Information Technology: Implementation of Reform Legislation Needed to Improve Acquisitions and Operations
Published: 2015-11-04T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The federal government invests more than $80 billion annually in IT. However, these investments frequently fail, incur cost overruns and schedule slippages, or contribute little to mission-related outcomes. As GAO has previously reported, this underperformance of federal IT projects can be traced to a lack of disciplined and effective management and inadequate executive-level oversight. Accordingly, in December 2014, IT reform legislation was enacted, aimed at improving agencies' acquisition of IT. Further, earlier this year GAO added improving the management of IT acquisitions and operations to its high-risk list—a list of agencies and program areas that are high risk due to their vulnerabilities to fraud, waste, abuse, and mismanagement, or are most in need of transformation.
This statement provides information on FITARA and GAO's designation of IT acquisitions and operations as a high-risk area. In preparing this statement, GAO relied on its previously published work in these areas.
section_title: What GAO Found
paragraphs: The law commonly known as the Federal Information Technology Acquisition Reform Act (FITARA) was enacted in December 2014 and aims to improve federal information technology (IT) acquisition and operations. The law includes specific requirements related to seven areas. For example, it addresses
Agency Chief Information Officer (CIO) authority enhancements . Among other things, agency CIOs are required to approve the IT budget requests of their respective agencies and certify that IT investments are adequately implementing the Office of Management and Budget's (OMB) incremental development guidance.
Enhanced transparency and improved risk management . OMB and agencies are to make publicly available detailed information on federal IT investments, and agency CIOs are to categorize IT investments by risk. Additionally, if major IT investments are rated as high risk for 4 consecutive quarters, the agencies are to conduct a review of the investment.
Portfolio review. Agencies are to annually review IT investment portfolios in order to, among other things, increase efficiency and effectiveness, and identify potential waste and duplication. OMB is required to develop standardized performance metrics, to include cost savings, and to submit quarterly reports to Congress on cost savings.
Federal data center consolidation initiative. Agencies are required to provide OMB with a data center inventory, a strategy for consolidating and optimizing the data centers (to include planned cost savings), and quarterly updates on progress made. OMB is required to develop a goal of how much is to be saved through this initiative, and report on progress annually.
Maximizing the benefit of the federal strategic sourcing initiative . Federal agencies are required to compare their purchases of services and supplies to what is offered under the Federal Strategic Sourcing initiative.
OMB has released guidance for agencies to implement provisions of FITARA, which includes actions agencies are to take regarding responsibilities for CIOs. The guidance also reiterates OMB's existing guidance on IT portfolio management, a key transparency website, and the federal data center consolidation initiative; and expands its existing guidance on reviews of at-risk investments. Agencies were to conduct a self-assessment and submit a plan to OMB by August 2015 describing the changes they will make to ensure that responsibilities are implemented. Further, portions of these plans are required to be made publicly available 30 days after OMB's approval; as of October 30, 2015, none of the 24 Chief Financial Officers Act agencies had done so.
Further, FITARA's provisions are similar to areas covered by GAO's high-risk area to improve the management of IT acquisitions and operations. For example, GAO has noted that improvements are needed in federal efforts to enhance transparency, consolidate data centers, and streamline agencies' IT investment portfolios. To demonstrate progress in addressing this high-risk area, agencies will need to implement the legislation's provisions and GAO's outstanding recommendations.
section_title: What GAO Recommends
paragraphs: Over the last 6 years, GAO made about 800 recommendations to OMB and agencies to improve acquisition and operations of IT. As of October 2015, about 32 percent of these had been implemented. It will be critical for agencies to implement the remaining GAO recommendations and the requirements of FITARA to achieve improvements.
, Carol Cha at (202) 512-4456 or chac@gao.gov , or Valerie Melvin at (202) 512-6304 or melvinv@gao.gov .

section_title: Letter
paragraphs: I am pleased to be here today to discuss the recently enacted federal  information technology (IT) acquisition reform legislation (commonly  referred to as the Federal Information Technology Acquisition Reform Act  or FITARA) and our recent designation of IT acquisitions and operations  as a government-wide high-risk area. As you know, the effective and  efficient acquisition and management of IT investments has been a long- standing challenge in the federal government. In particular, the federal  government has spent billions of dollars on failed and poorly performing  IT investments, which often suffered from ineffective management,  moreover spending on IT operations has been inefficient. Over the last 6  fiscal years, we have made about 800 recommendations to address  weaknesses in agencies’ IT acquisitions and operations.
My statement today will discuss FITARA requirements and our  designation of IT acquisitions and operations as a high-risk area. We  based this work upon prior reports and updates from agencies regarding  our recommendations. A more detailed discussion of the objectives,  scope, and methodology of this work is included in each of the reports  that are cited throughout this statement. We conducted the work on  which this statement is based in accordance with generally accepted  government auditing standards. Those standards require that we plan  and perform the audit to obtain sufficient, appropriate evidence to provide  a reasonable basis for our findings and conclusions based on our audit  objectives. We believe that the evidence obtained provides a reasonable  basis for our findings and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: The federal government invests more than $80 billion annually in IT, but  many of these investments fail to meet cost and schedule expectations or  make significant contributions to mission-related outcomes. We have  previously testified that the federal government has spent billions of  dollars on failed IT investments, such as  the Department of Defense’s (DOD) Expeditionary Combat Support  System, which was canceled in December 2012, after spending more  than a billion dollars and failing to deploy within 5 years of initially  obligating funds;  the Department of Homeland Security’s Secure Border Initiative  Network program, which was ended in January 2011, after the  department obligated more than $1 billion to the program, because it  did not meet cost-effectiveness and viability standards;  the Department of Veterans Affairs’ (VA) Financial and Logistics  Integrated Technology Enterprise program, which was intended to be  delivered by 2014 at a total estimated cost of $609 million, but was  terminated in October 2011 due to challenges in managing the  program;  the Farm Service Agency’s Modernize and Innovate the Delivery of  Agricultural Systems program, which was to replace aging hardware  and software applications that process benefits to farmers, was halted  after investing about 10 years and at least $423 million, while only  delivering about 20 percent of the functionality that was originally  planned.  the Office of Personnel Management’s Retirement Systems  Modernization program, which was canceled in February 2011, after  spending approximately $231 million on the agency’s third attempt to  automate the processing of federal employee retirement claims;  the National Oceanic and Atmospheric Administration, DOD, and the  National Aeronautics and Space Administration’s National Polar- orbiting Operational Environmental Satellite System, which was a tri- agency weather satellite program that the White House Office of  Science and Technology stopped in February 2010 after the program  spent 16 years and almost $5 billion; and  the VA Scheduling Replacement Project, which was terminated in  September 2009 after spending an estimated $127 million over 9  years.
These and other failed IT projects often suffered from a lack of disciplined  and effective management, such as project planning, requirements  definition, and program oversight and governance. In many instances,  agencies had not consistently applied best practices that are critical to  successfully acquiring IT investments.
Federal IT projects have also failed due to a lack of oversight and  governance. Executive-level governance and oversight across the  government has often been ineffective, specifically from chief information  officers (CIO). For example, we have reported that not all CIOs had the  authority to review and approve the entire agency IT portfolio and that  CIOs’ authority was limited.
section_title: Recent Legislation Can Improve Agencies’ Management of IT
paragraphs: Recognizing the severity of issues related to government-wide  management of IT, in December 2014, Congress enacted IT reform  legislation, FITARA. The law holds promise for improving agencies’  acquisition of IT and enabling Congress to monitor agencies’ progress  and hold them accountable for reducing duplication and achieving cost  savings. FITARA includes specific requirements related to seven areas.
Agency CIO authority enhancements. Agency CIOs are required  to (1) approve the IT budget requests of their respective agencies, (2)  certify that IT investments are adequately implementing the Office of  Management and Budget’s (OMB) incremental development  guidance, (3) review and approve contracts for IT, and (4) approve the  appointment of other agency employees with the title of CIO.
Enhanced transparency and improved risk management. OMB  and agencies are to make publicly available detailed information on  federal IT investments, and agency CIOs are to categorize their IT  investments by risk. Additionally, in the case of major IT investments  rated as high risk for 4 consecutive quarters, the law requires that the  agency CIO and the investment’s program manager conduct a review  aimed at identifying and addressing the causes of the risk.
Portfolio review. Agencies are to annually review IT investment  portfolios in order to, among other things, increase efficiency and  effectiveness, and identify potential waste and duplication. In  developing the associated process, the law requires OMB to develop  standardized performance metrics, to include cost savings, and to  submit quarterly reports to Congress on cost savings.
Federal data center consolidation initiative (FDCCI). Agencies are  required to provide OMB with a data center inventory, a strategy for  consolidating and optimizing the data centers (to include planned cost  savings), and quarterly updates on progress made. The law also  requires OMB to develop a goal of how much is to be saved through  this initiative, and provide annual reports on cost savings achieved.
Expansion of training and use of IT cadres. Agencies are to update  their acquisition human capital plans to address supporting the timely  and effective acquisition of IT. In doing so, the law calls for agencies  to consider, among other things, establishing IT acquisition cadres or  developing agreements with other agencies that have such cadres.
Maximizing the benefit of the federal strategic sourcing initiative.  Federal agencies are required to compare their purchases of services  and supplies to what is offered under the Federal Strategic Sourcing  initiative. OMB is also required to issue related regulations.
Government-wide software purchasing program. The General  Services Administration is to develop a strategic sourcing initiative to  enhance government-wide acquisition and management of software.  In doing so, the law requires that, to the maximum extent practicable,  the General Services Administration should allow for the purchase of  a software license agreement that is available for use by all Executive  Branch agencies as a single user.
In addition, in June 2015, OMB released guidance describing how  agencies are to implement the law. OMB’s guidance states that it is  intended to, among other things: assist agencies in aligning their IT resources to statutory  requirements; establish government-wide IT management controls that will meet the  law’s requirements, while providing agencies with flexibility to adapt to  unique agency processes and requirements;  clarify the CIO’s role and strengthen the relationship between agency  CIOs and bureau CIOs; and  strengthen CIO accountability for IT cost, schedule, performance, and  security.
In this regard, the guidance reiterates OMB’s existing guidance on  PortfolioStat, the IT Dashboard, and the federal data center consolidation  initiative, and expands its existing guidance on TechStat sessions.
The guidance includes several actions agencies are to take to establish a  basic set of roles and responsibilities (referred to as the “common  baseline”) for CIOs and other senior agency officials that are needed to  implement the authorities described in the law. For example, agencies  were required to conduct a self-assessment and submit a plan describing  the changes they will make to ensure that common baseline  responsibilities are implemented. Agencies were to submit their plans to  OMB’s Office of E-Government and Information Technology by August  15, 2015, and make portions of the plans publicly available on agency  websites no later than 30 days after OMB approval. As of October 30,  2015, none of the 24 Chief Financial Officers Act agencies had made  their plans publicly available.
The guidance also noted that OMB will help support agency  implementation of the common baseline by, for example, requiring the  Federal CIO Council to, on quarterly basis, discuss topics related to the  implementation of the common baseline and to assist agencies by  sharing examples of agency governance processes and IT policies.  Further, by June 30, 2015, the President’s Management Council was to  select three members from the council to provide an update on  government-wide implementation of FITARA on a quarterly basis through  September 2016. However, as of October 28, 2015, OMB officials stated  that the President’s Management Council had not yet selected members  to provide these updates.
In addition, OMB recently issued a memorandum regarding commodity IT  acquisitions and noted that agencies buy and manage their IT in a  fragmented and inefficient manner which conflicts with the goals of  FITARA. Among other things, the memorandum directed agencies to  standardize laptop and desktop configurations for common requirements  and reduce the number of contracts for laptops and desktops by  consolidating purchasing. The memorandum notes that OMB intends for  agencies to implement standard configurations over time by using  approved contracts, with a government-wide goal of 75 percent of  agencies using approved contracts by fiscal year 2018. The  memorandum requires agencies to develop transition plans to achieve  this goal and submit them to OMB by February 28, 2016.
section_title: IT Acquisitions and Operations Recently Added as a GAO High-Risk Area
paragraphs: Our government-wide high-risk area Improving the Management of IT  Acquisitions and Operations highlights critical IT initiatives, four of which  align with provisions in FITARA: (1) an emphasis on incremental  development, (2) a key transparency initiative, (3) efforts to consolidate  data centers, and (4) efforts to streamline agencies’ portfolios of IT  investments. Our high-risk report notes that implementation of these  initiatives had been inconsistent, and more work remained to demonstrate  progress in achieving IT acquisition outcomes. Implementing the  provisions from the law, along with our outstanding recommendations, will  be necessary for agencies to demonstrate progress in addressing this  high-risk area.
OMB has emphasized the need to deliver investments in smaller parts, or  increments, in order to reduce investment risk, deliver capabilities more  quickly, and facilitate the adoption of emerging technologies. In 2010, it  called for agencies’ major investments to deliver functionality every 12  months and, since 2012, every 6 months. However, we recently reported  that less than half of selected investments at five major agencies planned  to deliver capabilities in 12-month cycles. Accordingly, we  recommended that OMB develop and issue clearer guidance on  incremental development and that selected agencies update and  implement their associated policies. Most agencies agreed with our  recommendations or had no comment.
In January 2010, the Federal CIO began leading TechStat sessions— face-to-face meetings to terminate or turn around IT investments that are  failing or are not producing results. These meetings involve OMB and  agency leadership and are intended to increase accountability and  improve performance. OMB reported that federal agencies achieved over  $3 billion in cost savings or avoidances as a result of these sessions in  2010. Subsequently, OMB empowered agency CIOs to hold their own  TechStat sessions within their respective agencies.
We have since reported that OMB and selected agencies held multiple  TechStats, but additional OMB oversight was needed to ensure that these  meetings were having the appropriate impact on underperforming  projects and that resulting cost savings were valid. We concluded that  until OMB and agencies develop plans to address these investments, the  investments would likely remain at risk. Among other things, we  recommended that OMB require agencies to address high-risk  investments. OMB generally agreed with this recommendation.
However, as of October 28, 2015, OMB has only conducted one TechStat  review in the last 2 years. In particular, between March 2013 and October  2015, OMB held one TechStat on the Department of State’s legacy  consular systems investment in July 2015. Moreover, OMB has not listed  any savings from TechStats in any of its required quarterly reporting to  Congress since June 2012.
To help the government achieve transparency while managing legacy  investments, in June 2009, OMB established a public website (referred to  as the IT Dashboard) that provides detailed information on major IT  investments at 27 federal agencies, including ratings of their performance  against cost and schedule targets. Among other things, agencies are to  submit ratings from their CIOs, which, according to OMB’s instructions,  should reflect the level of risk facing an investment relative to that  investment’s ability to accomplish its goals.
As of August 2015, according to the IT Dashboard, 163 of the federal  government’s 738 major IT investments—totaling $9.8 billion—were in  need of management attention (rated “yellow” to indicate the need for  attention or “red” to indicate significant concerns). (See fig. 1.)
Over the past several years, we have made over 20 recommendations to  help improve the accuracy and reliability of the information on the IT  Dashboard and to increase its availability. Most agencies agreed with  our recommendations or had no comment.
In addition to spending money on new IT development, agencies also  plan to spend a significant amount of their fiscal year 2016 IT budgets on  the operations and maintenance (O&M) of legacy (i.e., steady-state)  systems. From fiscal year 2010 to fiscal year 2016, this amount has  increased, while the amount invested in developing new systems has  decreased by about $7.1 billion. (See figure 2.) This raises concerns  about agencies’ ability to replace systems that are no longer cost- effective or that fail to meet user needs.
Of the more than $79 billion budgeted for federal IT in fiscal year 2016,  26 federal agencies plan to spend about $60 billion, more than three- quarters of the total budgeted, on the O&M of legacy investments. Figure  3 provides a visual summary of the relative cost of major and nonmajor  investments, both in development and O&M.
Given the size and magnitude of these investments, it is important that  agencies effectively manage the O&M of existing investments to ensure  that they (1) continue to meet agency needs, (2) deliver value, and (3) do  not unnecessarily duplicate or overlap with other investments. To  accomplish this, agencies are required by OMB to perform annual  operational analyses of these investments, which are intended to serve  as periodic examination of an investment’s performance against, among  other things, established cost, schedule, and performance goals.
However, we have reported that agencies were not consistently  performing such analyses and that billions of dollars in O&M investments  had not undergone needed analyses. Specifically, as detailed in our  November 2013 report, only 1 of the government’s 10 largest O&M  investments underwent an OMB-required operational analysis. We  recommended that operational analyses be completed on the remaining 9  investments. Most agencies generally agreed with our recommendations.
To improve the efficiency, performance, and environmental footprint of  federal data center activities, OMB established the federal data center  consolidation initiative in February 2010. In a series of reports, we found  that, while data center consolidation could potentially save the federal  government billions of dollars, weaknesses existed in the execution and  oversight of the initiative.
Most recently, we reported that, as of May 2014, agencies collectively  reported that they had a total of 9,658 data centers; as of May 2015,  they had closed 1,684 data centers and were planning to close an  additional 2,431—for a total of 4,115—by the end of September 2015.  We also noted that between fiscal years 2011 and 2017, agencies  reported planning a total of about $5.3 billion in cost savings and  avoidances due to the consolidation of federal data centers. In  correspondence subsequent to the publication of our report, DOD’s Office  of the CIO identified an additional $2.1 billion in savings to be realized  beyond fiscal year 2017, which increased the total savings across the  federal government to about $7.4 billion. Further, since our May 2014  report we received additional information from other agencies about their  actual 2014 cost savings and revised plans for future savings. This  information is shown in table 1, which provides a summary of agencies’  total data center cost savings and cost avoidances between fiscal years  2011 and 2017, as well as DOD cost savings and cost avoidances to be  realized beyond 2017.
However, in our September 2014 report, we noted that planned savings  may be understated because of difficulties agencies encountered when  calculating savings and communicating their estimates to OMB. We made  recommendations to ensure the initiative improves efficiency and  achieves cost savings. Most agencies agreed with our recommendations  or did not comment.
To better manage existing IT systems, OMB launched the PortfolioStat  initiative, which requires agencies to conduct an annual, agency-wide IT  portfolio review to, among other things, reduce commodity IT spending  and demonstrate how their IT investments align with the agency’s mission  and business functions. In November 2013, we reported that agencies  continued to identify duplicative spending as part of PortfolioStat and that  this initiative had the potential to save at least $5.8 billion through fiscal  year 2015; however, weaknesses existed in agencies’ implementation of  the initiative, such as limitations in the CIOs’ authority. We made more  than 60 recommendations to improve OMB’s and agencies’  implementation of PortfolioStat. OMB partially agreed with our  recommendations, and responses from 21 of the agencies varied, with  some agreeing and others not.
In April 2015, we reported that agencies decreased their planned  PortfolioStat savings to approximately $2 billion—a 68 percent reduction  from the amount they reported to us in 2013. Additionally, although  agencies also reported having achieved approximately $1.1 billion in  savings, inconsistencies in OMB’s and agencies’ reporting made it difficult  to reliably measure progress in achieving savings. Among other things,  we made recommendations to OMB aimed at improving the reporting of  achieved savings, with which it agreed.
We have also recently reported on two additional key areas of agency’s  IT spending portfolio: software licensing and mobile devices.
Regarding software licensing, we recently reported that better  management was needed to achieve significant savings government- wide. In particular, 22 of the 24 major agencies we reviewed did not  have comprehensive license policies, and only 2 had comprehensive  license inventories. We recommended that OMB issue needed  guidance to agencies and made more than 130 recommendations to  the agencies to improve their policies and practices for managing  software licenses. OMB disagreed with the need for guidance.  However, we believe that without such guidance, agencies will likely  continue to lack the visibility into what needs to be managed. Most  agencies generally agreed with the recommendations or had no  comments.
We have also reported that most of the 15 agencies in our mobile  devices review did not have an inventory of mobile devices and  associated services, and only 1 of the 15 agencies we reviewed had  documented procedures for monitoring spending. Accordingly, we  recommended that the agencies take actions to improve their  inventories and control processes and that OMB measure and report  progress in achieving cost savings. OMB and 14 of the agencies  generally agreed with the recommendations or had no comment. The  Department of Defense partially agreed, and we maintained that  actions were needed.
subsections: section_title: Actions Needed to Address High-Risk Area
paragraphs: In our February 2015 high-risk report, we identified actions that OMB and  the agencies need to take to make progress in this area. These include  implementing the recently enacted statutory requirements promoting IT  acquisition reform, as well as implementing our previous  recommendations, such as updating the public version of the IT  Dashboard throughout the year. As noted in that report, we have made  multiple recommendations to improve agencies’ management of their IT  acquisitions, many of which have been discussed in this statement. In the  last 6 years we made approximately 800 recommendations to multiple  agencies. As of October 2015, about 32 percent of these  recommendations had been implemented.
Also in our high-risk report, we stated that OMB and agencies will need to  demonstrate measurable government-wide progress in the following key  areas:  implement at least 80 percent of GAO’s recommendations related to  the management of IT acquisitions and operations within 4 years. ensure that a minimum of 80 percent of the government’s major  acquisitions deliver functionality every 12 months. achieve no less than 80 percent of the planned PortfolioStat savings  and 80 percent of the planned savings planned for data center  consolidation.
In conclusion, with the recent passage of IT reform legislation, the federal  government has an opportunity to improve the transparency and  management of IT acquisition and operations, and strengthen the  authority of CIOs to provide needed direction and oversight. Further, by  identifying the management of IT acquisitions and operations as a new  government-wide high-risk area we are bringing necessary attention to  several critical IT initiatives in need of additional congressional oversight.  OMB and federal agencies should expeditiously implement the  requirements of the legislation and continue to implement our previous  recommendations. To help ensure that these improvements are achieved,  continued congressional oversight of OMB’s and agencies’  implementation efforts is essential.
Chairmen Meadows and Hurd, Ranking Members Connolly and Kelly,  and Members of the Subcommittees, this completes my prepared  statement. I would be pleased to respond to any questions that you may  have at this time.
section_title: GAO Contacts and Staff Acknowledgments
paragraphs: For additional information about this high-risk area, contact David A.  Powner at (202) 512-9286 or pownerd@gao.gov, Carol Cha at (202) 512- 4456 or chac@gao.gov, or Valerie Melvin at (202) 512-6304 or  melvinv@gao.gov. Individuals who made key contributions to this  testimony are Kevin Walsh (Assistant Director), Chris Businsky, Rebecca  Eyler, Kaelin Kuhn, and Jessica Waselkow.
section_title: Related GAO Products
paragraphs: Telecommunications: Agencies Need Better Controls to Achieve  Significant Savings on Mobile Devices and Services. GAO-15-431. May  21, 2015.
Information Technology: Additional OMB and Agency Actions Needed to  Ensure Portfolio Savings Are Realized and Effectively Tracked.  GAO-15-296. April 16, 2015.
Federal Chief Information Officers: Reporting to OMB Can Be Improved  by Further Streamlining and Better Focusing on Priorities. GAO-15-106.  April 2, 2015.
High-Risk Series: An Update. GAO-15-290. February 11, 2015.
Data Center Consolidation: Reporting Can be Improved to Reflect  Substantial Planned Savings. GAO-14-713. September 25, 2014.
Federal Software Licenses: Better Management Needed to Achieve  Significant Savings Government-Wide. GAO-14-413. May 22, 2014.
Information Technology: Agencies Need to Establish and Implement  Incremental Development Policies. GAO-14-361. May 1, 2014.
IT Dashboard: Agencies Are Managing Investment Risk, but Related  Ratings Need to Be More Accurate and Available. GAO-14-64. December  12, 2013.
Information Technology: Agencies Need to Strengthen Oversight of  Multibillion Dollar Investments in Operations and Maintenance.  GAO-14-66. November 6, 2013.
Information Technology: Additional OMB and Agency Actions Are Needed  to Achieve Portfolio Savings. GAO-14-65. November 6, 2013.
Information Technology: Additional Executive Review Sessions Needed  to Address Troubled Projects. GAO-13-524. June 13, 2013.
Information Technology: Agencies Need to Strengthen Oversight of  Billions of Dollars in Operations and Maintenance Investments.  GAO-13-87. October 16, 2012.
IT Dashboard: Accuracy Has Improved, and Additional Efforts Are Under  Way to Better Inform Decision Making. GAO-12-210. November 7, 2011.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.