U.S. ENVIRONMENTAL PROTECTION AGENCY 

OFFICE OF INSPECTOR GENERAL 

Catalyst for Improving the Environment 

Quick Reaction Report 

Lack of Project Plan Resulted in 

Transition and Contractor 

Performance Problems for the 

Institutional Controls Tracking System 

Report No. 09-P-0128 

 March 25, 2009 
 

 

 

 

Report Contributors Rudolph M. Brevard 

 Cheryl Reid 

 Neven Morcos 

Abbreviations 

EPA U.S. Environmental Protection Agency 

IC Institutional Controls 

ICTS Institutional Controls Tracking System 

OIG Office of Inspector General 

OSRTI Office of Superfund Remediation and Technology Innovation 

SDMS Superfund Document Management System 

SMP System Management Plan 
U.S. Environmental Protection Agency 09-P-0128 

March 25, 2009 Office of Inspector General 

At a Glance
 Catalyst for Improving the Environment 

Why We Did This Review 

We performed this review in 

response to an anonymous 

hotline complaint alleging 

mismanagement of the 

Institutional Controls Tracking 

System (ICTS) project being 

developed by the Office of 

Superfund Remediation and 

Technology Innovation 

(OSRTI). 

Background 

In 2003, the U.S. 

Environmental Protection 

Agency’s (EPA’s) Superfund 

program acquired a contract to 

develop ICTS to make 

information available via the 

Internet. In 2005, OSRTI 

purchased a Task Order under a 

different contractor to continue 

ICTS development. System 

Life Cycle Management 

guidance outlines EPA’s 

system development 

requirements. The procedures 

require that a project have a 

System Management Plan that 

serves as the primary 

managerial document to 

control, assess, and document 

the system. 

For further information, contact 

our Office of Congressional, 

Public Affairs and Management 

at (202) 566-2391. 

To view the full report, 

click on the following link: 

www.epa.gov/oig/reports/2009/ 

20090325-09-P-0128.pdf 

Lack of Project Plan Resulted in 

Transition and Contractor Performance Problems 

for the Institutional Controls Tracking System 

What We Found 

Lack of compliance with established project management procedures resulted in 

transitional problems in 2005 that delayed ICTS development and negatively affected 

contractor performance. Although we could not substantiate the mismanagement 

claims alleged in the hotline complaint, the absence of key decision documents and 

significant turnover of key ICTS personnel could have contributed to the 

complainant’s perception that ICTS project decisions were made in a haphazard 

manner. Had OSRTI documented its key decisions, as required by EPA guidance, 

institutional documents would have been available to answer communication and 

project questions that impacted the ICTS project. 

In April 2006, OSRTI assigned a certified project manager to oversee ICTS 

development. The project manager took steps to develop a System Management Plan 

for ICTS and provided leadership and direction to help OSRTI overcome challenges 

with contractor transitions. In 2007, ORSTI merged ICTS with the Superfund 

Document Management System (SDMS). More work is needed to ensure that OSRTI 

documents its processes for overseeing system development activities and conducting 

quality management reviews to ensure the System Management Plan is kept current. 

What We Recommend 

We recommend that the Director, Office of Superfund Remediation and Technology 

Innovation, Office of Solid Waste and Emergency Response: 

•	 Document procedures for overseeing development activities for the SDMS 

project as prescribed by EPA System Life Cycle Management guidance. 

•	 Conduct and document a review of SDMS system documentation to ensure the 

document is current. If needed, direct the contractor to update the 

documentation. 

•	 Create a Plan of Actions and Milestones in EPA’s Automated Security Self 

Evaluation and Remediation Tracking system for the above two 

recommendations. 

We met with OSRTI to discuss the report’s findings. OSRTI agreed with the report’s 

recommendations, and provided a complete corrective action plan to address the 

report’s recommendations. OSRTI management indicated that some elements of the 

report did not provide the current operational status of the ICTS application or the 

appropriate timeframe of the weaknesses found, and we modified the report as 

appropriate to address management’s concerns. 
 

 

 

UNITED STATES ENVIRONMENTAL PROTECTION AGENCY 

WASHINGTON, D.C. 20460 

OFFICE OF 

INSPECTOR GENERAL 

March 25, 2009 

MEMORANDUM 

SUBJECT:	 Lack of Project Plan Resulted in Transition and Contractor 

Performance Problems for the Institutional Controls Tracking System 

Report No. 09-P-0128 

FROM:	 Rudolph M. Brevard 

Director, Information Resources Management Assessments 

Office of Mission Systems 

TO: James Woolford 

Director, Office of Superfund Remediation and Technology Innovation 

Office of Solid Waste and Emergency Response 

This is our report on the subject audit conducted by the Office of Inspector General (OIG) of the 

U.S. Environmental Protection Agency (EPA). This report contains findings that describe the 

problems the OIG has identified and corrective actions the OIG recommends. This report 

represents the opinion of the OIG and does not necessarily represent the final EPA position. 

Final determinations on matters in this report will be made by EPA managers in accordance with 

established audit resolution procedures. 

The estimated cost of this report – calculated by multiplying the project’s staff days by the 

applicable daily full cost billing rates in effect at the time – is $155,121. 

Action Required 

We have closed this report in our audit tracking system based on the comments regarding 

corrective actions in your e-mail dated March 4, 2009. We believe the proposed actions, when 

implemented, will adequately address the report’s findings and recommendations. Please 

provide updated information in EPA’s Management Audit Tracking System as you complete 

each planned corrective action or revise any corrective actions and/or milestone dates. If you are 

unable to meet your planned milestones, or believe other corrective actions are warranted, please 

send us a memorandum stating why you are revising the milestones or why you are proposing 

alternative corrective actions, as required by EPA Manual 2750. 
We would like to thank your staff for their cooperation. We have no objections to the further 

release of this report to the public. This report will be available at http://www.epa.gov/oig. 

If you or your staff have any questions regarding this report, please contact me at (202) 566-0893 

or brevard.rudy@epa.gov; or Cheryl Reid, Project Manager, at (919) 541-2256 or 

reid.cheryl@epa.gov. 
 

 

 

 

Lack of Project Plan Resulted in 09-P-0128 

Transition and Contractor Performance Problems 

for the Institutional Controls Tracking System 

Table of Contents 

Purpose ............................................................................................................................. 1 

Background ....................................................................................................................... 1 

Scope and Methodology .................................................................................................. 1 

Findings ............................................................................................................................. 2
 

Lack of SMP Contributed to Miscommunication................................................................... 2 

Project Delays Resulted from Insufficient System Testing and Documentation................... 3
 

Recommendations............................................................................................................ 4 

Agency Comments and OIG Evaluation............................................................................. 4
 

Status of Recommendations and Potential Monetary Benefits.................................... 6 

Appendix 

A Distribution ......................................................................................................... 7 
 

09-P-0128 

Purpose 

The Office of Inspector General (OIG) of the U.S. Environmental Protection Agency (EPA) 

performed this review due to an anonymous hotline complaint that alleged mismanagement of 

the Institutional Controls Tracking System (ICTS) project. The ICTS was being developed by 

the Office of Superfund Remediation and Technology Innovation (OSRTI), within EPA’s Office 

of Solid Waste and Emergency Response. We performed a limited review of OSRTI’s 

management oversight processes for the development of ICTS. 

Background 

EPA’s vision for managing Institutional Controls (IC) information is through an integrated ICTS. 

ICs are non-engineered measures, such as administrative and legal controls over land or resource 

use, which minimize human exposure to contaminants and protect the integrity of a remedy. 

ICs are tools used on Superfund, Brownfields, Federal Facilities, Underground Storage Tanks, 

and Resource Conservation and Recovery Act clean-ups. Prior to ICTS, EPA systems did not 

capture IC information at the level of detail to track, monitor, and distribute information to 

stakeholders. Also, none of EPA’s systems allowed public queries and information distribution 

at the individual IC objective or instrument level. 

In 2002, the Assistant Administrator for Solid Waste and Emergency Response announced the 

goal to make more hazardous site information available to the public. OSRTI began to develop 

ICTS to capture land use controls and present the information on the Internet. By 2004, ICTS 

allowed EPA regions and offices to input data into ICTS. By the end of 2004, EPA developed an 

IC strategy to make sure the Agency required and monitored ICs at Superfund sites. In 2005, 

OSRTI further developed ICTS to expand the amount of data or related data fields to make the 

information more useful in applying the IC strategy. In 2007, ORSTI began efforts to merge 

ICTS with the Superfund Document Management System (SDMS). This effort, along with plans 

to integrate the Comprehensive Environmental Response, Compensation, and Liability 

Information System with SDMS, were considered essential in EPA’s plan to consolidate 

Superfund-related data distributed among various EPA systems. 

EPA’s System Life Cycle Management procedures outline EPA’s system development 

requirements. The procedures require that a project have a System Management Plan (SMP). 

This plan is the main managerial document and serves as a portfolio of required documents used 

by system managers to control, assess, and document the system. The SMP should have a 

project quality assurance plan and decision papers. The project quality assurance plan provides 

guidance on development of products created to make sure they are substantively accurate and 

conform to a standard project management structure. Decision papers summarize those aspects of 

the analysis and decisions of a given project phase that are important to program management and 

requests approval to continue the project. 

Scope and Methodology 

We performed this audit from October 2008 through February 2009 at EPA Headquarters in 

Washington, DC, in accordance with generally accepted government auditing standards. These 

1 
09-P-0128 

standards require that we plan and perform the audit to obtain sufficient and appropriate evidence 

to provide a reasonable basis for our findings and conclusions based on the audit objectives. We 

believe the evidence obtained provides a reasonable basis for our findings and conclusions. 

We assessed management control processes for developing of ICTS. We reviewed contract and 

system documents prepared between 2003 and 2008 relevant to the hotline complaint. We also 

spoke with current and past ICTS managers and Office of Acquisition Management’s contract 

officer to learn about ICTS development history and contractor performance. 

We did not review whether the ICTS contractor complied with the contract provisions or 

safeguarded resources. Therefore, the user of this report would not be able to determine whether 

(1) funds awarded for ICTS work were spent according to the contract, or (2) EPA took adequate 

steps to safeguard resources. 

We had not performed past audits of ICTS, so no follow-up was performed during this audit. 

Findings 

Lack of compliance with project management procedures resulted in problems that delayed ICTS 

development and had a negative effect on contractor performance. Although we could not 

substantiate the claims of mismanagement alleged in the hotline complaint, the absence of key 

decision documents and high turnover of key ICTS staff could have contributed to the perception 

that ICTS project decisions were made in a haphazard manner. Had OSRTI documented its key 

decisions in an SMP, as required by EPA guidance, institutional documents would have existed 

to communicate and answer project questions during transition of ICTS project staff. 

Internal controls do not guarantee the success or prevent mismanagement of a project. However, 

such controls provide a means to manage the risk associated with a complex project like ICTS. 

Documenting key decisions on various risk factors is a key component of a project plan. 

Whether it is contractual risks or risks in personnel retention, documentation serves as proof of 

management’s due diligence as stewards of resources. Office of Management and Budget 

Circular A-123, Management's Responsibility for Internal Control, states that documents for 

management controls and other significant events must be clear and available for examination. 

Without documenting key oversight decisions, management lacks information needed to ensure 

assigned staff is meeting responsibilities and key decisions are having the desired effect. 

Lack of SMP Contributed to Miscommunication 

Prior to April 2006, OSRTI had not created an SMP that included documents for management 

decisions that governed development of ICTS. We requested historical documents from the 

beginning of the ICTS project and were told by earlier ICTS managers there were none. We 

further learned that throughout the initial development phases of ICTS, there had been many 

changes in staff responsible for managing ICTS development. Changes included the assistant 

administrator, system owner, project manager, and contractor. These factors contributed to the 

transitional problems because communication channels were not kept open as staff rotated and 

historical documents were not available, so newly assigned project staff could know prior 

2 
09-P-0128 

decisions made. This problem could have been minimized had OSRTI documented key project 

decisions as they occurred and maintained the documentation in an SMP. The current project 

manager sent us a copy of an SMP. The project manager said that when he took over in April 

2006, it was one of his early directions to the contractor to create an SMP. Although the project 

manager took steps to correct this issue, we found that many of the SMP documents are in draft 

status and OSRTI should conduct a review to ensure needed documents are current and 

approved. 

Project Delays Resulted from Insufficient System Testing and Documentation 

The ICTS project also had significant project delays when the Agency switched contractors in 

January 2005. OSRTI purchased a task order under EPA’s existing contract, “Information 

Technology Solutions.” OSRTI managers said there were contractor performance concerns and 

a subsequent poor performance evaluation. In response, the new contractor cited that system 

requirements were not complete and system documents were dated. Also, the contractor stated 

that there was missing information on data elements that were needed for them to do their work. 

EPA did not dispute this statement and replied: 

The system delivered...was never tested. It is more than likely that some of the 

problems that emerged...were already present in the application, but since the 

application was neither tested nor used, problems lay dormant. 

In response to our discussion draft report, OSRTI disagreed that the system was “never” tested. 

They stated that due to differences between EPA’s staging and production environments, the 

testing in staging proved insufficient. As a result, problems quickly surfaced in the production 

application. OSRTI indicated it reviewed the processes used to move an application to 

production, which led to an overhaul of the processes. OSRTI indicated it was able to 

subsequently redeploy ICTS. 

EPA’s system life-cycle management processes are designed to make sure management is 

involved at key decision points, obtain and sustain the Agency’s commitment, and coordinate 

systems-related activities. Project planning and tracking are vital to the success of the project. 

Project planning helps set up reasonable plans for building a system, while project tracking 

provides assurance that the project plan is being followed. The Agency’s Automated Security 

Self Evaluation and Remediation Tracking system is used to create Plans of Actions and 

Milestones for identified system problems. Because OSRTI had not initially followed key 

system development practices in project planning and tracking, it had communication and 

contractor performance problems that led to OSRTI putting into production a version of ICTS 

that had significant quality problems. Although OSRTI appointed a certified project manager to 

further oversee ICTS and the SDMS project, it is incumbent upon management to document its 

processes for managing the SDMS project and conduct quality assurance reviews to make sure 

the processes are being followed as intended. 

3 
 

09-P-0128 

Recommendations 

We recommend that the Director, Office of Superfund Remediation and Technology Innovation, 

Office of Solid Waste and Emergency Response: 

1.	 Document procedures for overseeing the development activities for the SDMS project as 

prescribed by EPA System Life Cycle Management guidance. The procedures should 

contain steps to ensure that: 

a.	 The new SMP for SDMS is kept current and management decisions are 

documented as they occur. 

b.	 Testing of SDMS is completed as prescribed by EPA guidance. 

2. Conduct and document a review of SDMS documentation to ensure the documents are 

current. If needed, direct the contractor to update system documents. 

3. Create a Plan of Actions and Milestones in EPA’s Automated Security Self Evaluation 

and Remediation Tracking system for the above recommendations. 

Agency Comments and OIG Evaluation 

On February 26, 2009, we met with OSRTI management to discuss the discussion draft version 

of our report. OSRTI said the discussion draft did not provide the current status of ICTS and 

should reflect that OSRTI integrated ICTS with SDMS. OSRTI also said the report did not 

provide the timeframe for when noted weaknesses existed and indicated it has taken steps to 

better manage SDMS. OSRTI asked OIG to reword the recommendations to make them apply to 

SDMS and note that SDMS has an SMP. Lastly, OSRTI contended that it should not be inferred 

that a problem in a complex system development project such as ICTS means automatic 

deficiencies in project management. 

We changed the report where appropriate to address OSRTI concerns. We agree that problems 

that arise during system development do not automatically indicate project management 

problems. Software quality, reliability, and maintainability are enhanced by having good project 

documents for requirements, architecture, interfaces, test procedures, and management decisions. 

This is important during changes in contractors and project managers. We believe good 

documentation is the cornerstone of good project management. As such, we believe the lack of 

key project documents, combined with the turnover of project managers, directly contributed to 

perceptions that the ICTS project was not managed in accordance with prescribed system 

development practices. Also, project management is designed to reduce project risks. Had 

OSRTI kept key project documents, it would have had historical documents to better manage the 

risks that affected ICTS during contractor and project management turnover. 

After our meeting with OSRTI, management replied in an e-mail dated March 4, 2009, that it 

will create an on-going review process to ensure that all major and non-major information 

technology systems have current and complete SMPs. OSRTI also put Plans of Actions and 

Milestones in EPA’s Automated Security Self Evaluation and Remediation Tracking system to 

4 
09-P-0128 

track completion of our report’s recommendations. We believe these corrective actions address 

our recommendations and will help ensure ICTS meets its desired program goals. 

5 
 

 

 

 

 

 

 

 

 

09-P-0128 

Status of Recommendations and 

Potential Monetary Benefits 

POTENTIAL MONETARY 

RECOMMENDATIONS BENEFITS (in $000s) 

Rec. 

No. 

Page 

No. Subject Status1 Action Official 

Planned 

Completion 

Date 

Claimed 

Amount 

Agreed To 

Amount 

1 

2 

3 

4 

4 

4 

Document procedures for overseeing the 

development activities for the SDMS project as 

prescribed by EPA System Life Cycle 

Management guidance. The procedures should 

contain steps to ensure that: 

a. The new System Management Plan for 

SDMS is kept current and management 

decisions are documented as they occur. 

b. Testing of SDMS is completed as prescribed 

by EPA guidance. 

Conduct and document a review of SDMS 

documentation to ensure the documents are 

current. If needed, direct the contractor to update 

system documents. 

Create a Plan of Actions and Milestone in EPA’s 

Automated Security Self Evaluation and 

Remediation Tracking system for the above two 

recommendations. 

O 

O 

C 

Director, Office of 

Superfund Remediation and 

Technology Innovation 

Director, Office of 

Superfund Remediation and 

Technology Innovation 

Director, Office of 

Superfund Remediation and 

Technology Innovation 

04/01/2009 

10/01/2009 

03/04/2009 

O = recommendation is open with agreed-to corrective actions pending 

C = recommendation is closed with all agreed-to actions completed 

U = recommendation is undecided with resolution efforts in progress 

6 

1 
09-P-0128 

Appendix A 

Distribution 

Office of the Administrator 

Acting Assistant Administrator for Solid Waste and Emergency Response 

Director, Office of Superfund Remediation and Technology Innovation, 

 Office of Solid Waste and Emergency Response 

Agency Follow-up Official (the OCFO) 

Agency Follow-up Coordinator 

Acting General Counsel 

Acting Associate Administrator for Congressional and Intergovernmental Relations 

Acting Associate Administrator for Public Affairs 

Audit Follow-up Coordinator, Office of Solid Waste and Emergency Response 

Acting Inspector General 

7