Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 1 of 3 | January 2018

Defense Business Systems: Acquisition of IT Systems Volume 1

Recommendation 17: Eliminate separate requirement for annual IRB 

certification of DBS investments.

Problem 

The Investment Review Board (IRB) annual certification requirement for DBS investments leads to 

unnecessary delays and is duplicative of the program objective memorandum (POM) in the planning, 

programming, budgeting, and execution (PPBE) process. PPBE is the annual resource allocations and 

requirements process used to review and approve funding decisions for the defense budget, including 

DBS investments. 

Background

The concept of an IRB as a governance mechanism to oversee DBS investments originated from the 

Financial Management Modernization Program, a 2001 initiative to modernize DoD business 

operations.1 In the FY 2005 NDAA, Congress added the statutory requirement for IRB review and 

approval for DBSs in 10 U.S.C. § 2222.2

In the FY 2012 NDAA, Congress directed the DoD Deputy Chief Management Officer (DCMO) to 

establish an IRB and investment management process for covered DBSs by March 2012.3 In response, 

DoD designated the Defense Business Council (DBC) to serve as the IRB for covered DBSs.4 In the

FY 2016 NDAA, Congress eliminated the term Investment Review Board and codified the DBC in 

10 U.S.C. § 2222(f), requiring it to “provide advice to the Secretary on developing the defense business 

enterprise architecture, reengineering DoD’s business processes, developing and deploying defense

business systems, and developing requirements for defense business systems.”5

DBC’s membership consists of the DoD DCMO; CIO; the USD(AT&L); USD for Policy; DoD 

Comptroller; USD for Personnel and Readiness; USD for Intelligence; Director of Cost Assessment and 

Program Evaluation; Joint Staff; and the Service-level DCMOs and CIOs.6

DoD uses the IRB process to certify covered DBSs and recertify them each year. DBS programs “cannot 

proceed into development (or, if no development is required, into production or fielding)” unless they 

are IRB certified.7 By law, these criteria include the following:

§ DBS must be “reengineered to be as streamlined and efficient as practicable.”8

 

1 USD(AT&L), Investment Review Process Overview and Concept for Operations for Investment Review Boards, June 2, 2005, accessed June 

5, 2017, http://ogc.hqda.pentagon.mil/EandF/Fiscal_Documentation/TabASignedMemo%20with%20CONOPS.pdf. 2 FY 2005 NDAA, Pub. L. No. 108-375, 118 Stat. 1853 (2004). 3 FY 2012 NDAA, Pub. L. No. 112-81, 125 Stat. 1530 (2011). 4 DoD, Department of Defense Investment Review Board and Investment Management Process for Defense Business Systems, March 2012, 

accessed August 10, 2017, http://dcmo.defense.gov/Portals/47/Documents/Publications/NDAA/NDAA_2012_IRB_Report.pdf. 5 FY 2016 NDAA, Pub. L. No. 114-92, 129 Stat. 944 (2015). 6 DoD, Defense Business Council, December 10, 2014, accessed August 11, 2017, 

http://dcmo.defense.gov/Portals/47/Documents/Governance/DBC_Charter_12122014.pdf. 7 Defense Business Systems Investment Review, 10 U.S.C. § 2222(g)(1). 8 Defense Business Systems Investment Review, 10 U.S.C. § 2222(g)(1)(A).
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 1 of 3 | January 2018

Defense Business Systems: Acquisition of IT Systems Volume 1

§ DBS’s implementation must “maximize the elimination of unique software requirements and 

unique interfaces.”9

§ DBS must be in “compliance with the defense business enterprise architecture.”10

§ DBS must have “valid, achievable requirements and a viable plan for implementing those 

requirements.”11

§ DBS’s acquisition strategy must be designed to “eliminate or reduce the need to tailor 

commercial off-the-shelf systems to meet unique requirements.”12

§ DBS must be in “compliance with the Department’s auditability requirements.”13

According to DBC’s 2014 charter, its role as the IRB for DBSs includes these criteria as well:

§ Validating “requirements for defense business capabilities.”

§ Ensuring that “investments are aligned to DoD’s lines of business.”

§ Supporting “measurable improvements to DoD’s business objectives.” 

§ Generating “a measureable return on investment.”14

The IRB process outlined in DoD’s DBS Investment Management Guidance15 describes the integrated 

business framework (IBF) as the overarching structure to manage business IT investments.16 As 

Figure 3-5 shows, IBF includes eight functional areas that require functional strategies (FSs) to direct 

PPBE activities, and organizational execution plans (OEPs) to specify the certification request for each 

functional area and component.17

 

9 Ibid.

10 Defense Business Systems Investment Review, 10 U.S.C. § 2222(g)(1)(B). 11 Defense Business Systems Investment Review, 10 U.S.C. § 2222(g)(1)(C). 12 Defense Business Systems Investment Review, 10 U.S.C. § 2222(g)(1)(D). 13 Defense Business Systems Investment Review, 10 U.S.C. § 2222(g)(1)(E). 14 DoD, Defense Business Council, December 10, 2014, accessed August 11, 2017, 

http://dcmo.defense.gov/Portals/47/Documents/Governance/DBC_Charter_12122014.pdf. 15 DoD, Office of the Deputy Chief Management Officer, Defense Business Systems Investment Management Guidance, Version 4.0, 

accessed November 9, 2017, 

http://dcmo.defense.gov/Portals/47/Documents/Governance/DBS%20Investment%20Management%20Guidance%20Version%204.0%20

-%20April%202017.pdf?ver=2017-05-30-110052-673. 16 Ibid.

17 Ibid.
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 1 of 3 | January 2018

Defense Business Systems: Acquisition of IT Systems Volume 1

Figure 3-5. Integrated Business Framework

As Figure 3-6 shows, FSs and OEPs undergo a review process, resulting in certification decisions.

Figure 3-6. Integrated Business Management Process Overview
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 1 of 3 | January 2018

Defense Business Systems: Acquisition of IT Systems Volume 1

Findings

Statute specifies that IRB approval is required before programs can proceed to development.18 In 

practice, however, DoD requires IRB approval well before development. DBS program personnel have 

indicated to the Section 809 Panel that a major issue with the IRB process is the approval of the problem 

statement—a step that takes place before the first program milestone, and in at least one case, several 

years before the start of product development.19

One purpose of requiring a problem statement is to ensure sufficient BPR, yet, in several cases, DoD 

misapplied the problem statement check in the IRB process, because BPR was already complete. 

Prominent examples of misapplied problem statement checks in the last 2 years include the following:

§ The Integrated Personnel and Pay System–Army (IPPS-A) was delayed in FY 2015 because its 

fund certification was pending approval of its problem statement.20 Despite the fact that (a) it 

was a follow-on increment after OSD directed the division of IPPS-A into two separate 

increments, and (b) the first increment was already operating under an approved business case 

and problem statement, yet DoD required a separate problem statement for the follow-on 

increment. The follow-on increment was delivering the same required capability and was 

fielded using approved program requirements documents.21

§ The Medical Communications for Combat Casualty Care (MC4) program, which fields the 

Theater Medical Information Program-Joint (TMIP-J) software for Army computers in medical 

units, was delayed for FY 2015 because its fund certification was pending approval of its 

problem statement.22 For a number of years, MC4 has had to explain that it previously received

IRB certification under the provisions of the TMIP-J authorization documents.23

§ The Army’s LMP Increment 1 was not recertified in FY 2016 due to lack of a problem 

statement;

24 however, the program was fielded fully as of November 2011, was in sustainment 

per OSD, and should not have required certification.25

 

18 Defense Business Systems Investment Review, 10 U.S.C. § 2222(g)(1). 19 Data collection interviews, conducted by Section 809 Panel Team 6: IT Acquisition, from March to July 2017. The Problem Statement

terminology was changed with the issuance of DoDI 5000.75 in February 2017. It is now split between Capability Requirements (former 

Problem Statement Part 1) and Business Processes / BPR Changes (some of which was in Problem Statement Part 2, some of which is new 

with the 5000.75).

20 Office of the Deputy Chief Management Officer, Army Organizational Execution Plan (OEP) Investment Decision Memorandum (IDM) 

for Fiscal Year (FY) 2015 Defense Business Systems (DBS), (2014). 21 Data collection interviews, conducted by Section 809 Panel Team 6: IT Acquisition, from March to July 2017. 22 Office of the Deputy Chief Management Officer, Army Organizational Execution Plan (OEP) Investment Decision Memorandum (IDM) 

for Fiscal Year (FY) 2015 Defense Business Systems (DBS) (2014). 23 Data collection interviews conducted from March to July 2017 by Section 809 Panel Team 6: IT Acquisition. 24 Office of the Deputy Chief Management Officer, Army Organizational Execution Plan (OEP) Investment Decision Memorandum (IDM) 

for Fiscal Year (FY) 2016 Defense Business Systems (DBS) (2015).

25 Data collection interviews, conducted by Section 809 Panel Team 6: IT Acquisition, from March to July 2017.
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 1 of 3 | January 2018

Defense Business Systems: Acquisition of IT Systems Volume 1

§ The Global Combat Support System–Army Increment 2 was required to obtain IRB certification 

for its materiel development decision, which was two milestones and several years in advance 

of planned development.26 

Another issue with the IRB process is the redundancy of a separate certification process.27 By definition, 

the covered DBSs certified by IRBs have already been approved via the POM and subsequently had 

funds appropriated by Congress. 

According to the Defense Acquisition Guidebook, “methods through which more detailed 

requirements are documented are not dictated by policy,” but rather on a program-by-program basis.28

Some program-level personnel have indicated that the ability to generate more detailed requirements 

on an ad hoc basis creates incentives for the IRB process to overburden programs with requirements 

that do not add value to end products.29

In 2016, DoD DCMO Peter Levine suggested that the IRB process had encountered problems with 

“getting mired in small detail” and needed to “focus instead on broader issues.”30 Several officials have

also suggested that IRB-related problems persist.31 In particular, the assessment checklists, multipart 

requirements templates, technical documentation requirements, and long wait times are major 

roadblocks for getting programs IRB-certified in a timely manner.32

 

26 Office of the Deputy Chief Management Officer, Army Organizational Execution Plan (OEP) Investment Decision Memorandum (IDM) 

for Fiscal Year (FY) 2016 Defense Business Systems (DBS) (2015). In the case of this program, the MDD milestone was renamed 

Incremental Development Decision. 27 PEO personnel, conversation with Section 809 Panel staff, June 2017. 28 Defense Acquisition University, “Defense Acquisition Guidebook,” Chapter 6—3.5.2, accessed June 5, 2017, 

https://www.dau.mil/guidebooks/Shared%20Documents/Chapter%206%20Information%20Technology%20and%20Business%20Systems.

pdf. 29 Data collection interviews, conducted by Section 809 Panel Team 6: IT Acquisition, from March to July 2017. 30 House Armed Services Committee, “Statement of The Honorable Peter Levine, Deputy Chief Management Officer Department of 

Defense,” March 22, 2016, http://docs.house.gov/meetings/AS/AS26/20160322/104711/HHRG-114-AS26-Wstate-LevineP-20160322.pdf, 

accessed June 5, 2017.

31 Data collection interviews, conducted by Section 809 Panel Team 6: IT Acquisition, from March to July 2017. 32 Technical documentation requirements may be perceived by program-level staff as particularly burdensome. Descriptive data elements 

associated with DBSs must be drawn up, formatted, and entered into—at a minimum—four different data systems, all prior to the 

initiation of an IRB review. These are the DoD Information Technology Portfolio Repository (DITPR), the Select and Native Programming 

Data Input Systems for Information Technology (SNaP-IT), the Integrated Business Framework Data Alignment Portal (IBF-DAP), and the 

DoD Information Technology Investment Portal (DITIP). Each of these data systems focuses on a different functional area and requires 

unique types of expertise and skillsets. See Deputy Chief Management Officer, Defense Business Systems Investment Management 

Guidance, Version 4.0, 21, accessed April 2017, 

http://dcmo.defense.gov/Portals/47/Documents/Governance/DBS%20Investment%20Management%20Guidance%20Version%204.0%20

-%20April%202017.pdf?ver=2017-05-30-110052-673.

The multipart requirements template takes the form of a 34-page business case analysis (BCA) guidance document published by the DoD 

CIO. Program personnel are expected to provide detailed analysis of cost, alternatives, risk, funding sources, and many other topics 

associated with the business system. See Department of Defense Chief Information Officer, DoD IT Business Case Analysis Template, 

October 22, 2014, accessed June 5, 2017, 

http://dodcio.defense.gov/Portals/0/Documents/DOD%20IT%20Business%20Case%20Analysis%20(BCA).pdf.
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 1 of 3 | January 2018

Defense Business Systems: Acquisition of IT Systems Volume 1

There may also be unnecessary bureaucracy built into DBS Investment Management Guidance. For 

example, the guidance states, 

10 U.S.C. § 2222 gives greater responsibilities to Military Department Chief Management Officers 

(CMOs) and defines the statutory thresholds for a covered DBS. However, military departments and 

Fourth Estate CMOs may lower thresholds used internally as discussed later in this document.33

The statutory threshold for a covered DBS is $50M over the current FYDP period.34 DoD lowered the 

threshold, however, and designated the Fourth Estate minimum threshold at $1M over the period of 

the current FYDP later in the guidance.35 Instead of embracing this increased authority, DoD expanded 

its oversight role and designated nearly all Fourth Estate DBS programs as covered DBSs, requiring 

time-consuming annual fund certification and recertification. 

Conclusions

The review and approval of DBS investments can be satisfied through the POM and PPBE processes, 

which already occur on an annual basis. The term IRB does not appear in law (10 U.S.C. § 2222), and 

the DBC is established in law “to provide advice” (i.e., it is not a decision body). The only statutory 

basis for the IRB process is the annual certification requirement in 10 U.S.C. §§ 2222(g)(3) and (g)(4). 

Accordingly, 10 U.S.C. §§ 2222(g)(3) and (g)(4) should be eliminated.

The proposed governance structure in Recommendation 16 allows a newly empowered CMO to 

address the goals of the IRB process, such as minimizing customization and aligning with the business 

enterprise architecture, in a much more streamlined manner.

Implementation

Legislative Branch

§ Eliminate 10 U.S.C. §§ 2222(g)(3) and (g)(4), which states: 

- “(3) Annual certification.-For any fiscal year in which funds are expended for development 

or sustainment pursuant to a covered defense business system program, the appropriate 

approval official shall review the system and certify, certify with conditions, or decline to 

certify, as the case may be, that it continues to satisfy the requirements of paragraph (1). If 

the approval official determines that certification cannot be granted, the approval official 

shall notify the milestone decision authority for the program and provide a 

recommendation for corrective action.”

 

33 Deputy Chief Management Officer, Defense Business Systems Investment Management Guidance, Version 4.0, 5, accessed April 2017, 

http://dcmo.defense.gov/Portals/47/Documents/Governance/DBS%20Investment%20Management%20Guidance%20Version%204.0%20

-%20April%202017.pdf?ver=2017-05-30-110052-673. The term Fourth Estate refers to Defense agencies that are not the Military Services 

(e.g., Defense Acquisition University, Defense Logistics Agency).

34 Defense Business Systems Investment Review, 10 U.S.C. § 2222(i)(2). 35 Deputy Chief Management Officer, Defense Business Systems Investment Management Guidance, Version 4.0, accessed April 2017, 

http://dcmo.defense.gov/Portals/47/Documents/Governance/DBS%20Investment%20Management%20Guidance%20Version%204.0%20

-%20April%202017.pdf?ver=2017-05-30-110052-673.
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 1 of 3 | January 2018

Defense Business Systems: Acquisition of IT Systems Volume 1

- “(4) Obligation of funds in violation of requirements.-The obligation of Department of 

Defense funds for a covered defense business system program that has not been certified in 

accordance with paragraph (3) is a violation of section 1341(a)(1)(A) of title 31.” 

Executive Branch

§ Eliminate the IRB fund certification requirement from the DBS Investment Management 

Guidance. 

Implications for Other Agencies

§ There are no cross-agency implications for this recommendation.