Information Technology: Departments Need to Improve Chief Information Officers' Review and Approval of IT Budgets
Released: 2018-11-13T00:00:00

Letter

Background

In addition to improving the government-wide acquisition of IT, FITARA was intended to assist Congress in holding covered agencies accountable for their progress towards reducing duplication and achieving cost savings. The act also enhanced the CIO’s authority in covered agencies for the formulation and approval of their agency’s IT budgets. In this regard, the act requires CIOs to have a significant role in the decision processes for all annual and multi-year planning, and to approve the IT budget requests of the agency.

In June 2015, OMB released guidance that describes how agencies are to implement the requirements of FITARA. The guidance is intended to, among other things: assist agencies in aligning their IT resources with statutory requirements; establish government-wide IT management controls that will meet the law’s requirements, while providing agencies with flexibility to adapt to unique agency processes and requirements; strengthen the relationship between agency CIOs and component CIOs; and strengthen the CIO’s accountability for IT costs, schedules, performance, and security.

The guidance identifies a number of actions that agencies are to take to establish a basic set of roles and responsibilities (the common baseline) for CIOs and other senior agency officials. One such action is that agencies are to conduct a self-assessment to determine whether their current policies and procedures meet or do not meet the common baseline requirements. If the agencies do not meet the requirements, they are to submit an implementation plan describing the changes they intend to make to their policies and procedures in order to ensure that the common baseline requirements are met. Further, the guidance notes that senior agency officials—including Chief Financial Officers and Chief Acquisition Officers—are to work in partnership to facilitate successful implementation of the common baseline and to ensure the CIO is a strategic partner in agency strategies, budgets, and operations.

In its guidance, OMB states that agency CIOs are allowed to delegate certain responsibilities from the common baseline to other agency officials, such as component agency CIOs. For example, CIOs can delegate to these officials, inclusion in the planning, programming, and budgeting stages for programs with IT resources. However, according to the guidance, agency CIOs cannot delegate their responsibility for reviewing and approving the major IT investments portion of the budget request. The guidance further states that, for delegated responsibilities, agency CIOs are to establish plans that demonstrate how they will retain accountability. These delegation plans should include procedures for ensuring that the delegated official will execute the responsibility with the appropriate level of rigor.

In addition to the FITARA implementation guidance, OMB Circular A-130 establishes general requirements for the planning; budgeting; governance; acquisition; and management of federal information, personnel, equipment, funds, IT resources, and supporting infrastructure and services. The circular identifies responsibilities for planning, programming, and budgeting that reinforce requirements in OMB’s FITARA implementation guidance.

Moreover, in May 2018 the President issued an executive order that reinforces requirements in OMB’s FITARA implementation guidance. The order noted that its purpose was to further enhance the effectiveness of CIOs by, among other things, requiring agency heads to ensure that the CIO has a significant role in all IT-related annual and multi-year planning, programming, budgeting, and execution decisions. In addition, the executive order noted that agency heads are to direct the CIO to be a voting member of and to chair agency governance boards, including investment review boards, that have purview over IT or that set agency-wide IT standards.

We have previously testified that, while agencies have made progress in implementing FITARA, its further implementation is critical to improving IT management. We have also noted that, continued congressional oversight of agencies’ implementation of this law is essential to help ensure that these efforts succeed.

In addition, in an August 2018 report, we noted that 23 federal agencies had reported wide variations in the authority over component-level IT spending. For example, 8 agencies reported that the CIO had 100 percent authority over the agencies’ IT spending (including for components), while 10 agencies reported that these officials had authority for less than 50 percent of such spending. These widely varying levels of authority over agency-wide IT spending existed, in part, because OMB’s guidance did not completely define the authority that CIOs should have over this spending. Accordingly, we recommended that OMB define the authority that the CIOs are to have when agencies report on their authority over IT spending. OMB subsequently agreed with our recommendation.

Departments Took Steps to Establish Policies and Procedures for IT Budgeting, but Lacked Plans to Fully Implement FITARA Requirements

As previously mentioned, OMB’s guidance on implementing FITARA requires departments to develop policies and procedures to address a number of requirements identified in the basic set of roles and responsibilities (the common baseline) for CIOs. These include the eight selected common baseline requirements related to the CIO’s responsibility for IT budgeting. As identified in table 1, these requirements can be categorized into three areas: (1) CIO visibility into IT resources, (2) CIO input into IT resource plans, and (3) CIO review and approval of IT budgets.

OMB required federal agencies and departments to establish FITARA implementation plans that articulated policies and procedures for addressing each of the common baseline requirements and that described changes the departments intended to make to address any gaps in their policies and procedures. Further, for delegated responsibilities, OMB required agency CIOs to establish delegation plans that demonstrate how they intend to retain accountability for the requirement and ensure that the delegated official will execute the responsibility with the appropriate level of rigor.

Toward this end, the selected departments had taken steps to establish policies and procedures that addressed the common baseline requirements established by OMB; however, most of the departments, or their component agencies, lacked comprehensive policies and procedures that fully addressed all of the requirements. Specifically, of the eight common baseline requirements that we reviewed, all four departments and their respective component agencies had fully documented one requirement in their policies and procedures, and either had partially documented or had not documented the other seven requirements. While shortfalls existed for each department, DOJ had the most comprehensive IT budgeting policies and procedures, followed by Treasury, HHS, and DOE, respectively.

In addition, department CIOs at Treasury, HHS, and DOE had delegated many of the responsibilities for addressing the IT budgeting requirements to component CIOs—thus, these component agencies were to supplement their departments’ policies and procedures with their own IT budgeting policies and procedures for the responsibilities they were delegated.

Among the three respective component agencies to which Treasury, HHS, and DOE had delegated IT budgeting responsibilities, the extent to which the components had documented requirements in their policies and procedures varied. For example, IRS had documented policies and procedures for all four of its delegated requirements. In addition, CMS had documented policies and procedures that satisfied two, partially satisfied two, and did not satisfy one of the five requirements delegated to that component. For its part, NNSA had not documented any of its five delegated requirements in the component’s policies and procedures.

Figure 1 illustrates the extent to which all four departments’ policies and procedures had addressed the selected OMB common baseline requirements, and is followed by a discussion of each category of requirement. In addition, the figure highlights areas where component agencies addressed their delegated responsibilities or did not address their delegated responsibilities. Appendices II through V (for DOE, HHS, DOJ, and Treasury, respectively) provide additional details about our assessment of the extent to which the departments’ policies and procedures had addressed the selected OMB common baseline requirements, as well as the extent to which component agencies fulfilled their delegated responsibilities.

CIO Visibility into IT Resources

Establish the Level of Detail with Which IT Resources Are to Be Described in Order to Inform the CIO during the Planning and Budgeting Processes

All four departments had policies and procedures that addressed the level of detail with which IT resources are to be described in order to inform the CIO during the planning and budgeting processes. For example, three of the four departments (DOE, HHS, and Treasury) had policies that required the IT budget to include a description of IT resource categories that are required by OMB’s IT capital planning guidance, such as government labor and certain infrastructure resources. DOJ’s policy required the IT budget to include a description of 49 different IT resource categories. As a result, the departments have increased the likelihood that IT resources will be consistently described with the appropriate level of detail for the CIO.

Establish Agency-Wide Policy for the Level of Detail with Which Planned Expenditures for All Transactions That Include IT Resources Are to Be Reported to the CIO

Each of the four departments had documented within their IT budgeting procedures the level of detail that was required for reporting planned IT expenditures to the CIO. However, the procedures did not explicitly require that every transaction that related to IT resources be included in the planned expenditure reporting to the CIO. Without explicitly requiring that all transactions that have IT resources be included in the reporting of planned expenditures, there is increased risk that the CIO cannot ensure that all budget requests contain complete and accurate resource estimates, in a consistent manner, to inform the department’s annual IT budget.

CIO Input into IT Resource Planning

Include the CIO in the Planning and Budgeting Stages for Programs That Are Fully or Partially Supported with IT Resources

The departments varied in the extent to which their policies and procedures included a requirement for the department-level CIO to be included in programs supported with IT resources. For example, DOE and DOJ took steps to ensure that their CIOs are included in the planning and budgeting of programs with IT resources by requiring that each IT acquisition request include information about the investment in the CIO’s IT portfolio that is to support the acquisition. Adding this investment information to each acquisition request is intended to allow the CIO to ensure that the requests are factored into resource planning for the IT budget.

However, DOE’s, HHS’s, and Treasury’s policies and procedures did not always require that the CIO be included in the planning and budgeting stages for every program with IT resources. For example, DOE’s policies called for the CIO to be included in the budget development process by requiring the program offices to submit their IT budget to the CIO for review and approval annually. On the other hand, this policy did not apply to NNSA’s IT programs because the responsibility to meet this requirement was delegated to that component.

NNSA drafted procedures to carry out the delegated responsibility, but the procedures did not call for the DOE CIO—in addition to the component-level CIO—to have input into the IT budget, as required by the Secretary of Energy’s October 2016 FITARA implementation memorandum. According to officials in NNSA’s Office of the CIO, the component expects to finalize the procedures by the end of August 2018; however, the officials did not say whether the finalized procedures would include a requirement for NNSA to obtain input from the DOE CIO on its IT budget. By not requiring that the department-level CIO be included in the planning and budgeting stages for programs that are fully or partially supported with IT resources, DOE, HHS, and Treasury are at increased risk that the CIO is not providing input into key IT resource planning decisions.

Include the CIO as a Member of Governance Boards That Inform Decisions Regarding All IT Resources, Including Component-Level Governance Boards

The charters for all four department-level investment review boards that inform decisions regarding IT resources indicated that their respective CIOs were included as members. In addition, the charters for component-level investment review boards that inform decisions regarding IT resources at CMS and IRS included their respective component-level CIOs. However, a similar review board at FBI did not include the component-level CIO as a member and NNSA had not yet finalized its charter. Further, none of the charters for the selected components’ investment review boards indicated that the department-level CIOs were members.

Among the three CIOs at DOE, HHS, and Treasury that had delegated the responsibility of component-level board membership to component CIOs, the department-level CIOs at these agencies had not established procedures for ensuring that the components had implemented this responsibility, as required by OMB. As previously mentioned, while department CIOs were allowed to delegate this responsibility, OMB requires department CIOs to establish delegation plans that describe each requirement being delegated, demonstrate how the department CIOs will retain accountability for the requirement, and ensure that the delegated official executed the responsibility with the appropriate level of rigor. By not requiring that the department-level CIO be included in key governance board decisions regarding IT investments or establishing delegation plans that outline such activities for component CIOs, the selected departments are at increased risk that the CIO is not providing input into key IT resource planning decisions.

Document the Processes by Which Program Leadership Works with the CIO to Plan an Overall Portfolio of IT Resources

Departments varied in the extent to which they had documented the process by which program leadership is to work with the CIO to plan an overall portfolio of IT resources. For example, DOJ and Treasury documented a detailed process with roles and responsibilities for how program leadership is to work with their CIOs to plan resources for the overall portfolio through their IT governance process.

However, DOE and HHS had partially documented the process they were to follow to meet this requirement. Specifically, these departments documented that they were to utilize department-level governance boards to plan IT resources with program leadership for investments subject to the governance board reviews. However, they did not always document how CIOs were to work with program leadership in planning IT resources for other investments that were not subject to department-level governance board reviews, such as existing HHS investments that are greater than or equal to $20 million annually and DOE investments initiated by NNSA. As a result of shortfalls in documenting policies and procedures that require the CIO to work with program leadership to plan the IT portfolio, DOE and HHS are at an increased risk that the CIO’s role in the formulation of IT budgets is limited.

CIO Review and Approval of the IT Budget Request

Ensure the CIO Has Reviewed and Approved the Major IT Investments Portion of the Budget Request

The four selected departments varied in the extent to which they had documented in their policies and procedures how their CIOs are to review and approve the major IT investments portion of the budget request. For example, DOJ had a documented process for how the CIO is to review and approve all major IT investments through the department’s annual budget planning and IT portfolio review processes.

In contrast, the other three departments partially addressed the requirement by documenting the requirement to review and approve certain major investments, but not all major investments. To illustrate, DOE documented policies and procedures that required the CIO to review major IT investments, but the policies and procedures did not apply to major IT investments within NNSA and the national laboratories, including those related to high-performance computing.

Further, NNSA had draft policies and procedures requiring its component-level CIO to review major IT investments. However, these policies and procedures had not yet been finalized and approved, and they did not include a requirement for the DOE CIO’s review of these investments. Moreover, the department had not developed policies and procedures stipulating this requirement for the national laboratories. While officials in the department’s Office of the CIO stated that they plan to revise policies and procedures for the national laboratories to include the CIO in their annual planning processes, the officials did not identify a time frame for completing those revisions.

As another example, HHS had documented a process that required the department-level CIO to review and approve new major IT investments greater than or equal to $20 million. In addition, the process required that the review and approval of new and existing major investments between $10 million and $20 million annually be delegated to the department’s component CIOs. Accordingly, CMS met this requirement at the component level by documenting IT investment review board policies and procedures that require the component CIO to review and approve major, high-risk, and mission critical IT investments with estimated costs of less than $20 million. However, HHS did not fully address the department-level requirement in that its process did not document how the department-level CIO would review and approve existing (as opposed to new) major investments greater than or equal to $20 million annually. As a result of not fully documenting the process for how the departments are to meet this requirement, DOE, HHS, and Treasury are at increased risk that major investments will be submitted for the budget without being reviewed and approved by the CIO.

Ensure the CIO Has Reviewed IT Resources That Are to Support Major Program Objectives and Significant Increases and Decreases in IT Resources

The departments we reviewed varied in the extent to which they had documented in their policies and procedures how they are to ensure that the CIO has reviewed IT resources that are to support major program objectives and significant increases and decreases in resources. For example, DOJ and Treasury had documented in their policies and procedures their CIOs’ role in reviewing IT resources that support major program objectives and significant increases and decreases in their resources.

However, the other two departments—HHS and DOE—had not documented this role for their CIOs. Specifically, HHS policies and procedures did not include a requirement for the CIO to review significant increases and decreases in IT resources. In addition, the HHS CIO delegated to component-level CIOs the responsibility to review IT resources that support major program objectives for investments of less than $20 million annually. However, HHS had not established procedures for ensuring its components carried out the responsibility, and the component agency we selected—CMS—did not include this requirement in its procedures.

Similarly, DOE had not documented procedures for the department-level CIO’s role in reviewing IT resources that support major program objectives and significant increases and decreases in IT resources. For NNSA programs, DOE delegated the responsibility to the NNSA CIO. However, NNSA had not documented the NNSA CIO’s role in reviewing planned IT support for major program objectives, as well as significant increases and decreases in IT resources. Until DOE and HHS develop policies and procedures that include how the CIO is to review whether each investment’s IT resources support major program objectives and have increased or decreased significantly, they will have less assurance that the IT budget request consistently supports the departments’ goals and objectives and that the CIOs have approved significant changes in the budget.

Ensure the CIO Has Reviewed Whether the IT Portfolio Includes Appropriate Estimates of All IT Resources Included in the Budget Request

None of the four departments had documented in their policies and procedures how their CIOs are to ensure, as part of the IT budget review and approval process, that the IT portfolio includes appropriate estimates of all resources. Specifically, DOE, HHS, Treasury, and DOJ had not documented in their policies and procedures the necessary steps that their CIOs would need to take in order to ensure that the portfolios included the appropriate estimates of all IT resources in the budget requests.

In addition, Treasury delegated this responsibility to its component CIOs for component-level investments, and IRS had documented procedures for validating the estimates of all IT resources for the IRS budget request. However, Treasury did not document the necessary steps to ensure that its delegated authorities were being carried out, as required by OMB.

Without documented policies and procedures for the steps the CIO is to take to review whether the IT portfolio includes appropriate estimates of all IT resources included in the budget request or delegation plans that outline such activities for component CIOs, the selected departments may be limited in their ability to assure that their CIOs are effectively positioned to consistently and adequately review and approve the IT budget request.

Gaps in Departments’ FITARA Implementation and Delegation Plans

The shortcomings in the four departments’ policies and procedures related to CIO visibility into IT resources, CIO input into IT resource planning, and CIO review and approval of the IT budget request were due, in part, to having not addressed in their FITARA implementation and delegation plans how they intended to implement the OMB common baseline requirements.

For example, none of the four departments’ FITARA implementation plans addressed how they intended to implement the requirement that all transactions related to IT resources be included in planned expenditure reporting to the CIO. These departments’ implementation plans also did not address the requirement that the CIO review whether the IT portfolio includes appropriate estimates of all IT resources identified in the budget request. Officials in DOE’s Office of the CIO stated that the department is in the process of determining ways to add specific review criteria to its capital planning policies and procedures to identify how the department is to review the appropriateness of IT resources in the portfolio. Had such procedures been documented and identified in the department’s FITARA implementation plan, it would have been better positioned to demonstrate how this common baseline requirement is being addressed.

In addition, the HHS and Treasury FITARA delegation plans did not address how their CIOs would ensure components carried out their responsibilities for reviewing and approving the IT budget request. Officials in HHS’s Office of the CIO stated that delegation memorandums issued to their components included procedures for ensuring components carried out their responsibilities. However, the delegation plans they provided to us did not include such procedures. Officials in Treasury’s Office of the CIO stated that they did not believe that it was their responsibility to have procedures for verifying that components are carrying out their delegated responsibilities because they viewed it as an audit function. However, having such procedures is called for by OMB’s FITARA implementation guidance.

Without FITARA implementation plans that address the shortfalls in policies and procedures for ensuring the implementation of OMB’s common baseline requirements, departments have limited assurance that their CIOs will implement the requirements as intended by OMB and FITARA. In addition, without identifying the steps within the FITARA delegation plans that departments intend to take to ensure the responsibilities delegated to components are appropriately carried out, the departments may have limited assurance that these actions have been taken.

Selected Departments Demonstrated Mixed Implementation of IT Budgeting Requirements in Developing Fiscal Year 2017 Budgets for a Sample of Investments

While it is important for federal agencies to establish policies and procedures that describe how they are to carry out IT budgeting requirements identified in FITARA and OMB guidance, it is equally important for them to implement the requirements when planning and budgeting for individual IT investments and to retain supporting documentation that would demonstrate that they have done so. Among the eight selected OMB common baseline requirements related to IT budgeting, five of the requirements are applicable at the individual investment level. Table 2 shows how these five common baseline requirements would be implemented at the individual investment level, as well as the related categories.

The selected departments and their respective component agencies varied in the extent to which they could demonstrate that they had implemented the five common baseline requirements when developing their fiscal year 2017 funding requests for 16 sampled investments.

Figure 2 and the subsequent discussion summarize the extent to which the departments and their component agencies could demonstrate that they had implemented the five requirements in developing fiscal year 2017 budgets for the sample of investments that we reviewed. As described earlier, we reviewed the largest major and non-major investment for each of the four departments and four component agencies. In addition, appendices II through V provide further details about our assessments of the extent to which the departments and component agencies demonstrated that they had implemented the five requirements.

CIO Visibility into IT Resources

IT Resources for Each Investment Are Described in Order to Inform the CIO during the Planning and Budgeting Processes

For the investments that we reviewed, the departments and their components varied in the extent to which they could demonstrate that they had described their investments’ IT resources. For example, DOJ and Treasury described specific IT resources, such as costs for personnel and software, in spreadsheets or databases for processing annual requests for resources for each proposed IT investment.

Conversely, HHS and DOE did not fully describe in supporting documentation their respective IT resources for their investments included in our review. For example, HHS could not demonstrate that it had described the department-level non-major investment’s IT resources. In addition, although HHS described non-labor resources that were allocated for a portion of the sampled department-level major investment, the department did not describe labor resources for the investment. HHS also could not account for the investment’s entire funding request— leaving nearly $17 million in resources that were not described. Officials in HHS’s Office of the CIO were unable to explain why supporting documentation for the investment only accounted for a portion of the investment’s total funding request, and not the entire request.

HHS and DOE officials provided various reasons as to why their departments did not describe in supporting documentation all of the IT resources associated with the investments we sampled. For example, HHS could not demonstrate that it had described IT resources for the non-major investment that we reviewed because officials in the Office of the CIO did not have the supporting documentation associated with its funding request. In addition, according to officials in HHS’s Office of the CIO, the department’s omission of required labor resources from program office artifacts supporting the funding request for the department-level major investment was an oversight. According to the officials, during the budget formulation cycle, the department did not consistently maintain documentation for its investments that would describe the IT resources and lacked a mature governance process for reviewing the IT resources associated with the investment.

Moreover, officials in DOE’s Office of the CIO stated that the department’s budgeting procedures did not call for clearly identifying specific IT resources. However, at a minimum, DOE’s budgeting procedures required that the budget estimate for investments include planned government labor expenditures.

Until HHS and DOE describe IT resources within their investments, the CIO may have limited visibility into what the resources are that are being requested in the annual IT budget.

CIO Input into IT Resource Planning

The CIO Is Included in the Planning and Budgeting Stages for Investments with IT Resources

The extent to which each of the four departments’ could demonstrate that their CIOs were included in the planning and budgeting stages for the sampled investments with IT resources varied. Specifically, of the four investments we reviewed for each agency, DOJ and its component included the CIO in the planning and budgeting stages via an annual IT portfolio review that included the four sampled investments.

On the other hand, HHS, Treasury, and DOE—along with their components—could not always demonstrate that the department-level CIO was included for their investments. For example, within HHS, its component agency—CMS—partially implemented the requirement for both of the sampled investments. Specifically, CMS documented the CIO’s review and approval of each investment’s detailed IT resource estimates during governance board reviews. However, HHS’s supporting documentation did not demonstrate that the department CIO was involved in the planning process for these investments even though its capital planning and investment control policy required this official to review, validate, and approve these IT investments through the department-level review board.

Further, Treasury could not demonstrate that the department’s CIO was included in the planning and budgeting stages for the two department-level investments that we reviewed. According to officials in Treasury’s Office of the CIO, the relevant documentation was not retained for the selected department-level investments because procedures were not in place to document reviews by the CIO and certain artifacts that may have documented such reviews were no longer available in part due to employee turnover within the program offices responsible for the investments. Until DOE, HHS, and Treasury include the CIO in the planning and budgeting stages for investments with IT resources, they may be at risk of duplicating resources or funding investments without the CIO’s knowledge or approval.

Program Leadership Works with the CIO to Plan the Investment’s IT Resources

The selected departments varied in their ability to demonstrate that their CIOs worked with program leadership across the investments we sampled for the fiscal year 2017 funding request—both within and across the departments. For example, DOJ demonstrated that the CIO worked with program leaders in planning IT resources for both the major and non-major investment at the department level by jointly developing a plan for how business units were to utilize funds for IT services. At the component-level, FBI demonstrated that IT officials assisted program leadership in the planning of the major investment, but could not demonstrate that the CIO worked with program leadership on both the major and non-major investment.

In addition, HHS fully demonstrated that the CIO worked with program leaders in planning IT resources for its major investment. For example, the CIO reviewed detailed IT resource narratives and line item estimates for the investment at a department-level governance board meeting with program leadership. However, HHS could not demonstrate that the CIO worked with program leadership to plan the non-major investment. At the component-level, CMS partially demonstrated that the CIO took such actions to plan the component-level investments. Specifically, the CIO at CMS worked with program officials to review and approve detailed IT resource requests for the investments. However, HHS could not demonstrate that its CIO was also involved in planning IT resources with program leadership for the same investments, as required by the department’s policy. Officials in the Office of the CMS CIO stated that they believed that the CMS CIO was an authorized delegate for this responsibility. However, the officials could not provide documentation of the delegation as required by OMB.

Further, Treasury could not demonstrate that the CIO had worked with program leadership in planning IT resources for the department-level investments. According to officials in the Office of the CIO, they could not demonstrate the actions the CIO took to work with program leadership because documentation that would show the interaction was not retained. The officials stated that documentation was not retained due to turnover within the program offices responsible for the investments. At the component-level, IRS partially demonstrated that the CIO took action to work with program leadership for a portion of the component-level investments’ budget through IT budget reviews. However, IRS could not demonstrate coordination with program leadership for the full amount of the investments’ budget because the agency did not maintain a document trail for lower-level budgeting activities that included all relevant resource planning for the investments.

Lastly, DOE could not fully demonstrate that the CIO had worked with program leadership in planning IT resources across all four investments at the department and component. DOE could not demonstrate this, in part, because the Office of the CIO’s internal process, during the formulation of the fiscal year 2017 budget, did not require input from all relevant stakeholders, including senior leadership, directors, and program managers. Officials in DOE’s Office of the CIO acknowledged the gap in its process and stated that the department and its component agency— NNSA—are working to establish processes that include senior management and program officials in the planning process. As of May 2018, DOE did not have a time frame for establishing these processes.

The lack of consistent partnership of program leaders and the CIO to plan an investment’s IT resources at the department and component levels limits the ability of the CIO to have a significant role in the formulation of the department’s IT budget.

CIO Review and Approval of IT Budgets

The CIO Reviews Whether the Investment’s IT Resources Support Major Program Objectives and Have Increased or Decreased Significantly

The selected departments varied in the extent to which they could demonstrate that the CIO had appropriately reviewed all the investments we sampled. For example, DOJ demonstrated that the CIO reviewed whether the IT resources for the department- and component-level investments supported major program objectives and whether there were increases and decreases in IT resources for the investments.

In addition, HHS partially addressed the requirement for its component-level investments. Specifically, while the component-level CIO at CMS reviewed changes in the investments’ resources, supporting documentation did not show that alignment with major program objectives was reviewed.

Further, Treasury and DOE could not demonstrate that their CIOs reviewed whether the investment’s IT resources support major program objectives and any significant increases or decreases in resources for their department-level investments. According to officials in the offices of the CIO at Treasury and DOE, relevant documentation that would have demonstrated review activities had not been maintained for the investments. Until DOE, HHS, and Treasury can consistently demonstrate that the CIO has reviewed whether each investment’s IT resources support major program objectives and have increased or decreased significantly, the departments will have less assurance that the IT budget request supports their goals and objectives and that significant changes in the budget are appropriate.

The CIO Reviews Whether the Investment’s Estimates of IT Resources in the Portfolio and Budget Request Are Appropriate

The selected departments varied in the extent to which they could demonstrate that the CIO took steps to review whether the investment’s estimates of IT resources in the portfolio and budget request were appropriate.

For example, the CIO for DOE’s component agency—NNSA— demonstrated the review and approval of the non-major investment’s estimates of IT resources. However, NNSA could not demonstrate that the CIO reviewed the estimates for the major investment because it did not retain documentation that would provide details on the investment’s budget formulation and approval.

In addition, HHS’s component agency—CMS—partially demonstrated implementation of the requirement on the major investment. Specifically, the CIO for CMS reviewed and approved supporting documentation for the investment’s detailed resource estimates totaling more than $500 million in developing the fiscal year 2017 budget request. However, the fiscal year 2017 budget request for this investment was $399 million, and according to officials in the CMS Office of the CIO, the CMS CIO did not review and approve the lowered estimate—ensuring the IT portfolio reflected an appropriate estimate.

According to CMS officials in the Office of the CIO, the lowered estimate was the result of the user fees portion of the investment being removed from the request before it was submitted to OMB because it was not funded by annual appropriations. However, OMB’s fiscal year 2017 IT capital planning guidance required departments to report all budgetary sources of funding for each investment, including amounts available for obligation through collection of fees, as well as annual appropriations.

Further, Treasury could not demonstrate that the CIO had reviewed the resource estimates for the department-level investments. At the component level, IRS demonstrated that officials in the Office of the CIO reviewed supporting documentation for detailed cost estimates for the component-level investments. However, these cost estimates only accounted for a portion, and not the full amount, of the investment.

Finally, DOJ could not demonstrate that the component agency CIO ensured that the IT portfolio included appropriate estimates of all IT resources for the non-major investment at the component level. While officials in the FBI’s Office of the CIO stated that the component’s CIO was involved in reviewing detailed resource estimates for the investment prior to its submission to the department-level CIO, they could not provide supporting documentation because the FBI had not established procedures that explicitly required documenting the performance of this activity. Until the CIOs at DOE, HHS, Treasury, and DOJ consistently review IT resource estimates for each investment, departments will have less assurance that the estimates in the budget request are appropriate.

Departments Lacked Processes for Ensuring That Their IT Budgets Are Informed by Reliable Costs; the Administration Has Introduced an Initiative to Improve Cost Visibility

GAO and international standards recommend certain quality assurance practices that can assist departments in developing an IT budget that is informed by reliable cost information. These practices include, among others: (1) ensuring government labor costs have been accurately reported for all investments, (2) aligning contract costs with the investments, and (3) utilizing budget object class data to capture all IT programs. Further, having documented IT capital planning processes to implement these practices is important because OMB requires department CIOs to fully account for and report on planned expenditures in their annual IT budget requests.

All of the four selected departments—DOE, HHS, DOJ, and Treasury— lacked quality assurance processes to ensure government labor costs have been accurately reported, align contract costs with IT investments, and utilize budget data to capture all IT programs. However, OMB’s fiscal year 2019 IT capital planning guidance introduced several major changes to the budgeting process which, if effectively implemented, should provide departments and CIOs with enhanced visibility into IT costs across the portfolio and additional assurance that the budget is being informed by all relevant IT costs.

The Administration’s Efforts to Revise IT Budget Reporting Could Provide Department CIOs Additional Visibility into IT Spending

OMB’s fiscal year 2019 IT capital planning guidance, released in August 2017, introduced several major changes to the federal IT budgeting process, including the practice of using a set of low-level cost categories to group spending. Subsequently, the President’s Management Agenda, released in March 2018, identified “improving outcomes through federal IT spending transparency” as one of the Administration’s 14 cross-agency priority goals.

According to the President’s Management Agenda, the Administration intends to accomplish the cross-agency priority goal related to improving federal IT spending transparency by, among other things, increasing the granularity in IT budget reporting by utilizing a set of cost categories from OMB’s capital planning guidance. Figure 3 identifies the standard cost categories that OMB plans to implement in IT budget reporting.

In its fiscal year 2019 IT capital planning guidance, OMB has recognized potential value in utilizing budget object classes, or similar financial data, to provide CIOs and Chief Financial Officers additional visibility into costs that inform the budget. As noted in the guidance, OMB expects that this new approach for utilizing financial data to inform the IT investment portfolio will enable the reconciliation of this portfolio with the department’s budget submitted by the Chief Financial Officer. Further, this effort is to help CIOs work more closely and in partnership with the Chief Financial Officers by using budget object classes and sub-object classes as a way to reconcile different presentations of estimated costs. In addition, OMB’s guidance stated that departments should begin to identify where they lack capabilities or resources to deliver financial data for the new low-level IT cost categories (shown in figure 3), consider what changes are necessary to achieve the new reporting requirements, and take steps to align reporting with the categories.

Moreover, the President’s Management Agenda stated that the changes to how IT spending is to be categorized were made, in part, because federal executives have long known that they could better manage the more than $90 billion in federal government IT spending with increased visibility and more accurate data. The President’s Management Agenda action plan identified several milestones and due dates for accomplishing the goal of improving federal IT spending transparency, such as determining data sources necessary for departments to report within the low-level cost categories and establishing the common tools and services for the required reporting by June 2019. Moreover, the action plan stated that federal departments are expected to report all of the spending within their IT portfolio against the cost categories by September 2019. Given that improving federal IT spending transparency has been identified as one of the President’s top 14 management priorities and is critical to enabling department CIOs in carrying out their IT budgeting authorities from FITARA, it is important that OMB and departments take action now in order to meet the 2019 reporting requirements.

The Administration’s approach for obtaining additional granularity on department IT investment spending, when implemented, should provide departments and CIOs enhanced visibility into IT costs across the portfolio. If implemented effectively, this approach could also provide departments additional assurance that their budgets are being informed by relevant IT costs.

Conclusions

Recognizing the importance of CIOs’ ability to be responsible for IT budgeting, OMB’s common baseline includes eight requirements that departments’ policies and procedures should address to implement FITARA. While the four selected departments in our review either fully or partially addressed the majority of the requirements, none fully addressed all of them. The lack of policies and procedures was due, in part, to the fact that departments had not adequately addressed all of the required common baseline requirements in their FITARA implementation and delegation plans, as directed by OMB. Until the departments establish policies and procedures that address all requirements, they risk inconsistently applying requirements that are key to providing their CIOs visibility into resources, input to resource plans, and meaningful review and approval of IT budgets.

In addition, the lack of policies and procedures has hampered the departments’ ability to demonstrate their implementation of the common baseline requirements for their investments. While DOJ fully demonstrated implementation for the selected requirements for the majority of the investments we sampled, HHS and Treasury partially demonstrated implementation for a majority of their investments, and DOE had not demonstrated implementation for the majority of its investments. As a result, departments were not always able to show that these CIOs had adequate input to resource plans and review of their IT budgets. Without retaining supporting documentation to show how common baseline requirements have been addressed on individual investments, the departments will be challenged in consistently demonstrating that CIOs are sufficiently involved in planning and budgeting annual IT expenditures.

Finally, the four selected departments lacked quality assurance processes for ensuring their IT budgets are informed by reliable cost information. This resulted in billions of dollars that were requested without departments having comprehensive information to support those requests. Among other things, this was due to a lack of processes for periodically reviewing data quality and estimation methods for government labor estimates, as well as a lack of processes to cross-walk IT spending data in their procurement and accounting systems with investment data in their IT portfolio management systems.

The Administration’s new approach of using a standard set of low-level cost categories to group IT spending could help departments address their lack of processes if properly implemented. It is important that OMB and departments meet the 2019 milestone dates associated with this approach so that department CIOs have additional transparency into IT spending and can make informed budget decisions. Nonetheless, departments will continue to have limited insight into IT budgeting until they capture all relevant IT costs in their budgets.

Recommendations for Executive Action

We are making a total of 43 recommendations, including 9 to DOE, 6 to NNSA, 10 to HHS, 4 to CMS, 4 to DOJ, 1 to FBI, 8 to Treasury, and 1 to IRS.

The Secretary of Energy should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department’s FITARA plans by developing and implementing policies and procedures that establish department-wide policy for the level of detail of planned expenditure reporting to the CIO for all transactions that include IT resources. (Recommendation 1)

The Secretary of Energy should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department’s FITARA plans by developing and implementing policies and procedures that include the CIO in the planning and budgeting stages for all programs that are fully or partially supported with IT resources. (Recommendation 2)

The Secretary of Energy should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department’s FITARA plans by developing and implementing policies and procedures that include the CIO as a member of governance boards that inform decisions regarding all IT resources, including component-level boards. (Recommendation 3)

The Secretary of Energy should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department’s FITARA plans by developing and implementing policies and procedures that document the processes by which program leadership works with the CIO to plan an overall portfolio of IT resources. (Recommendation 4)

The Secretary of Energy should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department’s FITARA plans by developing and implementing policies and procedures that document the process for the CIO’s review and approval of the major IT investments portion of the budget request. (Recommendation 5)

The Secretary of Energy should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department’s FITARA plans by developing and implementing policies and procedures that document the CIO’s role in reviewing IT resources that are to support major program objectives and significant increases and decreases in IT resources. (Recommendation 6)

The Secretary of Energy should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department’s FITARA plans by developing and implementing policies and procedures that document the steps the CIO is to take to ensure whether the IT portfolio includes appropriate estimates of all IT resources included in the budget request. (Recommendation 7)

The Secretary of Energy should direct the Office of the CIO and other offices, as appropriate, to take steps to ensure that the actions taken to comply with OMB’s common baseline for implementing FITARA on individual investments are adequately documented. (Recommendation 8)

The Secretary of Energy should ensure that the Office of the CIO and other offices, as appropriate, establish quality assurance processes— such as data quality checks, reviews of estimation methods, linkages between the IT portfolio and procurement system data, and linkages between the IT portfolio and financial system data—for ensuring the annual IT budget is informed by complete and reliable information on anticipated government labor, contract, and other relevant IT expenditures. (Recommendation 9)

The Administrator of NNSA should ensure that the Office of the CIO and other offices, as appropriate, develop and implement policies and procedures that establish agency-wide policy for the level of detail with which planned expenditures for all transactions that include IT resources are to be reported to the CIO. (Recommendation 10)

The Administrator of NNSA should ensure that the Office of the CIO and other offices, as appropriate, develop and implement policies and procedures that include the CIO in the planning and budgeting stages for all programs that are fully or partially supported with IT resources. (Recommendation 11)

The Administrator of NNSA should ensure that the Office of the CIO and other offices, as appropriate, develop and implement policies and procedures that include the CIO as a member of governance boards that inform decisions regarding all IT resources. (Recommendation 12)

The Administrator of NNSA should ensure that the Office of the CIO and other offices, as appropriate, develop and implement policies and procedures that document the process for the CIO’s review and approval of the major IT investments portion of the budget request. (Recommendation 13)

The Administrator of NNSA should ensure that the Office of the CIO and other offices, as appropriate, develop and implement policies and procedures that document the CIO’s role in reviewing IT resources that are to support major program objectives and significant increases and decreases in IT resources. (Recommendation 14)

The Administrator of NNSA should direct the Office of the CIO and other offices, as appropriate, to take steps to ensure that the actions taken to comply with OMB’s common baseline for implementing FITARA on individual investments are adequately documented. (Recommendation 15)

The Secretary of Health and Human Services should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department’s FITARA plans by developing and implementing policies and procedures that establish department-wide policy for the level of detail of planned expenditure reporting to the CIO for all transactions that include IT resources. (Recommendation 16)

The Secretary of Health and Human Services should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department’s FITARA plans by developing and implementing policies and procedures that include the CIO in the planning and budgeting stages for all programs that are fully or partially supported with IT resources. (Recommendation 17)

The Secretary of Health and Human Services should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department’s FITARA plans by developing and implementing policies and procedures that include the CIO as a member of governance boards that inform decisions regarding all IT resources, including component-level boards. (Recommendation 18)

The Secretary of Health and Human Services should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department’s FITARA plans by developing and implementing policies and procedures that document the processes by which program leadership works with the CIO to plan an overall portfolio of IT resources. (Recommendation 19)

The Secretary of Health and Human Services should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department’s FITARA plans by developing and implementing policies and procedures that document the process for the CIO’s review and approval of the major IT investments portion of the budget request. (Recommendation 20)

The Secretary of Health and Human Services should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department’s FITARA plans by developing and implementing policies and procedures that document the CIO’s role in reviewing IT resources that are to support major program objectives and significant increases and decreases in IT resources. (Recommendation 21)

The Secretary of Health and Human Services should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department’s FITARA plans by developing and implementing policies and procedures that document the steps the CIO is to take to ensure whether the IT portfolio includes appropriate estimates of all IT resources included in the budget request. (Recommendation 22)

The Secretary of Health and Human Services should direct the department CIO to establish, for any OMB common baseline requirements that are related to IT budgeting that have been delegated, a plan that specifies the requirement being delegated, demonstrates how the CIO intends to retain accountability for the requirement, and ensures through quality assurance processes that the delegated official will execute such responsibilities with the appropriate level of rigor. (Recommendation 23)

The Secretary of Health and Human Services should direct the Office of the CIO and other offices, as appropriate, to take steps to ensure that the actions taken to comply with OMB’s common baseline for implementing FITARA on individual investments are adequately documented. (Recommendation 24)

The Secretary of Health and Human Services should ensure that the Office of the CIO and other offices, as appropriate, establish quality assurance processes—such as data quality checks, reviews of estimation methods, linkages between the IT portfolio and procurement system data, and linkages between the IT portfolio and financial system data—for ensuring the annual IT budget is informed by complete and reliable information on anticipated government labor, contract, and other relevant IT expenditures. (Recommendation 25)

The Administrator of CMS should ensure that the Office of the CIO and other offices, as appropriate, develop and implement policies and procedures that include the CIO in the planning and budgeting stages for all programs that are fully or partially supported with IT resources. (Recommendation 26)

The Administrator of CMS should ensure that the Office of the CIO and other offices, as appropriate, develop and implement policies and procedures that document the processes by which program leadership works with the CIO to plan an overall portfolio of IT resources. (Recommendation 27)

The Administrator of CMS should ensure that the Office of the CIO and other offices, as appropriate, develop and implement policies and procedures that document the CIO’s role in reviewing IT resources that are to support major program objectives and significant increases and decreases in IT resources. (Recommendation 28)

The Administrator of CMS should direct the Office of the CIO and other offices, as appropriate, to take steps to ensure that the actions taken to comply with OMB’s common baseline for implementing FITARA on individual investments are adequately documented. (Recommendation 29)

The Attorney General should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department’s FITARA plans by developing and implementing policies and procedures that establish department-wide policy for the level of detail of planned expenditure reporting to the CIO for all transactions that include IT resources. (Recommendation 30)

The Attorney General should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department’s FITARA plans by developing and implementing policies and procedures that include the CIO as a member of governance boards that inform decisions regarding all IT resources, including component-level boards. (Recommendation 31)

The Attorney General should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department’s FITARA plans by developing and implementing policies and procedures that document the steps the CIO is to take to ensure whether the IT portfolio includes appropriate estimates of all IT resources included in the budget request. (Recommendation 32)

The Attorney General should ensure that the Office of the CIO and other offices, as appropriate, establish quality assurance processes—such as data quality checks, reviews of estimation methods, linkages between the IT portfolio and procurement system data, and linkages between the IT portfolio and financial system data—for ensuring the annual IT budget is informed by complete and reliable information on anticipated government labor, contract, and other relevant IT expenditures. (Recommendation 33)

The FBI Director should direct the Office of the CIO and other offices, as appropriate, to take steps to ensure that the actions taken to comply with OMB’s common baseline for implementing FITARA on individual investments are adequately documented. (Recommendation 34)

The Secretary of the Treasury should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department’s FITARA plans by developing and implementing policies and procedures that establish department-wide policy for the level of detail of planned expenditure reporting to the CIO for all transactions that include IT resources. (Recommendation 35)

The Secretary of the Treasury should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department’s FITARA plans by developing and implementing policies and procedures that include the CIO in the planning and budgeting stages for all programs that are fully or partially supported with IT resources. (Recommendation 36)

The Secretary of the Treasury should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department’s FITARA plans by developing and implementing policies and procedures that include the CIO as a member of governance boards that inform decisions regarding all IT resources, including component-level boards. (Recommendation 37)

The Secretary of the Treasury should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department’s FITARA plans by developing and implementing policies and procedures that document the process for the CIO’s review and approval of the major IT investments portion of the budget request. (Recommendation 38)

The Secretary of the Treasury should ensure that the Office of the CIO and other offices, as appropriate, address gaps in the department’s FITARA plans by developing and implementing policies and procedures that document the steps the CIO is to take to ensure whether the IT portfolio includes appropriate estimates of all IT resources included in the budget request. (Recommendation 39)

The Secretary of the Treasury should direct the department CIO to establish, for any OMB common baseline requirements that are related to IT budgeting that have been delegated, a plan that specifies the requirement being delegated, demonstrates how the CIO intends to retain accountability for the requirement, and ensures through quality assurance processes that the delegated official will execute such responsibilities with the appropriate level of rigor. (Recommendation 40)

The Secretary of the Treasury should direct the Office of the CIO and other offices, as appropriate, to take steps to ensure that the actions taken to comply with OMB’s common baseline for implementing FITARA on individual investments are adequately documented. (Recommendation 41)

The Secretary of the Treasury should ensure that the Office of the CIO and other offices, as appropriate, establish quality assurance processes—such as data quality checks, reviews of estimation methods, linkages between the IT portfolio and procurement system data, and linkages between the IT portfolio and financial system data—for ensuring the annual IT budget is informed by complete and reliable information on anticipated government labor, contract, and other relevant IT expenditures. (Recommendation 42)

The IRS Commissioner should direct the Office of the CIO and other offices, as appropriate, to take steps to ensure that the actions taken to comply with OMB’s common baseline for implementing FITARA on individual investments are adequately documented. (Recommendation 43)

Agency Comments and Our Evaluation

We provided a draft of this report to the four departments and four component agencies included in our review, as well as to OMB. In response, we received comments from two departments and three component agencies (HHS, CMS, DOJ, FBI, and IRS) which agreed with our recommendations. One department (DOE) partially agreed with one recommendation and agreed with the other recommendations made to it, as well as with the recommendations made to its component agency (NNSA). In addition, one department (Treasury) neither agreed nor disagreed with the recommendations. Further, OMB provided technical comments, which we incorporated in the report, as appropriate.

The following departments and component agencies agreed with all of the recommendations that we directed to them:

HHS provided written comments, reprinted in appendix VI, stating that it concurred with the 10 recommendations made to the department, and with the 4 recommendations made to CMS. Of the recommendations made to the department, HHS stated that the processes it currently has in place address the various gaps in the department’s FITARA plans, documentation, and quality assurance processes. However, HHS did not provide additional evidence to demonstrate that the weaknesses we identified have been mitigated. Thus, we maintain that the department needs to take further actions to address our recommendations. Until it takes the appropriate actions to address gaps in its FITARA plans, document the actions taken to comply with OMB’s guidance, and implement key quality assurance processes, the department will be at increased risk that its CIO is not effectively engaged in IT budgeting decisions.

With regard to its component agency, HHS stated that CMS would take action to implement the recommendations made to it by updating the relevant policies and procedures to more explicitly identify the role of the CIO in developing the IT budget.

In comments provided via email on September 27, 2018, an audit liaison in the Internal Review and Evaluation Office of the Justice Management Division stated that DOJ concurred with the four recommendations made to the department, and with the one recommendation made to FBI.

IRS provided written comments, reprinted in appendix VII, stating that it concurred with our recommendation, has taken steps to begin implementing our recommendation, and is committed to making further progress toward fully implementing all OMB requirements when planning and budgeting for its individual investments.

DOE provided written comments, reprinted in appendix VIII, in which it concurred with eight of the nine recommendations made to the department and partially concurred with one recommendation. The department also concurred with all six recommendations made to NNSA.

Of the nine recommendations made to DOE, the department stated that it already had processes in place, or had taken action to address six of the recommendations, including the recommendation with which it partially concurred. However, the department did not provide sufficient evidence to demonstrate that the weaknesses we identified had been mitigated. Thus, we maintain that the recommendations warrant further actions. Until DOE takes the appropriate actions to address gaps in its FITARA plans, document the actions taken to comply with OMB’s guidance, and implement key quality assurance processes, the department will be at increased risk that the CIO is not effectively engaged in IT budgeting decisions.

In addition, DOE stated that NNSA’s Office of the CIO plans to develop policies and procedures—in collaboration with the component agency’s Office of Acquisition and Project Management and the agency’s Office of Management and Budget—that should address the findings and six recommendations made to NNSA. The department anticipates that the policies and procedures will be finalized by March 31, 2019.

Lastly, Treasury responded via email on September 28, 2018, but did not state whether it agreed or disagreed with our eight recommendations. Specifically, an audit liaison in Treasury’s Office of the CIO stated that the department believes it is implementing most of the OMB common baseline requirements in practice, but agreed that gaps exist in its policies and documentation. The official added that the department had started work on strengthening existing policies and procedures or developing new ones to close the gaps uncovered by our review.

We are sending copies of this report to the appropriate congressional requesters; OMB; the Secretaries of the Departments of Energy, Health and Human Services, and the Treasury; the Attorney General; the Administrator of NNSA, the Administrator of CMS, the FBI Director, and the IRS Commissioner. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-4456 or at harriscc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IX.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to determine the extent to which selected federal agencies (1) established policies and procedures in place that address the information technology (IT) budgeting requirements of the Federal Information Technology Acquisition Reform Act (FITARA) and related Office of Management and Budget (OMB) IT budget guidance, (2) could demonstrate that they had developed fiscal year 2017 IT budgets for sampled investments consistent with FITARA and OMB guidance, and (3) implemented processes to ensure that annual IT budgets are informed by reliable cost information.

To address our objectives, we first identified the subset of the 24 agencies covered by the Chief Financial Officers Act that had a fiscal year 2017 IT budget request of at least $1 billion. From this subset, we then identified the four agencies having the two highest and the two lowest average initial FITARA self-assessment scores, which included an assessment of OMB’s common baseline for IT management (common baseline). In the event that one or more agencies had the same average self-assessment scores, we selected the agency with the largest fiscal year 2017 IT budget. Based on these criteria, we selected four departments for our review: (1) the Department of Energy (DOE), (2) the Department of Health and Human Services (HHS), (3) the Department of Justice (DOJ), and (4) the Department of the Treasury (Treasury).

In addition, for each of these four departments, we selected their component agencies that had the largest fiscal year 2017 IT budget request. The components within the four selected departments were: (1) the National Nuclear Security Administration (NNSA) within DOE, (2) the Centers for Medicare and Medicaid Services (CMS) within HHS, (3) the Federal Bureau of Investigation (FBI) within DOJ, and (4) the Internal Revenue Service (IRS) within Treasury.

For the first objective, we compared the selected departments’ policies and procedures to requirements selected from OMB’s FITARA guidance (referred to as the common baseline) that related to developing departments’ IT budgets. In selecting the requirements, we reviewed 10 areas related to budget formulation and execution within OMB’s common baseline, and used professional judgment to select 8 requirements that we believed would significantly impact the development and approval of departments’ annual IT budgets. In doing so, we excluded one requirement that affected the development of annual IT budgets to a lesser extent and combined one requirement that was similar to another. Specifically, we excluded the requirement from the area related to the chief information officer’s (CIO) role in program management because the CIO’s review of program management artifacts could not be directly related to the IT budget review and approval process.

In addition, two common baseline areas had a similar requirement that the CIO be involved in the internal planning of IT resources prior to the budget submission. We combined these into one requirement for our review. We consulted with OMB officials in the Office of the Federal CIO on the requirements that we selected and how we planned to evaluate them and the officials agreed with our approach.

The eight OMB common baseline requirements within budget formulation and execution that we identified and selected are: establish the level of detail with which IT resources are to be described in order to inform the CIO during the planning and budgeting processes; establish agency-wide policy for the level of detail with which planned expenditures for all transactions that include IT resources are to be reported to the CIO; include the CIO in the planning and budgeting stages for programs that are fully or partially supported with IT resources; include the CIO as a member of governance boards that inform decisions regarding all IT resources, including component-level governance boards; document the processes by which program leadership works with the CIO to plan an overall portfolio of IT resources; ensure the CIO has reviewed and approved the major IT investments portion of the budget request; ensure the CIO has reviewed IT resources that are to support major program objectives and significant increases and decreases in IT resources; and ensure the CIO has reviewed whether the IT portfolio includes appropriate estimates of all IT resources included in the budget request.

After determining the eight requirements that we would review, we categorized them into three areas: CIO visibility into IT resources, CIO input to IT resource plans, and CIO review and approval of IT budgets.

We then reviewed the current policies and procedures that each department had documented for its IT budgeting process to determine whether the department documented a process for how they would address each of the eight common baseline requirements we selected for review. In addition to policies and procedures, we also reviewed each department’s FITARA implementation plan, which included a description of the steps the department must take to ensure that all FITARA and OMB requirements would be implemented; and the delegation memorandums from department CIOs, in which formal assignments of responsibilities to other department officials are documented, where applicable.

In cases where the department CIO fully or partially delegated responsibilities to component officials, we requested relevant documentation from the agency component with the largest fiscal year 2017 IT budget request. In such cases, we based our determination of departments’ implementation of the requirement on (1) the extent to which the component agency had documented policies and procedures that carried out the delegated requirement and (2) the extent to which the department CIO had procedures for ensuring the delegation was being carried out by the components.

With regard to our second objective, we determined whether the selected departments had implemented key IT budgeting requirements for a non-generalizable sample of investments in their fiscal year 2017 budget formulation. In doing so, we chose 16 investments—the largest major and non-major investments at the department level and the largest major and non-major investments at the component level—based on the selected departments’ fiscal year 2017 IT budget request. Although the information obtained is not generalizable to all of the departments’ investments, the sample provided a range of examples and conditions under which the departments were implementing requirements found in OMB’s common baseline.

We then identified a subset of requirements from the eight department requirements for developing IT budgets found in OMB’s common baseline for which implementation could be observed at the investment level. In doing so, we used professional judgment to select the subset of requirements where actions taken to implement these requirements could be observed for individual investments. Specifically, we did not select the requirement to establish agency-wide policy for the level of detail with which planned expenditures for all transactions that include IT resources are to be reported to the CIO, because the requirement primarily applied to enterprise-wide policymaking and reporting. Also, we did not select the requirement to include the CIO as a member of governance boards that inform decisions regarding all IT resources for review on individual investments because certain investments may not have been subject to governance board reviews during fiscal year 2017. In addition, we did not select the requirement to ensure the CIO has reviewed and approved the major IT investments portion of the budget request for review on individual investments because half of the investments we selected were not classified as major investments.

The five requirements for which we selected and reviewed implementation at the investment level were: IT resources for each investment are described in order to inform the CIO during the planning and budgeting processes; the CIO is included in the planning and budgeting stages for investments with IT resources; program leadership works with the CIO to plan the investment’s IT the CIO reviews whether the investment’s IT resources support major program objectives and have increased or decreased significantly; and the CIO reviews whether the investment’s estimates of IT resources in the portfolio and budget request are appropriate.

For each investment, if available, we obtained artifacts for the fiscal year 2017 budget submission—such as briefings, reports, meeting minutes, memorandums, and other relevant documentation showing the CIO’s involvement in relevant reviews or decisions. We compared this documentation to relevant OMB requirements for developing the IT budget at the individual investment level.

To address our third objective, we assessed the selected departments’ efforts to develop their fiscal year 2017 budget with reliable cost information by comparing the department’s IT capital planning and budgeting processes against best practices identified by us and the International Organization for Standardization—such as capturing government labor costs, aligning contract costs with investments, and utilizing budget object class data. We selected these three practices (from among others) because of their potential to inform the development of a complete and accurate IT budget for a federal department.

Capturing government labor costs. We reviewed each selected departments’ IT capital planning policies and procedures and government labor estimates within the 2017 IT budget submission reported on the Federal IT Dashboard. For each selected department, we identified the processes by which forecasted government labor costs are to be captured within investment proposals submitted with the annual IT budget. We then analyzed each department’s 2017 IT investment proposals to determine whether the department was capturing government labor for each investment. In doing so, we analyzed each selected department’s IT portfolio submitted with its fiscal year 2017 budget to determine whether the identified investments had included planned government labor costs, as required by OMB.

Aligning contract costs with investments. We reviewed each selected departments’ IT capital planning policies and procedures, contract-related information within the 2017 IT budget submission reported on the Federal IT Dashboard, and contract obligation data reported within the Federal Procurement Data System-Next Generation. From these document reviews, we identified the processes by which contract-related costs are to be captured within investment proposals submitted with the annual IT budget. We then determined whether departments were able to align current contracts with 2017 IT investment proposals. In doing so, we identified fiscal year 2016 contracts that departments reported in the Federal Procurement Data System-Next Generation that had an IT-related product or service code and an expected completion date that extended into fiscal year 2017 or beyond. We then attempted to match, using the unique procurement identification number for each contract, a corresponding IT investment for those contracts in departments’ fiscal year 2017 IT budget data. For contracts that we could not find a match, or alignment, with investments in departments’ fiscal year 2017 IT budget data, we identified dollars obligated on those contracts from October 2016 through September 2017.

Utilizing budget object class data. We reviewed each selected departments’ IT capital planning policies and procedures, budget object classes that are to help track IT financial transactions, and OMB’s fiscal year 2019 IT capital planning guidance that calls for greater use of IT financial data. We then assessed whether departments’ IT capital planning processes utilized budget object class information to ensure that relevant IT costs are being captured as investments for the annual IT budget.

We assessed the reliability of reported government labor costs by identifying instances in which investments had not included planned government labor costs and by corroborating those instances with officials in the departments’ offices of the CIO. We determined that the data were sufficiently reliable for our purposes. Where we identified data quality issues in capturing government labor costs for department investments, we included those in the findings of this report. We also assessed the reliability of Federal Procurement Data System-Next Generation data by performing electronic testing of selected data elements and reviewing existing information about the system and the data it produces. Specifically, we reviewed the data dictionary, data validation rules, and the fiscal year 2016 Federal Government Procurement Data Quality Summary for agency data in the Federal Procurement Data System-Next Generation. We determined that the data were sufficiently reliable for our purposes.

We supplemented our review with interviews with officials in the departments’ offices of the CIO, Chief Financial Officer, and program offices to include discussions of our observations of any shortfalls in their processes.

We conducted this performance audit from January 2017 to November 2018 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Department of Energy Detailed Analysis

DOE established department-wide IT capital planning and budgeting procedures that document the level of detail with which IT resources are to be described during the planning and budgeting process. The documented level of detail included OMB’s required reporting on government labor and certain resources for infrastructure investments.

This requirement was assigned at the department level.

DOE documented IT capital planning procedures for the level of detail of planned expenditure reporting. However, the procedures did not explicitly require that all transactions with an IT component be included in the expenditure reporting.

DOE’s FITARA implementation plan stated that the NNSA CIO was to work with the chief financial officer and chief acquisition officer to update NNSA’s policies to ensure they documented the level of detail for planned expenditure reporting for all IT transactions. However, NNSA had not established such policies and procedures.

DOE documented IT capital planning and annual budgeting procedures that included the CIO in the planning and budgeting stages for some, but not all programs identified as having IT resources. Specifically, at the time of our review, the department had not yet documented procedures for ensuring the CIO was included in budget decisions for all programs with IT resources, including those within NNSA and national laboratories.

According to DOE’s FITARA implementation plan and a memorandum from the Secretary providing further instructions on FITARA, NNSA was to provide an opportunity for the department CIO to provide input in its planning and budgeting stages for programs with IT resources and to document related review processes. However, at the time of our review, NNSA had not yet established the procedures that were to detail how this process was to be carried out.

DOE developed charters that included the CIO as a member of department-level IT governance boards, but had not included the CIO as a member of component-level IT investment review boards.

According to DOE’s FITARA implementation plan, NNSA was to allow the DOE CIO to provide input into NNSA acquisition decisions through its IT investment review board. However, at the time of our review, NNSA had not yet finalized its investment review board charter and related procedures to include the DOE CIO.

Department Rating GAO’s assessment DOE

DOE documented IT governance board procedures by which the CIO is to work with program leadership in planning IT resources for some, but not all of the programs subject to department-level governance board reviews. Specifically, at the time of our review, the department had not yet documented procedures by which the CIO was to work with program leadership in planning IT resources within NNSA and national laboratories, including high-performance computing efforts.

This requirement was assigned at the department level.

DOE documented IT capital planning and governance board procedures for its CIO to review and approve some, but not all of its major IT investments. Specifically, at the time of our review, the department had not yet documented procedures for the CIO to review major investments within NNSA and national laboratories, including high-performance computing efforts.

According to DOE’s FITARA implementation plan, the NNSA CIO was to review and approve NNSA major IT investments and provide the DOE CIO an opportunity to review and provide input prior to the final decision. However, at the time of our review, procedures to do so had not yet been established.

At the time of our review, DOE had not yet documented procedures for reviewing IT resources that are to support major program objectives and significant increases and decreases in IT resources for other department and component agency budget requests. DOE delegated the responsibility to meet this requirement to NNSA for their programs.

According to DOE’s FITARA implementation plan, the NNSA CIO was to review and approve NNSA major IT investments and provide the DOE CIO an opportunity to review and provide input prior to the final decision. However, at the time of our review, procedures to do so had not yet been established. In addition, NNSA had not documented procedures by which the NNSA CIO was to review IT resources that are to support major program objectives as well as significant increases and decreases in IT resources.

DOE had not documented procedures for this requirement.

This requirement was assigned at the department level. ● = The department provided documentation that demonstrated that the department or delegated component agency satisfied the OMB common ◑ = The department provided documentation that demonstrated that the department or delegated component agency satisfied some but not all of the ○ = The department could not provide documentation that demonstrated that the department or delegated component agency satisfied any of the OMB common baseline requirement. N/A = The component agency was not officially delegated the identified responsibilities for the OMB common baseline requirement.

GAO’s assessment NNSA could not demonstrate that the CIO reviewed the investment’s alignment with major program objectives or changes in resources.

The CIO reviewed IT resources that are to support major program objectives through business case materials that described the goals that the investment supported. In addition, the CIO reviewed decreases in the annual resource requirements by reviewing acquisition planning artifacts that included the investment’s cost estimate details.

DOE could not demonstrate that the CIO reviewed the appropriateness of IT resource estimates underlying the investment’s budget request.

DOE could not demonstrate that the CIO reviewed the appropriateness of IT resource estimates underlying the investment’s budget request.

NNSA could not demonstrate that the CIO reviewed the appropriateness of IT resource estimates underlying the investment’s budget request.

The NNSA CIO took steps to ensure the appropriateness of IT resource estimates included in the investment’s budget request by reviewing acquisition planning artifacts that included details on the fiscal year 2017 cost estimates. ● = The department or component demonstrated that it had implemented the OMB common baseline requirement on the investment. ◑ = The department or component demonstrated that it had implemented some but not all of the OMB common baseline requirement on the ○ = The department or component could not demonstrate that it had implemented the OMB common baseline requirement on the investment.

This requirement was assigned at the department level.

HHS documented IT capital planning procedures for the level of detail of planned expenditure reporting. However, the procedures had not explicitly required that all transactions with an IT component are included in the expenditure reporting.

This requirement was assigned at the department level.

HHS documented IT capital planning procedures for including the CIO in the planning and budgeting stages for new programs with IT resources that are greater than or equal to $20 million annually. However, at the time of our review, the department had not documented procedures for ensuring the CIO was included in the budget decisions for existing programs with IT resources that are greater than or equal to $20 million annually or for other programs that may have IT resources, such as those that are not primarily IT-oriented. The HHS CIO delegated the responsibility for carrying out this requirement to component CIOs for investments less than $20 million annually. However, HHS had not established procedures for ensuring its components were carrying out this responsibility.

CMS documented annual IT budget instructions and governance board procedures for the component CIO’s involvement in the planning and budgeting stages for major investments less than $20 million annually. However, CMS had not documented procedures for how the CIO was to be involved in budgeting decisions for non-major investments.

HHS developed charters that included the CIO on department-level governance boards that inform decisions regarding IT resources, such as the HHS Domain IT Steering Committee and the Chief Technology Officer Council. However, the HHS CIO was not a member of the Service and Supply Fund board—which reviews and approves operations and common service spending across the department—and other component-level IT investment review boards at CMS. The HHS CIO delegated the responsibility for carrying out this requirement to CMS’s CIO for investments less than $20 million annually. However, HHS had not established procedures for ensuring components were carrying out this responsibility.

Selected OMB common baseline requirements

CMS included its CIO as a member of the IT investment review board to oversee investments that are less than $20 million annually, consistent with the delegation from the HHS CIO.

HHS documented IT capital planning and governance board procedures by which the CIO is to work with program leadership to plan IT resources for new investments greater than or equal to $20 million annually. However, the department had not established procedures by which the CIO is to work with program leadership in planning resources for existing investments greater than or equal to $20 million annually. HHS’s CIO delegated the responsibility of reviewing and approving IT investments to components for investments less than $20 million annually. However, HHS had not established procedures for ensuring its components were carrying out this responsibility.

CMS documented the procedures by which program leadership was to work with the CMS CIO to plan IT resources for selected major and non- major investments through its IT investment review board. However, CMS had not established procedures for how the CIO was to work directly with program leadership on non-major IT investments that are not subject to the IT investment review board.

HHS documented IT capital planning and governance board procedures by which the CIO is to review and approve new major IT investments greater than or equal to $20 million annually. However, the department had not established procedures by which the CIO was to review and approve other major IT investments, including major investments greater than or equal to $20 million annually that are not new investments. The HHS CIO delegated the responsibility of the requirement to review and approve major investments between $10 million and $20 million annually to its component CIOs. However, at the time of our review, HHS had not established procedures for ensuring its components carried out the responsibility.

CMS documented procedures for its CIO to review and approve major IT investments that are between $10 million and $20 million annually through its IT capital planning and governance board procedures, consistent with its delegation from the HHS CIO.

HHS had not documented procedures for the CIO’s review of significant increases and decreases in IT resources. In addition, the HHS CIO delegated the responsibility for the requirement to review IT resources that are to support major program objectives to component-level CIOs for investments less than $20 million annually. However, HHS had not established procedures for ensuring its components carried out the responsibility.

CMS had not documented procedures for how the component was to review IT resources that are to support major program objectives, consistent with its delegated responsibility by the HHS CIO.

Department Rating GAO’s assessment HHS

HHS has not documented procedures for this requirement.

This requirement was assigned at the department level. ● = The department provided documentation that demonstrated that the department or delegated component agency satisfied the OMB common ◑ = The department provided documentation that demonstrated that the department or delegated component agency satisfied some but not all of the ○ = The department could not provide documentation that demonstrated that the department or delegated component agency satisfied any of the OMB N/A = The component agency was not officially delegated the identified responsibilities for the OMB common baseline requirement.

The HHS CIO was included in the planning and budgeting stages of the sampled investment by reviewing the IT resources through budget analysis meetings with the program office and department-level governance board. However, the review board only discussed nearly $15.8 million of the $33 million in total IT resources for the investment that was reported to OMB, and HHS officials could not demonstrate that the CIO was involved in the planning and budgeting stages for the remaining portion of the budget request.

HHS could not demonstrate that the CIO was involved in the planning and budgeting stages for the sampled investment’s IT resources.

The CMS CIO was included in the planning and budgeting stages for the sampled investment by reviewing and approving the investment’s budget request. However, HHS could not demonstrate that the department-level CIO was involved in the budgeting process for the investment’s IT resources through governance board reviews, as required by HHS policy. In addition, HHS could not demonstrate that the responsibility for this requirement had been delegated to the CMS CIO for the fiscal year 2017 budget request.

The CMS CIO was included in the planning and budgeting stages for the sampled investment by reviewing the investment’s budget. However, HHS could not demonstrate that the department-level CIO was involved in the budgeting process for the investment’s IT resources through governance board reviews, as required by HHS policy. In addition, HHS could not demonstrate that the responsibility for this requirement had been delegated to the CMS CIO for the fiscal year 2017 budget request.

HHS demonstrated that the CIO worked with program leadership to plan the investment’s IT resources through a department-level governance board meeting with program leadership, a briefing with the program office, and direction to investment managers to plan for a different funding scenario when determining the investment’s IT resource estimate.

HHS could not demonstrate that the CIO worked with program leadership to plan the sampled investment’s IT resources.

The CMS CIO worked with program leadership to plan the investment’s IT resources by chairing the CMS IT investment review board that approved the investment’s funding proposal. However, HHS could not demonstrate that the department-level CIO was involved in the planning process for the investment’s IT resources as required by HHS policy. In addition, HHS could not demonstrate that the responsibility for this requirement had been delegated to the CMS CIO for the fiscal year 2017 budget request.

The CMS CIO worked with program leadership to plan the investment’s IT resources by chairing the CMS IT investment review board that reviewed the investment’s funding proposal. However, HHS could not demonstrate that the department-level CIO was involved in the planning process for the investment’s IT resources as required by HHS policy. In addition, HHS could not demonstrate that the responsibility for this requirement had been delegated to the CMS CIO for the fiscal year 2017 budget request.

Selected OMB common baseline requirements CIO review and approval of IT budgets

The HHS CIO reviewed the investment’s alignment with major program objectives during an annual operational analysis review in December 2015. However, HHS did not demonstrate that the CIO reviewed the increase in IT resources for the investment totaling $33 million, more than double its initial estimate of nearly $15.8 million.

HHS could not demonstrate that the CIO reviewed the investment’s alignment with major program objectives or changes in resources.

The CMS CIO reviewed changes in resources identified within individual activity funding requests related to the investment. However, CMS could not demonstrate that the CIO reviewed the investment’s alignment with major program objectives. In addition, HHS could not demonstrate that the department-level CIO was involved in reviewing changes in IT resources for the investment. Moreover, HHS could not demonstrate that the responsibility for reviewing changes in IT resources had been delegated to the CMS CIO for the fiscal year 2017 budget request.

The CMS CIO reviewed changes in resources identified within individual activity funding requests related to the investment. However, CMS could not demonstrate that the CIO reviewed the investment’s alignment with major program objectives. In addition, HHS could not demonstrate that the department-level CIO was involved in reviewing changes in IT resources for the investment. Moreover, HHS could not demonstrate that the responsibility for reviewing changes in IT resources had been delegated to the CMS CIO for the fiscal year 2017 budget request.

The HHS CIO took steps to determine the appropriateness of nearly $15.8 million of the IT resource estimates for this investment by reviewing a line item budget estimate prepared for a department-level governance board. However, HHS could not demonstrate that the CIO took steps to determine the appropriateness of the IT resources for the remaining portion of the investment’s total 2017 budget request of $33 million as reported to OMB.

HHS could not demonstrate that the CIO or a designee reviewed the appropriateness of the IT resource estimates underlying the investment’s 2017 budget request.

The CMS CIO took steps to determine the appropriateness of the investment’s IT resources totaling approximately $500 million by reviewing the detailed budget request at an IT investment review board meeting. However, according to the Federal IT Dashboard, the fiscal year 2017 budget request for this investment totaled $399 million, and CMS could not demonstrate that the CIO took steps to determine the appropriateness of the revised budget total. In addition, HHS could not demonstrate that the department-level CIO reviewed the appropriateness of the investment’s IT resources. Moreover, HHS could not demonstrate that the responsibility for this requirement had been delegated to the CMS CIO for the fiscal year 2017 budget request.

Selected OMB common baseline requirements

The CMS CIO took steps to determine the appropriateness of the investment’s IT budget request by reviewing the IT resource request through the investment review board. However, HHS could not demonstrate that the department-level CIO reviewed the appropriateness of the investment’s IT resources. In addition, HHS could not demonstrate that the responsibility for this requirement had been delegated to the CMS CIO for the fiscal year 2017 budget request. ● = The department or component demonstrated that it had implemented the OMB common baseline requirement on the investment. ◑ = The department or component demonstrated that it had implemented some but not all of the OMB common baseline requirement on the ○ = The department or component could not demonstrate that it had implemented the OMB common baseline requirement on the investment.

DOJ established department-wide IT capital planning and budgeting procedures that document the level of detail with which IT resources are to be described during the planning and budgeting process. The documented level of detail went beyond OMB’s minimum required reporting to include 49 IT resources across four business areas.

This requirement was assigned at the department level.

DOJ documented IT capital planning procedures for the level of detail of planned expenditure reporting. However, the procedures did not explicitly require that all transactions with an IT component are included in the expenditure reporting.

This requirement was assigned at the department level.

DOJ documented procedures for including the CIO in the planning and budgeting stages for programs with IT resources.

This requirement was assigned at the department level.

DOJ documented governance board charters that included the CIO as a member of department-level IT governance boards. However, the CIO was not included a member of key component-level IT investment review boards, including those at FBI.

This requirement was assigned at the department level.

DOJ documented procedures in its IT Governance Guide by which the CIO is to work with program and component leadership in planning the overall portfolio of IT resources.

This requirement was assigned at the department-level.

DOJ documented procedures in its IT Governance Guide and Department Investment Review Council for the CIO to review and approve major IT investments.

This requirement was assigned at the department level.

DOJ documented procedures in its IT Governance Guide and IT capital planning guidance for the CIO to review IT resources that are to support major program objectives and significant increases and decreases in resources.

This requirement was assigned at the department level.

DOJ did not document procedures for this requirement.

This requirement was assigned at the department level. ● = The department provided documentation that demonstrated that the department or delegated component agency satisfied the OMB common ◑ = The department provided documentation that demonstrated that the department or delegated component agency satisfied some but not all of the ○ = The department could not provide documentation that demonstrated that the department or delegated component agency satisfied any of the OMB N/A = The component agency was not officially delegated the identified responsibilities for the OMB common baseline requirement.

FBI included the DOJ CIO in the planning and budgeting stages for the sampled investment through a review of the funding request during an annual IT portfolio review in October 2015.

FBI included the DOJ CIO in the planning and budgeting stages for the sampled investment through a review of the funding request during an annual IT portfolio review in October 2015.

DOJ’s CIO collaborated with program leaders in planning IT resources for the investment through development of the annual operating plan for DOJ’s working capital fund and through meetings with component business leadership and meetings with component CIOs.

DOJ’s CIO collaborated with program leaders in planning IT resources for the investment through development of the annual operating plan for DOJ’s working capital fund.

While FBI program leadership collaborated with IT representatives from the Criminal Justice and Information Services Division in planning IT resources, FBI could not demonstrate that the CIO was involved in the planning or that the responsibility had been delegated to the division.

FBI could not demonstrate that the CIO worked with program leadership to plan the sampled investment’s IT resources.

DOJ’s CIO reviewed IT resources that are to support major program objectives and changes in IT resources through development of the annual operating plan for DOJ’s working capital fund and in an annual IT portfolio review in October 2015.

DOJ’s CIO reviewed IT resources that are to support major program objectives and changes in IT resources through development of the annual operating plan for DOJ’s working capital fund and in an annual IT portfolio review in October 2015.

FBI obtained a review from the DOJ CIO regarding IT resources that are to support major program objectives and significant changes in IT resources through an annual IT portfolio review in October 2015.

FBI obtained a review from the DOJ CIO regarding IT resources that are to support major program objectives and significant changes in IT resources through an annual IT portfolio review in October 2015.

DOJ’s CIO took steps to ensure the investment included appropriate estimates of IT resources in its budget request by reviewing spreadsheets with additional and more detailed cost information during an annual IT portfolio review in October 2015.

DOJ’s CIO took steps to ensure the investment included appropriate estimates of IT resources in its budget request by reviewing spreadsheets with additional and more detailed cost information during an annual IT portfolio review in October 2015.

While IT representatives within the Criminal Justice and Information Services Division were involved in validating underlying IT resource estimates, FBI could not demonstrate that the CIO was involved in the planning or that the responsibility had been delegated to the division.

Selected OMB common baseline requirements

FBI could not demonstrate that the CIO or designee reviewed the appropriateness of IT resource estimates underlying the investment’s budget request. ● = The department or component demonstrated that it had implemented the OMB common baseline requirement on the investment. ◑ = The department or component demonstrated that it had implemented some but not all of the OMB common baseline requirement on the ○ = The department or component could not demonstrate that it had implemented the OMB common baseline requirement on the investment.

This requirement was assigned at the department level.

Treasury documented IT capital planning procedures for reporting investments’ planned IT expenditures. However, the procedures did not explicitly require that all transactions with an IT component are included in the expenditure reporting.

This requirement was assigned at the department level.

While the department documented procedures for including the CIO in the planning and budgeting stages for department-level programs that are identified as having IT resources, it did not document procedures for ensuring the CIO is included in all department-level programs that may have IT resources, including those that are not primarily IT-oriented. In addition, Treasury’s CIO delegated this requirement to component CIOs for component-level investments. However, the agency had not established procedures for verifying that components were carrying out this delegated responsibility.

IRS documented annual IT budgeting procedures for including the IRS CIO in the component’s planning and budgeting stages for all programs that have IT resources.

Treasury developed department-level IT governance board charters that included the CIO as a member. In addition, the Treasury CIO delegated the responsibility for this requirement to component CIOs for component- level IT governance boards. However, the department had not established procedures for verifying that components were carrying out this delegated responsibility.

IRS included its CIO as a member of its IT investment review board through its documented IT budgeting procedures.

Treasury has documented procedures in its IT capital planning guidance by which the CIO works with program and component leadership in planning IT resources.

This requirement was assigned at the department level.

Selected OMB common baseline requirements CIO review and approval of IT budgets

While Treasury documented procedures in its IT capital planning guidance for the CIO to review major IT investments with each component, the department had not documented procedures for how the CIO was to approve those investments. In addition, the Treasury CIO delegated to component CIOs the responsibility to develop proposed IT planning and budgeting artifacts while the Treasury CIO would retain the authority to approve them. However, the department had not established procedures for verifying that components were carrying out this delegated responsibility.

IRS documented annual IT budgeting procedures that described how the component CIO was to review and approve major IT investments.

Treasury established procedures through its Quarterly Performance Reviews and its IT capital planning guidance to review IT resources that are to support major program objectives and significant changes in IT resources. For example, during the annual Spring portfolio review with each component, the CIO was to discuss strategic IT changes for the component and any significant resource changes that have occurred on individual investments.

This requirement was assigned at the department level.

Treasury had not documented procedures for ensuring the appropriateness of IT resource estimates for department-level investments. In addition, Treasury delegated the responsibility for this requirement to component CIOs for component-level investments. However, the department had not established procedures for verifying that components were carrying out this delegated responsibility.

IRS documented annual IT budgeting procedures for ensuring the appropriateness of IT resources within the component-level IT portfolio. The procedures included validating annual IT demand requests that form the basis of the budget request. ● = The department provided documentation that demonstrated that the department or delegated component agency satisfied the OMB common ◑ = The department provided documentation that demonstrated that the department or delegated component agency satisfied some but not all of the ○ = The department could not provide documentation that demonstrated that the department or delegated component agency satisfied any of the OMB N/A = The component agency was not officially delegated the identified responsibilities for the OMB common baseline requirement.

IRS demonstrated that managers from the Office of the CIO worked with program leadership from IRS business units in developing a portion of the sampled investment’s budget of $286 million through IT budget reviews conducted by an integrated review team in July 2015. However, the component agency could not demonstrate that Office of the CIO officials worked with program leadership to develop the budget for the full investment totaling $468 million.

IRS demonstrated that managers from the Office of the CIO worked with program leadership from IRS business units in developing a portion of the sampled investment’s budget of $40 million through IT budget reviews conducted by an integrated review team in July 2015. However, the component agency could not demonstrate that Office of the CIO officials worked with program leadership to develop the budget for the full investment totaling $343 million.

Treasury could not demonstrate that the CIO reviewed the investment’s alignment with major program objectives or changes in resources.

Treasury could not demonstrate that the CIO reviewed the investment’s alignment with major program objectives or changes in resources.

IRS demonstrated that managers from the Office of the CIO reviewed alignment with major program objectives and changes in underlying resources for a portion of the sampled investment’s budget of $286 million through IT budget reviews conducted by an integrated review team in July 2015. However, the component agency could not demonstrate that Office of the CIO officials reviewed alignment with major program objectives and changes in resources for the full investment totaling $468 million.

IRS demonstrated that managers from the Office of the CIO reviewed alignment with major program objectives and changes in underlying resources for a portion of the sampled investment’s budget of $40 million through IT budget reviews conducted by an integrated review team in July 2015. However, the component agency could not demonstrate that Office of the CIO officials reviewed alignment with major program objectives and changes in resources for the full investment totaling $343 million.

Treasury could not demonstrate that the CIO or designee reviewed the appropriateness of IT resource estimates underlying the investment’s budget request.

Treasury could not demonstrate that the CIO or designee reviewed the appropriateness of IT resource estimates underlying the investment’s budget request.

Selected OMB common baseline requirement

IRS demonstrated that managers from the Office of the CIO reviewed detailed cost estimates for a portion of the sampled investment’s budget of $286 million through IT budget reviews conducted by an integrated review team in July 2015. However, the component agency could not demonstrate that Office of the CIO officials reviewed detailed cost estimates for the full investment totaling $468 million.

IRS demonstrated that managers from the Office of the CIO reviewed detailed cost estimates for a portion of the sampled investment’s budget of $40 million through IT budget reviews conducted by an integrated review team in July 2015. However, the component agency could not demonstrate that Office of the CIO officials reviewed detailed cost estimates for the full investment totaling $343 million. ● = The department or component demonstrated that it had implemented the OMB common baseline requirement on the investment. ◑ = The department or component demonstrated that it had implemented some but not all of the OMB common baseline requirement on the ○ = The department or component could not demonstrate that it had implemented the OMB common baseline requirement on the investment.

Appendix VII: Comments from the Internal Revenue Service

Appendix VIII: Comments from the Department of Energy

Appendix IX: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Dave Powner (Director), Nicole Jarvis (Assistant Director), Joshua Leiling (Analyst-in-Charge), Chris Businsky, Kara Epperson, Rebecca Eyler, Suellen Foth, Torrey Hardee, Tarunkant Mithani, Monica Perez-Nelson, and Andrew Stavisky made key contributions to this report.