FEBRUARY 12, 2014 REPORT NUMBER 14-10

 Evaluation Report

The SBA Did Not Follow Federal Regulations and Guidance in the Acquisition 

of the OneTrack System
U.S. Small Business Administration

Office of Inspector General

Washington, D.C. 20416

2

FINAL REPORT TRANSMITTAL

REPORT NUMBER 14-10

DATE: February 12, 2014

TO: Paul Christy, Chief Operating Officer

A. John Shoraka, Associate Administrator, Government Contracts and Business Development

Renee Macklin, Chief Information Officer

Jonathan Carver, Chief Acquisition Officer

SUBJECT: Review of the OneTrack System Acquisition

This report presents the results of our review of the Small Business Administration’s contracting practices in the 

acquisition of the OneTrack System. Our objective was to assess the Small Business Administration’s (SBA) 

compliance with Federal contracting regulations and guidance over Information Technology (IT) systems 

acquisition and project oversight. Generally, we found that the SBA did not follow applicable federal regulations in 

the procurement of the OneTrack system. Additionally, the SBA has not yet completed the system testing required 

prior to placing a system into production.

We conducted this evaluation in accordance with the Council of Inspectors General on Integrity and Efficiency 

(CIGIE) Standards for Inspection and Evaluations. Those standards require that we plan and perform the 

evaluation to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions 

based on our objectives. We believe that the evidence obtained provides a reasonable basis for our conclusions 

based on our objectives.

We appreciate the courtesies and cooperation of the SBA extended to the staff during this review. Please direct 

any questions to me at (202) 205-7100 or Riccardo Buglisi, Director, Business Development Group at (202) 205-

7489.

***

/s/

Robert A. Westbrooks

Deputy Inspector General
Executive Summary Report Number 14-10

The SBA Did Not Follow Federal Regulations and Guidance in the Acquisition of the OneTrack 

System

3

What the OIG Reviewed

We conducted our review of acquisition issues for the 

OneTrack system between June 2013 and September 

2013. To complete our review, we met with agency 

officials from the Acquisition Division, the Office of 

Government Contracts and Business Development, and 

the Office of the Chief Information Officer (OCIO). We 

also reviewed contract documentation for the 

OneTrack task order, and the contract documentation 

for all three vendors on the Information Technology 

Information Management (ITIM) multi-award contract. 

Further, we identified laws and regulations as well as 

internal agency guidance applicable to the acquisition 

of an information technology (IT) system.

What the OIG Found

The SBA did not follow federal regulations and 

guidance in its acquisition of the OneTrack system for 

use by the Business Development (BD), Historically 

Underutilized Business Zone (HUBZone), and three 

new Mentor-Protégé Programs. Specifically, the SBA 

did not receive the OneTrack system as originally 

designed due to the following:

 The SBA did not appropriately plan for the 

acquisition of the OneTrack system. Specifically, 

the Agency did not complete the necessary market 

research or use modular contracting principles. 

 The SBA did not award the task order for the 

OneTrack system in compliance with federal 

regulations. For example, it provided the vendors 

with the Independent Government Cost Estimate 

and did not maintain complete contract file 

documentation. 

 The OCIO did not assume primary responsibility of 

the OneTrack system acquisition, as outlined by 

federal regulations. Additionally, appropriate 

surveillance of the task order did not occur. 

 The OCIO did not provide adequate oversight over 

its contractor—the Technical Project Manager—

providing program management and support 

functions to ensure that the contractor did not 

perform inherently governmental-like functions. 

As a result, the SBA did not receive a system with full 

capabilities as originally designed. The original 

OneTrack system should have been completed in a 12-

month period at a total cost of around $1.17 million. 

Instead, the SBA modified the task order to receive a 

system with the same, limited functions as the existing 

system in use, the Business Development Management 

Information System (BDMIS). However, the SBA still 

did not have a tested and approved system with 

BDMIS capabilities to put into production when the 

task order expired. To date, the SBA has increased the 

total cost to develop the system by approximately 

$734,000 and extended the performance of the task 

order by 14 months. See Figure 1 for the total increase 

in the cost of the system from December 2011 through 

September 2013.

Figure 1 Total Cost of Developing the OneTrack System

Source: OIG presentation of SBA data.

OIG Recommendations

The OIG made four recommendations to the SBA, 

specifically, the Chief Information Officer, the Chief 

Acquisition Officer, and the Associate Administrator for 

Government Contracts and Business Development. 

These recommendations are intended to ensure that 

the SBA receives a final system that has been fully 

tested and approved, and to improve the contracting 

process for any additional work to be completed on 

the OneTrack system. 

Agency Comments

Management submitted formal comments and 

concurred with our findings and all four 

recommendations.

Actions Taken

The SBA awarded a fixed-price, definitized contract as 

suggested in Recommendation 2. This 

recommendation is closed as implemented.

$1.17M 

$1.6M 

$1.9M 

$0

$500,000

$1,000,000

$1,500,000

$2,000,000

Original Task

Order (T.O.)

 T.O. Plus

Modification

and De-scope

Completed T.O.

Plus Current

Letter Contract
Table of Contents

Introduction ..................................................................................................................................................2

Background ...................................................................................................................................................2

Results...........................................................................................................................................................4

1) The SBA Did Not Follow Federal Regulations in the Acquisition of the OneTrack System...............5

The SBA Did Not Appropriately Plan for the Acquisition of the OneTrack ...........................................5

The SBA Did Not Award the OneTrack Task Order in Compliance with Federal Regulations...............9

The OCIO Did Not Assume Primary Responsibility of the OneTrack System Acquisition...................12

The OCIO Did Not Provide Adequate Oversight to Ensure Contractors Did Not Perform Inherently 

Governmental Functions.....................................................................................................................18

Conclusions.........................................................................................................................................20

Recommendations..............................................................................................................................20

2) The SBA Must Complete System Testing and Deployment Activities.............................................20

Conclusion...........................................................................................................................................21

Recommendations..............................................................................................................................21

Agency Comments and Office of the Inspector General Response............................................................22

Appendix I: Scope and Methodology.........................................................................................................26

Appendix II: Deliverables Schedule Agreed To by Contractor at Kick-Off on January 19, 2012................27

Appendix III: Use of Time-and-Materials Contracts by Federal Agencies..................................................28

Contracting Officers Select Contract Type..............................................................................................28

T&M Contracts May Be Used When No Other Contract Option Is Suitable...........................................28

T&M Contracts Require Increased Oversight .........................................................................................29

Appendix IV: Modular Contracting Principles............................................................................................31

Planning for IT Acquisitions.....................................................................................................................31

Using Modular Contracting Principles for Large Scale IT Acquisitions ...................................................32

Appendix V: Comments from the Office of Government Contracting and Business Development...........33

Appendix VI: Comments from the Chief Acquisition Officer ......................................................................36
2

Introduction

In May 2013, the OIG initiated a review to determine the effectiveness of the Small Business 

Administration’s (SBA) information technology (IT) governance process. During the review, the OIG 

obtained information concerning acquisition issues relating to an IT project under development, the 

OneTrack System. We modified the scope of our review to focus on these acquisition issues. While we 

found preliminary issues regarding the SBA’s compliance with IT governance principles, we plan to 

conduct additional reviews of SBA IT systems—including the OneTrack system—to determine if the 

Agency followed IT governance requirements. The results of the IT governance review will be reported 

on at a later date. This report presents the results of our review concerning, specifically, the acquisition 

of the OneTrack System. 

Background

The SBA helps socially and economically disadvantaged small businesses gain access to federal 

contracting opportunities through its 8(a) Business Development Program, Historically Underutilized 

Business Zone (HUBZone) Program, and the Mentor-Protégé Program. The 8(a) Program was created to 

assist small, disadvantaged businesses compete in the American economy through business 

development. The HUBZone Program helps small businesses that are located in economically 

challenged areas, or HUBZones, stimulate their local economies. The Mentor-Protégé Program—part of 

the 8(a) Program—allows more experienced firms to mentor 8(a) firms (the protégé) to enhance the 

protégé’s capabilities, provide various forms of business development assistance, and improve the 

protégé’s ability to successfully compete for contracts.

Currently, the SBA operates two different IT systems to help process small business applications into 

such programs—the Business Development Management Information System (BDMIS)—for use for 

Business Development Programs and the HUBZone Certification Tracking System (HCTS). The existing 

BDMIS and HCTS do not effectively support program management and oversight or initiatives to 

eliminate waste, fraud, and abuse. For example, the two systems have extensive data integrity issues, 

provide poor customer experiences, and perform duplicative functions. 

In Management Challenge Number 6 of the OIG’s Report on the Most Serious Challenges Facing the 

Small Business Administration (Audit Report 14-01), we reported that the 8(a) Business Development 

(BD) Program needs modification to ensure that: (1) more firms receive business development 

assistance, (2) standards for determining economic disadvantage are justifiable, and (3) the SBA is able 

monitor small business compliance with 8(a) regulations. While we reported that the SBA has made 

progress in addressing issues that hinder the Agency’s ability to deliver an effective 8(a) Program, 

improvements are still needed. 

In June 2011, the SBA began a process to improve, streamline, and automate the processes for the BD 

and HUBZone Programs into one system. This effort would create one portal for the BD program, the 

HUBZone Program, and three new Mentor-Protégé initiatives for small business participants. It would 

also provide the SBA small business program development offices with a shared database, improve staff 

productivity, and enhance monitoring and reporting capabilities. When completed, the OneTrack 

system is intended to meet several mission critical strategic objectives and goals, as well as meet 

recommendations outlined in Management Challenge Number 6 and other recommendations made by 

the OIG and the U.S. Government Accountability Office.
3

In December 2011, the SBA awarded a time-and-materials (T&M) task order under the Information 

Technology Information Management (ITIM) multi-award contract to Business Integra Technology 

Solutions, Inc. (BI) to develop the OneTrack system.1 This task order had a 12-month period of 

performance and an approximate value of $1.17 million. Over the course of the performance, however, 

the task order was modified to extend the period of performance to September 2013 (an additional nine 

months). It also changed the value of the task order to $1.6 million—about a $434,000 increase. 

Additionally, in April 2013, the SBA and the vendor began discussions to decrease in the scope of work 

required by the task order. However, they did not come to an agreement until August 2013 to officially 

de-scope the task order requirements and deliverables. As a result, the vendor was only required to 

develop a system with capabilities equivalent to the current BDMIS system—and not the full system, as 

originally designed. In September 2013, the task order expired; however, the vendor did not provide a 

functioning system that could replace the current BDMIS system. As a result, the SBA awarded a letter 

contract to the same vendor for almost $300,000 that must be completed by the end of February 2014. 

See Figure 2 for the increase in funds for the development of the system between December 2011 and 

September 2013.

Figure 2 Total Cost of Developing the OneTrack System, December 2011 and September 2013

Source: OIG presentation of SBA data. This chart reflects changes to the overall cost of developing the OneTrack system based 

upon the identified contract actions. For example, the total cost of the OneTrack system when our audit work ended in 

September 2013 was approximately $1.9 million.

IT Acquisitions

Federal regulations provide a structured framework for IT acquisitions, and in some cases, the 

regulations provide more requirements than for standard acquisitions. For instance, the Clinger-Cohen 

Act introduced modular contracting as a guiding principle for IT acquisitions to be used to the maximum 

extent practicable. Modular contracting principles require federal agencies to divide their IT acquisition 

into smaller pieces that allow for the flexibility to adapt with rapidly changing IT capabilities. For 

example, with modular contracting, a federal agency could award a separate contract for the design of a 

system, the development of a system, and the implementation of a system. Additionally, with modular 

contracting, an agency should only award a T&M contract for the design of a system and no other 

 

1

The Information Technology Information Management (ITIM) contract vehicle is a multi-award contract awarded to three 

small and small, disadvantaged businesses. The ITIM contract provides for a full range of support services, technical and 

management expertise, and solution-related enabling products, if required, to meet the mission of the SBA.

$1.17M 

$1.6M 

$1.9M 

$0

$500,000

$1,000,000

$1,500,000

$2,000,000

Original Task Order

(T.O.)

 T.O. Plus Modification

and De-scope

Completed T.O. Plus

Current Letter Contract
4

portion of the acquisition. However, if the agency chooses to use a T&M contract for the design phase, 

it may only award a T&M contract if the agency cannot reasonably estimate the work required or 

potential costs. The use of modular contracting and the limited use of T&M contracts for IT acquisitions 

intend to reduce program risks and incentivize contactor performance. Appendix III and Appendix IV

provide a more detailed explanation about modular contracting principles and the use of a T&M 

contract by federal agencies. See Figure 3 below for a summary of the IT system acquisition process.

Figure 3 Basic Acquisition Process for a New IT Systems Development Contract

Source: OIG presentation of Federal regulations and guidance for IT systems development acquisitions.

Nature of Limited or Omitted Information

No information was omitted due to confidentiality or sensitivity, nor were there limitations to 

information on this audit.

Results

The SBA did not follow federal regulations and guidance in its acquisition of the OneTrack system for use 

by the BD and HUBZone Programs. As a result, the SBA has not received a system with full capabilities 

as originally designed. The original OneTrack system should have been completed in a 12-month period 

at a total cost of around $1.17 million. Instead, the SBA modified the task order to receive a system with 

the same functions as the current BDMIS. However, the SBA still did not have a tested and approved 

system with BDMIS capabilities to put into production when the task order expired. To date, the SBA 

has increased the total cost of the system by approximately $734,000 and extended the performance of 

the acquisition by 14 months. 

Program 

Office 

(Customer) 

Identifies 

Need for New 

or Updated IT 

System and 

Notifies OCIO

OCIO along 

with All of the 

System 

Stakeholders 

Develop 

Acquisition 

Strategy and 

Statement of 

Work

OCIO Submits 

Acquisition 

Package for IT 

System 

Acquisition

Acquistion 

Division 

Awards IT 

Systems 

Contract Using 

Modular 

Contracting 

and COR from 

OCIO is 

Assigned

COR (from 

OCIO) 

Monitors the 

Performance 

of the 

Contract and 

Coordinates 

with Customer 

and Any Other 

Stakeholders

OCIO and the 

Customer 

Accept the IT 

System Based 

upon 

Satisfactory 

User Testing 

Prior to 

Contract 

Expiration 
5

1) The SBA Did Not Follow Federal Regulations in the Acquisition of the 

OneTrack System

The SBA did not properly plan for or select the best contracting vehicle in the acquisition of the 

OneTrack system. Specifically, the Contracting Officer awarded a task order without the support of 

adequate market research and did not use appropriate IT systems procurement methods. Additionally, 

during the solicitation process, the Contracting Officer provided potential vendors with the Independent 

Government Cost Estimate, and the SBA did not follow its Acquisition Strategy when evaluating the two 

bids received. Moreover, the Acquisition Division did not maintain a complete contract file as required 

by the FAR and internal acquisition guidance. Further, the SBA did not provide appropriate oversight of 

the contract required by federal regulations. For example, the CIO did not take primary responsibility 

for the OneTrack acquisition. Additionally, contracting staff turnover created inconsistent oversight 

practices over the life of the acquisition. Furthermore, it does not appear that staff had the appropriate 

knowledge or expertise for IT acquisitions. The SBA also did not apply appropriate surveillance required 

for a T&M contract to mitigate the risk assumed by the Agency. Finally, the SBA did not provide 

adequate oversight to ensure that contractor personnel did not perform inherently governmental-like 

functions, such as evaluating the performance of another contractor. 

The SBA Did Not Appropriately Plan for the Acquisition of the OneTrack 

The Acquisition Division did not structure the acquisition using appropriate procurement methods for IT 

systems development, including not providing evidence of adequate market research or selecting the 

appropriate contracting vehicle. See Table 1 for an analysis of the SBA’s compliance with federal 

contract requirements and good practices for the acquisition planning in the procurement of the 

OneTrack system.
6

Table 1 Acquisition Planning

Contracting Requirement or Good Practice2 What Happened

Market Research: 

According to FAR Subpart 10, federal agencies are required to 

conduct market research to identify the best contract vehicle, 

possible contractors, and available commercial items, if any.

 The SBA did not provide any proof that market research 

was completed. 

 If in-depth, market research had been completed, the SBA 

would have identified a number of small or small, 

disadvantaged businesses with the capability of 

performing the task order. 

Use Modular Contracting for IT Acquisitions: 

Federal guidance on modular contracting3states that all IT 

acquisitions that include significant system development 

should utilize modular contracting to the maximum extent 

practicable. 

FAR 16.601(c) allows an Agency can only use a T&M contract 

if it is not possible to reasonably estimate the work required 

or anticipate costs, such as for the design of a system.

 The Acquisition Division awarded a T&M task order for the 

full procurement of the OneTrack system. It did not divide 

the procurement into smaller stages.

 Acquisition personnel originally directed the Program 

Office (GCBD) to use a T&M contract vehicle for the 

procurement even though the Program Office proposed 

the use of a fixed-price contract vehicle.

 All stakeholders agreed to the use of a T&M contract 

vehicle upon approval of the Acquisition Strategy for the 

OneTrack system.

Selection of Contract Vehicle: 

Per FAR Subpart 16.104, Contracting Officers select the 

contract type based upon numerous factors—including 

contract complexity, period of performance, and price 

analysis. 

Subpart 16.601 of the FAR also requires a Determination and 

Findings (D&F) for all T&M contracts.

 No D&F available in contract file justifying the use of a 

T&M contract vehicle. 

 The OneTrack Acquisition Strategy stated that the SBA 

would use the ITIM multi-award contract with no 

additional justification.

 The ITIM multi-award contract is geared more toward 

OCIO support and project management, and not systems 

development.

 The SBA limited competition of the task order to only two 

vendors.

Market Research

The Contracting Officer awarded a task order under an existing contract without ensuring adequate 

market research was conducted supporting this contract vehicle to be the best contracting solution. 

Federal regulations4require market research to help determine:

 If vendor(s) exist who can meet the contract requirements, 

 If commercial items exist that can meet the agency’s needs, and

 If there are any legal requirements or regulations unique to the item being acquired. 

Further, market research helps agencies determine the appropriate contract vehicle based upon 

identified vendors or products/services. However, we could not determine the extent to which the SBA 

conducted market research or why the agency used the ITIM multi-award contract based upon the 

documentation provided to us by the Office of Government Contracting and Business Development 

(GCBD) and the Acquisition Division personnel. Further, the FAR requires that documentation of market 

research performed for an acquisition needs to be maintained in the contract file; however, the SBA 

 

2

For the purpose of this report, we are defining a good practice as any Federal guidance or generally accepted standard used 

by the Federal acquisition community.

3

Capital Programming Guide. Supplement to Office of Management and Budget Circular A-11, Part 7: Planning, Budgeting, and 

Acquisition of Capital Assets. June 2006.

4

FAR Subpart 10 – Market Research.
7

could not locate most of the pre-award information for this particular procurement. As a result, we 

could not determine if the use of the ITIM multiple-award contract was the best option for the SBA.

In our opinion, if in-depth, market research had been completed, the SBA would have identified a 

number of small or small, disadvantaged businesses with the capability of performing the task order 

outside of the SBA’s ITIM contract. For example, the SBA could have used the General Services 

Administration’s (GSA) Alliant government-wide acquisition contract (GWAC) and other IT interagency 

contract vehicles instead of the ITIM contract. As a result, the SBA would have had a larger vendor 

universe to choose from. Specifically, one GWAC operated by the GSA includes 97 different vendors 

who have additional industry credentials, such as Capability Maturing Model Integration (CMMI).5 

In other words, the SBA could have received a better price or a more qualified vendor by not limiting its 

competition to two vendors.

Use of Modular Contracting for IT Acquisitions

The Acquisition Division did not follow federal policies and regulations by selecting a T&M contract for 

the entire design, development, and implementation of the OneTrack system. Specifically, FAR Subpart 

39.1036and the Clinger-Cohen Act7state that all IT acquisitions that include significant development 

should utilize modular contracting to the maximum extent practicable. Modular contracting is the 

acquisition of a major IT system through smaller, successive increments of interoperable modules. 

These regulations also limit the use of a T&M contract for the design of a system only if it is not possible 

to estimate accurately the extent or duration of the work or to anticipate costs with any reasonable 

degree of confidence.8

Additionally, federal regulations state that for each module (or increment), a Contracting Officer (CO) 

should choose an appropriate contracting technique that facilitates the acquisition of subsequent parts 

of the system in future increments. Further, the acquisition should be structured to ensure that the 

Government is not required to procure additional increments after executing the modular approach 

planned for the entire procurement. An enterprise-type system comprised of multiple business 

component programs like the OneTrack system is an ideal candidate for modular contracting, and the 

lack of a modular approach can lead to interface and interoperability risks and require more oversight of 

the contractor. Because the system requirements for the OneTrack system allowed for some 

interpretation, the Agency would have been correct in selecting a T&M contract for the design phase of 

the system. However, the Agency should have used a fixed price or cost reimbursement type contract 

for the remaining phases of the system acquisition process. 

Selection of Contract Vehicle

There was no evidence that the ITIM multi-award contract vehicle provided the SBA with the best 

contracting solution for the OneTrack system. Selecting the best procurement solution is based on a 

 

5

 The 8(a) STARS II is a small business set-aide, government-wide acquisition contract that provides flexible access to 

customized IT solutions from a large, diverse pool of 8(a) industry partners. The 8(a) STARS II contract allows for long-term 

planning of large-scale program requirements while strengthening opportunities for 8(a) small business. The industry partners 

on the contract are classified in two Constellations. Constellation II required industry partners to have additional industry 

credentials, such as Capability Maturity Model Integration (CMMI) or ISO 9001 (quality management system). 

6

FAR Subpart 39.103 – Modular Contracting.

7

Clinger-Cohen Act of 1996, P.L. 104-106.

8

FAR Subpart 16.601(c) – Time-and-materials contracts.
8

systematic approach. After completing the requirement analysis, conducting market research, and 

understanding the program constraints, contingencies, and system design, the Program Manager, the 

CO, and other members of the Program Office work together to craft the appropriate contracting 

approach.9 Then, according to federal regulations, COs select the most appropriate contract type based 

upon numerous factors—including contract complexity, period of performance, and price analysis.10 

It is unclear if these steps were completed prior to developing the Acquisition Strategy for the OneTrack 

system. According to the Clinger-Cohen Act,11 the CIO is responsible for establishing goals for improving 

the efficiency and effectiveness of agency operations through the effective use of IT. In the Acquisition 

Strategy, the SBA pre-determined that it would target small and small, disadvantaged businesses 

participating in the ITIM contract via closed competition. The ITIM contract is a multi-award, indefinite 

delivery/indefinite quantity (IDIQ) contract awarded to three small and small, disadvantaged businesses. 

Such contracts are appropriate for procuring supplies and services when the Government anticipates 

recurring requirements but cannot determine the precise quantities needed within a specific period. 

An IDIQ contract establishes a minimum quantity or value of supplies and services to be purchased and 

may establish a maximum as well. Contracting Officers then issue task or delivery orders against the 

IDIQ contract to purchase supplies and services that fulfill the Government’s needs. 

However, the Statement of Work (SOW) for the ITIM contract is geared more toward providing program 

management and support for the OCIO rather than systems development. For example, in the eight 

pages of the SOW, the phrase “systems development” only appears twice while discussion about 

program management and support is documented throughout the SOW. Also, the base ITIM contract 

only identified six labor categories that were tailored to positions necessary to provide program 

management and support activities and not systems development activities.

Appropriately, the Acquisition Division disqualified one of the three ITIM vendors from the OneTrack 

procurement because the vendor on the ITIM contract also developed the Acquisition Strategy and 

SOW. By doing so, the Acquisition Division limited itself to a closed competition of only two potential 

vendors based on a SOW focused on program management. 

By selecting the ITIM contract, the SBA had the ability to award a T&M, labor hours, or fixed price task 

order. The Contracting Officer awarded a T&M task order for the design, development, and 

implementation of the OneTrack system, even though under modular contracting principles, T&M 

contracts are limited only to the design phase of system development. According to the minutes of an 

acquisition planning meeting, GCBD personnel asked Acquisition Division officials about the possibility of 

using a fixed price contract. However, Acquisition Division officials told GCBD personnel that a fixed 

price contract could not be used because the requirements for the system were too undefined, and that 

a T&M task order must be used. 

 

9

Guide for Modular Contracting. GSA, Office of Governmentwide Policy, Emerging Information Technology Policies Division, 

issued in December 1998.

10 FAR Subpart 16.104 – Factors in selecting contract types and Contract Types: An Overview of the Legal Requirements and 

Issues, Congressional Research Service, October 2010

11 40 U.S.C. 11315 and 44 U.S.C. 3506(a). The major departments and agencies that the Clinger-Cohen Act applies to are listed 

in 31 U.S.C. 901(b) and includes the Small Business Administration. In September 2011, the U.S. Government Accountability 

Office issued a report that provides a detailed explanation of the duties of the Chief Information Officer. GAO, Federal Chief 

Information Officers: Opportunities Exist to Improve Role in Information Technology Management, September 15, 2011; 

Washington, DC; GAO-11-634. 
9

Based upon the decision to use a T&M task order, per federal regulations, a Determinations and 

Findings (D&F) needed to be developed.12 A D&F is “a special form of written approval by an authorized 

official that is required by statute or regulation” prior to taking certain contract actions that documents 

a particular conclusion and necessary support.13 Specifically, the D&F for a T&M contract should include 

the following:

1) Support to prove that “no other contract is suitable,” and

2) Plans to use fixed price-type contracts for future acquisitions.

The contract file, however, did not include this document, and agency officials could not provide this 

document upon request. Because the D&F could not be found or reviewed, the OIG could not 

determine the extent to which the CO prepared this document and whether steps to utilize fixed pricetype contracts in the future were identified.

The SBA Did Not Award the OneTrack Task Order in Compliance with Federal Regulations 

The Contracting Officer provided the two potential vendors with the Independent Government Cost 

Estimate during the solicitation process. The Technical Review Panel also did not evaluate the two 

differing bids based upon criteria outlined in the SBA’s Acquisition Strategy for the OneTrack system. 

Additionally, the Acquisition Division did not maintain a complete contract file as required by the FAR14

and internal acquisition guidance.15 See Table 2 for federal contract requirements and good practices 

for contract award in the procurement of the OneTrack system.

 

12 FAR Subpart 16.601(c) – Time-and-materials contracts; and FAR Subpart 12.207(b) – Contract type.

13 FAR Subpart 1.701, Determinations and Findings – Definition.

14 FAR Subpart 4.801 – Government Contract Files, General.

15 SBA Acquisition Division File Folder Index, Supplies Purchase Orders and Delivery Orders.
10

Table 2 Contract Award

Contracting Requirement or Good Practice What Happened

Independent Government Cost Estimate (IGCE): 

Federal agencies develop IGCEs to evaluate cost proposals 

received from potential vendors. 

The IGCE is generally accepted as a business sensitive 

document and should not be provided to interested vendors.

 Contracting Officer provided both vendors with 

performance schedule data from the IGCE. 

 One vendor, who was later awarded the task order, 

prepared and submitted their proposal based exactly upon 

the information provided by the Contracting Officer. 

Evaluation of Proposals: 

The Acquisition Strategy stated that the SBA will evaluate 

each offeror’s price for fairness and reasonableness. 

Unrealistically high (or low) pricing in the initial or revised 

proposal may be grounds for eliminating a proposal from 

competition.

 The SBA received two bids on the task order—one for $1.2 

million and another for $2.3 million. However, the 

Technical Review Panel did not overly scrutinize the bids 

as outlined in the Acquisition Strategy. 

 The contract file did not contain proof of a technical and 

cost evaluation or contract selection justification. The 

GCBD program staff provided us copies of the Technical 

Evaluations of the proposals, but it is unclear whether 

these evaluations were used for selection.

Complete Contract File Documentation: 

FAR Subpart 4.801 states that contract files should contain an 

organized record of all contractual actions and be sufficient to 

provide a complete history of the contract. 

A complete file helps staff make informed decisions during 

the acquisition process and support all of the actions taken. 

 Contract File missing substantial amount of Pre-Award 

documentation. 

 Existing information in the contract file did not meet FAR 

requirements.

 The contract file for this task order did not include 15 of 

the 20 items required by the Acquisition Division’s own 

checklist. 

 The effects of high turnover that occurred during the 

performance of the task order are exacerbated by the 

incomplete and poorly organized contract files.

Independent Government Cost Estimate

The Contracting Officer provided each of the two vendors with the SOW as well as supplemental 

information on the contract performance requirements used in its Independent Government Cost 

Estimate. The supplemental information included the estimated total number of weeks and hours 

needed to complete each stage of the procurement and is part of the Independent Government Cost 

Estimate (IGCE). The IGCE is classified as business sensitive and should not be provided to the 

contractor. 16 The purpose of the IGCE is to evaluate the cost proposal submitted by potential vendors 

and help the Government obtain the best value for the contract. Disclosure of this information 

increases the risk to the Government because the vendors no longer need to prepare the best value 

available for their services, they only need to match or beat the costs identified by the Government. 

With this information, one of the vendors prepared its proposal based exactly upon the hours and 

weeks provided by the Contracting Officer. Further, because both potential vendors obtained this 

information, the prices on these proposals should not have been that different from each other. 

However, one contract proposal was almost double the cost of the other. The price difference should 

have been red flag to the Technical Review Panel that one of the vendors did not understand the 

proposal, or that the proposal and requirements from the SBA were not entirely clear or realistic. 

 

16 It is a generally accepted practice that an Independent Government Cost Estimate (IGCE) should be classified as business 

sensitive documents, and treated as such. An IGCE is the baseline for evaluating an offeror’s contract price/cost. Any 

significant variation between an offeror’s proposal and the IGCE requires analysis. When variation exists, the Government can 

identify and correct inaccuracies in the IGCE or use the IGCE to negotiate a more realistic price.
11

Further, if the SBA had enough information to calculate the total number of hours for each stage of the 

development and implementation process, the SBA should have used a cost-reimbursement type 

contract instead of using a T&M contract.

Evaluation of Proposals

The SBA obtained two bids on the task order—one for $1.2 million and another for $2.3 million. In the 

Acquisition Strategy, the SBA stated that it would evaluate each offeror’s price for fairness and 

reasonableness. More specifically, it stated that unrealistically high (or low) pricing in the initial or 

revised proposal may be grounds for eliminating a proposal from competition—either on the basis that 

the offeror does not understand the requirement or the offeror has submitted an unrealistic proposal. 

However, the contract file did not contain any proof of evaluation or contract selection justification. 

Given that one of the proposals was almost twice the total amount of the other, the Technical Review 

Panel should have scrutinized the proposals to determine if one of the bids was too low or too high. 

Additionally, the current CO explained that the vendor selected to perform the task order stated that 

the previous CO told them during the solicitation process that additional money could be added to the 

task order, if necessary. Basically, if the task order required more money for completion, the SBA would 

be able to provide it to the vendor.

Toward the end of our review, staff from the GCBD provided us with copies of the technical evaluations 

completed for the two proposals submitted. However, we cannot confirm that these evaluations were 

used for selection because they were not included in the official contract file. Our review of those 

evaluations found that while a template was available for each member of the Technical Review Panel, 

limited guidance existed on how to use the template for assigning a numerical rating in each of the five 

evaluation areas. The five evaluation areas are: (1) staffing and key personnel, (2) technical 

solution/approach, (3) past performance, (4) corporate experience, and (5) price. It appears that the 

numerical value assigned allowed for personal judgment. For example, an addendum was added to a 

team evaluation for one vendor where the panel increased the rating for one section by two points; 

however, the addendum did not provide a justification for the increase. Additionally, once the team 

evaluation of each proposal had been completed, some members of the panel edited their individual 

evaluations by changing ratings scores and the previous supporting narrative. 

Moreover, one of the proposals (Proposal 1) included hourly rates and estimated work for positions not 

identified in the base contract or SOW. Specifically, Proposal 1 stated that the ITIM base-contract with 

standard labor categories did not cover the specialized skill set required to perform the contract. 

Therefore, the vendor submitted two additional labor categories in Proposal 1, such as a Tech 

Lead/Architect. However, the evaluators did not raise or document concerns regarding the difference in 

positions and hourly rates provided in the two proposals. Proposal 1 also stated that the vendor would 

revise the cost proposal to align with the SBA’s budget if additional information was provided and the 

scope was clarified and finalized. This statement shows that the solicitation did not provide the vendor 

with enough information about the functionality of the OneTrack system to put together a realistic cost 

proposal. Based upon the SBA’s Acquisition Strategy, this statement should have also triggered 

additional scrutiny of both proposals on the basis that an offeror did not understand the requirements 

or that the requirements were unclear.
12

Complete Contract File Documentation

Subpart 4.801 of the FAR states that documentation maintained in a contract file must be sufficient to 

constitute a complete history of the transaction for the purpose of:

(1) Providing a complete background as a basis for informed decisions at each step of the 

acquisition process;

(2) Supporting actions taken;

(3) Providing information for reviews and investigations; and 

(4) Furnishing essential facts in the event of litigation or congressional inquiries.

The current contract file, however, is missing 75 percent of the documentation required by Acquisition 

Division guidance,17 and does not meet the requirements outlined in the FAR. The incomplete and 

disorganized contract files made it difficult for staff to readily access and understand the contract’s 

complete history—especially given the turnover of Contracting Officers. A complete history is needed to 

provide a thorough background as a basis for informed decisions at each step of the acquisition process 

and to support all actions taken. Additionally, because many of the required documents are missing, in 

some instances, we could only speculate on what occurred prior to the contract award and during the 

management of the task order.

The OCIO Did Not Assume Primary Responsibility of the OneTrack System Acquisition 

The Clinger-Cohen Act established the role of the CIO to carry out IT capital planning, investment, and 

management for their respective agency and assume responsibility and accountability for IT 

investments. The CIO is responsible for, among other things, providing IT acquisition management and 

oversight. This requires the CIO to assume a primary role in developing and enforcing policies for 

systems acquisition, development, and integration with existing systems. Further, the CIO has the 

primary role of monitoring the performance of IT programs and advising the agency head whether to 

continue, modify, or terminate such programs. Also, the CIO oversees the acquisition or development of 

IT systems to improve the likelihood of success. Moreover, the CIO needs to have adequate oversight to 

ensure that funds being spent on Program Office investments will fulfill mission needs.

We found that the SBA did not provide adequate surveillance required to properly mitigate risk for the 

T&M task order used to acquire the OneTrack system. Additionally, contracting staff turnover—coupled 

with the OCIO not serving as the lead Program Office—added further risk and complications to the 

appropriate oversight of the contract performance. See Table 3 for a comparison of the SBA’s 

compliance with federal contract requirements and good practices for contract management, including 

oversight of the OneTrack system acquisition.

 

17 SBA Acquisition Division File Folder Index, Supplies Purchase Orders and Delivery Orders.
13

Table 3 Contract Management and Oversight

Contracting Requirement or Good Practice What Happened

Consistent and Knowledgeable Contracting Staff: 

The contracting office staff should be consistent and have 

institutional knowledge of the contract. 

The Government Accountability Office identified consistent 

and stable contracting staff as a critical factor for successful 

major systems acquisitions.18 

 The Acquisition Division used four different Contracting 

Officers during the task order award and performance. 

 The GCBD staff remained on the task order for the entire 

process, but should not have served as the primary driver 

of the project. 

 The OCIO assigned a contractor to the GCBD to provide 

technical oversight of the project.

 The vendor used three different Project Managers over 

the course of the acquisition.

Appropriate Surveillance for T&M Contracts: 

FAR Subpart 16.6 states that when an agency uses a T&M 

contract, appropriate surveillance of the contractor’s 

performance is necessary to give reasonable assurance that 

efficient methods and effective cost controls are being used.

 At the Kick-off Meeting held in January 2012, the vendor 

proposed a final schedule with an end of November 2013; 

even though the task order period of performance was 

December 2012. 

 The GCBD had concerns about the vendor’s performance 

throughout the task order, but did not notify the 

appropriate personnel and tried to build a case against the 

vendor only after the task order was already off course.

 The lack of coordination between the Program Office and 

the OCIO to oversee the vendor resulted in the SBA 

de-scoping a T&M contract that only requires a vendor to 

provide best effort.

Consistent and Knowledgeable Contracting Staff

In October 2011, the Government Accountability Office reported that a consistent and stable 

contracting staff is a critical factor for successful major systems acquisitions.19 However, significant 

turnover occurred at the SBA and with vendor contracting staff during management of the OneTrack 

system acquisition. Additionally, the contract oversight structure within the SBA created confusion, and 

consistent and stable contracting staff did not exist throughout the system’s development.

1) Acquisition Division: The Acquisition Division used four different Contracting Officers over the 

course of two years for the contract award and performance. Additionally, it is unclear whether

the Acquisition Division possessed the appropriate knowledge and expertise for awarding and 

administering IT acquisitions. 

2) Government Contracts and Business Development: While the GCBD staff remained on the 

contract for the entire process, the staff works primarily with business development programs 

and does not generally work with the SBA IT systems environment. The GCBD personnel 

assigned to monitor the acquisition were split between Washington, DC, and North Carolina. 

 

18 GAO, Information Technology: Critical Factors Underlying Successful Major Acquisitions. October 2011; Washington, D.C. 

GAO-12-7. 

19 While the current value of the system is less than $2 million, FAR Subpart 2.101 defines a major system as a “combination of 

elements that will function together to produce the capabilities required to fulfill a mission need. The elements may include 

hardware, equipment, software, or any combination thereof.” The OneTrack system is one of the most important system 

development efforts undertaken by the SBA between 2010 and 2013. Additionally, the system is designed to meet the needs of

the Agency and serve the small business base by allowing them a single access to multiple programs, and will allow the SBA to

meet mission critical strategic goals and objectives. Because the OneTrack system is a mission-critical system, the standards 

and guidance for “major systems acquisitions” apply to this system acquisition.
14

3) Office of the Chief Information Officer: The OCIO should have been the main driver of the 

acquisition with the GCBD assisting the OCIO as the customer. Instead, the GCBD was the 

primary Program Office in charge of the acquisition, and the OCIO assigned a contractor to be 

the Technical Project Manager for the task order to provide technical guidance to the GCBD. 

4) Prime Contractor: The vendor used three different Project Managers over the course of the 

acquisition. One of those Project Managers worked for a subcontractor assisting with the 

performance of the contract, not the prime contractor.

Normally, an IT system procurement would be led by the OCIO with assistance from the Acquisition 

Division. The OCIO would also coordinate with the users of the system—the applicable Program 

Office(s)—to ensure the system would meet their needs. Additionally, the OCIO would provide primary 

oversight of the contractor. See Figure 4 for an illustration of this management structure.

Figure 4 Basic Contracting Staff Oversight Structure for IT Acquisitions 

 

Source: OIG analysis of Federal regulations and guidance for IT systems acquisitions.

Conversely, the SBA had a complicated oversight structure of the OneTrack system acquisition that 

involved three different SBA offices and two different ITIM contractors. Given the rate of staff turnover 

at a variety of positions, it is possible that information was shared with one Contracting Officer or with 

the Project Manager at the prime vendor but was never passed along to the next person in the oversight 

structure. See Figure 5 for a breakdown of the actual contract oversight structure. 

Acquisition Division

Office of the Chief 

Information Officer

Vendor

Internal

Customer
15

Figure 5 Actual Contracting Staff Oversight Structure for the OneTrack System

Source: OIG analysis of oversight structure for the OneTrack system development.

Appropriate Surveillance for T&M Contracts 

Throughout the performance of the task order, several areas of concern should have been identified or 

shared with the appropriate officials. Use of a T&M contract and traditional procurement methods—

rather than incorporating modular contracting methods—increased the level of risk and oversight 

required by the agency to ensure the Government receives what it purchased. Subpart 16.6 of the FAR 

states that when an agency uses a T&M contract, the agency needs to have appropriate surveillance of 

the contractor performance to give reasonable assurance that efficient methods and effective cost 

controls are being used. When the Government does not provided adequate oversight of a T&M 

contract, the performance on the contract runs the risk of becoming a best effort rather than exerting a 

full focus on the performance objectives. For example, if all of the contract funds are expended, and the 

requirements in the SOW are not completed, the vendor is not required to provide any additional work 

to the Government. Given this structure, no positive incentives exist for the vendor to meet all of the 

requirements outlined in the SOW. In other words, the vendor only needs to provide a best effort to 

meet the requirements outlined in the SOW; therefore, the SBA is not guaranteed to receive the 

deliverables outlined in the task order. Additionally, use of a traditional procurement model—instead of 

modular contracting—adds a significant degree of risk to IT systems development and modernization 

acquisitions. See Appendix IV for more information about modular contracting.

The SBA did not properly manage this acquisition at all levels—from the Program Office (GCBD) to the 

OCIO to the Acquisition Division. For example, the GCBD had concerns about the vendor’s performance 

throughout the task order, but did not notify the appropriate personnel and only tried to build a case 

against the vendor after the task order was off course. Some of the concerns dated back to early 

summer 2012; however, GCBD personnel did not present these concerns to the Acquisition Division until 

the end of 2012. See below for issues that directly impacted the cost and schedule of the project.

Acquisition Division - Denver, CO and 

Washington, DC

4 Total Contracting Officers

GCBD COR - Washington, DC

Overseeing OneTrack Vendor Performance

No Oversight of Technical PM

Government PM - North Carolina

Overseeing OneTrack Vendor Performance

Supporting the GCBD COR

OCIO COR - Washington, DC

Approving Invoices for Technical PM

No Oversight of Technical PM

Technical PM - Washington, DC

Overseeing OneTrack Vendor Performance

Employee of Another ITIM Vendor

OneTrack Vendor - Maryland

3 Different Project Managers

1 of the 3 ITIM Vendors
16

1) At the end of 2011, the contract award process required more time than identified in the 

proposed project schedule, but the CO did not extend the end date of the task order to adjust 

for the delay. Instead, the CO only awarded a 12-month task order for the performance of a 16-

month project as indicated in the project schedule and the SOW. 

2) At the Kick-off Meeting held in January 2012, the vendor proposed a final schedule with an end 

in November 2013, even though the task order period of performance expired in December 

2012. While this discrepancy was briefly discussed, the transcript and recording revealed that 

officials accepted a response from the contractor that still did not meet the performance period, 

and no further concerns were raised. However, if the SBA had completed an Integrated Baseline 

Review, this discrepancy would have been identified. See Appendix II for the schedule proposed 

by the vendor at the Kick-Off meeting. 

3) In early 2012, the vendor began to use an open-source technology that was not compliant with 

the SBA’s system architecture. Due to the GCBD allowing for the use of this unapproved opensource technology, the schedule and cost of the system were negatively impacted because the 

vendor had to perform additional, unplanned work to make the system compliant with SBA’s 

architecture. If the OCIO had a more active role in the oversight of this acquisition, it is likely 

that the OCIO staff would have recognized this issue earlier in the process, and would have been 

able to validate the system design prior to development occurring.

4) In December 2012, the vendor contacted the SBA and stated that it needed an additional 

$340,000 to provide the full system as originally designed by July 2013. If the additional funds 

could not be provided the scope of requirements would need to be decreased. At this time, the 

SBA did not provide the vendor with additional funds. This proposal by the vendor to add funds 

or de-scope the project should have been another signal that the system development was not 

on track. 

In January 2013, the Chief Operating Officer (COO)—who was the CIO when the OneTrack task order 

was awarded—notified the SBA Administrator of the issues surrounding the acquisition. The COO then 

started holding regular meetings, with all of the Program Offices involved, to save the project. During 

this process, one email exchange between officials alluded to the SBA not following a strict 

interpretation of federal regulations and emphasizing a good relationship with the vendor. If the OCIO 

had assumed primary responsibility for this project and been more cognizant of the status, the CIO could 

have called a TechStat meeting when major issues began to arise prior to January 2013.20 Additionally, if 

the GCBD had properly monitored the development of the system and notified the appropriate officials, 

these concerns would have triggered TechStat meetings earlier to determine the best course of action 

for the project.

The lack of coordination between the GCBD and the OCIO, as well as the Acquisition Division, to oversee 

the vendor’s performance resulted in the SBA de-scoping a T&M contract that only requires a vendor to 

provide best effort.21 Discussions to de-scope the requirements began in April 2013, but all stakeholders 

 

20 A TechStat is a face-to-face, evidence-based accountability review of an IT program that examines program data, with a focus 

on problem solving that will lead to concrete action to improve the overall performance. TechStats seek to find potentially 

failing programs sooner to increase accountability, save taxpayer money, and help yield better results. In some instance, a 

TechStat may reveal that a project be temporarily halted or terminated. 

21 The Acquisition Division completed a bilateral modification to de-scope the Statement of Work for the OneTrack task order, 

which must be signed by the vendor and the Acquisition Division. 
17

did not reach agreement until August 2013. Specifically, the GCBD did not agree with the de-scoping 

and would not prepare a new SOW. As a result, the contractor prepared a new SOW for approval by the 

SBA. Because this agreement did not occur until August 2013, the vendor only had one month 

remaining on the task order to complete the new SOW. Moreover, the SBA de-scoped the task order in 

an attempt to salvage what they could based upon the status of the system’s development, even though 

the T&M task order did not contain an obligation for the vendor to deliver a finished product. Further, 

the de-scoping also created confusion about what deliverables the SBA was entitled to receive from the 

vendor, such as the work performed on the HUBZone and Mentor-Protégé sections of the system. 

When the task order expired in September 2013, the SBA had not received a functioning system with 

capabilities equivalent to the current BDMIS system. As a result, the SBA awarded a 5-month letter 

contract to BI for an additional $300,000 to finish developing a system with BDMIS capabilities. This 

letter contract also provided additional time to complete testing to ensure the SBA accepts a working 

system before the contract expires in February 2014. Additionally, the letter contract will result in a 

fixed price contract upon definitization. Figure 6 provides a timeline of changes made to the contract 

that impacted the cost, schedule, and scope of the OneTrack system development.

Figure 6 Timeline of the OneTrack System Acquisition (December 2011 through September 2013)

Source: OIG analysis of the acquisition timeline and modifications to the task order.

Additionally, the Acquisition Division took over the responsibility of approving invoices submitted by the 

vendor in January 2013. The COR for the GCBD stopped approving invoices from the vendor due to 

identified performance issues and documentation not being submitted by the vendor as required in the 

SOW. Contrary to the views of the COR for the GCBD, Acquisition Division officials stated that the 

vendor only needed to provide the invoice with total hours performed under the T&M contract line item 

number, and did not need to provide any additional support. Upon review of the contract 

documentation, the OIG determined that while the invoice only needed to state the total hours charged 

to the T&M line item, the contractor was still required to provide the bi-weekly status reports and 

updates to the Project Plan—as required in the SOW. This information is necessary for the COR to verify 

December 

2011

•Task order 

Awarded to 

Business 

Integra for 

$1.17M to 

provide the 

OneTrack 

system with 

full capability 

by December 

2012.

January 

2012

•At the Kick-off 

Meeting the 

vendor 

presented a 

performance 

schedule with a 

final delivery of 

Nov. 2013 - 11 

months after 

the task order's 

period of 

performance.

July 2012

•Per vendor's 

request, task 

order modified 

to extend the 

period of 

performance 

from Dec. 

2012 to Sept. 

2013, and to 

increase the 

contract by 

more than 

$434,000. 

New total 

contract value 

of $1.6M.

December 

2012

•Vendor 

proposed (1) 

an additional 

$340,000 to 

provide a 

system with all 

desired 

capabilities by 

Jul. 2013 or (2) 

no change in 

funds to only 

provide a 

BDMIS-like 

system.

System Includes: BDMIS, HUBZone, and Three MentorProtégé Programs System Includes: BDMIS

Increase from $1.17M to $1.6M Increase from $1.6M to $1.9M

April 2013

•Discussion 

began to descope the task 

order to only 

provide a 

BDMIS-like 

system.

August 

2013

•Task order 

modification 

approved to 

de-scope the 

Statement of 

Work to only 

provide a 

BDMIS-like 

system.

September 

2013

•Task order 

expired 

without a 

functioning 

BDMIS-like 

system.

•The SBA 

awarded a 5-

month letter 

contract for 

$300,000 to 

provide a 

functioning 

BDMIS-like 

system.
18

what the vendor reported it had worked on. Because the vendor stopped meeting these performance 

requirements or provided a late performance, it is reasonable for the COR to question whether the 

contractor performed the total hours charged. Moreover, the status updates and reports were 

previously provided by the vendor without issue until the GCBD started raising issues about the 

performance. Further, when the Acquisition Division asked for these documents in their review of the 

invoices, the vendor had no problem providing the requested documentation.

The OCIO Did Not Provide Adequate Oversight to Ensure Contractors Did Not Perform 

Inherently Governmental Functions

In accordance with federal regulations and guidance,22 the OCIO should have been the primary Program 

Office procuring this IT system representing the GCBD as its customer. We found that the OCIO assigned 

a contractor to provide program and management support activities for the OneTrack task order, and 

the OCIO did not properly oversee the contractor’s performance. This lack of oversight increased the 

potential for a contractor to perform inherently governmental-like functions and increased the risks 

associated with the contract. See Table 4 for an analysis of the federal contract requirements and good 

practices for the performance of inherently governmental functions during the OneTrack system 

acquisition.

Table 4 Performance of Inherently Governmental Functions

Contracting Requirement or Good Practice What Happened

Oversight of Contractors Performing Inherently Governmental 

Functions: 

FAR Subpart 7.5 states that inherently governmental functions 

must be performed by a Government employee. 

When a contractor performs inherently governmental 

functions, the Government unnecessarily assumes additional 

risk.

 The Technical Project Manager (PM) assigned to the task 

order by OCIO was a contractor and not managed properly 

by the COR.

 The Technical PM allowed for changes to be made to the 

task order that were not compliant with the SBA IT 

systems environment. 

 The COR from OCIO approved invoices for the Technical 

PM; however, it appears that little to no oversight of the 

Technical PM prior to approval.

Agency CIOs are required to carry out information technology management functions at their respective 

agency, which would include spearheading all major IT acquisition efforts.23 However, the GCBD had to 

take on the acquisition of a major IT system that is essential to the work completed by the SBA. When 

 

22 40 U.S.C. 11315 and 44 U.S.C. 3506(a). The major departments and agencies that the Clinger-Cohen Act applies to are listed 

in 31 U.S.C. 901(b) and includes the Small Business Administration. In September 2011, the U.S. Government Accountability 

Office issued a report that provides a detailed explanation of the duties of the Chief Information Officer. GAO, Federal Chief 

Information Officers: Opportunities Exist to Improve Role in Information Technology Management, September 15, 2011; 

Washington, DC; GAO-11-634. Further, the Office of Management and Budget Memorandum on Chief Information Officer 

Authorities from August 8, 2011 outlines that a Chief Information Officer must deliver IT solutions that support the mission and 

effectiveness of their agency. It also states that the CIO must drive the IT investment process and have responsibility over the 

entire IT portfolio for an Agency.

23 While the current value of the system is less than $2 million, FAR Subpart 2.101 defines a major system as a “combination of 

elements that will function together to produce the capabilities required to fulfill a mission need. The elements may include 

hardware, equipment, software, or any combination thereof.” The OneTrack system is one of the most important system 

development efforts undertaken by the SBA between 2010 and 2013. Additionally, the system is designed to meet the needs of 

the Agency and serve the small business base by allowing them a single access to multiple programs, and allow the SBA to meet

mission critical strategic goals and objectives. Because the OneTrack system is a mission-critical system, the standards and 

guidance for “major systems acquisitions” apply to this system acquisition.
19

the GCBD contacted the OCIO for support, the OCIO assigned a contractor as the Technical Project 

Manager (Technical PM) rather than assigning a Government employee. If a contractor performs 

functions relating to professional and management support activities, that contractor may be 

performing activities closely aligned to inherently governmental functions. These activities can include 

acquisition planning, development of the Statement of Work, or evaluation of another contractor’s 

performance. Federal regulations state that inherently government functions must be performed by a 

Government employee.24 When contractors perform these functions, there is a risk of inappropriately 

influencing the Government’s control over and accountability for decisions that may be based, in part, 

on contractor work. Due to this risk, contractors must be monitored to ensure that inherently 

governmental functions are not performed. Additionally, the SBA did not properly manage the 

contractor to ensure that any decisions made did not have an adverse effect on the Agency or the 

acquisition thus allowing for increased risk to be placed on the contract success. 

Confusion existed among SBA Program Offices as to who was monitoring the performance of the 

Technical PM, and therefore, the contractor was not managed properly by the COR from OCIO. This 

confusion and limited oversight allowed for the following issues to occur:

1) The OCIO believed that a GCBD staff had been assigned as the COR, and the GCBD staff believed 

that an OCIO staff had been assigned as the COR. We found that a representative from OCIO 

had been approving the hours submitted for payment for the Technical PM. Specifically, it 

appears that little to no oversight was completed to ensure that the Technical PM was providing 

satisfactory work. Additionally, it does not appear that any review occurred to ensure that the 

Technical PM had performed the work paid for by the SBA prior to the OCIO approving invoices. 

Officials from GCBD stated that the OCIO never asked for feedback on the Technical PM’s

performance. 

2) The Technical PM and the BI’s Project Manager previously worked for the same company, which 

increased the risk associated with decisions and guidance made by the Technical PM. 

Additionally, BI’s Project Manager was employed by two companies through February 2012—

both were providing the SBA with IT services through the ITIM contract vehicle. While this 

overlap was identified, GCBD officials stated that the Contracting Officer verbally approved this 

arrangement. However, the SBA did not provide for proper safeguards to minimize risk. As a 

result, the SBA was billed for the same employee by two different companies. 

3) The Technical PM advising the GCBD made decisions that impacted the schedule of the task 

order. Officials from the OCIO stated that at one point, they tried to remove the Technical PM 

because the contractor approved work that did not align with the SBA’s IT systems environment. 

However, the OCIO was unable to support the removal of the Technical PM because the OCIO 

did not have the performance documentation required. If the OCIO had properly managed the 

performance of the Technical PM, the contract file would have included the necessary 

performance documentation needed for removal.

 

24 FAR Subpart 7.5 – Inherently Governmental Functions. See also GAO-10-357 for more information on inherently 

governmental functions, and contractors overseeing other contractors. GAO, Contingency Contracting: Improvements Needed 

in Management of Contractors Supporting Contract and Grant Administration in Iraq and Afghanistan, April 12, 2010; 

Washington, D.C.; GAO-10-357.
20

Conclusions

Federal contracting laws and regulations provide specific requirements designed to safeguard the 

Government and mitigate risk. However, the SBA did not follow the requirements and guidance 

outlined for the planning and procurement of a mission-critical IT system because it did not appear to 

conduct adequate market research, use the appropriate contract procedures, or select the best 

contracting vehicle. As a result, the SBA added unnecessary risk to the acquisition of the OneTrack 

system and created a need for increased management and surveillance of the contractor’s performance. 

If the SBA had followed federal requirements to conduct the commensurate market research and select 

the correct contracting vehicle, the SBA would have increased its likelihood for success and limited risk. 

The use of information technology can increase the efficiency and effectiveness of a federal agency if 

planned for and acquired in compliance with federal regulations. When procuring mission critical 

systems, it is essential that the CIO take a key role in these efforts—based upon the Clinger-Cohen Act. 

If agencies do not follow federal regulations and guidance for IT systems acquisition undue risks are 

placed on the procurement and the likelihood for success decreases. The evidence of a lack of direction 

by the CIO and a lack of planning for the procurement of the OneTrack system resulted in the SBA not 

obtaining an operating system at the end of the task order. As a result, the SBA had to award another 

contract to procure services that were originally included in the first task order. Additionally, the 

demand for a functioning system in the near-term required the SBA to use the ITIM contract again—

even though the use of this contract vehicle previously culminated in unsatisfactory results. 

Recommendations

We recommend the Chief Information Officer, the Chief Acquisition Officer, and the Associate 

Administrator for GCBD should:

1) Conduct a requirements analysis in addition to a cost assessment of the system to determine what 

still needs to be developed to achieve the objectives of the final system.

2) Award a fixed price contract for any additional work performed in the development and 

implementation of the OneTrack system.

3) Ensure that only Government employees—not Government contractors—provide oversight of any 

additional contracts used to develop and implement the OneTrack system.

2) The SBA Must Complete System Testing and Deployment Activities 

In accordance with SBA guidelines, the SBA’s System Development Methodology (SDM), or its 

equivalent, must be used on all IT system development projects related to SBA programs. 25 The SDM 

aligns with Clinger-Cohen Act guidance related to IT systems and outlines classes of system acceptance 

testing that should be executed prior to system implementation. These tests include requirements 

validation, functional testing, stress testing, security testing, ease of use testing, operational testing, and 

 

25 The SDM is required by the SBA on all major system projects under the Clinger-Cohen Act. 40 U.S.C. 11315 and 44 U.S.C. 

3506(a). The major departments and agencies that the Clinger-Cohen Act applies to are listed in 31 U.S.C. 901(b) and includes 

the Small Business Administration. Further, OMB Circular A-130 provides additional guidance on completing the system 

development life cycle. 
21

interface testing. Compliance with SDM requirements was stipulated in the OneTrack SOW, which 

stated planning and activities, and product deliverables would comply with SDM. 

We found that comprehensive testing outlined by the SDM was not performed to provide adequate 

assurance that an acceptable level of performance would be attained by the OneTrack system. As a 

result, the SBA could not ensure that essential requirements were met, or that the newly designed 

system could handle adequate volumes of transactions. Further, the SBA could not ensure that the 

system properly interfaced with other systems operated by the SBA or other organizations. At the 

conclusion of the OneTrack task order, the project had only completed user acceptance testing. 

Before moving to the Evaluate Phase of SDM, the project must have successfully completed the system, 

integration, and documentation from the Build and Test Stage, and have been judged acceptable by 

project, technical and management review. The SDM further requires SBA’s IT governance board to 

oversee and approve a project’s advancement into the next development phase. 

The Evaluate Phase of the SBA’s SDM is the period in which independent testers measure the system's 

ability to perform the functions that are required by the user and ensure an acceptable level of 

performance. After this phase of development is completed, a clear indication of the system's readiness 

for operation is evident. We found that testing protocols identified in the Evaluate Phase of the SBA’s 

SDM were not completed for the OneTrack project. These tests measure the system’s ability to perform 

the functions that are required by the user and ensure an acceptable level of performance. 

For example, documentation testing evaluates system documentation for relevance, completeness, and 

accuracy against actual operation of the system. At the end of the OneTrack task order, we observed 

that only “user acceptance” testing was performed. These are scripted tests performed by the users 

during the Build Phase and are not equivalent to system acceptance tests. Also, the revised OneTrack 

SOW excluded unit functional test documentation, reporting, and operation manuals. The SDM requires 

system performance be fully tested prior to moving the software into a production environment, so it is 

unclear why the SOW excluded unit and functional test documentation, even though it was required. 

Conclusion

Comprehensive testing outlined in the SDM was not performed to provide adequate assurance that an 

acceptable level of performance would be attained by the OneTrack system. Without performing the 

additional types of tests or having oversight of any additional tests performed by the contractor, the SBA 

could not ensure that essential requirements were met. The SBA also could not ensure that the system 

could handle adequate volumes of transactions, or that the system properly interfaced with other 

systems operated by the SBA or other organizations.

Recommendations

We recommend the Chief Information Officer and Associate Administrator for GCBD:

4) Ensure all appropriate provisions (e.g. testing, conversion, and installation procedures) of the SDM 

guidance are met prior to placing OneTrack into production.
22

Agency Comments and Office of the Inspector General Response

On December 17, 2013, we provided a draft of this report to the Agency for comment. Three of the 

recommendations were directed to the Chief Information Officer, the Chief Acquisition Officer, and the 

Associate Administrator for GCBD. The fourth recommendation was directed to the Chief Information 

Officer and the Associate Administrator for GCBD. The Office of Government Contracts and Business 

Development provided its comments on January 23, 2014, which are included in their entirety in 

Appendix V. On January 24, 2014, the Chief Operating Officer informed the OIG that the CIO would not 

be providing official comments because we previously addressed their concerns. The Office of the Chief 

Financial Officer provided its comments on January 16, 2014, which are included in their entirety in 

Appendix VI. Management concurred with all four recommendations. A summary of management’s 

general comments to the report, recommendation-specific comments, and our response follows.

General Management Comments from the Office of Government Contracts and Business Development

The Office of Government Contracts and Business Development concurred with all of our 

recommendations, and provided additional comments regarding some of the information presented in 

the draft report. The Associate Administrator for GCBD raised issue with our finding that his office did 

not provide adequate oversight of the project. Specifically, he stated that GCBD personnel worked 

closely with the vendor on a daily basis and contract performance issues were articulated to the 

Contracting Officer during weekly progress meetings. However, in many instances, the Contracting 

Officer either ignored or undermined their efforts to oversee the vendor’s performance. 

The Associate Administrator for GCBD also stated that personnel from his office suggested to the 

Acquisition Division staff—in the same planning meeting referenced in the table on page 6—that a timeand-materials (T&M) contract should be used for the design phase and a fixed price contract for the 

development phase of the project. The Associate Administrator acknowledged that this structure would 

have coincided with modular contracting principles.

Moreover, the Associate Administrator stated that Acquisition Division staff advised GCBD personnel 

about the required use of the ITIM contract vehicle for this procurement. Because they were required 

to use this contract vehicle, limited market research was completed.

Finally, during the Technical Evaluation of the two contract proposals, the technical evaluation panel 

notified the Contracting Officer about the labor category discrepancies and also raised concerns about 

the price disparity between the two proposals. They were told by the Contracting Officer to move 

forward in the contract award process. 

OIG Response to GCBD

We stand by our findings that the GCBD did not properly manage this acquisition. While various levels 

of documentation were provided, we do not believe this documentation provides sufficient evidence of 

oversight and coordination with the Acquisition Division or the OCIO. 

For example, based upon our review, disagreements with the Contracting Officer did not occur until 

December 2012—when the contract was already off course. Additionally, the minutes of the acquisition 

planning meeting referenced in the Associate Administrator’s statement do not support his comments. 

The minutes only show that GCBD personnel wanted to use a firm-fixed price contract and there were 
23

no references to using a T&M contract or a design and development phase for the procurement. 

Additionally, the GCBD did not provide the OIG with any documentation to support this assertion during 

the review.

While GCBD personnel mentioned that they were required to use the ITIM contract during previous 

interviews, we were not able to corroborate this information. We could not find any SBA policy 

dictating that the ITIM contract vehicle be used for an IT system procurement. For example, another IT 

system procured by the GCBD did not have to utilize the ITIM contract vehicle. Moreover, when we 

spoke with personnel from the Acquisition Division and the OCIO, no one stated that use of the ITIM 

contract was a requirement. Further, because the Contracting Officer who awarded the contract is no 

longer with the agency, we could not determine if he provided this guidance to the GCBD.

We found no information in the contract file regarding possible discrepancies during the contract award 

process. Also, the GCBD did not provide any supplemental documents to support their contention 

regarding the difference in labor categories or significant price difference in the contract proposals. 

Further, the Contracting Officer who awarded the contract is no longer with the SBA, and therefore, we 

could not verify these statements.

General Management Comments from the Office of the Chief Financial Officer 

The OCFO agreed with all of our recommendations, but indicated that the report should be updated to 

show that the Contracting Officers were located in both Denver, CO, and Washington, DC. Additionally, 

the OCFO disagreed with the mention of pre-decisional discussions about the contract type because all 

parties agreed to the contract type used by signing the Acquisition Strategy.

OIG Response to OCFO

The OIG modified the graphic on page 15 of the report to reflect that the Acquisition Division was 

previously located in Washington, DC. Additionally, agency acquisition personnel should have the 

appropriate knowledge of procurement policies to advise program officials of the best contract vehicle 

based upon the type of goods and/or services being procured. In this instance, the program office 

wanted to use a firm-fixed price contract, but was advised to use a different contract method.

We made the following recommendations to the Chief Information Officer, the Chief Acquisition Officer, 

and the Associate Administrator for GCBD:

Recommendation 1 – Conduct a requirements analysis in addition to a cost assessment of the system 

to determine what still needs to be developed to achieve the objectives of the final system.

Management Comments

The Chief Financial Officer, the CIO and the Associate Administrator for GCBD concurred with 

this recommendation. Additionally, the CFO stated that the SBA has already completed the 

requirement analysis. Alternatively, the Associate Administrator for GCBD stated that 

implementation of Recommendation 1 and further system development would be predicated on 

the availability of funds.
24

OIG Response

Management’s comments were responsive to our recommendation. We consider 

this recommendation resolved but open pending completion of final action. 

Recommendation 2 – Award a fixed price contract for any additional work performed in the 

development and implementation of the OneTrack system.

Management Comments

The CFO, the CIO, and the Associate Administrator for GCBD concurred with this 

recommendation. Additionally, the CFO stated that it awarded a fixed price definitized letter 

contract to complete work on the OneTrack system.

OIG Response

Management’s comments were responsive to our recommendation. Management provided a 

copy of the fixed price definitized letter contract, and we determined this action met the intent 

of the recommendation. We consider this recommendation resolved and closed based on the 

management decision and final action.

Recommendation 3 – Ensure that only Government employees—not Government contractors—

provide oversight of any additional contracts used to develop and implement the OneTrack system.

Management Comments

The CFO, the CIO and the Associate Administrator for GCBD concurred with this 

recommendation. No specific comments were provided in response to this recommendation.

OIG Response

Management’s comments were responsive to our recommendation. We consider this 

recommendation resolved but open pending completion of final action.

We made the following recommendation to the Chief Information Officer and the Associate 

Administrator for GCBD:

Recommendation 4 – Ensure all appropriate provisions (e.g. testing, conversion, and installation 

procedures) for the SDM guidance are met prior to placing OneTrack into production.

Management Comments

The CIO and the Associate Administrator for GCBD concurred with this recommendation. No 

specific comments were provided in response to this recommendation.
25

OIG Response

Management’s comments were responsive to our recommendation. We consider this 

recommendation resolved but open pending completion of final action.
26

Appendix I: Scope and Methodology

During the course of completing a review of the OneTrack system for compliance with IT governance 

principles, we identified possible acquisition issues with the OneTrack system in June 2013. Accordingly, 

we modified the scope of our review to focus on these acquisition issues. To determine if the SBA 

followed acquisition regulations in the procurement of the system, we completed a site visit to the 

Denver Finance Center in July 2013 to obtain all available contract documentation for the OneTrack task 

order. We also obtained contract documentation for all three vendors on the Information Technology 

Information Management (ITIM) multi-award contract. We also met with Acquisition Division officials 

and staff directly involved with the procurement of the OneTrack system. In addition, we met with 

officials and staff in the Office of the Chief Information Officer and the Office of Government Contracting 

and Business Development. 

We reviewed contract documentation for the OneTrack task order, and the contract documentation for 

all three vendors on the ITIM multi-award contract. Review of the contract documentation included all 

base contracts and task orders awarded during the period of performance and any invoices submitted 

for the performance of work. We identified laws and federal regulations, including the Clinger-Cohen 

Act and Federal Acquisition Regulations that govern the acquisition of IT systems. We also identified 

internal agency guidance to determine if the SBA had any additional requirements for IT system 

acquisitions. Further, we reviewed reports issued by other auditing agencies, such as the U.S. 

Government Accountability Office and Offices of the Inspector General at other federal agencies. 

Additionally, we identified guidance from the Office of Management and Budget for the acquisition of IT 

systems.

We conducted our review of acquisition issues for the OneTrack system between June 2013 and 

September 2013.

Use of Computer-Processed Data

For the purposes of this review, we did not use computer-processed data to support our findings. 

Prior Coverage 

U.S. Government Accountability Office Audit Reports

Report GAO-12-7, Information Technology: Critical Factors Underlying Successful Major 

Acquisitions, issued October 21, 2011

Report GAO-11-634, Federal Chief Information Officers: Opportunities Exist to Improve Role in 

Information Technology Management, issued September 15, 2011
27

Appendix II: Deliverables Schedule Agreed To by Contractor at Kick-Off 

on January 19, 2012

Milestones CLIN # Start Date Finish Date

Initiation, Planning, and kick-off CLIN 0002 January 2012 Thursday, March 01, 2012

Manage Software Requirements

JAD Sessions

Detailed processes and workflows

Detailed functional requirements

CLIN 0003 Friday, March 02, 2012 Thursday, April 12, 2012

Manage Infrastructure Requirements CLIN 0004 On Going On Going

BDMIS, HCTS, Support Applications 

Data Analysis, Requirements, and 

Migration

CLIN 0005 Friday, April 13, 2012 Monday, June 18, 2012

System Analysis, Design, and 

Development

CLIN 0006a Tuesday, June 19, 2012 Wednesday, October 03, 2012

Reporting Requirements, Design, and 

Configuration

CLIN 0007a Thursday, October 04, 2012 Wednesday, January 02, 2013

Original Period of Performance on the Task Order Expired on 12/14/201226

Milestones CLIN # Start Date Finish Date

Reporting Configuration CLIN 0007b Thursday, January 03, 2013 Friday, March 29, 2013

Quality Assurance/Testing CLIN 0008 On Going On Going

Software Migration to SBA CLIN 0009 Thursday, January 03, 2013 Friday, March 29, 2013

Certification and Accreditation CLIN 0010 Friday, January 25, 2013 Friday, March 29, 2013

User Acceptance Testing CLIN 0011 Friday, March 29, 2013 Thursday, April 25, 2013

End User (Internal and External) 

Training

CLIN 0012 Friday, April 26, 2013 Thursday, May 23, 2013

SBA Final System Sign-off and 

Acceptance

CLIN 0013 Friday, May 24, 2013 Thursday, November 14, 2013

Modified Period of Performance on the Task Order Expired 09/20/2013

Milestones CLIN # Start Date Finish Date

C&A Annual Follow-on Work 

(Separate Task Order)

CLIN 0014 TBD TBD

Source: OIG presentation and analysis of SBA contract documentation.

 

26 The total task order schedule should have taken 16-months; however, the task order period of performance was incorrectly 

awarded for only 12-months.
28

Appendix III: Use of Time-and-Materials Contracts by Federal Agencies

Contracting Officers Select Contract Type

Generally, the Contracting Officer (CO) selects the contract type for a particular procurement and 

typically decides on the contract type prior to issuing a solicitation. This decision is made after

considering a range of factors including: (1) the degree of price competition in the procurement; (2) the 

type and complexity of the requirements; (3) the urgency of the requirements; (4) the period of 

performance or length of the production run; and (5) the history of the acquisition. Most reports issued 

by the Federal Government about agencies’ use of particular types of contracts allege not that the type 

used was unlawful but that it was imprudent. Typically, the types of contracts used were imprudent 

because they left the Government vulnerable to paying too much, especially if agency oversight of 

contractor performance was inadequate.

T&M Contracts May Be Used When No Other Contract Option Is Suitable

If agencies are not at prepared to award a fixed price contract or a cost reimbursement contract for a 

given project, then agencies should consider a small, short duration (less than one year), Time and 

Materials (T&M) or Labor Hour type of contract for that project. In a T&M contract, the contractor is 

paid a fixed hourly rate for direct labor expended during the contract’s performance (e.g., wages, 

overhead, general and administrative expenses, profit), as well as the actual cost of materials. 

The materials covered by a T&M contract can include direct materials, subcontracts for supplies or 

incidental services, other direct costs, and applicable indirect costs. Further, T&M contracts may be 

imbedded in the prime contract for short-duration, unquantifiable work, but never used as the primary 

vehicle for the delivery of products or services. Moreover, T&M contracts are not appropriate for major 

acquisitions that have passed the planning stage, and should only be used when insufficient knowledge 

about the requirement does not allow the agency to be able to use a cost reimbursement contract to fill 

the requirement. Additionally, a T&M contract should only be used when it is not possible at the time of 

the contract award to estimate accurately the extent or duration of the work, or to anticipate cost with 

any reasonable degree of confidence. 

Federal Acquisition Regulations (FAR) authorizes agencies to use T&M contracts only when the parties 

cannot accurately estimate the extent or duration of the contract’s work, or reasonably estimate the 

costs of the contract, at the time of contracting, and the contract includes a ceiling price that the 

contractor exceeds at its own risk. Additionally, the CO must prepare a determination and findings 

(D&F) proving that “no other contract is suitable” and must: 

(1) Include a description of the market research that was conducted to reach this conclusion; 

(2) Establish that it is not possible at the time of contracting or ordering to accurately estimate 

the extent or duration of the work or anticipate the costs; 

(3) Establish that the requirement has been structured to maximize use of firm-fixed-price or 

fixed-price with economic price adjustment contracts in future acquisitions for the same 

requirements (e.g., limiting the length of the contract); and 

(4) Describe plans to maximize the use of firm-fixed-price or fixed-price with economic price 

adjustment contracts in future acquisitions.
29

Additionally, Subpart 16.6 of the FAR state that when an agency uses a T&M contract, the agency needs 

to have appropriate surveillance of contractor performance to give reasonable assurance that efficient 

methods and effective cost controls are being used. This surveillance is required because T&M contracts 

provide no positive profit incentive to control their costs or efficiency. Further, FAR Subpart 52.232-7(d) 

states that total costs for the performance of the contract shall not exceed the contract ceiling, and the 

contractor agrees to use its best efforts to perform the work specified in the contract and all obligations 

under the contract within the contract ceiling price. When the Government does not provided adequate 

oversight of a T&M contract, the performance on the contract becomes a best effort rather than full 

performance. For example, if all of the contract funds are expended, and the requirements in the SOW 

are not completed, the vendor does not have to provide any additional work to the Government. Given 

this structure, no positive incentives exist for the vendor to meet all of the requirements outlined in the 

SOW. If the contractor or the Government at any point believes that the total costs will be substantially 

greater or less than the original ceiling, the opposite party should be notified and a new total cost 

developed. Basically, the clause states that the contractor is not required to provide the exact 

deliverables as identified in the contract; it must only provide a best effort to meet those deliverables to 

be paid—i.e., the Government is not guaranteed to receive the deliverables for which they are paying.

T&M Contracts Require Increased Oversight

For major IT development efforts, program management cannot be viewed as a part-time effort or 

additional duty. It requires a dedicated Program Manager (PM) leading a team of highly trained and 

experienced personnel. The team should also be familiar with and apply sophisticated management 

techniques such as “earned value reporting,” strong configuration management, and other performance 

measuring tools. The knowledge, skills, talent, and experience of the program team remain a key 

determinant of a successful IT development program. 

Figure 7 below outlines a list of activities that should be focused on by Program Managers during 

program management planning.

Figure 7 Planning Activities for Non-Technical and Technical Program Managers

Source: OIG presentation of Federal guidance for planning activities of non-technical and technical program managers.

Non-Technical Program Management Activities

•Developing a program management plan as the 

conceptual basis for program execution.

•Planning and controlling the framework, milestone 

schedules, reporting, risk management, etc.

•Systematically scheduling all steps and products 

required for appropriate visibility, assignment, 

identification, and tracking.

•Gathering information to support decision making.

•Reviewing input from team members and 

contractors on all activities

Technical Program Management Activities

•Controlling the system design so that all elements 

are integrated into the optimum system.

•Using configuration management to identify 

functional/physical characteristics (baselining), 

control changes, record/ report changes.

•Measuring and reviewing technical performance.
30

There are three key elements that are normally associated with any project: performance, cost, and 

schedule. An effective program management control system should provide data that indicates 

conclusive work progress and relevant cost, schedule, and technical performance characteristics. To 

enable the Government to monitor performance in terms of cost and schedule, the contractor should be 

required to submit periodic reports that inform the Program Office of the actual progress of the project. 

Additionally, Earned Value Management (EVM) is required on IT systems acquisition contracts if they are 

used for development work.
31

Appendix IV: Modular Contracting Principles

Planning for IT Acquisitions

After completing the requirement analysis, conducting market research, and understanding the program 

constraints, contingencies, and system design, the Program Manager, the CO, and other members of the 

Program Office work together to craft the appropriate contracting approach. The key to success is to 

craft a contract strategy that can accommodate rapid changes in technology, increased interoperability 

and integration risk, and potentially, multiple contractors. With the use of modular contracting, the 

agency acquisition strategy should divide the work for large IT contracts into discrete, contractual 

segments with firm, short-term performance, cost, and schedule objectives. Additionally, FAR Subpart 

39.103(d) states that COs will choose the appropriate contracting technique for the particular 

circumstances (e.g., indefinite delivery, indefinite quantity (IDIQ), single-award contracts with options, 

successive contracts, multiple award task order contracts, etc.). Additionally, the contracting technique 

should facilitate the acquisition of subsequent increments. Whatever the contractual approach, the FAR 

requires that contract(s) be structured to ensure that the Government is not required to procure 

additional increments. One important aspect of any contract strategy is the proper allocation of risk. 

The selection of contract type is one means of determining the extent to which the Government and 

contractor share risk. A major factor in determining the amount of risk present in a requirement is the 

amount of “unknowns” it contains. For example, system design and requirements definition efforts have 

more unknowns and are usually higher-risk tasks than coding and testing or acquiring commercial-offthe-shelf goods or services. 

For long-duration contracts that include significant development, it may be impossible to estimate the 

cost of performing the entire contract with sufficient accuracy to use a fixed price or structured 

incentive contract from day one. Therefore, it may be desirable to initiate the work with a small, shortduration T&M or cost-plus, fixed-fee contract for studies or early design. Upon completing the design 

phase, an agency can evolve to a cost plus award fee or cost-plus incentive fee contract for later design 

and initial development. Finally, the agency may then want to use a cost plus incentive fee, fixed price 

incentive, or fixed price contract for the initial and production units once all development work is 

complete. As the contract progresses and the ability to estimate the cost of performance increases, the 

use of fixed-price or cost-reimbursement contracts becomes more practical. Therefore, it may be 

desirable to initiate the IT systems development work with a small, short-duration T&M or cost-plus, 

fixed-fee contract for studies or early design, and evolve to a cost plus award fee or cost plus incentive 

fee contract for later design and initial development. For the initial and production units once all 

development work, use of a cost plus incentive fee, fixed price incentive, or fixed price contract is 

recommended. For contracts awarded to plan or design an IT system, it also may be desirable to 

negotiate an estimated cost or price in increments. The initial estimated cost or price would be for the 

studies or early design. As work progresses to develop the system, the estimated cost or price should be 

renegotiated upward at appropriate points in the contract, as those costs become more predictable. If 

an agency awards a contract at an estimated cost or price substantially less than the probable cost of 

performing the contract, the likelihood that the Government will receive the product or service on time 

and within the cost estimates decreases.
32

Using Modular Contracting Principles for Large Scale IT Acquisitions

The current statutory preference for modular contracting is the result of a considerable history of highprofile, multi-billion dollar failures of “grand design” information technology (IT) development efforts. 

The “grand design” approach to IT development often resulted in systems that were extremely 

expensive, fielded years behind schedule (if at all), provided less than the desired capabilities, and were 

most often technologically outdated by the time they were implemented. Modular contracting is now 

the preferred method for acquiring major developmental IT systems. It is most effectively applied when 

a requirement can be satisfied in successive acquisitions of interoperable increments completed every 

6-12 months. In its simplest terms, modular contracting is the acquisition of a major IT system through 

smaller, successive increments of interoperable modules. Under modular contracting, an executive 

agency’s need for a system is satisfied in successive acquisitions of interoperable increments. 

Each increment complies with common or commercially accepted standards applicable to IT so that the 

increments are compatible with other increments comprising the system. For example, an enterprisetype system comprised of multiple business component programs would be an ideal candidate for the 

modular approach, and the lack of a modular approach can lead to interface and interoperability risks 

and requires more oversight of the contractor. 

Alternatively, the difficulties associated with the traditional procurement process for the IT acquisition 

process can be attributed to the fact that traditional procurements require that agencies “solve” the 

entire operational problem during the pre-award source selection. For example, offerors are asked to 

propose and price the design, development, test, and implementation of a software system that, in 

many cases, has not been fully defined or understood. Once the contract is awarded, these estimates 

and assumptions became the baseline requirements by which the success or failure of the program is 

measured. While the standard procurement model is suitable for numerous types of federal 

acquisitions, it adds a significant degree of difficulty to large-scale IT systems development and 

modernization acquisitions. This difficulty arises from limitations in the standard model, which does not 

allow for the higher magnitude complexities, risks, uncertainties, and rate of technological change 

inherent in large-scale IT development efforts. Modular contracting is intended to reduce program risk 

and to incentivize contractor performance while meeting the Government’s need for timely access to 

rapidly changing technology. 
33

Appendix V: Comments from the Office of Government Contracting and 

Business Development

DATE: January 23, 2014

TO: Robert A. Westbrooks, Deputy Inspector General

FROM: A. John Shoraka

Associate Administrator

Office of Government Contracting and Business Development

SUBJECT: Response to OIG Draft Report

Thank you for the opportunity to respond to your Draft Report, PROJECT NO. 13011, entitled, “Review of 

the OneTrack System Acquisition” (The Report). Based on our review, we are providing the following 

comments:

 The Report notes that the Clinger-Cohen Act introduced modular contracting as a guiding 

principle for IT acquisitions to be used to the maximum extent practicable. You state “Modular 

contracting principles require federal agencies to divide their IT acquisition into smaller pieces 

that allow for the flexibility to adapt with rapidly changing IT capabilities.” The Report further 

notes that the minutes of an acquisition planning meeting indicate that GCBD personnel asked 

Acquisition Division officials about the possibility of using a fixed price contract. However, the 

Acquisition Division officials told GCBD personnel that a fixed price contract could not be used 

because the requirements for the system were too undefined, and that a T&M task order must 

be used. This in fact, is partially correct. In this meeting GCBD personnel suggested that the 

design phase of the project be awarded via a T & M contract and that the development phase of 

the project be awarded fixed price. This approach would have coincided with the modular 

contracting approach described in your report and would have mitigated the concerns noted by 

the contracting officer regarding the degree to which the requirements were defined.

 In the area regarding Market Research, The Report indicates that the extent to which the SBA 

conducted market research or why the agency used the ITIM multi-award contract could not be 

determined based upon the documentation provided by the Office of Government Contracting 

and Business Development (GCBD) and the Acquisition Division personnel. In this regard, the 

market research that was conducted was very limited. In its acquisition strategy GCBD originally 

proposed that the award be made via a competitive procurement pursuant to Section 8(a) 

procedures. However, GCBD was advised by the acquisition staff that it would be required to 

use the existing Agency ITIM multi-award contract, thereby limiting market research. GCBD is 

unaware of why this was stipulated as a requirement.

U.S. SMALL BUSINESS ADMINISTRATION

WASHINGTON, D.C. 20416
34

 In respect to the technical evaluation of the proposals, note that while consideration was given 

to the disparity in the price proposals by the Technical Evaluation panel, the more expensive 

proposal was not rated as highly by the technical evaluation panel. Further, additional 

questions were asked of the low bidder to ensure that the Government’s requirement was fully 

understood. Based on the additional questions asked, discussions and the ability for the firm to 

ask clarifying questions, the determination was made that the vendor understood the 

government’s requirement. Also noteworthy is that the low bidder included in the proposal a 

partner who previously performed a review of the BDMIS system and the HUBZone system. At 

that time there was no indication that the bidders didn’t understand the government’s 

requirement. Both proposals demonstrated that the bidders had familiarity with the 

government’s requirement. It was not until the Awardee’s request for additional funding was 

denied that it asserted that it did not fully understand the requirements of the contract. 

Also, the Contracting Officer was notified of the labor class discrepancy and the technical 

evaluation panel was verbally told that contract award to the low bidder could continue. Finally, 

the technical evaluation panel was not provided a copy of the ITIM contract although it was 

requested.

The technical evaluation panel did raise concerns regarding the disparity in the vendor price 

proposals to the Contracting Officer and the decision was made to move forward in the process. 

As mentioned earlier technical reviewers with an IT background suggested that the price 

difference could be caused by the types of tools proposed by the higher bidder.

 The Report indicates that SBA did not properly manage this acquisition at all levels—from the 

Program Office (GCBD) to the OCIO to the Acquisition Division. For example, the GCBD had 

concerns about the vendor’s performance throughout the task order, but did not notify the 

appropriate personnel and only tried to build a case against the vendor after the task order was 

off course. Some of the concerns dated back to early summer 2012; however, GCBD personnel 

did not present these concerns to the Acquisition Division until the end of 2012. 

Throughout this project the GCBD worked closely with the Vendor on a daily basis. Additional 

there were weekly formal progress meetings held with the Vendor that included the Contracting 

Officer assigned at that time. During these meetings the GCBD concerns were clearly 

articulated. At all times the Contracting Officer was aware of the program office concerns. 

However, in many instances, the Contracting Officer would contradict the project team; ignore 

information provided by the project team, and, disregard OMB guidance regarding Information 

Technology acquisitions. More importantly, the efforts of the program office were significantly 

impacted by the Contracting Officer’s independent telephone conversations with the vendor 

following regular scheduled weekly meetings. Although the Contracting Officer participated in 

the schedule meeting, subsequent independent telephone conversations were held with the 

vendor wherein the vendor was advised to not follow directions or respond to request made by 

the program office. This was evidenced on many occasions when the program office was told by 

the vendor that they were told by the Contracting officer that they were not required to 

respond to a program office request.

 On a final note, The Report states, “In early 2012, the vendor began to use an open-source 

technology that was not compliant with the SBA’s system architecture. Due to the GCBD 

allowing for the use of this unapproved open-source technology, the schedule and cost of the 
35

system were negatively impacted because the vendor had to perform additional, unplanned 

work to make the system compliant with SBA’s architecture.” In this regard, it should be noted 

that the open source technology was clearly allowed for in the OCIO new application 

infrastructure page on the CASE environment. Further the use of open source technology was 

included in the low bidder’s proposal. There was representation from OCIO on the technical 

evaluation panel and it was not voiced that open source technology was prohibited. 

In conclusion, GCBD concurs with the recommendation contained in this report. However, 

implementation of Recommendation No. 1 and further system development are predicated on the 

availability of funds.
36

Appendix VI: Comments from the Chief Acquisition Officer

To: Robert Westbrooks

Deputy Inspector General

From: Jonathan Carver

Chief Financial Officer

Date: January 16, 2014

Re: CFO Comments to Draft Report on “The SBA Did Not Follow Federal Regulations and 

Guidance in the Acquisition on the OneTrack System”, Project 13011

The Office of the Chief Financial Officer (OCFO) appreciates the opportunity to respond to the draft 

report “The SBA Did Not Follow Federal Regulations and Guidance in the Acquisition on the OneTrack 

System, Project 13011.” We reviewed the report and appreciate that you addressed a number of 

concerns we raised from our review of the discussion draft. 

OCFO however still disagrees with statements in the report that lay blame on acquisition personnel for 

directing “the Program Office to use a T&M contract vehicle.” Pre-decisional discussions during the 

acquisition planning process are not relevant since the strategy was codified in the Acquisition Strategy 

document that was signed by all parties. 

As a point of clarification, Draft pages 13, 15 and 16 state that the Acquisition Division used four 

different Contracting Officers over the course of two years for the contract award and performance. 

While that statement is true, the report should mention that part of the reason was due to the transfer 

of a majority of the acquisition function from DC to Denver. In addition, Figure 5 on Draft page15 is not 

accurate since the original contracting officer was located in DC and remained in DC after the transfer. 

Therefore, we request that you add DC as a location for the Acquisition Division.

OCFO concurs with the three recommendations outlined in the draft report for the Chief Acquisition 

Officer, the Chief Information Officer and the Associate Administrator for GCBD. In fact, SBA has already

completed the requirements analysis and awarded a fixed price definitized letter contract to complete 

work on the OneTrack system. 

Thank you for the opportunity to review the draft report. Please let me know if you need additional 

information or have any questions regarding our response.

U.S. SMALL BUSINESS ADMINISTRATION

WASHINGTON, D.C. 20416