Audit of NRC’s

Information Technology 

Procurement Process

OIG-15-A-09 

February 11, 2015 

 

All publicly available OIG reports (including this report) 

are accessible through NRC’s Web site at

http://www.nrc.gov/reading-rm/doc-collections/insp-gen
UNITED STATES

NUCLEAR REGULATORY COMMISSION

WASHINGTON, D.C. 20555-0001

OFFICE OF THE

INSPECTOR GENERAL

February 11, 2015

MEMORANDUM TO: Mark A. Satorius

Executive Director for Operations

FROM: Stephen D. Dingbaum /RA/

Assistant Inspector General for Audits

SUBJECT: AUDIT OF NRC’S INFORMATION TECHNOLOGY 

PROCUREMENT PROCESS (OIG-15-A-09)

Attached is the Office of the Inspector General’s (OIG) audit report titled Audit of NRC’s 

Information Technology Procurement Process.

The report presents the results of the subject audit. Following the January 23, 2015, exit 

conference, agency staff indicated that they had no formal comments for inclusion in this 

report.

Please provide information on actions taken or planned on each of the recommendations 

within 30 days of the date of this memorandum. Actions taken or planned are subject to OIG 

followup as stated in Management Directive 6.1.

We appreciate the cooperation extended to us by members of your staff during the audit. If 

you have any questions or comments about our report, please contact me at (301) 415-5915 

or Beth Serepca, Team Leader, at (301) 415-5911.

Attachment: As stated
Office of the Inspector General

U.S. Nuclear Regulatory Commission

Defense Nuclear Facilities Safety Board

Results in Brief

Audit of NRC’s Information Technology Procurement 

Process

What We Found

NRC IT governance groups do not consistently apply investment 

criteria in reviewing and approving staff requests for new 

technology. Specifically, OIG found cases dating from 2010 to the 

present in which NRC purchased items to meet specific customer 

needs without establishing standardized selection criteria or 

applying such criteria to business case justifications for the 

procurements. Additionally, staff interviews and internal agency 

analysis corroborate a need for better coordination of IT 

procurement planning, budgeting, and prioritization.

What We Recommend

To strengthen NRC’s IT procurement process, we make one 

recommendation to develop IT selection criteria, and one 

recommendation to educate staff on IT procurement criteria and 

NRC’s IT governance structures.

Management stated their general agreement with the finding and 

recommendations in this report.

Why We Did This Review

Cost-effective information 

technology (IT) procurement is 

critical as the Nuclear 

Regulatory Commission (NRC) 

aims to provide staff with 

technology that helps them 

perform their mission and 

manage information security 

risk, while also maintaining 

fiscal discipline in the face of 

declining resources.

There are several processes for 

procuring IT at NRC, depending 

upon variables such as 

transaction cost, availability 

through existing contracts, and 

similarity to products already in 

use at NRC.

The audit objective was to assess 

the effectiveness of NRC’s IT 

procurement process in meeting 

the agency’s current and future 

IT needs.

OIG-15-A-09

February 11, 2015
Audit of NRC’s Information Technology Procurement Process 

ABBREVIATIONS AND ACRONYNMS........................................................ i

I. BACKGROUND ................................................................................1

II. OBJECTIVE......................................................................................6

III. FINDING...........................................................................................6

NRC Could Improve New IT Procurement With Well Defined and 

Better Understood Investment Criteria..............................................6

Recommendations ...................................................................................10

IV. AGENCY COMMENTS...................................................................11

APPENDIX 

OBJECTIVE, SCOPE, AND METHODOLOGY .........................................12

TO REPORT FRAUD, WASTE, OR ABUSE.............................................14

COMMENTS AND SUGGESTIONS..........................................................14

 TABLE OF CONTENTS
Audit of NRC’s Information Technology Procurement Process 

i

AC Architecture Council

FY Fiscal Year

IPEC

Information Technology / Information Management 

Portfolio Executive Council

IT Information Technology

ITB

Information Technology / Information Management 

Board

NRC Nuclear Regulatory Commission

OIG Office of the Inspector General

OIS Office of Information Services

OMB Office of Management and Budget

 ABBREVIATIONS AND ACRONYMS
Audit of NRC’s Information Technology Procurement Process 

1

Cost-effective information technology (IT) procurement is critical as the 

Nuclear Regulatory Commission (NRC) aims to provide staff with 

technology that helps them perform their mission and manage information 

security risk, while also maintaining fiscal discipline in the face of declining 

resources. The need to “innovate with less”1 is reinforced by trends in 

NRC’s annual IT spending, which decreased from approximately $165 

million in fiscal year (FY) 2011 to approximately $152 million in FY 2015.2 

This spending supports mission and management data systems, such as 

NRC’s incident response, official agency recordkeeping, and core financial 

accounting systems. Infrastructure services and support—which includes 

maintenance of NRC computer and telecommunication networks across 

agency headquarters, regional, and resident inspector offices—accounts 

for the largest single line item at $71 million, or 46 percent of NRC’s total 

FY 2015 IT budget.

 1 The Office of Management and Budget (OMB) has directed Federal agencies to “innovate with less” by ending 

low priority and duplicative IT investments. See OMB Memorandum M-12-10, Implementing PortfolioStat, March 

30, 2012.

2 In February 2014, senior NRC management announced a series of IT product and service cutbacks driven by 

budgetary constraints. These included a 25-percent reduction in the headquarters IT purchase card budget, 

deferral of technology initiatives such as alternative mobile devices and enterprise Wi-Fi access, and termination of 

project management and business analysis support services.

 I. BACKGROUND
Audit of NRC’s Information Technology Procurement Process 

2

IT Governance Groups at NRC

NRC has three principal governance3 groups that provide oversight of the 

agency’s IT planning and funding:

• The Information Technology/Information Management Portfolio 

Executive Council (IPEC) manages NRC’s IT portfolio4 at the 

strategic level and sets current fiscal year funding priorities. The 

IPEC is co-chaired by NRC’s Chief Information Officer and Chief 

Financial Officer, and its voting members are NRC office directors. 

Advisory members provide input on contracting, finance, 

operations, and security issues, but do not have a voting role in 

IPEC decisionmaking.

• The Information Technology/Information Management Board (ITB) 

reviews and recommends changes to the agency's IT portfolio 

based on the agency's mission and business needs, and provides 

resourcing and investment5 recommendations to the IPEC. The 

ITB is co-chaired by a branch chief from the Office of Information 

Services (OIS) and one program office representative who rotates 

biennially. Other voting members include branch chiefs and deputy 

division directors from various headquarters and regional offices. 

The ITB also has non-voting advisory members from OIS, the 

Office of Administration’s Acquisition Management Division, and 

NRC’s Technical Training Center.

 3 In December 2013, NRC’s Office of the Inspector General (OIG) issued audit report OIG-A-14-04, Audit of NRC’s 

Information Technology Governance. This report is publicly available in the NRC Agencywide Documents Access 

and Management System. See http://pbadupws.nrc.gov/docs/ML1334/ML13343A244.pdf.

 

4 NRC’s IT portfolio includes all IT investments, both existing and in development. The NRC portfolio is the 

enterprise—i.e., agencywide—view of the history and future of NRC IT investments. Key IT management activities 

at this level include scanning for new industry and Federal Government developments, technical program portfolio 

analysis, development of transition strategies to move NRC from the current state to a target state, and 

compilation and submission of NRC’s IT budget.

5 IT investments are activities and acquisitions that focus on achieving an interrelated set of organizational goals in 

support of NRC’s mission, and in accordance with NRC’s target architecture. Key activities at this level include the 

identification, sponsorship, preparation, planning, and selection of IT investments within the context of the NRC 

transition strategy, development of investment business cases, update and maintenance of IT investment 

documentation, and the monitoring of investment performance.
Audit of NRC’s Information Technology Procurement Process 

3

• The Architecture Council (AC) oversees IT projects6 and 

infrastructure, provides technology analysis to NRC’s Chief 

Information Officer and the ITB, and serves as a forum for 

discussing technological innovation. The AC also evaluates 

proposed projects to determine whether the projects will fit within

the agency’s enterprise architecture.7

 The AC is also tasked with 

ensuring that standardized methods and procedures are used for 

efficient and prompt handling of all changes to enterprise services 

and projects. The AC is composed of OIS and Computer Security 

Office staff who represent functional areas such as customer 

service, operations, systems engineering, security, and 

acquisitions.

The IPEC and AC charters outlining objectives, responsibilities, and 

organizational relationships were undergoing revision at the time of this 

audit. The ITB charter was revised in June 2014. 

IT Procurement Processes at NRC

There are several processes for procuring IT at NRC, depending upon 

variables such as transaction cost, availability through existing contracts, 

and similarity to products already in use at NRC. The following points 

offer general summaries of different procurement processes.

• Micropurchases: Purchase cards are used for transactions worth 

$3,000 or less. Purchase requests undergo supervisory review to 

ensure they meet legitimate business needs, do not duplicate items 

already in inventory, and have funding available. Micropurchases

at NRC headquarters are subject to quarterly audits, and 

micropurchases at NRC regional offices are audited annually.8

 6 IT projects are temporary endeavors that support development for investments. Projects cover a range of types, 

including new development, operations and maintenance, service delivery, and organizational strengthening.

7

Enterprise architecture provides a clear and comprehensive picture of current and proposed technical 

environments, and a roadmap for transitioning from the current to the target technical environment. When 

properly managed, enterprise architecture can help optimize the relationships among an organization's business 

operations and the IT infrastructure and applications supporting them.

8 During OIG’s audit, NRC staff were reportedly revising the agency’s purchase card handbook to strengthen 

controls over IT micropurchases.
Audit of NRC’s Information Technology Procurement Process 

4

• Purchases worth more than $3,000: Staff may procure items 

unavailable through purchase card orders by creating new 

standalone contracts, or by issuing orders under existing contracts. 

Creating new contracts entails considerable administrative burden 

and can delay procurements, so staff are encouraged to consult 

with Office of Administration acquisitions specialists to determine 

the best option. In some cases, staff can use enterprisewide 

contracts to expedite requisitions and help NRC obtain better 

pricing than that available through standalone contracts.9

• New technology requests: Staff may requisition new IT by 

submitting change requests to OIS staff, who determine whether a 

product meets agency technical standards.10 Standard changes, 

such as required security patches, upgrades to approved hardware 

and software, or mission-related hardware and software deployed 

on a limited scale, are generally reviewed and approved within a 

few days. Requests for new, non-standard technology must 

undergo technical review by the AC, which may refer cases with 

significant resource impacts to the ITB for review. All changes 

must be tested, validated, and evaluated in an accepted test 

environment.

• Expedited requests: Some IT procurement requests undergo 

expedited review by the AC. Urgent security needs are one basis 

for expedited review, as are event-driven needs like NRC’s 

response to Fukushima. Requests from senior NRC personnel 

may also be “fast tracked”; however, this requires direction from the 

Deputy Chief Information Officer and Chief Information Security 

Officer.

 9 NRC also uses interagency agreements, such as agreements with Department of Energy laboratories, to procure 

goods and services not available through commercial contractors, including IT such as specialized software 

development.

10NRC maintains these standards in its Technical Reference Model, which serves as a catalog of products approved 

for use at NRC. Staff told auditors that NRC was in the process of reducing the number of products listed in the 

Technical Reference Model to eliminate duplicative technologies and promote standardization among items that 

perform similar functions.
Audit of NRC’s Information Technology Procurement Process 

5

IT Procurement Initiatives at NRC

During this audit, NRC was undertaking several initiatives to improve IT 

procurement. During October 2014, staff announced a near-term plan to 

reduce print and copy expenses pending a longer-term procurement and 

device management strategy to be implemented in 2015. Additionally, 

OIS staff were revising the change request process to reduce backlogs of 

pending requests, with a goal of further expediting the process through 

automation. Lastly, the ITB integrated budget formulation with IT 

prioritization, tested this new approach in developing a FY 2016 budget 

proposal, and conducted a lessons-learned analysis of this exercise to 

help the FY 2017 exercise.
Audit of NRC’s Information Technology Procurement Process 

6

 III. FINDING

The audit objective was to assess the effectiveness of NRC’s IT 

procurement process in meeting the agency’s current and future IT needs. 

The report appendix provides information on the audit’s scope and 

methodology.

NRC Could Improve New IT Procurement With Well Defined and 

Better Understood Investment Criteria

NRC has governance groups that review IT investments in the planning, 

development, and operational stages. The agency is also taking steps to 

streamline and improve the cost-effectiveness of its IT procurements. 

However, NRC could more effectively meet agencywide IT needs by 

developing and applying investment criteria, and by communicating these 

criteria to all staff involved in the IT procurement process. 

NRC IT governance groups should apply IT investment criteria that are 

well defined and understood by all staff involved in the IT procurement 

process. NRC IT governance groups do not consistently apply these 

investment criteria in reviewing and approving staff requests for new 

technology. This occurs because NRC IT governance groups lack 

standardized technical and financial selection criteria. As a result, IT 

items are sometimes deployed without full functionality and NRC does not 

always realize full return on its procurement investment.

 II. OBJECTIVE
Audit of NRC’s Information Technology Procurement Process 

7

IT Investment Criteria Should Be Defined and Understood

NRC should apply IT investment criteria that are well defined and 

understood by all staff involved in the IT procurement process. This 

includes staff seeking to procure new IT, as well as those serving on 

governance groups that evaluate and approve procurement requests. In 

its best practices for IT portfolio planning and development, the U.S. 

Government Accountability Office recommends that organizations define 

investment criteria and apply those criteria in the selection process. 

These criteria may include qualitative or quantitative factors such as cost, 

benefit, schedule, and risk.

NRC Does Not Consistently Apply Best Practices for IT Investment 

Criteria

NRC IT governance groups do not consistently apply investment criteria in 

reviewing and approving staff requests for new technology. Specifically, 

OIG found cases dating from 2010 to the present in which NRC purchased 

items to meet specific customer needs without establishing standardized 

selection criteria or applying such criteria to business case justifications for 

the procurements. Additionally, staff interviews and internal agency 

analysis corroborate a need for better coordination of IT procurement 

planning, budgeting, and prioritization. 

The following cases illustrate the condition found by auditors, but are not 

intended to be representative of all NRC IT procurement actions.

• Alternative laptops based on a different operating system than 

standard-issue NRC laptops were procured through an expedited 

process for limited use by senior personnel. These laptops require 

dedicated technical support because of their difference from 

What Is Required

What We Found
Audit of NRC’s Information Technology Procurement Process 

8

standard-issue laptops.11 After the initial procurement of seven 

devices, NRC staff and contractors analyzed potential use of the 

alternative laptops on an agencywide scale, but found significant 

cost and technical challenges. Specifically, staff estimated the cost 

of procuring and operating the limited number of laptops at 

approximately $800,000 per year. At the time of this audit, use of 

supported alternative laptops remained limited to senior personnel.

• Tablets were procured for a proof-of-concept trial by a program 

office. Staff presented a business case analysis to the ITB, which 

included user needs, functional requirements, and analysis of total 

ownership costs associated with deploying tablets for a 5-year 

period, which varied between $470,000 and $748,000 for the 

models that were selected. The ITB conditionally approved the 

devices, and NRC procured 12 tablets (6 each of 2 different 

brands). However, technical matters pertaining to security and 

network integration were not resolved prior to device deployment. 

The proof-of-concept tablet deployment was conducted separately 

from a broader agencywide mobile device initiative and, at the time 

of this audit, the tablets were not being used as networked devices.

• Security hardware and software was procured initially on a trial 

basis because NRC, at that time, had not yet decided whether to 

implement the specific technology. Contract documents show that 

licenses for the hardware and software have been renewed 

annually for 3 years at a total cost of approximately $109,000, but 

the products reportedly remain in beta testing mode for staff 

training purposes. 

• File management software was procured with a 3-year contract 

worth approximately $24,300 after receiving conditional approval 

from the ITB for limited use, with questions raised by ITB members 

regarding security and technical support requirements. Nearly 11 

months into the contract, NRC staff were following up to determine 

whether issues raised by ITB members during review of the 

procurement have been resolved. 

 11The ITB gave limited approval to this procurement request, but records do not show the basis for this decision.
Audit of NRC’s Information Technology Procurement Process 

9

Auditors’ reviews of ITB and AC records, as well as interviews with staff 

who have participated in these governance boards, show staff concern for 

greater consistency and discipline in the IT procurement process. 

Additionally, agency management has expressed desire for agency 

governance boards to have more effective authority—specifically, the 

authority to reject procurements that do not align with agencywide goals.

IT Governance Groups Lack Standardized Selection Criteria

IT governance groups do not consistently apply investment criteria in 

reviewing requests for new IT because they lack standardized technical 

and financial selection criteria. Members of NRC’s IT governance groups 

demonstrate understanding of key issues such as security, technical 

support requirements, total ownership costs, and enterprise architecture. 

However, these types of issues are not formalized and communicated to 

stakeholders in policy that would foster consistent IT investment review 

and staff awareness of the standards by which IT procurement requests 

are approved or rejected.

IT Products Sometimes Lack Full Functionality, Do Not Optimize 

Return on Investment

The lack of defined selection criteria and rigorous application of such 

criteria to the IT investment selection process has led to items being 

procured and deployed without full functionality or put to limited use. 

Additionally, some product deployments have resulted in end users losing 

features that could potentially enhance their work. As a further 

consequence, the agency has not always realized a full return on its 

procurement investment.

Why This Occurred

Why This Is Important
Audit of NRC’s Information Technology Procurement Process 

10

Recommendations

OIG recommends that the Executive Director for Operations

1. Develop and implement selection criteria for use by the ITB and 

other IT governance groups in reviewing IT procurement proposals.

2. Develop and implement a communication plan to educate NRC 

customers on IT procurement criteria and the role of NRC’s 

governance structures in reviewing and approving IT procurement 

proposals. 
Audit of NRC’s Information Technology Procurement Process 

11

 IV. AGENCY COMMENTS

An exit conference was held with the agency on January 23, 2015. Prior 

to this meeting, agency management reviewed a discussion draft and

provided technical comments that have been incorporated into this report, 

as appropriate. As a result, agency management opted not to provide 

formal comments for inclusion in this report.
Audit of NRC’s Information Technology Procurement Process 

12

 Appendix 

Objective

The audit objective was to assess the effectiveness of NRC’s IT 

procurement process in meeting the agency’s current and future IT needs.

Scope

This audit focused on the process by which NRC headquarters and 

regional staff procure IT products. We conducted this performance audit 

from June 2014 through December 2014 at NRC headquarters in 

Rockville, MD, and regional offices via telephone. Internal controls related 

to the audit objective were reviewed and analyzed. Throughout the audit, 

auditors were aware of the possibility of fraud, waste, and abuse in the 

program. 

Methodology

To address the audit objective within the scope of this audit, OIG auditors 

analyzed the following Federal and agency guidance, and key data and 

documents:

• Federal Acquisition Regulation.

• Office of Management and Budget Memorandum M-12-10, 

Implementing PortfolioStat, March 30, 2012.

 U.S. Government Accountability Office: Best Practices and 

Leading Practices in Information Technology Management.

http://www.gao.gov/key_issues/leading_practices_information_tech

nology_management/issue_summary

• NRC Strategic Plan for Fiscal Years 2014-2018.

 OBJECTIVE, SCOPE, AND METHODOLOGY
Audit of NRC’s Information Technology Procurement Process 

13

• Management Directive 11.1, NRC Acquisition of Supplies and 

Services.

• Management Directive 11.7, NRC Procedures for Placement and 

Monitoring of Work with the U.S. Department of Energy.

• Management Directive 2.8, Project Management Methodology.

• NRC IT governance organization charters.

• NRC IT governance organization meeting minutes.

• NRC IT budget planning and spend analysis documents.

• NRC IT procurement process flow charts.

• Commercial contracts and Department of Energy laboratory 

agreement contracts.

Additionally, OIG auditors conducted in-person and telephone interviews 

with NRC staff representing the Office of Information Services, the Office 

of Administration (Acquisitions Management Division), the Computer 

Security Office, the Office of New Reactors, the Office of Nuclear 

Regulatory Research, and the four NRC regional offices. 

We conducted this performance audit in accordance with generally 

accepted government auditing standards. Those standards require that 

we plan and perform the audit to obtain sufficient, appropriate evidence to 

provide a reasonable basis for our findings and conclusions based on our 

audit objectives. We believe that the evidence obtained provides a 

reasonable basis for our findings and conclusions based on our audit 

objectives. 

The work was conducted by Beth Serepca, Team Leader; Paul Rades, 

Audit Manager; Nandini Sharma, Auditor; Lucky Singh, Auditor; and 

Andrew Pham, Student Analyst.
Audit of NRC’s Information Technology Procurement Process 

14

 TO REPORT FRAUD, WASTE, OR ABUSE

 COMMENTS AND SUGGESTIONS

Please Contact:

Email: Online Form

Telephone: 1-800-233-3497

TDD 1-800-270-2787

Address: U.S. Nuclear Regulatory Commission

Office of the Inspector General

Hotline Program

Mail Stop O5-E13

11555 Rockville Pike

Rockville, MD 20852

If you wish to provide comments on this report, please email OIG using this link.

In addition, if you have suggestions for future OIG audits, please provide them using 

this link.