GAO-06-947R Observations on BSA Direct R&S 

United States Government Accountability Office

Washington, DC 20548 

July 14, 2006 

The Honorable Christopher Bond 

Chairman 

The Honorable Patty Murray 

Ranking Minority Member 

Subcommittee on Transportation, Treasury, 

the Judiciary, HUD and Related Agencies 

Committee on Appropriations 

United States Senate 

Subject: Information Technology Management: Observations on the Financial Crimes 

Enforcement Network’s (FinCEN’s) BSA Direct Retrieval and Sharing (BSA Direct 

R&S) Project 

FinCEN’s primary function is to support and strengthen domestic and international antimoney laundering efforts through coordination and partnerships. Since its creation in 

1990, FinCEN has been responsible for overseeing the management, processing, storage 

and dissemination of Bank Secrecy Act (BSA) data.1

 In 2004, FinCEN embarked on a 

major initiative intended to improve the sharing of information reported under the Bank 

Secrecy Act. BSA Direct is an umbrella project intended to provide secure, user-friendly, 

web-based tools for accessing, analyzing, and filing BSA data. It is part of a broad effort 

to reengineer data management responsibilities and transition them from the IRS. 

During the early spring of 2006, it became clear to FinCEN that the Retrieval and Sharing 

component of the BSA Direct project (BSA Direct R&S) was not going to meet the 

critical implementation deadline of June 30, 2006. 

Objectives

Because FinCEN has experienced problems with development and implementation of 

the BSA Direct R&S, you asked us about the project’s current status and to provide 

observations on FinCEN’s IT investment management practices. Our objectives were to 

(1) describe BSA Direct R&S and the project’s current status; (2) examine FinCEN’s 

application of information technology (IT) investment management 

 1

 The Bank Secrecy Act, enacted by Congress in 1970, authorizes the Secretary of the Treasury to issue 

regulations requiring financial institutions to retain records and file reports that are determined to 

have a significant degree of usefulness in criminal, tax, and regulatory investigations or in the conduct 

of intelligence or counterintelligence activities, including analysis, to protect against international 

terrorism. Pub. L. 91-508, codified as amended at 12 U.S.C. 1829b,12 U.S.C. 1951-1959 and 31 U.S.C. 

5311-5332. 
processes to the BSA Direct R&S project; and (3) describe, at a high level, the range of 

options FinCEN may consider as it reexamines the BSA Direct R&S project. 

We are sending copies of this report to the Secretary of Treasury, the Director of 

FinCEN, and interested congressional committees. We will also provide copies to others 

on request. 

Scope and Methodology

To provide observations on FinCEN’s BSA Direct R&S project, we reviewed and 

analyzed BSA Direct planning and implementation documents, interviewed agency 

officials at FinCEN, the Internal Revenue Service (IRS), and some users of BSA 

information such as federal law enforcement agencies. We also examined FinCEN’s 

application of IT investment management processes to the BSA Direct R&S project using 

GAO’s guide, Information Technology Investment Management: A Framework for 

Assessing and Improving Process Maturity,2 as our criteria. We did not conduct a 

comprehensive review of FinCEN’s investment management practices. We focused on 

critical processes associated with Stage 2 of the five-stage framework because they 

represent the practices needed for basic project-level control. We reviewed project 

documents such as the Office of Management and Budget Exhibit 300, the original BSA 

Direct R&S contract and revisions, progress reports, interim briefings, and project 

assessments conducted by MITRE. We also interviewed FinCEN officials responsible for 

investment management and the BSA Direct R&S project, the contractor conducting the 

BSA Direct R&S project, and MITRE officials involved in the project. We conducted our 

review according to generally accepted government auditing standards between May and 

July 2006. 

In late June 2006, we provided a detailed briefing to your staff on the results of this work. 

The briefing slides are included as Enclosure I. The purpose of this letter is to publish 

the briefing slides and to transmit our recommendations to the Director of FinCEN. 

Results in Brief

On March 15, 2006 the director of FinCEN placed the Retrieval and Sharing component 

of the BSA Direct project under a temporary “stop work” order because of significant 

cost, schedule, and performance issues. For example, phase one of the project was 

planned for completion in 250 days but was actually completed in 373 days. 

Judging against the criteria of GAO’s framework for information technology investment 

management , GAO found that FinCEN did not always apply effective investment 

management processes to oversee the BSA Direct R&S project. This, in part, contributed 

to the problems experienced by the project, because issues that occurred at the project 

management level continued and compounded, yet were not addressed at the executive 

level. For example, MITRE—the organization assisting FinCEN with project 

monitoring—identified multiple occasions where FinCEN did not take action to mitigate 

project risks or address significant de-scoping of project functionality. 

 2 See U.S. GAO, Information Technology Investment Management: A Framework for Assessing and 

Improving Process Maturity GAO-04-394G (Washington, D.C.: March 2004).

Page 2 GAO-06-947R 
FinCEN is considering three basic options in determining whether or not to continue the 

BSA Direct R&S project. These include reestablishing a modified contract; finding a new 

contractor to take over the project; or terminating the contract and assessing needs and 

plans for new capabilities. FinCEN’s inadequate application of sound information 

technology investment management processes and controls to the BSA Direct R&S 

project contributed to the cost, schedule, and performance issues that have plagued the 

project from its inception. FinCEN plans to determine the future direction of BSA Direct 

R&S in mid-July 2006. Regardless of what decision is made, FinCEN runs the risk of 

having similar problems and similar results in the future unless better investment 

management processes and procedures are put in place.

Recommendation for Executive Action

In light of the issues experienced on the BSA Direct R&S project, we recommend that the 

Director of FinCEN direct the Chief Information Officer (CIO) to develop a plan for 

improving the agency's capabilities for overseeing the BSA Direct project. The plan 

should focus in particular on establishing policies and procedures for executives to 

regularly review investments' progress against commitments and take corrective actions 

when these commitments are not met. In addition, the plan should (1) specify 

measurable goals, objectives, and milestones; (2) specify needed resources; (3) assign 

clear responsibility and accountability for accomplishing tasks; and (4) be approved by 

the Director of FinCEN. In implementing the plan, the FinCEN CIO should report 

progress against expectations to the FinCEN Director and take appropriate actions to 

address deviations. 

Agency Comments

In commenting orally on a draft of this report, the Acting Deputy Chief Information 

Officer stated that FinCEN concurred fully with our findings and recommendation. 

If you or your staff have any questions, or wish to discuss this material further, please 

call me at (202) 512-5594 or whitej@gao.gov. We are sending copies of this report to the 

Secretary of Treasury, the Director of FinCEN, and interested congressional committees. 

The letter is also available on GAO's home page at http://www.gao.gov. We will also 

provide copies to others on request. GAO staff who made major contributions to this 

report are listed in Enclosure II. 

James R. White 

Director, Strategic Issues

Enclosures (2) 

Page 3 GAO-06-947R 
Enclosure I 

Observations on the Financial Crimes Enforcement 

Network’s (FinCEN’s) BSA Direct Retrieval & Sharing 

Project

Briefing to Senate Appropriations Subcommittee on 

Transportation, Treasury, the Judiciary, HUD and 

Related Agencies

June 22, 2006

Page 4 GAO-06-947R 
2

Purpose and Outline

Outline:

Objectives

Scope and Methodology

Results in Brief

Background

Status of BSA Direct R&S

Observations on BSA Direct R&S

Potential Options for the Future of BSA Direct R&S 

Conclusions

Recommendation for Executive Action 

Page:

3

4

5

6

8

11

21

23

24

Purpose

To describe the status of the Retrieval and Sharing component of the BSA 

Direct project (BSA Direct R&S) [1] and provide our observations on the project

and its future.

[1] BSA Direct is an overall umbrella project with several components, including: electronic filing, secure access, and retrieval and sharing. This briefing focuses on the retrieval

and sharing component of BSA Direct. For purposes of clarity and to prevent confusion with the broader BSA Direct project we use the term-- BSA Direct R&S throughout this briefing.

Page 5 GAO-06-947R 
3

Objectives

• Describe BSA Direct R&S and the project’s current status.

• Examine FinCEN’s application of information technology (IT) investment 

management processes to the BSA Direct R&S project. 

• Describe, at a high level, the range of options FinCEN may consider as it

reexamines the BSA Direct R&S project. 

Page 6 GAO-06-947R 
4

Scope and Methodology

For objectives 1, 2 and 3 we reviewed and analyzed BSA Direct R&S planning and

implementation documents, interviewed agency officials at FinCEN, the Internal

Revenue Service (IRS), and some users of BSA information such as federal law 

enforcement agencies. 

In addition, for objective 2 we also examined FinCEN’s application of IT investment

management processes to the BSA Direct R&S project using GAO’s guide,

Information Technology Investment Management: A Framework for Assessing and

Improving Process Maturity,[2] as our criteria. We focused on critical processes 

associated with Stage 2 of the five-stage framework because they represent the 

practices needed for basic project-level control. We reviewed project documents 

such as the Office of Management and Budget Exhibit 300, the original BSA Direct 

R&S contract and revisions, progress reports, interim briefings, and project 

assessments conducted by MITRE. We also interviewed FinCEN officials 

responsible for investment management and the BSA Direct project, the contractor 

conducting the BSA Direct R&S project, and MITRE officials involved in the project.

[2] See U.S. GAO, Information Technology Investment Management: A Framework for Assessing and Improving Process Maturity GAO-04-394G (Washington, D.C.: March 2004).

Page 7 GAO-06-947R 
5

Results in Brief

On March 15, 2006 the director of FinCEN placed the retrieval and sharing

component of the BSA Direct project under a temporary “stop work” order because 

of significant cost, schedule, and performance issues. For example, phase one of

the contract was planned for completion in 250 days but was actually completed in

373 days. 

Judging against the criteria of GAO’s framework for information technology

investment management, we found that FinCEN did not always apply effective 

investment management practices to oversee the BSA Direct R&S project. This, in

part, contributed to the problems experienced by the project, because issues that 

occurred at the project management level continued and compounded, yet were

not addressed at the executive level. For example, MITRE—the organization

assisting FinCEN with project monitoring—identified multiple occasions where 

FinCEN did not take action to mitigate project risks or address significant descoping of project functionality.

FinCEN is considering three basic options in determining whether or not to

continue the BSA Direct R&S project. These include reestablishing a modified

contract; finding a new contractor to take over the project; or terminating the 

contract and assessing needs and plans for new capabilities.

Page 8 GAO-06-947R 
6

Background

Legislative and Statutory Authorities

The Bank Secrecy Act (BSA), enacted by Congress in 1970, authorizes the

Secretary of the Treasury to issue regulations requiring financial institutions to 

retain records and file reports that are determined to have a significant degree of

usefulness in criminal, tax, and regulatory investigations.[2] Following the 

September 11th terrorist attacks, Congress passed the USA PATRIOT Act, which 

among other things, amended the BSA to allow information collected under the

BSA to be used in the conduct of intelligence or counterintelligence activities and to 

protect against international terrorism.

The BSA charged the Secretary of Treasury to designate “a single officer or agency 

of the United States to whom suspicious activity reports shall be made.”[3] The

agency designated for BSA compliance is responsible for overseeing the 

administration of the BSA. Overall authority for enforcement and compliance of the 

BSA has been delegated to the Assistant Secretary of the Treasury;[4] which 

further delegated responsibility to the Director of the Financial Crimes Enforcement

Network (FinCEN), a bureau of the Department of Treasury.

[3]Pub. L. 91-508, codified as amended at 12 U.S.C. §1829b,12 U.S.C. §§1951-1959 and 31 U.S.C. §§5311-5314;5316-5332.

[4]31 U.S.C. §5318(g) (4) (A).

[5]31 CFR103.56 subpart (e).

Page 9 GAO-06-947R 
7

Background

BSA Data Management Responsibilities

FinCEN’s mission is to support and strengthen domestic and international antimoney laundering efforts through coordination and partnerships. Since its creation

in 1990, FinCEN has been responsible for overseeing the management, 

processing, storage and dissemination of BSA data. FinCEN is the overall

administrator of the Bank Secrecy Act and thus is ultimately responsible for the

management of BSA data. 

However, the Department of the Treasury, historically, has relied upon the Internal

Revenue Service (IRS) to assist FinCEN in the management of BSA information. 

Under a longstanding cooperative arrangement with FinCEN, the IRS collects and 

stores all the data reported under the BSA. IRS’s Detroit Computing Center (DCC) 

is the central point of collection and housing of all BSA data in a single repository. 

DCC maintains the infrastructure needed to collect the reports, convert paper and 

magnetic tape submissions to electronic media, correct errors in submitted forms 

through correspondence with filers, and store the data on its Currency and Banking

Retrieval System (CBRS).

Page 10 GAO-06-947R 
8

FinCEN’s BSA Direct R&S Project

Description

BSA Direct is an umbrella project intended to improve the sharing of information

reported under the Bank Secrecy Act. FinCEN characterizes it as a major initiative

intended to provide secure, user-friendly, web-based tools for accessing, analyzing,

and filing BSA data. It has several components, including electronic filing, secure

access, and retrieval and sharing. 

BSA Direct is part of a broad effort by FinCEN to transition from the IRS, and 

reengineer, BSA data management responsibilities.

FinCEN entered into a contract with EDS in June 2004 to develop the retrieval and 

sharing component of BSA Direct. 

Page 11 GAO-06-947R 
9

FinCEN’s BSA Direct Project

Status

On March 15, 2006, the director of FinCEN placed the retrieval and sharing 

component of the BSA Direct project under a temporary “stop work” order because 

the project had repeatedly failed to meet performance milestones, was

experiencing significant issues with both functionality and stability, and was not 

going to meet the critical implementation deadline of June 30, 2006. This “stop

work” period, originally for 90 days, was extended by the director for an additional 

30 days to July 15, 2006. 

During this period all work on the project by both FinCEN employees and the 

project contractor have been halted. Meanwhile FinCEN is coordinating with the 

IRS— who currently and historically has collected and maintained BSA data— in 

an effort to ensure users do not experience an interruption in service. FinCEN has 

also assembled an assessment team that has been charged with assessing the

BSA Direct R&S system, conducting an alternatives analysis, and recommending a 

course of action moving forward. 

Page 12 GAO-06-947R 
10

FinCEN’s BSA Direct R&S Project

IRS’s Current Role

After FinCEN recognized BSA Direct R&S would not be implemented before the

critical June 30, 2006 deadline, it determined the need to coordinate with the IRS to

ensure users of BSA data do not experience an interruption in service. 

Meeting the June 30, 2006 deadline was critical to the project’s success because

that is when IRS is shutting down the legacy system (CBRS) containing all BSA 

data. IRS no longer needs this legacy system because they have developed a new 

system, called WebCBRS, to store all BSA data and then disseminate it to internal

(IRS) customers. 

Meanwhile, BSA Direct R&S was intended to provide non-IRS users with access to 

BSA data once the legacy system was discontinued. Since FinCEN halted work on

BSA Direct R&S, agency officials have been working with IRS to identify a way to

provide non-IRS users with access to the WebCBRS system in the same way that

they had access to CBRS.

Page 13 GAO-06-947R 
11

Observations on BSA Direct R&S

IT Management

There are many areas that are important to successfully managing IT, including 

investment management, system/software development and acquisition

management, enterprise architecture management, information security, and 

human capital management. In each of these areas there are numerous policies 

and procedures that can be applied.

Of particular relevance to FinCEN’s BSA Direct R&S project are investment

management and system/software development and acquisition management. 

Investment management focuses on the selection and management oversight of an

agency’s or division’s IT investments. Whereas, system/software development and

acquisition management focuses on process management and quality

improvement at the project management level.

The Office of the Inspector General for Treasury is conducting a review of the BSA 

Direct R&S project and the system/software development and acquisition 

management processes and procedures that were in place. Therefore, for the 

purposes of this briefing, the focus is to provide our observations on FinCEN’s

application of some investment management processes and procedures to the 

BSA Direct R&S project. 

Page 14 GAO-06-947R 
12

Observations on BSA Direct R&S 

ITIM Overview

The Information Technology Investment Management (ITIM) framework focuses on

the selection and management oversight of an agency’s or division’s IT

investments. Built around the select/control/evaluate approach described in the

Clinger-Cohen Act [6], the ITIM framework provides a method for evaluating and

assessing how well an agency is selecting and managing its IT resources. 

Agencies can also use the framework as they work to improve their processes.

The maturity stages, depicted in figure 1, represent steps toward achieving a stable

and mature IT investment management process. Organizations implementing

Stages 2 and 3 of the framework have in place the investment selection, control, 

and evaluation processes that are required by the Clinger-Cohen Act. 

[6]The fiscal year 1997 Omnibus Consolidated Appropriations Act, Pub. L. 104-208, renamed both Division D (the Federal Acquisition Reform Act) and E (the Information

Technology Management Reform Act) of the 1996 DOD Authorization Act, Pub. L. 104-106, as the Clinger-Cohen Act of 1996.

Page 15 GAO-06-947R 
13

Observations on BSA Direct R&S 

The Five Stages of Maturity within ITIM

Figure 1: Five Stages of Maturity within ITIM

Page 16 GAO-06-947R 
14

Observations on BSA Direct R&S 

Characterization of ITIM Stages 1 & 2

Stage 1 of the ITIM framework is characterized as IT spending without disciplined

investment processes

In Stage 2 basic selection capabilities are driven by the development of project

selection criteria, including benefit and risk criteria, and an awareness of 

organizational priorities when identifying projects for funding. Executive oversight is 

applied on a project-by-project basis. The five critical processes of investment 

management at Stage 2 are:

• Instituting the investment board,

• Meeting business needs,

• Providing investment oversight,

• Capturing investment information, and

• Selecting an investment

Table 1 describes the critical ITIM processes at Stage 2 and our observations on

how these processes have been applied to the BSA Direct R&S project.

Page 17 GAO-06-947R 
15

Observations on BSA Direct R&S

Application of Critical Stage 2 Processes

Table 1: Observations on FinCEN’s Application of Stage 2 ITIM Processes

to the BSA Direct R&S Project

Source: GAO analysis

Stage 2 ITIM Processes Observations on Application to B SA D irect R &S

Instituting the investm ent board— 

entails creating and defining the m em bership and

guiding policies, operations, roles, responsibilities, and 

authorities for one or m ore IT investm ent boards within

the organization.

FinC EN chartered a Technology R eview Board in June

2005 that is responsible for m anaging capital planning

investm ent control processes and overseeing the use of

technology. H owever, in practice, this review board did not

have jurisdiction or final decision-m aking authority over the 

BSA D irect R &S project. 

M eeting business needs— 

entails ensuring that IT projects and system s support

the organization’s business needs and m eet users’

needs. It involves identifying business and users’

needs for each IT project and having users participate

in project m anagem ent throughout the project’s life

cycle.

Users did not consistently participate in BSA Direct R &S

during the project life cycle. Specifically, FinC EN involved

users in conducting a requirem ents analysis to docum ent

business and users’ needs before the BSA D irect R&S

contract was awarded. However, after the contract award,

every FinC EN user we spoke with stated they had not

participated in the process since that tim e.

Providing investm ent oversight—

entails m onitoring the progress of all IT projects and 

system s relative to cost, schedule, risk, and benefit 

expectations and taking corrective action when these 

expectations are not being m et.

FinC EN project m anagers m et regularly with the BSA 

Direct R&S contractor and occasionally with M ITRE to

discuss the project’s progress. They w ere provided reports

docum enting issues im pacting the cost, schedule, and 

perform ance of the BSA Direct R&S project, how ever, it is

unclear w hat inform ation was provided to FinCEN

executives, when it was provided, or how it was used in

decision-m aking. 

C apturing investm ent inform ation—

involves identifying IT assets and creating a

com prehensive repository of investm ent inform ation for

decision m akers to use to evaluate the im pacts and

opportunities created by proposed (or continuing) IT

investm ents.

FinC EN has m ade efforts to capture inform ation on its IT

assets. How ever, this inform ation w as not alw ays used

effectively to evaluate the im pact that interfacing BSA

Direct R&S with other IT system s would have. For

exam ple, nine m onths after the BSA Direct R &S contract

was awarded significant m odifications had to be m ade to

address system incom patibility issues. 

Selecting an investm ent— 

entails ensuring that a well-defined and disciplined 

process be used to select new IT proposals and

reselect ongoing investm ents.

W e did not exam ine the process used to select the BSA

Direct R&S proposal. Since the stop-work order on BSA

Direct R&S, FinC EN has also developed an assessm ent

team to reselect— i.e. determ ine whether to continue

funding— this project.

Page 18 GAO-06-947R 
16

Observations on BSA Direct R&S

Importance of Internal Control Techniques

One important focus in Stage 2 of the ITIM framework is the attainment of 

repeatable successful IT investment control techniques at the project level. For an

organization to develop a sound IT investment process, it must first be able to 

control its investments so that they finish predictably within established schedule

and budget ranges. In addition, it must be able to identify potential exposures to

risk and put in place strategies to mitigate that risk. 

In the absence of predictable, repeatable, and reliable investment control 

processes, selected investments will be subject to a higher risk of failure despite 

rigorous analysis of the estimates used to justify them. Further the absence of 

repeatable control processes will result in ineffective evaluation processes and

contradictory efforts at process improvement. 

Page 19 GAO-06-947R 
17

Observations on BSA Direct R&S

Application of Internal Control Processes

In FinCEN’s case, the BSA Direct R&S project lacked sufficient investment

control techniques. This, in part, contributed to the problems experienced by

the project, because issues that occurred at the project management level

continued and compounded, yet were not addressed at the executive level. 

For example, MITRE found that the project—

• was not fully baselined from inception in July 2004 until February 2005; 

• lost the baseline 3 months later and could not be fully recovered, in part, 

because of:

– contractor staffing issues thru September 2005,

– ongoing schedule slippages, without risk mitigation activity, and

– project de-scoping, meaning certain functionalities in the original

contract would not be provided;

• lacked system acceptance criteria, known as a Service Level

Agreement.

These, and other, issues were significant and had a major impact on the

project, yet they remained for months and often were never adequately

addressed. Figure 2 illustrates how these, and other, issues impacted the

project from a chronological perspective and table 2 provides a month-bymonth accounting of many of the issues identified by MITRE.

Page 20 GAO-06-947R 
18

Observations on BSA Direct R&S

Schedule Slippages

Figure 2: BSA Direct R&S Project Schedule Slippages

Note: Updates and revisions were made to the BSA Direct R&S project schedule on an ongoing basis; however, we selected the following three revision dates to illustrate how the

schedule changed over time: Revision 1 – March 21, 2005; Revision 2 – September 19, 2005; Revision 3 – February 22, 2006.

Note: Phases 1, 2, and 3 denote critical milestones established by FinCEN and the contractor for the BSA Direct R&S project.

Page 21 GAO-06-947R 
19

Observations on BSA Direct R&S

Chronology of Issues Identified

Source: GAO Summary of MITRE data

Update Issue Identified Update Issue Identified

July 2004

(Project

Launched)

June 2005 Project understaffed

Project baseline lost

August 2004 Project schedule not baselined

Project understaffed 

July 2005 Project understaffed 

Project baseline lost

September 2004 Project schedule not baselined

Project understaffed 

August 2005 Project understaffed

No business continuity plan

MITRE not consistently included in project

discussions and meetings

October 2004 Project schedule not baselined

Project understaffed 

September

2005 

Project understaffed

Lack of project baseline

Need for system design change

MITRE not consistently included in project

discussions and meetings

November 2004 Project schedule not baselined

Project understaffed 

October 2005 Contractor project manager resigns

December 2004 Project understaffed November 2005 Schedule slippage with no risk mitigation

activities

January 2005 Project understaffed December 2005 Schedule slippage with no risk mitigation

activities

February 2005 Project understaffed January 2006 Loss of project baseline 

March 2005 Project understaffed February 2006 Project de-scoping

Schedule slippage with no risk mitigation

activities

April 2005 Project understaffed March 2006 Temporary stop work order issued

May 2005 Project baseline lost

Project understaffed 

Table 2: Chronology of Some Issues Identified by MITRE during the BSA 

Direct R&S Project

Page 22 GAO-06-947R 
20

Observations on BSA Direct R&S

Critical Aspects of Improvement

Critical to maturing project-level IT investment control processes is the ability to

recognize the need for and to take swift corrective action when a project is having

trouble meeting its schedule expectations and cost estimates. 

As it moves through Stage 2, an organization develops robust methods to collect 

data from the project-level management processes and aggregate it appropriately

to provide executive management with the information it needs to execute its

oversight responsibilities. As the organization matures, it also learns from past 

decisions and better manages the causal factors that created past problems, thus

improving the performance results of ongoing projects.

Beyond investment control processes, the organization also begins to implement 

basic selection processes. The core business needs for each IT project are

identified and the basic portfolio development processes are used to select new IT

proposals.

Page 23 GAO-06-947R 
21

BSA Direct R&S Project Options

Since the director of FinCEN issued a stop-work order on BSA Direct R&S on

March 15, 2006, FinCEN has established a reassessment team to determine the 

future of the project. According to FinCEN officials, they are considering three

basic options during this reassessment period. These include—

• reestablishing a modified contract with EDS;

• developing a new request for proposal, enabling a new contractor to

take over the project; or 

• terminating the contract and assessing agency needs and plans for new 

capabilities

Page 24 GAO-06-947R 
22

Potential Options for BSA Direct R&S Project

Options and Reasons for Selection

Table 3: BSA Direct R&S Options and Potential Reasons for Selection

Source: FinCEN and GAO

Option Potential Reason for Selecting

FinCEN reestablishes a

modified contract with EDS.

After nearly two years working on the project, EDS has 

developed significant knowledge of the working 

environment.

FinCEN develops new 

request for proposal for a 

new contractor to take over 

the project. 

Brings a fresh approach that builds on the nearly functional

aspects of the system. 

FinCEN terminates the 

contract, assesses agency 

needs, and plans for new 

capabilities

The IRS’s WebCBRS system is deemed sufficient to provide 

the capability needed for the short- to intermediate-term. 

This also provides FinCEN the time to reevaluate its longterm strategy for reengineering and transitioning data

management processes. 

Page 25 GAO-06-947R 
23

Conclusions

FinCEN’s inadequate application of sound information technology investment 

management processes and controls to oversee the BSA Direct R&S project 

contributed to the cost, schedule, and performance issues that have plagued the 

project from its inception.

FinCEN plans to determine the future direction of BSA Direct R&S in mid-July 

2006. Regardless of what decision is made, FinCEN runs the risk of having similar 

problems and similar results in the future unless better investment management

processes and procedures are put in place.

Page 26 GAO-06-947R 
24

Recommendation for Executive Action

In order to improve FinCEN’s ability to manage its IT investments, we recommend

that Director of FinCEN direct the CIO to develop a plan for improving the agency’s

capabilities for overseeing the BSA Direct project. The plan should focus in

particular on establishing policies and procedures for executives to regularly review 

investments’ progress against commitments and take corrective actions when

these commitments are not met.

In addition, the plan should 

• specify measurable goals, objectives, and milestones;

• specify needed resources;

• assign clear responsibility and accountability for accomplishing tasks; and

• be approved by the Director of FinCEN.

In implementing the plan, the FinCEN CIO should report progress against

expectations to the FinCEN Director and take appropriate actions to address 

deviations.

Page 27 GAO-06-947R 
 Enclosure II 

GAO Contact and Staff Acknowledgments 

GAO Contact

James R. White, (202) 512-5594 or whitej@gao.gov

Acknowledgments

In addition to the person named above, Timothy Hopkins, Robyn Howard, Brian 

James, Signora May, Donna Miller, Sabine Paul, David Powner, and Katrina Taylor 

made key contributions to the report. 

(450500)

Page 28 GAO-06-947R 
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately. 
GAO’s Mission The Government Accountability Office, the audit, evaluation and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To

have GAO e-mail you a list of newly posted products every afternoon, go 

to www.gao.gov and select “Subscribe to Updates.” 

The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to: 

U.S. Government Accountability Office 

441 G Street NW, Room LM 

Washington, D.C. 20548 

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, D.C. 20548 

Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548 

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Mail or Phone 

To Report Fraud,

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

PRINTED ON RECYCLED PAPER