Information Technology: HUD Needs to Strengthen Its Capacity to Manage and Modernize Its Environment
Published: 2009-07-31T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Information technology (IT) plays a critical role in the Department of Housing and Urban Development's (HUD) ability to carry out its home ownership and community development mission, which was recently expanded under the Housing and Economic Recovery Act of 2008. Pursuant to a congressional mandate to study HUD's IT environment, GAO reviewed the adequacy of key IT management and modernization controls within the department, including strategic planning and performance measurement, investment management, human capital management, enterprise architecture development and use, and modernization program office establishment. To do so, GAO compared HUD policies, guidance, plans, reports, and other products and actions to relevant aspects of statutory requirements, federal guidance, and related best practices.
section_title: What GAO Found
paragraphs: The department has to varying degrees established key IT management and modernization controls needed to help ensure that its existing IT environment adequately supports mission operations and that its efforts to modernize this environment are successful. However, these controls have not been fully implemented either in accordance with a statutory requirement, federal guidance, or related best practices. Specifically, HUD has (1) developed an IT strategic plan, with strategic goals and related activities and performance targets, but it has not assessed its IT performance since fiscal year 2007, and its assessment at that time showed performance shortfalls. For example, it reported that it was behind schedule or not making progress on about one-half of the activities needed to achieve its IT strategic goals. (2) established policies and procedures for creating portfolios of IT investments, but it lacks related practices to effectively control them. For example, criteria to evaluate the performance of its portfolio do not exist. (3) analyzed gaps in its IT workforce and developed a strategy for addressing them, but the analysis was based on an incomplete and outdated inventory of human capital skill levels, thus rendering its strategy unreliable. (4) established an enterprise architecture program--to connect strategic plans with individual programs and system solutions--that meets key aspects of related best practices, but its efforts to extend its architecture by adding the level of detail needed to implement modernization projects, referred to as segment architectures, are not sufficient. For example, while HUD has identified and prioritized segments to be modernized, it has not adhered to these priorities, and the segments developed do not reflect important elements of federal guidance, and most are out of date. (5) identified the need for a modernization program office with the responsibility for managing its modernization efforts but has not established this office. Department officials acknowledged these shortcomings and stated that efforts to address them have been constrained by such factors as turnover in IT leadership and, until recently, limited modernization resources and initiatives. Until it strengthens these IT management controls, the performance of its existing IT environment and the success of its recent and future efforts to modernize this environment will be at risk.

section_title: Letter
paragraphs: The Department of Housing and Urban Development (HUD) performs a  range of significant home ownership and community development  missions that are integral to our nation’s economic recovery. To  accomplish these missions, HUD relies extensively on information  technology (IT) and has been attempting to modernize its IT infrastructure  and systems to enhance its ability to do so.
The Explanatory Statement that accompanies the Department of Housing  and Urban Development Appropriations Act, 2008, identifies concerns  about HUD’s capacity to manage its IT modernization and directs GAO to  review HUD’s information systems. As agreed, our objective was to  determine if HUD has adequately established institutional management  controls needed to manage and modernize its existing IT environment. To  address this objective, we focused on key IT institutional management  controls that our research and experience across the federal government  have shown are hallmarks of successful organizations (strategic planning  and performance measurement, portfolio-based investment management,  human capital management, enterprise architecture development and use,  and a responsible and accountable modernization program office). For  each control, we compared pertinent agency documentation, such as  policies, procedures, and plans, to statutory requirements, federal  guidance, and related best practices. Details on our objective, scope, and  methodology are in appendix I.
We conducted this performance audit from July 2008 to July 2009, in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives.
subsections: section_title: Background
paragraphs: HUD’s mission is to increase home ownership, support community  development, and increase access to affordable housing free from  discrimination. To these ends, it has established six strategic goals:   (1) increasing home ownership opportunities; (2) promoting decent  affordable housing; (3) strengthening communities; (4) ensuring equal  opportunity in housing; (5) embracing high standards of ethics,  management, and accountability; and (6) promoting participation of faith- based and community organizations. HUD works with other federal  agencies and branches of government, as well as with local governments,  faith-based and community organizations, and the private sector to  achieve these goals.
To carry out its mission, HUD is organized into five main program areas:  Housing, Community Planning and Development, Fair Housing and Equal  Opportunity, Public and Indian Housing, and the Government National  Mortgage Association.
Office of Housing: This office oversees the Federal Housing  Administration (FHA) and regulates certain aspects of the housing  industry. Among other things, its mission is to contribute to building and  preserving healthy neighborhoods and communities; maintain and expand  home ownership, rental housing, and health care opportunities; and  stabilize credit markets in times of economic disruption. The office is  composed of two mission areas: single-family housing and multifamily  housing. Single-family housing programs provide mortgage insurance on  loans to purchase homes. Multifamily programs provide mortgage  insurance to lenders on loans for the development of housing projects and  health care facilities.
Office of Community Planning and Development: The office’s mission is  to provide decent housing, a suitable living environment, and economic  opportunities for people of low and moderate income. To accomplish this,  it engages in partnerships with all levels of government, the private sector,  and nonprofit organizations.
Office of Fair Housing and Equal Opportunity: The office’s mission is to  administer and enforce federal laws that prohibit discrimination in  housing, such as the Fair Housing Act and the Civil Rights Act of 1964.  To accomplish this, it establishes and enforces policies intended to ensu that all Americans have equal access to housing of their choice.
Office of Public and Indian Housing: The office’s mission is to ensure  safe, decent, and affordable housing and create opportunities for  residents’ self-sufficiency and economic independence. Among other  things, this office administers and manages programs authorized by the  Housing Act of 1937 to provide housing to over 1.3 million households.
Government National Mortgage Association (Ginnie Mae): This HUD- owned corporation’s mission is to expand affordable housing by linking  global capital markets to the nation’s housing markets. While Ginnie Mae  does not issue loans or mortgage-backed securities, it guarantees investors  timely payment and interest on mortgage-backed securities backed by  federally insured or guaranteed loans.
HUD also consists of a number of mission support offices, such as the  Office of Healthy Homes and Lead Hazard Control and the Office of Faith- Based and Community Initiatives, as well as administrative offices, such as  the Office of the Chief Procurement Officer and the Office of the Chief  Information Officer (OCIO). Figure 1 provides a simplified view of the  department’s organizational structure.
HUD’s fiscal year 2008 appropriation was about $37.6 billion, while its  fiscal year 2009 appropriation is about $41.5 billion. HUD’s budget request  for fiscal year 2010 is about $46.3 billion. The department has  approximately 8,500 employees in 81 field offices that are resident in all 50  states, the District of Columbia, and Puerto Rico.
subsections: section_title: Recent Economic Recovery Legislation Has Increased HUD’s Mission Responsibilities and Funding for IT Support
paragraphs: During the past year, legislation has been enacted to stimulate our nation’s  economy, in part through strengthening the housing market. Under this  legislation, HUD was given new responsibilities and additional funding to  help meet these new responsibilities. Specifically, the Housing and  Economic Recovery Act of 2008 established a program at FHA intended  to help families avoid home foreclosure by refinancing them into FHA- insured mortgages. The act also authorized $25 million for each of fiscal  years 2009 through 2013 for improvements to FHA’s IT, among other  things.
In addition, the American Recovery and Reinvestment Act of 2009  provided roughly $11.6 billion to HUD across a range of programs, and  authorized HUD to, depending on the program, use either up to 1/2 percent  or up to 1 percent of the funds for IT and other administrative costs  related to most of these programs. As such, the act recognizes that HUD’s  ability to effectively implement these programs depends in part on its  simultaneous delivery of enhanced IT support. According to OCIO  officials, of the approximately $61 million made available for IT under this  act, about 2.5 percent or $1.5 million will be spent on the development of a  new system supporting reporting requirements mandated by the act,  while the remainder is planned to be used to maintain or enhance existing  systems.
section_title: HUD Relies Extensively on IT to Support Its Mission Operations and on OCIO to Provide This Support
paragraphs: IT plays a critical role in HUD’s ability to carry out its missions, supporting  data collection and dissemination throughout the department and to  external partners. For instance, the department reports that its business  areas rely on IT to process over 50,000 loan requests per week, over 12,000  service calls per month, and more than 7,000 grant requests annually for  each of its major grant programs. Further, the department’s increased  responsibilities under the Housing and Economic Recovery Act of 2008  will introduce greater processing requirements for FHA loan applications  and new budget reporting requirements, and thus further increase its  reliance on IT.
OCIO is responsible for supporting HUD programs, services, and  management processes by providing high-quality IT solutions and services.  To this end, OCIO has established four IT strategic goals: (1) rapidly  modernizing IT to support key HUD business initiatives; (2) transforming  the IT infrastructure to adapt to and adopt emerging technologies;   (3) developing a cadre of highly capable IT professionals with mission  critical competencies; and (4) providing secure, rapid, and reliable data  and information to customers, citizens, and business partners.
OCIO consists of the Chief Information Officer (CIO), two Deputy Chief  Information Officers, and eight offices. These offices are responsible for  systems integration and efficiency; policy and E-government; IT  governance and investment; IT operations; enterprise architecture (EA); IT  strategic planning and communication; administrative services; and IT  security. (See fig. 2 for an OCIO organizational chart depicting key  positions; see table 1 for a summary of each office’s roles and  responsibilities.)
section_title: Overview of the Department’s IT Environment
paragraphs: HUD’s current IT environment does not effectively support its ongoing  business operations. According to the department’s recent operating plans  and budget submissions to Congress, its information systems are  overlapping and duplicative, are not integrated, necessitate manual  workloads, and employ antiquated technologies that are costly to  maintain. More specifically:  It consists of over 200 information systems, many of which perform the  same functions and thus are duplicative. For example, it has at least 16  financial management systems that it plans to consolidate.
It consists of stove-piped, nonintegrated systems. For example, multiple  systems support grants management and cannot share related data.
It provides insufficient support for key business processes, such as grants  management, thus necessitating reliance on manual processing.  Specifically, four of its offices perform most of their own grants  management operations manually, about $7 billion in annual low-income,  housing, project-based contracts are renewed using a paper intensive  process, and about $16 billion per year is managed using a spreadsheet  application.
It consists of antiquated and complex systems that are costly to maintain.  For example, HUD relies on several different operating systems and 35  different programming languages, each of which requires specialized skills  to operate and maintain. In addition, a 2007 study of HUD’s IT  environment found that the average age of its information systems was  nearly 15 years, which is more than twice that of other agencies (6 years).
section_title: Summary of HUD’s Recent IT Funding
paragraphs: HUD funds its IT operations through its working capital fund (WCF). The  WCF is funded through both direct appropriations and program transfers  from HUD mission-focused programs. As illustrated in figure 3, the  majority of WCF funding has consistently been through direct  appropriations, although funding from program transfers has increased  steadily. As also illustrated, until fiscal year 2009, the level of total IT  funding had declined.
Funding for HUD’s IT environment can be split into two categories:  maintenance and development. Maintenance of its existing IT environment  includes application operations support for approximately 200 existing  systems; infrastructure costs for shared IT services across the department  and regional locations, such as hardware support, disaster recovery, and  facilities management; and salaries and indirect expenses for 255 full-time  equivalent OCIO positions, as well as certain staff who provide  management support to IT services from the Office of the Chief  Procurement Officer and the Office of the Chief Financial Officer.  Development includes modernizing systems to better support HUD’s  mission and business priorities. As illustrated in figure 4, the percentage of  funds obligated for new development (i.e., modernization) has consistently  been a small percentage of total IT obligations, particularly in fiscal year  2008 when only about 2 percent of IT obligations was for development.
HUD’s fiscal year 2010 budget request provides for increases in IT funding  under what it refers to as its “Transformation Initiative.” This initiative  consists of four related components, one of which focuses on modernizing  IT systems in order to decrease HUD’s reliance on its legacy environment.  According to the budget request, the initiative’s funding is to be 1 percent  of HUD’s total budget, or approximately $434 million. HUD officials stated  that the potential exists for as much as one-half of this amount (or about  $217 million) to be used for modernization of its IT systems.
section_title: Effective Maintenance and Modernization of IT Depends on Institutionalizing Key IT Management Controls
paragraphs: A federal agency’s ability to effectively and efficiently maintain and  modernize its existing IT environment depends in large part on how well it  employs certain IT management controls that are embodied in statutory  requirements, federal guidance, and best practices. Among other things,  these controls include strategic planning and performance measurement,  portfolio-based investment management, human capital management,  enterprise architecture (and supporting segment architecture)  development and use, and establishing responsibility and accountability  for modernization management. The purpose of each of these controls is  as follows:    Strategic planning and performance measurement are intended to ensure  that an organization’s IT strategic goals are aligned with its overall mission  goals and outcomes and that these IT goals are supported by clearly  defined (1) activities aimed at accomplishing the goals and (2) measures  for determining performance in accomplishing these activities and goals.  These principles are reinforced through statutory requirements. By  establishing such activities and measures and then monitoring actual- versus-expected performance, an organization can better understand  progress, and thus the need for corrective action, in achieving its IT  strategic goals.
Investment management is aimed at selecting, controlling, and evaluating  investments in IT in a manner that better ensures that they produce  business value, reduce investment-related risks, and increase  accountability and transparency in the investment decision-making  process. In 2004, we issued a framework for assessing federal agencies’  investment management practices that consists of five progressive stages  of maturity, with Stage 1 representing immature and undisciplined  investment management structures and processes, and Stage 5  representing optimized maturity focused on continuous improvement.  Stage 3—our focus in this report—is where an organization moves from  project-centric to portfolio-based investment processes. Through a  portfolio-based approach, the organization can consider new investment  proposals, along with previously funded investments, and identify the  appropriate mix and synergies of these investments to best meet mission  needs, technology needs, and priorities for improvement. Organizations  that have implemented Stage 3 practices have capabilities in place that  assist in the establishment of selection, control, and evaluation structures,  policies, procedures, and practices that are consistent with the investment  management provisions of the Clinger-Cohen Act.
Human capital management is intended to ensure that an organization has  the employees with the appropriate knowledge and skills to effectively  execute critical IT functions. It involves assessing IT workforce needs,  inventorying existing staff’s knowledge and skills and identifying any gaps  between needs and existing capabilities, and developing strategies and  plans to fill any gaps.
EA development and use is aimed at establishing a corporate blueprint for  investing that connects strategic plans with individual programs and  system solutions. As such, this blueprint provides the information details  needed to guide and constrain investments in a consistent, coordinated,  and integrated fashion—thereby improving interoperability, reducing  duplicative efforts, and optimizing mission operations. In brief, an EA  includes descriptions of an organization’s current or “as is” environment  and its target or “to be” environment. The architecture also includes a  transition or sequencing plan, which is based on an analysis of the gaps  between the “as is” and “to be” environments. In 2003, we issued a  framework for assessing and improving an organization’s EA management  that includes five stages of maturity for developing, maintaining, and  implementing an architecture. One approach to providing the EA  information details needed to adequately inform, and thus guide and  direct, program and system solution implementations is to divide the  architecture into segments and to develop more detailed architectures for  each segment. As such, segment architectures can be used to provide a  bridge between the corporate frame of reference captured in the EA and  each individual program and system investment. The Office of  Management and Budget (OMB) has issued guidance related to segment  architectures. As part of its guidance, agencies are to group their  segments into three categories: core mission areas (e.g., single-family  housing), business services (e.g., financial management), and enterprise  services (e.g., records management).
Effective modernization management includes having clearly defined and  assigned responsibilities. This often involves a modernization program  office that is accountable for planning, evaluating, executing, and tracking  an enterprise’s modernization efforts.
section_title: Key IT Management and Modernization Controls Have Not Been Fully Established
paragraphs: The department has, to varying degrees, established certain key IT  management and modernization controls needed to help ensure that its  existing IT environment adequately supports mission operations and that  its efforts to modernize this environment are successful. However, these  controls have not been fully implemented either in accordance with a  statutory requirement, federal guidance, or related best practices.
HUD officials are aware of the need to strengthen each of these controls,  but they stated that a combination of turnover in OCIO senior leaders and  a pre-2009 decline in IT resources constrained their efforts to do so.  Because these controls are critical to managing an organization’s existing  IT environment and to modernizing it, and given HUD’s recent and  planned increases in modernization-related activities, it is important for  the department to fully establish each control. Until it does, the  performance of HUD’s existing IT environment, as well as its efforts to  modernize this environment, will be at risk.
subsections: section_title: HUD Has Stopped Assessing Performance in Meeting Its IT Strategic Goals, and Its Most Recent Assessment Showed Performance Shortfalls
paragraphs: Effective IT strategic planning and performance measurement can help an  organization effectively and efficiently leverage IT in meeting mission  goals and achieving performance outcomes. To this end, executive  agencies are to establish goals for improving the efficiency and  effectiveness of their operations through the effective use of IT, annually  submit to Congress a report on their progress in achieving these goals,  and establish and apply performance measures to determine how well IT  supports their programs. In addition, HUD guidance emphasizes the  importance of regularly assessing progress in implementing its IT strategic  plan and provides for quarterly and annual CIO reporting on progress  against its strategic goals.
To its credit, HUD established goals and performance measures, as  required. Specifically, it developed an IT strategic plan in January 2006  that defines four strategic goals that are intended to improve IT’s  contribution to program productivity, efficiency, and effectiveness. These  goals are to (1) rapidly modernize IT to support key HUD business  initiatives; (2) transform the IT infrastructure to adapt to and adopt  emerging technologies; (3) develop a cadre of highly capable IT  professionals with mission critical competencies; and (4) provide secure,  rapid, and reliable data and information to customers, citizens, and  business partners. In addition, the plan identifies a range of activities  necessary to achieve each of these goals. For example, to transform the IT  infrastructure to adapt to and adopt emerging technologies, HUD intends  to increase the reuse of its components, improve program management,  identify infrastructure requirements, and perform customer training for  new technologies. The plan also includes performance measures for each  strategic goal, which according to HUD, are to serve as indicators of the  extent to which the IT goals are being met and how well IT is supporting  the department’s mission. For example, for this same strategic goal, two of  its performance measures are “100 percent of contract actions are  completed on time” and “infrastructure collaborates with 100 percent of  program areas/project managers and developers to ensure project plans  and architectures are agreed upon.”
However, HUD did not assess and report on performance against its four  IT strategic goals in fiscal year 2008, as required. Moreover, while HUD  assessed and reported on its IT performance in fiscal year 2007, this  assessment showed that it was either behind schedule or not making  progress in 46 percent of the activities it defined as needed to achieve its  IT strategic goals. At the same time, the basis for those assessments is not  clear. For example, for its strategic goal to develop a cadre of highly  capable IT professionals with mission critical competencies, HUD only  reported that it was “not progressing in establishing a team to support  customer service management,” and thus did not relate the specific status  of this activity to measurable commitments. In addition, the fiscal year  2007 assessment did not address how well IT supports the department’s  mission outcomes, and it did not measure performance against any of the  indicators in the IT strategic plan.
OCIO officials attributed the agency’s performance measurement  weaknesses to, among other things, turnover in OCIO senior leaders.  According to these officials, efforts are under way to redefine HUD’s  process for measuring the performance and progress of IT operations, and  this new process is to be implemented by the end of fiscal year 2010. In the  meantime, HUD reports that it has commenced efforts to assess  performance during fiscal year 2009. However, no plan exists that defines  how performance in fiscal year 2009 will be assessed or how this new  process is to be developed and implemented, including a schedule of  activities and resource needs. Until HUD regularly assesses and reports  progress against its strategic IT performance measures and activities, it  will not be in compliance with a statutory requirement and will not know  how well it is achieving its IT strategic goals and where it needs to  improve. Thus, its ability to effectively and efficiently support HUD  mission operations may be impaired.
section_title: Policies and Procedures for Developing Investment Portfolios Are Largely Established, but Key Policies and Practices to Effectively Control Them Have Not Been Implemented
paragraphs: If managed effectively, IT investments can have a dramatic impact on an  organization’s performance and accountability. If mismanaged, they can  result in wasteful spending and lost opportunities for achieving mission  goals and improving mission performance. According to our Information  Technology Investment Management (ITIM) framework, an organization  that has reached Stage 3 of maturity manages projects as a portfolio of  investments, treating them as integrated packages of competing  investment options and thereby pursuing those that best meet the  organization’s strategic goals and mission. Managing IT investments as  portfolios also allows an organization to make more informed decisions  about which projects to begin funding and continue funding based on  analyses of the relative organizational value and risks of all projects,  including those that are proposed, under development, and in operation.  Our prior work has shown that the absence of a portfolio-based approach  to IT investment management can contribute to duplication in programs  and equipment that do not operate effectively together.
Stage 3 maturity involves implementation of four critical processes:   (1) defining the portfolio criteria; (2) creating the portfolio; (3) evaluating  (i.e., controlling) the portfolio; and (4) conducting postimplementation  reviews. Table 2 summarizes the purpose of each of these processes. To  effectively manage a portfolio of investments, an organization should  establish policies and procedures to address each of these critical  processes, as well as the key practices needed to evaluate its portfolio.
To HUD’s credit, it has established the range of necessary policies and  procedures needed to execute three of the four critical processes  associated with developing a complete investment portfolio—defining the  portfolio, creating the portfolio, and conducting postimplementation  reviews. However, it has not established policies and procedures and is  not executing five of the six key practices needed to satisfy the fourth— evaluating the portfolio.
For defining portfolio criteria, HUD’s ITIM process guide identifies an  annual time frame and responsibilities for creating and modifying  investment selection criteria. Specifically, the OCIO is to develop  proposed criteria, the Technology Investment Board Working Group  (TIBWG) is responsible for reviewing and commenting on the criteria, and  the Technology Investment Board Executive Committee (TIBEC)  approves the final criteria. The process guide also states that the criteria  are to reflect HUD strategies, modernization goals, and OMB exhibit 300  criteria.
For creating the portfolio, the TIBWG is to annually analyze and compare  IT projects to be included in the portfolio using, among other things, IT  portfolio selection criteria, funding requests, and departmental priorities  identified by the TIBEC. The group’s recommendations for the portfolio,  including recommended project priorities, are to be provided to the TIBEC  for an approval decision. This decision is to be guided by HUD’s policy  that identifies a series of questions, such as “Does the portfolio reflect  HUD’s strategic priorities?” and “Have potential funding constraints been  considered?” To maintain the portfolio, HUD’s guidance states that, as a  result of ongoing control reviews, recommendations can be made to the  TIBEC to maintain or adjust the IT portfolio, including the cancellation of  a project.
For conducting postimplementation reviews, HUD has developed detailed  guidance. For example, these reviews are to be conducted within 6 to 18  months after the implementation of a project to validate actual investment  results and extract lessons learned for ITIM process improvement. These  reviews are to be conducted by designated teams that are selected  annually by ITIM staff using identified criteria and represent a cross  section of representatives from various disciplines, such as EA and IT  operations. The guide also provides a step-by-step process for conducting  the reviews, as well as detailed evaluation criteria to be applied to help  formulate findings. The results of this review process are to be provided to  the reviewed project’s sponsors, managers, and other stakeholders, and a  summary of the results is to be provided to the TIBWG.
For evaluating the portfolio, HUD does not have policies and procedures  for reviewing, evaluating, and improving the performance of its portfolio.  Specifically, while the TIBEC charter establishes that it is responsible for  conducting regular reviews to assess and improve the performance of  HUD’s investment portfolio, policies and procedures that address this  responsibility have not been established. (See table 3 for a summary of our  analysis relative to HUD’s policies and procedures for each Stage 3 critical  process.)
Moreover, the department is not executing five of the six additional key  practices associated with evaluating its portfolio. Specifically, the  department does not evaluate performance of its overall investment  portfolio on a continuing basis and has not established criteria for  assessing overall portfolio performance. (See table 4 for a summary of our  analysis of the practices related to the evaluating the portfolio critical  process, with the exception of the establishment of policies and  procedures, which is addressed in table 3.)
The OCIO’s Director of ITIM attributed these portfolio management  weaknesses to limitations in resources. The Director of ITIM also stated  that the department recognizes the need to improve IT portfolio  investment management, adding that a plan will be developed within the  next 12 months to address the key practice weaknesses that we identified.  Without having defined and implemented practices for evaluating the  performance of its IT investment portfolios, HUD will be limited in its  ability to control the risks and achieve the benefits associated with the mix  of legacy system and modernization investments that it selects.
section_title: HUD Is Not Adequately Managing Its IT Human Capital
paragraphs: Effective human capital management requires a strategic and proactive  approach to meeting current and future human capital needs. By  employing such an approach, organizations can be better positioned to  have the people with the right knowledge, skills, and abilities to support  mission operations both today and in the future. The success or failure of  federal programs depends, in large part, on having the right number of  people with the right mix of knowledge and skills. Since 2001, we have  designated the strategic management of human capital as a  governmentwide high-risk area.
We have previously reported on principles for strategic workforce  planning, which outline guidance for human capital management.  Strategic workforce planning involves (1) determining the critical skills  and competencies needed to achieve current and future program results,  (2) analyzing the gaps between current skills and future needs, and (3)  developing strategies for filling gaps. If performed effectively, these  activities can collectively create a strategic and proactive approach to  human capital management.
OCIO has not adequately performed most of these activities:    The office assessed its needed IT workforce skills and competencies  (requirements) in fiscal year 2008, based on interviews with most, but not  all, OCIO managers.
The office performed an analysis of the gaps between its IT workforce  requirements and skills (inventory) in fiscal year 2008 using an outdated  inventory of human capital skills, thus rendering the identified gaps  unreliable. Specifically, OCIO’s IT workforce skills inventory was based on  a 2006 governmentwide survey conducted by the Office of Personnel  Management and the Federal Chief Information Officer’s Council.  However, this inventory only covered about 48 percent of HUD’s IT  workforce. Moreover, since then, HUD has reduced its IT workforce by  about 26 percent, and this reduction, according to the Acting CIO, mostly  affected persons with specialized skills who operate and maintain existing  systems and are difficult to replace. According to OCIO officials, they plan  to conduct an inventory of IT workforce skills, as well as to participate in  a follow-up to the 2006 governmentwide survey that is to begin in early  2010. However, they did not have a plan or time frame for completing their  own inventory.
The office developed a strategy for closing the gaps, including steps,  activities, and related milestones. However, the strategy is based on the  aforementioned unreliable gap analysis, and it has yet to be implemented.  OCIO officials did not know when implementation of this strategy would  begin or be completed. Aspects of this strategy not yet implemented  include developing and implementing performance metrics for gauging  HUD’s IT project management capability by December 2008 and a training  plan for building its IT investment management capability by January 2009.
OCIO officials cited various reasons for these weaknesses in its IT human  capital management, including the expense of conducting an inventory of  current IT workforce skills and limitations in resources available to  implement its strategy for closing its human capital gaps. Without effective  IT human capital management, it is unlikely that HUD will have the people  it needs to effectively operate and maintain existing systems and to deliver  modernized systems, thus impairing its ability to provide the department’s  mission operations with effective and efficient IT support.
section_title: HUD Has Yet to Develop Sufficient Architectural Context to Guide and Manage Modernization Projects
paragraphs: A key aspect of HUD’s approach to modernizing its IT environment is to  extend its EA to include what are referred to as segment architectures,  which are to provide the modernization details needed to develop and  implement system solutions for portions, or segments, of a department or  agency. Such a “divide and conquer” approach to modernizing is  advocated by OMB. To this end, HUD has established a departmentwide  EA that largely satisfies relevant federal guidance, and it has identified and  prioritized 37 segments, as provided for in federal guidance. However, it  has only developed architectures for 8 of its segments, and not all of these  8 are its highest priority segments. Moreover, the majority of the segment  architectures developed thus far are out of date and do not fully address  key aspects of federal guidance, such as provisions for performance goals  and measurement. At the same time, HUD is investing in modernization  projects in at least 3 of these segments in fiscal year 2009. Unless HUD  develops well-defined segment architectures to guide and constrain  modernization projects, it risks investing time and resources in systems  that do not reflect department priorities, are not well integrated, are  potentially duplicative, and do not optimally support mission operations  and performance.
subsections: section_title: The Department’s EA Management Program Largely Satisfies Relevant Guidance
paragraphs: In August 2006, we reported that HUD had largely established an EA  program but was nevertheless missing two key aspects. Since then, HUD  has taken steps to address these aspects and additional steps are planned.  As noted earlier, our EA Management Maturity Framework provides a  five-stage approach to managing the development, maintenance, and  implementation of an architecture and understanding the extent to which  effective architecture management practices are being performed and  where an organization is progressing toward having a well-managed  architecture program. In short, the framework consists of 31 core  elements that relate to architecture governance, content, use, and  measurement. These elements reflect research by us and others showing  that architecture programs should be founded upon institutional  architecture commitment and capabilities, and on measured and verified  products and results. Satisfying the framework’s core elements helps  organizations reduce the risk of investing in IT assets that are duplicative,  are not well-integrated, and do not optimally support mission operations.
To HUD’s credit, it had satisfied the vast majority of the core elements  described in our framework as of August 2006, as the following examples  illustrate:    HUD established a committee or group representing the enterprise and  responsible for directing, overseeing, and approving the EA, and thereby  demonstrating the organization’s commitment to obtaining buy-in for the  EA from across the organization, and providing vested ownership and  accountability for the EA and its use as a transformational tool at the most  senior levels of the organization.
The department developed EA plans that called for describing the  enterprise in terms of business, performance, information/data,  application/service, technology, and security. Having such descriptions is  consistent with recognized frameworks governing EA content, including  OMB’s EA “reference models.” In short, these models collectively provide  for defining an enterprise’s operations in both business terms (e.g.,  business processes, business rules, information needs and flows, shared  business services, and work locations and users) as well as technical  terms (e.g., hardware, software, data, and security attributes and  standards).
It measured and reported on the quality of its EA products, which is  important for informing senior leadership about EA progress and thus  providing a means for timely and appropriate actions to address deviations  from established goals.
It established the EA as an integral part of the IT investment management  process, thus ensuring that the organization approves those investments  that move it toward the target architecture, as defined in the sequencing  plan.
It developed the EA using a framework, methodology, and automated tool,  thereby helping to ensure that its architecture was developed according to  a defined structure and nomenclature, as well as explicit and consistent   steps, and that the architecture is captured in a repository that is  accessible and can be updated.
Nevertheless, we also reported that HUD had not addressed two important  elements. First, HUD had yet to adequately incorporate information  security into its EA. Since that time, HUD issued an Enterprise Security  Architecture in April 2007 that provides a target conceptual framework for  information protection. For example, it contains the architecture’s goals  and objectives and generally (1) discusses security drivers (e.g., external  threats such as hackers and cyber terrorists); (2) describes security  governance (e.g., roles and responsibilities of key players with references  to HUD security policy, standards, and guidelines); (3) identifies the  purpose of the HUD security concept of operations, planning, and risk  management, noting that each is resident in other HUD procedural and  process guidance; and (4) describes a target security environment (e.g.,  types of security services and the security impact levels for categories of  data).
In addition, HUD’s Enterprise Security Architecture states that segment  architectures are to be the primary means of implementing its security  architecture, and thus the details surrounding how target concepts will be  implemented and achieved will be specified in these segment  architectures. Of the 8 HUD segment architectures developed to date, each  of which are discussed later in this report, only its single-family housing  segment architecture addresses information security, while the others do  not. According to HUD’s Director of EA, security will be addressed in the  remaining segment architectures, as new ones are developed and existing  ones are updated. However, no schedule exists defining when this will  occur. Adequately incorporating security into the EA and related segment  architectures is important because security is an integral aspect of an  architecture’s performance, business, information/data,  application/service, and technical models, and needs to be reflected  thoroughly and consistently across each of them to ensure that new and  existing investments meet the department’s information assurance needs.
Second, we also reported that HUD had yet to submit its EA products and  management processes to independent verification and validation. Since  that time, HUD developed an independent verification and validation plan,  and a HUD OCIO organization has reviewed three EA products, including  the Enterprise Security Architecture document. However, OCIO officials  told us independent verification and validation activities were  discontinued in 2007 because of resource limitations. As a result, HUD  continues to lack important information about the quality of its  architecture products and management processes that are needed to have  a mature EA program.
section_title: HUD Has Begun to Extend Its EA by Identifying and Prioritizing Modernization Segments
paragraphs: HUD is approaching its business modernization efforts through the  development of segment architectures, which can be viewed as subsets of  an EA or a bridge between the EA and IT investments. According to OMB  guidance, agencies should (1) define enterprise segments as components  of their EA planning activities and (2) prioritize segments by focusing first  on those that will help the agency perform its mission most effectively.  Further, it identifies three segment types: core mission areas, business  services (e.g., financial management), and enterprise services (e.g.,  information sharing). It also states that agencies (1) must have a  structured process to determine high-priority segments that is based on  such factors as statutory requirements, the agency’s strategic plan and its  IT strategic plan, impact on mission performance, and cost efficiency  opportunities and (2) should initiate development of architectures for  high-priority segments after the CIO has approved segment priorities.
HUD’s 2005 EA transition plan, which was approved by the TIBEC,  identifies, classifies, and prioritizes 37 segments. According to the plan,  the priorities were based on the following considerations: business  transformation impact, financial impact, impact on execution of other  high-priority transition activities, resource availability, opportunities for  early success, and the ability to leverage work in progress. Further, the  priorities were determined using a scale of 1 to 5, with 5 as the highest  priority. (See table 5 for these priorities and app. II for descriptions of  each segment.)
section_title: Segment Architectures Have Not Been Developed According to Established Priorities
paragraphs: To date, HUD has developed 8 segment architectures. However, the 8  segments are not the department’s 8 highest priorities (see table 6).  Specifically, HUD has developed an architecture for its highest priority  segment, financial management, but its next 4 highest segment priorities  (controls and oversight, tracking and workflow, integrated enterprise data  management, and identity management), each with priority scores of 4.0  or above, do not yet have architectures. Moreover, HUD has developed  architectures for only 4 of the next 10 highest priority segments, each with  scores between 3.5 and 4. At the same time, it has developed architectures  for 3 segments with priority scores of less than 3.
OCIO’s Director of EA stated that because IT funding has not been  available to develop segment architectures according to the established  priorities, HUD’s development of segment architectures has been driven  by whether individual business units make funds available for their  respective segments. For example, even though acquisition management  ranks as 24th out of 37 in priority, it is one of the eight developed  architectures because the Office of the Chief Procurement Officer  provided funding for its development. According to the Director of EA,  HUD is currently developing a structured methodology for prioritizing  segments, and once this process is approved by the TIBWG and TIBEC,  the department will begin implementing it. Until the department begins  developing segment architectures in accordance with defined priorities, it  will increase the risk of investing limited IT resources in a manner that  does not reflect the department’s priorities.
subsections: section_title: Segment Architectures Have Not Been Developed According to Key Aspects of Federal Guidance
paragraphs: The development and maintenance of the eight segment architectures do  not reflect key aspects of relevant federal guidance. According to relevant  guidance, a segment architecture is to be developed and maintained by  an integrated project team (IPT) that consists of key stakeholders, such as  a program manager, business subject matter experts, and enterprise  architects. In this regard, the guidance states that this team is critical to  successful segment architecture development and should be involved in  each step of development process and responsible for making decisions  relative to defining business and technology requirements and achieving  these requirements. In addition to requiring an IPT, this guidance also  specifies the following key activities relative to analyzing and developing  each segment architecture:    Prioritized opportunities—The IPT is to consider current change drivers,  such as key strategic, legislative, and management requirements, to  identify and prioritize opportunities to achieve performance improvements  within the context of the current operating environment. These prioritized  opportunities are to be used to define the scope of the segment  architecture and help the IPT make informed decisions about the potential  reuse of common or shared business processes, data, and services.
Performance goals—The IPT is to establish performance goals that  include target measures and time frames for achieving them. The  performance goals are to provide the basis for developing the performance  layer of the target segment architecture, and they are to be reconciled with  the agency EA and agency strategic plan to ensure consistency. They are  also to be used to determine the segment performance gaps that need to  be closed.
Target architecture—The IPT is to develop a target segment architecture  that establishes the business, data, services, and technology architecture  layers to support the performance layer of the architecture. The target  architecture should, among other things, describe the systems that are  required, including those to be consolidated. These targets are to be used  by the IPT to develop the segment transition strategy.
Segment transition strategy—The IPT is to use the target segment  architecture to define the specific projects needed to close identified  performance gaps and achieve the target state. Among other things, the  strategy is to include project priorities, project dependencies, and project  sequencing. The IPT and the agency’s Chief Architect are to jointly  reconcile the segment architecture and transition strategy with the  agency’s EA to ensure consistency. The transition strategy is to be used to  prepare project funding strategies and business cases.
None of the eight segment architectures that HUD has developed  incorporates all of these key activities, with only one (acquisition  management) fully addressing most of the elements. The remaining seven  segment architectures fully address no more than two elements and either  partially address or did not address the others. (See table 7 for a summary  of the extent to which the eight segment architectures reflect OMB  guidance.) The extent to which the eight reflect each of the key activities  is discussed in detail following the table.
OCIO’s Director of EA stated that all eight segment architectures were  developed by IPTs. However, two of the segment architectures (financial  management and human resources management) did not have charters or  any other form of documentation demonstrating that key stakeholders  were involved in developing the architectures.
One of the segment architectures (acquisition management) identifies and  prioritizes opportunities for improvement, while four (financial  management, grants management, human resources management, and  multifamily housing) identify opportunities for improvement but do not  prioritize these opportunities. The remaining three do not identify  opportunities for improvement.
None of the segment architectures identify performance goals and time  frames. While four (acquisition management, electronic records and  documents management, human resources management, and rental   housing assistance) have performance goals, none of the four include time  frames to achieve these goals. The remaining four do not establish  performance goals or time frames.
Two of the segment architectures (acquisition management and single- family housing) define their respective target states to be achieved, while  five others (electronic records and documents management, financial  management, grants management, human resources management, and  multifamily housing) partially define these targets. For example, the grants  management segment architecture identifies the systems required in the  target environment but does not address any impact to existing systems.  The rental housing assistance segment architecture does not define any  aspects of its target architecture in support of the performance goals it  identified.
One segment architecture (acquisition management) has a complete  transition strategy, while three others (financial management, grants  management, and multifamily housing) have partial strategies. For  example, the financial management and grants management architectures  identify, prioritize, and sequence projects, and the multifamily housing  architecture identifies projects to be completed; however, none of the  three identify dependencies among projects. The remaining four segment  architectures do not identify any aspects of a transition strategy.
The extent to which the majority of the eight segment architectures reflect  relevant federal guidance is attributable to the fact that the architectures  were developed prior to the issuance of federal guidance (only the  acquisition management architecture was developed after this guidance  was issued). Accordingly, in a June 2008 strategic portfolio review, HUD  recognized the need to update the segment architectures to reflect  relevant guidance. Moreover, this review recognized that seven of the  eight segment architectures (all except acquisition management) were not  current. For example, 4 of the segment architectures are 4 or more years  old (see table 8). According to federal guidance, regular maintenance of  segment architectures is important to ensuring that they reflect the current  direction of the agency.
The Director of EA said that, since June 2008, efforts have been initiated to  update one of the segment architectures—human resources management.  Specifically, the Director of EA said that an IPT is being formed and will  begin to update this segment architecture this summer. However, the  department did not have a plan to update the remaining segment  architectures.
The need to develop segment architectures that are complete and current  is significant because HUD currently has three major investments under  way in its financial management, rental housing assistance, and grants  management segments. In fiscal year 2009, these investments total about  $50 million in development as follows:    Financial management—Approximately $27 million is being used to  develop a single core financial system that integrates the programmatic  and financial information of four existing financial systems.
Rental housing assistance—Approximately $16 million is being used to  develop a system for HUD’s rental housing assistance program to support  management of public housing assets.
Grants management—Approximately $7 million is being used to develop  a system for HUD’s grants programs to support the administration of  grants and the automation of redundant processes.
Until HUD’s segment architectures are defined in accordance with  applicable federal guidance and kept current, they will not provide a  sufficient basis for guiding and directing segment projects in a manner to  ensure that both system enhancements and new development efforts are,  among other things, properly sequenced, well integrated, and not  duplicative.
section_title: HUD Has Yet to Assign Responsibility and Accountability for Modernization Management
paragraphs: Effective systems modernization requires a structured management  approach, to include clearly defined and assigned responsibility and  accountability for enterprisewide modernization management. Our  experience in reviewing large-scale system modernization programs in  other federal departments and agencies, such as the Internal Revenue  Service and Department of Defense, shows that this often involves,  among other things, establishing a modernization program management  office. In addition, independent research recommends establishing a  modernization management office before attempting an enterprisewide  modernization effort. According to this research, this type of office  brings structure and support to evaluating, justifying, defining, planning,  tracking, and executing an IT modernization effort, and it facilitates  interaction among senior leaders, program managers, and project  managers.
To HUD’s credit, its EA transition plan identifies the need for an  Enterprise Program Management Office (EPMO) to manage its  modernization projects, calling this office a critical success factor to  delivering modernized systems. Specifically, the plan states that the size  and complexity of the department’s modernization efforts will introduce a  paradigm shift and that this office is a “foundational enabler” to these  efforts and would, among other things, ensure that independent segments  are pursued in an integrated manner.
To date, the department has not established its EPMO and thus has not  assigned responsibility and authority for management of its modernization  efforts. While OCIO has identified a range of functions that this office  would need to perform, such as establishing a systematic, standardized,  repeatable process for management of IT projects across the enterprise,  and included these responsibilities as a contract task in an existing  contract awarded in August 2007, OCIO officials told us that this EPMO  task was not executed due to funding constraints. These officials also  stated that alternative contract solutions to meeting the department’s  EPMO needs will be examined. However, they did not have a plan defining  how and when this would occur, stating that it is dependent on funding  available in fiscal year 2010. Without an EPMO, HUD will be challenged in  its ability to successfully deliver modernized systems.
section_title: Conclusions
paragraphs: HUD’s ability to effectively and efficiently perform mission-critical  operations, including those integral to our nation’s economic recovery and  reinvestment activities, is constrained by its current IT environment. To  overcome these limitations and maximize IT support to HUD programs,  such as those that involve home mortgages and provide rental assistance,  it is essential for the department to have the capability and capacity to  manage both its existing IT environment and its ongoing and future IT  modernization efforts. Currently, it does not, as evidenced by limitations in  a number of core IT controls that are instrumental to managing both an  organization’s existing IT environment and its IT modernization efforts. In  particular, HUD is not effectively measuring whether it is meeting its IT  goals and, as a result, is not in compliance with a statutory requirement.  HUD is also not adequately controlling its IT investment portfolios to  ensure that they optimally deliver mission capabilities and value and is not  taking key steps to ensure that it has an adequate workforce to both  operate and maintain its existing systems and to deliver modernized  systems. Moreover, it has not ensured that modernization projects are  governed by well-defined segment architectures and that responsibility  and accountability for enterprisewide modernization management has  been assigned.
To HUD’s credit, it is aware of the need to improve many of these IT  management controls, but its IT resources have in recent years been  almost exclusively directed to sustaining its existing IT environment, and  it has yet to develop specific plans for strengthening each of these  management controls. Given the recent increase in modernization  resources available this year and, with further increases envisioned for  future years, it is important that building this capability and capacity be  treated as a department priority. Until HUD establishes effective and  mature structures, processes, practices, and tools for managing IT, it will  be challenged in its ability to effectively modernize its IT environment and  thus provide IT support to critical mission operations.
section_title: Recommendations for Executive Action
paragraphs: To ensure that HUD has an IT environment that effectively and efficiently  supports its mission operations, we recommend that the Secretary of  Housing and Urban Development ensure that recent and anticipated  increases in IT resources be allocated to strengthening each of the IT  management controls discussed in this report.
To these ends, we further recommend that the Secretary take the  following five actions:  1.  Direct the CIO to develop a plan for developing and implementing the  department’s new performance management framework, including an  implementation schedule of key activities and related resource needs,  and to ensure that this plan provides for complying with the statutory  requirement for annual reporting of progress in achieving IT strategic  goals. 2.  Direct the Deputy Secretary, as the TIBEC chairperson, to develop and  implement a plan to address the IT portfolio investment management  weaknesses that we identified. This plan should address the following:  a.  instituting policies and procedures for reviewing, evaluating, and  improving the performance of the department’s portfolio of  investments; b.  establishing resources for reviewing the investment portfolio,  including people, funding, and tools and ensuring board members  are familiar with the process for evaluating and improving portfolio  performance;  c.  developing criteria for assessing portfolio performance and  reviewing and modifying them at regular intervals to reflect current  performance expectations;  d.  defining and collecting IT portfolio performance measurement data  consistent with the portfolio performance criteria; and  e.  executing adjustments to the IT investment portfolio in response to  actual portfolio performance.  3.  Direct the CIO to establish and execute IT human capital gap closure  strategies that are based on a complete and current inventory of its  existing IT workforce skills. 4.  Direct the Deputy Secretary, as the TIBEC chairperson, to  a.  report to the Secretary on actions planned to address our prior EA  recommendations on defining a security architecture and  performing independent verification and validation, and  b.  develop a plan for reexamining segment priorities and updating  and developing segment architectures in accordance with these  priorities and relevant guidance.  5.  Direct the CIO to establish an enterprisewide program office with the  responsibility and authority for managing the department’s  modernization efforts.
section_title: Agency Comments and Our Evaluation
paragraphs: In written comments on a draft of our report signed by the Deputy Chief  Information Officer, the department agreed with our recommendations,  adding that it will dedicate resources to implementing each of them. In  addition, it provided largely technical comments to clarify, correct, or  update information in the report, which we have incorporated in the  report as appropriate, and address more specifically in appendix III.  However, it also offered a comment relative to our finding that HUD’s  segment architectures do not include performance goals, stating that such  segment performance goals are updated each year in HUD’s performance  architecture, and major investment performance goals are provided in its  annual budget submissions. We agree with this comment. However, the  point of our finding is that the segment architectures themselves do not  include performance goals and related time frames, as required by OMB  guidance. As a result, we have not modified our report to reflect this  comment.
We are sending copies of this report to interested congressional  committees; and the Secretary of Housing and Urban Development. The  report also is available at no charge on the GAO Web site at  http://www.gao.gov.
If you or your offices have questions on matters discussed int his report,  please contact me at (202) 512-3439 or at hiter@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix IV.
section_title: Appendix I: Objective, Scope, and Methodology
paragraphs: Our objective was to determine if the Department of Housing and Urban  Development (HUD) has adequately established institutional information  technology (IT) management controls needed to manage and modernize  its existing IT environment. To meet this objective, we focused on the  following management controls: IT strategic planning and performance  measurement; portfolio-based IT investment management; IT human  capital management; architecture development and use; and responsibility  and accountability for modernization management.
To evaluate HUD’s IT strategic planning and performance measurement,  we reviewed HUD’s agencywide strategic plan and its IT strategic plans, its  IT strategic implementation plan, and available assessments of its progress  in achieving IT strategic goals. We also interviewed HUD officials  including the Office of the Chief Information Officer’s (OCIO) Strategic  Planner. We assessed this information against provisions in the Clinger- Cohen Act and Paperwork Reduction Act related to defining IT strategic  goals and plans, assessing progress toward achieving IT strategic goals,  and measuring performance of IT operations.
To evaluate HUD’s IT investment management (ITIM) practices associated  with portfolio management, we used GAO’s ITIM framework and  assessed the extent to which HUD had established the policies and  procedures needed to effectively manage its investments as a portfolio, as  well as the key practices needed to control its portfolio (practices spec ific  to the evaluating the portfolio critical process of Stage 3). To conduc t our  assessment, we reviewed relevant HUD policies, procedures, guidance,  and documentation—including HUD’s investment management guide,  related process guides, such as its ITIM select guide, postimplementation  review guide, investment board charters, budget documents, and project  reviews and presentations. We also interviewed HUD’s Director of ITIM  and the Associate Deputy Chief Information Officer for Business and  Information Technology Modernization. We then compared this  information with the selected key practices in the ITIM framework to  determine the extent to which the department was employing effective IT  investment portfolio management practices. We rated ITIM key practices  as “executed” on the basis of whether the agency demonstrated (by  providing evidence of performance) that it had fully met the criteria of the  key practice. A key practice was rated as “not executed” when we found  insufficient evidence of a practice during the review or when we  determined that there were significant weaknesses in HUD’s execution of  the key practices. We provided HUD an opportunity to produce evidence  for the key practices that we rated as “not executed.”
To evaluate HUD’s IT human capital management, we reviewed IT human  capital management plans and related documentation, such as a  workforce needs assessment, gap analyses, and gap closure strategies. We  also interviewed HUD officials, including the Office of CIO’s Director of  Administrative Services. We assessed this information against strategic  workforce planning principles established in prior GAO work.
To evaluate HUD’s enterprise architecture (EA) development and use, we  relied on our previous report on HUD’s EA, updating this report relative  to two weaknesses that we reported—security in its EA and independent  verification and validation of EA products and management processes. To  do so, we reviewed HUD EA work products, including security and  independent verification and validation plans and products. In addition,  we reviewed EA transition plans, segment architectures, performance  architecture, and segment architecture development guidance, and  interviewed officials. We assessed this information against relevant  criteria in federal guidance, such as the Office of Management and  Budget’s (OMB) Federal Enterprise Architecture Practice Guidance and  its EA assessment framework, and best practices in GAO’s EA  Framework. Specific to segment architecture development, we assessed  the extent to which HUD’s segment architectures addressed elements of  segment development guidance in OMB’s Federal Enterprise Architecture  Practice Guidance. Specifically, we determined the extent to which  segment architectures addressed the element (addresses all aspects of the  element); partially addressed the element (addresses some, but not all  aspects of the element); or did not address the element (does not address  any aspect of the element).
To evaluate HUD’s modernization management office, we reviewed  published reports and research on having such an office and HUD plans  for establishing this office, including EA transition plans and an  acquisition contract for program management support. We also  interviewed the Associate Deputy CIO for Business and Information  Technology Modernization, the Director of Enterprise Architecture, and  the Director of Information Technology Systems Integration and  Efficiency. We assessed this information to determine the extent to which  HUD had established responsibility and accountability for modernization  management.
We conducted this performance audit from July 2008 to July 2009, in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives.
section_title: Appendix II: Descriptions of HUD Segment Architectures
paragraphs: Table 9 provides descriptions of segment architectures as identified by  HUD.
section_title: Appendix III: Comments from the Department of Housing and Urban Development
paragraphs: The following are GAO’s comments on the Department of Housing and  Urban Development dated July 22, 2009.
subsections: section_title: GAO Comments
paragraphs: 1.  We revised our report to reflect this comment.  2.  We revised our report to reflect HUD’s current OCIO organizational  structure. 3.  We clarified our report by explicitly identifying the HUD reports that  cite the limitations in HUD’s IT environment. 4.  We clarified our report to reflect this comment.  5.  We clarified our report to reflect this comment.  6.  We agree that performance goals are identified in HUD’s performance  architecture relative to segments and are included in budget  submissions to OMB for HUD’s major investments. However, our point  is that the performance goals and related time frames are not included  in the segment architectures. According to federal guidance, the  establishment of performance goals and time frames for achieving  these goals is to occur during the development of a segment  architecture, and thereby provide the basis for the goals in the  performance architecture and budget submissions. Therefore, we have  not modified our report in response to this comment. 7.  See comment 6.
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the individual named above, key contributions were made to  this report by James Sweetman, Assistant Director; Jamey Collins; Eric  Costello; Kristin English; Michael Holland; Lowell Labaro; Anh Le; Lee  McCracken; Sabine Paul; and Glenn Spiegel.