HUD Information Technology: More Work Remains to Implement Necessary Management Controls
Published: 2012-03-29T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Department of Housing and Urban Development (HUD) performs a range of significant home ownership and community development missions that are integral to the U.S. economy. In doing so, HUD relies extensively on information technology (IT). However, HUDs IT environment has not effectively supported its business operations, and as a result, the department has been working to modernize its IT infrastructure. To provide oversight and inform decision-making, Congress required that HUD develop and submit plans describing how it intends to use its expenditures to support its modernization efforts. In addition, Congress required GAO to review these expenditure plans to determine if they meet statutory conditions.
GAO was asked to testify on HUDs progress in implementing its prior recommendations on (1) modernizing its IT systems and (2) improving its expenditure plans. In preparing this statement, GAO relied on previous work at HUD.
section_title: What GAO Found
paragraphs: HUD has made progress in implementing prior GAO recommendations on modernizing its IT environment; however more actions are needed. In 2009, GAO reported that HUD lacked key IT management controls; which are essential to achieving successful outcomes. Specifically,
Although the department had established an IT strategic plan that outlined goals and performance measures, it had not assessed its performance against established goals. As a result, HUD did not know how well it was achieving its goals and where it needed to improve.
While the department had established policies and procedures for developing a complete portfolio of its investments, it had not established policies and procedures for evaluating that portfolio. This meant that it was limited in its ability to control risks and achieve benefits associated with the mix of legacy systems and modernization investments it selected.
HUDs Office of the Chief Information Officer had not adequately assessed its IT workforce needs, inventoried existing staff knowledge and skills, and identified gaps between needs and existing capabilities. As a result, the department was not well positioned to acquire the skill sets it needed.
The department had not fully developed its enterprise architecture (EA)which provides a blueprint for investing that connects strategic plans with individual programs and system solutions. This meant that HUD lacked a sufficient basis for guiding and directing its modernization projects.
GAO made a number of recommendations to HUD aimed at strengthening its management capabilities, and while progress has been made in addressing them, work remains. For example, HUD issued a department-wide strategic plan with associated goals that aligned with new IT strategic goals. However, the department had not developed criteria for assessing the performance of its portfolios, finalized its plan to address its IT workforce needs, or established an approved policy for its enterprise architecture.
HUDs modernization expenditure plans, which are to describe how the agency plans to spend IT modernization funding, have improved in response to GAOs recommendations. These plans are to meet statutory conditions that include identifying, for each modernization project, capabilities to be delivered, expected benefits, estimated costs, and key milestones; and showing that each project is supported by adequate staff, conforms to capital planning and investment control requirements, complies with the departments EA, and is being managed in accordance with department lifecycle management policies. GAO found that HUDs 2010 expenditure plan contained weaknesses and thus was limited as a congressional oversight and decision-making mechanism. Accordingly, GAO recommended, among other things, that the department ensure future plans satisfied each element of the statutory conditions. In response, subsequent expenditure plans submitted in 2011 and 2012 satisfied the conditions. As a result, these more recent plans have provided key information needed for continued oversight of the modernization projects.
section_title: What GAO Recommends
paragraphs: GAO is not making new recommendations. As noted, GAO has previously made recommendations aimed at assisting HUD in fully implementing key IT management controls.

section_title: Letter
paragraphs: I am pleased to participate in today’s hearing to discuss the Department  of Housing and Urban Development’s (HUD) management challenges.  HUD performs a range of significant home ownership and community  development missions that are integral to our nation’s economic well- being, and it relies extensively on information technology (IT) to carry out  these missions. Moreover, legislation enacted since 2008 to stimulate the  economy, in part through strengthening the housing market, has  continued to expand the department’s responsibilities and thus its need  for IT support. For example, the department’s increased responsibilities  under the Housing and Economic Recovery Act of 2008 introduced  greater processing requirements for Federal Housing Administration  (FHA) mortgage insurance programs, which further increased its reliance  on information systems and other IT services.
Nevertheless, HUD has long experienced shortcomings in its IT  capability. As we reported in 2009, the department’s IT environment did  not effectively support its business operations.operating plans and budget submissions indicated, for example, that its  information systems were overlapping and duplicative, were not  integrated, necessitated manual workloads, and employed antiquated  technologies that were costly to maintain. Since our report, the  department has been working to modernize its IT infrastructure.
To provide oversight and inform decision-making, Congress established  limitations on funding for HUD’s IT modernization efforts through  appropriations acts in fiscal years 2010 and 2011. In addition, these acts required us to review and provide an assessment of HUD’s IT  modernization expenditure plans. To this end, we issued two reports—in  November 2010 and September 2011—that documented the results of  our fiscal year 2010 expenditure plan review. Further, earlier this week,  we briefed the Committees’ staff on a just-completed third review which  examined the department’s fiscal year 2011 expenditure plan.
At your request, my testimony today summarizes HUD’s progress in  implementing our prior recommendations on (1) modernizing its IT  systems and (2) improving its expenditure plans.
The information in my testimony is based on our previous reports on  HUD. All work on which this testimony is based was conducted in  accordance with generally accepted government auditing standards.
subsections: section_title: Background
paragraphs: HUD’s mission to create strong, sustainable, and inclusive communities  and quality and affordable homes for all has significantly evolved due to  the current economic and housing crisis. Accordingly, the department has  increased its reliance on IT. In particular, legislation enacted over the past  several years has given the department new responsibilities for, among  other things, strengthening the housing market. For example, the Housing  and Economic Recovery Act of 2008 established a program intended to  help families avoid home foreclosure by refinancing them into mortgages  insured by FHA. As a result, the number of mortgage loans insured by  FHA more than tripled between 2006 and 2010, from almost half a million  loans to 1.7 million loans. This in turn resulted in the need for much  greater system processing capabilities to accommodate the increased  demand.
IT plays a critical role in the department’s ability to carry out its growing  mission by supporting data collection and dissemination throughout the  department and to external parties. For instance, the department reports  that its business areas rely on IT to process over 50,000 loan requests  per week, over 12,000 service calls per month, and more than 7,000  grant requests annually for each of its major grant programs.
subsections: section_title: HUD’s IT Environment
paragraphs: Despite its growing mission, HUD’s IT environment has not effectively  supported its business operations. In 2009, we reported that the  department’s IT had consisted of: over 200 information systems, many of which performed the same manual processing for key business processes; and functions and, thus, were duplicative;  stove-piped, nonintegrated systems that could not share related data;  systems that were nearly 15 years old (on average), including several  different operating systems and using 35 different programming  languages.
A factor that had contributed to the state of HUD’s IT environment was  the department’s focus, primarily, on the maintenance of its existing  systems and infrastructure, rather than on the modernization needed to  meet its expanding mission needs. For example, in fiscal year 2008,  about 2 percent of the department’s IT obligations were for new  development, whereas the remaining 98 percent were obligated for  operating and maintaining legacy systems.
HUD’s Office of the Chief Information Officer (OCIO) is responsible for  supporting the department’s programs, services, and management  processes by providing IT solutions and services. Additionally, the OCIO  is responsible for developing, modernizing, and enhancing the IT  environment. To this end, in 2010, the OCIO established four  management goals, which aligned with the department’s 2010-2015  Strategic Plan: (1) enhance the quality, availability, and delivery of HUD  information to citizens, business partners, and government; (2) promote  an enterprise approach to IT that will foster innovation and collaboration;  (3) achieve excellence in IT management practice; and (4) transform the  OCIO to a culture of operational excellence that can achieve current and  future departmental goals.
To assist HUD in its modernization efforts, Congress has authorized and  appropriated funding for the department in multiple statutes. For example,  in recognizing the need to modernize the department’s IT environment,  the Housing and Economic Recovery Act of 2008 authorized $25 million  for each fiscal year, from 2009 through 2013, for improvements to FHA’s  IT, among other things. In addition, according to department officials,  HUD used approximately $1.5 million of the funding provided in the  American Recovery and Reinvestment Act of 2009 for improving IT  capabilities across a range of programs. More recently, the appropriations  acts for fiscal years 2010 and 2011 made available to HUD for  expenditure $180 million and $71 million, respectively, for IT  modernization to support its Transformation Initiative.
section_title: Progress Has Been Made in Implementing Recommendations on HUD’s IT Modernization, but More Work Remains
paragraphs: While HUD has been working to modernize its IT systems, we reported in  2009 that the department lacked sound management controls that are  essential to achieving successful outcomes. These controls included IT  strategic planning, investment management, enterprise architecture, and  human capital planning. We recommended that the department make  improvements in these areas, and while it has taken a number of  important steps, additional actions are still needed by the department to  respond to remaining concerns.
Strategic planning and performance management: Effective IT  strategic planning and performance management are intended to  ensure that an organization’s IT strategic goals are aligned with its  overall mission goals and outcomes and that these goals are  supported by clearly defined (1) activities aimed at accomplishing the  goals and (2) measures for determining performance in accomplishing  the activities and goals.
In 2009, we found that although HUD had established an IT strategic  plan that outlined goals and performance measures, it had not  assessed its IT performance against established goals since fiscal  year 2007. By not regularly assessing and reporting progress against  its strategic IT performance measures and activities, HUD did not  know how well it was achieving its strategic goals and where it  needed to improve. We recommended that HUD establish a plan for  developing and implementing the department’s performance  management framework, including an implementation schedule of key  activities and related resource needs, and ensure that this plan  provides for annually reporting progress in achieving IT strategic  goals.
In September 2011, we reported that HUD had fully implemented this  recommendation by issuing a new department-wide strategic plan  with associated goals that aligned with new IT strategic goals that the  OCIO developed.
IT investment management: Investment management is aimed at  selecting, controlling, and evaluating IT investments in a manner that  better ensures that they produce business value, reduce investment- related risks, and increase accountability and transparency in the  investment decision-making process. As we have previously reported,  moving away from project-centric investment management and  toward a portfolio-based approach, is considered a best practice. By  managing investments as a portfolio, an organization can consider  new investment proposals, along with previously funded investments,  and identify the appropriate mix and synergies of these investments to  best meet mission needs, technology needs, and priorities for  improvement.
In 2009, we reported that while HUD had established a range of  policies and procedures for developing a complete investment  portfolio, it had not established policies and procedures for evaluating  the portfolio.evaluating the performance of its portfolios, HUD was limited in its  ability to control the risks and achieve the benefits associated with the  mix of legacy system and modernization investments selected.  Accordingly, we recommended that HUD develop a plan for instituting  policies and procedures for reviewing, evaluating, and improving the  performance of the department’s portfolio of investments; developing  criteria for assessing portfolio performance and reviewing and   Without having defined and implemented practices for  modifying them at regular intervals; defining and collecting IT portfolio  performance measurement data consistent with the portfolio  performance criteria; and executing adjustments to the IT investment  portfolio in reaction to actual portfolio performance.
In September 2011, we reported that, in response to our  recommendations, the department had begun establishing a new  investment management governance structure and had applied it to  its portfolio for IT modernization projects. However, HUD had not yet  developed criteria for assessing portfolio performance, or defined and  collected data consistent with the criteria. In the absence of taking  these key steps, the department has continued to be challenged in  implementing proper investment management practices.
Human capital: As we have previously reported, IT human capital  management is intended to ensure that an organization has the  employees with the appropriate knowledge and skills to effectively  execute critical IT functions. Human capital management involves  assessing IT workforce needs, inventorying existing staff’s knowledge  and skills and identifying any gaps between needs and existing  capabilities, and developing strategies and plans to fill any gaps.
In 2009, we reported that HUD’s OCIO had not adequately performed  most of these activities. For example, while the office had analyzed  skill gaps in its IT workforce and had developed a strategy for closing  those skills gaps, OCIO officials did not know when implementation of  this strategy would begin or be completed. Additionally, the gap  analysis was based on an incomplete and outdated inventory of  human capital skill levels, thus rendering its strategy unreliable. We  noted that without effective human capital management, HUD’s ability  to have the right people to effectively operate and maintain existing  systems was impaired. Therefore, we recommended that HUD  establish and execute IT human capital gap closure strategies that are  based on a complete and current inventory of its existing IT workforce  skills.
In September 2011, we reported that HUD had made progress in this  area. Specifically, HUD began working to establish a human capital  plan that included tasks such as identifying challenges, developing  performance metrics and strategies, and addressing the identified IT  skill gaps. HUD anticipated finalizing this plan by December 2011;  however, as of this month, the plan has not yet been completed. Until  HUD finalizes its IT human capital management plan, implementation  of this management control will continue to be a challenge.
Enterprise architecture: EA development and use is aimed at  establishing a corporate blueprint for investing that connects strategic  plans with individual programs and system solutions. As such, this  blueprint provides the information needed to guide and constrain  investments in a consistent, coordinated, and integrated fashion— thereby improving interoperability, reducing duplicative efforts, and  optimizing mission operations. Developing an enterprise architecture  with associated system solutions for portions, or segments (referred to  as segment architectures), is an important aspect of this activity.
In 2009 we reported that, while HUD had established an enterprise  architecture program that met key aspects of related best practices,  its efforts to develop segment architectures were not sufficient. For  example, HUD had identified and prioritized segments to be  modernized; however, it did not adhere to these priorities, the  segments developed did not reflect important elements of federal  guidance, and most were out of date. We found that HUD had  developed eight segment architectures; however, these segments  were not the department’s eight highest priorities. As a result, HUD’s  segment architectures did not provide a sufficient basis for guiding  and directing segment projects in a manner to ensure that both,  system enhancements and new development efforts were properly  sequenced, well integrated, and not duplicative. We recommended  that HUD develop a plan for reexamining segment priorities and  updating and developing segment architectures in accordance with  these priorities and relevant guidance.
We subsequently reported in September 2011, that the department  had made progress toward implementing our recommendation, by, for  example, creating a conceptual enterprise architecture. However, it  had not yet established a policy to guide the development,  maintenance, and use of this architecture. Thus, we further  recommended that HUD establish and approve a policy to govern the  EA prior to further developing its segment architectures. In response,  HUD officials did not explicitly agree or disagree with our  recommendation, but noted that the department was working to draft  an enterprise architecture policy. As of this month, the department  had not yet finalized its EA policy. To this end, establishing a  commitment to its new EA direction remains a challenge for the  department.
section_title: HUD’s Implementation of Recommendations to Improve Expenditure Plans Enables More Oversight
paragraphs: Out of concern about HUD’s capacity to manage its IT modernization  efforts, Congress established limitations on the funding provided to the  department for this purpose. Specifically, the appropriations acts stated  that the department could not obligate more than 25 percent of fiscal year  2010 funds and 35 percent of fiscal year 2011 funds until the Secretary of  HUD submitted to the appropriations committees in each year an  expenditure plan that satisfied two sets of statutory conditions and had  been reviewed by GAO. To address the first set of statutory conditions,  for each modernization project, HUD was required to identify in the plan  (1) functional and performance capabilities to be delivered, (2) expected  mission benefits, (3) estimated lifecycle costs, and (4) planned key  milestones. To address the second set of statutory conditions, the plan  had to demonstrate that each project (1) was supported by an adequately  staffed project office, (2) conformed to capital planning and investment  control requirements, (3) complied with the department’s enterprise  architecture, and (4) was being managed in accordance with applicable  lifecycle management policies and guidance.
Our assessment found that the department’s first expenditure plan,  submitted in April 2010, did not adequately satisfy the two sets of  statutory conditions. In particular, we found that the plan did not  describe specific and measureable mission benefits for all of HUD’s IT  modernization projects. In addition, the plan did not include information  that demonstrated compliance with regard to the department’s enterprise  architecture and capital planning for IT investments. For example, the  modernization projects could not show how they aligned to the  department’s EA because the existing EA was no longer operative. In the  absence of this information, the plan was limited as a congressional  oversight and decision-making mechanism. As a result, we recommended  that HUD ensure that future expenditure plans satisfied each element of  both sets of statutory conditions and describe the status of HUD’s efforts  to establish and implement modernization management controls.
In response, HUD submitted a revised 2010 expenditure plan in February  2011, which we found satisfied both sets of statutory conditions. For  example, the plan identified key milestones by project phase and  deliverable timeframes for the development of requirements and software  releases. The plan also described how each of seven identified  modernization projects complied with the department’s evolving  enterprise architecture. Additionally, the plan clearly described the status  of the department’s efforts to implement the management controls.
Further, in January 2012, HUD submitted its 2011 expenditure plan for  our review, which also satisfied both sets of statutory conditions. For  example, the plan described specific and measureable mission benefits  for each of the identified IT modernization projects. In addition, it  described costs associated with the lifecycle of each project, providing  details on funds needed for major work activities and deliverables.  Further, the plan categorized each project relative to HUD’s evolving  architecture.
As a result of the measures that HUD has taken to respond to our  recommendations and improve the content of each subsequent  expenditure plan, it has rendered these plans more useful. In turn, the  plans should facilitate continued and more effective oversight of the  department’s IT modernization projects.
Going forward, the fiscal year 2012 appropriations act has directed us to  evaluate HUD’s 2012 expenditure plan. Additionally, the 2012  conference report directed us to evaluate implementation of project  management practices, including contractor oversight and cost estimation  for selected IT modernization projects. We have also been directed to  assess the department’s institutionalization of IT governance. We  anticipate initiating aspects of this work in spring 2012.
In summary, HUD has made progress in addressing certain weaknesses  that we identified in its IT management capabilities. However, it is  important to note that more actions are still needed. In particular, fully  addressing the recommendations that we have made is vital to helping  the department implement sound management controls and, ultimately, to  overcome the challenges it has faced in improving its IT management  capabilities. HUD has demonstrated progress in improving the content of  its IT expenditure plans. As a result, these plans should be more useful  as an oversight tool and thus should better help to demonstrate the extent  to which the department takes the important steps that are essential to  strengthening its capacity to manage and modernize its IT environment.
Chairman Latham, Ranking Member Olver, and Members of the  Subcommittee, this concludes my statement today. I would be pleased to  respond to any questions that you may have.
section_title: Contact and Acknowledgments
paragraphs: If you have any questions concerning this statement, please contact  Valerie C. Melvin, Director, Information Management and Technology  Resources Issues, at (202) 512-6304 or melvinv@gao.gov. Other  individuals who made key contributions include Shannin G. O’Neill,  Assistant Director; Kami J. Corbett; Lee A. McCracken; and Teresa M.  Neven.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.