Information Technology: Improved Implementation of Reform Law Is Critical to Better Manage Acquisitions and Operations
Released: 2016-12-06T00:00:00

Letter

Background

The federal government is likely to invest more than $89 billion on IT in fiscal year 2017. However, as we have previously reported, investments in federal IT too often result in failed projects that incur cost overruns and schedule slippages, while contributing little to the desired mission-related outcomes. For example:

The Department of Veterans Affairs’ Scheduling Replacement Project was terminated in September 2009 after spending an estimated $127 million over 9 years.

The tri-agency National Polar-orbiting Operational Environmental Satellite System was stopped in February 2010 by the White House’s Office of Science and Technology Policy after the program spent 16 years and almost $5 billion.

The Department of Homeland Security’s Secure Border Initiative Network program was ended in January 2011, after the department obligated more than $1 billion to the program, because it did not meet cost-effectiveness and viability standards.

The Office of Personnel Management’s Retirement Systems Modernization program was canceled in February 2011, after spending approximately $231 million on the agency’s third attempt to automate the processing of federal employee retirement claims.

The Department of Veterans Affairs’ Financial and Logistics Integrated Technology Enterprise program was intended to be delivered by 2014 at a total estimated cost of $609 million, but was terminated in October 2011 due to challenges in managing the program.

The Department of Defense’s Expeditionary Combat Support System was canceled in December 2012 after spending more than a billion dollars and failing to deploy within 5 years of initially obligating funds.

These and other failed IT projects often suffered from a lack of disciplined and effective management, such as project planning, requirements definition, and program oversight and governance. In many instances, agencies had not consistently applied best practices that are critical to successfully acquiring IT investments.

Federal IT projects have also failed due to a lack of oversight and governance. Executive-level governance and oversight across the government has often been ineffective, specifically from chief information officers (CIO). For example, we have reported that not all CIOs had the authority to review and approve the entire agency IT portfolio and that CIOs’ authority was limited.

FITARA Can Improve Agencies’ Management of IT

Recognizing the severity of issues related to government-wide management of IT, FITARA was enacted in December 2014. The law was intended to improve agencies’ acquisitions of IT and enable Congress to monitor agencies’ progress and hold them accountable for reducing duplication and achieving cost savings. FITARA includes specific requirements related to seven areas.

Federal data center consolidation initiative (FDCCI). Agencies are required to provide OMB with a data center inventory, a strategy for consolidating and optimizing the data centers (to include planned cost savings), and quarterly updates on progress made. The law also requires OMB to develop a goal for how much is to be saved through this initiative, and provide annual reports on cost savings achieved.

Enhanced transparency and improved risk management. OMB and agencies are to make detailed information on federal IT investments publicly available, and agency CIOs are to categorize their IT investments by level of risk. Additionally, in the case of major IT investments rated as high risk for 4 consecutive quarters, the law requires that the agency CIO and the investment’s program manager conduct a review aimed at identifying and addressing the causes of the risk.

Agency CIO authority enhancements. Agency CIOs are required to (1) approve the IT budget requests of their respective agencies, (2) certify that OMB’s incremental development guidance is being adequately implemented for IT investments, (3) review and approve contracts for IT, and (4) approve the appointment of other agency employees with the title of CIO.

Portfolio review. Agencies are to annually review IT investment portfolios in order to, among other things, increase efficiency and effectiveness and identify potential waste and duplication. In establishing the process associated with such portfolio reviews, the law requires OMB to develop standardized performance metrics, to include cost savings, and to submit quarterly reports to Congress on cost savings.

Expansion of training and use of IT acquisition cadres. Agencies are to update their acquisition human capital plans to address supporting the timely and effective acquisition of IT. In doing so, the law calls for agencies to consider, among other things, establishing IT acquisition cadres or developing agreements with other agencies that have such cadres.

Government-wide software purchasing program. The General Services Administration is to develop a strategic sourcing initiative to enhance government-wide acquisition and management of software. In doing so, the law requires that, to the maximum extent practicable, the General Services Administration should allow for the purchase of a software license agreement that is available for use by all executive branch agencies as a single user.

Maximizing the benefit of the federal strategic sourcing initiative. Federal agencies are required to compare their purchases of services and supplies to what is offered under the federal strategic sourcing initiative. OMB is also required to issue related regulations.

In June 2015, OMB released guidance describing how agencies are to implement FITARA. OMB’s guidance is intended to, among other things: assist agencies in aligning their IT resources with statutory establish government-wide IT management controls that will meet the law’s requirements, while providing agencies with flexibility to adapt to unique agency processes and requirements; clarify the CIO’s role and strengthen the relationship between agency CIOs and bureau CIOs; and strengthen CIO accountability for IT cost, schedule, performance, and security.

The guidance identified several actions that agencies were to take to establish a basic set of roles and responsibilities (referred to as the common baseline) for CIOs and other senior agency officials, which are needed to implement the authorities described in the law. For example, agencies were required to conduct a self-assessment and submit a plan describing the changes they intended to make to ensure that common baseline responsibilities are implemented. Agencies were to submit their plans to OMB’s Office of E-Government and Information Technology by August 15, 2015, and make portions of the plans publicly available on agency websites no later than 30 days after OMB approval. As of November 2016, all agencies had made their plans publicly available.

In addition, in August 2016, OMB released guidance intended to, among other things, define a framework for achieving the data center consolidation and optimization requirements of FITARA. The guidance includes requirements for agencies to: maintain complete inventories of all data center facilities owned, operated, or maintained by or on behalf of the agency; develop cost savings targets due to consolidation and optimization for fiscal years 2016 through 2018 and report any actual realized cost savings; and measure progress toward meeting optimization metrics on a quarterly basis.

The guidance also directs agencies to develop a data center consolidation and optimization strategic plan that defines the agency’s data center strategy for fiscal years 2016, 2017, and 2018. This strategy is to include, among other things, a statement from the agency CIO stating whether the agency has complied with all data center reporting requirements in FITARA. Further, the guidance indicates that OMB is to maintain a public dashboard that will display consolidation-related costs savings and optimization performance information for the agencies.

IT Acquisitions and Operations Identified by GAO as a High-Risk Area

In February 2015, we introduced a new government-wide high-risk area, Improving the Management of IT Acquisitions and Operations. This area highlights several critical IT initiatives in need of additional congressional oversight, including (1) reviews of troubled projects; (2) efforts to increase the use of incremental development; (3) efforts to provide transparency relative to the cost, schedule, and risk levels for major IT investments; (4) reviews of agencies’ operational investments; (5) data center consolidation; and (6) efforts to streamline agencies’ portfolios of IT investments. We noted that implementation of these initiatives has been inconsistent and more work remains to demonstrate progress in achieving IT acquisitions and operations outcomes.

Further, in our February 2015 high-risk report, we identified actions that OMB and the agencies need to take to make progress in this area. These include implementing FITARA, as well as implementing at least 80 percent of our recommendations related to the management of IT acquisitions and operations within 4 years. As noted in that report, we made multiple recommendations to improve agencies’ management of IT acquisitions and operations, many of which are discussed later in this statement. Specifically, between fiscal years 2010 and 2015, we made 803 recommendations to OMB and federal agencies to address shortcomings in IT acquisitions and operations, including many to improve the implementation of the recent initiatives and other government-wide, cross-cutting efforts.

As of October 2016, OMB and the agencies had fully implemented about 46 percent of these recommendations. This is a 23 percent increase compared to the percentage we reported as being fully implemented in 2015. Figure 1 summarizes the progress that OMB and the agencies have made in addressing our recommendations, as compared to the 80 percent target.

In addition, in fiscal year 2016, we made 202 new recommendations, thus further reinforcing the need for OMB and agencies to address the shortcomings in IT acquisitions and operations.

Full Implementation of FITARA Needed to Improve IT Management

Agencies have taken steps to improve the management of IT acquisitions and operations by implementing key FITARA initiatives. However, agencies would be better positioned to fully implement the law, and thus realize additional management improvements, if they addressed the numerous recommendations we have made aimed at improving data center consolidation, increasing transparency via OMB’s IT Dashboard, and incremental development.

Agencies Have Made Progress in Consolidating Data Centers, but Need to Take Action to Achieve Planned Cost Savings

One of the key initiatives to implement FITARA is data center consolidation. OMB established FDCCI in February 2010 to improve the efficiency, performance, and environmental footprint of federal data center activities. In a series of reports over the past 5 years, we determined that while data center consolidation could potentially save the federal government billions of dollars, weaknesses existed in several areas, including agencies’ data center consolidation plans and OMB’s tracking and reporting on cost savings. In total, we have made 111 recommendations to OMB and agencies to improve the execution and oversight of the initiative. Most agencies agreed with our recommendations or had no comments.

In March 2016, we reported that the 24 agencies participating in FDCCI collectively had made progress on their data center closure efforts. Specifically, as of November 2015, these agencies had identified a total of 10,584 data centers, of which they reported closing 3,125 through fiscal year 2015. Notably, the Departments of Agriculture, Defense, the Interior, and the Treasury accounted for 84 percent of these total closures. Further, the agencies have reported that they are planning to close additional data centers by the end of fiscal year 2019.

In addition, we noted that 19 of the 24 agencies had reported achieving an estimated $2.8 billion in cost savings and avoidances from their data center consolidation and optimization efforts from fiscal years 2011 through 2015. The Departments of Commerce, Defense, Homeland Security, and the Treasury accounted for about $2.4 billion (or about 86 percent) of the total. Further, 21 agencies collectively reported planning an additional $5.4 billion in cost savings and avoidances, for a total of approximately $8.2 billion, through fiscal year 2019. Figure 2 summarizes agencies’ reported achieved and planned cost savings and avoidances from fiscal years 2011 through 2019.

To better ensure that federal data center consolidation and optimization efforts improve governmental efficiency and achieve cost savings, we recommended that 10 of the 24 agencies take actions to complete their planned data center cost savings and avoidance targets for fiscal years 2016 through 2018. We also recommended that 22 of the 24 agencies take actions to improve optimization progress, including addressing any identified challenges. Fourteen agencies agreed with our recommendations, 4 did not state whether they agreed or disagreed, and 6 stated that they had no comments.

Risks Need to Be Fully Considered When Agencies Rate Their Major Investments on OMB’s IT Dashboard

To facilitate transparency across the government in acquiring and managing IT investments, OMB established a public website—the IT Dashboard—to provide detailed information on major investments at 26 agencies, including ratings of their performance against cost and schedule targets. Among other things, agencies are to submit ratings from their CIOs, which, according to OMB’s instructions, should reflect the level of risk facing an investment relative to that investment’s ability to accomplish its goals. In this regard, FITARA includes a requirement for CIO’s to categorize their major IT investment risks in accordance with OMB guidance.

Over the past 6 years, we have issued a series of reports about the IT Dashboard that noted both significant steps OMB has taken to enhance the oversight, transparency, and accountability of federal IT investments by creating its IT Dashboard, as well as issues with the accuracy and reliability of data. In total, we have made 47 recommendations to OMB and federal agencies to help improve the accuracy and reliability of the information on the IT Dashboard and to increase its availability. Most agencies agreed with our recommendations or had no comments.

Most recently, in June 2016, we determined that agencies had not fully considered risks when rating their major investments on the IT Dashboard. Specifically, our assessments of risk for 95 investments at 15 selected agencies matched the CIO ratings posted on the Dashboard 22 times, showed more risk 60 times, and showed less risk 13 times.

Figure 3 summarizes how our assessments compared to the selected investments’ CIO ratings.

Aside from the inherently judgmental nature of risk ratings, we identified three factors which contributed to differences between our assessments and the CIO ratings:

Forty of the 95 CIO ratings were not updated during the month we reviewed, which led to more differences between our assessments and the CIOs’ ratings. This underscores the importance of frequent rating updates, which help to ensure that the information on the Dashboard is timely and accurately reflects recent changes to investment status.

Three agencies’ rating processes spanned longer than 1 month.

Longer processes mean that CIO ratings are based on older data, and may not reflect the current level of investment risk.

Seven agencies’ rating processes did not focus on active risks.

According to OMB’s guidance, CIO ratings should reflect the CIO’s assessment of the risk and the investment’s ability to accomplish its goals. CIO ratings that do no incorporate active risks increase the chance that ratings overstate the likelihood of investment success.

As a result, we concluded that the associated risk rating processes used by the agencies were generally understating the level of an investment’s risk, raising the likelihood that critical federal investments in IT are not receiving the appropriate levels of oversight. To better ensure that the Dashboard ratings more accurately reflect risk, we recommended that the 15 agencies take actions to improve the quality and frequency of their CIO ratings. Twelve agencies generally agreed with or did not comment on the recommendations and three agencies disagreed.

Agencies Need to Increase Their Use of Incremental Development Practices

OMB has emphasized the need to deliver investments in smaller parts, or increments, in order to reduce risk, deliver capabilities more quickly, and facilitate the adoption of emerging technologies. In 2010, it called for agencies’ major investments to deliver functionality every 12 months and, since 2012, every 6 months. Subsequently, FITARA codified a requirement that agency CIOs certify that IT investments are adequately implementing OMB’s incremental development guidance.

In May 2014, we reported that 66 of 89 selected investments at five major agencies did not plan to deliver capabilities in 6-month cycles, and less than half of these investments planned to deliver functionality in 12-month cycles. We also reported that only one of the five agencies had complete incremental development policies. Accordingly, we recommended that OMB develop and issue clearer guidance on incremental development and that the selected agencies update and implement their associated policies. Four of the six agencies agreed with our recommendations or had no comments; the remaining two agencies partially agreed or disagreed with the recommendations.

More recently, in August 2016, we reported that agencies had not fully implemented incremental development practices for their software development projects. Specifically, we noted that, as of August 31, 2015, 22 federal agencies had reported on the IT Dashboard that 300 of 469 active software development projects (approximately 64 percent) were planning to deliver usable functionality every 6 months for fiscal year 2016, as required by OMB guidance. Regarding the remaining 169 projects (or 36 percent) that were reported as not planning to deliver functionality every 6 months, agencies provided a variety of explanations for not achieving that goal. These included project complexity, the lack of an established project release schedule, or that the project was not a software development project. Table 1 lists the total number and percent of federal software development projects for which agencies reported plans to deliver functionality every 6 months for fiscal year 2016.

In reviewing seven selected agencies’ software development projects, we determined that 45 percent of the projects delivered functionality every 6 months for fiscal year 2015 and 55 percent planned to do so in fiscal year 2016. However, significant differences existed between the delivery rates that the agencies reported to us and what they reported on the IT Dashboard. For example, in four cases (Commerce, Education, HHS, and Treasury), the percentage of delivery reported to us was at least 10 percentage points lower than what was reported on the IT Dashboard. These differences were due to (1) our identification of fewer software development projects than agencies reported on the IT Dashboard and (2) the fact that information reported to us was generally more current than the information reported on the IT Dashboard. Figure 4 compares the software development projects’ percentage of planned delivery every 6 months reported on the IT Dashboard and to us.

We concluded that by not having on the IT Dashboard up-to-date information about whether the project is a software development project and the extent to which projects are delivering functionality, these seven agencies were at risk that OMB and key stakeholders may make decisions regarding the agencies’ investments without the most current and accurate information.

Finally, while OMB has issued guidance requiring agency CIOs to certify that each major IT investment’s plan for the current year adequately implements incremental development, only three agencies (the Departments of Commerce, Homeland Security, and Transportation) had defined processes and policies intended to ensure that the department CIO certifies that major IT investments are adequately implementing incremental development. Officials from three other agencies (the Departments of Education, Health and Human Services, and the Treasury) reported that they were in the process of updating their existing incremental development policy to address certification, while the Department of Defense’s policies that address incremental development did not include information on CIO certification. We concluded that until all of the agencies we reviewed define processes and policies for the certification of the adequate use of incremental development, they will not be able to fully ensure adequate implementation of, or benefit from, incremental development practices, as required by FITARA.

To improve the reporting of incremental data on the IT Dashboard and policies for CIO certification of adequate incremental development, we made 12 recommendations to seven agencies and OMB. Five agencies agreed with our recommendations. In addition, the Department of Defense partially agreed with one recommendation and disagreed with another, OMB did not agree or disagree, and the Department of the Treasury did not comment on the recommendations.

In summary, with the enactment of FITARA, the federal government has an opportunity to improve the transparency and management of IT acquisitions and operations, and to strengthen the authority of CIOs to provide needed direction and oversight. To their credit, agencies have taken steps to improve the management of IT acquisitions and operations by implementing key FITARA initiatives, including data center consolidation, efforts to increase transparency via OMB’s IT Dashboard, and incremental development; and they have continued to address recommendations we have made over the past several years. However, additional improvements are needed, and further efforts by OMB and federal agencies to implement our previous recommendations would better position them to fully implement FITARA. To help ensure that these efforts succeed, continued congressional oversight of OMB’s and agencies’ implementation of FITARA is essential. In addition, we will continue to monitor agencies implementation of our previous recommendations.

Chairmen Meadows and Hurd, Ranking Members Connolly and Kelly, and Members of the Subcommittees, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time.

GAO Contacts and Staff Acknowledgments

If you or your staffs have any questions about this testimony, please contact me at (202) 512-9286 or at pownerd@gao.gov. Individuals who made key contributions to this testimony are Kevin Walsh (Assistant Director), Chris Businsky, Rebecca Eyler, and Bradley Roach (Analyst in Charge).

Related GAO Products

Information Technology Reform: Agencies Need to Increase Their Use of Incremental Development Practices, GAO-16-469. Washington, D.C.: August 16, 2016.

IT Dashboard: Agencies Need to Fully Consider Risks When Rating Their Major Investments, GAO-16-494. Washington, D.C.: June 2, 2016.

Data Center Consolidation: Agencies Making Progress, but Planned Savings Goals Need to Be Established . GAO-16-323. Washington, D.C.: March 3, 2016.

High-Risk Series: An Update. GAO-15-290. Washington, D.C.: February 11, 2015.

Data Center Consolidation: Reporting Can Be Improved to Reflect Substantial Planned Savings. GAO-14-713. Washington, D.C.: September 25, 2014.

Information Technology: Agencies Need to Establish and Implement Incremental Development Policies. GAO-14-361. Washington, D.C.: May 1, 2014.

IT Dashboard: Agencies Are Managing Investment Risk, but Related Ratings Need to Be More Accurate and Available. GAO-14-64. Washington, D.C.: December 12, 2013.

Data Center Consolidation: Strengthened Oversight Needed to Achieve Cost Savings Goal. GAO-13-378. Washington, D.C.: April 23, 2013.

Information Technology Dashboard: Opportunities Exist to Improve Transparency and Oversight of Investment Risk at Select Agencies. GAO-13-98. Washington, D.C.: October 16, 2012.

Data Center Consolidation: Agencies Making Progress on Efforts, but Inventories and Plans Need to Be Completed. GAO-12-742. Washington, D.C.: July 19, 2012.

IT Dashboard: Accuracy Has Improved, and Additional Efforts Are Under Way to Better Inform Decision Making. GAO-12-210. Washington, D.C.: November 7, 2011.

Data Center Consolidation: Agencies Need to Complete Inventories and Plans to Achieve Expected Savings. GAO-11-565. Washington, D.C.: July 19, 2011.

Federal Chief Information Officers: Opportunities Exist to Improve Role in Information Technology Management. GAO-11-634. Washington, D.C.: September 15, 2011.

Information Technology: OMB Has Made Improvements to Its Dashboard, but Further Work Is Needed by Agencies and OMB to Ensure Data Accuracy. GAO-11-262. Washington, D.C.: March 15, 2011.

Information Technology: OMB’s Dashboard Has Increased Transparency and Oversight, but Improvements Needed. GAO-10-701. Washington, D.C.: July 16, 2010.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.