Office of Inspector General

Audit Report

IMPROVEMENTS TO DOT’S 

GOVERNANCE PROCESSES ARE 

NEEDED TO ENHANCE OVERSIGHT 

OF MAJOR IT INVESTMENTS

Office of the Secretary of Transportation

Federal Aviation Administration

Report Number: ZA-2013-057

Date Issued: March 27, 2013
U.S. Department of

Memorandum

Transportation

Office of the Secretary

of Transportation

Office of Inspector General

Subject: ACTION: Improvements to DOT’s Governance 

Processes Are Needed To Enhance Oversight of 

Major IT Investments

Report Number ZA-2013-057

Office of the Secretary of Transportation

Federal Aviation Administration

Date: March 27, 2013

From: Mary Kay Langan-Feirson

Assistant Inspector General for Acquisition and

 Procurement Audits

Reply to 

Attn. of: JA-60

To: Deputy Secretary 

Federal Aviation Administrator 

The U.S. Department of Transportation’s (DOT) fiscal year 2012 major 

information technology (IT) investment portfolio was just over $2.2 billion.

1

About 94 percent ($2.07 billion) of the portfolio is managed by the Federal 

Aviation Administration (FAA). FAA’s major IT investments fund important 

aviation modernization programs, including the Next Generation Air 

Transportation System (NextGen), a multibillion-dollar effort to modernize the 

U.S. air traffic control system.

2 However, since 2005, FAA has experienced cost 

overruns, schedule delays, or both on 7 of its 14 major air traffic control IT 

programs, including 1 that exceeded original cost estimates by $2 billion and was 

delayed by 14 years.3

 1 OMB Circular A-130, “Management of Federal Information Resources,” defines “major information system(s)” as 

those that require special management attention for reasons including importance to the agency’s mission; high 

development, operating, or maintenance costs; or significant role in administering agency programs. The $2.2 billion 

represents DOT’s major IT investments as reported on OMB’s IT dashboard, as of September 2012. DOT’s total 

portfolio including non-major IT investments is $3.0 billion.

Our office and the Government Accountability Office

(GAO) have issued numerous audit reports and testimonies related to FAA’s major 

IT investments that point to longstanding and significant concerns in the Agency’s 

management and oversight of these critical programs (see exhibit B).

2 According to FAA’s fiscal year 2012 enacted budget, 30 percent of its IT investment portfolio is devoted to NextGen 

programs. 

3 FAA’s February 2012 Capital Investment Plan, Appendix D. 
2

To improve oversight of major Federal IT investments, the Office of Management 

and Budget (OMB) called for agencies to establish executive investment 

governance processes. In response, DOT established a departmental Investment 

Review Board (IRB), effective December 4, 2009, to help ensure the Department 

realizes optimal value for its IT investments. DOT also required that individual 

IRBs be established within each of its 12 Operating Administrations that are 

responsible for overseeing their IT investments. The Joint Resources Council 

(JRC) serves as FAA’s IRB to help ensure FAA’s capital investments fulfill 

mission priorities and maximize resources. 

Given the cost, complexity, and importance of major IT investments to the

Department’s mission, we assessed whether (1) DOT’s investment governance 

practices meet Federal and statutory investment oversight requirements and best 

practices, and (2) FAA and DOT provide sufficient oversight of FAA’s major IT 

investments. 

In conducting this audit, we analyzed DOT’s and FAA’s investment review 

policies and practices, interviewed IRB and JRC members, surveyed Chief 

Information Officers (CIO) at all 12 of DOT’s Operating Administrations, and 

reviewed all 15 key investment decisions that the JRC made in calendar year 2010 

through November 2011, worth a combined value of over $2.6 billion. We 

conducted this review between September 2011 and January 2013 in accordance 

with generally accepted Government auditing standards prescribed by the 

Comptroller General of the United States. Exhibit A provides further details on 

our scope and methodology.

RESULTS IN BRIEF

DOT’s investment oversight practices do not fully meet OMB requirements or 

DOT policies. Specifically, DOT does not have an active IRB or supporting 

boards to provide a comprehensive management framework. Until recently,4 the 

Department had not held a senior management level IRB meeting in almost 

2 years, despite OMB requirements to meet periodically and DOT’s 2009 IRB 

Charter requirements to meet semiannually.

5

 4 On December 14, 2012, DOT held its first IRB meeting since February 2011. The meeting did not include a review of

DOT’s IT portfolio. Instead, the Office of the CIO (OCIO) presented a proposed framework for departmentwide IT 

governance and a draft, updated IRB charter, which was dated October 23, 2012. 

IRB meetings are intended to provide 

strategic oversight of DOT’s entire IT investment portfolio. Instead, DOT relied

solely on evidence-based TechStat accountability sessions, which are, by design, 

5 OMB Circular A-130, “Management of Federal Information Resources,” requires agencies to establish oversight 

mechanisms that require periodic review of information systems. Under DOT’s IRB charter, dated December 4, 2009, 

the IRB is to meet semiannually to provide strategic direction, leadership, and alignment of IT investments and 

programs with DOT business needs and direction, budget objectives, goals, performance planning, and reporting to 

conduct investment oversight duties.
3

less comprehensive than IRB reviews because they focus on individual troubled or 

underperforming programs. OMB requires that agencies use TechStat sessions and

specifies that the sessions should supplement rather than replace agency IRB 

reviews.6 Additionally, DOT did not fully implement OMB’s TechStat guidance. 

For example, DOT did not consistently hold program offices accountable for 

completing assigned action items, which, according to OMB, is a key objective of 

TechStat sessions. For the 8 TechStat sessions we reviewed, DOT did not track

56 percent of action items to completion. During our audit, DOT initiated actions 

intended to reform its IT investment oversight, such as issuing a high-level 

departmental IT governance policy7

FAA and DOT face challenges in providing sufficient oversight of FAA’s major 

IT investments. FAA’s JRC has a comprehensive framework for investment 

governance, yet the Agency does not always follow the JRC approval and 

oversight process. For example, program offices do not always submit critical 

investment information—such as program requirements and cost and schedule 

estimates—prior to JRC investment decisions, and the JRC Secretariat does not 

maintain a complete repository of investment information as FAA’s Acquisition 

Management System (AMS) requires.

and proposing a new framework for IT 

governance. However, DOT has not yet developed comprehensive plans and 

procedures to implement this new framework. 

8

We are making a series of recommendations to improve DOT’s and FAA’s 

oversight of major IT investments.

Consequently, the JRC risks making 

investment decisions with incomplete information, which could jeopardize the 

success of critical FAA programs. FAA has recently created a new Program 

Management Office (PMO) for its Air Traffic Organization (ATO) to oversee the 

execution of its IT programs and supplement the JRC; however, this group is not 

yet fully staffed and lacks processes needed to function effectively in this role. 

Finally, DOT’s IT governance process provides only limited oversight of FAA’s 

major IT investments—even though FAA’s IT investments comprise 94 percent 

($2.07 billion) of DOT’s fiscal year 2012 major investment portfolio. Notably, 

DOT has only reviewed two FAA programs in the past 2 years. 

BACKGROUND

Since the 1990s, Federal initiatives have called for agencies to use rigorous 

governance processes to manage their investments. The Clinger-Cohen Act of 

1996 establishes the CIO position in Federal executive agencies and requires each 

 6 OMB guidance, A Year in Review: Outcomes and Lessons Learned from Implementing Agency-Led TechStat Reviews 

Across the Federal Government, states that TechStat reviews are to be integrated into the agency’s broader IT 

management framework. OMB also states that TechStats should not be viewed as a separate investment review process. 

7 DOT Policy Order 1351.39, dated August 29, 2012.

8 AMS Appendix A, Roles and Responsibilities.
4

agency to implement a management framework to optimize IT expenditures.

9

FAA’s IRB is the JRC. Under FAA’s AMS, the JRC is to help ensure FAA’s 

capital investments fulfill mission priorities and maximize resources, and the JRC 

Executive Secretariat manages a Readiness Process intended to determine if its 

investments align with FAA’s mission. FAA’s Capital Investment Planning and 

Control Process prescribes key decision points to determine and prioritize 

investment decisions, implement solutions, and manage them over their lifecycle 

(see table 1).

OMB’s Circular A-130, “Management of Federal Information Resources,” issued 

November 2000, requires the agency’s CIO to (1) monitor and evaluate IT 

investment performance through a capital planning and investment control 

process, and (2) advise the agency head on budgetary implications of IT decisions. 

In response, DOT chartered its IRB in December 2009. In addition to the 

departmentwide IRB, the Department required each DOT Operating 

Administration to establish an IRB to select and manage their individual 

investments.

Table 1. Key Decision Points in FAA’s Lifecycle Management 

Process

Key Decision Definition

Concept & Requirements 

Definition Readiness

Translates priority operational needs in the Enterprise Architecture 

(EA) into preliminary requirements and a concept of operations to 

improve service delivery. Identifies alternative solutions able to 

satisfy the service need.

Investment Analysis 

Readiness

The Investment Decision Authority (IDA) determines whether the 

concept of use, preliminary requirements, EA products, and 

alternatives are sufficiently defined to move to investment analysis.

Initial Investment Enables the IDA to select the best alternative that meets the 

required performance and offers the greatest value.

Final Investment Details planning for the alternative selected for implementation.

In-Service Authorizes deployment of a solution into the operational 

environment.

Baseline Change Replans the remaining schedule and/or reallocates the remaining 

budget.

Source: FAA

Recently, OMB has placed increased importance on sound agency capital planning 

and IT investment governance to improve the way Federal IT investments are 

 9 Clinger-Cohen Act of 1996 (formerly the Information Technology Management Reform Act), Pub. L. No. 104-106, 

Division E (1996); codified at 40 United States Code (U.S.C.) § 11101, et seq. (2011). According to FAA, the ClingerCohen Act does not apply to the Agency because 49 U.S.C. § 40110(d) empowers the FAA Administrator to establish 

the AMS to address the unique needs of FAA without requiring compliance with most Federal acquisition laws or 

regulations, including the Clinger-Cohen Act.
5

managed. In December 2010, the Federal CIO issued an assessment of 

governmentwide IT governance and announced a plan for IT reform, which 

established the requirement for Federal agencies to conduct TechStat 

accountability sessions on troubled investments, and to turnaround or terminate 

poorly performing projects.

10 In August 2011, OMB required that agency CIOs be 

positioned with the authority to improve their agencies’ operating efficiencies, 

take a lead governance role, and ensure IT portfolio analysis is an integral part of 

the annual budget process.11

In December 2011, the Federal CIO Council issued an assessment of agency-led 

TechStats after 1 year of implementation across the Federal Government. The 

Federal CIO Council’s report reiterated that TechStat accountability sessions 

(1) provide a valuable accountability tool to supplement existing agency review 

processes and IRBs, and (2) are intended to be integrated into agencies’ strategic,

comprehensive performance management frameworks for their IT investment 

portfolios.12

DOT’S INVESTMENT OVERSIGHT PRACTICES DO NOT FULLY 

MEET OMB REQUIREMENTS OR DOT POLICIES

DOT does not have a comprehensive management framework for executive 

oversight of its $2.2 billion major IT investment portfolio. Instead of holding 

required senior management level IRB meetings, which focus on reviewing the 

Department’s entire IT investment portfolio, DOT had, until recently, relied solely 

on TechStat accountability sessions, which are intended to only focus on 

individual troubled or underperforming programs. Further, DOT has not fully 

implemented OMB’s TechStat guidance and has not held TechStats for several

projects that DOT rates as “at risk.” During our audit, DOT initiated some actions 

intended to reform its IT investment framework, but it has not yet developed 

comprehensive plans and procedures to implement them.

DOT Does Not Have a Comprehensive Framework for Executive 

Oversight of Its IT Investments

Until recently, DOT’s IRB had not held required semiannual investment review 

sessions since February 2011. As a result, DOT has not complied with either 

OMB’s requirements for investment oversight or DOT’s 2009 IRB Charter, which 

outlines specific planning and oversight roles for the IRB. Officials from DOT’s 

Office of the CIO (OCIO) explained that the Department placed the IRB process 

 10 OMB, 25 Point Implementation Plan to Reform Federal Information Technology Management, Dec. 9, 2010. 11 OMB Memorandum, “Chief Information Officer Authorities,” Aug. 8, 2011. 12 OMB guidance, A Year in Review: Outcomes and Lessons Learned from Implementing Agency-Led TechStat Reviews 

Across the Federal Government, Dec. 8, 2011.
6

in “hibernation” because the meetings were ineffective at overseeing DOT’s

investments. According to OCIO officials, IRB members frequently delegated 

meeting attendance to lower ranking officials, so the IRB could not make 

meaningful decisions needed to oversee DOT’s IT investments. We briefed DOT 

on our audit findings in September 2012, and the OCIO subsequently held an IRB 

meeting on December 14, 2012. However, this IRB meeting did not include a 

review of DOT’s IT portfolio or troubled programs. Instead, the OCIO presented a 

proposed framework for DOT’s IT governance and a draft, updated IRB Charter, 

dated October 23, 2012. The OCIO did not schedule the next IRB meeting or 

establish action items to finalize the IT governance framework and IRB Charter.

In addition, while DOT’s 2009 IRB Charter designated a subcommittee called the

Executive Committee (ExComm) to oversee the individual IRBs of DOT 

Operating Administrations,

13 it too stopped meeting. In response to our survey, 

9 of 11 CIOs—who oversee their Operating Administration’s IRBs—stated that

the ExComm has not assessed their IRBs’ performance. As such, the ExComm 

and OCIO lack full insight and are not well positioned to advise on investments 

approved by the Operating Administrations’ IRBs.14

Finally, while DOT’s Office of the Chief Financial Officer (OCFO) collaborates 

with Operating Administrations when they submit their annual budgets, DOT does 

not have a process to monitor and oversee Operating Administrations’ programs 

after they have been appropriated funding.15

Strategic departmentwide oversight is especially important in a decentralized 

department like DOT, which has 12 Operating Administrations, each with unique 

investment portfolios. Without an active IRB and supporting boards, DOT does 

not have a comprehensive management framework to provide executive oversight 

or integrated portfolio management of its $2.2 billion major IT investment 

portfolio. As a result, DOT is not well positioned to meet Federal requirements for 

investment oversight, which is intended to enforce accountability and maximize 

the value of IT investments.

This is contrary to OMB’s 

requirement that agency CIOs not only have the authority to improve their 

agencies’ IT program operating efficiencies but that they also take a lead 

management advisory role, to include recommending termination of 

underperforming programs, when necessary.

 13 DOT’s 2009 IRB charter also requires the ExComm subcommittee to meet quarterly to ensure Operating 

Administrations execute their responsibilities for planning, selecting, acquiring, securing, operating, and managing IT 

investments.

14 DOT’s draft, updated IRB charter, dated October 23, 2012, would eliminate the ExComm’s role and establish an 

Executive Secretariat to monitor Operating Administrations’ IRB performance.

15 DOT’s December 14, 2012, proposed framework for IT governance provides a conceptual model illustrating at a 

high level the intended relationships among DOT’s IRB, the Operating Administration’s IRBs, and their budget offices. 
7

DOT Relied Solely on TechStat Reviews of Individual Programs in 

Place of Strategic Oversight of the Department’s IT Portfolio

During our review, DOT relied solely on its TechStat accountability sessions for 

its IT management framework. However, TechStats are intended to review

individual troubled programs rather than support portfolio-wide investment 

decisions. In 2010, OMB required all agencies to conduct TechStat accountability 

sessions, which are evidence-based reviews of troubled or underperforming IT 

programs. While DOT began its TechStat accountability sessions in March 2011, 

it did not until recently hold IRB meetings, which are intended to provide strategic 

IT oversight for the entire Department. As a result, TechStat sessions had replaced 

rather than supplemented DOT’s IRB reviews, contrary to OMB guidance. As 

table 2 on the next page illustrates, TechStat reviews of individual programs serve 

a different purpose than IRB oversight of the Department’s entire IT portfolio.

Since March 2011, DOT has only reviewed 9 of 44 (20 percent) major IT 

programs using TechStat accountability sessions. Such minimal oversight weakens 

DOT’s ability to effectively manage its entire IT investment portfolio.16

 16 The nine TechStat accountability sessions were held from March 2011 through April 2012. According to DOT OCIO 

officials, the OCIO cancelled two sessions scheduled in that timeframe because DOT did not want to review programs 

that OMB had already reviewed. 
8

Table 2. Comparison of DOT’s IRB Reviews and TechStat 

Sessions

IRB Reviews (including ExComm)a TechStat Sessionsb

Purpose • Provide strategic leadership

• Align IT investments with DOT’s needs 

• Establish budget goals as well as 

performance planning and reporting

• Review programs to provide executive 

management oversight of large-dollar, 

major, cross-agency, or troubled IT 

projects

• Review Operating Administrations’ IRB 

performance and make specific project 

management recommendations

• Reduce wasteful spending by turning 

around troubled or risky programs,

and terminating failed programs 

sooner

• Identify lessons learned to better 

manage Federal IT Investments

• Hold officials accountable for 

program success

• Assign concrete actions to address 

weaknesses

Approach • Semiannual IRB meetings

• Quarterly ExComm meetings

• Monthly meetings

Voting 

Members/Attendees • Deputy Secretary

• DOT CIO

• DOT CFO

• Deputy General Counsel

• Assistant Secretary for Administration

• Under Secretary for Policy

• Administrator from each DOT Operating 

Administration

• DOT CIO and staff

• Program office of the troubled 

program

a According to the OCIO’s draft, updated IRB Charter (dated October 23, 2012, and pending approval), 

several changes are to be made to the IRB. For example, (1) the ExComm will be eliminated and replaced 

with an Executive Secretariat, (2) IRB meetings will be held at least annually, and (3) the Senior 

Procurement Executive will become a voting member.

b DOT’s proposed framework for IT governance, dated December 14, 2012, introduced the concept of an 

Investment Working Group (IWG), which would report to the IRB on its analysis and research of IT 

investments. A key responsibility of the IWG would include reviews of high-risk or underperforming 

investments, a role similar to DOT’s TechStat.

Source: OIG analysis of DOT’s December 4, 2009, IRB Charter; DOT’s draft October 23, 2012,

IRB Charter; and OMB’s TechStat guidance.

DOT Did Not Fully Implement OMB’s TechStat Guidance Resulting in 

Diminished Oversight of Its Troubled Programs

During our review, DOT held TechStat reviews as a substitute for a 

comprehensive IT management framework. Even though it held TechStat reviews, 

it did not fully implement OMB’s TechStat guidance. DOT followed some of 

OMB’s guidance on TechStat accountability sessions, such as providing subject 

matter expert reviews of investment documents and preparing decision 

memoranda that assign action items to program offices. However, DOT did not 

comply with OMB guidance to fully develop and institutionalize its TechStat 

process. Specifically, DOT did not (1) formalize its TechStat authority within its 
9

IT management framework, (2) establish clear criteria to select and prioritize 

investments requiring TechStat reviews, (3) consistently hold Operating 

Administrations accountable for completing assigned action items, or 

(4) implement an effective means to document and share lessons learned and best 

practices.

DOT did not formalize TechStat authority within its IT management 

framework. DOT has not updated its 2009 IRB Charter to reflect OMB guidance,

which states that an agency’s IRB should be the primary governing body that 

enforces TechStat decisions. Without an updated charter, DOT’s IRB did not have 

formal authority over the TechStat decision-making process. In addition, since no 

IRB meetings were held, senior management lacked the insight and ability to 

oversee troubled programs, as OMB had intended for a functioning and

comprehensive IT governance framework.

17

DOT does not have clear criteria to select and prioritize investments 

requiring TechStat reviews. According to OMB guidance, DOT should have a 

methodology and consistent metrics—such as cost, schedule, and program 

significance—to select investments for TechStat review. Because DOT does not 

have documented procedures for selecting and prioritizing programs for review, it 

may miss opportunities to turnaround underperforming programs. For example, 

DOT’s TechStat has not yet reviewed three of seven programs that the DOT CIO 

currently rates as “at risk.”18 These three programs represent over $81 million in 

fiscal year 2012 spending.19

DOT does not consistently hold Operating Administrations accountable for 

completing assigned TechStat action items. According to OMB guidance, action 

items are a main feature of TechStat sessions and can help ensure the success of 

reviewed programs. We reviewed the meeting minutes for 8 TechStat sessions20—

all that were available at the time of our audit—and found that DOT did not track 

4121

 17 The DOT OCIO’s draft updated IRB charter, dated October 23, 2012, would, if adopted, provide the IRB with the 

authority to enforce TechStat decisions.

(56 percent) of 73 action items to completion, all of which are at least 

6 months overdue. For example, at a TechStat session for the National Highway 

Traffic Safety Administration’s (NHTSA) Modernization and Consolidation 

program—projected to spend $6.8 million through budget year 2013—DOT 

18 As of July 2012, DOT had seven programs rated as “medium risk” and no programs rated as “high risk.” Two of the 

three programs not reviewed have been “at risk” or underperforming since September and November 2011, while the 

other has been “at risk” since January 2011.

19 As reported on OMB’s IT Dashboard. 20 Although DOT held nine total TechStat sessions, the information for one of these sessions was unavailable at the 

time of our review. 21 The 41 action items include 37 listed in DOT’s action item tracking tool and 4 that were assigned during a TechStat 

session but not listed in the tracking tool. DOT did not have documentation explaining why these action items were not 

being tracked.
10

assigned seven action items to NHTSA program officials to improve cost 

consolidation, governance, program initiation, and business needs analysis.22

DOT lacks an effective means to document and share lessons learned and best 

practices for its TechStat process. According to OMB, an intended goal of the 

TechStat process is to document and share lessons learned and best practices. 

DOT’s OCIO stated that DOT officials currently share best practices verbally at 

monthly CIO council meetings; however, they do not keep meeting minutes, so 

any best practices that may be discussed are not documented—a practice contrary 

to OMB guidance.

Yet 

DOT only monitored three of the seven action items to ensure NHTSA completed 

them on time. This lack of accountability and follow up weakens the Department’s 

management of troubled and underperforming programs, and may impede or delay

decisions to redirect limited budget resources to other programs or agency 

priorities.

23 Consequently, DOT is missing opportunities to leverage 

knowledge management, information-sharing best practices, and approaches from 

Government and industry to ensure that investments produce high-quality products 

on time and within budget.24

DOT Has Initiated Actions To Reform Its Governance Structure But 

Does Not Have a Comprehensive Implementation Plan 

During the course of our audit, DOT’s OCIO initiated actions to reform its IT 

governance. These actions include proposing a new framework for DOT’s IT 

governance; issuing a policy order pertaining to DOT’s IT governance structure;

and proposing a draft, updated IRB Charter. However, DOT does not have a 

comprehensive plan to implement the new policy order and to finalize the 

proposed framework and the draft, updated IRB Charter.

In March 2012, the OCIO shared with us a draft high-level proposal for a new 

departmentwide governance structure for major IT investments. The OCIO told us 

that the components of the proposed March 2012 structure would include a 

reinstatement of DOT’s IRB as the highest level of reporting and a continuation of

TechStat accountability sessions of troubled or underperforming programs. 

 22 According to NHTSA, this program is intended to replace two of its core data collection, analysis, and reporting 

systems.

23 OMB Circular A-123, “Management’s Responsibility for Internal Control,” Dec. 21, 2004. The Circular requires that 

appropriate internal control should be integrated into each agency system used to direct its operations. It also requires 

that agency management should have well-defined documentation processes that contain an audit trail, include 

verifiable results, and specify document retention periods so that someone not connected with the procedures can 

understand them. 24A knowledge-based approach to product development efforts enables developers to be reasonably certain, at critical 

junctures or “knowledge points” in the acquisition life cycle, that their projects are more likely to meet established cost, 

schedule, and performance baselines, and therefore provides them with information needed to make sound investment 

decisions. See GAO report, NASA: Implementing a Knowledge-Based Acquisition Framework Could Lead to Better 

Investment Decisions and Project Outcomes (GAO-06-218A) Dec. 21, 2005. 
11

According to the OCIO, the goal of its new governance structure is to transform 

the role of the OCIO to that of a trusted advisor and consultant on the 

Department’s major IT projects. 

On August 29, 2012, the OCIO issued Policy Order 1351.39, “Departmental 

Information Technology Governance Policy,” intended to serve as the overarching 

DOT policy pertaining to the governance structure for IT management investments 

and operations. The policy order delegates new oversight responsibilities to 

DOT’s CIO, including (1) development and implementation of policies, guidance, 

standards, and tools to support implementation of the IT governance policy; and 

(2) management of oversight processes, including accountability reviews of IT 

investments and evidence-based reviews of IT portfolios. The policy order also 

calls for Operating Administrations to comply with the IT governance policy and 

for increased collaboration among stakeholders. For example, it requires DOT’s 

CFO and Senior Procurement Executive (SPE)

25

However, Policy Order 1351.39 only provides a broad outline of DOT’s IT 

governance structure and lacks details regarding day-to-day implementation and 

practices. For example, the policy order describes DOT’s IT governance structure 

as “multiple groups, processes, schedules, roles, and responsibilities” with no 

mention of details of the OCIO’s proposed governance structure. Instead, the DOT 

policy order acknowledges that the DOT OCIO needs to develop implementation 

guidance.

to integrate the IT governance 

policy with their processes for making budget, financial, and acquisition 

management decisions. 

26 Further, the OCIO has not yet developed a comprehensive plan with 

milestones to implement the policy order, and the policy order does not clearly 

define the roles of critical agency stakeholders in DOT’s governance processes. To 

illustrate, the policy order does not specify the SPE’s role in key investment 

control and oversight bodies, such as the IRB or TechStat. OMB guidelines and 

GAO best practices state that failure to define roles and responsibilities can lead to 

missed opportunities to improve acquisition outcomes.27

In September 2012, we briefed DOT on our audit findings; in response, on 

December 14, 2012, DOT held its first IRB meeting since February 2011. At this 

meeting, the Deputy Secretary emphasized his commitment to strengthening the 

IRB’s role and oversight of DOT’s IT investments. The agenda for the December 

14, 2012, IRB meeting consisted of the OCIO introducing the IRB members to (1) 

a proposed framework for IT governance at DOT28

 25 The SPE’s responsibilities include ensuring that DOT acquisitions help accomplish the Department’s mission.

and (2) a draft, updated IRB 

26 DOT Policy Order 1351.39, Section 39.10.1, Aug. 29, 2012. 27 OMB Memorandum, “Conducting Acquisition Assessments under OMB Circular A-123,” May 21, 2008; 

GAO, A Framework for Assessing the Acquisition Function at Federal Agencies (GAO-05-218G), Sept. 2005. 28 DOT’s proposed IT governance framework, dated December 14, 2012, presented in a conceptual Microsoft 

PowerPoint presentation, reflects an evolution of an earlier draft proposal that the OCIO shared with us in March 2012. 
12

Charter, dated October 23, 2012. The OCIO’s proposed IT governance framework 

includes a conceptual model illustrating the intended roles of DOT’s IRB, a new 

Investment Working Group, the Operating Administration’s IRBs, and the DOT 

and Operating Administrations’ budget offices. For example,

• The DOT IRB is intended to provide strategic direction and planning for 

departmentwide portfolio concerns and major investments, supply IT guidance

in support of DOT’s budget and acquisition processes, and ensure 

accountability reviews of IT investments are conducted. 

• A new Investment Working Group (IWG), which would report to the IRB, is 

intended to implement cross-cutting initiatives throughout DOT in support of 

the IRB’s priorities. For example, one of the IWG’s key responsibilities would 

be to review high-risk or underperforming investments—a role similar to DOT 

TechStat sessions.

• The Operating Administrations’ IRBs are intended to provide investment 

management—including selecting, controlling, and evaluating their 

investments. 

• DOT’s budget office and the Operating Administrations’ budget offices would 

play a role in this new IT governance framework by providing input to the 

DOT IRB and the Operating Administrations’ IRBs. 

According to the OCIO, this new governance structure would offer benefits 

including cost savings from enterprise solutions, the setting of clear standards and 

repeatable processes for departmentwide initiatives, a focus on key priorities for 

managing DOT’s IT portfolio, and the integration of IT governance with the 

budget formulation process and acquisition strategy and planning. However, while 

the OCIO’s proposed structure acknowledged that DOT needs to be more 

accountable and efficient while implementing a sound governance process, the 

OCIO has not yet set a date to finalize the framework and has not implemented 

operating procedures to ensure that this framework is effectively institutionalized 

and consistently implemented departmentwide.

The OCIO’s draft, updated IRB Charter presented at the December 14, 2012, 

meeting addresses some concerns we shared with DOT during our September 

2012 briefing. For example, the draft, updated IRB charter (1) calls for the IRB to 

meet at least annually, (2) establishes DOT’s SPE as an IRB voting member, and 

(3) assigns the IRB authority to execute management oversight of IT investment 

performance through accountability reviews. However, DOT has not finalized a 

date to approve the draft, updated IRB charter, and the IRB has not yet convened

to review DOT’s entire IT portfolio.
13

Until DOT fully implements its new policy order, finalizes its draft IT governance 

framework and draft, updated IRB Charter, and integrates these three efforts, the 

Department’s $2.2 billion IT investment portfolio—including NextGen 

programs—is at risk of continued cost overruns and schedule slips due to 

insufficient oversight. 

FAA AND DOT FACE CHALLENGES IN PROVIDING SUFFICIENT 

OVERSIGHT OF FAA’S IT INVESTMENTS

FAA’s JRC has a framework for investment governance, yet the Agency does not 

always follow this JRC process. As a result, FAA risks making investment 

decisions with incomplete information, which could jeopardize the success of 

critical FAA programs. Moreover, FAA has recently created a new ATO PMO to 

oversee the execution of its IT programs and supplement the JRC, but it lacks 

documented policies and procedures to function effectively in this role. Finally, 

DOT’s governance process provides limited oversight of FAA’s major IT 

investments, which comprise the vast majority of the Department’s investment 

portfolio. 

FAA Does Not Always Follow Its JRC Process

FAA provides a structure for investment governance through its JRC, which 

includes a required approval and oversight process for key investment decisions. 

However, the JRC does not always hold program offices accountable for following 

this process, including (1) submitting critical investment information prior to 

investment decisions, (2) approving investment information prior to decisions, 

(3) completing action items on time, (4) meeting scheduled decision due dates, and 

(5) maintaining a complete investment decision repository. In addition, the JRC’s 

official investment decision repository is incomplete.

Critical investment documents are not always submitted prior to decisions.

The AMS and FAA guidance29

 29 FAA, Investment Decision Authority Process Guidance, Jul. 30, 2010.

require FAA program offices to provide the JRC 

with specific acquisition planning and control documents prior to key investment 

decisions. Without these documents—which contain critical investment data such 

as program requirements, detailed plans, cost and schedule estimates, and business 

cases—the JRC cannot ensure that it is fully informed on issues that may affect its 

investment decisions. However, the JRC made key investment decisions (valued at 

$23 million) for 2 of the 15 programs we reviewed without all of the required 

investment information—including the Implementation Strategy and Planning 

Document (ISPD). FAA describes the ISPD as the most critical, relevant, and 

meaningful information for investment decision making, as it contains plans for 

the investment’s implementation and in-service management. In one case, the JRC 
14

approved an $8 million baseline change for FAA’s Instrument Flight Procedures 

Automation program without the required Acquisition Program Baseline

document.30 In the other case, the JRC approved an initial investment decision for 

FAA’s NextGen Facilities program and authorized $15 million to conduct final 

investment analysis without required documentation, including the ISPD and the 

Final Investment Analysis Plan.

31

Critical investment documents are not always approved prior to decisions.

FAA guidance also requires that the investment information documents be 

approved and signed by FAA approving officials prior to investment decisions.32

However, 4 of the 15 programs we reviewed—including the En Route Automation 

Modernization program (ERAM) and Automatic Dependent SurveillanceBroadcast (ADS-B), which are both NextGen programs—lacked required 

approvals for some investment decision documents. Specifically, these programs

lacked approvals for documents such as the final business case, program baseline, 

and ISPD. However, the JRC made over $1 billion in investment decisions for 

these programs without approvals in place.

33

Controls are not in place to ensure action item due dates are met. The JRC 

assigns action items to resolve outstanding issues from investment decisions, often 

requiring program offices to finalize or obtain approval for investment documents. 

However, the JRC does not have adequate controls to ensure action item due dates 

are met. For example, the JRC did not hold the ERAM program office accountable 

for meeting an action item deadline to resolve open concerns about its ISPD. FAA 

had only given conditional approval for the ISPD because it had open concerns 

about whether ERAM’s installation and maintenance activities complied with 

necessary standards. Rather than require the program office to resolve these

concerns before the decision meeting, the JRC went ahead and approved a 

$330 million cost baseline increase in June 2011. The JRC also required the 

Missing and/or late signatures may 

indicate that approving officials have unresolved concerns with the investment or 

that they simply did not review the investment documents. An FAA official said 

that the JRC and program offices discuss the risks associated with making

investment decisions without approved investment information. However, FAA 

does not document these risk discussions and has not developed risk mitigation 

plans—contrary to AMS risk management policies. Further, we identified an 

instance in which FAA approving officials backdated approvals of an investment 

decision document. This practice calls into question the reliability of other 

investment documents that appeared to have timely approvals.

 30 The Acquisition Program Baseline defines cost, schedule, and performance baselines for the investment program. 31 The Final Investment Analysis Plan includes detailed cost and benefits estimates, detailed plans, and final 

requirements for the most promising alternative.

32 FAA, Investment Decision Authority Process Guidance, Jul. 30, 2010. 33 This includes documents that are either still completely missing signatures or were approved as much as 2 months 

after the decision date.
15

ERAM program office to resolve open concerns and submit an approved ISPD by 

the end of July 2011. Although the ERAM program office missed the deadline by 

4 months, there is no evidence that the JRC followed up with ERAM program 

officials, nor did it suspend or reconsider its rebaseline decision. The JRC’s 

practice of conditionally approving investment decisions without resolving 

existing technical program issues puts the schedule and cost for FAA programs at 

risk. These risks are magnified in already troubled programs. 

Scheduled investment decision meeting dates are not always met. The JRC 

does not hold program offices accountable for missing scheduled investment 

decision meetings. For example, FAA’s Aeronautical Information Management 

Modernization (AIM-M) program office postponed a final investment decision 

meeting three times over a 20 month period. The decision meeting concerned

segment 1 (valued at $23 million) of the AIM-M program, which is intended to 

improve the capacity and efficiency of airspace usage while reducing safety 

incidents caused by out-of-date or confusing information. Although the JRC 

ultimately canceled the AIM-M final investment decision meeting, it authorized 

$6.5 million in funding for the program based on the program office’s financial 

and technical analysis. This practice of postponing or canceling key investment 

decisions could also result in significant delays to interdependent programs. For 

example, FAA’s Next Generation Air/Ground Communications (NEXCOM)

shares interdependencies with AIM-M and could be affected by delays in AIM-M 

decisions.

The JRC’s investment decision repository is incomplete. FAA has not 

identified what type of investment decision documentation should be maintained 

by the JRC Executive Secretariat, and this office has only kept partial records of 

investment decision documents in its official repository. According to the AMS, 

the JRC Executive Secretariat’s office is to populate and maintain the repository to 

ensure it contains investment decision documentation, records of decision meeting 

minutes, assigned action items, and investment decision guidance documents and 

processes. However, the AMS does not specify which specific decision 

documents, such as the ISPD, should be maintained in the repository.

Consequently, we found that critical investment information was sometimes 

dispersed among the JRC repository, program offices, and other FAA offices. 

Specifically, for the 15 FAA programs that had key investment decisions between 

2010 and 2011, the repository lacked 14 of 53 investment decision documents—

including investment analysis plans and final ISPDs. Secretariat officials stated 

that they did not consistently maintain documents in the repository because they 

believed the documents were available elsewhere, such as a program office. 

However, one Secretariat official said that maintaining all investment documents 

in the repository would be a good business practice. In the absence of a properly 

maintained investment repository, FAA is missing opportunities to leverage 
16

knowledge management and information-sharing best practices and approaches 

from Government and industry to effectively manage its investments, including 

the (1) consistent management of investment information, (2) tracking of program 

baselines, (3) identification of major IT cost and management trends and program 

risks, (4) application of knowledge-based acquisition principles, and (5) capturing 

of lessons learned.

34

FAA Is Currently Implementing a New ATO Program Management 

Office To Enhance Program Oversight 

Leading organizations in Government and industry have used 

such approaches to deliver high-quality products on time and within budget. 

In September 2011, Congress approved FAA’s request to create a new ATO 

PMO35 as part of the Agency’s “Foundation for Success” initiative, which is 

focused on putting in place an improved organizational structure with the 

flexibility needed to keep pace with the growth and advancement of aviation 

worldwide. The ATO PMO is responsible for overseeing 26 of the Agency’s 

37 major IT programs. FAA estimated that it would spend $1.8 billion on these 

26 programs in fiscal year 2012. According to the Secretary of Transportation, 

combining FAA’s program managers under one organization will create a stronger 

program management community, provide greater transparency and 

accountability, and improve consistency and sharing of best practices. However, 

Congress noted that FAA’s past efforts to streamline operations have met with 

limited success in controlling operating costs and executing major acquisitions, 

and warned that the new reorganization will be “hollow” unless FAA builds the 

necessary expertise and strengthens program management for NextGen.

36

Within the ATO PMO, FAA established a Program Control Group, which is 

expected to provide another layer of review to supplement the JRC’s investment 

approval and oversight processes.

37 However, the group is only about 55 percent 

staffed and lacks documented policies and procedures to function effectively in 

this role.38

 34 GAO, Information Technology Investment Management: A Framework for Assessing and Improving Process 

Maturity (GAO-04-394G), Mar. 2004.

For example, PMO officials stated that the Program Control Group is 

responsible for assessing investment decision documents, yet the group lacks 

formal policies and procedures to evaluate whether decision documents will 

35 FAA PMO officials told us that the PMO was “stood up” in May 2012. 36 Departments of Transportation, and Housing and Urban Development, and Related Agencies Appropriations Bill, 

2013 (House of Representatives Report No. 112-541), Jun. 20, 2012. 37 The Program Control Group’s other functions include providing quality assurance, monitoring program metrics, 

tracking best practices, standardizing program reporting mechanisms, and serving as a direct interface to other lines of 

business (such as FAA’s acquisitions, CIO, and finance offices). The Program Control Group meets biweekly. 38 GAO’s March 2004 report, Information Technology Investment Management: A Framework for Assessing and 

Improving Process Maturity, states that in order for an organization to develop a sound IT investment process, it must 

attain successful IT investment control techniques at the project level. The absence of predictable, repeatable, and 

reliable investment control processes will result in ineffective evaluation processes and contradictory efforts at process 

improvement.
17

provide the JRC with reliable and complete information on which to make 

investment decisions. PMO officials stated that process standardization will occur 

over time but could not provide dates by which it expected to complete this 

standardization. Without standardized operating processes, it may be challenging 

for the PMO to effectively manage FAA’s ATO programs and achieve its goals 

for transparency, accountability, and consistency.

DOT’s IT Governance Process Provides Limited Oversight of FAA 

Investments

FAA accounts for a significant portion of DOT’s investments and, in fiscal year 

2012, represented 94 percent ($2.07 billion) of DOT’s total major IT investment 

portfolio. However, the DOT IRB provides limited oversight of these investments.

FAA has agreed to take part in DOT’s IRB investment planning and oversight 

processes—through actions such as signing DOT’s 2009 IRB charter and agreeing 

to “voluntarily participate” in the IRB’s ExComm reviews39—even though the 

Agency has been granted independent acquisition authority.

40 According to FAA, 

this authority exempts the Agency from most Federal procurement laws, including

the Clinger-Cohen Act that mandated agency IRBs. Despite FAA’s voluntary 

agreement to take part in DOT’s IT investment management process, DOT’s 

OCIO officials told us that FAA’s independent acquisition authority could impede 

the Department’s ability to oversee FAA investments.41

Improved oversight is especially important for FAA’s NextGen transformational 

programs, given their mission criticality and significant cost. FAA plans to spend 

more than $2 billion on NextGen over the next 4 years; yet, as we reported in 

April 2012, FAA has not established reliable and comprehensive baselines for its 

six NextGen transformational programs and has made limited progress 

implementing them due to a lack of finalized requirements.

Therefore, DOT has only 

reviewed two FAA programs in the past 2 years, even though FAA’s investments 

make up the largest portion of DOT’s IT investment portfolio. DOT’s IRB 

reviewed FAA’s ERAM program in February 2011, and DOT performed a 

TechStat review of FAA’s NAS Voice System, a key enabling program for 

NextGen, in April 2012. 

42

 39 DOT Deputy Secretary Memorandum, “OA Investment Review Board (IRB) Requirements and Interaction with the 

Executive Committee (ExComm) of the DOT IRB,” Nov. 4, 2008. 

40 49 U.S.C. § 106(f) states that the FAA Administrator, rather than the Secretary of Transportation, has final authority 

over FAA Acquisitions; 49 U.S.C. § 40110(d) empowers the FAA Administrator to establish the AMS to address the 

unique needs of FAA without requiring compliance with most Federal acquisition laws or regulations. 41 The FAA administrator has the final authority with respect to FAA acquisitions using the Agency’s independent 

procurement authority once the final investment is approved by the JRC. 

42 Status of Transformational Programs and Risks to Achieving NextGen Goals (OIG Report No. AV-2012-094), Apr. 

23, 2012.
18

CONCLUSION

Effective investment oversight and decision making are critical to the 

Department’s IT modernization efforts—especially FAA’s NextGen programs.

However, governance structures, related plans, and procedures for 

implementation, as well as oversight processes are incomplete. Until DOT and 

FAA address these shortfalls, their ability to effectively manage major acquisitions 

and make well-informed investment management decisions remains at risk, as 

does the Department’s ability to reap the benefits that accompany sound IT 

investment management and oversight strategies.

RECOMMENDATIONS 

We recommend that the DOT Deputy Secretary require the OCIO to:

1. Develop a comprehensive implementation plan for its proposed IT governance 

framework, which includes all DOT Operating Administrations’ IT 

investments and clearly assigns organizational responsibilities, accountability 

and authority, milestones to complete activities, and written policies and 

procedures. This implementation plan should integrate and coordinate Policy 

Order 1351.39, “Departmental Information Technology Governance Policy”;

DOT’s draft, updated IRB Charter; and any other documents integral to the 

framework. 

2. Finalize DOT’s draft, updated IRB charter to clarify organizational 

responsibilities, define IRB and TechStat roles and responsibilities, and 

establish the Senior Procurement Executive as a voting member.

3. Establish written policies and procedures for TechStat accountability sessions,

or similar review sessions for troubled and underperforming IT investments. 

These policies and procedures should include criteria for selecting programs to 

review, accountability controls to ensure actions items are fully and timely 

implemented, and a method to share and document lessons learned across the 

Department. 

We recommend that FAA’s Federal Acquisition Executive:

4. Strengthen internal controls to ensure that required investment decision 

documents are reviewed and approved prior to JRC decision meetings as 

required by the Acquisition Management System.

5. Develop procedures to (a) document the JRC’s discussions with program 

offices when JRC decisions are made without required investment documents, 

(b) identify the risks of moving forward without the documents, and (c) ensure 
19

that these documented discussions are maintained in the JRC’s information 

repository.

6. Establish procedures to ensure that the JRC Executive Secretariat effectively 

maintains the JRC’s information repository, including all documents that 

support key investment decisions.

7. Update the Acquisition Management System to specify the investment 

documents that are required to be included in JRC’s information repository and 

the location of those that should be stored elsewhere.

We recommend that FAA’s Vice President of the ATO PMO:

8. Fully staff the ATO Program Control Group, and develop and implement 

standardized operating policies and procedures for use by the group.

AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 

RESPONSE 

We provided OST and FAA with our draft report on January 22, 2013, and 

received its response on March 12, 2013, which can be found in its entirety in the 

appendix of this report. OST and FAA concurred with all recommendations and 

stated that they have already implemented corrective actions for recommendations 

3 and 6, as of March 12, 2013. We consider these recommendations resolved but 

open pending our verification that these reported corrective actions are complete. 

OST and FAA have also provided sufficient planned actions with reasonable 

target dates for recommendations 1, 2, 4, 5, 7, and 8. Accordingly, we consider 

these recommendations resolved but open pending completion of the planned 

actions. 

ACTIONS REQUIRED

We consider recommendations 1, 2, 4, 5, 7, and 8 resolved but open pending 

completion of the planned actions. We consider recommendations 3 and 6 

resolved but open pending our verification of the completed actions cited by OST 

and FAA. For recommendations 3 and 6, we request that OST and FAA provide 

information that clearly indicates what actions have been taken. Specifically, for 

recommendation 3, we request that OST provide us the DOT OCIO’s completed 

standard operating procedure for the TechStat process and the date of its 

implementation. For recommendation 6, we request that FAA provide us its 

procedures to ensure that the JRC Executive Secretariat effectively maintains the 

JRC’s information repository and the date of their implementation. In accordance 
20

with DOT Order 8000.1C, we request that OST and FAA provide this information 

within 30 days.

We appreciate the courtesies and cooperation of OST and FAA representatives 

during this audit. If you have any questions concerning this report, please call me 

at (202) 366–5225; Tony Wysocki, Program Director, at (202) 493–0223; or Dana 

Short, Project Manager at (202) 366–2089.

#

cc: DOT Audit Liaison (M–1)

FAA Audit Liaison (AAE–100)
21

Exhibit A. Scope and Methodology

EXHIBIT A. SCOPE AND METHODOLOGY

We conducted this audit between September 2011 and January 2013 in accordance 

with generally accepted Government auditing standards. Those standards require 

that we plan and perform the audit to obtain sufficient, appropriate evidence to 

provide a reasonable basis for our findings and conclusions based on our audit 

objectives. We believe that the evidence obtained provides a reasonable basis for 

our findings and conclusions based on our audit objectives. 

To assess whether the Department of Transportation’s (DOT) investment 

governance practices meet Federal and statutory investment oversight 

requirements and best practices, we reviewed all of the Office of the Secretary’s 

(OST) TechStat accountability sessions held from March 2011 through April 2012 

to determine the extent to which OST follows the Office of Management and 

Budget’s (OMB) TechStat model. In addition, we interviewed officials from 

DOT’s Office of the Chief Information Officer (OCIO) and Office of the Chief 

Financial Officer (OCFO) and the Senior Procurement Executive (SPE). We also 

surveyed the 12 Operating Administrations’ CIOs to collect information on OST’s 

acquisition oversight and decision processes; 11 CIOs responded.

To assess whether the Federal Aviation Administration (FAA) and DOT provide 

sufficient oversight of FAA’s major information technology investments, we 

reviewed 15 (100 percent) of the key investment decisions, with a total value of 

over $2.6 billion, that were made by FAA’s Joint Resources Council (JRC) during 

calendar year 2010 through November 2011. We reviewed these decisions to 

determine if required documentation was received, approved, and signed at the 

time of the decision date. We also interviewed FAA’s JRC Executive Secretariat, 

JRC members, FAA’s Federal Acquisition Executive, an OCFO official, the Air 

Traffic Organization’s Program Management Office (ATO PMO) officials, and 

FAA program managers.

In addition, we assessed FAA’s and OST’s investment approval and oversight, 

procurement practices, and compliance against criteria and best practices such as: 

• FAA:

- Acquisition Management System (AMS), including 1.2 Key Elements of 

Acquisition Management; 2.0 Lifecycle Acquisition Management Policy;

4.15 Post Implementation Review and Operational Analysis, Appendix A: 

Roles and Responsibilities, and Appendix B: Acquisition Planning and 

Control Documents.

- FAA’s Capital Investment Plan for FY 2012-2016 and FY2013-2017.
22

Exhibit A. Scope and Methodology

• OMB:

- OMB Circulars: A-11, Part 7: “Planning, Budgeting, Acquisition, and 

Management of Capital Assets,” August 2011; A-123, “Management’s 

Responsibility for Internal Control,” Dec. 21, 2004; and A-130, 

“Management of Federal Information Resources;” November 28, 2000.

- OMB Capital Programming Guide V3.0 Supplement to OMB Circular A11, Part 7: “Planning, Budgeting, Acquisition, and Management of Capital 

Assets,” August 2011.

- OMB Memorandum, “Conducting Acquisition Assessments under OMB 

Circular A-123,” May 21, 2008.

- OMB Memorandum, “Chief Information Officer Authorities,” August 8, 

2011.

- OMB, 25 Point Implementation Plan to Reform Federal Information 

Technology Management, December 2010.

• Government Accountability Office (GAO), Information Technology 

Investment Management: A Framework for Assessing and Improving Process 

Maturity (GAO-04-394G), March 2004.

• Clinger-Cohen Act of 1996 (formerly the Information Technology 

Management Reform Act).

• National Aeronautics and Space Administration (NASA):

- NASA Policy Directive 1440.6H, “NASA Records Management,” March 

2008.

- NASA Procedural Requirements 1441.1D, “NASA Record Retention 

Schedules,” June 2009; 2800.1B, “Managing Information Technology,” 

March 2009; 7120.6, “Lessons Learned Process,” January 2010; and 

7120.7, “NASA Information Technology and Institutional Infrastructure 

Program and Project Management Requirements,” December 2011.

• Department of Defense (DoD):

- DoD Directive 5000.02, “Operation of the Defense Acquisition System,” 

December 2008.

- DoD IT Defense Business Systems Investment Review Process Guidance, 

January 2009.

- DoD Report to Congress, “DoD Investment Review Board and Investment 

Management Process for Defense Business Systems,” March 2012.

Finally, to gain an understanding of IT investment best practices, we spoke with 

officials at GAO and OFPP.
23

Exhibit B. Prior OIG Audits Related to FAA Programs

EXHIBIT B. PRIOR OIG AUDITS RELATED TO FAA PROGRAMS

These OIG reports and testimonies are available on our Web site at 

www.oig.dot.gov.

Status of Transformational Programs and Risks to Achieving NextGen Goals 

(OIG Report No. AV-2012-094), Apr. 23, 2012.

DOT Does Not Have an Effective Enterprise Architecture for the Management of 

Information Technology Changes (OIG Report No. FI-2012-086), 

Apr. 17, 2011.

Progress and Challenges in Developing and Transitioning to the Next Generation 

Air Transportation System (OIG Congressional Testimony No. CC-2011-036), 

Oct. 5, 2011.

Actions Needed to Meet FAA’s Long-Term Goals for NextGen

(OIG Congressional Testimony No. CC-2011-016), Feb. 16, 2011.

Status of FAA’s Major Acquisitions: Cost Growth and Schedule Delays Continue 

to Stall Air Traffic Modernization (OIG Report No. AV-2005-061), 

May 26, 2005.
24

Exhibit C. Major Contributors to This Report

EXHIBIT C. MAJOR CONTRIBUTORS TO THIS REPORT

Anthony Wysocki Program Director 

Name Title

Dana Short Project Manager 

Angela Hailes Analyst 

David Lahey Auditor 

Kathryn Novicky Analyst 

Arnett Sanders Project Manager

Amy Berks Senior Counsel

Tanner Horton-Jones Legal Intern

Christina Lee Writer-Editor
25

Appendix. Agency Comments

APPENDIX. AGENCY COMMENTS

THE DEPUTY SECRETARY OF TRANSPORTATION

WASHINGTON, D.C. 20590

March 12, 2013

MEMORANDUM TO: Calvin L. Scovel III

Inspector General

FROM: John D. Porcari

Deputy Secretary

SUBJECT: Management Response to Office of Inspector General Draft 

Report on the Department’s Information Technology 

Investment Governance Process

Information Technology Investments Are Thoroughly Scrutinized

The Department has provided thorough oversight of information technology (IT) investments 

in order to achieve the best possible outcomes using available tools and current processes. 

This has included consideration of systems from various perspectives, including technical, 

budgetary, and procurement. Oversight processes have been applied at the Operating 

Administration (OA) level and in the Office of the Secretary. These processes have been 

effective at identifying problem systems as well as identifying and implementing the 

measures necessary to get these systems back on track. While effective, we recognize that 

the Department would benefit from a more comprehensive approach that fully achieves the 

synergies available by refreshing the Investment Review Board (IRB) process to ensure the 

new governance process provides meaningful and effective oversight.

More Comprehensive Governance Structure for Major IT Investments 

Substantive changes are underway to enhance the governance processes utilized by the 

Department. The Investment Review Board (IRB) is currently revising its charter to place a 

clearer focus on strategic leadership for all departmental IT investments. The IRB is 

planning to reconvene as the Department refines its IT governance and portfolio management 

policies and practices to improve the effectiveness of IT investment management while 

promoting efficient use of IT resources. The Department is working to ensure that its 

governance process effectively aligns the technical perspective of the CIO with the resource 

availability and efficiency perspective from the Chief Financial Officer and sound 

contracting practices through the Senior Procurement Executive. At the same time, DOT 

needs to accommodate sound IRB principles and practices in a manner that is consistent with 

its unique statutory requirements and maintaining effective interactions with the Federal 

Aviation Administration (FAA).
26

Appendix. Agency Comments

Central to enabling this strategic leadership, the departmental governance structure seeks to 

take a portfolio-based approach, tightly integrating the areas of Enterprise Architecture (EA) 

and Capital Planning & Investment Control (CPIC). EA provides authoritative data, used to 

conduct analysis that frames strategic opportunities for IT investments. CPIC is the manner 

by which we select our strategic IT investments, monitor their progress and ensure they 

achieve the intended business outcomes. This renewed focus is intended to provide not only 

compliance with the issues identified in the OIG draft report, but to give a clear picture of the 

Departments IT portfolio and how those investments are being developed and managed 

throughout their lifecycle. 

Over the past year, the Department, including the FAA, has made significant progress in 

further improving IT capital investment processes and oversight of these investments. For 

example, the Acting Chief Information Officer, Senior Procurement Executive and the Chief 

Financial Officer are working closely on strategic sourcing and investments supporting the 

planning, acquisition, and management of information technology for the entire Department. 

In addition, in order to assure even greater transparency over FAA investments, the FAA has 

invited the Department’s Office of the Chief Information Officer (OCIO) as well as a 

member of the Office of the Chief Financial Officer to attend the FAA Joint Resources 

Council (JRC) meetings. 

RECOMMENDATIONS AND RESPONSE

OIG offered the following recommendations to OST:

Recommendation 1: Develop a comprehensive implementation plan for its proposed IT 

governance framework, which includes all DOT Operating Administrations’ IT investments 

and clearly assigns organizational responsibilities, accountability and authority, milestones to 

complete activities, and written policies and procedures. This implementation plan should 

integrate and coordinate Policy Order 1351.39, “Departmental Information Technology 

Governance Policy;” DOT’s draft, updated IRB Charter; and any other documents integral to 

the framework. 

Response: Concur. The DOT OCIO is currently completing a comprehensive 

implementation plan for the new governance processes. We intend to complete this action by 

June 28, 2013. 

Recommendation 2: Finalize DOT’s draft, updated IRB charter to clarify organizational 

responsibilities, define IRB and TechStat roles and responsibilities, and establish the Senior 

Procurement Executive as a voting member. 

Response: Concur. The DOT OCIO has sent a revised IRB Charter to all OA’s, adjudicated 

and updated with appropriate comments, and will have a final signed version for use by the 

DOT IRB. We intend to complete this action by June 28, 2013.

Recommendation 3: Establish written policies and procedures for TechStat accountability 

sessions, or similar review sessions for troubled and underperforming IT investments. These 

policies and procedures should include criteria for selecting programs to review, accountability
27

Appendix. Agency Comments

controls to ensure actions items are fully and timely implemented, and a method to share and 

document lessons learned across the Department. 

Response: Concur. The DOT OCIO has completed a standard operating procedure (SOP) 

for the TechStat process, tailored to the needs of the Department, and will provide a copy to 

the OIG with our final response. This recommendation has been completed in full. 

OIG offered the following recommendations to FAA:

Recommendation 4: Strengthen internal controls to ensure that required investment 

decision documents are reviewed and approved prior to JRC decision meetings as required by 

the Acquisition Management System.

Response: Concur. The FAA JRC Executive Secretariat will ensure required investment 

decision documents are reviewed and approved prior to JRC decision meetings by using the 

JRC Readiness System to track open checklist items that must be closed before the 

investment is placed on the JRC meeting agenda. The internal process calls for required 

documents to be provided to the JRC Secretariat one week prior to the investment decision 

meeting. The Secretariat has established a mailbox which is used as a drop box where the 

documents (with all the required signatures) are uploaded, extracted and placed in the official 

repository. This change in our internal controls was put into place in May of 2012. In the 

event an exception is granted, for example when an approving official requests a JRC 

discussion prior to final concurrence for good cause and there is no objection from the 

organization that has not yet signed, an action item will be formally assigned and tracked to 

closure using the JRC tracking system. Open action items are reviewed at each Acquisition 

Quarterly Program Review meeting by the JRC, which gives the members an opportunity to 

take the appropriate action to ensure action items are completed. These enhancements to our 

internal controls are being documented in the JRC Executive Secretariat’s standard operating 

procedures. This recommendation is intended to be completed by April 30, 2013. 

Recommendation 5: Develop procedures to (a) document the JRC’s discussions with 

program offices when JRC decisions are made without required investment documents, (b) 

identify the risks of moving forward without the documents, and (c) ensure that these 

documented discussions are maintained in the JRC’s information repository.

Response: Concur. The FAA JRC investment decision briefing templates will be revised to 

reflect that any investment program requesting approval from the JRC to be allowed to 

proceed to an investment decision without providing the required documentation prior to the 

decision meeting must identify the reason for the delay in providing the documents, the risks 

if allowed to move forward without them, and the planned date that the documents will be 

provided to the JRC Executive Secretariat. The Record of Decision (ROD) of the meeting 

will document the discussion held by the JRC, the assigned action item, the action item due 

date and organization responsible for completing the action. The briefing provided to the JRC 

along with the final approved ROD will be maintained in the JRC documentation repository. 

The briefing templates will be revised and posted to the JRC Executive Secretariat web site 

for use by investment programs by April 30, 2013. 
28

Appendix. Agency Comments

Recommendation 6: Establish procedures to ensure that the JRC Executive Secretariat 

effectively maintains the JRC’s information repository, including all documents that support 

key investment decisions.

Response: Concur. The aforementioned procedures that have been developed and executed 

related to the JRC Executive Secretariat internal controls will be used to ensure that the FAA 

JRC documentation repository both physical and virtual are effectively maintained. All 

documentation identified in the AMS as exit criteria for each key decision point is being 

obtained prior to the investment decision meeting or by the assigned due date established by 

the JRC and placed in the physical repository and uploaded in the virtual repository. This 

recommendation is considered complete.

Recommendation 7: Update the Acquisition Management System to specify the investment 

documents that are required to be included in JRC’s information repository and the location 

of those that should be stored elsewhere.

Response: Concur. FAA will update the Acquisition Management System by April 30, 

2013 to specify the AMS-required decision documents to be stored in the JRC’s information 

repository, and the location of other related documents to be stored elsewhere.

Recommendation 8: Fully staff the ATO Program Control Group, and develop and 

implement standardized operating policies and procedures for use by the group.

Response: Concur. The FAA Air Traffic Organization’s Program Management 

Organization (PMO) is adding staff to the Program Control Group and intends to have it fully 

staffed by September 30th, 2013. The PMO is currently developing and implementing several 

Standard Operating Procedures (SOPs) for the entire organization, including Program 

Control. For clarification, the PMO Program Control Group is not intended to be responsible

for assessing investment decision documents in order to evaluate whether the documents will 

provide the JRC with reliable and complete information. Multiple organizations across the 

Agency are responsible for assessing decision documents, including the Office of Financial 

Management, NAS Systems Engineering Services, and ATO’s Technical Operations Service 

Unit. The Program Control Group, once fully staffed, will perform assessments of PMO 

program planning documentation, to ensure consistency and accountability for the PMO 

leadership. The PMO plans to develop the SOP for these assessments by June 30th, 2013. 

Additional PMO Program Control SOPs are planned developed and implemented prior to 

June 30th, including the procedures for internal Program Reviews, PMO Business Planning, 

and various document control processes.