Information Technology: OMB and Agencies Need to Focus Continued Attention on Implementing Reform Law
Released: 2016-05-18T00:00:00

Letter

Background

The federal government plans to invest more than $89 billion on IT in fiscal year 2017. However, as we have previously reported, investments in federal IT too often result in failed projects that incur cost overruns and schedule slippages while contributing little to the mission-related outcome. For example:

The Department of Defense’s Expeditionary Combat Support System was canceled in December 2012 after spending more than a billion dollars and failing to deploy within 5 years of initially obligating funds.

The Department of Homeland Security’s Secure Border Initiative Network program was ended in January 2011, after the department obligated more than $1 billion to the program, because it did not meet cost-effectiveness and viability standards.

The Department of Veterans Affairs’ Financial and Logistics Integrated Technology Enterprise program was intended to be delivered by 2014 at a total estimated cost of $609 million, but was terminated in October 2011 due to challenges in managing the program.

The Office of Personnel Management’s Retirement Systems Modernization program was canceled in February 2011, after spending approximately $231 million on the agency’s third attempt to automate the processing of federal employee retirement claims.

The tri-agency National Polar-orbiting Operational Environmental Satellite System was stopped in February 2010 by the White House’s Office of Science and Technology Policy after the program spent 16 years and almost $5 billion.

The Department of Veterans Affairs’ Scheduling Replacement Project was terminated in September 2009 after spending an estimated $127 million over 9 years.

These and other failed IT projects often suffered from a lack of disciplined and effective management, such as project planning, requirements definition, and program oversight and governance. In many instances, agencies had not consistently applied best practices that are critical to successfully acquiring IT investments.

Federal IT projects have also failed due to a lack of oversight and governance. Executive-level governance and oversight across the government has often been ineffective, specifically from chief information officers (CIO). For example, we have reported that not all CIOs had the authority to review and approve the entire agency IT portfolio and that CIOs’ authority was limited.

Recent Law Can Improve Agencies’ Management of IT

Recognizing the severity of issues related to government-wide management of IT, FITARA was enacted in December 2014. The law holds promise for improving agencies’ acquisition of IT and enabling Congress to monitor agencies’ progress and hold them accountable for reducing duplication and achieving cost savings. FITARA includes specific requirements related to seven areas.

Federal data center consolidation initiative (FDCCI). Agencies are required to provide OMB with a data center inventory, a strategy for consolidating and optimizing the data centers (to include planned cost savings), and quarterly updates on progress made. The law also requires OMB to develop a goal for how much is to be saved through this initiative, and provide annual reports on cost savings achieved.

Enhanced transparency and improved risk management. OMB and agencies are to make detailed information on federal IT investments publicly available, and agency CIOs are to categorize their IT investments by risk. Additionally, in the case of major IT investments rated as high risk for 4 consecutive quarters, the law requires that the agency CIO and the investment’s program manager conduct a review aimed at identifying and addressing the causes of the risk.

Agency CIO authority enhancements. Agency CIOs are required to (1) approve the IT budget requests of their respective agencies, (2) certify that IT investments are adequately implementing OMB’s incremental development guidance, (3) review and approve contracts for IT, and (4) approve the appointment of other agency employees with the title of CIO.

Portfolio review. Agencies are to annually review IT investment portfolios in order to, among other things, increase efficiency and effectiveness, and identify potential waste and duplication. In developing the associated process, the law requires OMB to develop standardized performance metrics, to include cost savings, and to submit quarterly reports to Congress on cost savings.

Expansion of training and use of IT acquisition cadres. Agencies are to update their acquisition human capital plans to address supporting the timely and effective acquisition of IT. In doing so, the law calls for agencies to consider, among other things, establishing IT acquisition cadres or developing agreements with other agencies that have such cadres.

Government-wide software purchasing program. The General Services Administration is to develop a strategic sourcing initiative to enhance government-wide acquisition and management of software. In doing so, the law requires that, to the maximum extent practicable, the General Services Administration should allow for the purchase of a software license agreement that is available for use by all Executive Branch agencies as a single user.

Maximizing the benefit of the federal strategic sourcing initiative. Federal agencies are required to compare their purchases of services and supplies to what is offered under the Federal Strategic Sourcing initiative. OMB is also required to issue related regulations.

In June 2015, OMB released guidance describing how agencies are to implement the law. OMB’s guidance states that it is intended to, among other things: assist agencies in aligning their IT resources to statutory establish government-wide IT management controls that will meet the law’s requirements, while providing agencies with flexibility to adapt to unique agency processes and requirements; clarify the CIO’s role and strengthen the relationship between agency CIOs and bureau CIOs; and strengthen CIO accountability for IT cost, schedule, performance, and security.

The guidance includes several actions agencies are to take to establish a basic set of roles and responsibilities (referred to as the “common baseline”) for CIOs and other senior agency officials that are needed to implement the authorities described in the law. For example, agencies were required to conduct a self-assessment and submit a plan describing the changes they will make to ensure that common baseline responsibilities are implemented. Agencies were to submit their plans to OMB’s Office of E-Government and Information Technology by August 15, 2015, and make portions of the plans publicly available on agency websites no later than 30 days after OMB approval. As of May 2016, 22 of the 24 Chief Financial Officers Act agencies had made their plans publicly available.

In addition, OMB recently released proposed guidance for public comment on the optimization of federal data centers and implementation of FITARA’s data center consolidation and optimization provisions. Among other things, the proposed guidance instructs agencies to maintain complete inventories of all data center facilities owned, operated, or maintained by or on behalf of the agency; develop cost savings targets due to consolidation and optimization for fiscal years 2016 through 2018 and report any actual realized cost savings; and measure progress toward defined performance metrics (including server utilization) on a quarterly basis as part of their data center inventory submissions. The proposed guidance also directs agencies to develop a data center consolidation and optimization strategic plan that defines the agency’s data center strategy for the subsequent 3 years. This strategy is to include a timeline for agency consolidation and optimization activities with an emphasis on cost savings and optimization performance benchmarks the agency can achieve between fiscal years 2016 and 2018. Finally, the proposed guidance indicates that OMB will maintain a public dashboard that will display consolidation-related costs savings and optimization performance information for the agencies.

IT Acquisitions and Operations Identified by GAO as a High Risk Area

In February 2015, we introduced a new government-wide high-risk area, Improving the Management of IT Acquisitions and Operations. This area highlights several critical IT initiatives in need of additional congressional oversight, including reviews of troubled projects, an emphasis on incremental development, a key transparency website, reviews of agencies’ operational investments, data center consolidation, and efforts to streamline agencies’ portfolios of IT investments. We noted that implementation of these initiatives has been inconsistent and more work remains to demonstrate progress in achieving IT acquisition outcomes.

Further, in our February 2015 high-risk report, we identified actions that OMB and the agencies need to take to make progress in this area. These include implementing FITARA, as well as implementing our previous recommendations, such as developing comprehensive inventories of federal agencies’ software licenses. As noted in that report, we have made multiple recommendations to improve agencies’ management of IT acquisitions and operations, many of which are discussed later in this statement. Between fiscal years 2010 and 2015, we made approximately 800 such recommendations to OMB and federal agencies. As of May 2016, about 33 percent of these recommendations had been implemented.

Also in our high risk report, we stated that OMB and agencies will need to demonstrate measurable government-wide progress in the following key areas: implement at least 80 percent of GAO’s recommendations related to the management of IT acquisitions and operations within 4 years, ensure that a minimum of 80 percent of the government’s major acquisitions deliver functionality every 12 months, and achieve no less than 80 percent of the planned PortfolioStat savings and 80 percent of the planned savings for data center consolidation.

Implementation of IT Reform Law Needed to Improve Performance of Key Initiatives

One of the key initiatives to implement FITARA is data center consolidation. OMB established FDCCI in February 2010 to improve the efficiency, performance, and environmental footprint of federal data center activities. In a series of reports over the past 5 years, we determined that while data center consolidation could potentially save the federal government billions of dollars, weaknesses existed in several areas including agencies’ data center consolidation plans and OMB’s tracking and reporting on cost savings. In total, we have made 111 recommendations to OMB and agencies to improve the execution and oversight of the initiative. Most agencies agreed with our recommendations or had no comment.

Most recently, in March 2016, we reported that the 24 departments and agencies participating in FDCCI collectively made progress on their data center closure efforts. Specifically, as of November 2015, agencies had identified a total of 10,584 data centers, of which they reported closing 3,125 through fiscal year 2015. Notably, the Departments of Agriculture, Defense, the Interior, and the Treasury accounted for 84 percent of these total closures. Agencies are also planning to close an additional 2,078 data centers—for a total of 5,203—by the end of fiscal year 2019. See figure 1 for a summary of agencies’ total data centers and reported and planned closures.

In addition, we reported that 19 of the 24 agencies reported achieving an estimated $2.8 billion in cost savings and avoidances from their data center consolidation and optimization efforts from fiscal years 2011 to 2015. Notably, the Departments of Commerce, Defense, Homeland Security, and the Treasury accounted for about $2.4 billion (or about 86 percent) of the total. Further, 21 agencies collectively reported planning an additional $5.4 billion in cost savings and avoidances, for a total of approximately $8.2 billion, through fiscal year 2019. See figure 2 for a summary of agencies’ reported achieved and planned cost savings and avoidances from fiscal years 2011 through 2019.

However, we noted that planned savings may be higher because 10 of the 21 agencies that reported planned closures from fiscal years 2016 through 2018 have not fully developed their cost savings and avoidance goals for these fiscal years. Agencies provided varied reasons for not having this information, including that they were in the process of re- evaluating their data center consolidation strategies, as well as facing other challenges in determining such information. We noted that the reporting of planned savings goals is increasingly important considering the enactment of FITARA, which requires agencies to develop yearly calculations of cost savings as part of their multi-year strategies to consolidate and optimize their data centers. We concluded that, until agencies address their challenges and complete and report such information, the $8.2 billion in total savings and avoidances may be understated and agencies will not be able to satisfy the data center consolidation strategy provisions of FITARA.

Finally, we reported that agencies made limited progress against OMB’s fiscal year 2015 core data center optimization performance metrics. In total, 22 of the 24 agencies reported data center optimization information to OMB. However, of the nine metrics with targets, only one—full-time equivalent ratio (a measure of data center labor efficiency)—was met by half of the 24 agencies, while the remaining eight were each met by less than half of the agencies. See figure 3 for a summary of agencies’ progress against OMB’s data center optimization metric targets.

Agencies reported a variety of challenges in meeting OMB’s data center optimization targets, such as the decentralized nature of their agencies making consolidation and optimization efforts more difficult. We noted that addressing this challenge and others is increasingly important in light of the enactment of FITARA, which requires agencies to measure and report progress in meeting data center optimization performance metrics. We concluded that, until agencies take action to improve progress against OMB’s data center optimization metrics, including addressing any challenges identified, they could be hindered in the implementation of the data center consolidation provisions of FITARA and in making initiative- wide progress against OMB’s optimization targets.

To better ensure that federal data center consolidation and optimization efforts improve governmental efficiency and achieve cost savings, we recommended that 10 agencies take action to complete their planned data center cost savings and avoidance targets for fiscal years 2016 through 2018. We also recommended that 22 agencies take action to improve optimization progress, including addressing any identified challenges. Fourteen agencies agreed with our recommendations, 4 did not state whether they agreed or disagreed, and 6 stated that they had no comments.

Risks Need to Be Fully Considered When Agencies Rate Their Major Investments on OMB’s IT Dashboard

To facilitate transparency across the government in acquiring and managing IT investments, OMB established a public website—the IT Dashboard—to provide detailed information on major investments at 26 agencies, including ratings of their performance against cost and schedule targets. Among other things, agencies are to submit ratings from their CIOs, which, according to OMB’s instructions, should reflect the level of risk facing an investment relative to that investment’s ability to accomplish its goals. In this regard, FITARA includes a requirement for CIO’s to categorize their major IT investment risks in accordance with OMB guidance.

Over the past 6 years, we have issued a series of reports about the IT Dashboard that noted both significant steps OMB has taken to enhance the oversight, transparency, and accountability of federal IT investments by creating its IT Dashboard, as well as issues with the accuracy and reliability of data. In total, we have made 22 recommendations to OMB and federal agencies to help improve the accuracy and reliability of the information on the IT Dashboard and to increase its availability. Most agencies agreed with our recommendations or had no comment.

Most recently, as part of our ongoing work, we determined that agencies had not fully considered risks when rating their major investments on the IT Dashboard. Specifically, our assessment of 95 investments at 15 agencies matched the CIO ratings posted on the Dashboard 22 times, showed more risk 60 times, and showed less risk 13 times. Figure 4 summarizes how our assessments compared to the select investments’ CIO ratings.

Aside from the inherently judgmental nature of risk ratings, we identified three factors which contributed to differences between our assessments and CIO ratings:

Forty-one of the 95 CIO ratings were not updated during the month we reviewed, which led to more differences between our assessments and the CIOs’ ratings. This underscores the importance of frequent rating updates, which help to ensure that the information on the Dashboard is timely and accurately reflects recent changes to investment status.

Three agencies’ rating processes span longer than 1 month. Longer processes mean that CIO ratings are based upon older data, and may not reflect the current level of investment risk.

Seven agencies’ rating processes did not focus on active risks.

According to OMB’s guidance, CIO ratings should reflect the CIO’s assessment of the risk and the investment’s ability to accomplish its goals. CIO ratings that do no incorporate active risks increase the chance that ratings overstate the likelihood of investment success.

As a result, we concluded that the associated risk rating processes used by the agencies were generally understating the level of an investment’s risk, raising the likelihood that critical federal investments in IT are not receiving the appropriate levels of oversight. To better ensure that the Dashboard ratings more accurately reflect risk, we are recommending in our draft report, which is with the applicable agencies for comment, that 15 agencies take actions to improve the quality and frequency of their CIO ratings.

Agencies Need to Increase Their Use of Incremental Development Practices

OMB has emphasized the need to deliver investments in smaller parts, or increments, in order to reduce risk, deliver capabilities more quickly, and facilitate the adoption of emerging technologies. In 2010, it called for agencies’ major investments to deliver functionality every 12 months and, since 2012, every 6 months. Subsequently, FITARA codified a requirement that agency CIO’s certify that IT investments are adequately implementing OMB’s incremental development guidance.

In May 2014, we reported that almost three-quarters of selected investments at five major agencies did not plan to deliver capabilities in 6-month cycles, and less than half planned to deliver functionality in 12- month cycles. We also reported that most of the five agencies reviewed had incomplete incremental development policies. Accordingly, we recommended that OMB develop and issue clearer guidance on incremental development and that selected agencies update and implement their associated policies. Most agencies agreed with our recommendations or had no comment.

More recently, as part of our ongoing work, we determined that agencies had not fully implemented incremental development practices for their software development projects. Specifically, as of August 31, 2015, on the IT Dashboard, 22 federal agencies reported that 300 of 469 active software development projects (approximately 64 percent) were planning to deliver usable functionality every 6 months for fiscal year 2016, as required by OMB guidance. Regarding the remaining 169 projects (or 36 percent) that were reported as not planning to deliver functionality every 6 months, agencies provided a variety of explanations for not achieving that goal, including project complexity, the lack of an established project release schedule, or that the project was not a software development project. Table 1 lists the total number and percent of software development projects that agencies reported plans to deliver functionality, from highest to lowest.

In reviewing seven selected agencies’ software development projects, we determined that the percentage delivering functionality every 6 months was reported at 45 percent for fiscal year 2015 and planned for 54 percent in fiscal year 2016. However, significant differences existed between the delivery rates that the agencies reported to us and what they reported on the IT Dashboard. For example, the percentage of software projects delivering every 6 months that was reported to us by the Department of Commerce decreased by about 42 percentage points from what was reported on the IT Dashboard. In contrast, the Department of Defense reported a 55 percentage point increase from what was reported on the IT Dashboard. Figure 5 compares what the seven agencies reported on the IT Dashboard and the numbers they reported to us.

We determined that the significant differences in delivery rates were due, in part, to agencies having different interpretations of OMB’s guidance on reporting software development projects and because the information reported to us was generally more current than the information reported on the IT Dashboard. We concluded that, until the inconsistences in the information reported to us versus the information provided on the IT Dashboard are addressed, the seven agencies we reviewed are at risk that OMB and key stakeholders may make decisions regarding agency investments without the most current and accurate information.

Finally, nearly all of the seven agencies we reviewed had not yet implemented the FITARA requirement related to certifying that major IT investments are adequately implementing OMB’s incremental development guidance. Specifically, only one agency—the Department of Homeland Security—had processes and policies to ensure that the CIO will certify that major IT investments are adequately implementing incremental development, while the remaining six agencies had not established such processes and policies. Officials from most of these six agencies reported they were in the process of updating their existing incremental development policies to address certification.

To improve the use of incremental development, we are recommending in our draft report, which is with the applicable agencies for comment, that agencies take action to update their policies for incremental development and IT Dashboard project information. We are also recommending that OMB provide clarifying guidance on what IT investments are required to use incremental development and for reporting on projects that are not subject to these requirements.

In summary, with the recent enactment of FITARA, the federal government has an opportunity to improve the transparency and management of IT acquisition and operations, and strengthen the authority of CIOs to provide needed direction and oversight. However, improvements are needed in several critical IT initiatives, including data center consolidation, efforts to increase transparency via OMB’s IT Dashboard, and incremental development—all of which are related to provisions of FITARA. Accordingly, OMB and federal agencies should expeditiously implement the requirements of the new IT reform law and continue to implement our previous recommendations. To help ensure that these improvements are achieved, continued congressional oversight of OMB’s and agencies’ implementation efforts is essential.

Chairmen Meadows and Hurd, Ranking Members Connolly and Kelly, and Members of the Subcommittees, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time.

GAO Contacts and Staff Acknowledgments

If you or your staffs have any questions about this testimony, please contact me at (202) 512-9286 or at pownerd@gao.gov. Individuals who made key contributions to this testimony are Dave Hinchman (Assistant Director), Justin Booth, Chris Businsky, Rebecca Eyler, Linda Kochersberger, and Jon Ticehurst.

Related GAO Products

Data Center Consolidation: Agencies Making Progress, but Planned Savings Goals Need to Be Established . GAO-16-323. Washington, D.C.: March 3, 2016.

High-Risk Series: An Update. GAO-15-290. Washington, D.C.: February 11, 2015.

Data Center Consolidation: Reporting Can Be Improved to Reflect Substantial Planned Savings. GAO-14-713. Washington, D.C.: September 25, 2014.

Information Technology: Agencies Need to Establish and Implement Incremental Development Policies. GAO-14-361. Washington, D.C.: May 1, 2014.

IT Dashboard: Agencies Are Managing Investment Risk, but Related Ratings Need to Be More Accurate and Available. GAO-14-64 Washington, D.C.: December 12, 2013.

Data Center Consolidation: Strengthened Oversight Needed to Achieve Cost Savings Goal. GAO-13-378. Washington, D.C.: April 23, 2013.

Information Technology Dashboard: Opportunities Exist to Improve Transparency and Oversight of Investment Risk at Select Agencies. GAO-13-98. Washington, D.C.: October 16, 2012.

Data Center Consolidation: Agencies Making Progress on Efforts, but Inventories and Plans Need to Be Completed. GAO-12-742. Washington, D.C.: July 19, 2012.

IT Dashboard: Accuracy Has Improved, and Additional Efforts Are Under Way to Better Inform Decision Making. GAO-12-210. Washington, D.C.: November 7, 2011.

Data Center Consolidation: Agencies Need to Complete Inventories and Plans to Achieve Expected Savings. GAO-11-565. Washington, D.C.: July 19, 2011.

Federal Chief Information Officers: Opportunities Exist to Improve Role in Information Technology Management. GAO-11-634. Washington, D.C.: September 15, 2011.

Information Technology: OMB Has Made Improvements to Its Dashboard, but Further Work Is Needed by Agencies and OMB to Ensure Data Accuracy. GAO-11-262. Washington, D.C.: March 15, 2011.

Information Technology: OMB’s Dashboard Has Increased Transparency and Oversight, but Improvements Needed. GAO-10-701. Washington, D.C.: July 16, 2010.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.