DOD is the largest U.S. government department and one of the most complex organizations in the world. In support of its military operations, the department manages many interdependent business functions, including logistics management, procurement, health care management, and financial management. DOD relies extensively on IT to support its business functions. The department’s IT budget organizes investments in four categories, called mission areas—enterprise information environment, business, warfighting, and intelligence. Figure 1 shows the amount of DOD’s total requested fiscal year 2020 IT budget (of $36.1 billion) that the department plans to spend on each of its mission areas (including the approximately $8.9 billion it plans to spend on developing, modernizing, operating, and maintaining its business systems). The department further organizes its IT budget by segments. In this regard, the business mission area segments are logistics/supply chain management, human resource management, health, financial management, acquisition, real property management, training and readiness, other business services, and defense security enterprise. Figure 2 shows the department’s projected fiscal year 2020 spending (of $8.9 billion) for each segment in the business mission area. As amended in 2016, the U.S. Code requires DOD to perform certain activities aimed at ensuring that its business system investments are managed efficiently and effectively. Specifically, the amendments established four sets of requirements for the department related to (1) issuing policy and guidance for managing defense business systems; (2) developing and maintaining a defense business enterprise architecture; (3) establishing a Defense Business Council to provide advice to the Secretary on managing defense business systems; and (4) obtaining approvals before systems proceed into development (or if no development is required, into production or fielding). Further, the amendments to the code established specific designations and thresholds that, among other things, provided additional details about the department’s requirements: Covered defense business systems. The code defines a covered defense business system as a system that is expected to have a total amount of budget authority of over $50 million over a period of 5 years or more. Priority defense business systems. The code establishes a category of system, called a priority defense business system. This refers to a system that is (1) expected to have a total amount of budget authority of over $250 million over the period of the current future-years defense program, or (2) designated by the DOD chief management officer (CMO) as a priority defense business system based on specific program analyses of factors including complexity, scope, and technical risk, and after notification to Congress of such designation. Thresholds and officials responsible for review and certification of defense business systems. The code states that, unless otherwise assigned by the Secretary of Defense, military department CMOs are to have approval authority for their covered defense business system investments of below $250 million over the future- years defense program. The CMO is to have approval authority for defense business systems owned by DOD components other than the military departments, systems that will support the business process of more than one military department or other component, and priority defense business systems. Certification requirements. The code requires that a defense business system program be reviewed and certified at least annually, on the basis of its compliance with the business enterprise architecture and appropriate business process reengineering. In addition, the code requires that the business system program be reviewed and certified on the basis of having valid, achievable requirements and a viable plan for implementing the requirements; having an acquisition strategy designed to eliminate or reduce the need to tailor commercial off-the-shelf systems; and being in compliance with the department’s auditability requirements. DOD Instruction 5000.75: Business System Requirements and Acquisitions assigns roles and responsibilities for managing defense business system investments. Table 1 identifies the key entities and their responsibilities for managing defense business system investments. GAO designated the department’s business systems modernization efforts as high risk in 1995 and has continued to do so in the years since. In addition, since 2005, we have issued 12 reports in which we assessed DOD’s actions to respond to the business system investment management requirements contained in U.S. Code Title 10, Section 2222. These 12 reports, which are listed in appendix I, collectively contained 29 recommendations to help strengthen the department’s management of its business systems. For example, In 2014, we reported that DOD had taken steps to comply with key provisions in the NDAA for Fiscal Year 2005; however, the department continued to face challenges in fully complying with the provisions and modernizing its business systems environment. As a result, we recommended that the department improve its business system certification and approval process. DOD agreed with, and implemented this recommendation. In 2015, we reported that DOD had implemented 5 of the 16 recommendations made by GAO since June 2011 to address each of the overarching provisions for improving business systems management described in the NDAA for Fiscal Year 2005. The department had partially implemented the other 11 recommendations. We also reported that DOD’s business enterprise architecture and process reengineering efforts were not fully achieving the intended outcomes described in statute. Thus, we made a recommendation aimed at ensuring that the department better achieve business process reengineering and enterprise architecture outcomes and benefits. DOD agreed with this recommendation and took steps toward implementing it. In 2018, we reported that DOD had made progress in complying with most legislative provisions for managing its defense business systems, but that additional actions were needed. For example, the NDAA for Fiscal Year 2016 required DOD and the military departments to issue guidance to address five requirements for reviewing and certifying the department’s business systems. We reported that, while DOD had issued guidance addressing all of the requirements, the military departments had shown mixed progress. Accordingly, we recommended that the military departments issue guidance to address certifiying their business systems on the basis of the five requirements. While DOD partially agreed with these recommendations, the military departments implemented them. As of June 2019, the department had implemented 15 of the 29 recommendations contained in the 12 reports. In addition, we closed two of the recommendations as “not implemented” because the actions taken by the department did not sufficiently address the recommendations. The department had not yet taken actions to address the other 12 recommendations. Table 2 identifies the four sets of requirements for strengthening DOD’s management of defense business systems identified in the U.S. Code. In addition, the table identifies a fifth category associated with human capital, which supports the department’s execution of the other four sets of requirements. The table also identifies the 12 GAO recommendations that remained to be implemented as of June 2019. DOD took actions toward addressing GAO’s recommendations related to business system requirements contained in the U.S. Code. In doing so, the department made progress in strengthening the management of its defense business system investments. Specifically, between June 2019 and November 2019, the department demonstrated that it had implemented four of the 12 remaining recommendations aimed at strengthening business systems management. As of November 2019, for example, the department had taken actions to implement a recommendation that helped the department comply with the code’s requirement to establish guidance for effectively managing its defense business system investments. In this regard, the Office of the CMO demonstrated that DOD had implemented our recommendation to improve the department’s policy to require full consideration of sustainability and technological refreshment requirements for its defense business systems investments. Specifically, the department demonstrated that its Instruction 5000.75, DOD Directive 5000.01, and DOD Financial Management Regulation Volume 2B guidance includes policy requiring consideration of sustainability and technological refreshment. The department also demonstrated that its DOD Directive 5000.01 guidance includes policy to ensure that best systems engineering practices are used in the procurement and deployment of commercial systems, modified commercial systems, and defense-unique systems. In addition, with regard to the requirement that DOD ensure that business systems are reviewed and certified in accordance with U.S. Code Title 10, Section 2222, the Army demonstrated that it had implemented our recommendation that the department improve its guidance for certifying defense business systems. Specifically, the Army issued guidance to require that the systems be certified on the basis of (1) having valid, achievable requirements and a viable plan to implement the requirements; (2) having an acquisition strategy designed to eliminate or reduce the need to tailor commercial off-the-shelf systems to meet unique requirements, incorporate unique requirements, or incorporate unique interfaces to the maximum extent practicable; and (3) being in compliance with DOD’s auditability requirements. The Air Force also demonstrated that it had implemented our recommendation that the department improve its guidance for certifying defense business systems. Specifically, the Air Force issued guidance to require that systems be certified on the basis of (1) having an acquisition strategy designed to eliminate or reduce the need to tailor commercial off-the-shelf systems to meet unique requirements, incorporate unique requirements, or incorporate unique interfaces to the maximum extent practicable; and (2) being in compliance with DOD’s auditability requirements. Further, with regard to this requirement, the Office of the CMO demonstrated that it had addressed the recommendation to implement and use business enterprise architecture and business process reengineering compliance assessments more effectively. Specifically, in September 2019, the Office of the CMO demonstrated that it had reviewed business enterprise architecture and business process reengineering compliance assessments and identified in investment decision memorandums which systems had assessments that required action. Even with the actions taken, however, more remained to be done to implement eight other recommendations relating to the code’s requirements that could help strengthen the department’s management of its business systems. Specifically, with regard to the requirement to ensure that business systems are reviewed and certified in accordance with the code, the department had not implemented two of our related recommendations. For example, it had not implemented our recommendation to ensure that portfolio assessments are conducted in key areas identified in GAO’s IT investment management framework, such as current schedule, project reporting, and risks. In addition, with regard to the requirement to develop and maintain a defense business enterprise architecture and IT enterprise architecture, in accordance with relevant laws and Office of Management and Budget policies and guidance, the department had developed a business enterprise architecture. However, it had not implemented our five related recommendations. For example, it had not implemented our recommendation to integrate its business and IT architectures. According to officials in the Office of the CIO, the office plans to finalize the first increment of version 3 of its DOD Information Enterprise Architecture (i.e., IT enterprise architecture) by the end of December 2019, and intends to integrate the business enterprise architecture into the Information Enterprise Architecture as a part of that effort. Further, with regard to human capital, which supports the other requirements, the department had not implemented our related recommendation to develop a skills inventory, needs assessment, gap analysis, and plan to address identified gaps as part of a strategic approach to human capital planning. In commenting on its status in addressing the recommendation in September 2019, the Office of the CMO stated that it intends to publish a Defense Business Operations Management Workforce Plan by December 31, 2019. According to office officials, the plan is to include skills requirements for both Office of the CMO permanent employees and DOD employees detailed to the Office of the CMO in support of the management and reform of defense business operations management. Table 3 summarizes the status of the 12 recommendations, as of November 2019, relative to the requirements established in the code. Further, appendix II provides additional information about the status of the recommendations, as of November 2019. By taking actions to implement four of the 12 remaining recommendations, DOD made important progress in its efforts to comply with the requirements established in the U.S. Code. Nevertheless, taking further actions to implement all of the recommendations is essential to helping the department comply with all of the requirements—and ultimately, to strengthen the management of its defense business system investments and efforts to effectively transform its business operations. DOD provided written comments on a draft of this report, which are reprinted in appendix III. In its comments, the department stated that it appreciated GAO’s recognition of the progress that DOD has made to strengthen business systems management. The department agreed that more needs to be done to strengthen the management of investments in DOD business operations and stated that, in the coming months, it plans to execute a reform agenda intended to strengthen oversight and improve business performance. Further, while this report made no new recommendations, the department concurred with our assessment of the status of seven of the eight open recommendations that DOD has not yet implemented. In addition, the department suggested that we close one recommendation that it perform specific activities as part of a strategic approach to human capital planning for the Office of the CMO, based on the CMO’s submission of a human capital analysis report to Congress in early January 2020. The department subsequently provided us a copy of the CMO’s human capital analysis report on February 7, 2020. We plan to assess the report to determine if it meets the intent of our recommendation. We are sending copies of this report to the appropriate congressional committees, the Director of the Office of Management and Budget, the Secretary of Defense, and other interested parties. This report also is available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions on matters discussed in this report, please contact me at (202) 512-4456 or harriscc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV. Since 2005, GAO has issued 12 reports in which we assessed DOD’s actions to respond to business systems modernization requirements contained in U.S. Code, Title 10, Section 2222. These requirements specify how DOD is to manage its business system investments. The reports are listed below: Defense Business Systems: DOD Needs to Continue Improving Guidance and Plans for Effectively Managing Investments, GAO-18-130 (Washington, D.C.: April 16, 2018). DOD Business Systems Modernization: Additional Action Needed to Achieve Intended Outcomes, GAO-15-627 (Washington, D.C.: July 16, 2015). Defense Business Systems: Further Refinements Needed to Guide the Investment Management Process, GAO-14-486 (Washington, D.C. May 12, 2014). DOD Business Systems Modernization: Further Actions Needed to Address Challenges and Improve Accountability, GAO-13-557 (Washington, D.C.: May 17, 2013). DOD Business Systems Modernization: Governance Mechanisms for Implementing Management Controls Need to Be Improved, GAO-12-685 (Washington, D.C.: June 1, 2012). Department of Defense: Further Actions Needed to Institutionalize Key Business System Modernization Management Controls, GAO-11-684 (Washington, D.C.: June 29, 2011). Business Systems Modernization: Scope and Content of DOD’s Congressional Report and Executive Oversight of Investments Need to Improve, GAO-10-663 (Washington, D.C.: May 24, 2010). DOD Business Systems Modernization: Recent Slowdown in Institutionalizing Key Management Controls Needs to Be Addressed, GAO-09-586 (Washington, D.C.: May 18, 2009). DOD Business Systems Modernization: Progress in Establishing Corporate Management Controls Needs to Be Replicated Within Military Departments, GAO-08-705 (Washington, D.C.: May 15, 2008). DOD Business Systems Modernization: Progress Continues to Be Made in Establishing Corporate Management Controls, but Further Steps Are Needed, GAO-07-733 (Washington, D.C.: May 14, 2007). Business Systems Modernization: DOD Continues to Improve Institutional Approach, but Further Steps Needed, GAO-06-658 (Washington, D.C.: May 15, 2006). DOD Business Systems Modernization: Important Progress Made in Establishing Foundational Architecture Products and Investment Management Practices, but Much Work Remains, GAO-06-219 (Washington, D.C.: November 23, 2005). Table 4 summarizes the status of recommendations made to the Department of Defense (DOD), based on GAO’s assessments of DOD’s actions to respond to defense business system investment management requirements contained in U.S. Code Title 10, Section 2222. The recommendations, included in GAO reports issued from 2005 through 2018, were aimed at helping the department strengthen its approach to managing its business system investments. As of June 2019 (when GAO began its current review of DOD’s actions to address the recommendations), the department had not yet addressed 12 of 29 total recommendations. Subsequently, between June 2019 and November 2019, the department implemented four of the recommendations, but did not implement eight other recommendations. In addition to the contact above, individuals who made contributions to this report include Michael Holland (Assistant Director), Tyler Mountjoy (Analyst in Charge), Camille Chaires, Cheryl Dottermusch, William Hutchinson, Monica Perez-Nelson, Priscilla Smith, and Adam Vodraska.

Summary: DOD spends billions of dollars each year on systems to support its key business areas, such as personnel and logistics. For fiscal year 2020, DOD reported that its business system investments are expected to cost about $8.9 billion. GAO has made many recommendations to DOD aimed at strengthening defense business systems management. Further, U.S. Code Title 10, Section 2222 requires DOD to perform activities aimed at ensuring that these investments are managed efficiently and effectively. The National Defense Authorization Act for Fiscal Year 2016 included a provision for GAO to report on the extent to which DOD is complying with the code's requirements. Accordingly, the objective of this review was to assess the extent to which DOD has taken actions that comply with the code's requirements for ensuring that business system investments are managed efficiently and effectively. To do so, GAO selected 12 recommendations that DOD had not implemented as of June 2019, and assessed the department's subsequent actions on the recommendations (through November 2019) against the requirements in the code. GAO also analyzed DOD's business systems guidance and business enterprise architecture documentation, and interviewed relevant DOD officials. As of November 2019, the Department of Defense (DOD) had taken actions that addressed some, but not all, of the 12 prior GAO recommendations for strengthening defense business systems management. In doing so, the department made progress in complying with related business system investment management requirements contained in U.S. Code Title 10 Section 2222 (the code or U.S. Code). Specifically, as of November 2019, DOD had implemented four of the 12 recommendations (see table). For example, with respect to the requirement associated with investment management guidance, DOD had implemented the recommendation to issue policy requiring full consideration of sustainability and technological refreshment requirements for its business system investments. However, DOD had not yet implemented eight other recommendations relating to the code's requirements. The recommendations that had not been implemented relate to the department's actions to: integrate its business and information technology (IT) architectures, ensure that portfolio assessments are conducted in key areas identified in the GAO Information Technology Investment Management framework. develop a skills inventory, needs assessment, gap analysis, and plan to address identified gaps as part of a strategic approach to human capital planning, among other things. Taking further actions to implement all of the recommendations is essential to helping the department achieve compliance with all of the requirements—and, ultimately, further strengthen the management of its defense business system investments as well as its efforts to effectively transform its business operations. GAO is not making any new recommendations in this report. As of November 2019, DOD had not yet implemented eight of the 12 prior recommendations. GAO will continue to monitor DOD's actions to address the remaining recommendations.