The Department of State’s primary mission is to advise the President in the formulation and execution of foreign policy and to ensure the advancement and protection of U.S. interests abroad. The Department is also responsible for conducting consular operations, including visa services for foreign nationals; managing embassies and other real property—with a current estimated value of about $12 billion; and providing support services to at least 24 other federal agencies who have offices overseas. To meet these responsibilities, the Department must be able to (1) quickly and accurately, analyze and interpret political, economic, and societal events taking place all over the world, and (2) assess the potential effects of these events on the U.S. Complicating completion of these responsibilities is the current operating environment of shrinking budgets and reduced staffing. In this context, effective IRM is key to successful accomplishment of State’s critical missions. Twenty-one bureaus, as well as over 260 foreign posts and other offices, support State’s worldwide program and administrative responsibilities. By delegating responsibilities to the bureaus and offices, State has given each a significant amount of operational control for IRM. For example, many bureaus and offices have their own IRM staff, as well as budgetary authority, to independently undertake systems initiatives. Of the Department’s fiscal year 1994 total reported IRM expenditures—excluding salaries—58 percent, or approximately $149.1 million, was managed by State’s IRM office, while the remainder was allocated among the bureaus. The IRM office is responsible for guiding, coordinating, and providing technical support for the bureaus’ and offices’ IRM activities. The IRM office also is responsible for providing the infrastructure necessary for the bureaus and offices to achieve their individual IRM goals. State relies on a variety of information resources to help it carry out its responsibilities and support its decentralized operations. For instance, State has numerous systems to help with its consular activities, which include managing immigrant and nonimmigrant visas and preventing their issuance to terrorists, drug traffickers, and others who are not entitled to them. State also accounts for and controls its annual appropriation of about $5 billion on a reported 33 domestic and overseas financial systems and subsystems. Further, State has a variety of systems to help it account for and manage both its overseas real properties and over 25,000 full-time employees, here and abroad. Several federal agencies, including the Department of Defense, the United States Information Agency, and the Agency for International Development, also depend on information from State’s automated systems. In fiscal year 1994, State reported spending about $372 million on its IRM activities. State supports its systems on a variety of hardware platforms. Its corporate systems are operated on mainframe computers at data processing centers in the Washington, D.C. area and overseas. Domestic bureaus and overseas posts are also equipped to varying degrees with mini-computers and office automation equipment, which State purchased over a 15-year period almost exclusively from one vendor—Wang. Foreign Service Officers rely on this equipment for electronic mail, word processing, and other functions to develop reports and communicate information in support of State’s foreign policy objectives. Even though State relies on information and technology to meet its mission and business needs, its management of these resources has historically been poor. GAO, the General Services Administration, the Office of Management and Budget, and State’s Office of Inspector General have all reported broad IRM problems at State related to planning, budgeting, organization, acquisition, and information security. The reports also discussed problems in State’s financial management, property, and consular systems. The reports stated that because of these problems, managers often did not have the accurate, timely, integrated information they needed to meet administrative and foreign policy objectives. State too has recognized that it has many long-standing IRM problems. It reported a number of these material and high-risk weaknesses to the President and the Congress under provisions of the Federal Managers’ Financial Integrity Act (FMFIA) and its implementing guidance. These weaknesses and State’s efforts to address them include the following: In 1993, State reported that the Department relied heavily upon proprietary computer systems and associated software for all of its major applications (that is, finance, consular, personnel, and other administrative systems). State also reported that this Wang equipment was technically obsolete and prone to failure. The Department’s modernization initiative is aimed at replacing the Wang systems, reducing maintenance costs, and improving system reliability. Since 1987, State has reported that outdated technology and inadequate management controls and oversight of visa processing increased vulnerability to illegal immigration and diminished the integrity of the U.S. visa. State currently has an effort aimed at automating visa namechecking systems at all posts worldwide and eliminating out-dated microfiche systems that are currently at 72 posts. This effort is intended to reduce the risk of issuing visas to terrorists, drug traffickers, and others. Over the past decade, State had reported 42 material weaknesses and nonconformances in its core and subsidiary accounting systems. The Department manages six financial management systems worldwide. It has reported that its general ledger has never properly reflected the agency’s financial position. The Integrated Financial Management System initiative is intended to integrate State’s various financial management and related systems, providing managers with accurate and timely information to be used in making program decisions. State has reported for the past decade that the absence of backup capabilities for mainframe systems jeopardized the Department’s domestic information infrastructure in the event of an emergency. State has an effort underway to acquire mainframe backup to provide for processing if the mainframes at State’s data processing centers fail. Appendix II provides further details on these four initiatives and the problems they are intended to correct. To assess the adequacy of State’s current IRM program and improvement initiatives in meeting agency and business needs, we focused on a recent GAO report of 11 best IRM practices of leading public and private organizations. (See appendix III for a list of these best practices.) Using this report, as well as other federal IRM guidance, we identified management elements we believe to be critical and relevant to IRM success at State. These elements include top-level management commitment to improving IRM; a strategic IRM planning process that is based on mission and business needs and that integrates the planning and budgeting functions; an acquisition process in accordance with legal requirements and applicable policy guidance; and an organizational framework that includes leadership and authority for IRM, an executive-level review process to prioritize and oversee investment projects, and an IRM organization that provides adequate guidance and support for agencywide customers. To obtain information on State’s IRM program for evaluation against these management elements, we interviewed senior agency officials, IRM managers, technical personnel, and bureau representatives. We conducted our work between January 1994 and November 1994, in accordance with generally accepted government auditing standards. Appendix I provides further details on our scope and methodology. While the State Department depends on information to conduct its various missions, its management of information technology over the years has been poor. Problems have gone unresolved and managers have not had information when they need it to perform mission-critical and business needs. Moreover, improvement efforts focused on addressing these problems have not been successful, have taken too long, or have had only minimal impact on operations. Many of these problems are similar to ones we have seen throughout the federal government. We recently studied a number of leading private and public organizations to determine how they managed information resources to improve mission performance. We identified practices that, when used together, led to significant improvements in mission performance. These practices include top-level management recognizing the need to change and taking steps to ensure sustained commitment throughout the organization; establishing an outcome-oriented, integrated strategic information establishing organizationwide information management capabilities to ensure that information technology meets mission and business needs. A basic step toward improving information management is top executives recognizing that business as usual will not suffice and that the need to change is both real and urgent. Senior executives should (1) recognize the value of improving IRM, (2) evaluate IRM practices against those of leading organizations, and (3) dedicate themselves, and the organization, to improvement. Initiating and maintaining activities focused on rapid improvement requires investing in, identifying, and adopting new techniques, new processes, and new ways of doing business. The lack of top-level management commitment to improving IRM has long been a problem at State, as evidenced by the Department’s failure to resolve material, high risk, and other IRM weaknesses. Despite repeated criticisms from oversight agencies over the past decade, State has not had a sustained effort to improve IRM departmentwide. For example, the Department identified serious weaknesses in its financial and accounting systems over a decade ago that have not yet been corrected. These weaknesses include the general ledger not properly reflecting the agency’s financial position, deficiencies in data quality, and inadequate support of mission performance. Our recent report on the Integrated Financial Management System project, which is intended to correct these weaknesses, concluded that the project held a high risk of failure because of a lack of departmentwide IRM leadership and strategic planning. As a result, financial information that managers increasingly require to make informed program decisions in support of foreign policy objectives will continue to be inaccurate and untimely. Recently, however, the Under Secretary for Management, recognizing that effectively managing State’s information resources is critical for the Department to meet its various missions, initiated several efforts to address the Department’s information management problems. These efforts include clarifying the roles and responsibilities of senior officials to ensure that they fulfill federal requirements for IRM, developing a process to prioritize IRM acquisitions departmentwide, and establishing an advisory board of senior officials to provide leadership and oversight for IRM. The Under Secretary told us that these efforts are just first steps in resolving State’s many IRM shortcomings. These initial steps are critical to helping resolve State’s information management problems; still, State needs to maintain the momentum for change by obtaining commitment from senior managers in key program and support areas to continue institutionalizing improvements. Such support will require State to (1) analyze current performance problems and determine how information management solutions can address these problems and (2) educate line managers about how strategic information management can improve mission effectiveness. As the need to fundamentally change is recognized and managers throughout the organization begin to understand their responsibility for change, the organization can begin to focus on an integrated, strategic information management process. Key tenets of such a process include developing a strategic planning process based on mission and business needs, and integrating the planning and budgeting functions. Additionally, the organization should ensure that information resource procurements and contracts are performed in accordance with legal requirements and applicable policy guidance. A basic step in an integrated information management process is building a departmentwide strategic planning process that is anchored to an agencywide business plan that specifies mission goals and objectives. Such a planning process includes (1) identifying the agency’s mission goals and objectives and (2) developing an IRM plan that supports these goals and objectives. State has not yet developed such a strategic IRM planning process. State does not have a departmentwide plan specifying mission, goals, objectives, and priorities, although program planning guidance provides limited information on these. Department officials agreed that a clear statement of mission goals, objectives, and priorities would help them in their IRM planning efforts. The 1994 strategic IRM plan—the first issued since 1991—was developed within the IRM office with comments from the bureaus and is largely a description of numerous information technology projects. The plan does not prioritize State’s numerous IRM initiatives—including office automation, overseas telephone system replacement, overseas telecommunications service, and the integrated financial management system projects—and, thus, cannot guide executive and operational decisions. Such prioritization is essential because funding may not be available for all initiatives. Recently, the Under Secretary for Management began focusing attention on improving agencywide program planning. As previously mentioned, the Under Secretary established an advisory board of senior officials whose first task is to develop an IRM vision that provides direct support to the Department mission. The Under Secretary is also considering establishing a new process for linking program, IRM, and other planning processes. Officials in the Bureau of Finance and Management Policy stated that the support of other Under Secretaries will be necessary to ensure departmentwide attention to program planning processes, because historically, planning has not been a focus in State’s culture. As one agency report stated, “... it is a rare Department officer who is able to do much more than cope with today’s crises and issues.” This report further states that the Department needs to significantly increase its strategic planning efforts, recognizing that if State does not know where it wants to go, as well as the options for getting there, it will not do well in the post Cold War era. In conjunction with focusing on mission and business goals, successful organizations integrate the planning and budgeting processes. This reinforces the linkage of IRM initiatives to the agency’s mission, provides tight controls during implementation, and helps ensure that projects stay on track. This also helps ensure that budgeting does not become reactive to priorities of the moment that have not been adequately weighed against those of the future, and that plans do not become mere paper exercises. The IRM planning and budgeting processes have not been linked at State. For example, bureau IRM budgets are not developed out of a departmentwide IRM planning process. Instead bureau IRM budgets have been developed by the bureaus and reviewed (along with other budgetary items) and approved by the Chief Financial Officer—without the involvement of the Designated Senior Official for IRM or a departmentwide IRM board. Thus, State has not had a means to analyze or eliminate duplication in IRM initiatives and funding. State has also not had a mechanism to ensure adequate funding for initiatives to address long-standing IRM problems. Projects are funded at a level sufficient to plan them, but not to implement them, according to senior IRM officials. These officials stated that this is a primary reason why several large projects—including replacement of proprietary, obsolescent mini-computers and office automation equipment in State’s domestic bureaus and overseas posts—have made little progress. (See appendix II for details on this systems modernization effort.) According to a March 1994 memo from the Assistant Secretary for Administration, although the IRM support office lacked the necessary modernization funding, individual bureaus and offices—other than the IRM office—expended $68 million on office automation items. Without a departmentwide, integrated, IRM planning and budgeting process, the Department could not ensure that the $68 million was directed towards State’s highest priorities. The memo further stated that such a planning process is critical to eliminating the duplication and waste inevitable in the current approach, and that the absence of this process results in bureaus independently implementing modernization plans in accordance with their own priorities and resources. Slow progress in modernizing systems has been accompanied by difficulty in supporting and maintaining older technology and increased vulnerability to computer failures. The cost of supporting obsolete, proprietary office automation equipment has been high—about $12 million in fiscal year 1994, according to an IRM official. State officials also said that foreign affairs operations have been affected by computer failures. For example, in January 1994, the Bureau of Near Eastern Affairs experienced failures of old Wang disk drives during 5 of the 10 days of preparation prior to the Secretary’s negotiations in the Middle East. The failures resulted in delays and difficulty in providing briefings to the Executive Secretariat. Systems were down for hours at a time and reports that were needed to prepare for the negotiations had to be recreated because files were deleted or could not be accessed. The old disk drives ultimately had to be replaced with new equipment to adequately support bureau operations. The lack of an integrated IRM planning and budgeting function has also resulted in long-standing weaknesses related to backup for the mainframe systems. State has reported inadequate backup as a high risk weakness under FMFIA for about 10 years. However, such backup has not been provided because of various funding shortfalls. For example, several classified systems in Washington, D.C. do not have backup. One classified system without back-up is the telegraphic retrieval system. This system allows for search and retrieval of all cables over the past 20 years. Such a system is important to users who rely on search and retrieval for important time-critical research, such as identifying groups who may be responsible for terrorist acts under investigation. In 1993, State began an effort to better integrate the planning and budgeting functions. The IRM office initiated a departmentwide planning process in which bureau representatives met in separate groups—regional, policy, and management bureaus—to determine spending priorities. This effort represents an improvement from the past in that it (1) relied on decision criteria based on mission benefits and (2) brought together bureau representatives to communicate priorities and needs. However, this process is evolutionary and has not yet been institutionalized as an integrated, departmentwide process for allocating all State IRM funds. The Federal Acquisition Regulation requires federal agencies to develop acquisition plans to obtain the maximum extent of full and open competition in fulfilling agency needs. The purpose of these plans is to ensure that agencies meet their needs in the most effective, economical, and timely manner. Historically, however, State has not conducted adequate planning and management to meet these goals in its acquisition of information technology. About one-half of State’s Delegations of Procurement Authority (DPAs) for information technology acquisitions are sole source. In 1992 the General Services Administration (GSA) lowered the thresholds in State’s DPA—that allowed State to make IRM purchases without GSA’s prior approval—because of these procurement problems. For example, State’s general authority to award IRM contracts was lowered from $2.5 million to $1.5 million for competitive procurements. State’s acquisition problems include the failure to adequately track DPAs and request DPAs for contract extensions sufficiently in advance of the contract expiration date. Between 1991 and 1993, about half of State’s requests for DPAs to execute contract extensions were sent to GSA less than a month before the expiration of each contract. For example, in March 1993, State requested a DPA for a contract extension 5 days before a contract for maintenance of State’s Foreign Affairs Data Processing Center was set to expire. State noted in its request to GSA that, without the extension, the Department would have to shut down operations at its Beltsville data processing site and reduce operations at its headquarters site, with an “almost catastrophic effect on the Department’s ability to conduct business.” To prevent this outcome, the contract has been extended twice since March 1993. The December 1993 DPA for an extension was given on the condition that State develop a management plan for the acquisition. State has established a Major Acquisition Program Office within the IRM office to address major acquisition weaknesses. This office has developed a set of new policies and procedures, currently under review by acquisition and IRM officials, for planning major acquisitions. Further, the IRM office has an ongoing review of acquisition management problems, although it has not yet determined how the problems should be addressed. Successful organizations we studied in developing our executive guide on best practices established effective organizational frameworks to provide IRM direction and focus. Such frameworks included positioning a Chief Information Officer (CIO) to provide IRM leadership and authority; establishing an executive-level investment review board to prioritize projects and oversee the organization’s various IRM activities; and ensuring that the agency’s IRM organization provides adequate guidance and support for its agencywide customers. A CIO positioned as a senior management partner can serve as a bridge between top management, line managers, and information support professionals. This includes clearly articulating the critical role information management plays in mission improvement and focusing and advising senior executives on high-value IRM issues, decisions, and investments. Appointing a CIO will not, in itself, resolve problems or lead to improved mission capabilities. The CIO should have the authority to ensure implementation of IRM initiatives and agencywide compliance with approved IRM standards. State has a Designated Senior Official (DSO) for IRM, rather than a CIO. However, because of his position and other responsibilities, State’s DSO has not provided adequate leadership for IRM. The DSO is positioned several levels down within State’s hierarchy and reports to the Under Secretary for Management, whose involvement in IRM has traditionally been limited. The DSO, who is the Assistant Secretary of State for the Bureau of Administration, also has a range of other responsibilities, including all administrative functions of the Department and managing the Foreign Buildings Operations. Finally, the DSO is at the same organizational level as the other bureau chiefs. Without a senior IRM official, State has also not had anyone with the authority to ensure agencywide compliance with any IRM guidance or standards that might be approved. For example, because the DSO is equivalent to other bureau heads, the DSO cannot ensure departmentwide compliance with data standards in an effort to institute a departmentwide data administration program. Further, the DSO has no means of ensuring compliance with departmentwide computer or telecommunications standards supporting the current systems modernization effort. The Under Secretary for Management stated that he is acting as the CIO under the current management structure. He believes that it is his responsibility to create the environment and relationships necessary to effectively manage information resources. We agree that his IRM role is critical. However, we are concerned that leaving the CIO as an ad hoc position will not ensure that the processes needed to effect lasting IRM improvements will be institutionalized. A departmentwide process for selecting and reviewing investments is needed to effectively carry out IRM improvement efforts. Such a process would involve an investment review board, with significant control over decisions and balanced representation from key program and support areas. Traditionally, IRM projects have been thought of as individual information technology expenses. The leading organizations we studied, however, began to think of information systems projects, not as one-time expenses, but rather as investments to improve mission performance. They instituted review boards with responsibility for controlling budgets and selecting, funding, integrating, and reviewing information management projects to ensure that they meet agencywide mission and business objectives. Thinking of projects as investments helped to concentrate top management’s attention on measuring the mission benefits, risks, and costs of individual projects. It also helped managers evaluate the tradeoffs between continuing to fund existing operations and developing new performance capabilities. In an effort to institute a more departmentwide focus to agency IRM, the Under Secretary for Management recently established an IRM board of senior State officials. The board, which has met a few times, was established to develop an IRM vision from the Department’s strategic plan; approve the IRM strategic plan; review IRM programs to ensure that program, policy, and acquisition requirements are met; and approve and prioritize IRM acquisitions to be presented to the Under Secretary for Management. It is too early to determine whether the board has sufficient control over key decisions or whether its authority should be increased beyond that of advising the Under Secretary for Management. In addition, State’s board lacks sufficient representation from regional and functional bureaus to ensure that mission-critical information needs receive adequate priority. The board has 11 members of which only 3 represent mission-critical areas. Thus, the majority of the 21 bureaus are not represented on the board. The other eight members of the board represent support areas, including four representatives from the Bureau of Administration, two representatives from the Bureau of Finance and Management Policy, one representative from the Bureau of Diplomatic Security, and the Deputy Legal Adviser. If the board is given sufficient oversight over IRM improvement efforts, it could play an important role in ensuring that projects are completed successfully. This is particularly important at State because periodic Foreign Service Officer rotations hinder managers from seeing projects through to completion. For example, the highest level IRM office employee devoted full-time to the modernization effort has changed five times in the past few years. The board could also be an important vehicle for ensuring that important projects, such as data administration, are adequately funded and implemented agencywide. In the past, this has not occurred. For example, the data administration program is intended to support the modernization effort and address fundamental technical inefficiencies that have resulted from State’s decentralized organization and mission and business operations. With posts all over the world managing their own specialized programs and functions, the Department has become reliant on separate systems environments for various overseas and domestic operations. Redundant and incompatible systems operating within these environments produce inconsistent, inaccurate, and untimely data that hamper departmental decision making, according to a State report. The report further states that bureaus spend a considerable amount of time reconciling data delivered by other bureaus. Data administration is needed to ensure that common, integrated data and information support business and program operations. According to IRM officials, however, bureaus (other than the Bureau for Financial and Management Policy) have only demonstrated a token interest in data administration. In addition, the program has not had an official charter, mission, and permanent staff. On several occasions, the data administration program ran out of funds. At one point, the Bureau of Finance and Management Policy provided some of its own operational funds to keep the project going to meet bureau needs. The Office of the Under Secretary for Management recently drafted proposals to begin to bring together IRM planning and budgeting processes; however, State officials said that agencywide commitment will be needed to implement these initiatives. In addition, as previously mentioned, State began in 1993 to hold separate meetings for representatives from the regional, policy, and management bureaus to establish agencywide spending priorities and make decisions on investments in line with mission and business objectives. These are all steps in the right direction; however, it is too early to determine what final impact they will have. One of the basic responsibilities of an agency’s IRM support organization is to provide organizationwide guidance on the management of information resources. Increasingly, IRM support organizations are also called upon to provide information and technical architectures and standards to guide the management and acquisition of information resources. State’s IRM organization, however, has not provided adequate guidance describing how State’s various information resources should be managed. For example, the guidance that the IRM office has provided does not address issues such as strategic IRM planning, management of major acquisitions, or conducting IRM evaluations in accordance with federal requirements. Policy officials are currently revising the guidance to reflect departmental changes, reduce its length, and ensure compliance with federal regulations. The revisions are expected to be completed in 1995. The IRM office also has not provided an infrastructure within which to effectively manage information resources. Specifically, State has not developed an enterprisewide information architecture that identifies the information that is needed to achieve mission objectives and defines how information systems will be integrated through common standards to satisfy those objectives. Senior IRM officials recognized that an information architecture was needed, but said that a project to develop one will not be initiated for another year or two. The IRM office is currently working to institute a technical architecture as part of its systems modernization program. The technical architecture is to provide a set of standards and specifications, describing the basic features necessary to permit a wide variety of platforms to interoperate at all of State’s posts and offices worldwide. However, planning for the systems modernization program is based on inadequate supporting analysis. Specifically, State has not identified agencywide information and functional requirements in planning for systems modernization. Instead, State has unnecessarily limited its modernization options by focusing on technology solutions. For example, the Department selected Microsoft Windows as its systems environment at the desktop level. In conducting a requirements survey, the IRM officials asked users whether they needed Windows—ignoring other desktop platforms, such as Macintosh and OS/2. As a result, State does not know whether Windows is the most appropriate system environment for meeting users’ needs. With shrinking budgets and reduced staffing, the Department of State is facing new challenges in fulfilling its worldwide responsibilities. Meeting these challenges will require State to increase the effectiveness and efficiency of its mission and business operations, including consular affairs operations aimed at reducing visa fraud and financial management operations aimed at improving financial statements. How successful State is will depend, at least in part, on how well the Department manages its information resources. Although the Department spends hundreds of millions of dollars on IRM activities annually, it continues to be plagued by long-standing IRM problems. As a result of its failure to follow the best IRM practices, major IRM improvement initiatives remain at risk of failure. Specifically, because IRM planning and budgeting processes have not been linked, initiatives to modernize office automation equipment have made little progress and backup for some mainframes is still lacking. These initiatives have been funded at levels sufficient to plan them, but not fully implement them. While State has recently begun a departmentwide investment review board, the board lacks adequate representation from regional and functional bureaus to ensure adequate support for mission-critical information needs. To resolve its long-standing problems, State must follow the example set by leading organizations and adopt a more strategic approach to information management. Such an approach includes (1) a departmentwide commitment to change, (2) an integrated management process, and (3) an organizationwide information management capability to address mission and business needs. The Under Secretary for Management has initiated efforts to promote change and revise management processes and organizational structures. These are important first steps. However, more action should be taken to sustain and support these efforts. Managers throughout the agency must begin to work together to identify and address information management weaknesses. State must also assess and prioritize its mission and business needs and begin to focus on those projects that are most needed across the Department. Only by taking an agencywide focus will State be able to make substantive progress and break from its history of poor information management. To institute modern information resources management practices in support of departmentwide mission and business needs, we recommend that the Secretary of State designate a Chief Information Officer, above the Assistant Secretary level, with the authority necessary to oversee the implementation of departmentwide IRM initiatives and standards, and strengthen the recently established new IRM investment review board by (1) increasing regional and functional bureau representation and (2) ensuring that the board’s determinations are implemented. We also recommend that the Chief Information Officer, in conjunction with participants from the IRM investment review board, ensure development of an agency business plan specifying mission goals, objectives, and priorities to provide a sound basis for IRM planning and business process improvements; integrate IRM planning with budgeting and other related processes; ensure that the IRM organization (1) issues adequate guidance to govern agencywide IRM, including the areas of strategic planning and acquisition, and (2) develops information and technical architectures and standards to ensure integration of data and systems; and require periodic evaluations of State’s IRM practices against those of leading organizations and implement necessary improvements to continually strengthen practices. As requested, we did not obtain written comments on a draft of this report. However, we discussed the results of our work with the Under Secretary for Management and senior IRM officials, who generally agreed with the information presented. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the date of this letter. We will then send copies to the Secretary of State, other interested congressional committees, and the Director of the Office of Management and Budget. Copies will also be sent to others upon request. Please contact me at (202) 512-6240 if you or your staff have any questions. Other major contributors are listed in appendix IV. To address our objective, we focused on a recent GAO report on the best practices of leading public and private organizations, and reviewed legislation, federal guidance, and other IRM criteria. On the basis of this criteria, we identified elements we believe to be critical and relevant to IRM success at State. These elements include adequate leadership and authority for IRM, and strategic IRM planning based on the agency’s mission and business needs. To obtain background information on the long-standing IRM problems at State, we interviewed and collected reports from officials at the General Services Administration, the Office of Management and Budget, and State’s Office of Inspector General. We reviewed internal reports and evaluations from State to gain the agency’s perspective on its IRM program. Further, we interviewed State officials and observed operations at the Foreign Affairs Data Processing Center, the Communications Center at State headquarters, and the Information Management Center in Beltsville, Maryland. To assess State’s organizational structure, we consulted various offices departmentwide. Specifically, we interviewed senior State officials (including the Under Secretary for Management, the Assistant Secretary for Administration, and the Deputy Assistant Secretary for Information Management), as well as other IRM representatives to gain their perspectives on IRM needs and challenges, and corresponding initiatives to address them. Further, we analyzed documents and interviewed representatives from Consular Affairs, Finance and Management Policy, Diplomatic Security, and the regional bureaus to learn about the bureaus’ IRM activities, support from and coordination with the IRM office, and whether or not bureau information and technology needs are adequately met. To evaluate State’s IRM planning, we reviewed plans and supporting documentation and discussed IRM planning processes with relevant IRM officials. We observed newly instituted integrated planning sessions in which users work together to prioritize their technology needs and develop an IRM spending plan. We interviewed program planning officials concerning the link between program and IRM planning and the need to develop a departmentwide business plan. Additionally, we obtained information on forums established to coordinate IRM activities and initiatives agencywide. To assess State’s ongoing IRM improvement efforts, we reviewed and analyzed modernization plans and supporting documents and interviewed relevant IRM office, Diplomatic Telecommunications Service Program Office, and other bureau officials. We consulted with officials from the National Institute of Standards and Technology to gather information on approaches to establishing open system environments. We performed our work at State headquarters offices in the Washington, D.C., area. As requested by your office, we did not obtain written comments on a draft of this report. However, we discussed the results of our work with the Under Secretary for Management and senior IRM officials, who generally agreed with the information presented. State has a number of weaknesses that it has reported over the past decade as high risks under FMFIA and its implementing guidance. These weaknesses include (1) reliance on obsolete proprietary equipment that is increasingly vulnerable to failure and rising maintenance costs, (2) use of out-dated microfiche to check the names of terrorists, narcotics traffickers, and others prior to the issuance of visas, (3) inaccurate and untimely financial information to support program decisions, and (4) lack of backup capabilities for mainframe computers. The Department has a number of initiatives aimed at addressing these weaknesses. State’s domestic bureaus and overseas posts are equipped to varying degrees with mini-computers and office automation equipment, which State purchased over a 15-year period almost exclusively from one vendor. Now this equipment is obsolescent and, in many cases, costly to maintain. According to one Department report, 92 percent of State’s unclassified office automation equipment and 72 percent of its domestic equipment fit the Federal Information Resources Management Regulation definition of obsolete. In addition, the IRM office reported that maintenance costs were about $12 million in fiscal year 1994. State has consequently embarked on a program to modernize its aging information technology infrastructure. This program, which began in 1992 and is managed by the IRM office, is aimed at replacing State’s proprietary hardware and software systems with an open systems environment. State estimates that the program will cost about $530 million from fiscal year 1994 through 1998. The main goals for the overall modernization program, identified in State’s March 1994 Open Systems Migration Implementation Plan, are to reduce dependency on proprietary architectures throughout the Department, move new and existing systems to a modern, open, technical environment, and improve support of State’s business functions. At least 228 of State’s more than 260 embassies and posts conduct consular operations overseas. These consular operations include processing visas for foreign nationals and providing passport services for U.S. citizens. Of these 228 posts, only 110 have an automated namechecking system that is on-line to a central database at State headquarters. Forty-six of the posts rely on a system known as the Distributed Name Checking System, that uses magnetic tape and compact disk-read only memory (CD-ROM) files. One consular official told us that these files are about 6 weeks out-of-date. Finally, 72 posts rely on microfiche that are several months out-of-date and are so time-consuming and difficult to use that consular staff may not check for ineligible applicants prior to issuing a visa. The 72 posts that do not have any automated namechecking capability unnecessarily risk issuing visas to persons who could engage in activities that endanger the welfare and security of United States citizens. State’s Inspector General testified before the Congress in July 1993 that IRM and procedural shortfalls helped facilitate the issuance of at least 3 visas to Sheik Abdel Rahman, indicted in the February 1993 World Trade Center bombing, that killed 6 people, injured more than 1,000 others, and caused damage estimated at more than a half billion dollars. The Inspector General testified that the first two visas were issued because the Sheik’s name was not added to the namechecking system until 7 years after it should have been. In 1990, although his name had been added to the system, the Khartoum post issued a visa to the Sheik without checking the microfiche namecheck system. According to the Inspector General, because the microfiche system is so time-consuming and cumbersome, there are probably numerous occasions throughout the world where the microfiche is not being checked as required. The Foreign Relations Authorization Act for fiscal years 1994 and 1995 mandates that all posts have automated namechecking systems by October 30, 1995. State officials were uncertain whether it will meet the deadline due to a number of possible hindrances cited in the Bureau program plan. These hindrances include the following: (1) the ability to complete procurements in a timely manner, (2) failure of the IRM office and other agencies to provide the infrastructure to support installation, and (3) insufficient resources and/or facilities for posts to physically collect and process funds. State is currently developing the Integrated Financial Management System (IFMS), which is intended to link State’s worldwide operations and provide managers at all levels with reliable financial information to plan and conduct operations in conformance with governmentwide requirements. The system is expected to partially address weaknesses in management and accountability of real and personal property, worldwide disbursing and cashiering, and payroll transactions. The Department has identified such weaknesses as high-risk areas for the past 3 years in its annual FMFIA reports to the President and the Congress. We reported in August 1994, however, that State’s efforts to plan and manage the IFMS initiative have not been adequate, increasing the risk that the system will not resolve long-standing financial management weaknesses or meet managers’ future information needs. Specifically, we reported that State did not have any documentation that described the anticipated financial management structure, how various subsidiary systems will integrate with this structure, or how IFMS is related to State’s other long-term improvement efforts. We reported that State also had not identified all existing financial management systems and subsystems to be enhanced or maintained in the improvement project. We concluded that without in-depth knowledge of the current financial accounting and management environment and a fully articulated target structure, it will be very difficult for State to improve its processes or correct weaknesses. State has reported the lack of critical ADP safeguards, such as backup capability, for its mainframe systems since 1984. One mainframe lacking backup supports agencywide, classified functions at the headquarters Foreign Affairs Data Processing Center. One system on this mainframe—the telegraphic retrieval system—is especially important because the system allows for search and retrieval of all cables over the past 20 years. This system is important to users, such as the Ambassador at Large for Counter-Terrorism, who rely on search and retrieval for important time-critical research. For example, the system was recently queried to assist in the identification of terrorist groups who may be responsible for terrorist acts under investigation. State recently installed a new mainframe at the Foreign Affairs Data Processing Center at State headquarters. State expects this mainframe to provide backup capabilities for unclassified information systems at its Beltsville Information Management Center by the end of 1994. Initiate, mandate, and facilitate major changes in information management to improve performance. Practice 1: Recognize and communicate the urgency to change information management practices. Practice 2: Get line management involved and create ownership. Practice 3: Take action and maintain momentum. Establish an outcome-oriented, integrated strategic information management process. Practice 4: Anchor strategic planning in customer needs and mission goals. Practice 5: Measure the performance of key mission delivery processes. Practice 6: Focus on process improvement in the context of an architecture. Practice 7: Manage information systems projects as investments. Practice 8: Integrate the planning, budgeting, and evaluation processes. Build organizationwide information management capabilities to address mission needs. Practice 9: Establish customer/supplier relationships between line and information management professionals. Practice 10: Position a Chief Information Officer as a senior management partner. Practice 11: Upgrade skills and knowledge of line and information management professionals. Financial Management: State’s Systems Planning Needs to Focus on Correcting Long-standing Problems (GAO/AIMD-94-141, August 12, 1994). Executive Guide: Improving Mission Performance Through Strategic Information Management and Technology (GAO/AIMD-94-115, May 1994). Financial Management: Serious Deficiencies in State’s Financial Systems Require Sustained Attention (GAO/AFMD-93-9, November 13, 1992). Management of Overseas Real Property (GAO/HR-93-15, December 1992). The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 6015 Gaithersburg, MD 20884-6015 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (301) 258-4066, or TDD (301) 413-0006. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (301) 258-4097 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.

Summary: Pursuant to a congressional request, GAO reviewed the Department of State's information resources management (IRM) program and ongoing IRM improvement efforts. GAO found that: (1) State has poorly managed its information resources and continues to use inadequate and obsolete information technology, which has resulted in critical information shortfalls and interrupted operations; (2) although State has a number of initiatives to improve IRM, its failure to follow the best IRM practices and commit top-level management to IRM jeopardizes its improvement efforts; (3) State lacks an adequate mechanism to prevent IRM duplication and ensure sufficient funding; (4) State needs a chief information officer (CIO) to provide leadership and guidance for IRM and an investment and oversight process involving senior regional and functional bureau managers; and (5) State needs to address long-standing fundamental barriers to effective IRM and commit to a departmentwide IRM approach to meet its critical mission and business functions.