Senior executives in the successful organizations we studied were personally committed to improving the management of technology. The PRA and the Clinger-Cohen Act make federal agency heads directly responsible for establishing goals and measuring progress in improving the use of information technology to enhance the productivity and efficiency of their agency’s operations. To help them with their major information management responsibilities, the reform legislation directs the heads of the major agencies to appoint CIOs. The legislation assigns a wide range of duties and responsibilities to CIOs, foremost of which are working with the agency head and senior program managers to implement effective information management to achieve the agency’s strategic goals; helping to establish a sound investment review process to select, control, and evaluate spending for information technology; promoting improvements to the work processes used by the agency to carry out its programs; increasing the value of the agency’s information resources by implementing an integrated agencywide technology architecture; and strengthening the agency’s knowledge, skills, and capabilities to effectively manage information resources, deal with emerging technology issues, and develop needed systems. While there are various approaches on how best to use the CIO position to accomplish these duties, the legislative requirements, OMB guidance, and our best practices experience with leading organizations define common tenets for the CIO position. An agency should place its CIO at a senior management level, working as a partner with other senior officials in decision-making on information management issues. Specifically, agencies should appoint a CIO with expertise and practical experience in technology position the CIO as a senior partner reporting directly to the agency head; ensure that the CIO’s primary responsibilities are for information have the CIO serve as a bridge between top management, line management, and information management support professionals, working with them to ensure the effective acquisition and management of the information resources needed to support agency programs and missions; task the CIO with developing strategies and specific plans for the hiring, training, and professional development of staff in order to build the agency’s capability to develop and manage its information resources; and support the CIO position with an effective CIO organization and management framework for implementing agencywide information technology initiatives. Having effective CIOs will make a real difference in building the institutional capacity and structure needed to implement the management practices embodied in the broad set of reforms set out in the PRA and the Clinger-Cohen Act. The CIO must combine a number of strengths, including leadership ability, technical skills, an understanding of business operations, and good communications and negotiation skills. For this reason, finding an effective CIO can be a difficult task. Agencies faced a similar difficulty in trying to find qualified chief financial officers to implement the CFO Act’s financial management reforms. It took time and concerted effort by the Administration, the CFO Council, and the Congress to get strong, capable leaders into the CFO positions. Shortly after the Clinger-Cohen Act went into effect, OMB evaluated the status of CIO appointments at the 27 agencies. OMB noted that at several agencies, the CIO’s duties, qualifications, and placement met the requirements of the Clinger-Cohen Act. According to OMB, these CIOs had experience, both operationally and technically, in leveraging the use of information technology, capital planning, setting and monitoring performance measures, and establishing service levels with technology users. These CIOs also had exposure to a broad range of technologies, as well as knowledge of government budgeting and procurement processes and information management laws, regulations, and policies. However, OMB had concerns about a number of other agencies that had acting CIOs, CIOs whose qualifications did not appear to meet the requirements of the Clinger-Cohen Act, and/or CIOs who did not report directly to the head of the agency. OMB also raised concerns about agencies where the CIOs had other major management responsibilities or where it was unclear whether the CIOs’ primary duty was the information resource management function. OMB stated that it would reevaluate the situations at these agencies at a later date, after agencies had time to put permanent CIOs in place or take corrective actions to have their CIO appointment and organizational alignment meet the necessary requirements. OMB called for updated information on the status of governmentwide CIO appointments in its April 1997 data request on individual agency efforts to implement provisions of the Clinger-Cohen Act. OMB has not yet issued a status report based on this information and subsequent follow-up. In a recent discussion, OMB officials stated that they will provide feedback on individual CIO appointments as part of the fiscal year 1999 budget review process. On the basis of preliminary observations, however, OMB officials stated that they still have some of the same concerns that they had a year ago about CIO positions that have not been filled, have not been properly positioned, or have multiple responsibilities. It is very important for OMB to follow through on its efforts to assess CIO appointments and resolve outstanding issues. Information technology reforms simply will not work without effective CIO leadership in place. We will continue to monitor this situation to provide our suggestions on actions that need to be taken. One area that we will focus on during the coming year is CIOs who have major responsibilities in addition to information management. The Clinger-Cohen Act clearly calls for CIOs to have information resources management as their primary duty. We have stressed the importance of this principle in testimonies and, most recently, in our February 1997 high-risk report, in which we emphasized that the CIO’s duties should focus sharply on strategic information management issues and not include other major responsibilities. In addition to the escalating demands of rapidly evolving technologies, CIOs are faced with many serious information management issues, any one of which would be a formidable task to address. Taken together, these issues create a daunting body of work for any full-time CIO, much less for one whose time and attention is divided by other responsibilities. As you know, Mr. Chairman, we have reported extensively on a number of these compelling challenges. The following are just a few of these challenges. Ensuring that federal operations will not be disrupted by the Year 2000 problem is one of the foremost and most pressing issues facing agencies—one that we have designated as a governmentwide high-risk area. Efforts by this Subcommittee have underscored repeatedly that many agencies are seriously behind schedule in resolving this problem during the next 2 years. Poor security management is putting billions of dollars worth of assets at risk of loss and vast amounts of sensitive data at risk of unauthorized disclosure, making it another of our governmentwide high-risk areas. Agencies need to make much better progress in designing and implementing security programs and getting skilled staff in place to manage them. This extreme vulnerability has been given added emphasis by the recent Presidential commission report on the growing exposure of U.S. computer networks to exploitation and terrorism. Agencies need to develop, maintain, and facilitate integrated systems architectures to guide their system development efforts. We have seen major modernization efforts handicapped by incomplete architectures, such as at the Federal Aviation Administration (FAA) and the Internal Revenue Service (IRS), as well as the departments of Veterans Affairs and Education. Agencies need to establish sound information management investment review processes that provide top executives with a systematic, data-driven means to select and control how technology funds are spent. Our reviews of system development and modernization projects, such as the Medicare Transaction System and the four high-risk efforts included in our 1997 High-Risk Series, continue to show the crucial importance of structured investment oversight.In our 1997 High-Risk Series we identified 25 high-risk areas covering a wide array of key federal activities, ranging from Medicare fraud to financial management at the Department of Defense. Resolving the problems in these areas depends heavily on improved information management. Agencies need to integrate strategic information planning with the overall strategic plan that they must prepare under the Results Act. Our review of recent attempts by agencies to develop sound strategic plans showed very weak linkages between the strategic goals and the information technology needed to support those goals. Agencies must build their staffs’ skills and capabilities to react to the rapid developments in information technology, develop needed systems, and oversee the work of systems contractors. Weaknesses in agencies’ technology skills bases, especially in the area of software acquisition and development, have been a recurring theme in our reviews of federal information technology projects. Despite the urgent need to deal with these major challenges, we still see many instances of CIOs who have responsibilities beyond information management. At present, only 12 agencies have CIOs whose responsibilities are focused solely on information management. The other 15 agencies have CIOs with multiple responsibilities. Together, these 15 agencies account for about $19 billion of the nearly $27 billion dollars in annual federal planned obligations for information technology. While some of these CIO’s additional responsibilities are minor, in many cases they include major duties, such as financial operations, human resources, procurement, and grants management. At the Department of Defense, for example, the CIO is also the Assistant Secretary for Command, Control, Communications and Intelligence. By asking the CIO to also shoulder a heavy load of programmatic responsibility, it is extremely difficult, if not impossible, for the CIO to devote full attention to information resource management issues. Recognizing this problem, the Department’s Task Force on Defense Reform is examining the current structure of the CIO position to ensure that the person can devote full attention to reforming information management within the Department. We are particularly troubled by agencies that have vested CIO and Chief Financial Officer responsibilities in one person. The challenges facing agencies in both financial and information management are monumental. Each requires full-time leadership by separate individuals with appropriate talent, skills, and experience in these two areas. In financial management, for example, most agencies are still years away from their goal of having reliable, useful, relevant, and timely financial information—an urgently needed step in making our government fiscally responsible. Because it may be difficult for the CIO of a large department to adequately oversee and manage the specific information needs of the department’s major subcomponents, we have also supported the establishment of a CIO structure at the subcomponent and bureau levels. Such a management structure is particularly important in situations where the departmental subcomponents have large information technology budgets or are engaged in major modernization efforts that require the substantial attention and oversight of a CIO. In the Conference Report on the Clinger-Cohen Act, the conferees recognized that agencies may wish to establish CIOs for major subcomponents and bureaus. These subcomponent level CIOs should have responsibilities, authority, and management structures that mirror those of the departmental CIO. We have reported on instances where the subcomponent CIOs were not organizationally positioned and empowered to discharge key CIO functions. For example, in our reviews of FAA’s air traffic control (ATC) modernization, which is expected to cost $34 billion through the year 2003, we found that FAA’s CIO was not responsible for developing and enforcing an ATC systems architecture. Instead, FAA had diffused architectural responsibility across a number of organizations. As a result, FAA did not have a complete ATC architecture, which in turn has led to incompatible and unnecessarily expensive and complex ATC systems. Additionally, we found that while FAA’s CIO was responsible for ATC software acquisition process maturity and improvement, the CIO lacked the authority to implement and enforce process change. Consequently, we reported that (1) FAA’s processes were ad hoc, and sometimes chaotic, and not repeatable across ATC projects and (2) its improvement efforts have not produced more disciplined processes. Among other actions, we recommended that FAA establish an effective management structure for developing, maintaining, and enforcing a complete systems architecture and improving software acquisition process improvement and that this management structure be similar to the department-level CIO structure prescribed by the Clinger-Cohen Act. Similarly, in the last few years, we have reported and testified on management and technical weaknesses associated with IRS’ Tax Systems Modernization. Among other things, we have noted how important it is for IRS to have a single IRS entity with responsibility for and control over all information systems efforts. Since we first reported on these problems, IRS has taken a number of positive steps to address its problems and consolidate its management control over systems development. However, as we noted in recent briefings to the acting IRS Commissioner and congressional committee staffs, neither the CIO nor any other organizational entity has sufficient authority needed to implement IRS’ Systems Life Cycle—its processes and products for managing information technology investments—or enforce architectural compliance agencywide. We will soon be making formal recommendations to IRS to address this issue. Finally, as we reported to you earlier this year, the problems encountered by the Health Care Financing Administration (HCFA) in its development of the Medicare Transaction System provide another example of the need for strong management over the development and implementation of information systems. In recent testimony on Medicare automated systems, we reemphasized the importance of establishing CIOs and involving them and other senior executives in information management decisions. While HCFA has recently established a CIO and an Information Technology Investment Review Board, the agency has not yet implemented an investment process—including senior management roles and responsibilities—that governs the selection, control, and evaluation of IT investments. Consequently, we have recommended that HCFA establish an investment management approach that explicitly links the roles and responsibilities of the CIO and Investment Review Board to relevant legislative mandates and requirements. Such actions are essential to ensure that HCFA’s—or any agency’s—information technology initiatives are cost-effective and serve its mission. Although the Clinger-Cohen Act did not call for the establishment of a federal CIO Council, the Administration is to be commended for taking the initiative to establish one through a July 1996 Executive Order. Our experience with the CFO Act shows the importance of having a central advisory group to help promote the implementation of financial management reform. The CFO Council, which has a statutory underpinning, has played a lead role in creating goals for improving federal financial management practices, providing sound advice to OMB on revisions to executive branch guidance and policy, and building a professional community of governmentwide financial management expertise. The CIO Council, chaired by OMB, can play a similarly useful role. As stated in its charter, the Council’s vision is to be a resource for helping promote the efficient and effective use of agency information resources. The Council serves as the principle forum for agency CIOs to develop recommendations for governmentwide information technology management policies, procedures, and standards; share experiences, ideas, and promising practices for improving promote cooperation in using information resources; address the federal government’s hiring and professional development needs for information management; and make recommendations and provide advice to OMB and the agencies on the governmentwide strategic plan required under the PRA. The CIO Council is currently going through a formative period. Since its first meeting in September 1996, the Council has engaged in a wide variety of activities. It meets on a monthly basis, bringing together CIOs, deputy CIOs, and representatives from major departments and agencies, as well as representatives from other organizations, such as the Small Agency Council, the CFO Council, and the Governmentwide Information Technology Services Board. The Council’s activities during its first year have largely revolved around four major areas. (1) Council organization: The Council decided how to organize and created operational procedures. (2) Committee specialization: The Council created five committees to focus on selected topics of concern emerging from initial sessions—the year 2000, capital planning and investment, interoperability, information resources management training and education, and outreach/strategic planning. Each committee has pursued agendas that include regular working group sessions to exchange ideas and identify promising management practices. (3) Topical forums: The Council has provided a regular forum for presentations and discussions of specific topics of shared concern, such as improving Internet security, enhancing the usefulness of budgetary reporting on federal information technology, understanding the use of governmentwide acquisition contracting mechanisms, developing effective systems architectures, and consolidating data center operations. (4) Governmentwide policy advice and recommendations: The Council has responded to OMB’s solicitation for comments on proposed federal information resources management policy revisions (the Federal Acquisition Regulations, Freedom of Information Act, the Privacy Act, the PRA); updates on critical issues such as Year 2000 progress; and guidance and feedback on agency reporting to meet OMB’s federal oversight requirements (such as preparing budget submissions for information assets under OMB Circular A-11). While these activities have proved useful, the Council does not yet have a strategic plan to help guide its work and serve as a benchmark for measuring progress. As we saw in the case of the CFO Council, achieving accomplishments that have strategic impact requires well-defined goals and measures. The CFO Council adopted a vision, goals, and strategies for financial management that have made it a much more productive body. The CFO Council now regularly reviews activities and, if necessary, revises Council priorities. In addition, the Council annually reports on its progress in implementing financial management reforms. Recognizing the need to focus its efforts, the CIO Council began to reassess and redefine its strategic direction this past summer. This October, the Council members met at a day-long planning conference to discuss and finalize their long-range strategy. They agreed to focus their work on five strategic goals: establish sound capital planning and investment processes at the agencies; ensure the implementation of security practices that gain public confidence and protect government services, privacy, and sensitive and national security information; lead federal efforts to successfully implement the Year 2000 conversions; assist agencies in obtaining access to human resources with the requisite skills and competencies to develop, maintain, manage, and utilize information technology programs, projects, and systems; and define, communicate, and establish the major elements of a federal information architecture, in support of government missions, that is open and interoperable. We believe that the CIO Council has selected the right set of issues to pursue. Several of these coincide with issues we raised in our 1997 High-Risk Series and recommendations we have formulated in conjunction with specific audit work. In addition, they parallel several concerns that the Congress—and this Subcommittee in particular—have raised about federal IT management. For example, the regular hearings and concerted effort by the Subcommittee on the Year 2000 computing crises have highlighted the urgency of the problem and helped to increase the attention and actions of federal executives. GAO has raised concerns about the pace at which federal agencies are moving to effectively address the Year 2000 problem. In consonance with industry best practices, we have also developed and disseminated an assessment guide to help agencies plan, manage, and evaluate their Year 2000 programs, and are using this as a basis for selected agency audits. In addition, we have strongly recommended that agencies adopt a capital planning and investment-oriented approach to information technology decision-making. It has been a key foundation for recommending improvements to the management of IRS’ Tax Systems Modernization, HCFA’s development of the Medicare Transaction System, and FAA’s air traffic control modernization. We worked with OMB in 1995 to issue governmentwide guidance on information technology investment management and we have also issued detailed guidance on how agencies can effectively implement an investment-oriented decision-making approach to their information technology spending decisions as expected under the Clinger-Cohen Act. Information security is also an issue of paramount importance to the information maintained and managed by the federal government. We have highlighted the reality of the government’s vulnerability and the urgent need to effectively identify and address systemic information security weaknesses. Moreover, in our September 1996 report on information security, we specifically recommended that the Council adopt information security as one of its top priorities. Also, building federal agencies’ capability to manage information resources has been a critical problem for years. Several of our recent reports, for instance, have focused on serious weaknesses in an agency’s capability to manage major technology initiatives, such as in the area of software acquisition or development. Similarly, our best practices work has shown the importance of pursuing improvement efforts within the context of an information architecture in order to maximize the potential of information technology to support reengineered business processes. We are encouraged by the Council’s intention to establish a strong strategic focus for its work and further refine and prioritize the areas where it can best make a difference. One of the noteworthy aspects of the Council’s goal-setting process was the members’ desire to move away from earlier draft language that defined the goals in terms of “promoting” and “supporting.” Instead, the Council is working to frame specific, outcome-oriented goals. At the conclusion of the conference, the Council set up committees for each of the goals and charged them to decide on specific objectives and performance measures. The Council’s aim is to complete this work quickly and publish its strategic plan in January 1998. There is great urgency to deal with these major information technology problems. It is important that the Council demonstrate how CIOs are helping to make a difference by showing progress this coming year. GAO and OMB have given the CIO Council a head start by publishing guidance on information technology capital investments, information security, and best practices in information technology management. By leveraging off this work, the Council should be able to build momentum quickly. Also, the CIO Council should follow the example set by the CFO Council, which publishes a joint report with OMB each year on its progress in meeting financial management goals. Having a visible yardstick will provide a strong incentive for both the Council and the agencies to make progress in meeting their information management goals and demonstrate positive impact on the agencies’ bottom line performance. Because it is essentially an advisory body, the CIO Council must rely on OMB’s support to see that its recommendations are implemented through federal information management policies, procedures, and standards. In the coming months, the Congress should expect to see the CIO Council becoming very active in providing input to OMB on the goals it has chosen. OMB, in turn, should be expected to take the Council’s recommendations and formulate appropriate information management polices and guidance to the agencies. There should be clear evidence that the CIO Council, OMB, and the individual CIOs are driving the implementation of information technology reforms at the agencies. Ultimately, the successful implementation of information management reforms depends heavily upon the skills and performance of the entire CIO organization within departments and agencies—not just the CIO as a single individual. We have emphasized this point in our recent guidance on information technology performance measurement. With this in mind, we are working to produce an evaluation guide that offers a useful framework for assessing the effectiveness of CIO organizations. As with our other guidance, we intend to ground this approach in common management characteristics and techniques prevalent in leading private and public sector organizations. Using this methodology that focuses on both management processes and information technology spending results, we can provide the Congress and the agencies with in-depth evaluations of CIO organizational effectiveness. Mr. Chairman, this concludes my statement. I would be happy to answer any questions that you and members of the Subcommittee may have. The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.

Summary: GAO discussed the importance of having strong agency chief information officers (CIO) and an effective CIO Council, focusing on its study of how leading private- and public-sector organizations control system development projects and successfully apply technology to improve their performance, which identified a specific set of strategic practices that these organizations use to improve performance through information management. GAO noted that: (1) senior executives in the successful organizations it studied were personally committed to improving the management of technology; (2) applicable laws make federal agency heads directly responsible for establishing goals and measuring progress in improving the use of information technology to enhance the productivity and efficiency of agency operations and assign a wide range of duties and responsibilities to CIOs; (3) agencies should place CIOs at a senior management level, working as a partner with other senior officials in decisionmaking on information management issues; (4) having effective CIOs will make a difference in building the institutional capacity and structure needed to implement sound management practices; (5) shortly after the Clinger-Cohen Act went into effect, the Office of Management and Budget (OMB) evaluated the status of CIO appointments at 27 agencies and noted that at several agencies, the CIO's duties, qualifications, and placement met the act's requirements; (6) however, OMB had concerns about a number of other agencies that had acting CIOs, CIOs whose qualifications did not appear to meet the act's requirements, or CIOs who did not report directly to the head of the agency; (7) OMB also raised concerns about agencies where the CIOs had other major management responsibilities or where it was unclear whether the CIOs' primary duty was information resource management; (8) one area that GAO will focus on is CIOs who have major responsibilities in addition to information management; (9) only 12 agencies have CIOs whose responsibilities are focused solely on information management; (10) GAO is particularly troubled by agencies that have vested CIO and Chief Financial Officer responsibilities in one person; (11) because it may be difficult for the CIO of a large department to adequately oversee and manage the specific information needs of the department's major subcomponents, GAO has also supported the establishment of a CIO structure at the subcomponent and bureau levels; (12) GAO has reported on instances where the subcomponent CIOs were not organizationally positioned and empowered to discharge key CIO functions; (13) the CFO Council has played a lead role in creating goals for improving federal financial management practices; the Council does not yet have a strategic plan to help guide its work and serve as a benchmark for measuring progress; and (14) ultimately, the successful implementation of information management reforms depends heavily upon the skills and performance of the entire CIO organization within departments and agencies, not just the CIO as an individual.