DOD Business Systems Modernization: Billions Being Invested without Adequate Oversight
Published: 2005-04-29T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Despite its significant investment in business systems, the Department of Defense (DOD) continues to have long-standing financial and business management problems that preclude the department from producing reliable and timely information for making decisions and for accurately reporting on its billions of dollars of assets. GAO was asked to (1) identify DOD's fiscal year 2005 estimated funding for its business systems and (2) determine whether DOD has effective control and accountability over its business systems modernization investments.
section_title: What GAO Found
paragraphs: DOD's business and financial management weaknesses have resulted in billions of dollars wasted annually in a time of increasing fiscal constraint. These weaknesses continue despite DOD requesting over $13 billion in fiscal year 2005--about $6 billion less than in fiscal year 2004--to operate, maintain, and modernize its existing duplicative business systems. The difference is more a reclassification of systems rather than an actual spending reduction. Some of the reclassifications appeared reasonable and others were questionable due to inconsistent information. At the same time, DOD reported an increase in the number of business systems to 4,150 as of February 2005--an increase of about 1,900 systems since April 2003. The duplicative and stovepiped nature of DOD's systems environment is illustrated by the numerous systems in the same business area. For example, DOD reported that it has over 2,000 logistics systems--an increase of approximately 255 percent since April 2003. DOD still does not have an effective departmentwide management structure for controlling business systems investments. Furthermore, DOD is not in compliance with the National Defense Authorization Act for Fiscal Year 2003, which requires the DOD Comptroller to determine that system improvements with obligations exceeding $1 million meet the criteria specified in the act. Based on limited information provided by DOD, system improvements totaling about $243 million of obligations over $1 million were not reviewed by the DOD Comptroller in fiscal year 2004. Cumulatively, based upon DOD's reported data, system improvements totaling about $651 million of obligations over $1 million were not reviewed by the DOD Comptroller before obligations were made since passage of the 2003 act. The 2005 defense authorization act directed that DOD put in place a management structure to improve the control and accountability over business systems investments by placing more responsibility with the domains. At the same time, each military service has its own investment review process. Absent an integrated management structure that clearly defines the relationship of the domains and the military services, DOD will be at risk that the parochialism contributing to the current problems will continue.

section_title: Letter
paragraphs: The Department of Defense (DOD) continues to confront pervasive  decades-old financial management and business system problems.  These  problems continue despite the department spending billions of dollars  annually to operate, maintain, and modernize its business systems.   Additionally, our reports continue to show that the department’s  stovepiped and duplicative systems contribute to fraud, waste, and abuse.   Of the 25 areas on GAO’s governmentwide “high-risk” list, 8 are DOD  program areas, and the department shares responsibility for 6 other high- risk areas that are governmentwide in scope.  These problems also  preclude the department from producing reliable, timely, and useful  information to make sound decisions and to accurately report on its  trillions of dollars of assets and liabilities.
This report is a continuation of our reviews to provide Congress  information on DOD’s continuing significant investments in its business  systems and its control and accountability over these investments.  More  specifically, as agreed with your offices, our objectives were to (1) identify  the amount of funding DOD requested for fiscal year 2005 to operate,  maintain, and modernize its business systems and (2) determine whether  DOD has effective control and accountability over its business systems  modernizations investments.
To determine how much DOD plans to spend on the operation,  maintenance, and modernization of its business systems in fiscal year 2005,  we analyzed DOD’s information technology (IT) budget request and met  with officials in the office of the DOD Chief Information Officer (CIO) and  military service representatives to obtain an overview of how the IT budget  request was developed.  To determine the effectiveness of the department’s  efforts to control and account for its business systems investments, we met  with officials in DOD’s office of the Business Management Modernization  Program (BMMP) and the business domains and reviewed available  documentation.  Further, we asked the military services and defense  agencies for a list of fiscal year 2004 reported obligations exceeding  $1 million for business systems modernizations, which we used in  determining if the obligations were reviewed by the DOD Comptroller to  ascertain whether financial systems improvements met the criteria  specified in the fiscal year 2003 defense authorization act.
Our work was performed from August 2004 through February 2005 in  accordance with U.S. generally accepted government auditing standards.   Details on our scope and methodology are included in appendix I.  We  requested comments on a draft of this report from the Secretary of Defense  or his designee.  Written comments from the Under Secretary of Defense  for Acquisition, Technology and Logistics are reprinted in appendix II.
subsections: section_title: Background
paragraphs: Because DOD is one of the largest and most complex organizations in the  world, overhauling its business operations represents a huge management  challenge.  In fiscal year 2004, DOD reported that its operations involved  $1.2 trillion in assets, $1.7 trillion in liabilities, over 3.3 million military and  civilian personnel, and over $605 billion in net cost of operations. For fiscal  year 2005, the department received appropriations of about $417 billion.   Execution of DOD’s operations spans a wide range of defense  organizations, including the military services and their respective major  commands and functional activities, numerous large defense agencies and  field activities, and various combatant and joint operational commands  that are responsible for military operations for specific geographic regions  or theaters of operation.  To support DOD’s operations, the department  performs an assortment of interrelated and interdependent business  processes, including logistics management, procurement, health care  management, and financial management.
Transformation of DOD’s business systems and operations is critical to the  department providing Congress and DOD management with accurate and  timely information for use in the decision-making process.  This effort is an  essential part of the Secretary of Defense’s broad initiative to “transform  the way the department works and what it works on.” Secretary Rumsfeld  has estimated that successful improvements to DOD’s business operations  could save the department 5 percent of its budget a year, which equates to  over $20 billion a year in savings.
subsections: section_title: Pervasive Financial and Business Management Problems Affect DOD’s Efficiency and Effectiveness
paragraphs: For several years, we have reported that DOD faces a range of financial  management and related business process challenges that are complex,  long-standing, pervasive, and deeply rooted in virtually all business  operations throughout the department.  As the Comptroller General  testified in November 2004, DOD’s financial management deficiencies,  taken together, continue to represent the single largest obstacle to  achieving an unqualified opinion on the U.S. government’s consolidated  financial statements. To date, none of the military services has passed the  test of an independent financial audit because of pervasive weaknesses in  internal controls and processes and fundamentally flawed business  systems.
In identifying improved financial performance as one of its five  governmentwide initiatives, the President’s Management Agenda  recognized that obtaining a clean (unqualified) financial audit opinion is a  basic prescription for any well-managed organization.  At the same time, it  recognized that without sound internal controls and accurate and timely  financial and performance information, it is not possible to accomplish the  President’s agenda and secure the best performance and highest measure  of accountability for the American people. The Joint Financial Management  Improvement Program (JFMIP) Principals have defined certain measures,  in addition to receiving an unqualified financial statement audit opinion, for  achieving financial management success. These additional measures  include (1) being able to routinely provide timely, accurate, and useful  financial and performance information; (2) having no material internal  control weaknesses or material noncompliance with laws and regulations;  and (3) meeting the requirements of the Federal Financial Management  Improvement Act of 1996 (FFMIA).  DOD does not meet any of these  conditions. In September 2004, the DOD Comptroller identified 11 major  deficiencies that would affect the department’s ability to prepare accurate  and reliable financial statements for fiscal year 2004.  Subsequently, the  DOD Inspector General issued a disclaimer of opinion on DOD’s fiscal year  2004 financial statements, citing material weaknesses in internal controls  and noncompliance with FFMIA requirements.  Pervasive weaknesses in  DOD’s financial management and related business processes and systems  have (1) resulted in a lack of reliable information needed to make sound  decisions and report on the status of DOD activities, including  accountability of assets, through financial and other reports to Congress  and DOD decision makers; (2) hindered its operational efficiency;  (3) adversely affected mission performance; and (4) left the department  vulnerable to fraud, waste, and abuse, as the following examples illustrate.
Mobilized Army National Guard soldiers have experienced significant  problems getting accurate, timely, and consistent reimbursement for  out-of-pocket travel expenses.  These weaknesses were more glaring in  light of the sustained increase in mobilizations for Army National Guard  soldiers over the last 3 years.  Our case study units experienced a broad  range of travel reimbursement problems, including disputed amounts  for meals that remained unpaid at the end of our review and vouchers  that were submitted five or more times before being paid.  One of the  primary causes for these problems is rooted in the paper-intensive  process used by DOD to reimburse Army National Guard soldiers for  their travel expenses.
Manual processes and nonintegrated pay and personnel systems affect  the Army’s ability to generate timely active duty medical extension  orders and ensure that soldiers are paid correctly.  The current  stovepiped, nonintegrated systems are labor-intensive and require  extensive error-prone manual entry and reentry.   The inadequate  control resulted in some soldiers being removed from active duty status  in the automated systems that control pay and access to benefits,  including medical care.  In addition, because these soldiers no longer  had valid active duty orders, they did not have access to the commissary  and post exchange—which allows soldiers and their families to  purchase groceries and other goods at a discount.  In one case we  reviewed, during a 12-month period, while attempting to obtain care for  injuries sustained from a helicopter crash in Afghanistan, one Special  Forces soldier fell out of active duty status four times.  During the times  he was not recorded in the system as being on active duty, he was not  paid and he and his family experienced delays in receiving medical  treatment.  In all, he missed payments for 10 pay periods—totaling  $11,924.
The processes and automated systems relied on to provide active duty  payments to mobilized Army Reserve soldiers are so error-prone,  cumbersome, and complex that neither DOD nor, more importantly, the  Army Reserve soldiers themselves could be reasonably assured of  timely and accurate payments. Specifically, at eight Army Reserve units  that we reviewed, 332 of 348 soldiers (95 percent) experienced at least  one problem with the active duty pay and allowances they were entitled  to receive. Many of the soldiers experienced multiple pay problems  associated with their active duty mobilizations. Some of the pay  problems soldiers experienced often lingered unresolved for  considerable lengths of time, some for over a year.  Of the $375,000 in  active duty pay and allowance problems identified in our case studies,  the majority were overpayments. We referred one individual for criminal  investigation because he did not mobilize with his unit, but he  erroneously received over $36,000 in active duty pay and did not report  this overpayment. We also identified 294 soldiers who were underpaid a  total of about $51,000 in active duty pay and allowances.
section_title: Efforts to Modernize DOD Business Systems
paragraphs: Transformation of DOD’s business systems and operations is critical to the  department having the ability to provide Congress and DOD management  with accurate and timely information for use in the decision-making  process.  One of the key elements we have reported as necessary to  successfully execute the transformation is establishing and implementing a  business enterprise architecture (BEA).  In this regard, the department has  undertaken a daunting challenge to modernize its existing business  systems environment through the development, maintenance, and  implementation of the BEA, or modernization blueprint. As previously  noted, the department has designated six domain owners to be responsible  for implementing the BEA. The importance of developing, maintaining, and  implementing an enterprise architecture is a basic tenet of both  organizational transformation and IT management. Managed properly, an  enterprise architecture can clarify and help optimize the interdependencies  and relationships among an organization’s business operations and the  underlying IT infrastructure and applications that support these  operations. Employed in concert with other important management  controls, such as portfolio-based capital planning and investment control  practices, architectures can greatly increase the chances that  organizations’ operational and IT environments will be configured to  optimize mission performance. Our experience with federal agencies has  shown that investing in IT without defining these investments in the  context of an architecture often results in systems that are duplicative, not  well integrated, and unnecessarily costly to maintain and interface.
A key element of an enterprise architecture is the development and  implementation of a transition plan.  According to relevant guidance and  best practices, the transition plan should provide a road map for moving  from the “As Is” to the “To Be” environment. An important step in the  development of a well-defined transition plan is an analysis that compares  the “As Is” and “To Be” architectures to identify differences. Options are  explored and decisions are made regarding which legacy systems to retain,  modify, or retire, and which new systems either to introduce on a  temporary basis or to pursue as strategic solutions.  Accordingly, transition  plans identify legacy, migration, and new systems, and sequence them to  show, for example, the phasing out and termination of systems and  capabilities and the timing of the introduction of new systems and  capabilities. Furthermore, they do so in light of resource constraints, such  as budget, people, acquisition/development process maturity, and  associated time frames.
To improve DOD’s control and accountability over business systems  investments, Congress included provisions in the Ronald W. Reagan  National Defense Authorization Act for Fiscal Year 2005.   The act directs  that a management structure be put in place that (1) makes domains  responsible for the control and accountability over business systems  investments, (2) requires domains to establish a hierarchy of investment  review boards from across the department, and (3) directs the boards to  use a standard set of investment review and decision-making criteria to  ensure compliance and consistency with the BEA.  The act also directs the  establishment of a departmental review board called the Defense Business  Systems Management Committee that is to be chaired by the Deputy  Secretary of Defense.
section_title: DOD Lacks Accurate Information on the Costs and Number of Business Systems
paragraphs: Until DOD has complete, reliable information on the costs and number of  business systems operating within the department, its ability to effectively  control the money it spends on these systems will be limited.  DOD’s fiscal  year 2005 budget request for its business systems was $13.3 billion, which  on its face is about $6 billion, or 29 percent, less than its fiscal year 2004  budget request.  We found that this decrease can be attributed to DOD’s  reclassification of some business systems to national security systems, not  to a reduction in spending on its systems.  While some of the  reclassifications appeared reasonable, our analysis showed that others  were questionable or inconsistencies exist, which hinders DOD’s ability to  develop a definitive business systems inventory.  DOD CIO officials  acknowledged that there were inconsistencies in the classifications of  systems as either business systems or national security systems and stated  that they were working to improve the classification criteria.
DOD CIO officials also stated that they are working toward a single system  repository for the department that will include information to be used in  developing the budget.  At the same time the amount of requested business  system funding declined, the reported number of business systems  increased by about 1,900—from 2,274 in April 2003 to 4,150 in February  2005.  Given the ever-changing numbers—for both funding and systems— the department continues to lack reasonable assurance that all business  systems are included within the reported inventory and that all business  system funding is accurately detailed in the budget.
subsections: section_title: Fiscal Year 2005 Budget Request for DOD’s Business Systems Environment Is $13.3 Billion
paragraphs: For fiscal year 2005, DOD requested approximately $28.7 billion in IT  funding to support a wide range of military operations as well as DOD  business systems operations.  Of the $28.7 billion, our analysis showed that  about $13.3 billion was for business applications and related infrastructure.   Of the $13.3 billion, our analysis of the budget request disclosed that about  $8.4 billion was for infrastructure and related costs.  Business applications  include activities that support the business functions of the department,  such as personnel, health, travel, acquisition, finance and accounting, and  logistics.  The remaining $15.4 billion was classified as being for national  security systems.  Of that amount, our analysis ascertained that about  $7.5 billion was for infrastructure and related costs.
Of the $13.3 billion, $10.7 billion was for the operation and maintenance of  the existing systems and $2.6 billion was for the modernization of existing  systems, the development of new systems, or both.  The Office of  Management and Budget requires that funds requested for IT projects be  classified as either steady state (referred to by DOD as “current services”)  or as development/modernization.  Current services funds are to be for  operating and maintaining systems at current levels (i.e., without major  enhancements), while development/modernization funds are to be for  developing new IT systems or making major enhancements to existing  systems.  Table 1 shows the distribution, by DOD component, of the  reported $13.3 billion between current services and modernization funding.
As an example of how a component applies funding for current services  and modernization, the budget request for the Standard Procurement  System, which is one of the department’s standard systems, will use a  combination of current services and modernization funding.  The fiscal  year 2005 budget request for the Standard Procurement System identified  about $56 million in total—$30 million for current services and $26 million  for development and modernization.
section_title: Reclassification Limits Oversight of Business Systems
paragraphs: Incorrect system classification hinders the department’s efforts to improve  its control and accountability over its business systems investments.  For  instance, the incorrect reclassification of business systems to national  security systems precludes scrutiny by the business domains, including the  process utilized to obtain the DOD Comptroller’s determination that  authorizes the components to obligate amounts over $1 million for the  improvement of financial management systems.  Our comparison of the  fiscal years 2004 and 2005 budget requests disclosed that DOD reclassified  56 systems in the fiscal year 2005 budget request from business systems to  national security systems. The net effect of the reclassifications was a  decrease of approximately $6 billion in the fiscal year 2005 budget request  for business systems and related infrastructure.  The reported amount  declined from about $19 billion in fiscal year 2004 to over $13 billion in  fiscal year 2005.
In some cases, we found that the reclassification appeared reasonable.  For  example, in the fiscal year 2005 budget request, the Defense Message  System was classified as a national security system.  In our May 2004  report, we noted the inconsistent classification of this system among the  military services.  The Navy classified the Defense Message System as a  business system but the Army and Air Force classified it as a national  security system.  Similarly, the reclassification of the Defense Information  System Network initiative as a national security system appeared  reasonable.  For example, the Defense Information System Network is used  to provide a secure telecommunication network—voice, data, and video— to the President, the Secretary of Defense, the Joint Chiefs of Staff, and  military personnel in the field.  These two systems account for over  $2.6 billion of the $6 billion.
However, our analysis of the 56 systems that were reclassified as national  security systems also identified instances for which the reclassification  was questionable.  For example, Base Level Communication  Infrastructure—initiative number 254—for several DOD entities was  shown as a national security system in the fiscal year 2005 budget request.   Our review of the fiscal year 2005 budget found that within the Air Force  there were numerous other initiatives entitled Base Level Communication  Infrastructure that were classified as business systems, not national  security systems.  The nomenclature describing these different initiatives  was the same.  Therefore, it was difficult to ascertain why certain initiatives  were classified as national security systems while others, with the same  name, were classified as business systems.  The following are examples of  the inconsistencies in the department’s classification of systems.
The Joint Total Asset Visibility System had been classified as a business  system since at least fiscal year 1999 and was identified as a business  system in the department’s original list of 2,274 business systems in  April 2003 and is still being reported as a business system in the  department’s systems inventory.  We found nothing in our review of the  fiscal year 2005 budget request that warranted a change in classification.
The Transportation Coordinators’ Automated Information for  Movements System II was identified as a business system in the  department’s original inventory of business systems in April 2003 and  has been shown as a business system in the budget request since 1999.   Furthermore, BMMP currently reports it as one of the department’s  business systems.  Yet it was reclassified as a national security system in  the fiscal year 2005 budget request even though its functionality had not  changed.  According to the program management office, the DOD CIO  classified the system as a national security system, but the program  management office was informed by the DOD Comptroller that the  system needed to be submitted to the DOD Comptroller for review in  accordance with section 1004(d) of the fiscal year 2003 defense  authorization act.  However, the section of the act relating to the DOD  Comptroller review does not apply to national security systems.  In our  May 2004 report, we noted that the Army reported that it obligated  almost $22 million for modernization of the system in fiscal year 2003  without its having been subject to review by the DOD Comptroller for  consistency with DOD’s BEA.
The Army’s Global Combat Support System was reclassified as a  national security system in the fiscal year 2005 budget, even though it is  still being reported as a business system in the department’s current  inventory.  Furthermore, BMMP officials stated that reclassification was  incorrect and the system was submitted to the DOD Comptroller for  review in accordance with section 1004(d) of the fiscal year 2003  defense authorization act.  The DOD Comptroller approved investment  in the system in August 2003 and January 2004.
In addition, this is the first year in which the Navy ERP was listed in the  budget and incorrectly classified as a national security system.  Its  forerunners, four pilot ERP projects, have been classified as business  systems since their inception.  DOD officials were not able to provide a  valid explanation why the program was classified as a national security  program.  For the fiscal year 2006 budget request, the Navy has requested  that the DOD CIO reclassify the program from a national security system to  a business system.
The misclassification of systems in DOD’s budget hinders the department’s  ability to develop a comprehensive list of its business systems, thereby  affecting its ability to develop a well-defined “As Is” component of its BEA  and a viable transition plan.  In addition, improper classification diminishes  Congress’s ability to effectively monitor and oversee the billions of dollars  spent annually to maintain, operate, and modernize the department’s  business systems environment.
section_title: DOD Is Working to Develop a Single Systems Inventory
paragraphs: DOD CIO officials acknowledged that there were inconsistencies within  the department in the classification of a system as either a business system  or a national security system, which hinder its ability to develop a single  comprehensive business systems inventory.  DOD CIO officials also stated  that with the implementation of the DOD Information Technology Portfolio  Data Repository (DITPR)—the new systems inventory repository—they  are working to improve the criteria governing the classification of systems,  and these criteria are being incorporated into the new systems inventory  repository.
As discussed in our May 2004 report, DOD has several databases that  contain information on its systems—business and national security—and  these databases have not been reconciled and therefore inconsistencies  exist.  We recommended that the department establish a single database for  its inventory of business systems.  Subsequently, on July 13, 2004, the DOD  CIO directed establishment of the DITPR.  According to BMMP officials,  the department is working toward one database that will contain  information for use in developing the annual budget request and will be  considered the single system repository for the department.  Additionally,  all existing databases will be eliminated.  Furthermore, the DITPR will  automatically classify each system based on selected information entered  for each.  For example, all intelligence, science and technology, and  logistics-warfighting systems are to be classified as national security  systems.
In addition, to help identify and properly categorize its business systems,  we recommended in May 2004 that DOD develop a standard definition for  business systems.  In July 2004, DOD established a definition of a system,  but not specifically of a business system.  DOD broadly defined a system as  a set of information resources organized for the collection, storage,  processing, maintenance, use, sharing, dissemination, disposition, display,  or transmission of information.  DOD’s definition also clarifies what should  not be reported as a system.  For example, it excludes such things as  commercial office automation packages, information assurance initiatives,  and architecture initiatives.  Additionally, DOD’s definition is aimed at  identifying all systems that would obligate $1 million or more for  modernization in any year of the department’s 5-year defense plan.
While DOD did not develop a specific definition of a business system, the  fiscal year 2005 defense authorization act subsequently provided a  definition.  The act defines a defense business system as an information  system, other than a national security system, operated by, for, or on behalf  of the department that is used to support business activities, such as  acquisition, financial management, logistics, strategic planning and  budgeting, installations and environment, and human resources  management.  The act states that such systems are to include financial  systems, mixed systems, financial data feeder systems, and IT and  information assurance infrastructure.  It is incumbent upon the department  to ensure that the definition specified in the act is used consistently  throughout the department and becomes the basis for entering information  into the DITPR.  As previously discussed, the accurate and complete  identification of DOD’s business systems is crucial for developing a  credible “As Is” component and transition plan for the BEA and ensuring  that obligations for modernizations are reviewed and approved as required  by the act.  Furthermore, such information is needed in order to provide  complete and accurate data to Congress for use in monitoring the  department’s business systems investments.
section_title: DOD Reports Significant Increase in the Number of Existing Business Systems
paragraphs: The department’s reported number of business systems continues to  fluctuate, and DOD does not yet have reasonable assurance that the  currently reported number of business systems is complete.  As of  February 2005, DOD reported that its business systems inventory consisted  of 4,150 systems, which is an increase of approximately 1,900 reported  business systems since April 2003.  Table 2 presents a comparison of the  April 2003 and February 2005 reported business systems inventories by  domain.
The largest increase is due to the logistics domain increasing its reported  inventory of business systems from 565 in April 2003 to the current 2,005.   We reported in May 2004 that the logistics domain had validated about  1,900 business systems but had not yet entered most of them into the  BMMP systems inventory.  Logistics domain officials informed us that they  completed that process and this increase was the result.  According to the  logistics domain officials, in making this determination, they considered an  initiative as a business system if it (1) is used by at least 50 people, (2) costs  at least $50,000 annually to operate, and (3) runs on a network.  The criteria  used by the logistics domain are stricter than those developed by the DOD  CIO.  As previously noted, the department needs to ensure that the same  criteria are used by all the domains in defining business systems in order to  ensure that it develops a complete and accurate inventory of its business  systems.
As shown in table 2, the reported inventory of business systems for most of  the other domains increased, except for the financial management domain,  whose inventory declined.  Domain officials attributed the increases to  additional data calls and working closely with the components to identify  systems.  The financial management domain attributed the declines to  eliminating nonsystems and duplicate entries in the inventory.  For  example, its analysis showed that previously spreadsheets, reports, or both  were incorrectly reported as being systems.  For the current inventory,  some of the domains indicated that they used the definition of a system that  was issued by DOD’s CIO in the July 2004 DITPR data call.
Table 3 shows the distribution of the 4,150 business systems among the  components and domains.
The table shows the stovepiped, duplicative nature of DOD’s business  systems.  For example, there are 713 human resources systems across all  components whose reported funding for fiscal year 2005 includes  approximately $223 million for modernization and over $656 million for  operation and maintenance.  According to DOD officials, the Defense  Integrated Military Human Resources System (DIMHRS) is intended to  totally or partially replace 113 of these systems.  We were informed that the  remaining 600 human resources systems are to be reviewed in the context  of the BEA as it is developed.
Furthermore, a human resources domain official acknowledged that for  two of the systems that are to be replaced by DIMHRS—the Army’s  Electronic Military Personnel System and the Air Force Military Personnel  Data System—continuing to spend money to modernize these systems was  questionable.  We also reported in June 2004 that the fiscal year 2005 IT  budget request did not provide sufficient information to identify or justify  the specific current services and modernizations for 97 of the 113 systems.   Because, as noted in table 1, the funding is distributed to and controlled by  the military services and DOD components, the domains have minimal  influence over system funding.  As a result, DOD continues to fund the  modernization of systems that it intends to totally or partially replace.  As  discussed later, the new requirements and authorities included in the fiscal  year 2005 defense authorization act are aimed at ensuring that the domains  have a vital decision-making role in the control and accountability of the  investments being made in the department’s business systems.
While DOD has reported that its inventory of business systems has  increased by about 1,900, the department continues to struggle with  developing a comprehensive inventory.  As detailed in table 3, there are 215  business systems with no component identified—although they have been  assigned to a domain—and 140 business systems with no domain assigned.  BMMP officials stated that they are reviewing each system and working  with the domains to ascertain where each system should be placed.   Without the component being identified, it would be difficult if not  impossible to identify the DOD entity that is responsible for investment  reviews of the systems.  Furthermore, it is essential that a domain be  identified for each system in order for the department to meet the  requirements set forth in the fiscal year 2005 defense authorization act.
In discussing the increase in the number of systems identified in DOD,  some of the domains stated that many of the systems are not included in  the IT budget request.  They said that some of these systems were likely  developed at the local level and financed by the operation and maintenance  funds received at that location and therefore were not captured and  reported as part of the department’s annual IT budget request.  Financing  business systems in this manner rather than within the IT budget results in  Congress and DOD management not being aware of the total amount being  spent to operate, maintain, and modernize the department’s business  systems.  As a result, Congress and DOD management do not receive  complete and accurate data for use in monitoring the department’s  business systems investments.
In addition, according to Army officials, as part of its efforts to develop the  Army’s enterprise architecture, the Army has identified about 3,000  systems, and it believes some of these systems should be categorized as  business systems.  At this time, the Army is uncertain how many should be  classified as business systems.  As shown in table 3, the BMMP inventory of  Army business systems totaled 727 systems as of February 2005.  Army  officials did not specify the anticipated time frame for completing their  analysis of these systems.
section_title: Limited Progress Made in DOD’s Efforts to Control Its Business Systems Investments
paragraphs: Given that DOD does not know how many business systems it has or how  much is spent on them, it is not surprising that the department continues to  lack effective management oversight and control over business systems  investments.  Since February 2003, the domains have been given the  responsibility to oversee the department’s business systems investments,  yet the billions of dollars spent each year continue to be spread among the  military services and defense agencies, enabling the numerous DOD  components to continue to develop stovepiped, parochial solutions to the  department’s long-standing financial management and business operation  challenges.  Furthermore, the department has testified that it does not  know whether it was in compliance with the fiscal year 2003 defense  authorization act, which provides that obligations in excess of $1 million  for systems improvements may not be made unless the DOD Comptroller  determines that the improvements are consistent with the criteria specified  in the act.  In this regard, based upon data reported to us by the military  services and DOD components, obligations totaling about $243 million  were made for systems modernizations in fiscal year 2004 that were not  referred to the DOD Comptroller for the required review.
Further, while the fiscal year 2005 national defense authorization act  directs that the domains are to have increasing oversight of the  department’s business systems investments, each of the military services  has established its own management oversight structures.  Thus, DOD does  not yet have a comprehensive strategy in place that delineates the specific  roles and responsibilities of the domains and military services.  Absent an  integrated strategy, the domains’ and military services’ efforts may be  duplicative, resulting in the wasteful use of resources and hindering the  overall transformation of the department’s business systems and related  operations.
subsections: section_title: Management Oversight Structure and Guidance Not Finalized
paragraphs: DOD has not yet finalized guidance that clearly defines the roles and  responsibilities of domains or assigns explicit authority for fulfilling these  roles and responsibilities.  It also has not established common investment  criteria for system reviews or conducted a comprehensive review of its  ongoing business systems investments. Over the past several years, we  have made numerous recommendations aimed at improving the  department’s control and accountability over its business systems  investments.  Many of the actions that DOD planned to take remained  incomplete as of February 2005.
DOD officials acknowledged that the following actions have not been  completed:  The March 2004 IT portfolio management policy memorandum signed  by the Deputy Secretary of Defense provides the basic structure of the  roles and responsibilities of the domains.  In order for the guidance to  be institutionalized within the department, DOD planned to issue a  formal DOD directive to specify the roles and responsibilities of the  domains and how they are to be involved in the overall business systems  investment management process.  As of February 2005, the DOD  guidance had not been finalized, and DOD CIO officials did not have a  time frame for its issuance.
The domains are still working on developing standard and consistent  criteria for performing system reviews.  The BMMP program director  recently acknowledged that the differing criteria are being used in the  system review process.  Although the domains have used draft guidance  listing 27 critical questions since July 2004, this DOD guidance has not  been finalized, and a time frame for approval has not been provided.
The domains have not completed a comprehensive system review of  their ongoing IT investments.  As discussed previously, the reported  business systems inventory has increased from 2,274 systems in April  2003 to over 4,000 systems in February 2005.  A target date for  completing these reviews has not been determined.  We have previously  reported that best practices recommend that an organization review  ongoing investments periodically to ensure that they are consistent with  its architectural development efforts.
In a July 16, 2004, memorandum, the DOD Comptroller reiterated the  importance of having all business systems modernizations with obligations  exceeding $1 million approved.  The memorandum expanded the  congressional requirements for DOD Comptroller certification to all  business systems and required business domains to submit a fiscal year  2005 system certification schedule to BMMP officials.  Later, in November  2004, the DOD Comptroller testified that the department had started to  take actions that would position it to meet the new, similar review  requirements of the fiscal year 2005 act.  The DOD Comptroller’s testimony  noted that the department had already identified 132 business systems that  represent 78 percent of fiscal year 2005 modernization funding.  These  systems are scheduled to be reviewed during the current fiscal year.  However, as noted earlier, DOD has not yet established specific criteria for  investment reviews.  Such criteria would include elements to implement  the definition of what constitutes a business system modernization that  would be subject to the provisions in the fiscal year 2005 defense  authorization act.  While the act provides a general definition for a business  system modernization, it is critical for DOD to issue specific  implementation guidance and criteria to explicitly define business systems  modernizations to ensure that the DOD components and the domains use  clear, consistent guidance in performing the system reviews.
section_title: DOD Lacks Reasonable Assurance That It Is in Compliance with Statutory Investment Management Controls
paragraphs: We found that DOD is not in compliance with the fiscal year 2003 defense  authorization act, which requires that all financial system improvements  with obligations exceeding $1 million be reviewed by the DOD Comptroller.   Based upon the reported obligational data provided to us by the military  services and the defense agencies for fiscal year 2004, we identified 30  modernizations with obligations totaling about $243 million that were not  submitted for the required review. As previously noted, DOD defines a  modernization as an enhancement to existing systems or the development  of new systems.  For purposes of this report, we treat modernizations as  defined by DOD the same as “system improvements” as that term is  similarly defined in the fiscal year 2003 defense authorization act.   Additionally, the 2003 act defines financial systems to include “budgetary,  accounting, finance, enterprise resource planning or mixed information  system.”  We reviewed DOD’s representation of the functions performed by  these systems made in the department’s fiscal years 2004 and 2005 budget  requests.
DOD has acknowledged that it does not have a mechanism to identify  systems that should be reviewed in accordance with the statutory  requirements.  Because DOD lacks a systematic means to identify the  systems that were subject to the requirements of the fiscal year 2003  defense authorization act, there is no certainty that the information  provided to us accurately identified all systems improvements with  obligations greater than $1 million during the fiscal year.
BMMP officials stated that the domains were responsible for working with  the components to make sure that business systems with obligations for  modernizations greater than $1 million were submitted for review as  required.  There was also general agreement among the domains and  BMMP officials that systems owners were responsible for initiating the  $1 million review process. In essence, compliance was achieved via the  “honor system,” which relied on systems owners coming forward and  requesting approval.  However, the approach did not work.  During fiscal  year 2004, the number of systems reviewed was small when compared to  the potential number of systems that appeared to meet the obligation  threshold identified in the fiscal year 2004 budget request.  We analyzed the  DOD IT budget request for fiscal year 2004 and identified over 200 systems  in the budget that could involve modernizations with obligations of funds  that exceed the $1 million threshold.  However, BMMP officials confirmed  that only 46 systems were reviewed, of which 38 were approved as of  September 30, 2004.   The remaining 8 systems were either withdrawn by  the component/domain or were returned to the component/domain  because the system package submitted for review lacked some of the  required supporting documentation, such as the review by the Office of  Program Analysis and Evaluation, if necessary.
Moreover, although the modernizations of 38 business systems were  reviewed and approved by the DOD Comptroller as required, this does not  necessarily mean these were prudent resource investments or integrated  solutions to DOD’s long-standing problems.  Although the criteria for the  DOD Comptroller review included compliance with the BEA, we have  previously reported that the BEA did not include many of the elements of  a well-defined architecture.  For example, DOD does not have a  comprehensive system inventory of its “As Is” environment and has not  developed a transition plan to identify those systems that would not be part  of the architecture.  Further, the real value of a BEA is that it provides the  necessary context for guiding and constraining systems investments in a  way that promotes interoperability and minimizes overlap and duplication.   Without it, expensive rework is likely to be needed to achieve these  outcomes.
In an attempt to substantiate that financial system improvements with over  $1 million in obligations were reviewed by the DOD Comptroller, as  provided for in the fiscal year 2003 act, we requested that DOD activities  provide us with a list of obligations (by system) greater than $1 million for  modernizations for fiscal year 2004.  We compared the reported  obligational data to the system approval data reported to us by BMMP  officials.  Based upon this comparison and as shown in table 4, 30 business  systems with obligations totaling about $243 million in fiscal year 2004 for  modernizations were not reviewed by the DOD Comptroller.
Examples of DOD business systems modernizations with obligations in  excess of $1 million included in table 4 that were not submitted to the DOD  Comptroller include the following.
The Navy obligated about $57 million for the Navy Tactical Command  Support System in fiscal year 2004.  We previously reported that for  fiscal year 2003, the Navy obligated about $22 million for this system  without submitting it to the DOD Comptroller for review.
DFAS obligated about $3 million in fiscal year 2004 for the DFAS  Corporate Database/DFAS Corporate Warehouse (DCD/DCW).  In fiscal  year 2003, DFAS obligated approximately $19 million for DCD/DCW  without submitting it to the DOD Comptroller for review.  Additionally,  we reported in May 2004 that DFAS had yet to complete an economic  analysis justifying that continued investment in DCD/DCW would result  in tangible improvements in the department’s operations.  The  department has acknowledged that DCD/DCW will not result in tangible  savings to DOD.  Continued investment is being based upon intangible  savings of man-hours reductions by DFAS.
The Air Force obligated about $25 million for the Integrated  Maintenance Data System in fiscal year 2004.  We previously reported  that for fiscal year 2003, the Air Force obligated over $9 million for this  system without it being submitted to the DOD Comptroller for review.
The Army obligated over $34 million for its Logistics Modernization  Program in fiscal year 2004.  In fiscal year 2003, the Army obligated over  $52 million without the prerequisite review being performed by the DOD  Comptroller.
DLA obligated about $5 million for the Defense Medical Logistics  Standard Support program in fiscal year 2004.  We previously reported  that DLA obligated about $5 million in fiscal year 2003 for this program.
The 2003 act placed limitations on the legal authority of individual program  and government contracting officials to obligate funds in support of the  financial systems improvements for which they are responsible, but DOD  did not proactively manage investments to avoid violations of the  limitations and did not review investments in any meaningful way to  enforce these statutory limitations.
Appendix III provides a list of obligations exceeding $1 million for business  systems modernizations for fiscal year 2004 that were reviewed and  approved by the DOD Comptroller as required by the 2003 act. Appendix IV  provides a list of the individual systems not submitted to the DOD  Comptroller and the related amount of the reported obligations for fiscal  year 2004, as required by the 2003 act.  It should be noted that since passage  of the fiscal year 2003 defense authorization act in December 2002 through  the end of fiscal year 2004, based upon information reported to us, the  military services and defense components obligated about $651 million for  business systems modernizations without the required review by the DOD  Comptroller.  While this amount is significant, it is not complete or accurate  because it does not include any fiscal year 2005 obligations that occurred  prior to the enactment of the fiscal year 2005 defense authorization act on  October 28, 2004.
Additionally, our analysis also identified another 50 business systems with  obligations totaling over $258 million that were not submitted for review as  directed by the DOD Comptroller’s July 16, 2004, memorandum.  The  memorandum expanded the criteria set forth in the 2003 act to include the  modernization of all nonfinancial business systems that support the  operations of the business domains.  Appendix V provides a list of the  business systems not submitted for review in accordance with the July  2004 guidance and the related amount of obligation for each system.
In an attempt to achieve compliance with the requirement of the 2003 act  and the DOD Comptroller’s July 2004 memorandum, as of January 2005, the  DOD Comptroller identified 48 business systems that had both fiscal year  2004 and 2005 budgets each greater than $1 million in modernization  funding, but had not been reviewed and approved by the DOD Comptroller.   For the 48 business systems, the DOD Comptroller withheld a funding  amount equal to 50 percent of the systems’ fiscal year 2005 modernization  funding, which amounts to over $192 million.  We discussed the withheld  amounts with BMMP officials, who told us they anticipated that virtually all  of the systems would come off of the “withhold” list by the end of the fiscal  year.  According to BMMP officials, a system will be removed from the  withhold list as soon as the system owner, in conjunction with the domains,  has a business system certification package approved by the DOD  Comptroller, thereby showing compliance with the DOD Comptroller’s July  2004 memorandum.
DOD’s process of withholding funding is focused on meeting  documentation requirements related to compliance with the BEA, rather  than on the control of business systems investments.  The “withhold”  process ultimately will have very little impact on DOD’s control and  accountability over its business systems investment.  The department  continues to perpetuate the proliferation of duplicative, nonintegrated, and  stovepiped business systems by spending billions of dollars annually on the  modernization of systems for which DOD lacks reasonable assurance that  the investment will add value to DOD’s operations. To gain more control  and accountability over such business systems funding, we have previously  recommended that the funding be vested with the “owners” of the various  functional areas or domains. We believe it is critical that funds for DOD  business systems be appropriated to the domain owners in order to prevent  the continued parochial approach to systems investment that exists today.  While the department has stated that the domains would be involved in the  fiscal year 2006 budget review process, as previously noted, we found this  not to be the case.  Unless the domains control the funding, it will be  difficult for them to meet the requirements of the Ronald W. Reagan  National Defense Authorization Act for Fiscal Year 2005, including control  and accountability over business systems investments.
section_title: Congress Acts to Improve DOD’s Control and Accountability over Business Systems Investments
paragraphs: The statutory requirements enacted as part of the Ronald W. Reagan  National Defense Authorization Act for Fiscal Year 2005 are aimed at  improving the department’s business systems management practices.  The  act directs DOD to put in place a definite management structure that is  responsible for the control and accountability over business systems  investments by establishing a hierarchy of investment review boards from  across the department and directs that the boards use a standard set of  investment review and decision-making criteria to ensure compliance and  consistency with the BEA.
More specifically, the act does the following:  Directs DOD to establish specific management oversight and  accountability with the “owners” of the various functional areas or  domains. The legislation defined the scope of the various business areas  (e.g., acquisition, logistics, and finance and accounting) and directed the  establishment of functional approval authority and responsibility for  management of the portfolio of business systems with the relevant  under secretary of defense for the departmental domains and the  Assistant Secretary of Defense for Networks and Information  Integration and the CIO for the department.
Stipulates that no later than March 15, 2005, the responsible approval  authorities, or domains, establish a hierarchy of investment review  boards with DOD-wide representation, including the military services  and defense agencies. The boards are responsible for reviewing and  approving investments to develop, operate, maintain, and modernize  business systems for their respective business areas, including ensuring  that investments are consistent with DOD’s BEA.
Directs the Secretary of Defense to establish the Defense Business  Systems Management Committee with representation including the  Deputy Secretary of Defense, the designated approval authorities, and  secretaries of the military services and heads of the defense agencies.   The Deputy Secretary of Defense is the chairman of the committee with  one of the designated approval authorities serving as the vice-chairman.
Directs that effective October 1, 2005, funds may not be obligated for a  defense business systems modernization that will have a total cost in  excess of $1 million unless the conditions specified in the act are met.
The Defense Business Systems Management Committee must agree  with the designated approval authorities’ certification before funds can  be obligated. More important, the obligation of funds without the  requisite approval by the Defense Business Systems Management  Committee is deemed a violation of the Anti-Deficiency Act.
Requires that no later than March 15 of each year from 2005 through  2009, the Secretary of Defense shall submit a report to Congress that  describes how DOD plans to comply with the requirements of the act.
Stipulates that all budget requests, starting with the budget request for  fiscal year 2006, include supporting information that (1) identifies each  defense business system for which funding is proposed in that budget;  (2) identifies all current services and modernization funds, by  appropriation, for each business system; (3) identifies the designated  approval authority for each business system; and (4) describes the  required certification for each business system.
While the success of BMMP and improved control and accountability of  business systems investments are critical aspects of the department’s  transformation efforts, equally important is the department’s ability to  develop and implement business systems that provide the promised  capabilities on time and within budget.  As we have previously reported,  the department has not demonstrated the ability to achieve these goals.   Given that the domains have been designated as being responsible for  reviewing and approving business systems investments, each of the  domains’ investment review boards needs to provide effective management  oversight of each system project’s performance and progress toward  predefined cost and schedule expectations as well as each project’s  anticipated benefits and risk exposure.  Further, each investment review  board should also employ early warning systems that enable it to take  corrective action at the first sign of cost, schedule, or performance  slippages. Effective project oversight requires having regular reviews of the  project’s performance against stated expectations and ensuring that  corrective actions for each underperforming project are documented,  agreed to, implemented, and tracked until the desired outcome is achieved.  We have previously recommended that until DOD assesses its current  systems, investment should be limited to   deployment of systems that have already been fully tested and involve  no additional development or acquisition cost;   stay-in-business maintenance needed to keep existing systems   management controls needed to effectively invest in modernized   new systems or existing system changes that are congressionally  directed or are relatively small, cost-effective, and low risk and can be  delivered in a relatively short time frame.
DOD also has not acted upon this recommendation and continues to invest  billions of dollars without effective oversight and control.  With the fiscal  year 2005 act placing more responsibility on the domains, the  implementation of the above four limitations would be one means of  obtaining improved control over business systems investments.
We have previously reported that best practices recommend that to  achieve successful transformation, an organization must change its culture  so that it is more results-oriented, customer-focused, and collaborative in  nature.  To transform its culture, an effective performance management  system can be a strategic tool to drive internal changes and achieve desired  results by using specific key practices to create a clear link between  individual performance and organizational success.  An effective  performance management system pertaining to DOD’s business systems  would help the department determine the effectiveness of the domains and  components in carrying out their responsibilities for the control and  accountability of business systems investments.
Although the requirements of the fiscal year 2005 defense authorization act  establish a management structure, each of the military services has  established its own business systems investment review process.  At this  point, it is uncertain how they will be integrated with the roles and  responsibilities that are to be exercised by the domains.  Given the size and  complexity of the business systems and related operations transformation  endeavor, it is critical that the military services and domains are fully  integrated into one cohesive business system investment management  strategy.  However, it is not clear what specific role the military services  will play.  If the military services’ efforts are simply viewed as one more  level of review, that would be counterproductive to the overall  transformation goals and objectives.  Absent guidance that clearly  articulates the relationship and the related roles and responsibilities of the  domains and military services, each will continue to have stovepiped  approaches to business systems investment management that result in  more duplicative efforts.  As a result, the department will continue to lack  an overall comprehensive corporate process for ensuring that the billions  of dollars spent on business systems are being spent efficiently and  economically.
section_title: Conclusion
paragraphs: DOD’s difficulty in simply identifying all of its business systems and the  money spent on them illustrates the enormity and complexity of  transforming the department’s business operations.  Since April 2003, the  reported inventory has increased by about 1,900 systems.  Also, the  department is not aware of which DOD component controls all the systems  nor have all the systems been assigned to a domain.  Given these  circumstances, the department has made limited progress in achieving  effective management control and accountability over the billions of  dollars invested annually in its business systems.  The department  continues to lack reasonable assurance that the billions of dollars spent  annually on its business systems represent an efficient use of resources.   Because DOD lacks a well-defined BEA and transition plan, billions of  dollars continue to be at risk of being spent on systems that are duplicative,  are not interoperable, cost more to maintain than necessary, and do not  optimize mission performance and accountability.
While the fiscal year 2005 defense authorization act provides a  management structure to improve the control and accountability over the  department’s business systems investments, the appropriate policies and  procedures still must be developed, implemented, and institutionalized to  allow the department to make informed systems investment decisions.  An  integrated, comprehensive strategy will be critical to help ensure the  domains and military services do not proceed independently of one  another.  By doing less, DOD will continue to waste billions of dollars by  perpetuating today’s legacy business systems environment.
section_title: Recommendations for Executive Action
paragraphs: To improve the department’s control and accountability of business  systems investments, we are making the following four recommendations.   We recommend that the Secretary of Defense direct that the   DOD CIO, in consultation with the domains, review the 56 systems  reclassified from business systems to national security systems to  determine how these should be properly reported in the fiscal year 2007  IT budget request;  Defense Business Systems Management Committee work with the  domain investment review boards to review the reported BMMP  business systems inventory so systems are defined in accordance with  the definition specified in the fiscal year 2005 defense authorization act;   Defense Business Systems Management Committee develop a  comprehensive plan that addresses implementation of our previous  recommendations related to the BEA and the control and accountability  over business systems investments (at a minimum, the plan should  assign responsibility and estimated time frames for completion); and    comprehensive plan we recommend above be incorporated into the  department’s second annual report due March 15, 2006, to the defense  congressional committees, as required by the fiscal year 2005 defense  authorization act, to help facilitate congressional oversight.
section_title: Agency Comments and Our Evaluation
paragraphs: We received written comments on a draft of this report from the Under  Secretary of Defense for Acquisition, Technology and Logistics, which are  reprinted in appendix II.  DOD concurred with our recommendations and  identified actions it planned to take to improve the department’s control  and accountability of business systems investments.  For example, the  Under Secretary of Defense for Acquisition, Technology and Logistics,  stated that the department will conduct a review of the 56 systems  reclassified from business to national security systems to determine the  proper classification of these systems in the IT budget requests.  In  addition, the Under Secretary of Defense for Acquisition, Technology and  Logistics, noted that on March 17, 2005, the department designated the  DITPR as the database for all DOD business systems and that the DITPR  has the capability to identify all reported BMMP business systems in  accordance with the definition specified in the fiscal year 2005 defense  authorization act.  The Under Secretary of Defense for Acquisition,  Technology and Logistics, also stated that the department is developing a  plan and timeline to address our previous recommendations and that this  plan will be included in the department’s report due March 15, 2006, to the  defense congressional committees.
In addition to the actions taken in response to our recommendations, DOD  implemented several other key steps after we provided a draft of the report  to the department for comment.  Specifically, the department acted to  address certain provisions and requirements of the fiscal year 2005 defense  authorization act.  On March 19, 2005, the Deputy Secretary of Defense  delegated the authority for the review, approval, and oversight of the  planning, design, acquisition, development, operation, maintenance, and  modernization of defense business systems to the designated approval  authority for each business area.  Additionally on March 24, 2005, the  Deputy Secretary of Defense directed the transfer of program management,  oversight, and support responsibilities regarding DOD business  transformation efforts from the Office of the Under Secretary of Defense,  Comptroller, to the Office of the Under Secretary of Defense for  Acquisition, Technology and Logistics. According to the directive, this  transfer of functions and responsibilities will allow the Office of the Under  Secretary of Defense for Acquisition, Technology and Logistics to establish  the level of activity necessary to support and coordinate activities of the  newly established Defense Business Systems Management Committee. As  required by the act, the Defense Business Systems Management  Committee, with representation including the Deputy Secretary of Defense,  the designated approval authorities, and secretaries of the military services  and heads of the defense agencies, is the highest ranking governance body  responsible for overseeing DOD business systems modernization efforts.
While these actions are important in establishing the administrative  framework for implementing management reform, we continue to believe  that a new executive position is needed to provide the strong and sustained  leadership to guide these efforts.  We have testified on the need for a chief  management official (CMO) on numerous occasions, including our most  recent testimony on April 13, 2005.  The CMO would serve as the Deputy  Secretary of Defense for Management and oversee the department’s  business transformation efforts.  The day-to-day demands placed on the  Secretary of Defense, the Deputy Secretary, and others make it difficult for  these leaders to maintain the oversight, focus, and momentum needed to  resolve the weaknesses in DOD’s overall business operations. This is  particularly evident given the demands that the Iraq and Afghanistan  postwar reconstruction activities and the continuing war on terrorism have  placed on current leaders. Furthermore, the breadth and complexity of the  problems and the hierarchical nature of the department preclude the under  secretaries from asserting the necessary authority to resolve these long- standing issues while continuing to fulfill their other responsibilities. A  CMO could provide the sustained and focused leadership that these other  top officials are unable to provide. On April 14, 2005, a bill was introduced  in the Senate that requires the establishment of a CMO that would be  appointed by the President and confirmed by the Senate, for a set term of 7  years.
As agreed with your offices, unless you announce the contents of this  report earlier, we will not distribute it until 30 days after its issuance date.   At that time, we will send copies to the Chairmen and Ranking Minority  Members, Senate Committee on Armed Services; Senate Committee on  Homeland Security and Governmental Affairs; Subcommittee on Defense,  Senate Committee on Appropriations; House Committee on Armed  Services; Subcommittee on Defense, House Committee on Appropriations;  and Ranking Minority Member, House Committee on Government Reform.   We will also send copies to the Under Secretary of Defense (Comptroller);  the Under Secretary of Defense (Acquisition, Technology and Logistics);  the Under Secretary of Defense (Personnel and Readiness); the Assistant  Secretary of Defense (Networks and Information Integration); and the  Director, Office of Management and Budget.  Copies of this report will be  made available to others upon request.  In addition, the report will be  available at no charge on the GAO Web site at http://www.gao.gov.  If you or  your staff have any questions on matters discussed in this report, please  contact Gregory D. Kutz at (202) 512-9095 or kutzg@gao.gov or Keith A.  Rhodes at (202) 512-6412 or rhodesk@gao.gov.  GAO contacts and key  contributors to this report are listed in appendix VI.
section_title: Scope and Methodology
paragraphs: We reviewed the Department of Defense’s (DOD) approximately  $28.7 billion fiscal year 2005 information technology (IT) budget request to  determine what portion of the budget relates to DOD business systems.  We  reviewed the budget to determine, of the approximately $13.3 billion  related to the department’s business systems, the amount allocated for  operation, maintenance, and development/modernization.  We also met  with the domains to obtain an understanding of the process followed in  determining the specific number of business systems applicable to each  respective domain.
In addition, we compared the fiscal year 2004 and 2005 IT budget requests  to determine the systems that were reclassified from business systems to  national security systems.  We analyzed the 56 system reclassifications by  using information in the budget requests, the Business Management  Modernization Program (BMMP) systems inventory, and the list of business  systems modernizations with obligations approved by the DOD  Comptroller to determine if they were reasonable and consistent.  For  certain systems that had inconsistent information, we inquired of system  program and BMMP officials about the appropriateness of the  reclassifications.
To determine the effectiveness of DOD’s control and accountability over its  business systems investments, we met with DOD officials to obtain an  update on the status of our prior recommendations. We also met with  appropriate officials in the DOD Comptroller and DOD Chief Information  Officer (CIO) offices to discuss the status of various draft policies and  guidance that are aimed at improving the department’s control and  accountability over business systems investments. We also reviewed and  analyzed the DOD budget request for fiscal year 2004 to identify the  business systems investments that could be subject to the requirements of  the Bob Stump National Defense Authorization Act for Fiscal Year 2003,  which requires the DOD Comptroller to review all financial system  improvements with obligations exceeding $1 million and determine  whether each improvement is in accordance with criteria specified in the  act.  To assess DOD’s compliance with the act, we obtained and reviewed  obligational data on modernizations in excess of $1 million for business  systems for fiscal year 2004.  We compared the obligational data provided  by the military services and defense agencies with information obtained  from BMMP officials to determine if the modernizations were reviewed by  the DOD Comptroller as stipulated in the fiscal year 2003 act. We did not  review the accuracy and reliability of the obligational data reported by  DOD.  Given the department’s previously reported problems related to  financial management, we have no assurance that the data provided were  complete, but the obligational data reported by DOD are the only data  available that can be used for determining the specific amount of  modernization funding spent on each business system.
To augment our document reviews and analyses, we interviewed officials  from various DOD organizations, including the Office of the Under  Secretary of Defense (Comptroller); the DOD CIO; and the Office of the  Under Secretary of Defense (Acquisition, Technology and Logistics).  We  conducted our work from August 2004 through February 2005 in  accordance with U.S. generally accepted government auditing standards.
We requested comments on a draft of this report from the Secretary of  Defense or his designee.  We received written comments on a draft of the  report from the Under Secretary of Defense for Acquisition, Technology  and Logistics, which are reprinted in appendix II.
section_title: Comments from the Department of Defense
section_title: DOD Business Systems Modernizations with Obligations in Excess of $1 Million Approved by the DOD Comptroller in Fiscal Year 2004
section_title: Modernizations with Obligations in Excess of $1 Million Not Submitted for the Required DOD Comptroller Review
paragraphs: Defense Civilian Personnel Data System-Sustainment Navy Tactical Command Support System Conventional Ammunition Integrated Information System SPAWAR Financial Management – ERP NAVSEA Regional Fleet Maintenance ERP Pilot Regional Maintenance Automated Information System Integrated Logistics System – Supply Depot Maintenance Accounting and Production System Financial Inventory Accounting & Billing System Regionalization of Civilian Personnel Support Job Order Production Master System Fuels Automated Management System Sustainment - Air  Force Automated Budget Analysis/Centralized User System DFAS Corporate Database/DFAS Corporate Warehouse Defense Medical Logistics Standard Support Subsistence Total Order and Receipt Electronic System $9.8 (Continued From Previous Page)
section_title: Modernizations with Obligations in Excess of $1 Million Not Reviewed by DOD Comptroller per July 2004 Memorandum
paragraphs: Personnel Electronic Records Management System US MEPCOM Integrated Resource System US Army Accessions Command Integrated Automation  Architecture Target Location Design and Hand-Off System Electronic Military Personnel Record System Joint Engineer Data Management Information Control  System MSC Afloat Personnel Management Center Mounted Cooperative Target ID System Surface Warfare Management Information Systems Reliability and Maintainability Information System Air Force Military Personnel Data System Education and Training Technology Applications  Program Cadet Administrative Management Information System Air Force Recruiter Information Support System Programming Depot Maintenance Scheduling System 2.6 (Continued From Previous Page)
section_title: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Acknowledgments
paragraphs: Staff members who made key contributions to this report were Beatrice  Alff, Francine DelVecchio, Francis Dymond, Lauren Fassler, Kristi Karls,  Mai Nguyen, Philip Reiff, and Bernard Trescavage.