inspector 

General and by the Government Accountability 

Office; 

• Reviewed numerous documents related to the 

Department's DOE-COE initiative; 

• Held discussions with organizational officials and 

personnel from Department of Energy 

Headquarters, including representatives from the 

Offices of the Chief Information Officer, Science, 

Environmental Management, Fossil Energy, Energy 

Efficiency and Renewable Energy, 

Counterintelligence, Intelligence, Civilian 

Radioactive Waste Management, Legacy 

Management, Hearings and Appeals, General 

Counsel, Environment, Safety and Health, 

Economic Impact and Diversity, Board of Contract 

Appeals, Inspector General, and the National 

Nuclear Security Administration, the Energy 

Information Administration, and the Departmental 

Representative to the Defense Nuclear Facilities 

Safety Board; and, 

• Reviewed the Government Performance and Results 

Act of 1993 to determine if performance measures 

had been established for managing and developing 

the initiative.
Appendix 1 (continued) 

________________________________________________________________ 

Page 9 Objective, Scope, and Methodology

The audit was conducted in accordance with generally 

accepted Government auditing standards for performance 

audits and included a test of internal controls and 

compliance with laws and regulations to the extent 

necessary to satisfy the audit objective. Accordingly, we 

assessed internal controls regarding implementation of the 

DOE-COE initiative, management of the Application 

Hosting Environment, user account termination, customer 

service, and asset management. However, the audit report 

does not necessarily disclose all internal control 

deficiencies that may have existed at the time of our audit. 

While we did not rely solely on computer-processed data to 

satisfy our audit objective, we confirmed the validity of 

such data, when appropriate, by reviewing supporting 

source documents such as user lists, payment remittances, 

and invoices. 

An exit conference was held on March 27, 2007, with 

officials from the Office of the Chief Information Officer. 
Appendix 2 

___________________________________________________________________ 

Page 10 Prior Reports 

PRIOR REPORTS

• Information Technology Support Services at the Department of Energy's Operating 

Contractors, (DOE/IG-0725, April 2006). The audit report found that while the 

Department of Energy (Department) had initiated action to consolidate requirements 

for services provided to Federal employees, it continues to face a number of 

challenges related to contractor procured or furnished information technology (IT) 

support services. The report states that although the Department had initiated action 

to consolidate Federal IT support services by implementing its Extended Common 

Integrated Technology Environment Program, it had not established a comprehensive 

framework which would provide a corporate-wide approach to providing IT support 

services that included contractor-managed sites. Without such a framework, the 

Department did not require contractors to adopt other available methods for reducing 

costs such as coordinating with established consortium buying groups to consolidate 

demand and obtain volume discounts. Consequently, the Department lacked an 

effective means of managing and controlling contractor IT support services costs. 

The report concluded that there is a potential for significant cost savings at the 

Department's numerous contractor-managed sites through better management and 

control of IT support services. 

• Management of the Department's Desktop Computer Software Enterprise License 

Agreements, (DOE/IG-0718, January 2006). The audit found that the Department had 

not adequately managed the acquisition and maintenance of desktop computer 

software licenses. The report states that the Department spent more than $4 million 

more than necessary over the last five years to acquire and maintain desktop software. 

In particular, the report found that enterprise agreements for common products such 

as security and antivirus software had not been established. According to the report, 

the Department had not established a complex-wide desktop software acquisition and 

maintenance strategy. 

• Development and Implementation of the Department's Enterprise Architecture, 

(DOE/IG-0686, April 2005). This audit found that the Department had not fully 

defined its current or future information technology requirements, essential elements 

if architecture is to be an effective tool in managing information technology 

investments. In particular, the Department had not defined the roles, responsibilities, 

and authorities necessary to develop and implement a Department-wide architecture. 

Further, the Department did not have a formal program plan that established the 

scope, schedule, and cost of the development effort; nor, had it established 

performance goals to measure progress toward the development of architecture. 

Consequently, since 1998, Office of Inspector General reports have shown that the 

lack of an enterprise architecture contributed to more than $155 million in lost 

opportunities for information technology-related savings. 
Appendix 2 (continued) 

___________________________________________________________________ 

Page 11 Prior Reports 

• Information Technology Support Services Contracts, (DOE/IG-0516, August 2001). 

The audit found that the Department did not have a comprehensive framework for 

acquiring IT support services. Therefore, the Department was not effectively 

managing the acquisition of IT support services. For example, Headquarters and field 

elements did not consolidate requirements and routinely resorted to open-market 

procurements without formally considering the use of existing Federal contracts. 

Despite requirements in the Clinger-Cohen Act, the Department had not developed 

and implemented a framework for acquiring IT support services in an efficient and 

cost-effective manner. If the Department adopted an enterprise-wide approach to 

acquiring IT support services, significant savings, as much as $44 million over a three 

year period, may be possible. 

• Corporate and Stand-Alone Information Systems Development, (DOE/IG-0485, 

September 2000). The audit found that duplicative and/or redundant computer 

systems exist or are under development at virtually all organizational levels, corporate 

and Federal, within the Department. The Department had not fully developed and 

implemented an application software investment strategy designed to reduce or 

eliminate duplicative systems. As a result, the Department spent at least $38 million 

developing duplicative information systems. 

• Commercial Off-the-Shelf Software Acquisition Framework, (DOE/IG-0463, March 

2000). The Department had not developed and implemented software standards or 

effectively used enterprise-wide contracts, key components of a Commercial Off-the 

Shelf acquisition framework. Therefore, departmental offices acquired application 

and operating system software that varied in type and price and duplicated 

procurement efforts by awarding and managing multiple contracts for the same 

product. The Department's inability to establish a framework was due to its 

decentralized information technology strategy and a lack of organizational support. 

The Department has not taken advantage of enterprise-wide software contracts that 

could result in savings of about $38 million over five years for just one of its major 

desktop software suites. The audit also found that the use of enterprise-wide 

contracts for other required applications could also significantly increase savings. 
Appendix 3 

___________________________________________________________________ 

Page 12 Management Comments 
IG Report No. DOE/IG-0763

CUSTOMER RESPONSE FORM 

The Office of Inspector General has a continuing interest in improving the usefulness of 

its products. We wish to make our reports as responsive as possible to our customers' 

requirements, and, therefore, ask that you consider sharing your thoughts with us. On the 

back of this form, you may suggest improvements to enhance the effectiveness of future 

reports. Please include answers to the following questions if they are applicable to you: 

1. What additional background information about the selection, scheduling, scope, or 

procedures of the inspection would have been helpful to the reader in understanding 

this report? 

2. What additional information related to findings and recommendations could have 

been included in the report to assist management in implementing corrective actions? 

3. What format, stylistic, or organizational changes might have made this report's 

overall message more clear to the reader? 

4. What additional actions could the Office of Inspector General have taken on the 

issues discussed in this report which would have been helpful? 

5. Please include your name and telephone number so that we may contact you should 

we have any questions about your comments. 

Name Date 

Telephone Organization 

When you have completed this form, you may telefax it to the Office of Inspector 

General at (202) 586-0948, or you may mail it to: 

Office of Inspector General (IG-1) 

Department of Energy 

Washington, DC 20585 

ATTN: Customer Relations 

If you wish to discuss this report or your comments with a staff member of the Office of 

Inspector General, please contact Judy Garland-Smith (202) 586-7828.
The Office of Inspector General wants to make the distribution of its reports as customer friendly 

and cost effective as possible. Therefore, this report will be available electronically through the 

Internet at the following address: 

U.S. Department of Energy Office of Inspector General Home Page 

http://www.ig.energy.gov

Your comments would be appreciated and can be provided on the Customer Response Form.