Information Technology: OMB Needs to Report On and Improve Its Oversight of the Highest Priority Programs
Released: 2017-11-21T00:00:00

Letter

Background

The federal government plans to invest about $96 billion in fiscal year 2018 for IT that is critical to the health, economy, and security of the nation. However, prior IT expenditures have often resulted in significant cost overruns, schedule delays, and questionable mission-related achievements. For example,

The Department of Health and Human Services’ website, Healthcare.gov, and its supporting systems, which were to facilitate the establishment of a federal health insurance marketplace by January 2014, encountered significant cost increases, schedule slips, and delayed functionality. In a series of reports, we identified numerous planning, oversight, security, and system development challenges faced by this program.

For almost two decades, the Department of Veterans Affairs (VA) has undertaken numerous initiatives with the Department of Defense (DOD) that were intended to advance the ability of the two departments to share electronic health records. In our report of the departments’ efforts in 2015, we reported that the departments had not identified outcome-oriented goals and metrics to clearly define what they aimed to achieve from their interoperability efforts, resulting in numerous failures. During most of the last 20 years, VA has also been planning to modernize its system separately from DOD. Recently, the Secretary of VA announced that the department plans to use the same electronic health record system that DOD is in the process of acquiring. However, the significant challenges that have confronted VA in its efforts contributed to our designation of VA health care as a high risk area.

The Department of Homeland Security’s U.S. Citizenship and Immigration Services’ Transformation Program, which was initiated to address processing inefficiencies and transform the agency’s current paper-based system into an electronic account-based system, has faced continual management and development challenges, limiting its progress and ability to achieve its goals of enhanced national security and system integrity, better customer service, and operational efficiency. The U.S. Citizenship and Immigration Services estimates that the program’s cost increased by approximately $1 billion and its schedule was delayed by over 4 years from its initial approved baseline.

The Office of Personnel Management’s Retirement Systems Modernization program, which was intended to improve the efficiency and effectiveness of its retirement claims processing, was canceled in February 2011 after the agency had spent approximately $231 million on a third attempt to automate the processing of federal employee retirement claims.

As previously stated, due to the challenges associated with acquiring IT across the federal government, in 2015, we added improving the management of IT acquisitions and operations to our list of high-risk areas. We recently issued an update to our high-risk report and determined that, while progress has been made in addressing the high- risk area of IT acquisitions and operations, significant work remains to be completed. For example, as of May 2017, OMB and federal agencies had implemented 380 (or about 47 percent) of the 803 recommendations that we had made from fiscal years 2010 through 2015 related to IT acquisitions and operations.

OMB’s Mission and Oversight of Federal IT Programs

By law, OMB is to oversee federal agencies’ management of information and information technology. Within OMB, primary responsibility for oversight of federal IT has been given to the Administrator of the Office of Electronic Government and Information Technology, who is also called the Federal Chief Information Officer (Federal CIO). According to OMB, this oversight responsibility covers about 800 major and nearly 5,700 non-major IT investments across the federal government. As a part of the oversight, the E-Gov office develops policy and reviews federal agencies’ IT strategic plans. In addition, OMB establishes processes to analyze, track, and evaluate the risks and results of IT investments made by executive agencies, and issues guidance on processes for selecting and overseeing agency privacy and security protections for information and information systems.

OMB has also implemented a series of initiatives to improve the oversight of underperforming investments and more effectively manage IT. These initiatives include the following:

Federal IT Dashboard. In June 2009, to further improve the transparency into and oversight of federal agencies’ IT investments, OMB deployed the Federal IT Dashboard, a public website with information on the performance of these investments. OMB provided guidance to the agencies on the information they should maintain and update on the dashboard. Currently, the dashboard displays information on the cost, schedule, and performance of close to 800 major IT investments at 26 federal agencies. In addition, agencies are to submit ratings from their CIOs to the dashboard, which, according to OMB’s instructions, should reflect the level of risk facing an investment relative to that investment’s ability to accomplish its goals. The public display of these data is intended to allow OMB, other oversight bodies, and the general public to hold agencies accountable for mission-related outcomes. Over the past 7 years, we have issued a series of reports that have noted both significant steps OMB has taken to enhance the oversight, transparency, and accountability of federal IT investments by creating the dashboard, as well as issues with the accuracy and reliability of the data it contains.

TechStat reviews. In January 2010, the Federal CIO began leading TechStat reviews—face-to-face meetings to discuss whether to terminate or turn around IT investments that are in danger of failing or are not producing results. These meetings involved OMB and agency leadership and were intended to increase accountability and improve performance. OMB reported that federal agencies achieved over $3 billion in cost savings or avoidances as a result of these reviews in 2010. Subsequently, it empowered agency CIOs to begin holding their own TechStat reviews by June 2012. OMB’s 2015 guidance specified that the TechStat reviews were to be held with agency leadership, not led by OMB as in the past, and that agencies were only required to notify OMB of the meetings’ occurrence and report the results.

In November 2015, we testified that OMB had conducted only one TechStat review between March 2013 and October 2015, and had not listed any related savings in its quarterly reporting to Congress since June 2012. In April 2017, OMB reported that it had not led a TechStat review since 2015. A report issued by the Federal CIO Council in January 2017, entitled The State of Federal Information Technology, noted that shifting TechStat reviews from OMB to agencies had diminished the executive scrutiny and impact of the initiative.

PortfolioStat sessions. To better manage existing IT systems, in 2012, OMB launched the PortfolioStat initiative, which required agencies to conduct an annual, agency-wide portfolio review to, among other things, reduce commodity IT spending and demonstrate how their investments aligned with the agency’s mission and business functions. These reviews were to be held between the Federal CIO and agency leadership. In 2014 and 2015, OMB’s PortfolioStat guidance also called for it and agencies to identify high impact IT programs that merited additional support and oversight by OMB and/or agency leadership, and for these programs to be discussed during a PortfolioStat session. The 2015 guidance also changed the frequency of the PortfolioStat sessions from annually to quarterly, and the level of participation to no longer require attendance by the Federal CIO or the agency’s Deputy Secretary.

The Federal Information Technology Acquisition Reform provisions (commonly referred to as FITARA) enacted as a part of the Carl Levin and Howard P. ‘Buck’ McKeon National Defense Authorization Act for Fiscal Year 2015 aimed to improve federal IT acquisition and operations and recognized the importance of these OMB initiatives by incorporating certain requirements into the law. For example, among other things, the act requires OMB to publicly display investment performance information and review federal agencies’ IT investment portfolios.

Further, as previously mentioned, the December 2014 explanatory statement for the Consolidated Appropriations Act, 2015, stated that OMB was to identify the top 10 high priority IT programs under development in the federal government and report on their status quarterly. Additionally, in December 2015, in the explanatory statement for the Consolidated Appropriations Act, 2016, Congress stated that USDS, an OMB component, was to provide a quarterly status report on its current projects, including the top 10 high priority programs.

USDS’s Mission and Organization

The current mission of USDS is to deliver better government services to the American people through technology and design. USDS is focused on, among other things, improving the nation’s most important digital services used by the public, and modernizing procurement processes and practices for the digital era. To execute its mission, USDS recruits private sector experts, such as IT engineers and designers and leading civil servants, and deploys small teams to federal agencies. It selects which projects it will apply resources to and generally initiates the effort with the federal agency that owns the IT projects. In August 2016, we reported that USDS had developed procedures and criteria for selecting and prioritizing projects to work on.

Current Administration’s Efforts to Improve Federal IT

The current administration has initiated additional efforts aimed at improving federal IT, including digital services. Specifically, in March 2017, the administration established the Office of American Innovation, which has a mission to, among other things, make recommendations to the President on policies and plans aimed at improving federal government operations and services and modernizing federal IT. In doing so, the office is to consult with both OMB and the Office of Science and Technology Policy. Further, in May 2017, the administration established the American Technology Council, which has a goal of helping to transform and modernize federal agency IT and how the federal government uses and delivers digital services. The Federal CIO and the USDS Administrator are members of this council.

OMB Identified High Priority IT Programs, but Did Not Ensure Federal CIO Oversight or Continued and Timely Reporting

OMB reported that it undertook a structured approach to identifying the top 10 high priority IT programs it reported to Congress in June 2015 and June 2016. Specifically, staff in the E-Gov office, including the Unit Chief for the Agency Oversight and Implementation team, stated that they chose the top 10 programs from a list of high impact programs that OMB separately maintains. They added that their approach was not guided by any documented procedures or scoring techniques to distinguish the programs.

Analysts in the E-Gov office told us that, to identify the high impact programs from which the top 10 high priority programs were selected, they used program information from IT portfolio summaries, monthly IT dashboard updates, and quarterly integrated data collection submissions that OMB receives from agencies. They also considered several additional factors, such as risk exposure, public impact, public use, criticality to agency mission, size, and cost. In addition, they considered input from USDS leadership and OMB budget examiners, as well as our reports, inspectors general reports, and CIO risk ratings.

Further, the analysts stated that OMB sought input from officials of the 24 Chief Financial Officers Act agencies to gain a better understanding of the importance of each program. In the end, based on all of the information considered, E-Gov staff made a judgment call regarding which of the agencies’ programs to identify as being high impact. According to these staff, on average, two high impact programs are identified for each of the 24 agencies, with at least one program being identified for each agency, and as many as four programs being identified for some larger agencies. Further, according to the staff, the Federal CIO approved the process for selecting the high impact programs.

In addition, in determining the top 10 high priority programs, the E-Gov staff stated that they identified on the high impact list those programs that they believed were representative of the most important IT programs across federal agencies. They also considered other factors, such as whether a program had generated legislative interest or had performance issues. They added that the Federal CIO then approved the list of top 10 programs that they had selected.

OMB subsequently issued two reports to Congress—in June 2015 and June 2016—that identified the top 10 high priority programs. Along with the status of each program, the reports identified the IT investments that were a part of each program as well as total IT spending, average CIO risk rating, major milestones, and the level of involvement USDS has with the program. Table 1 lists the programs that OMB identified in the two reports.

As shown in the table, OMB made two changes to the top 10 list in 2016. Specifically, it replaced the Social Security Administration’s Service Modernization program with the agency’s Disability Case Processing System due to a change in focus within the agency. In addition, it replaced VA’s Medical Appointment Scheduling System with VA’s Medical 21st Century Development Core program, which is a larger effort that encompasses the scheduling system.

OMB Oversight Efforts Did Not Ensure Federal CIO Involvement

E-Gov staff reported that the high priority programs were already receiving greater oversight than what was provided to the other major programs due to their high impact designation. Specifically, the staff stated that OMB provides additional oversight to high impact IT programs by regularly communicating about them through quarterly, monthly, weekly, or daily meetings with agency CIOs and program staff, depending on the risk and profile of the program. In contrast, communication is much less frequent for other major IT systems. The staff added they also discuss high impact programs with agencies during quarterly PortfolioStat meetings. Further, they stated that they can request that agencies perform a TechStat review, if needed, for a troubled high impact program.

Most agencies that owned the high priority programs identified in the June 2016 report confirmed that OMB had already provided increased oversight for the high priority programs when they were originally designated as high impact programs. Specifically, officials from six of the eight agencies stated that the programs were discussed during quarterly PortfolioStat sessions, and officials from five agencies stated that OMB had provided action items for them to address with regard to their programs. Further, officials from six agencies stated that OMB’s oversight included periodic meetings (e.g., daily, weekly, or bi-weekly). Its oversight also included participation in a TechStat review of a high impact program performed by the Social Security Administration.

Nevertheless, while additional OMB oversight of the high impact programs (and, accordingly, the identified high priority programs) is a positive step, the Federal CIO was not directly involved in this oversight. According to the E-Gov staff, the Federal CIO does not typically get involved with overseeing individual IT programs due to the large number of programs. However, the results of past CIO-led TechStat reviews suggest that the Federal CIO’s involvement in overseeing such programs does have significantly positive results. Specifically, as previously mentioned, CIO-led TechStat reviews of IT investments performed in 2010 resulted in $3 billion in savings and cost avoidance.

Further, during a September 2016 Comptroller General forum to explore challenges and opportunities for improving federal IT acquisitions and operations, current and former CIOs and other participants pointed to the importance of OMB’s oversight and guidance, and specifically, to the role of the Federal CIO in helping to ensure effective IT governance. The participants cited specific OMB initiatives undertaken by the Federal CIO, including the TechStat reviews that had resulted in greater accountability and positive results. Thus, without the involvement of the Federal CIO more directly and regularly in the oversight of high impact and high priority programs, including leading TechStat reviews for the programs, OMB is likely to miss significant opportunities to improve accountability for and achieve positive results from the federal government’s IT investments.

OMB Has Stopped Reporting on High Priority IT Programs

OMB issued two reports on the high priority programs—one in 2015 and another in 2016. While these reports provided the requested information they were not issued quarterly. According to the E-Gov staff, OMB was not able to report quarterly on the programs because of other competing reporting requirements, limited resources available to draft the report, and the amount of time it takes to get its reports fully reviewed.

Moreover, the staff stated that they stopped issuing the high priority reports in 2016 because they believe the explanatory statement to the Consolidated Appropriations Act, 2016, no longer directed them to continue reporting on the programs. Specifically, the explanatory statement directed USDS to provide a quarterly report to the Committees on Appropriations of the House and Senate describing the status of current USDS teams and projects, including the top 10 high priority programs, a list of USDS accomplishments, and agency project proposals. Both E-Gov staff and USDS staff said they determined this to mean that OMB should report on the USDS projects considered to be high priority given USDS’s responsibilities. In addition, USDS staff stated that they did not receive any feedback from congressional stakeholders indicating otherwise.

However, continued identification and reporting on the top ten high priority programs, and not just USDS projects, would further enhance congressional oversight by providing congressional stakeholders with information on high priority programs that is not readily available. Such information could also be useful for current administration IT governance entities such as the Office of American Innovation and the American Technology Council, to assist them with prioritizing their efforts to modernize federal agency IT.

USDS Has a Defined Project Selection Process, but its Reporting Did Not Address High Priority Programs As Requested and Was Not Timely

USDS has developed a process for identifying and prioritizing the IT projects to which it provides support. Moreover, as we have previously reported, its project selection process is consistent with best practices, which state that organizations should establish and implement procedures for prioritizing projects that include identifying selection criteria to help consistently select projects based on their contributions to the strategic goals of the organization.

In explaining the process used to identify projects, USDS staff stated that they obtained input from various sources, including the Federal IT Dashboard, leadership of the relevant federal agency, E-Gov analysts, and GAO reports. In addition, the staff said they considered the high impact programs identified by the E-Gov office; they also coordinated with E-Gov analysts through monthly meetings to incorporate issues of significance to E-Gov into their selection process.

To further facilitate the selection process, the USDS staff established three questions as criteria for prioritizing agencies’ IT projects, in the following order of importance: (1) What will do the greatest good for the greatest number of people in the greatest need? (2) How effective and cost efficient will the USDS investment be? (3) What potential exists to scale or reuse a technological solution across the government? The staff said they used the criteria to create a list of all potential projects, including their descriptions and information on resource needs; they updated the list when they identified additional projects that met the criteria. This list was subsequently used by USDS leadership to make decisions about which projects to pursue. According to the staff, an important consideration when selecting a project was whether there was executive sponsorship from the agency. They added that executive sponsorship ensures that USDS has the help it needs to make changes to the projects, and it affects the efficiency and cost-effectiveness of USDS’s investment. Projects that were not selected went into a backlog that is to be used to select a project when a team becomes available to work on a new engagement.

USDS has issued two reports to Congress on the status of its projects— one in December 2016 and the other in July 2017. The report issued in December 2016 summarized the status of 11 projects that USDS is engaged in at federal agencies, and 3 broader initiatives that are intended to improve the performance and cost-effectiveness of government digital services. According to USDS staff, the 11 projects had broad impact and had made the most significant progress. For example, these included the VA’s Vets.gov project, which is intended to assist the department in developing a new digital application for healthcare, and DOD’s Defense Travel System, a system that facilitates travel for all DOD employees. Further, USDS reported on the status of their efforts for these three initiatives: modernizing procurement processes, development of federal shared services, and hiring top technical talent.

The July 2017 report included summaries for 10 projects, including 5 new projects. Specifically, the new projects were the General Service Administration’s Login.gov project, the Small Business Administration’s effort to modernize small business certification for government contractors, DOD’s Advisor Network system, DOD’s Defense Personal Property System, and transforming federal IT procurement through digital acquisition training. In addition, 6 projects that were discussed in the December 2016 report were not included in the July 2017 report.

Table 2 provides a complete list of the projects identified in the two reports.

Our analysis determined that four of the projects identified in USDS’s reports were among the high priority programs that OMB’s E-Gov office had identified in its June 2015 and June 2016 reports to Congress. These projects were Healthcare.Gov, Disability Claim Processing, modernizing the immigration system at the Department of Homeland Security, and improving the Visa program at the Department of State. However, USDS’s report does not specify this or provide an update on the status of the other high priority programs. USDS staff stated that they did not address all of the top 10 high priority programs because, as stated earlier in this report, they interpreted Congress’s 2016 request as being focused on USDS’s priority projects and not on the programs previously identified by E-Gov. As mentioned earlier, however, continuing to identify and report on the top 10 high priority IT programs while also reporting on USDS’s projects would further enhance congressional oversight and current administration IT governance entities’ efforts by providing stakeholders with information on high priority programs and USDS projects that is not readily available.

Further, although USDS was directed to report quarterly, it did not do so. Instead, it issued a report in December 2016, nearly a year after Congress’s direction, and in July 2017, nearly 7 months after its first report. In discussing this matter, USDS staff said they were not able to report quarterly due to the time and effort needed to prepare and review a report. As a result, USDS’s reporting did not provide congressional stakeholders with the timely information needed to support their oversight responsibilities.

Conclusions

While OMB’s 2015 and 2016 reports to Congress on the top 10 high priority programs included the status of the programs, their total IT spending, and other information to assist Congress in monitoring the progress of critical programs, OMB did not issue the reports quarterly as directed in the explanatory statement. In addition, OMB does not plan on continuing to issue the top 10 high priority reports because it believes that, in 2016, Congress directed the agency to instead focus on providing a status of USDS’s most important projects. Further, OMB’s December 2016 and July 2017 reports on USDS’s projects did not address the top 10 high priority programs across the government. However, continued reporting on the top 10 high priority programs would further enhance congressional oversight by providing congressional stakeholders with information that is not readily available on those programs in the greatest need of attention. Reporting on the top 10 high priority programs could also be useful for IT governance entities such as the Office of American Innovation and the American Technology Council, to assist them with prioritizing their efforts to modernize federal agency IT.

Moreover, OMB did not issue the high priority programs and USDS reports on a quarterly basis as requested. Without OMB’s quarterly reporting on the progress of both the top 10 high priority programs and the status of the USDS projects, congressional stakeholders and others may lack the timely information they need to support their oversight and other responsibilities.

Finally, while additional OMB oversight of the high impact programs (and, accordingly, the identified high priority programs) is a positive step, the Federal CIO was not directly involved in the oversight of these programs. Based on the positive impact of direct Federal CIO involvement in leading investment reviews in the past, such involvement could significantly improve program outcomes.

Recommendations for Executive Action

We are making the following three recommendations to OMB:

The Director of OMB should continue to identify and report to Congress on the status of the top 10 high priority IT programs and the extent to which USDS is involved in the programs, as was done in June 2015 and June 2016. In doing so, the Director should ensure that these reports are issued quarterly. (Recommendation 1)

The Director of OMB should ensure that the Federal CIO is directly involved in the oversight of high priority programs. (Recommendation 2)

The Director of OMB should continue to report on the status of USDS projects. In doing so, the Director should ensure that the reports are issued quarterly. (Recommendation 3)

Agency Comments and Our Evaluation

We received comments on our draft report via e-mail from the OMB liaison to GAO. In the comments, OMB did not specifically state whether it agreed or disagreed with our recommendations. Rather, OMB stated that it has concerns with GAO’s alternative interpretations of law and that GAO’s findings and conclusions are rooted in an incorrect legal interpretation of OMB’s annual appropriation. Specifically, it stated that GAO considers reporting requirements specific to an annual appropriation to apply for all future annual appropriations.

However, OMB’s characterization is incorrect, as we did not assert this legal conclusion. As stated in our report, in the explanatory statement accompanying the Consolidated and Further Continuing Appropriations Act, 2015, Congress directed OMB to identify the 10 highest priority IT investment programs (referred to in our report as the top 10 high priority programs) that are under development across federal agencies and report on their status each quarter. Subsequently, the explanatory statement accompanying the Consolidated Appropriations Act, 2016, directed USDS to provide a quarterly status report on, among other things, current USDS projects, including the top 10 high priority programs. Our report does not conclude that the language of either explanatory statement establishes a legally binding requirement, whether applicable only to the subject fiscal year or beyond.

GAO’s conclusions are based on the view that continued identification and reporting on the top 10 high priority programs, and not just USDS projects, would help to enhance congressional oversight. Identifying and reporting on the top 10 high priority programs is important because such information is not readily available. We have revised relevant statements in the report to clarify our message in this regard. Further, while GAO did not assert a legal conclusion, we have, nonetheless, removed all references to our “interpretation” of the explanatory statement so as to avoid the inference that we are making legal conclusions.

OMB also said our conclusion that it has stopped reporting altogether is incorrect. However, our report does not state that OMB has stopped reporting altogether. Rather, our report states that OMB stopped issuing reports on the top 10 high priority IT programs due to its interpretation of the 2016 explanatory statement and, instead, switched to reporting on the status of USDS’s projects.

In addition, OMB stated that, while it agreed that the reports have not been submitted on a quarterly basis, it provided Congress with the requested information for the four quarters of the relevant fiscal years. In addition, OMB stated that USDS is currently discussing with congressional stakeholders whether providing quarterly briefings, instead of reports, would address the quarterly reporting requirement. As noted in our report, timely (i.e., quarterly) information would enhance congressional and other stakeholders’ oversight responsibilities. Therefore, we maintain that our recommendation for reporting quarterly is appropriate.

Finally, OMB stated that it disagreed with our conclusion that the lack of personal Federal CIO involvement in high priority IT programs had resulted in inadequate oversight. While we state that the Federal CIO was not directly involved in overseeing the high priority programs, we did not conclude that this resulted in inadequate oversight. Rather, we stated that the results of past CIO-led TechStat reviews suggest that more direct and regular involvement of the Federal CIO would improve accountability and achieve positive results for the federal government’s investments. Thus, we continue to believe that our recommendation to ensure that the Federal CIO is directly involved in overseeing high priority programs is appropriate.

OMB also provided technical comments, which we have incorporated into the report as appropriate.

We are sending copies of this report to interested congressional committees, the Director of the Office of Management and Budget, and other interested parties. In addition, the report will be available at no charge on GAO’s website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-9286 or pownerd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix I.

Appendix I: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Sabine Paul (Assistant Director), Scott Borre (Analyst in Charge), Nancy Glover, Lori Martinez, Bradley Roach, and Marshall Williams, Jr. made key contributions to the report.