Information Technology: OMB and Agencies Need to Fully Implement Major Initiatives to Save Billions of Dollars
Released: 2013-01-22T00:00:00

Letter

Background

OMB assists the President in overseeing the preparation of the federal budget submission and supervising budget administration in executive branch agencies. In helping to formulate the President’s spending plans, OMB is responsible for evaluating the effectiveness of agency programs, policies, and procedures; assessing competing funding demands among agencies; and setting funding priorities. Further, the agency ensures that the budget submission is consistent with relevant statutes and presidential objectives.

Each year, OMB and federal agencies work together to determine how much the government plans to spend on IT projects and how these funds are to be allocated. As reported to OMB, federal agencies plan to spend more than $74 billion on IT investments in fiscal year 2013, which is the total expended for not only acquiring such investments, but also the funding to operate and maintain them. Of the reported amount, agencies plan to spend about $20 billion on development and acquisition, and $54 billion on O&M. Figure 1 shows the percentages of total planned spending for 2013.

However, this $74 billion does not reflect the spending of the entire federal government. We have previously reported that OMB’s figure understates the total amount spent in IT investments. Specifically, it does not include IT investments by 58 independent executive branch agencies, including the Central Intelligence Agency, or by the legislative or judicial branches. Further, agencies differed on what they considered an IT investment; for example, some have considered research and development systems as IT investments, while others have not. As a result, not all IT investments are included in the federal government’s estimate of annual IT spending. OMB provided guidance to agencies on how to report on their IT investments, but this guidance did not ensure complete reporting or facilitate the identification of duplicative investments. Consequently, we recommended, among other things, that OMB improve its guidance to agencies on identifying and categorizing IT investments.

To assist agencies in managing their IT investments, Congress enacted the Clinger-Cohen Act of 1996, which requires OMB to establish processes to analyze, track, and evaluate the risks and results of major capital investments in information systems made by federal agencies and report to Congress on the net program performance benefits achieved as a result of these investments. Further, the act places responsibility for managing investments with the heads of agencies and establishes chief information officers (CIO) to advise and assist agency heads in carrying out this responsibility.

Many of these investments are critical to our nation. For example, they include systems to process tax returns, secure our nation, and control aircraft.

However, the federal government has spent billions of dollars on poorly performing IT investments, as the following examples illustrate: In July 2010, OMB directed the National Archives and Records Administration (NARA) to halt development of its Electronic Records Archive system at the end of fiscal year 2011 (1 year earlier than planned). OMB cited concerns about the system’s cost, schedule, and performance and directed NARA to better define system functionality and improve strategic planning. Through fiscal year 2010, NARA had spent about $375 million on the system. We issued several reports and made recommendations to improve this system. These findings and recommendations contributed to the decision to halt the system.

In January 2011, the Secretary of Homeland Security ended the Secure Border Initiative Network program after obligating more than $1 billion to the program because it did not meet cost-effectiveness and viability standards. Since 2007, we have identified a range of issues and made several recommendations to improve this program. For example, in May 2010 we reported that the final acceptance of the first two deployments had slipped from November 2009 and March 2010 to September 2010 and November 2010, respectively, and that the cost-effectiveness of the system had not been justified. We concluded that the Department of Homeland Security (DHS) had not demonstrated that the considerable time and money being invested to acquire and deploy the program was a wise and prudent use of limited resources. As a result, we recommended that the department (1) limit near-term investment in the first incremental block of the program, (2) economically justify any longer- term investment in it, and (3) improve key program management disciplines. This work contributed to the department’s decision to cancel the program.

In February 2011, the Office of Personnel Management canceled its Retirement Systems Modernization program after several years of trying to improve the implementation of this investment. According to the Office of Personnel Management, it spent approximately $231 million on this investment. We issued a series of reports on the agency’s efforts to modernize its retirement system and found that the Office of Personnel Management was hindered by weaknesses in several important management disciplines that are essential to successful IT modernization efforts.recommendations in areas such as project management, organizational change management, testing, cost estimating, and earned value management. In May 2008, an Office of Personnel Management official cited the issues that we identified as justification for issuing a stop work order to the system contractor, and the agency subsequently terminated the contract.

In March 2011, we reported that while the Department of Defense’s (DOD) Navy Next Generation Enterprise Network investment’s first increment was estimated to cost $50 billion, the program was not well- positioned to meet its cost and schedule estimates. Accordingly, we recommended DOD limit further investment until it conducts an interim review to reconsider the selected acquisition approach and addresses its investment management issues. DOD stated that it did not concur with the recommendation to reconsider its acquisition approach, but we maintained that without doing so, DOD could not be sure it was pursuing the most cost-effective approach.

In December 2012, DOD canceled the Air Force’s Expeditionary Combat Support System after having spent more than a billion dollars and missing multiple milestones. We issued several reports on this system and found that, among other things, the program was not fully following best practices for developing reliable schedules and cost estimates.

In addition to these poorly performing investments, the IT Dashboard identifies other at-risk investments. Specifically, as of August 2012, according to the IT Dashboard, 190 of the federal government’s approximately 700 major IT investments—totaling almost $12.5 billion— were in need of management attention (rated “yellow” to indicate the need for attention or “red” to indicate significant concerns). (See fig. 2.)

As previously mentioned, in June 2009, to further improve the transparency into and oversight of agencies’ IT investments, OMB publicly deployed the IT Dashboard. As part of this effort, OMB issued guidance directing federal agencies to report, via the Dashboard, the performance of their IT investments. Currently, the Dashboard publicly displays information on the cost, schedule, and performance of over 700 major federal IT investments at 26 federal agencies. Further, the public display of these data is intended to allow OMB, other oversight bodies, and the general public to hold the government agencies accountable for results and progress.

In December 2010 OMB released its 25-point plan to reform federal IT. Among other things, the plan noted the goal of turning around or terminating at least one-third of underperforming projects by June 2012.

To its credit, OMB’s IT Reform Plan provided specific actions to agencies so they could (1) more effectively manage IT acquisitions and (2) achieve operational efficiencies. To effectively manage IT acquisitions, the plan identified key actions such as improving accountability and governance and aligning acquisition processes with the technology cycle. To achieve operational efficiencies, the plan outlined actions required to adopt cloud solutions and leverage shared services. One of these actions was the consolidation of data centers as described in OMB’s FDCCI, which was announced in February 2010 and included a high-level goal to reduce the cost of data center hardware, software, and operations. Another action that was identified was related to cloud computing. OMB developed a “Cloud First” policy that required each agency CIO to fully migrate three services to a cloud solution by June 2012, and implement cloud-based solutions whenever a secure, reliable, and cost-effective cloud option exists.

As part of the IT Reform Plan, in 2011 the Federal CIO Council launched an initial Best Practices platform on http://www.CIO.gov to provide agency case studies that demonstrate best practices in managing federal IT systems. According to OMB, agencies have been encouraged to develop practices that focus on early, frequent, and constructive communication during the acquisition process so that the government clearly understands the marketplace and can obtain an effective solution at a reasonable price.

Further, since June 2010, OMB has required agencies to develop and carry out an operational analysis (OA) policy for examining the ongoing performance of existing operational IT investments to measure, among other things, whether the investment is continuing to meet business and customer needs and is contributing to meeting the agency’s strategic goals. OMB’s guidance calls for the policy to provide for an annual OA of each investment that addresses the following: cost, schedule, customer satisfaction, strategic and business results, financial goals, and innovation.

More recently, the Federal CIO initiated the PortfolioStat effort for commodity IT in March 2012. OMB requires agency Deputy Secretaries or Chief Operating Officers to lead PortfolioStats—IT portfolio reviews— working in coordination with CIOs, Chief Financial Officers, and Chief Acquisition Officers. Such an effort, as planned, is appropriate given the numerous investments performing the same function, as we reported in February 2012. For example, 27 major federal agencies planned to spend $2.7 billion on 580 financial management systems in 2011. See figure 3 for the total number of investments within the 27 federal agencies, by function.

OMB believes that the PortfolioStat effort has the potential to save the government $2.5 billion over the next 3 years by, for example, consolidating duplicative systems.

We previously reported and testified on the issue of duplicative IT investments at DOD and the Department of Energy. Specifically, we found 37 potentially duplicative investments, accounting for about $1.2 billion in total IT spending for fiscal years 2007 through 2012. We made recommendations to those agencies to report on the progress of efforts to identify and eliminate duplication, where appropriate.

Opportunities Exist to Improve Acquisitions and Operations of IT Investments

Over the past several years, we have highlighted OMB efforts to enhance oversight of IT acquisition. Most notably, we issued a series of reports on the IT Dashboard. In addition, we identified common factors critical to successful IT investments.

IT Dashboard OMB has taken significant steps to enhance the oversight, transparency, and accountability of federal IT investments by creating its IT Dashboard, and by improving the accuracy of investment ratings. However, there were issues with the accuracy and reliability of cost and schedule data, and we recommended steps that OMB should take to improve these data.

Our July 2010 report found that the cost and schedule ratings on OMB’s Dashboard were not always accurate for the investments we reviewed, because these ratings did not take into consideration current performance. As a result, the ratings were based on outdated information. We recommended that OMB report on its planned changes to the Dashboard to improve the accuracy of performance information and provide guidance to agencies to standardize milestone reporting. OMB agreed with our recommendations and, as a result, updated the Dashboard’s cost and schedule calculations to include both ongoing and completed activities. Similarly, in March 2011, OMB had initiated several efforts to increase the Dashboard’s value as an oversight tool, and had used its data to improve federal IT management.calculations contributed to inaccuracies in the reported investment performance data. These included, for instance, missing data submissions or erroneous data at each of the five agencies we reviewed, along with instances of inconsistent program baselines and unreliable source data. As a result, we recommended that the agencies take steps to improve the accuracy and reliability of their Dashboard information, and that OMB improve how it rates investments relative to current performance and schedule variance. Most agencies generally concurred with our recommendations; OMB agreed with our recommendation for improving ratings for schedule variance. It disagreed with our recommendation to improve how it reflects current performance in cost and schedule ratings, but more recently made changes to Dashboard calculations to address this while also noting challenges in comprehensively evaluating cost and schedule data for these investments.

However, agency practices and the Dashboard’s noted that that the accuracy of investment cost and schedule ratings had improved since our July 2010 report because OMB had refined the Dashboard’s cost and schedule calculations. Most of the ratings for the eight investments we reviewed were accurate, although more could be done to inform oversight and decision making by emphasizing recent performance in the ratings. We recommended that the General Services Administration comply with OMB’s guidance for updating its ratings when new information becomes available (including when investments are rebaselined) and the agency concurred. Since we previously recommended that OMB improve how it rates investments, we did not make any further recommendations.

More recently, in October 2012 we found that opportunities existed to improve transparency and oversight of investment risk at our selected agencies. Specifically, CIOs at six federal agencies consistently rated the majority of their IT investments as low risk. These agencies rated no more than 12 percent of their investments as high or moderately high risk, and two agencies (DOD and the National Science Foundation) rated no investments at these risk levels. Over time, about 47 percent of the agencies’ Dashboard investments received the same rating in every rating period. For ratings that changed, DHS and Office of Personnel Management reported more investments with reduced risk when initial ratings were compared with those in March 2012; the other four agencies reported more investments with increased risk. In the past, OMB reported trends for risky IT investments needing management attention as part of its annual budget submission, but discontinued this reporting in fiscal year 2010. Accordingly, we recommended OMB analyze agencies’ investment risk over time as reflected in the Dashboard’s CIO ratings and present its analysis with the President’s annual budget submission, with which OMB concurred.

Further, agencies generally followed OMB’s instructions for assigning CIO ratings, which included considering stakeholder input, updating ratings when new data become available, and applying OMB’s six evaluation factors. DOD’s ratings were unique in reflecting additional considerations, such as the likelihood of OMB review, and consequently DOD did not rate any of its investments as high risk. However, in selected cases, these ratings did not appropriately reflect significant cost, schedule, and performance issues reported by GAO and others. Although three DOD investments experienced significant performance problems and were part of a GAO high-risk area (business systems modernization), they were all rated low risk or moderately low risk by the DOD CIO. For example, in early 2012, we reported that Air Force’s Defense Enterprise Accounting and Management System (DEAMS) faced a 2-year deployment delay and an estimated cost increase of about $500 million from an original life- cycle cost estimate of $1.1 billion (an increase of approximately 45 percent), and that assessments by DOD users had identified operational problems with the system, such as data accuracy issues, an inability to generate auditable financial reports, and the need for manual workarounds. In July 2012, the DOD Inspector General reported that the DEAMS’s schedule delays were likely to diminish the cost savings it was to provide, and would jeopardize the department’s goals for attaining an auditable financial statement. DOD’s CIO rated DEAMS low risk or moderately low risk from July 2009 through March 2012.

Moreover, DOD did not apply its own risk management guidance to the ratings, which reduces their value for investment management and oversight. Therefore, we recommended that DOD ensure that its CIO ratings reflect available investment performance assessments and its risk management guidance. DOD concurred with our recommendation.

Critical Factors Underlying Successful Major Acquisitions To help the federal agencies address the well-documented acquisition challenges they face, we identified seven successful investment acquisitions and nine common factors critical to their success in 2011. Specifically, we reported that department officials identified seven successful investment acquisitions, in that they best achieved their respective cost, schedule, scope, and performance goals.common factors critical to the success of three or more of the seven investments were: (1) program officials were actively engaged with stakeholders; (2) program staff had the necessary knowledge and skills; (3) senior department and agency executives supported the programs; (4) end users and stakeholders were involved in the development of requirements; (5) end users participated in testing of system functionality prior to formal end user acceptance testing; (6) government and contractor staff were stable and consistent; (7) program staff prioritized requirements; (8) program officials maintained regular communication with the prime contractor; and (9) programs received sufficient funding. Further, officials from all seven investments cited active engagement with program stakeholders as a critical factor to the success of those investments. These critical factors support OMB’s objective of improving the management of large-scale IT acquisitions across the federal government, and wide dissemination of these factors could complement OMB’s efforts.

The nine In addition to efficiently acquiring IT investments, it is also important for the federal government to efficiently manage operational investments, especially since agencies are planning to spend about $54 billion in fiscal year 2013 on operational systems. Accordingly, we issued key reports on the federal government’s oversight of IT investments in O&M, progress toward meeting OMB data center consolidation goals, and progress toward cloud computing as specified in the “Cloud First” policy.

Oversight of Investments in O&M While agencies spend billions on operational investments, they have not always provided adequate oversight of these investments. Specifically, assessments of the performance of such investments—commonly referred to as OAs—varied significantly, as we reported in October 2012.perform such analyses annually to ensure O&M investments continue to meet agency needs. The guidance also includes 17 key factors (addressing areas such as cost, schedule, customer satisfaction, and innovation) that are to be assessed.

The agencies in our review were DHS, DOD, the Departments of Health and Human Services (HHS), the Treasury, and Veterans Affairs (VA). all investments and that all factors are fully assessed; and OMB revise its guidance to include directing agencies to report on the IT Dashboard the results from the OAs. The five agencies and OMB agreed with our recommendations.

Data Center Consolidation Agencies have developed plans to consolidate data centers; however, these plans were incomplete and did not include best practices. We issued two reports on the federal government’s effort to consolidate data centers and made several recommendations for improvements.

Our July 2011 report found that agency consolidation plans indicated that agencies anticipated closing about 650 data centers by fiscal year 2015 and saving about $700 million in doing so. However, only one of the 24 agencies submitted a complete inventory and no agency submitted complete plans. Further, OMB did not require agencies to document the steps they took, if any, to verify the inventory data. We noted the importance of having assurance as to the accuracy of collected data and, specifically, the need for agencies to provide OMB with complete and accurate data and the possible negative impact of that data being missing or incomplete. We concluded that until these inventories and plans were completed, agencies would not be able to implement their consolidation activities and realize expected cost savings. Moreover, without an understanding of the validity of agencies’ consolidation data, OMB could not be assured that agencies were providing a sound baseline for estimating consolidation savings and measuring progress against those goals. Accordingly, we made several recommendations to OMB, including that the Federal CIO require that agencies, when updating their data center inventories, state what actions have been taken to verify the inventories and to identify any associated limitations on the data.

In a subsequent report we noted that agencies updated their inventories and plans, but key elements were still missing. Specifically, as of September 2011, 24 agencies identified almost 2,900 total centers, established plans to close 1,186 of them by 2015, and estimated they would realize over $2.4 billion in cost savings in doing so. OMB noted that the savings would be even greater and estimated that FDCCI would realize $3 billion in savings by 2015.However, while OMB required agencies to complete missing elements in their data center inventories and plans by the end of September 2011, only 3 agencies submitted complete inventories, and only 1 agency submitted a complete plan. Further, in their consolidation plans, 13 agencies did not provide a full master program schedule, and 21 agencies did not fully report their expected cost savings. Our report noted that until these inventories and plans were complete, agencies would continue to be at risk of not realizing anticipated savings, improved infrastructure utilization, or energy efficiency. We also reiterated our recommendation that the agencies complete the missing elements of their inventories and plans.

In addition, while OMB required a master program schedule and a cost-benefit analysis (a type of cost estimate) as key requirements of agencies’ consolidation plans, none of the five agencies we reviewed had a schedule or cost estimate that was fully consistent with the four selected attributes of a properly sequenced schedule (such as having identified dependencies) or the four characteristics that form the basis of a reliable cost estimate (such as being comprehensive and well- documented). OMB had established a standardized cost model to aid agencies in their consolidation planning efforts, but use of the model was voluntary. As a result, we recommended that the five selected agencies should implement recognized best practices when establishing schedules and cost estimates for their consolidation efforts and that OMB ensure agencies utilize its standardized cost model across the consolidation initiative. OMB and three agencies agreed with our recommendation, and two did not agree or disagree with it.

Finally, we highlighted consolidation successes, such as the benefits of focusing on key technologies and the benefits of working with other agencies and components to identify consolidation opportunities. However, agencies continued to report a number of the same challenges that we first described in 2011, while other challenges were evolving. For example, 15 agencies reported continued issues with obtaining power usage information, and 9 agencies reported that their organization continued to struggle with acquiring the funding required for consolidation. In light of these successes and challenges, we noted that it was important for OMB to continue to provide leadership and guidance, such as—as we previously recommended— using the consolidation task force to monitor agencies’ consolidation efforts. Therefore, we recommended that OMB ensure that all future revisions to the guidance on data center consolidation inventories and plans are defined in an OMB memorandum and posted to the FDCCI public website in a manner consistent with the guidance published in 2010. OMB agreed with our recommendation.

Cloud Computing Implementing cloud computing has security implications, which federal agencies began addressing. Further, agencies made progress implementing OMB’s “Cloud First” policy. We reported on these two issues and made recommendations.

In May 2010, we reported that cloud computing can both increase and decrease the security of information systems in federal agencies. Risks included dependence on the security practices and assurances of a vendor, dependency on the vendor, and concerns related to sharing of computing resources. Federal agencies had begun efforts to address information security issues for cloud computing, but key guidance was lacking and efforts remained incomplete. Although individual agencies had identified security measures needed when using cloud computing, they had not always developed corresponding guidance. For example, only nine agencies reported having approved and documented policies and procedures for writing comprehensive agreements with vendors when using cloud computing. Agencies had also identified challenges in implementing existing federal information security guidance and the need to streamline and automate the process of implementing this guidance. These concerns included having a process to assess vendor compliance with government information security requirements and the division of information security responsibilities between the customer and vendor. Among other things, we recommended that OMB establish milestones for completing a strategy for implementing the federal cloud computing initiative.

Federal agencies made progress in implementing OMB’s “Cloud First” Consistent with this policy, each policy, as we reported in July 2012.of the seven agencies in our review incorporated cloud computing requirements into their policies and processes. Further, each of the seven agencies met the OMB deadlines to identify three cloud implementations by February 2011 and to implement at least one service by December 2011. However, two agencies did not plan to meet OMB’s deadline to implement three services by June 2012, but planned to do so by calendar year’s end. Each of the seven agencies also identified opportunities for future cloud implementations, such as moving storage and help desk services to a cloud environment. While each of the seven agencies submitted plans to OMB for implementing the cloud solutions, all but one plan were missing key required elements. As a result, we recommended that the seven agencies develop key planning information, such as estimated costs and legacy IT systems’ retirement plans, for existing and planned services. The agencies generally agreed with these recommendations.

IT Reform Plan OMB’s IT Reform Plan acknowledged many of these acquisition and operation issues by requiring 25 actions to be completed by 2012. For example, it required agencies to launch a best practices collaboration platform and shift to a “Cloud First” policy. We reported on the federal government’s progress toward implementing these actions in April 2012.OMB and key federal agencies had made progress on action items in the IT Reform Plan, but there were several areas where more remained to be done. Specifically, we reviewed 10 actions and found that 3 were complete: design a cadre of specialized IT acquisition professionals. stand-up contract vehicle for infrastructure, reform and strengthen investment review boards, and Additionally, 7 items were partially completed: work with Congress to create budget models for modular complete plans for data center consolidation, issue guidance on modular development, shift to a “Cloud First” policy, work with Congress to consolidate routine IT purchases under agency CIO, launch a best practices platform, and redefine the role of agency CIO and CIO Council.

OMB reported greater progress than we determined. While OMB officials acknowledged that there is more to do in each of the topic areas, they considered the key action items to be completed because the IT Reform Plan has served its purpose as a catalyst for a set of broader initiatives. They explained that work will continue on all of the initiatives even after OMB declares that the related action items are completed under the IT Reform Plan. We disagreed with this approach and noted that in prematurely declaring the action items to be completed, OMB risked losing momentum on the progress it has made to date. We recommended that three agencies complete key IT Reform action items. We also recommended that OMB accurately characterize the status of the IT Reform Plan action items in the upcoming progress report in order to keep momentum going on action items that are not yet completed.

Further, OMB and key agencies planned to continue efforts to address the seven items that we identified as behind schedule, but lacked time frames for completing most of them. For example, OMB had planned to work with congressional committees during the fiscal year 2013 budget process to assist in exploring legislative proposals to establish flexible budget models and to consolidate certain routine IT purchases under agency CIOs. However, OMB had not established time frames for completing five of the seven IT Reform Plan action items that were behind schedule. Accordingly, we recommended that OMB ensure that the action items called for in the IT Reform Plan be completed by the responsible parties prior to the completion of the IT Reform Plan’s 18-month deadline of June 2012, or if the June 2012 deadline could not be met, by another clearly defined deadline; and provide clear time frames for addressing the shortfalls associated with the action items.

Last, OMB had not established performance measures for evaluating the results of most of the IT reform initiatives we reviewed. Specifically, OMB established performance measures for 4 of the 10 action items, including data center consolidation and cloud computing. However, no performance measures existed for 6 other action items, including establishing the best practices collaboration platform and developing a cadre of IT acquisition professionals. Thus, we recommended that OMB establish outcome- oriented measures for each applicable action item.

In summary, OMB’s and agencies’ recent efforts have resulted in greater transparency and oversight of federal spending, but continued leadership and attention is necessary to build on the progress that has been made.

For example, federal agencies need to continue to improve the accuracy of information on the Dashboard to provide greater transparency and even more attention to the billions of dollars invested in troubled projects. Further, the expanded use of the common factors critical to the successful management of large-scale IT acquisitions should result in the more effective delivery of mission-critical systems. In addition, the federal government can more efficiently manage operational systems by ensuring the $54 billion in O&M is continuing to improve mission performance, in particular the $3 billion which had not undergone required analyses. The federal government can also build on the momentum of the $2.4 billion in estimated savings as a result of data center consolidation efforts. Overall, implementation of outstanding GAO recommendations can help further reduce wasteful spending on poorly managed, unnecessary, and duplicative investments.

Chairman Issa, Ranking Member Cummings, and Members of the Committee, this concludes my statement. I would be pleased to answer any questions at this time.

GAO Contact and Staff Acknowledgments

If you should have any questions about this testimony, please contact me at (202) 512-9286 or by e-mail at pownerd@gao.gov. Individuals who made key contributions to this testimony are Dave Hinchman, Assistant Director; Gary Mountjoy, Assistant Director; Rebecca Eyler; Kevin Walsh; and Shawn Ward.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.