Information Technology: Key Federal Agencies Need to Address Potentially Duplicative Investments
Released: 2013-09-12T00:00:00

Letter

Background

Information technology should enable government to better serve the American people. However, according to OMB, despite spending more than $600 billion on IT over the past decade, the federal government has achieved little of the productivity improvements that private industry has realized from IT.

Too often, federal IT projects run over budget, behind schedule, fail to deliver promised functionality, or are duplicative of other projects. In combating this problem, proper oversight is critical. Both OMB and federal agencies have key roles and responsibilities for overseeing IT investment management. OMB is responsible for working with agencies to ensure investments are appropriately planned and justified. Additionally, each year, OMB and federal agencies work together to determine how much the government plans to spend on IT projects and how these funds are to be allocated.

OMB uses the following mechanisms and processes, among others, to help it fulfill its required oversight responsibilities for federal IT spending.

Exhibit 53s and exhibits 300s. OMB requires 27 federal departments and agencies to provide information related to their IT investments, including agency exhibit 53s and capital asset plans and business cases (called exhibit 300s).

Federal Enterprise Architecture (FEA) initiative. In February 2002, OMB established the FEA initiative. According to OMB, the FEA is intended to facilitate governmentwide improvement through cross- agency analysis and identification of duplicative investments, gaps, and opportunities for collaboration, interoperability, and integration within and across agency programs. The FEA is composed of five “reference models” describing the federal government’s (1) business (or mission) processes and functions, independent of the agencies that perform them; (2) performance goals and outcome measures; (3) means of service delivery; (4) information and data definitions; and (5) technology standards. Since the fiscal year 2004 budget cycle, OMB has required agencies to categorize their IT investments in their annual exhibit 53s according to primary function and subfunction as identified in the FEA reference models. Additionally, agencies were required to choose a subfunction for each investment related to the primary function.

IT reform. In December 2010, the Federal Chief Information Officer issued a 25 Point Implementation Plan to Reform Federal Information Technology Management. This 18-month plan specified five major goals: strengthening program management, streamlining governance and improving accountability, increasing engagement with industry, aligning the acquisition and budget processes with the technology cycle, and applying “light technology” and shared solutions. As part of this plan, OMB outlined actions to, among other things, strengthen agencies’ investment review boards and consolidate federal data centers. The plan stated that OMB will work with Congress to consolidate commodity IT spending (e.g., e-mail, data centers, content management systems, and web infrastructure) to, among other things, eliminate duplication, under agency Chief Information Officers. Further, the plan called for the role of agency Chief Information Officers to focus more on IT portfolio management.

In April 2012, we reported on the federal government’s progress toward implementing these actions. In particular, we found that OMB and key federal agencies had made progress on action items in the IT Reform Plan, but that much work remained to be done on action items such as completing data center consolidation plans and launching a forum for agencies to share IT management best practices. Accordingly, we recommended, among other things, that the agencies complete all key IT Reform action items; OMB agreed with our recommendation.

IT operations and maintenance. With regard to identifying and eliminating duplication within existing IT legacy systems—commonly referred to as steady state investments—OMB issued the Capital Programming Guide that calls for agencies to analyze (via operational analysis) whether their steady state investments are continuing to meet business and customer needs and are contributing to meeting the agency’s strategic goals. More specifically, this guidance calls for agencies to perform operational analyses annually on each steady state investment and requires that each operational analysis address 17 key factors, including cost, schedule, customer satisfaction, strategic and business results, financial goals, and whether the investment overlaps with other systems.

In October 2012, we reported that of five key agencies selected for review, only two had performed operational analyses, and these two agencies did not perform analyses on all their steady state investments.agencies, none fully addressed the 17 key factors specified in OMB’s guidance. Consequently, we recommended that the agencies conduct annual operational analyses on all their steady state investments and in doing, fully address the 17 key factors. The agencies agreed with our recommendations and have taken actions, such as developing operational analysis guidance, to address them.

Further, of the analyses performed by the two

PortfolioStat reviews. In March 2012, OMB launched the PortfolioStat initiative, which requires agencies to conduct an annual agencywide IT portfolio review to, among other things, reduce commodity IT spending and demonstrate how their IT investments align with the agency’s mission and business functions. PortfolioStat is designed to assist agencies in assessing the current maturity of their IT investment management process, making decisions on eliminating duplicative investments, and moving to shared solutions in order to maximize the return on IT investments across the portfolio. While OMB’s TechStat reviews are intended to examine IT performance at the specific project or investment-level, PortfolioStat reviews are intended to examine the portfolio as a whole and draw on the agency’s enterprise architecture to help identify and eliminate areas of duplication and waste. In March 2013, OMB reported that through its PortfolioStat effort, agencies had identified and committed to nearly 100 opportunities to consolidate or eliminate commodity IT investments. OMB reports that PortfolioStat has the potential to save the government $2.5 billion over the next 3 years by, for example, consolidating duplicative systems.

GAO Has Previously Reported on Potential IT Investment Duplication

During the past several years, we have issued multiple reports and testimonies and made numerous recommendations to OMB and federal agencies to identify and reduce duplication within the federal government’s portfolio of IT investments. For example, in September 2011, we reported that results of OMB initiatives to identify potentially duplicative IT investments were mixed and that several federal agencies did not routinely assess their entire IT portfolios to identify and remove or consolidate duplicative systems.OMB’s recent initiatives had not yet demonstrated results, and several agencies had not routinely assessed legacy systems to determine if they were duplicative. Accordingly, we recommended that OMB among other things (1) improve its agency guidance on identifying and categorizing IT investments and (2) require the agencies as part of their annual budget and IT investment submissions to report the steps they take to ensure their IT investments are not duplicative. OMB generally agreed with these two recommendations and to address them subsequently updated its Specifically, we found that most of guidance to provide additional clarity on how agencies should characterize investments in order to enhance the identification of potentially duplicative investments.

In addition, in February 2012 we reported on potentially duplicative IT investments within DOD, the Department of Energy, and DHS. Specifically, we found that while DOD and the Department of Energy had various investment review processes in place that were partially designed to avoid investing in systems that were duplicative, we identified 37 potentially duplicative investments, totaling about $1.2 billion for fiscal years 2007 through 2012. Accordingly, we recommended that the agencies utilize existing transparency mechanisms, such as the IT Dashboard, to report on the results of the department’s efforts to identify and eliminate, where appropriate, each potentially duplicative investment we identified, as well as any other duplicative investments. We also recommended that these agencies, among other things, report on the progress of their efforts to identify and eliminate duplication. The agencies generally agreed with our recommendations and have taken steps to address them. For example, DOD and the Department of Energy (1) are conducting portfolio reviews, as part of their established IT investment management processes, as means to identifying and eliminating IT duplication and (2) plan to report the results of these reviews via the IT Dashboard.

GAO, Data Center Consolidation: Strengthened Oversight Needed to Achieve Cost Savings Goal, GAO-13-378 (Washington, D.C.: Apr. 23, 2013). that while agencies had closed 420 data centers, this was 285 closures short of where OMB expected the agencies to be as of the December 2012 time frame. Further, we found that OMB had not determined agencies’ progress against their cost savings goals because OMB had yet to determine a consistent and repeatable method for tracking cost savings. Consequently, we recommended that OMB, among other things, track and report on key performance measures and extend the time frame for achieving planned cost savings. OMB agreed with the first recommendation and plans to evaluate the second recommendation but did not provide a time frame for the evaluation’s completion. Additionally, the above work and associated reports have been updated and summarized in our 2011, 2012, and 2013 duplication series which reported on opportunities that existed for federal agencies to reduce fragmentation, overlap, or duplication in key areas, including IT, in order to achieve greater efficiency and effectiveness.

A Small Number of the Agencies’ IT Investments Appeared to be Potentially Duplicative, but They Represent Significant Spending

The three agencies in our review had some IT investments that appeared to be duplicative; of the total investments we reviewed, the number of such investments was small but represented a significant amount of spending. Specifically, of the 590 IT investments reviewed, we identified 12 potentially duplicative investments (within 5 purpose groups) at DHS, DOD, and HHS which accounted for about $321 million in reported IT spending for fiscal years 2008 through 2013. (Our analysis and categorization of the 12 investments by common purposes is included in app. II). With regard to the 12 investments, we found, as shown in table 2, the following: two potentially duplicative investments totaling about $30 million at DHS that are used to “book” and process apprehended illegal aliens who are suspected of committing criminal and administrative violations, commonly referred to as immigration enforcement booking management; four such investments totaling about $31 million at DOD, which include two investments totaling $16 million that track health care status of warfighters and two investments totaling $15 million that manage dental care; and six potentially duplicative investments totaling approximately $260 million at HHS, which include four investments totaling $257 million that support enterprise information security and two totaling $4 million for Medicare Coverage Determination.

It is important that federal agencies avoid duplicative investments, whenever possible, to ensure the most efficient use of resources. As such, OMB has issued guidance to help agencies reduce duplicative IT investments. More specifically, our analysis (by agency) found the following for each of the investments addressed in the purpose groups specified in table 2.

At DHS, the department had two potentially duplicative IT investments with the purpose of immigration enforcement booking; they are called E3 and EAGLE and are used by DHS component agencies—namely, U.S. Customs and Border Protection (CBP) and U.S. Immigration and Customs Enforcement (ICE), respectively—to enforce immigration law, including the processing of apprehended illegal aliens who are suspected of committing criminal and administrative violations. These investments were potentially duplicative because they perform similar functions, including querying other law enforcement data sources about, among other capturing biographic information on apprehended illegal aliens, recording illegal alien arrests and enforcement incidents, collecting biometric data on such aliens, and things, prior arrests and outstanding warrants.

CBP and ICE officials disagreed that the investments are duplicative, and thus do not have plans to address them. Specifically, officials from CBP and ICE stated that E3 and EAGLE accommodate different work processes and requirements. For example, ICE officials stated that EAGLE is a customized interface designed to meet the needs of its investigative and detention mission. However, CBP and ICE officials agreed that the systems do capture common data elements that are stored in a single, shared database. In addition, in 2007, CBP and ICE planned to jointly develop the E3 project. Specifically, according to the E3 project charter (dated February 2007) and project plan (dated June 2007), the goal of the investment was to jointly develop a system to replace the then legacy booking management system being used at the time by both agencies. Although ICE subsequently withdrew from the project citing risks with the intended modernization approach and unique requirements that would not be addressed by the new system, it was not able to provide evidence corroborating its concerns with the modernization approach or an analysis showing that its requirements could not be satisfied by the new (E3) system. Further, as part of its development of EAGLE, ICE did assess three alternatives to the legacy booking management system, including E3 but concluded that adopting E3 also had significant cost and schedule risks. Nevertheless, ICE was not able to provide the costs associated with each of the alternatives other than EAGLE and thus could not corroborate their assessment that EAGLE was the most viable alternative.

At DOD, the department had two potentially duplicative investments in Health Care Tracking and two in Dental Management. Specifically, the two Health Care Tracking investments—namely, the Warrior Care and Transition System and Clinical Case Management Information Technology Initiative—manage wounded soldier health care through their transition back into active duty status or as veterans. DOD officials agreed that these investments had areas of duplication, and stated that they recently canceled the Clinical Case Management Information Technology Initiative, in part to address this duplication.

The two dental management systems—called Corporate Dental Application and Dental Common Access System—support and service the oral health of operational personnel, including the collection and management of oral health data, and updating readiness. These investments were potentially duplicative because they perform similar functions for each of the armed services. Department officials stated that when the systems were originally being deployed to the various armed services, the department did not consider deploying a common solution. Specifically, the Navy deployed its system in 2000 and the Army deployed its system in 1998 to meet their services’ specific dental system requirements. DOD officials agreed that these systems are potentially duplicative and said to address this duplication, the department plans to migrate to a single system across all armed services. DOD officials stated that they plan to complete this migration by fiscal year 2017 and recently signed a memorandum of understanding (dated February 2013) on how they plan to share data between the systems until the migration is completed. In addition, according to these officials, DOD has developed a draft plan for how this migration is to be completed, but the plan has yet to be approved, and DOD was unable to provide us with documentation of this effort.

At HHS, the department had four potentially duplicative investments in Enterprise Information Security and two supporting Medicare Coverage. The four information security investments maintain and secure the operations and assets of HHS and its components. These investments were potentially duplicative because they had overlapping products and solutions which were procured separately to address similar requirements across HHS and its components. Department officials stated that, although the information security investments appear to be duplicative on the surface, these investments are not analogous to a system but, rather, fund information security functions, such as personnel, policy, and oversight for each component. Nonetheless, HHS officials stated that the department is currently conducting a review, to be completed by September 2013, to identify opportunities for consolidation of information security activities across its components. As part of this, officials said that HHS plans to use the Chief Information Security Officer council to gather uniform toolsets that can be used across the department to improve efficiencies.

The two Medicare coverage management systems—which are called the National Coverage Determination and Local Coverage Determination databases—collect and disseminate information regarding Medicare coverage on national and local levels, as well as Medicare policy and other related information to the public via a website. These systems were potentially duplicative because they store and disseminate similar Medicare information to the public, but are maintained separately by the same contractor. Department officials stated that the department has consolidated certain functions of the systems, such as help desk functions and website management, to reduce duplication and create efficiencies. With regard to the other functions, the officials said that they determined that consolidating these functions would be more costly than keeping them separate, due to issues such as differences in mandated processes, security requirements and the size and complexity of the systems, but were not able to provide documentation showing this cost analysis.

Conclusions

To the credit of DHS, DOD, and HHS, the vast majority of the IT investments examined did not appear to be duplicative. Nonetheless, those few identified as being potentially duplicative represent significant financial investments on behalf of these agencies and appeared in part to be unnecessary. In selected cases, DOD and HHS are acting to address and eliminate duplicative investments. In other instances, DHS, DOD, and HHS have not yet demonstrated evidence of plans to do so. As a result, the agencies cannot provide assurance they are not spending resources on duplicative investments.

Recommendations for Executive Action

To better ensure agencies avoid duplicative investments, we recommend that the Secretary of Homeland Security direct appropriate officials to: address the potentially duplicative investments identified in this report, including assessing the extent to which a single system could meet CBP and ICE immigration enforcement booking requirements.

We recommend that the Secretary of Defense direct appropriate officials to: develop and document a plan on how the department intends to migrate its single dental system solution to all the services.

We recommend that the Secretary of Health and Human Services direct appropriate officials to: assess whether it would be cost effective to consolidate the remaining functions of the Medicare coverage determination systems.

Agency Comments and Our Evaluation

In commenting on a draft of this report, DOD and HHS agreed with our recommendations. Specifically, In its written comments, DOD concurred with our recommendation. The department added that the Air Force and Army have already transitioned to the single dental system solution (the Corporate Dental Application). It also noted that the Navy is to do the same in fiscal year 2015 (with the exception of ship-based installations of the system which are not to be completed until fiscal year 2017 due to the ships’ limited availability for scheduling the installations). DOD’s comments are reprinted in appendix III.

In comments provided via email from its GAO audit liaison within the Office of the Chief Information Officer, HHS also concurred with our recommendation.

DHS, in its written comments—which are reprinted in appendix IV—stated it did not concur with our recommendation because the EAGLE and E3 investments have been reviewed by the DHS Chief Enterprise Architect and have been through DHS’s annual IT review processes and were found not to be duplicative. Specifically, DHS said that EAGLE and E3 share the same database, and the applications that access it were developed separately to facilitate mission-specific functions for ICE and CBP agents.

While we recognize that ICE and CBP developed their applications separately to facilitate mission-specific functions, we also note that these applications perform similar functions, such as capturing biographic information on apprehended illegal aliens, recording illegal alien arrest and enforcement incidents, and collecting biometric data on such aliens. We also note (and discuss in the report) that ICE was unable to provide analyses showing, among other things, that its specific requirements could not be satisfied by the E3 system. Until such an assessment is performed, DHS cannot provide assurance that it is not spending resources on duplicative immigration enforcement investments.

DOD, HHS, and DHS also provided technical comments, which we incorporated as appropriate.

If you or your staff have any questions on the matters discussed in this report, please contact me at (202) 512-9286 or at pownerd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix V.

Appendix I: Objective, Scope, and Methodology

Our objective was to identify whether there are potentially duplicative information technology (IT) investments at key federal agencies. More specifically, it was to identify the extent to which potentially duplicative IT investments exist within Office of Management and Budget (OMB) defined categories—such as defense and national security; disaster management; health; and homeland security—at the key agencies that reportedly spend the most on IT. To do this, we first selected for review the three agencies with the largest amount of planned IT spending during fiscal year 2012—namely, the Departments of Homeland Security (DHS), Defense (DOD), and Health and Human Services (HHS).

The FEA is intended to provide federal agencies and other decision makers with a common frame of reference or taxonomy for informing agencies’ individual enterprise architecture efforts and their planned and ongoing investment activities, and to do so in a way that identifies opportunities for avoiding duplication of effort and launching initiatives to establish and implement common, reusable, and interoperable solutions across agency boundaries.

This nongeneralizable sample of 590 IT investments was 8 percent of the 7,272 investments agencies reported on their exhibit 53s.The investments we reviewed represented approximately 10 percent of DOD’s IT portfolio in terms of number of investments that it reports to OMB, 31 percent of HHS’s, and 33 percent of DHS’s.

Within each subfunction, we then reviewed the name and narrative description of each investment’s purpose to identify similarities among related investments within each agency. Once we identified investments that had such similarities, we grouped them by mission purpose into categories (we described as purpose groups)—such as dental management and enterprise information security—that more specifically defined the purpose and mission of these similar investments.

Next, we compared the investments within these groupings to identify those that performed similar or overlapping functions. We then discussed these investments with the appropriate agency officials, including whether the investments could be consolidated or eliminated, and obtained additional information on each investment. This included reviewing and assessing agencies’ rationales for having multiple systems that perform similar functions. Further, to identify any actions agencies had taken to address the potentially duplicative investments we identified, we assessed agency documentation (e.g., agency memorandums, project plans) and interviewed officials. We also interviewed agency officials to identify the actions taken to consolidate, eliminate, or modify such investments.

We conducted this performance audit from November 2012 to September 2013 in accordance with generally accepted government auditing standards. Those standards required that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective.

Appendix II: Additional Information on Potentially Duplicative Investments

Table 4 provides information on the 12 potentially duplicative IT investments at DHS, DOD, and HHS we identified as potentially duplicative within the selected FEA categories (e.g., Health, Homeland Security, and Information and Technology Management).

Appendix III: Comments from the Department of Defense

Appendix IV: Comments from the Department of Homeland Security

Appendix V: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, individuals making contributions to this report included Gary Mountjoy (Assistant Director), Scott Borre, Rebecca Eyler, James MacAulay, and Teresa Smith.