Information Technology: Architecture Needed to Guide Modernization of DOD's Financial Operations
Released: 2001-05-17T00:00:00

Letter

Background

DOD is one of the largest and most complex organizations in the world. Defense operations involve about $1 trillion in assets, $310 billion in annual budgetary authority, $24 billion in monthly disbursements, and 3 million military and civilian employees. Moreover, execution of these operations spans a wide range of defense organizations, including the military services and their respective major commands and functional activities, numerous large defense agencies and field activities, and various combatant and joint operational commands that are responsible for military operations for specific geographic regions or theaters of operations.

Effectively managing DOD’s finances across this complex array of organizations is both a formidable challenge and a prerequisite for effective and efficient departmental performance and accountability. Without reliable financial management information, DOD cannot make informed decisions among competing spending priorities and cannot effectively identify opportunities for reducing costs and reallocating resources to pressing needs.

Responsibility for DOD Financial Management Is Shared Among Department Components

DOD’s financial management operations and systems span numerous organizations (see fig. 1). The Under Secretary of Defense (Comptroller) is DOD’s Chief Financial Officer and the principal advisor to the Secretary of Defense for budgetary and fiscal matters. The DOD Comptroller is responsible for promulgating financial management policies and procedures relating to financial management matters and the production of financial statements. Under the Comptroller is DFAS, which was established in November 1990 to consolidate DOD’s diffused disbursement and accounting functions.

Each of DOD’s components (military services and defense agencies) has a financial management and comptroller organization that is responsible for financial matters within that component, except for those performed centrally by DFAS. These functions include managing financial management activities and operations, directing the preparation of budget estimates, approving asset management systems, collecting debts, and accounting for property and inventories. The DOD Comptroller does not have direct authority over any of the financial management organizations within the military services and defense agencies. However, DOD has directed the military services and defense agencies to follow the DOD Comptroller’s guidance and regulations.

With the establishment of DFAS, the military services and defense agencies generally no longer perform the finance (disbursing) and accounting (reporting) functions. However, they continue to perform other financial management functions, such as initiating financial events, obligating and authorizing the expenditure of funds, maintaining stewardship over DOD assets, and accounting for assets, liabilities, and equity. Accordingly, these components are responsible for the systems that create financial event data and “feed” these data to DFAS. According to DOD, the “feeder” systems provide about 80 percent of the financial data used by DFAS.

As shown in figure 2, DFAS uses these data, as well as data from non-DOD entities (contractors, vendors, and commercial carriers), to perform the core financial management functions of transaction processing, accounting, and reporting. Transaction processing includes recording the results of financial events in detailed accounts and disbursing payments to DOD personnel and others. Accounting and reporting uses various subfunctions (see fig. 2) to show the financial impact of all the department’s financial events.

DOD Recognizes the Need to Improve Financial Management Operations and Has Taken Some Steps to Begin Doing So

The department’s long-standing and pervasive financial management problems are well chronicled by the DOD Inspector General (IG), the military service audit agencies, and us. These problems include (1) weaknesses in budget execution accounting, (2) inability to properly account for and report on weapon system support equipment, (3) inability to account for and control its investment in inventories, and (4) inability to capture and accurately report the full costs of its programs.

Such problems led us in 1995 to add DOD financial management to our list of high-risk programs vulnerable to waste, fraud, abuse, and mismanagement. Since 1995, we have continued to designate DOD financial management a high-risk program. DOD has acknowledged that its present financial management environment has serious inadequacies and does not, for the most part, comply with the framework for financial reform set out by the Congress in the Chief Financial Officers Act of 1990 and the Federal Financial Management Improvement Act of 1996, as well as OMB direction and guidance, such as OMB Circular A-127, Financial Management Systems (June 10, 1999).

To help alleviate these problems, the National Defense Authorization Act For Fiscal Year 1998 (P.L. 105-85) directed the Secretary of Defense to submit to Congress a biennial strategic plan for improving financial management within the department. The Secretary submitted DOD’s first Financial Management Improvement Plan to Congress on October 26, 1998. The plan identified over 200 initiatives that were intended to improve the department’s financial operations and systems. In January 1999, we reported that the plan provided the first-ever vision of the department’s future financial management environment. We also noted that the plan was an important first step in improving DOD’s financial management operations, because it discussed for the first time the importance of the programmatic functions of personnel, acquisition, property management, and inventory management to the department’s ability to provide consistent, accurate information. However, we also reported that the plan’s discussion of the future environment was focused on DFAS and did not address how financial management reform and modernization would address such areas as asset accountability and control and budget formulation. Additionally, we reported that the 200 planned initiatives were not clearly linked to DOD’s future financial management environment and that the plan did not address feeder systems’ data integrity. In September 1999, DOD updated the plan, and in July 2000, we testified that although the plan provided more detail on strategies and on the hundreds of improvement initiatives, the fundamental issues that we reported on in January 1999 still remained.

In January 2001, DOD issued an updated plan and stated that it had established a process for the military services and defense agencies to follow in making their respective accounting, finance, and feeder systems compliant with federal financial management requirements. Under the Financial and Feeder System Compliance Process, DOD components are assigned responsibility for ensuring, in consultation with DFAS, that their systems are compliant. Modeled after the department’s Year 2000 process, the process consists of five phases: awareness, evaluation, renovation, validation, and compliance. Each component is to have defined exit criteria for each phase. The Senior Financial Management Oversight Council is to provide oversight and guidance. The National Defense Authorization Act For Fiscal Year 2001 directs that we review the plan and that we report our results to the defense authorization and appropriations committees. Our work to respond to this mandate is ongoing.

Enterprise Architecture: A Key to Effective System Modernization

An enterprise architecture systematically captures in useful models, diagrams, and narrative the full breadth and depth of the mission-based mode of operations for a given enterprise, which can be (1) a single organization or (2) a functional or mission area that transcends more than one organizational boundary (e.g., financial, acquisition, or logistics management). Further, such an architecture describes the enterprise’s operations in both (1) logical terms, such as interrelated business functions, information needs and flows, work locations, and system applications, and (2) technical terms, such as hardware, software, data, communications, and security attributes and performance standards. An architecture also provides operational and technological perspectives or views both for the enterprise’s current (or “as is”) environment and for its target (or “to be”) environment, and it provides an IT capital investment road map for moving between the two environments.

The development, implementation, and maintenance of enterprise architectures are recognized hallmarks of successful public and private sector organizations. Managed properly, an enterprise architecture can clarify and thus help to optimize the interdependencies and interrelationships among an organization’s business operations and the underlying IT infrastructure and applications supporting these operations. Employed in concert with other important IT management controls, such as portfolio investment management (selection, control, and evaluation) practices and continuous information security management practices,enterprise architectures can greatly increase the chances of modernization programs succeeding.

Congress, OMB, and the CIO Council have recognized the importance of enterprise architectures. The Clinger-Cohen Act of 1996 mandates that an agency’s CIO develop, maintain, and facilitate the implementation of these architectures as means for managing the integration of business processes and agency goals with IT. Further, OMB has issued guidance that, among other things, requires system investments to be consistent with these architectures. Similarly, the CIO Council has issued guidance providing (1) a federal framework for the content and structure of an enterprise architecture, (2) a process for assessing investment compliance with an enterprise architecture, and (3) a set of management controls for developing, implementing, and maintaining an enterprise architecture.

DOD has also issued enterprise architecture policy, including a framework defining an architecture’s structure and content. Specifically, in February 1998, DOD directed its components and activities to use the Command, Control, Communications, Computers, Intelligence, Surveillance, and Reconnaissance (C4ISR) Architecture Framework, Version 2.0. According to DOD, the C4ISR Architecture Framework is a critical tool for achieving its strategic direction, and all DOD components and activities should use the framework for all functional areas and domains within the department. The C4ISR Architecture Framework is recognized in the CIO Council’s A Practical Guide to Federal Enterprise Architecture as a model architecture framework. (Appendix II provides more detailed information on the C4ISR Architecture Framework.)

DOD Does Not Have a Departmental Financial Management Enterprise Architecture

DOD does not have an enterprise architecture to guide and constrain the billions of dollars it plans to spend to modernize its financial management operations and systems. Rather, DOD is relying upon three other initiatives for directing operational and technology change in this area: the DOD Financial Management Improvement Plan, a DFAS enterprise architecture that is under development, and the DOD Financial and Feeder System Compliance Process. While each of these three initiatives has value, neither singularly nor collectively do they provide sufficient architectural definition, as specified by the DOD C4ISR Architecture Framework, for modernizing something as large and complex as DOD financial management. Moreover, none of the DOD entities responsible for these initiatives currently have plans for producing a departmentwide architecture.

DOD’s Enterprise Architecture Framework: A Brief Description

The C4ISR Architecture Framework, Version 2.0, defines the type and content of architectural artifacts, as well as the relationships among artifacts, that are needed to produce a useful enterprise architecture. Briefly, the framework decomposes an enterprise architecture into three primary views (windows into how the enterprise operates): the operational, systems, and technical views. According to DOD, the three interdependent views are needed to ensure that IT systems are developed and implemented in an interoperable and cost-effective manner. Each of these views is summarized below. (Fig. 3 is a simplified diagram depicting the interrelationships among the views.)

The operational architecture view defines the operational elements, activities, tasks, and information flows required to accomplish or support an organizational mission or business function. According to DOD, it is useful for facilitating a number of actions and assessments across DOD, such as examining business processes for reengineering or defining operational requirements to be supported by physical resources and systems.

The systems architecture view defines the systems and their interconnections supporting the organizational or functional mission in context with the operational view, including how multiple systems link and interoperate, and may describe the internal construction and operations of particular systems. According to DOD, this view has many uses, such as helping managers to evaluate interoperability improvement and to make investment decisions concerning cost-effective ways to satisfy operational requirements.

The technical architecture view defines a minimum set of standards and rules governing the arrangement, interaction, and interdependence of system applications and infrastructure. It provides the technical standards, criteria, and reference models upon which engineering specifications are based, common building blocks are established, and applications are developed.

Within the three architectural views, the C4ISR Architecture Framework identifies 26 graphical, textual, and tabular architectural artifacts or products. Of the 26, DOD specifies that 7 are essential and must be developed for each enterprise architecture. Table 1 briefly describes the content of each essential product.

DOD’s Financial Management Improvement Plan Is Not an Enterprise Architecture

DOD Comptroller officials acknowledge that they do not have an enterprise architecture for the department’s financial management functional area. Rather, they stated that DOD is relying upon the Financial Management Improvement Plan to describe the department’s vision of its future financial management operations and to define the interim strategies for achieving this vision.

We compared this plan against DOD’s C4ISR Architecture Framework requirements and determined that the plan is not a sufficient surrogate for a financial management enterprise architecture. To DOD’s credit, the plan provides useful conceptual information on the department’s current and future financial management operations and supporting systems, and briefly describes over 200 initiatives for transitioning to this future state. Also, the plan provides some information on existing interfaces between components’ feeder systems and DFAS’ finance and accounting systems. In our view, such information would be valuable input in developing an enterprise architecture. However, the plan does not satisfy any of the C4ISR Architecture Framework requirements for essential products.

For example, the plan does not provide a full definition of each of the department’s financial management processes or discuss the interrelationships among the processes and related systems. More specifically, the plan does not address the entire business process for property, from acquisition to disposal, nor the interrelationships among the functional areas of acquisition, property management, and property accounting. Additionally, the plan does not provide specific information (1) defining the operational elements that produce, consume, or process data; (2) describing the information exchanged between operational elements; and (3) specifying the characteristics of information being exchanged (content, format, media, volume, security classification, timeliness, and interoperability requirements). Further, the plan does not define the interfaces between systems in terms of the procedures governing the systems, applications present, infrastructure capabilities and services supporting the applications, and the means by which the systems process, manipulate, store, and exchange data. Such information, which is part of the operational and systems view product requirements, is critical for linking information system requirements with the functional processes that support the agency’s mission.

DFAS’ Efforts to Develop an Enterprise Architecture Are Not Complete and Include Only Finance and Accounting Functions

DFAS recognizes that it needs an enterprise architecture to guide and constrain its investment in modern finance and accounting systems, and it has begun efforts to develop one. As of February 2001, DFAS had drafted three of the seven essential products defined in the DOD C4ISR Architecture Framework. However, DFAS had not validated any of the three products and had yet to begin developing the other four essential products. Moreover, our analysis of the three draft products showed that none of the three fully satisfied DOD’s requirements. Table 2 summarizes this analysis.

Examples of essential products that DFAS has yet to draft include the following: The overview and summary information should provide a unique descriptive name for the architecture; explain why the architecture is needed, what it is intended to demonstrate, and what views and products will be developed; and describe known and anticipated linkages to other DOD enterprise architectures. This information is needed to guide the development of other architecture products and to assist in the integration of enterprise architectures across the department.

The operational node connectivity description and the operational information exchange matrix should specifically define the operational elements that produce, consume, or process financial management information; the nature and content of information transfers among these operational elements; and the characteristics of the exchanged information (such as content, format, media, volume, security classification, timeliness, and interoperability requirements). This information is essential to ensure that modernized designs for organizational alignment, business processes, and system and infrastructure optimize mission performance.

DFAS has drafted various documents that partially satisfy the requirements for three essential products. For example, the DFAS Finance and Accounting Activity (Process) Model provides a functional decomposition of all finance and accounting processes, including the inputs, outputs, and controls, showing how an activity is to be performed in the target environment. However, this model does not provide required information on where a process activity is to be performed and who is responsible for performing the activity.

Besides being incomplete, in that they do not include all essential architectural products specified by the DOD C4ISR Architecture Framework, DFAS’ architectural documents do not include DOD financial management operations and supporting systems that are outside DFAS’ span of control. DFAS recognizes that systems outside its boundaries provide data that are critical for its finance and accounting mission performance and accountability. For example, the systems view states that DFAS cannot control the characteristics of any external system. As a result, the systems view does not include the approximately 90 feeder systems belonging to the military services and defense agencies that support other functional areas (e.g., acquisition management, inventory management, and human capital management) and according to DOD originate and process about 80 percent of the data that DFAS uses. Rather, this product states that interoperability between DFAS and the feeder systems must be achieved through properly and completely defined interfaces—hardware and software that can integrate disparate systems and their data sets. However, the systems view does not define these interfaces.

DFAS officials agreed that they have not yet completed the essential architectural products, as defined by the DOD C4ISR Architecture Framework. According to the CIO, DFAS intends to develop and validate these products, but it has not developed a plan that specifies when they will be completed. Additionally, even if the agency completes its architecture, it will be limited to DFAS’ organizational boundaries, meaning that this architecture will omit important DOD financial management operations and systems.

Financial and Feeder System Compliance Process Does Not Include an Architecture

DOD’s Financial and Feeder System Compliance Process and the charter of the Council that is overseeing the process, while not precluding development and use of a DOD financial management enterprise architecture, do not explicitly provide for developing and using one as part of either this process or DOD’s other financial management modernization efforts. Like the Year 2000 program that it is modeled after, the compliance process is designed to correct weaknesses in the current accounting, finance, and feeder systems so that they substantially comply with federal financial systems requirements, federal accounting standards, and the U.S. Government Standard General Ledger at the transaction level as mandated by the Federal Financial Management Improvement Act of 1996. These corrective actions include making procedural changes to improve management controls surrounding manual interfaces among systems, as well as making changes to software and hardware to introduce missing management controls.

Under the compliance process, each component establishes its own plans and criteria for system compliance. The Council approves the compliance plans and criteria, coordinates efforts among components, and ensures that defined compliance criteria are met. The purpose of the process is to ensure that the accounting, finance, and feeder systems provide timely and accurate financial data to senior DOD decisionmakers and help achieve favorable audit opinions on the department’s financial statements. As a result, the process is intended to modify rather than modernize and optimize the department’s current financial management operations through such actions as eliminating duplicative systems, promoting system interoperability, and/or reengineering business processes.

Structures and Processes Are Not in Place to Effectively Develop and Implement a DOD Financial Management Enterprise Architecture

The CIO Council, in collaboration with OMB and us, has incorporated enterprise architecture management practices used by successful public and private sector organizations into a management framework for effectively developing, implementing, and maintaining enterprise architectures. This framework consists of eight interrelated phases, including steps for obtaining executive support, for establishing management structures and process controls, and for initiating, developing, and maintaining an enterprise architecture program (see fig. 4).

The DOD organizations currently involved in directing financial management modernization activities, namely the DOD Comptroller Office, the DFAS CIO Office, and the Senior Financial Management Oversight Council, neither singularly nor collectively have in place the necessary structural and process controls needed for effectively developing and implementing an enterprise architecture. Rather, these organizations are continuing DOD’s traditional practice of having components independently implement business processes and supporting systems—a practice that has historically produced systems that are duplicative, not interoperable, and unnecessarily costly to interface and maintain, and that do not optimize DOD-wide financial management performance and accountability.

DOD Does Not Have Management Structures and Processes to Effectively Develop a Financial Management Enterprise Architecture

Among other things, the architecture and management guide published by the CIO Council presents the following recognized practices for successfully initiating and developing an enterprise architecture: Because the enterprise architecture is a corporate asset for systematically managing institutional change, the support and sponsorship of the head of the enterprise are essential for the architecture effort to be successful. Obtaining a clear mandate for the architecture in the form of an enterprise policy statement is a critical success factor and will be instrumental in gaining the buy-in and commitment of all organizational components of the enterprise, whose participation is vital to successfully developing and implementing the enterprise’s architecture.

The enterprise architecture effort should be directed and overseen by an executive body empowered by the head of the enterprise, whose members represent all stakeholder organizations and have the authority to commit resources and to make and enforce decisions for their respective organizations.

The enterprise architecture effort should be led by a Chief Architect and managed as a formal program: that is, a program office should be created, core staff committed, a program management plan implemented that details work breakdown structures and schedules, budgetary resources and tools allocated, basic program management functions performed (e.g., risk management, change control, quality assurance, configuration management), and progress tracked and reported against measurable goals.

The enterprise architecture’s intended use should be defined and its appropriate scope and definitional depth specified. In doing so, it is critically important that architecture development be approached in a top- down, incremental manner, consistent with the hierarchical architectural views that are the building blocks of published architecture frameworks, such as the DOD C4ISR Architecture Framework. It is equally important that the higher level architecture views span the entire enterprise. Only then can the needed enterprisewide understanding be developed to permit informed decisions about whether the enterprise, and thus the enterprise architecture, can be compartmentalized without sacrificing its intended purpose.

The enterprise architecture should be developed according to a specified framework and using an interactive architecture development and maintenance tool.

As shown in table 3, the financial management improvement efforts being sponsored by the DOD Comptroller, DFAS, and the Senior Financial Management Oversight Council do not satisfy most of these recognized practices for effective enterprise architecture development.

For example, while DFAS’ ongoing architecture development efforts are following the DOD C4ISR Architecture Framework, the scope of these efforts is limited to what DFAS can control; therefore, even if its architecture is completed, it will not provide a sufficient basis for effective and efficient DOD-wide financial management change. Moreover, DFAS is not managing its architecture effort as a program, with a Chief Architect, detailed development plans and work breakdown structures and schedules, requisite resources, established progress and performance measures, and progress reporting against these measures. During the course of our work, the DFAS CIO told us that the agency would take steps to strengthen its architecture management controls, such as establishing an architecture council made up of senior agency management that will be responsible for completing the architecture. In February 2001, the DFAS CIO stated that the council had been established and its charter drafted. However, DFAS has yet to develop a detailed plan with milestones for the completion of the remaining four essential products.

Similarly, neither the DOD Comptroller, who is responsible for DOD’s Financial Management Improvement Plan, nor the Senior Financial Management Oversight Council, which is responsible for the Financial and Feeder System Compliance Process, plans to develop a DOD financial management architecture, nor to implement the above-cited practices for architecture development.

DOD Does Not Have Management Structures and Processes to Effectively Implement a Financial Management Enterprise Architecture

According to CIO Council guidance, the following are recognized practices to successfully implementing an enterprise architecture: The enterprise architecture should be integrated into the enterprise’s capital planning and investment control process and its project life-cycle development/acquisition management process. Compliance of new and ongoing investment projects with the architecture should be addressed by the enterprise’s investment decisionmaking body at the projects’ key life- cycle decision points.

All enterprise IT capital investments should be compliant with the enterprise architecture as a condition of approval and funding; waivers to the architecture compliance requirement should be granted only if a compelling case can be made for doing so.

An architecture technical review committee should be established to assess the architectural alignment of proposed investments and make recommendations to the enterprise’s capital investment decisionmaking body.

As shown in table 4, the financial management improvement efforts being sponsored by the DOD Comptroller, DFAS, and the Senior Financial Management Oversight Council do not satisfy these recognized practices for effective implementation of an enterprise architecture.

Since DOD has not developed a complete DOD financial management enterprise architecture, it cannot determine whether proposed system investments are compliant with one. However, even if such an architecture existed, neither DFAS nor the DOD Comptroller has the investment decisionmaking authority across all DOD financial management operations to ensure that modernization investments comply with the architecture. Further, neither has established the structural and process controls cited above to ensure that DOD financial management investments are architecturally compliant.

According to a representative of the DOD Comptroller, rather than develop and implement a financial management architecture, the DOD Comptroller’s office is working with the DOD CIO’s office to implement portfolio management as a way of guiding and constraining the department’s financial management investments. However, portfolio management cannot be fully effective without an enterprise architecture. According to OMB Circular A-130 and the CIO Council’s published enterprise architecture management guide, effectively managing an investment portfolio, whether it is based on an organization or a functional area, requires that the portfolio be grounded in and derived from the enterprise architecture capital investment sequencing plan. Moreover, the DOD CIO’s draft policy and guidance on portfolio management state that functional area portfolios should be based on architectures. Thus, the DOD Comptroller Office’s plans for employing portfolio investment management in place of an enterprise architecture are not consistent with OMB and DOD positions.

Also, the Senior Financial Management Oversight Council’s charter, while not precluding the Council from enforcing the implementation of an enterprise architecture, if one existed, does not explicitly provide for this role and responsibility, nor for establishing any type of architecture technical review committee to support the Council in doing so. Instead, the Council is to be the final approval authority for all action plans developed by the military services and defense agencies; provide oversight and guidance on all matters concerning the compliance process; review the status of the applicable systems efforts at least quarterly; approve the exit criteria for the phases of the compliance process; establish and oversee a Systems Compliance Working Group to, among other things, (1) review all corrective action plans developed by the military services and defense agencies before they are submitted to the Council and the head of the responsible component, (2) coordinate actions pertaining to compliance of critical accounting, finance, and feeder systems with the respective components, (3) review quarterly status briefings, and (4) recommend systems for exit from the phases of the compliance process; and verify that all established exit criteria for a particular phase have been fulfilled.

Without a Complete and Enforced Financial Management Architecture, Neither DOD’s Existing Systems Nor Its Modernization Plans Are Well Integrated

DOD has long operated and evolved its existing financial management processes and systems without a financial management enterprise architecture. Under this approach, each military service and defense agency developed its own processes and supporting systems independently from one another. Even after the establishment of DFAS to consolidate certain financial management operations and systems, DOD components have continued to play a vital role in the end-to-end financial management process. Specifically, the components still operate and maintain their own unique program management systems that capture financial event data and provide these data to DFAS for its use in preparing various financial reports on DOD operations. To further complicate this situation, the financial management functions that are performed by DFAS and the components have been allowed to vary from component to component.

The result of this architecturally unguided and unconstrained environment is understandably a collection of existing DOD financial management processes and systems that are nonstandard and “siloed,” causing processes to be slow and susceptible to error. In many cases, the use of hard-copy information, such as from faxed forms, and manual entry are necessary to ensure that data from the feeder systems are entered into DFAS’ systems. This extensive reliance on these manual interfaces means that millions of transactions must be keyed and rekeyed into multiple systems. This lack of standard finance and accounting processes and the difficulty of sharing data among heterogeneous systems are a root cause of multiple problems, including (1) disbursements that are not properly matched to specific obligations recorded in the department’s records, (2) unauditable financial statements, (3) delays in obtaining data, (4) duplicate system interfaces that must be maintained, and (5) manual reconciliation of the reported differences between different sets of records.

Another example of this lack of standardization is the complex line of accounting code required for recording of financial transactions; these codes accumulate appropriation, budget, and management information. To illustrate, the following line of code is used for the Army’s Operations and Maintenance appropriation: An error in any one character in such a line of code can delay payment processing or affect the reliability of the data used to support management and budget decisions. Compounding this problem is that the lines of code are not standard between the military services and fund types.

Without a financial management enterprise architecture, DOD will perpetuate its existing problems of disparate and noninteroperable processes and systems. According to a recent DOD Inspector General report, these problems continue. The DOD Inspector General reported that DFAS’ current modernization efforts are not being managed as an integrated set of projects and thus will not likely succeed in creating a set of integrated financial management systems. The report stated that effective and comprehensive management controls and oversight were needed to achieve the DOD financial management modernization goals of standardized business processes and a reduced number of accounting, finance, and feeder systems. These management controls and oversight include effective use of a financial management enterprise architecture.

Currently, DOD is investing and planning to invest significant resources to address its financial management challenges. DFAS, military service, and defense agency financial management modernization initiatives number in the hundreds and are expected to cost billions of dollars. However, because responsibility and accountability for these initiatives are diffused across many DOD components and activities, and because these initiatives are not part of an integrated portfolio of investments, departmentwide aggregated information on the estimated costs for these initiatives is limited.

To illustrate, DFAS currently has 32 modernization projects underway, but neither DFAS’ System Integration Directorate nor its CIO could provide us with either the total acquisition cost or the life-cycle cost of these projects, because such information is not maintained centrally in DFAS and would have to be obtained from the managers for the respective projects. Instead of estimated costs, DFAS officials provided budgetary data for fiscal years 2000 through 2007, which show that DFAS plans to invest $2.2 billion during this 8-year period to acquire and operate systems associated with its modernization activities.

Similarly, DOD does not have a reliable estimate of the cost to make the military service and defense agency feeder systems compliant with federal financial management requirements. While the Financial Management Improvement Plan identifies approximately $1.4 billion, this covers only a portion of the projects identified in the plan. Moreover, the Director for Business Policy, Office of the DOD Comptroller, who is responsible for maintaining the plan, told us that this cost estimate was questionable and that one of the first steps in the Financial and Feeder System Compliance Process is to develop a reliable cost estimate for the effort.

We also found that some DOD components are investing in different financial management solutions. For example, the Army, Naval Air Systems Command, and the Defense Logistics Agency (DLA) have separate programs underway that are estimated to cost about $700 million, $750 million, and $900 million, respectively, to implement different commercially available products for automating and reengineering various enterprise operations. Among the functions that these commercial “enterprise resource planning” products address is financial management. In the case of DLA, the agency plans to establish teams that would define interfaces (hardware and software) that are to perform, for example, rate conversion to allow DLA to exchange information with DFAS and others.

DOD acknowledges the need to manage the relationships among these different modernization activities. Specifically, it recently issued a program budget decision directing all components that are pursuing enterprise resource planning solutions to report to the Deputy Chief Financial Officer by March 31, 2001, on how their respective efforts will use and interface with DOD’s current and planned standard systems. Additionally, in the future, all DOD components must submit a similar report no later than 90 days after they decide to begin planning or designing an enterprise resource planning systems solution. While this decision acknowledges the above-cited problem of DOD components investing separately in financial management processes, it does not address the root problem—that a DOD-wide financial management enterprise architecture is not being used to guide and constrain these investments.

Conclusions

DOD does not have a financial management enterprise architecture, and it does not currently have the management structures and processes in place to effectively develop, implement, and maintain one. DOD has not applied recognized best practices: in particular, support and sponsorship by the head of the enterprise, and assignment of accountability and commensurate authority for developing, implementing, and maintaining a DOD-wide financial management enterprise architecture. Nevertheless, DOD’s various components are either spending or planning to spend billions of dollars to acquire new or modify existing financial management systems. In the absence of a complete, enforceable enterprise architecture for DOD-wide financial management operations and systems, making such investments is unwise. If DOD continues down this road, it runs the serious risk that its components will spend billions of dollars modifying and modernizing financial management systems independently from one another, resulting in DOD perpetuating an existing systems environment that suffers from duplication of systems, limited interoperablity, and unnecessarily costly operations and maintenance.

As part of its plans for investing in financial management systems modernization, DOD has taken some actions that appropriately exploit lessons learned from its Year 2000 program. DOD can build upon actions such as these and activities already underway to ensure that it employs recognized best practices for enterprise architecture management. DOD can thus position itself to cost effectively manage the billions of dollars it plans to spend to address its high-risk financial management operations. This approach will increase DOD’s chances of modernizing its financial management operations and supporting systems in a way that will optimize financial management performance and accountability.

Recommendations for Executive Action

We recommend that the Secretary of Defense immediately designate DOD financial management modernization a departmental priority and accordingly direct the Deputy Secretary of Defense to lead an integrated program across the department for modernizing and optimizing financial management operations and systems.

We further recommend that the Secretary immediately (1) issue a DOD policy that directs the development, implementation, and maintenance of a financial management enterprise architecture and (2) modify the Senior Financial Management Oversight Council’s charter to designate the Deputy Secretary of Defense as the Council chair and the Under Secretary of Defense (Comptroller) as the Council vice-chair; empower the Council to serve as DOD’s financial management enterprise architecture steering committee, giving it the responsibility and authority to ensure that a DOD financial management enterprise architecture is developed and maintained in accordance with the DOD C4ISR Architecture Framework; empower the Council to serve as DOD’s financial management investment review board, giving it the responsibility and authority to (1) select and control all DOD financial management investments and (2) ensure that its investment decisions treat compliance with the financial management enterprise architecture as an explicit condition for investment approval that can be waived only if justified by a compelling written analysis; and expand the role of the Council’s System Compliance Working Group to include supporting the Council in determining the compliance of each system investment with the enterprise architecture at key decision points in the system’s development or acquisition life cycle.

Additionally, we recommend that the Secretary immediately make the Assistant Secretary of Defense (Command, Control, Communications & Intelligence), in collaboration with the Under Secretary of Defense (Comptroller), accountable to the Senior Financial Management Oversight Council for developing and maintaining a DOD financial management enterprise architecture. In fulfilling this responsibility, we recommend that the Assistant Secretary appoint a Chief Architect for DOD financial management modernization and establish and adequately staff and fund an enterprise architecture program office that is responsible for developing and maintaining a DOD-wide financial management enterprise architecture in a manner that is consistent with the framework defined in the CIO Council’s published guide for managing enterprise architectures. In particular, the Assistant Secretary should take appropriate steps to ensure that the Chief Architect obtains executive buy-in and support, establishes architecture management structure and controls, defines the architecture process and approach, develops the baseline architecture, the target architecture, and the sequencing plan, facilitates the use of the architecture to guide financial management modernization projects and investments, and maintains the architecture.

In addition, we recommend that the Assistant Secretary of Defense (Command, Control, Communications & Intelligence) report at least quarterly to the Senior Financial Management Oversight Council on the Chief Architect’s progress in developing a financial management enterprise architecture, including the Chief Architect’s adherence to enterprise architecture policy and guidance from OMB, the CIO Council, and DOD.

Further, we recommend that the Senior Financial Management Oversight Council report to the Secretary of Defense every 6 months on progress in developing and implementing a financial management enterprise architecture. We also recommend that the Secretary report every 6 months to the congressional defense authorizing and appropriating committees on progress in developing and implementing a financial management enterprise architecture.

Until a financial management enterprise architecture is developed and the Council is positioned to serve as DOD’s financial management investment review board as recommended above, we also recommend that the Secretary of Defense limit DOD components’ financial management investments to (1) deployment of systems that have already been fully tested and involve no additional development or acquisition cost, (2) stay- in-business maintenance needed to keep existing systems operational, (3) management controls needed to effectively invest in modernized systems, and (4) new systems or existing system changes that are congressionally directed or are relatively small, cost effective, and low risk and can be delivered in a relatively short time frame.

Agency Comments

In written comments on a draft of this report, the DOD Deputy Comptroller stated that the Secretary of Defense is committed to improving the department’s financial management operations and providing departmental managers and the Congress with more accurate and reliable information for use in the decisionmaking process (see appendix III). The Deputy Comptroller further stated that the department would consider our recommendations, in conjunction with recommendations from ongoing studies directed by the Secretary, in developing a strategy to improve DOD’s financial management operations.

This report contains recommendations to you. The head of a federal agency is required by 31 U.S.C. 720 to submit a written statement on actions taken on these recommendations. You should submit your statement to the Senate Committee on Governmental Affairs and the House Committee on Government Reform within 60 days of the date of this report. A written statement also must be sent to the House and Senate Committees with the agency’s first request for appropriations made more than 60 days after the date of this report.

We are sending copies of this report to Senator John Warner, Chairman, and Senator Carl Levin, Ranking Member, Senate Committee on Armed Services; Senator Ted Stevens, Chairman, and Senator Daniel Inouye, Ranking Member, Senate Appropriations Subcommittee on Defense; Representative Bob Stump, Chairman, and Representative Ike Skelton, Ranking Democratic Member, House Armed Services Committee; Representative Jerry Lewis, Chairman, and Representative John P. Murtha, Ranking Minority Member, House Appropriations Subcommittee on Defense; Representative Stephen Horn, Chairman, and Representative Janice D. Schakowsky, Ranking Minority Member, Subcommittee on Government Efficiency, Financial Management, and Intergovernmental Relations, House Committee on Government Reform; the Honorable Mitchell E. Daniels Jr., Director, Office of Management and Budget; the Honorable Dov S. Zakheim, Under Secretary of Defense (Comptroller); and the Honorable Thomas R. Bloom, Director, Defense Finance and Accounting Service. Copies of this report will be made available to others upon request.

If you or your staff have any questions on matters discussed in this report, please contact either of us at (202) 512-3439 or (202) 512-9095. We can also be reached by e-mail at hiter@gao.gov or kutzg@gao.gov. Key contributors to this report were Robert L. Crocker, Jr., Jean K. Lee, Madhav S. Panwar, Sanford F. Reigle, Phillip E. Rutar, and Darby W. Smith.

Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to determine (1) the status of DOD’s efforts to develop and implement a departmentwide financial management enterprise architecture to guide and constrain its modernization program and (2) the effectiveness of DOD’s structures and processes for managing this architecture.

To determine the status of DOD’s efforts to develop this architecture, we reviewed relevant federal and DOD enterprise architecture policy and guidance, including OMB memorandums and circulars, the CIO Council’s Federal Enterprise Architecture Framework Version 1.1, and DOD’s Command, Control, Communications, Computers, Intelligence, Surveillance, and Reconnaissance (C4ISR) Architecture Framework, Version 2.0. In addition, we identified the DOD organizations involved in efforts to reform and modernize DOD financial management operations and systems, as well as organizations responsible for DOD policy and guidance on enterprise architectures, including the Office of the Under Secretary of Defense (Comptroller); the Office of the Assistant Secretary of Defense (Command, Control, Communications and Intelligence); the DFAS Office of the Director, Information and Technology; and the DFAS Office of the Director for Systems Integration. From each of these organizations, we solicited information on plans and activities that defined the form and content of these reform and modernization efforts. We then questioned officials from each organization about planned and existing architectural documents and obtained copies of all such plans and architectural documents. Next, we analyzed the information provided, including DOD’s Financial Management Improvement Plans, DOD’s Financial and Feeder Systems Compliance Process documentation, and available DFAS enterprise architecture documentation, against DOD’s C4ISR Architecture Framework to determine the extent to which these organizations individually or collectively had produced architectural documentation that satisfied DOD requirements.

To determine the effectiveness of DOD’s structure and processes for managing the development and implementation of a financial management enterprise architecture, we obtained and reviewed the CIO Council’s A Practical Guide to Federal Enterprise Architecture, Version 1.0, as well as published information related to the enterprise architecture best practices that the guide is based upon. We then obtained descriptions of the management controls in place, including policies, procedures, and charters, for these organizations and their respective reform and modernization activities. We also interviewed officials from these organizations about controls in place and planned. We then analyzed these controls against the best practices described in the CIO Council guide to identify any variances.

Additionally, we requested cost data on DFAS’ modernization program and reviewed information in the Year 2000 Financial Management Improvement Plan about other DOD component initiatives to improve systems that provide financial management data. We then discussed with DFAS officials the nature and extent of efforts underway to define the relationship between the DFAS modernization program and the financial elements of these improvement initiatives.

We conducted our work at the above-cited agencies and offices in Washington, D.C., and Crystal City, VA. We performed our review from April 2000 through March 2001 in accordance with generally accepted government auditing standards.

Appendix II: Description of DOD Architecture Framework Essential Products

The C4ISR Architecture Framework, Version 2.0, provides the rules, guidance, and products for all DOD components to use in developing enterprise architectures. This framework requires three interrelated architecture views: operational, systems, and technical. Within these views, the framework defines a total of 26 architecture products and designates 7 of these products essential or mandatory for all architectures. According to the framework, these seven products provide the minimum architectural description needed to permit, among other things, integration of architectures across the department and informed investment decisionmaking. Each of these seven essential products is described below under the primary view that it supports. Two of the products support all three views and are described under “All Views.”

All Views

The overview and summary information serves initially as a planning guide. Once the architecture products are developed, it provides summary textual information. Among other things, it provides a unique descriptive name for the architecture, the architect, involved organizations, and development date; descriptions of why the architecture is needed, what it is to demonstrate, types of analyses to be applied to it, who is to do the analyses, what decisions are to be made based on the analyses, who is to make the decisions, and what actions are to result from the architecture; identification of architecture views and products to be developed and the temporal nature of the architecture, including time frame covered or designations such as “as is,” “to be,” “transitional,” and/or “objective”; context description of interrelated conditions forming the architecture setting, including doctrine, relevant goals, vision statements, concepts of operation, scenarios, and environmental conditions; tasking for developing the architecture; known or anticipated linkages to other architectures; specific assumptions and constraints regarding the architecture development; and identification of authoritative sources for rules, criteria, and conventions to be followed; findings and recommendations developed based on the architecture; and tools and file formats used to develop architecture data and products, including file names, file format, and location of data for each architecture product.

The integrated dictionary provides a central source for all definitions and metadata used to describe the architecture. At a minimum, it is intended to be a glossary with definitions of terms used in a given architecture. It is also intended to allow the set of architecture products to stand alone and to be read and understood without reference to other documents.

Operational View

The high-level operational concept graphic is the most general of the architecture description products. It shows missions, high-level operations, organizations, and geographic distribution of assets. The product’s main purpose is to facilitate human communication; it is intended for presentation to high-level decisionmakers. The product is also intended to orient and focus detailed discussions.

The operational node connectivity description describes operational nodes, needlines, and the characteristics of the data or information exchanged over the needlines. The product helps ensure comparability and integratability across architectures and to provide linkages among nodes and the activities performed by nodes.

The operational information exchange matrix defines activities and the information exchange requirements across the three basic entities of an operational architecture view. The emphasis in this product is on the logical and operational flow of the information, including who exchanges what information with whom, why the information is necessary, how the information is exchanged, and the relevant attributes of the information exchanged including its medium (data, voice, and video), its quality (frequency, timeliness, and security), and its quantity (volume and speed).

Systems View

The system interface description links the operational and systems architecture views by depicting the assignments of systems and their interfaces to the nodes and needlines described in the operational node connectivity description. While the operational node connectivity description shows operational nodes, the system interface description depicts the corresponding system nodes that implement the operational node’s activities. It explicitly relates each system to the operational activities and the information exchange needlines shown in the operational node connectivity description. The product includes description of specific resource allocations (i.e., people, platforms, facilities, and systems), description of interfaces among system nodes, systems, and system graphic descriptions and/or text detailing the capabilities present in each system (i.e., applications, infrastructure services, and interfaces).

Technical View

The technical architecture profile cites the technical standards that apply to the architecture and its implementation. In most cases, especially in describing architectures whose scope is less than a DOD component, building the technical architecture view will consist of identifying the applicable portions of existing technical guidance documentation, tailoring those portions as needed, and filling in any gaps. The DOD C4ISR Architecture Framework identifies some of the existing universal reference resources that will help build the technical architecture view, including the following: C4ISR core architecture data model—a logical data model of information used to describe and build architectures; Defense data dictionary system—a repository of standard data definitions, formats, usage, and structures; Levels of information systems interoperability—a reference model of interoperability levels and operational, systems, and technical architecture associations; Technical reference model—a common conceptual framework and vocabulary encompassing a representation of the information system domain; Defense information infrastructure common operation environment—a framework for systems development encompassing systems architecture standards, software, reuse, sharable data, interoperability, and automated integration; Shared data environment—a strategy and mechanism for data sharing in the context of systems compliant with the defense information infrastructure common operation environment; and Joint technical architecture—information technology standards and guidelines.

Appendix III: Comments From the Department of Defense