Testimony

Before the Subcommittee on Technology and

Procurement Policy, Committee on Government

Reform, House of Representatives

United States General Accounting Office

GAO

For Release on Delivery

Expected at 10 a.m. EDT

Tuesday

October 1, 2002

HOMELAND SECURITY

OMB’s Temporary

Cessation of Information

Technology Funding for

New Investments

Statement of Joel C. Willemssen

Managing Director, Information Technology Issues

GAO-03-186T
Page 1 GAO-03-186T

Mr. Chairman and Members of the Subcommittee:

Thank you for inviting us to participate in today’s hearing on the

temporary cessation of funding for new information technology (IT)

infrastructure and business system investments related to the proposed

Department of Homeland Security. This action was taken by the Office of

Management and Budget (OMB) in an attempt to identify redundant

investments or achieve more efficiencies in these investments by

organizations expected to be part of the proposed department.

Since the events of September 11, the President and the Congress have

responded with important actions to protect the nation—creating the

Office of Homeland Security, establishing a new agency to improve

transportation security, and working in collaboration with federal, state,

and local governments and private sector entities to prevent future

terrorist acts. In addition, as you know Mr. Chairman, on June 18, the

President transmitted draft legislation to the Congress for the creation of a

new Department of Homeland Security whose mission would be

preventing terrorist attacks within the United States, reducing America’s

vulnerability to terrorism, and minimizing the damage and recovering from

attacks that do occur.1

After some brief background describing the Administration’s Department

of Homeland Security proposal, I will discuss, at your request,

• information management and technology challenges facing the proposed

department and

• OMB’s policy that selected agencies temporarily cease funding of new IT

infrastructure and business system investments.

Integrating the diverse communication and information systems of the

myriad of organizations that would be part of the proposed Department of

Homeland Security would be an enormous undertaking. Among the nearterm challenges that would have to be addressed to successfully tackle

this task is developing an enterprise architecture. Managed properly,

enterprise architectures can clarify and help optimize the

 1

The House of Representatives has passed (H.R. 5005), and the Senate is considering

(S. 2452) legislation to create a Department of Homeland Security. Although the bills are

different, they share the goal of establishing a statutory Department of Homeland Security.

Results in Brief
Page 2 GAO-03-186T

interdependencies and interrelationships among related enterprise

operations and the underlying IT infrastructure and applications that

support them. Another near-term challenge is establishing and enforcing a

disciplined IT investment management process. Well managed IT

investments that are carefully selected and focused on meeting mission

needs can propel an organization forward, dramatically improving

performance while reducing costs.

To help tackle these challenges, in July OMB issued two memoranda to

selected agencies telling them to “cease temporarily” and report on new IT

infrastructure and business system investments above $500,000, which are

to be reviewed by IT investment review groups.2

 Several agencies reported

new IT infrastructure and business system investments to OMB, which are

currently being evaluated by OMB and the investment review groups. In

addition, as of September 26, three agencies had submitted emergency

requests for expedited review, which were subsequently approved.

However, because the non-emergency agency submissions are still being

evaluated, at this time it is too early to assess the effect of OMB’s action.

Under the President’s proposal,3

 22 existing major components and about

170,000 people would be integrated into the new department in order to

strengthen the country’s defenses against terrorism. Table 1 lists the major

components the Administration proposes to move to the new department.

 2

Two review groups were established, the (1) Homeland Security IT Investment Review

Group, which is to review IT infrastructure investments and (2) Business Systems IT

Review Group, which is to review business system investments.

3

The President’s proposal entitled The Department of Homeland Security, President

George W. Bush, June 2002.

Background
Page 3 GAO-03-186T

Table 1: Major Components the Administration Proposes to Move to the

Department of Homeland Security (by parent department/agency)a

Parent department/agency Components(s) proposed to be moved

Department of Agriculture Animal and Plant Health Inspection Service

Plum Island Animal Disease Center

Department of Commerce Critical Infrastructure Assurance Office

National Institute of Standards and Technology’s

Computer Security Division

Department of Defense National Communications System

Department of Energy Lawrence Livermore National Laboratory

National Infrastructure Simulation and Analysis

Center

Nuclear Incident Response

Federal Emergency

Management Agency

All

General Services Administration Federal Computer Incident Response Center

Federal Protective Service

Department of Health and

Human Services

Civilian Biodefense Research Program

Chemical, Biological, Radiological and Nuclear

Response Assets

Department of Justice Immigration and Naturalization Service

National Domestic Preparedness Office

National Infrastructure Protection Center

Office of Domestic Preparedness

Department of Transportation Transportation Security Administration

Coast Guard

Department of Treasury Secret Service

Customs Service

a

Other organizations also proposed to be part of a new Department of Homeland Security are the

Domestic Emergency Support Team, which is an interagency group currently mobilized by the

Attorney General in response to major incidents, and a newly created National Bio-Weapons Defense

Analysis Center.

Source: The President’s proposal entitled The Department of Homeland Security, President George

W. Bush, June 2002. The National Institute of Standards and Technology’s Computer Security

Division was not included in the President’s original proposal but was incorporated in the President’s

draft legislation to the Congress.

As we previously testified, the creation of the Department of Homeland

Security will be one of the largest reorganizations ever undertaken.4

Performing a successful transition of this scale will take considerable time

and money and, as a result, thorough planning will be critical to the

successful creation of the proposed department. We have previously

 4

U.S. General Accounting Office, Homeland Security: Critical Design and

Implementation Issues, GAO-02-957T (Washington, D.C.: July 17, 2002).
Page 4 GAO-03-186T

recommended that careful attention to fundamental public sector

management practices and principles, such as strong financial, technology,

and human capital management, are critical to the successful

implementation of government reorganizations. 5

As we have previously testified,6 information management and technology

are among the critical success factors that the proposed new department

should emphasize in its initial implementation phase.7

 As all of the

programs and agencies are brought together in the proposed department,

it will be an enormous undertaking to integrate their diverse

communication and information systems. Some of the challenges that the

proposed department will have to face and overcome include

• establishing an effective IT management organization,

• implementing appropriate security controls,

• instituting mature systems acquisition, development, and operational

practices,

• addressing human capital issues,

• constructing and enforcing an enterprise architecture, and

• establishing and enforcing a disciplined IT investment management

process.

Let me now turn to the latter two challenges in more detail, given their

near-term importance and relationship to OMB’s recent actions regarding

the proposed department.

Our experience with federal agencies has shown that attempts to

modernize IT environments without blueprints—models simplifying the

complexities of how agencies operate today, how they want to operate in

the future, and how they will get there—often result in unconstrained

 5

U.S. General Accounting Office, Government Reorganization: Issues and Principles,

GAO/T-GGD/AIMD-95-166 (Washington, D.C.: May 17, 1995).

6

U.S. General Accounting Office, Proposal for Cabinet Agency Has Merit, But

Implementation Will be Pivotal to Success, GAO-02-886T (Washington, D.C.: June 25,

2002).

7

Other critical success factors include strategic planning, organization alignment,

communication, building partnerships, performance management, human capital strategy,

knowledge management, financial management, acquisition management, and risk

management.

Proposed Department

Faces Significant

IT Management

Challenges

Enterprise Architectures:

A Hallmark of Successful

Organizations
Page 5 GAO-03-186T

investment and systems that are duplicative and ineffective.8 Enterprise

architectures offer such blueprints. Managed properly, architectures can

clarify and help optimize the interdependencies and interrelationships

among related enterprise operations and the underlying IT infrastructure

and applications that support them. The development, implementation,

and maintenance of architectures are recognized hallmarks of successful

public and private organizations. Further, OMB Circular A-130, which

implements the Clinger-Cohen Act of 1996,9 requires executive branch

agencies to use them.

In our February report on the use of enterprise architectures in the federal

government, we provided an initial version of an enterprise architecture

maturity framework to serve as a standard for measuring the status and

progress of agencies’ architecture efforts.10 Figure 1 provides a simplified

depiction of this framework.

 8

For example, U.S. General Accounting Office, Air Traffic Control: Complete and Enforced

Architecture Needed for FAA Systems Modernization, GAO/AIMD-97-30 (Washington,

D.C.: Feb. 3, 1997) and Tax System Modernization: Blueprint Is a Good Start but Not Yet

Sufficiently Complete to Build or Acquire Systems, GAO/AIMD/GGD-98-54 (Washington,

D.C.: Feb. 24, 1998).

9

Clinger-Cohen Act of 1996, P.L. 104-106, section 5125, 110 Stat. 684 (1996).

10U.S. General Accounting Office, Information Technology: Enterprise Architecture Use

across the Federal Government Can Be Improved, GAO-02-6 (Washington, D.C.: Feb. 19,

2002).
Page 6 GAO-03-186T

Figure 1: GAO’s Five Stages of Enterprise Architecture Maturity (version 1.0)

Source: GAO.

Our February report found that agencies’ use of enterprise architectures

was a work in progress, with much to be accomplished. This is

demonstrated by table 2, which lists the maturity stage (1 representing the

lowest maturity and 5 representing the highest) of the parent organization

and, if available, the entity within this organization that is proposed to be

moved to a new Department of Homeland Security.
Page 7 GAO-03-186T

Table 2: Maturity Stage of Parent Organizations and, Where Available, the Entity

Proposed to be Moved to a New Department of Homeland Security

Department/agency

Enterprise architecture

maturity stage

Department of Agriculture

• Animal and Plant Health Inspection Service

1

1

Department of Commerce 3

Department of Defense 3

Department of Energy 2

Federal Emergency Management Agency 2

General Services Administration 2

Department of Health and Human Services 1

Department of Justice

• Immigration and Naturalization Service

3

1

Department of Transportation

• Coast Guard

2

2

Department of the Treasury

• Secret Service

• Customs Service

1

2

5

Note: Only those component entities for which we have enterprise architecture data are listed.

Source: GAO.

To its credit, OMB recognizes the importance of an enterprise architecture

and has reported that it is in the process of defining a framework for

creating a national enterprise architecture for homeland security.

Investments in IT can have a dramatic impact on an organization’s

performance. Well managed IT investments that are carefully selected and

focused on meeting mission needs can propel an organization forward,

dramatically improving performance while reducing costs. Likewise, poor

investments, those that are inadequately justified or whose costs, risks,

and benefits are poorly managed, can hinder and even restrict an

organization’s performance. Recognizing this, in 1996 the Congress passed

the Clinger-Cohen Act, which requires agencies to implement IT

investment and capital planning processes.

In support of the Clinger-Cohen Act, in May 2000, we issued the

Information Technology Investment Management (ITIM) maturity

IT Investment

Management: A Process

to Improve Performance

and Reduce Costs
Page 8 GAO-03-186T

framework,11 which identifies critical processes for successful IT

investment management and organizes these processes into an assessment

framework comprising five stages of maturity. Each stage builds upon the

lower stages and enhances the organization’s ability to manage its IT

investments. Figure 2 shows the five ITIM stages and provides a brief

description of each stage.

Figure 2: The five stages of Maturity Within ITIM

Source: GAO.

Using this model, our evaluations of selected agencies, including the Coast

Guard and the Immigration and Naturalization Service, found that while

some processes have been put in place to help them effectively manage

their planned and ongoing IT investments, more work remains.12

 11U.S. General Accounting Office, Information Technology Investment Management: A

Framework for Assessing and Improving Process Maturity, Exposure Draft,

GAO/AIMD-10-1.23 (Washington, D.C.: May 2000).

12For example, see U.S. General Accounting Office, Information Technology: INS Needs to

Strengthen Its Investment Management Capability, GAO-01-146, Dec. 29, 2000) and

Information Technology Management: Coast Guard Practices Can Be Improved,

GAO-01-190 (Washington, D.C.: Dec. 12, 2000).
Page 9 GAO-03-186T

For the proposed new department, OMB has reported that it is defining a

framework for an IT capital planning process, which is an important step

in developing strong IT management at the outset. The ITIM framework

can provide a useful roadmap for new organizations—like the proposed

Department of Homeland Security—for implementing a fundamentally

sound IT capital planning and investment management process, because it

identifies the key practices for creating and maintaining such a process.

In July, OMB issued two memoranda13 to selected agencies telling them to

(1) cease temporarily new IT infrastructure and business system (i.e.,

financial management, procurement, and human resources systems)

investments above $500,000 pending a review of the investment plans of all

proposed Department of Homeland Security component agencies, (2)

identify and submit to OMB information on any current or planned

spending on these types of initiatives, and (3) participate in applicable IT

investment review groups14 co-chaired by OMB and the Office of Homeland

Security. According to OMB, its goal in issuing these memoranda is to seek

opportunities for improved effectiveness and economy (including millions

in anticipated savings). In addition, according to officials from OMB’s

Office of Information and Regulatory Affairs, another purpose was to

obtain an inventory of current and planned IT infrastructure and business

system investments for organizations that would be moved to the

proposed Department of Homeland Security. This information is expected

to help in the Administration’s transition planning for the proposed

department.

Table 3 summarizes the funding for new IT infrastructure and business

system investments for fiscal years 2002 and 2003 that the affected

agencies submitted to OMB in response to the July memoranda. Table 3

may not include all investments being reviewed by OMB and the

investment review groups. In particular, we did not include operations and

 13Office of Management and Budget, Reducing Redundant IT Infrastructure Related to

Homeland Security, M-02-12 (July 19, 2002) and Review and Consolidation of Business

Management Systems for the Proposed Department of Homeland Security, M-02-13 (July

30, 2002).

14Two review groups were established, the (1) Homeland Security IT Investment Review

Group, which is to review IT infrastructure investments, such as local area networks and

desktop services and (2) Business Systems IT Review Group, which is to review business

system investments, including those related to financial management, human resources,

and procurement systems.

Agencies Told to

Temporarily Cease

Funding for New IT

Infrastructure and

Business System

Investments, but It Is

Too Early to Assess

Effect
Page 10 GAO-03-186T

maintenance funding because OMB reported that its July memoranda did

not affect “steady state” spending needed to continue operations.

Table 3: Agencies’ Reported Funding for New IT Infrastructure and Business System Investments for fiscal years 2002 and

2003 (in thousands)a

IT Infrastructure Business Systems

Department/agency Fiscal year 2002 Fiscal year 2003 Fiscal year 2002 Fiscal year 2003

Department of Agriculture

• Animal and Plant Health Inspection

Service

3,100 3,200 Not applicableb

Not applicable

Department of Commerce Not applicable Not applicable Not applicable Not applicable

Department of Defense Not applicable Not applicable No submission

requested by OMBc

No submission

requested by OMB

Federal Emergency Management

Agency

7,500 4,000 1,700 700

Department of Justice

• Immigration and Naturalization

Serviced 40,155 83,900 0 0

Department of Transportation

• Transportation Security

Administration

• Coast Guard

40,300

No written response

submitted to OMBe

0

No written response

submitted to OMB

Not applicable

No written response

submitted to OMB

Not applicable

No written response

submitted to OMB

Department of the Treasury

• Secret Servicef

• Customs Serviceg 0

200

0

4,000

0

3,790

0

4,210

a

OMB sent the July memoranda to those agencies that had the larger organizations that would be

part of the proposed Department of Homeland Security and did not send them to the Departments of

Energy and Health and Human Services and the General Services Administration, which also have

components that would be moved under to the proposed department.

b

Not applicable means that the agency reported that it did not have any system investments meeting

OMB’s criteria.

c

OMB did not request that the Department of Defense provide information on business system

investments.

d

The Immigration and Naturalization Service also reported an additional $2.85 million and $3.05

million in fiscal years 2002 and 2003, respectively for internet and intranet projects, but did not specify

whether these funds were new funds or for operations and maintenance.

e

The Coast Guard stated that it did not provide OMB with a list of system investments, noting that it

addressed most of its investment issues with the investment review groups.

f

The Secret Service reported no new funding for current and planned IT infrastructure and business

system investments. However, its submission indicated that it intended to conduct various planned

upgrades, such as an upgrade to its Enterprise Financial Management System, and the

implementation of a search engine using operations and maintenance funding.

g

In addition to the new funding for IT infrastructure and business system investments included in the

table, the Customs Service’s submission stated that it had “planned upgrades for standard growth” for

several initiatives in which it planned to use operations and maintenance funding.
Page 11 GAO-03-186T

Source: Applicable agencies. We did not validate this information. The July memoranda also stated

that, if an agency had a critical need or emergency, it could submit information for an expedited

review. As of September 26, agencies had requested three emergency requests for expedited review.

Specifically, according to OMB, the following emergency requests have been approved, (1) a Coast

Guard request to proceed with a licensing agreement with Microsoft, (2) a Transportation Security

Administration request to proceed with a task order for a managed services contract, and (3) a Secret

Service request to go forward with a search engine that would conduct database searches across the

agency.

Mr. Chairman, you asked us to identify the process being used in

reviewing the projects submitted under OMB’s memoranda, the criteria

being used in determining which projects would go forward, and the

length of time that the memoranda are expected to be in effect. First, OMB

has not yet finalized its process for reviewing the IT infrastructure and

business system investments reported by the agencies. However, officials

from OMB’s Office of Information and Regulatory Affairs told us that OMB

expects to use the same basic process that it used in addressing the

emergency requests. Namely, (1) agencies will submit information on their

new IT infrastructure or business system investments to OMB, (2) OMB

and the applicable IT investment review group will review the agency

submission, and (3) the applicable review group will make a

recommendation. Once a recommendation is made, according to these

officials, the normal budget execution process will be implemented, which

may require additional action by OMB or the applicable agency head.

Second, regarding the criteria for evaluating current and planned IT

investments of affected agencies, officials from OMB’s Office of

Information and Regulatory Affairs stated that they will use the principles

contained in section 300 of OMB Circular A-11 and section 8(b) of OMB

Circular A-130. These circulars instruct agencies to develop, implement,

and use capital programming processes that, for example: (1) evaluate and

select capital assets investments that will support core mission functions

and demonstrate projected returns on investments that are clearly equal to

or better than alternative uses of public resources, (2) ensure that

improvements to existing information systems and planned information

systems do not unnecessarily duplicate IT capabilities within the same

agency, and (3) institute performance measures and management

processes that monitor and compare actual performance to planned

results.

Finally, OMB Office of Information and Regulatory Affairs officials did not

know how long the memoranda would remain in effect, stating that they

will remain in effect until their goals are met. Specifically, these officials

stated that whether and how long the investment review groups

established by the memoranda continue to operate will in large part
Page 12 GAO-03-186T

depend on if or when legislation establishing the Department of Homeland

Security is enacted.

Mr. Chairman, you also asked us to address the impact of the OMB

memoranda on the affected agencies. Although OMB directed selected

agencies to temporarily cease these investments, it does not necessarily

mean that work is to be stopped on all IT infrastructure and business

system projects at the applicable agencies. First, the memoranda only

pertain to funding for new development efforts and not to existing systems

in a “steady state” using operations and maintenance funding. Second, the

cessation does not apply if funds pertaining to a development or

acquisition contract have already been obligated. Third, as I previously

noted, agencies can request an expedited review to obtain the approval to

proceed if they have an emergency or critical need. The following are

examples of how OMB’s direction to cease temporarily would apply in

certain circumstances.

• If an agency had an existing procurement system in a “steady state” in

which no major modifications or modernization efforts were planned,

there would be no effect on the funding of this system.

• If an agency had an ongoing contract with available obligations for the

development of a financial management system, there would be no effect

on this contract, but new obligations for development or modernization

efforts would be required to be approved by the Business Systems IT

Review Group.

• If an agency wanted to award a contract for a new or modernized IT

infrastructure item, such as a local-area-network, over $500,000, it would

be required to obtain approval from the Homeland Security IT Investment

Review Group before proceeding.

At this time it is not possible to assess the full effect of the July

memoranda on the selected agencies. Except for emergency requests,

according to officials from OMB’s Office of Information and Regulatory

Affairs, the investment review groups have not taken any action on the

agencies’ submissions in response to the July memoranda because neither

they nor OMB have completed their reviews of these documents. In

addition, OMB officials stated that OMB is not tracking whether, or to

what extent, agencies have halted spending or altered system plans as a

result of the July memoranda. Although it may be too early to evaluate the

results of the July memoranda at this time, OMB has stated that the

investment review groups would track any savings resulting from its

Impact of OMB’s Action

Too Early to Assess
Page 13 GAO-03-186T

actions, which should provide some information to help assess the

outcome of the temporary cessation in the future.

At least one agency has put planned initiatives on hold pending the

establishment of the Department of Homeland Security. Specifically, in its

submission to OMB in response to the July memoranda, the Federal

Emergency Management Agency reported that it had put all initiatives

related to two projects, including its Personnel Resources Information

Systems Mart, on hold pending the creation of the Department of

Homeland Security.

Mr. Chairman, this concludes my statement. I would be pleased to answer

any questions that you or other members of the subcommittee may have at

this time.

If you should have any questions about this testimony, please contact me

at (202) 512-6240 or via e-mail at willemssenj@gao.gov. Contact

(310006)