Information and Technology Management: Responsibilities, Reporting Relationships, Tenure, and Challenges of Agency Chief Information Officers
Released: 2004-07-21T00:00:00

Letter

Background

Despite a substantial investment in IT, the federal government’s management of information resources has produced mixed results.

Although agencies have taken constructive steps to implement modern strategies, systems, and management policies and practices, we continue to find that agencies face significant challenges. The CIO position was established by the Congress to serve as the focal point for information and technology management issues within an agency, and CIOs can address these challenges with strong and committed leadership.

The Congress has assigned a number of responsibilities to the CIOs of federal agencies. (See app. I for a summary of the legislative evolution of agency CIO responsibilities.) In addition, we have identified other areas of information and technology management that can contribute significantly to the successful implementation of information systems and processes. Altogether, we identified the following 13 major areas of CIO responsibilities as either statutory requirements or critical to effective information and technology management: IT/IRM strategic planning. CIOs are responsible for strategic planning for all information and information technology management functions— referred to by the term information resources management (IRM) strategic planning .

IT capital planning and investment management. CIOs are responsible for IT capital planning and investment management [44 U.S.C. 3506(h) and 40 U.S.C. 11312 & 11313].

Information security. CIOs are responsible for ensuring their agencies’ compliance with the requirement to protect information and systems [44 U.S.C. 3506(g) and 3544(a)(3)].

IT/IRM human capital. CIOs have responsibilities for helping their agencies meet their IT/IRM workforce needs [44 U.S.C. 3506(b) and 40 U.S.C. 11315(c)].

Information collection/paperwork reduction. CIOs are responsible for the review of their agencies’ information collection proposals to maximize the utility and minimize public paperwork burdens .

Information dissemination. CIOs are responsible for ensuring that their agencies’ information dissemination activities meet policy goals such as timely and equitable public access to information .

Records management. CIOs are responsible for ensuring that their agencies implement and enforce records management policies and procedures under the Federal Records Act .

Privacy. CIOs are responsible for their agencies’ compliance with the Privacy Act and related laws .

Statistical policy and coordination. CIOs are responsible for their agencies’ statistical policy and coordination functions, including ensuring the relevance, accuracy, and timeliness of information collected or created for statistical purposes .

Information disclosure. CIOs are responsible for information access under the Freedom of Information Act .

Enterprise architecture. Federal laws and guidance direct agencies to develop and maintain enterprise architectures as blueprints to define the agency mission and the information and IT needed to perform that mission.

Systems acquisition, development, and integration. GAO has found that a critical element of successful IT management is effective control of systems acquisition, development, and integration [44 U.S.C. 3506(h)(5) and 40 U.S.C. 11312].

E-government initiatives. Various laws and guidance direct agencies to undertake initiatives to use IT to improve government services to the public and internal operations [44 U.S.C. 3506(h)(3) and the E-Government Act of 2002].

CIOs’ Responsibilities, Reporting Relationships, Tenure, and Challenges

The agency CIOs were generally responsible for most of the 13 key areas we identified as either required by statute or among those critical to effective information and technology management, and most of these CIOs reported directly to their agency heads. We found that only 2 of these 13 areas were cited as the responsibility of fewer than half of the CIOs, and 19 of the CIOs reported directly to their agency heads. Their median tenure was about 2 years—less than the 3 to 5 years that CIOs and former senior agency IT executives said were necessary for a CIO to be effective; this gap could be problematic because it could inhibit CIOs’ efforts to address major challenges, including IT management and human capital.

Agency CIOs Generally Were Responsible for Most Areas

As figure 1 illustrates, CIOs were responsible for key information and technology management areas. In particular, 5 of the 13 areas were assigned to every agency CIO. These areas were capital planning and investment management, enterprise architecture, information security, IT/IRM strategic planning, and IT workforce planning. However, of the other 8 areas, 2 of them—information disclosure and statistics—were the responsibility of fewer than half of the CIOs. Disclosure is a responsibility that has frequently been assigned to offices such as general counsel and public affairs in the agencies we reviewed, while statistical policy is often the responsibility of separate offices that deal with the agency’s data analysis, particularly in agencies that contain Principal Statistical Agencies. Nevertheless, even for those areas of responsibility that were not assigned to them, the CIOs generally reported that they contributed to the successful execution of the agency’s responsibility.

In those cases where the CIOs were not assigned the expected responsibilities, and they expressed an opinion about the situation, more than half of the CIO responses were that the applicable information and technology management areas were appropriately held by some other organizational entity. Moreover, one of the panels of former agency IT executives suggested that not all 13 areas were equally important to CIOs. A few of the former agency IT executives even called some of the areas relating to information management a distraction from the CIO’s primary responsibilities. Those sentiments, however, are not consistent with the law, which envisioned that having a single official responsible for the various information and information technology functions would provide integrated management.

Specifically, one purpose of the Paperwork Reduction Act of 1980 (PRA) is to coordinate, integrate, and—to the extent practicable and appropriate— make federal information resources management policies and practices uniform as a means to improve the productivity, efficiency, and effectiveness of government programs by, for example, reducing information collection burdens on the public and improving service delivery to the public. Moreover, the House committee report accompanying the PRA in 1980 asserted that aligning IRM activities under a single authority should provide for both greater coordination among an agency’s information activities and higher visibility for these activities within the agency.

In addition to specifying areas of responsibility for the CIOs of major departments and agencies, the Clinger-Cohen Act calls for certain CIOs to have IRM as their primary duty. All but a few of the agencies complied with this requirement. The other significant duties reported by some CIOs generally related to other administrative or management areas, such as procurement and human capital. We and Members of Congress have previously expressed concern about agency CIOs having responsibilities beyond information and technology management and have questioned whether dividing time between two or more kinds of duties would allow CIOs to deal effectively with their agencies’ IT challenges.

CIOs Generally Reported to Their Agency Heads

Federal law—as well as our guide based on CIOs of leading private sector organizations—generally calls for CIOs to report to their agency heads, forging relationships that ensure high visibility and support for far- reaching information management initiatives. Nineteen of the CIOs in our review stated that they had this reporting relationship. In the other 8 agencies, the CIOs stated that they reported instead to another senior official, such as a deputy secretary, under secretary, or assistant secretary.

The views of current CIOs and former agency IT executives about whether it is important for the CIO to report to the agency head were mixed. For example, of the 8 CIOs who did not report directly to their agency heads, (1) 3 stated it was important or critical, (2) 2 stated it was not important, (3) two stated it was generally important but that the current reporting structure at their agencies worked well, and (4) 1 stated it was very important that a CIO report to at least a deputy secretary. In contrast, 15 of the 19 CIOs who reported to their agency heads stated that this reporting relationship was important. However, 8 of the 19 CIOs who said they had a direct reporting relationship with the agency head noted that they also reported to another senior executive, usually the deputy secretary or under secretary for management, on an operational basis. Finally, members of our Executive Council on Information Management and Technology told us that what is most critical is for the CIO to report to a top level official. The members of our panels of former agency IT executives also had a variety of views on whether it was important that the CIO report to the agency head.

CIOs Have Diverse Backgrounds and Generally Remained in Office about 2 Years

At the major departments and agencies included in our review, the current CIOs had diverse backgrounds, and since the enactment of the Clinger- Cohen Act, the median tenure of permanent CIOs whose time in office had been completed was about 2 years. Both of these factors can significantly influence whether a CIO is likely to be successful. First, the background of the current CIOs varied in that they had previously worked in the government, the private sector, or academia, and they had a mix of technical and management experience. Virtually all of them had work experience and/or educational backgrounds in IT or IT-related fields. For example, 12 current agency CIOs had previously served in a CIO or deputy CIO capacity. Moreover, most of the CIOs had business knowledge related to their agencies because they had previously worked at the agency or had worked in an area related to the agency’s mission.

Second, the median time in the position for agencies’ permanent CIOs was 23 months. For career CIOs, the median was 32 months; the median for political appointees was 19 months. When asked how long a CIO needed to stay in office to be effective, the most common response of current CIOs and former agency IT executives was 3 to 5 years. Between February 10, l996 and March 1, 2004, only about 35 percent of the permanent CIOs who had completed their time in office reportedly had stayed in office for a minimum of 3 years. The gap between actual time in office and the time needed to be effective is consistent with the views of many agency CIOs, who believed that the turnover rate was high and that the political environment, the pay differentials between the public and private sectors, and the challenges that CIOs face contributed to this rate.

Agency CIOs Face Major Challenges

Current CIOs reported that they faced major challenges in fulfilling their duties. In particular, two challenges were cited by over 80 percent of the CIOs: implementing effective information technology management and obtaining sufficient and relevant resources. This indicates that CIOs view IT governance processes, funding, and human capital as critical to their success. Other common challenges they cited were communicating and collaborating internally and externally and managing change. Effectively tackling these reported challenges can improve the likelihood of a CIO’s success. The challenges the CIOs identified were as follows: IT Management. Leading organizations execute their information technology management responsibilities reliably and efficiently. A little over 80 percent of the CIOs reported that they faced one or more challenges related to implementing effective IT management practices at their agencies. This is not surprising given that, as we have previously reported, the government has not always successfully executed the IT management areas that were most frequently cited as challenges by the CIOs—information security, enterprise architecture, investment management, and e-gov.

Sufficient and Relevant Resources. One key element in ensuring an agency’s information and technology success is having adequate resources available. Virtually all agency CIOs cited resources, both in dollars and staff, as major challenges. The funding issues cited generally concerned the development and implementation of agency IT budgets and whether certain IT projects, programs, or operations were being adequately funded.

We have previously reported that the way agency initiatives are originated can create funding challenges that are not found in the private sector. For example, certain information systems may be mandated or legislated, so the agency does not have the flexibility to decide whether to pursue them. Additionally, there is a great deal of uncertainty about the funding levels that may be available from year to year. The government also faces long- standing and widely recognized challenges in maintaining a high-quality IT workforce. In 1994 and 2001, we reported the importance that leading organizations placed on making sure they had the right mix of skills in their IT workforce. About 70 percent of the agency CIOs reported on a number of substantial IT human capital challenges, including, in some cases, the need for additional staff. Other challenges included recruiting, retention, training and development, and succession planning.

Communicating and Collaborating. Our prior work has shown the importance of communication and collaboration, both within an agency and with its external partners. For example, one of the critical success factors we identified in our CIO guide focuses on the CIO’s ability to establish his or her organization as a central player in the enterprise. Ten agency CIOs reported that communication and collaboration were challenges. Examples of internal communication and collaboration challenges included (1) cultivating, nurturing, and maintaining partnerships and alliances while producing results in the best interest of the enterprise and (2) establishing supporting governance structures that ensure two-way communication with the agency head and effective communication with the business part of the organization and component entities. Other CIOs cited activities associated with communicating and collaborating with outside entities as challenges, including sharing information with partners and influencing the Congress and the Office of Management and Budget (OMB).

Managing Change. Top leadership involvement and clear lines of accountability for making management improvements are critical to overcoming an organization’s natural resistance to change, marshaling the resources needed to improve management, and building and maintaining organizationwide commitment to new ways of doing business. Some CIOs reported challenges associated with implementing changes originating both from their own initiative and from outside forces. Implementing major IT changes can involve not only technical risks but also nontechnical risks, such as those associated with people and the organization’s culture. Six CIOs cited dealing with the government’s culture and bureaucracy as challenges to implementing change. Former agency IT executives also cited the need for cultural changes as a major challenge facing CIOs. Accordingly, in order to effectively implement change, it is important that CIOs build understanding, commitment, and support among those who will be affected by the change.

Actions Can Be Taken to Improve Agencies’ Information and Technology Management

The Congress and agencies can take various actions to assist CIOs in fulfilling their vital roles. With respect to the Congress, hearings such as this, Mr. Chairman, help to raise issues and suggest solutions. Also, the report we are releasing today contains a Matter for Congressional Consideration in which we suggest that, as you hold hearings on and introduce legislation related to information and technology management, you consider whether the existing statutory requirements related to CIO responsibilities and reporting to the agency head reflect the most effective assignment of information and technology management responsibilities and the best reporting relationship. To further assist in your oversight role, as you requested, we are beginning work on the development of a set of CIO best practices, based on the practices of leading organizations in the private sector, to complement the report we are releasing today.

Agencies, too, can take action to improve their information and technology management. First, to address concerns about the high CIO turnover rate, agencies may be able to use human capital flexibilities— which represent the policies and practices that an agency has the authority to implement in managing its workforce—to help retain its CIOs. For example, our model on strategic human capital management notes that recruiting bonuses, retention allowances, and skill-based pay can attract and retain employees who possess the critical skills the agency needs to accomplish its mission. We have also issued several reports that discuss these issues in more depth and provide possible solutions and recommendations. Second, we have issued various guides to assist CIOs in tackling the major challenges that they have cited. This guidance includes (1) information security best practices to help agencies with their information security challenges; (2) an IT investment management framework, including a new version that offers organizations a road map for improving their IT investment management processes in a systematic and organized manner; and (3) a framework that provides agencies with a common benchmarking tool for planning and measuring their efforts to improve their enterprise architecture management.

In summary, the report we are issuing today indicates that CIOs generally stated that they had most of the responsibilities and reporting relationships required by law, but that there were notable exceptions. In particular, some agency CIOs reported that, contrary to the requirements in the law, they were not responsible for certain areas, such as records management, and that they did not report to their agency head. However, views were mixed as to whether CIOs could be effective leaders without having responsibility for each individual area. In addition, most CIOs did not stay in office for 3 to 5 years—the response most commonly given when we asked current CIOs and former agency IT executives how long a CIO needed to be in office to be effective. Agencies’ use of various mechanisms, such as human capital flexibilities, could help reduce the turnover rate or mitigate its effect. Reducing turnover among CIOs is important because the amount time CIOs are in office can affect their ability to successfully address the major challenges they face. Some of these challenges—such as how IT projects are originated—may not be wholly within their control. Other challenges—such as improved IT management—are more likely to be overcome if a CIO has sufficient time to more effectively address these issues.

Mr. Chairman, this completes my prepared statement. I would be happy to respond to any questions that you or other Members of the Subcommittee may have at this time.

Legislative Evolution of Agency Chief Information Officer Roles and Responsibilities

For more than 20 years, federal law has structured the management of information technology and information-related activities under the umbrella of information resources management (IRM). Originating in the 1977 recommendations of the Commission on Federal Paperwork, the IRM approach was first enacted into law in the Paperwork Reduction Act of 1980 (PRA). The 1980 act focused primarily on centralizing governmentwide responsibilities in the Office of Management and Budget (OMB). The law gave OMB specific policy-setting and oversight duties with regard to individual IRM areas—for example, records management, privacy, and the acquisition and use of automatic data processing and telecommunications equipment (later renamed information technology). The law also gave agencies the more general responsibility to carry out their IRM activities in an efficient, effective, and economical manner and to comply with OMB policies and guidelines. To assist in this effort, the law required that each agency head designate a senior official who would report directly to the agency head to carry out the agency’s responsibilities under the law.

Together, these requirements were intended to provide for a coordinated approach to managing federal agencies’ information resources. The requirements addressed the entire information life cycle, from collection through disposition, in order to reduce information collection burdens on the public and to improve the efficiency and effectiveness of government.

Amendments to the PRA in 1986 and 1995 were designed to strengthen agency and OMB implementation of the law. Most particularly, the PRA of 1995 provided detailed agency requirements for each IRM area, to match the specific OMB provisions. The 1995 act also required for the first time that agencies develop processes to select, control, and evaluate the results of major information systems initiatives.

In 1996, the Clinger-Cohen Act supplemented the information technology management provisions of the PRA with detailed Chief Information Officer (CIO) requirements for IT capital planning and investment control and for performance and results-based management. The 1996 act also established the position of agency chief information officer by amending the PRA to rename the senior IRM officials CIOs and by specifying additional responsibilities for them. Among other things, the act required IRM to be the “primary duty” of the CIOs in the 24 major departments and agencies specified in 31 U.S.C. 901. Accordingly, under current law, agency CIOs are required to carry out the responsibilities of their agencies with respect to information resources management, including information collection and the control of paperwork; statistical policy and coordination; privacy, including compliance with the Privacy Act; information security, including compliance with the Federal Information Security Management Act; information disclosure, including compliance with the Freedom of Information Act; and information technology.

Together, these legislated roles and responsibilities embody the policy that CIOs should play a key leadership role in ensuring that agencies manage their information functions in a coordinated and integrated fashion in order to improve the efficiency and effectiveness of government programs and operations.

This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.