Business Systems Modernization: Internal Revenue Service Needs to Further Strengthen Program Management
Published: 2004-02-12T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Internal Revenue Service (IRS) has been grappling with modernizing its computer systems for many years. IRS's current program, commonly referred to as Business Systems Modernization (BSM), began in fiscal year 1999; about $1.4 billion has been reported spent on it to date. While progress has been made, the program continues to face significant challenges and risks. In recognition of these risks, IRS and a contractor recently completed several comprehensive assessments of BSM, including one of its Customer Account Data Engine (CADE) project, which is to modernize the agency's outdated data management system. At the request of the Subcommittee on Oversight, House Committee on Ways and Means, GAO's testimony will summarize (1) GAO's prior findings and recommendations, along with those of the recent assessments; and (2) actions IRS has taken or plans to take to address these issues.
section_title: What GAO Found
paragraphs: Prior GAO reviews have disclosed numerous modernization management control deficiencies that have contributed to reported cost overruns and schedule delays. Costs and completion dates for ongoing projects have grown from their initial estimates. Reasons for such delays include inadequate definition of systems requirements, increases in project scope, and underestimation of project complexity. These impair IRS's ability to make future systems investment decisions and delay delivery of benefits to taxpayers.
section_title: What GAO Recommends
paragraphs: GAO has made a series of recommendations focusing on stronger program management--and limiting modernization activities until such management practices were in place. IRS has made important progress in implementing management controls, establishing infrastructure, delivering certain business applications, and balancing the pace of the program with the agency's ability to manage it. Nevertheless, IRS needs to further strengthen BSM program management, including fully implementing modernization management controls in such areas as cost and schedule estimating. The recent BSM assessments identified many weaknesses, consistent with prior GAO findings, that contributed to the cost overruns and schedule delays, and offered recommendations to address them. IRS has responded by identifying 46 discrete issues to be resolved; according to the agency, 27 of these have been completed. Commitment of appropriate resources, top management attention, and continuing oversight by Congress and others are critical to the success of BSM.

section_title: Letter
paragraphs: I am pleased to be here today to discuss the Internal Revenue Service’s  (IRS) actions to modernize its computer systems. Although updated  through the years, IRS’s set of computer systems is based on an  architecture that dates from the 1960s. This architecture has inhibited  IRS’s ability to effectively and efficiently perform its mission of providing  service to taxpayers and enforcing the nation’s tax laws. However, IRS’s  attempts to modernize its computer systems and underlying architecture  now span three decades. Given the long history of continuing delays and  design difficulties, we previously designated IRS’s modernization program  as a high-risk area in 1995. It remains so today.
IRS’s current multibillion-dollar effort, known as the Business Systems  Modernization (BSM) program, was initiated in fiscal year 1999. IRS  contracted with Computer Sciences Corporation (CSC) as the prime  contractor to assist with designing, developing, and integrating a new set  of information systems that were intended to replace IRS’s aging business  and tax processing systems. To date, about $1.7 billion has been  appropriated for the program, including about $388 million for fiscal year  2004.
To facilitate congressional oversight of this program, annual  appropriations laws since fiscal year 1998 have mandated that  modernization funds not be available until IRS submits to the  congressional appropriations committees for approval a modernization  expenditure plan that satisfies six legislative conditions, including that it  be reviewed by us. We are currently reviewing the fiscal year 2004 BSM  expenditure plan. During our past reviews of such plans, we have noted  numerous modernization management control deficiencies and made  recommendations to correct them. Although IRS has made progress in  implementing our recommendations, BSM continues to face significant  challenges and serious risks. Recognizing these risks, IRS and CSC  recently completed several in-depth and more comprehensive assessments  on the health of the BSM program, including an independent technical  assessment of the Customer Account Data Engine (CADE) project, a  project critical to the success of BSM. IRS has developed an action plan to  address the assessments’ recommendations, and has begun to act on it.
In my testimony today I will summarize our prior findings and  recommendations and those of the recently completed program  assessments. I will also discuss the actions IRS reports it has taken or  plans to take to address issues raised by these assessments.
In preparing this testimony, we relied on our prior reports and testimony  on IRS’s systems modernization activities and BSM expenditure plans. We  also reviewed and analyzed information contained in the BSM expenditure  plan for fiscal year 2004; Carnegie Mellon University Software Engineering  Institute’s (SEI) independent technical assessment of CADE; reports on  the BSM program by the Treasury Inspector General for Tax  Administration and the IRS Oversight Board; and IRS briefing materials (1)  analyzing the root causes of BSM project cost increases and schedule  delays, (2) independent reviews of CSC’s business processes and IRS’s  procurement practices, and (3) IRS’s action plan to address issues  identified by the reviews. We did not independently validate planned  projects’ cost estimates or confirm, through system and project  management documentation, the validity of IRS-provided information on  the projects’ content and progress. Our work was performed during the  past month, in accordance with generally accepted government auditing  standards.
subsections: section_title: Background
paragraphs: The tax administration system that collects about $2 trillion in revenues  each year is critically dependent on a collection of obsolete computer  systems developed by the IRS over the last 40 years. IRS envisions a future  in which its tax processing environment will be virtually paper-free, and  up-to-date taxpayer information will be readily available to IRS employees  to respond to taxpayer inquiries. To accomplish this, IRS embarked on its  ambitious BSM program. BSM involves the development and delivery of a  number of modernized business, data, and core infrastructure projects  that are intended to provide improved and expanded service to taxpayers  as well as IRS internal business efficiencies. Recognizing the long-term  commitment needed to solve the problem of obsolete computer systems,  Congress set up a special BSM account in fiscal year 1998 to fund IRS’s  systems modernization efforts.
IRS initiated CADE as part of BSM, to modernize the agency’s outdated  and inefficient data management system. IRS also sees this project as the  corporate data source enabling future customer service and financial  management applications. CADE is therefore IRS’s linchpin modernization  project. In light of the projects that depend on CADE, as well as the many  interrelationships that are to exist among CADE and IRS’s modernized  applications and among CADE and current IRS applications, the agency  must manage this critical project effectively. Without CADE, the business  systems modernization program cannot succeed.
section_title: IRS Has Made Improvements, But Systems Modernization Program Remains High-Risk
paragraphs: IRS’s attempts to modernize its aging computer systems span several  decades. This long history of continuing delays and design difficulties led  to our designating IRS’s Tax Systems Modernization program, BSM’s  predecessor, as a high-risk area in 1995. During the mid-1990s we reported  on several technical and management weaknesses associated with Tax  Systems Modernization, a program that began in the 1980s. These  weaknesses related to incomplete or inadequate strategic information  management practices; immature software development capability;  incomplete systems architecture, integration planning, system testing, and  test planning practices; and the lack of an effective organizational  structure to consistently manage and control systems modernization  organizationwide. We made a series of recommendations for correcting  these weaknesses and limiting modernization activities until they were  corrected. IRS subsequently discontinued the program after the agency  had spent about $4 billion without receiving expected benefits. In fiscal  year 1999, IRS launched the BSM program. IRS contracted with CSC as its  prime systems integration services contractor for systems modernization,  helping it design new systems and identify other contractors to develop  software and perform other tasks.
In our reviews of IRS’s BSM expenditure plans, we have identified  numerous deficiencies in the BSM program, including a continuation of  the weaknesses noted above. Also, a consistent challenge for IRS has been  to make sure that the pace of systems acquisition projects does not exceed  the agency’s ability to manage them. In May and November 2000, we  reported that projects were in fact getting ahead of the modernization  management capacity that needed to be in place to manage them  effectively. In February 2002 we reported that such an imbalance was due  to IRS’s first priority and emphasis being on getting the newer, more  modern systems—with their anticipated benefits to taxpayers—up and  running. In so doing, however, management controls had not been given  equal attention and thus had not kept pace. This emphasis on new systems  added significant cost, schedule, and performance risks that escalate as a  program advances. Moreover, these risks increased as IRS moved forward  because of interdependencies among projects, and the complexity of  associated workload activities to be performed increased dramatically as  more systems projects were built and deployed.
In addition, we identified other deficiencies in the BSM program, including  the need to establish processes that meet the level 2 requirements of the  SEI’s Software Acquisition Capability Maturity Model, and to improve  modernization management controls and capabilities, such as those  related to configuration management, risk management, enterprise  architecture implementation, human capital strategic management,  integrated program scheduling, and cost and schedule estimating.
In response to our recommendations, IRS has made important progress.  First, significant progress has been made in establishing the modernization  management controls needed to effectively acquire and implement  information technology systems. For example, IRS has  invested incrementally in its modernization projects;    defined a systems life cycle management methodology, which IRS  refers to as the Enterprise Life Cycle;   developed and is using a modernization blueprint, commonly called an  enterprise architecture, to guide and constrain its modernization  projects; and   established processes that meet the level 2 requirements of the SEI’s  Software Acquisition Capability Maturity Model.
Second, IRS has made progress in establishing the infrastructure systems  on which future business applications will run. For example, IRS has  delivered elements of the Security and Technology Infrastructure Release  to provide the hardware, software, and security solutions for  modernization projects. IRS has also built an enterprise integration and  test environment that provides the environment and tools for multiple  vendors associated with a release to perform integration and testing  activities.
Third, it has delivered certain business applications that are producing  benefits today. These applications include    Customer Communications 2001, to improve telephone call  management, call routing, and customer self-service applications;   Customer Relationship Management Examination, to provide off-the- shelf software to IRS revenue agents to allow them to accurately  compute complex corporate transactions; and Internet Refund/Fact of Filing, to improve customer self-service by  providing to taxpayers via the Internet instant refund status  information and instructions for resolving refund problems.
Fourth, IRS took steps to align the pace of the program with the maturity  of IRS’s controls and management capacity, including reassessing its  portfolio of planned projects.
Nevertheless, IRS continued to face challenges to fully develop and  implement its modernization management capacity. Last June we reported  that IRS had not yet fully implemented a strategic approach to ensuring  that it has sufficient human capital resources for implementing BSM, nor  had it fully implemented management controls in such areas as  configuration management, estimating costs and schedules, and employing  performance-based contracting methods. We made several  recommendations to address those issues. Our analysis has shown that  weak management controls contributed directly to the cost, schedule,  and/or performance shortfalls experienced by most projects. Given that  the tasks associated with those projects that are moving beyond design  and into development are by their nature more complex and risky and that  IRS’s fiscal year 2004 BSM expenditure plan supports progress toward the  later phases of key projects and continued development of other projects,  systems modernization projects likely will encounter additional cost and  schedule shortfalls. IRS will need to continue to assess the balance  between the pace of the program and the agency’s ability to manage it.
section_title: Projects Continue to Incur Cost Increases and Schedule Delays
paragraphs: Based on IRS’s expenditure plans, BSM projects have consistently cost  more and taken longer to complete than originally estimated. Table 1  shows the life cycle variance in cost and schedule estimates for completed  and ongoing BSM projects. These variances are based on a comparison of  IRS’s initial and revised cost and schedule estimates to complete initial  operation or full deployment of the projects.
As the table indicates, the cost and schedule estimates for full deployment  of the e-Services project have increased by just over $86 million and 18  months, respectively. In addition, the estimated cost for the full  deployment of CADE release 1 has increased by almost $37 million, and  project completion has been delayed by 30 months. In addition to the  modernization management control deficiencies discussed above, our  work has shown that the increases and delays were caused, in part, by  inadequate definitions of systems requirements. As a result,  additional requirements have been incorporated into ongoing projects.  increases in project scope. For example, the e-Services project has  changed significantly since the original design. The scope was  broadened by IRS to provide additional benefits to internal and  external customers.   cost and schedule estimating deficiencies. IRS has lacked the  capability to effectively develop reliable cost and schedule estimates.   underestimating project complexity. This factor has contributed  directly to the significant delays in the CADE release 1 schedule.   competing demands of projects for test facilities. Testing  infrastructure capacity is insufficient to accommodate multiple  projects when testing schedules overlap.   project interdependencies. Delays with one project have had a  cascading effect and have caused delays in related projects.
These schedule delays and cost overruns impair IRS’s ability to make  appropriate decisions about investing in new projects, delay delivery of  benefits to taxpayers, and postpone resolution of material weaknesses  affecting other program areas.
Producing reliable estimates of expected costs and schedules is essential  to determining a project’s cost-effectiveness. In addition, it is critical for  budgeting, management, and oversight. Without this information, the  likelihood of poor investment decisions is increased.
Schedule slippages delay the provision of modernized systems’ direct  benefits to the public. For example, slippages in CADE will delay IRS’s  ability to provide faster refunds and respond to taxpayer inquiries on a  timely basis.
Delays in the delivery of modernized systems also affect the remediation  of material internal management weaknesses. For example, IRS has  reported a material weakness associated with the design of the master  files. CADE is to build the modernized database foundation that will  replace the master files. Continuing schedule delays will place resolution  of this material weakness further out into the future. In addition, the  Custodial Accounting Project is intended to address a financial material  weakness and permit the tracking from submission to disbursement of all  revenues received from individual taxpayers. This release has yet to be  implemented, and a revised schedule has not yet been determined. Finally,  the Integrated Financial System is intended to address financial  management weaknesses. When IRS submitted its fiscal year 2003 BSM  expenditure plan, release 1 of the Integrated Financial System was  scheduled for delivery on October 1, 2003. However, it has yet to be  implemented, and additional cost increases are expected.
section_title: Internal and Independent Assessments of BSM Have Identified Significant Weaknesses and Risks
paragraphs: Given the continued cost overruns and schedule delays experienced by  these BSM projects, IRS and CSC launched internal and independent  assessments during 2003 of the health of BSM as whole, as well as CADE.  Table 2 describes these assessments.
The IRS root cause analysis, PRIME review, and the Office of Procurement  assessment revealed several significant weaknesses that have driven  project cost overruns and schedule delays, and also provided a number of  actionable recommendations for IRS and CSC to address the identified  weaknesses and reduce the risk to BSM. Deficiencies identified are  consistent with our prior findings and include  low program productivity levels, ineffective integration across IRS, and insufficient applications and technology engineering.
As noted, CADE release 1 has experienced significant reported cost  overruns and schedule delays throughout its life cycle, and has yet to be  delivered. SEI’s independent technical assessment of CADE pointed to  four primary factors that have caused the project to get off track and  resulted in such severe cost and schedule impairments: (1) the complexity  of CADE release 1 was not fully understood; (2) the initial business rules  engine effort stalled; (3) both IRS and PRIME technical and program  management were ineffective in key areas, including significant  breakdowns in developing and managing CADE requirements; and (4) the  initially contentious relationship between IRS and PRIME hindered  communications. SEI also warned that CADE runs the risk of further  trouble with later releases due to unexplored/unknown requirements;  security and privacy issues that have not been properly evaluated (e.g.,  online transactions are different from the way IRS does business today);  dependence on an unproven business rules engine software product; and  the critical, expensive, and lengthy business rules harvesting effort that  has not yet been started. SEI offered several recommendations to address  current CADE issues and reduce project risk in the future.
section_title: IRS Is Acting to Resolve Issues Identified in the BSM Assessments
paragraphs: Based on these assessments, IRS identified a total of 46 specific issues for  resolution in the following six areas, and developed a BSM action plan  comprising individual action plans to address each issue:    Organization and Roles. Immediate steps are needed to clarify  IRS/PRIME roles and responsibilities and clearly define decision- making authorities.
Key Skills & Strengthening the Team. Strengthened skills and  capabilities are needed in such key areas as project management and  systems engineering.
Technology–Architecture & Engineering. More focus is needed to  improve current systems architecture integration.
Technology–Software Development Productivity & Quality.
Improvements in product quality and productivity are essential to  strengthening software delivery performance.
Acquisition. Contracting and procurement practices require major  streamlining to improve overall contract management.
CADE. Delivery of CADE release 1 will require aggressive focus and  attention, and a business rules engine solution requires additional  evaluation.
These 46 issue action plans were assigned completion dates and an IRS or  PRIME owner was assigned to take the lead in implementing each plan.  IRS and PRIME each also assigned a senior-level executive to drive the  execution of the issue action plans, identify and help mitigate  implementation hindrances or roadblocks, and ensure successful  completion of all planned actions. To assess the efficacy of the BSM action  plan, MITRE was tasked with conducting an independent analysis and  provided feedback to IRS on the effectiveness of the specific issue action  plans to address the associated findings/recommendations and correct any  problems found.
IRS has reported making steady progress with implementing the BSM  action plan. According to the IRS BSM program office, as of late January  2004, 27 of the 46 issue action plans have been completed. Examples of  completed actions include (1) making business owners and program  directors accountable for project success; (2) assigning teams to  investigate and resolve problem areas on key projects such as CADE, the  Integrated Financial System, and e-Services; (3) aligning critical  engineering talent to the most critical projects; (4) increasing the  frequency of CADE program reviews; and (5) issuing a firm fixed-price  contracting policy.
Significant further work remains to complete implementation of the  remaining 19 open issue action tasks. Bain & Company—which conducted  the independent review of PRIME—has been hired to facilitate the  implementation of various issue action plans within the Organization and  Roles challenge area, while IRS has also contracted with SEI to conduct  further periodic reviews of the CADE project.
Additionally, the IRS Oversight Board recently issued a report on its own  independent analysis of the BSM program, which made several  observations and recommendations that are consistent with those  discussed here. IRS has conducted an analysis of this report to reconcile  the board’s recommendations with those that are currently being  addressed in the BSM action plan. As a result, IRS plans to open two  additional issues and action plans to address (1) rationalizing and  streamlining oversight of the BSM program, and (2) determining and  maintaining a manageable portfolio of projects. IRS expects to complete  the majority of the BSM action plan by end of April of this year, and fully  implement any remaining open actions by the end of the calendar year.
Further, during 2003, the Treasury Inspector General for Tax  Administration performed several reviews related to management of the  BSM program and for specific BSM projects. These reviews identified  several issues, including those related to compliance with the defined  management and project development processes, full implementation of  disciplined project testing processes and procedures, IRS’s cost and  schedule estimation process, and contract management. IRS management  reaffirmed their commitment to fully implement key management and  project development processes.
section_title: Concluding Observations
paragraphs: IRS’s multibillion-dollar BSM program is critical to agency’s successful  transformation of its manual, paper-intensive business operations and  fulfilling its restructuring activities. The agency has made important  progress in establishing long-overdue modernization management  capabilities and in acquiring foundational system infrastructure and some  applications that have benefited the agency and the public. However, our  reviews, those of the Treasury inspector general, and the recently  completed internal and independent assessments of the BSM program  clearly demonstrate that significant challenges and serious risks remain.  IRS acknowledges this and is acting to address them.
To successfully address these challenges and risks and to modernize its  systems, IRS needs to continue to strengthen BSM program management  by continuing efforts to    balance the scope and pace of the program with the agency’s capacity  to handle the workload, and institutionalize the management processes and controls necessary to  resolve the deficiencies identified by the reviews and assessments.
Commitment of appropriate resources and top management attention are  critical to resolving the identified deficiencies. In addition, continuing  oversight by the Congress, OMB, and others, as well as ongoing  independent assessments of the program, can assist IRS in strengthening  the BSM program.
Meeting these challenges and improving performance are essential if IRS  and the PRIME contractor are to successfully deliver the BSM program  and ensure that BSM does not suffer the same fate as previous IRS  modernization efforts.
Mr. Chairman, this concludes my statement. I would be pleased to respond  to any questions that you or other members of the subcommittee may have  at this time.
section_title: Contacts and Acknowledgments
paragraphs: For information about this testimony, please contact me at (202) 512-3317  or by e-mail at daceyr@gao.gov. Individuals making key contributions to  this testimony include Bernard R. Anderson, Michael P. Fruitman, Timothy  D. Hopkins, and Gregory C. Wilshusen.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. It may be reproduced and distributed in its entirety without further  permission from GAO. However, because this work may contain copyrighted images or  other material, permission from the copyright holder may be necessary if you wish to  reproduce this material separately.