The federal government invests more than $80 billion annually in IT, but many of these investments fail to meet cost and schedule expectations or make significant contributions to mission-related outcomes. We have previously testified that the federal government has spent billions of dollars on failed IT investments, such as the Department of Defense’s (DOD) Expeditionary Combat Support System, which was canceled in December 2012, after spending more than a billion dollars and failing to deploy within 5 years of initially obligating funds; the Department of Homeland Security’s Secure Border Initiative Network program, which was ended in January 2011, after the department obligated more than $1 billion to the program, because it did not meet cost-effectiveness and viability standards; the Department of Veterans Affairs’ (VA) Financial and Logistics Integrated Technology Enterprise program, which was intended to be delivered by 2014 at a total estimated cost of $609 million, but was terminated in October 2011 due to challenges in managing the program; the Farm Service Agency’s Modernize and Innovate the Delivery of Agricultural Systems program, which was to replace aging hardware and software applications that process benefits to farmers, was halted after investing about 10 years and at least $423 million, while only delivering about 20 percent of the functionality that was originally planned. the Office of Personnel Management’s Retirement Systems Modernization program, which was canceled in February 2011, after spending approximately $231 million on the agency’s third attempt to automate the processing of federal employee retirement claims; the National Oceanic and Atmospheric Administration, DOD, and the National Aeronautics and Space Administration’s National Polar- orbiting Operational Environmental Satellite System, which was a tri- agency weather satellite program that the White House Office of Science and Technology stopped in February 2010 after the program spent 16 years and almost $5 billion; and the VA Scheduling Replacement Project, which was terminated in September 2009 after spending an estimated $127 million over 9 years. These and other failed IT projects often suffered from a lack of disciplined and effective management, such as project planning, requirements definition, and program oversight and governance. In many instances, agencies had not consistently applied best practices that are critical to successfully acquiring IT investments. Federal IT projects have also failed due to a lack of oversight and governance. Executive-level governance and oversight across the government has often been ineffective, specifically from chief information officers (CIO). For example, we have reported that not all CIOs had the authority to review and approve the entire agency IT portfolio and that CIOs’ authority was limited. Recognizing the severity of issues related to government-wide management of IT, in December 2014, Congress enacted IT reform legislation, FITARA. The law holds promise for improving agencies’ acquisition of IT and enabling Congress to monitor agencies’ progress and hold them accountable for reducing duplication and achieving cost savings. FITARA includes specific requirements related to seven areas. Agency CIO authority enhancements. Agency CIOs are required to (1) approve the IT budget requests of their respective agencies, (2) certify that IT investments are adequately implementing the Office of Management and Budget’s (OMB) incremental development guidance, (3) review and approve contracts for IT, and (4) approve the appointment of other agency employees with the title of CIO. Enhanced transparency and improved risk management. OMB and agencies are to make publicly available detailed information on federal IT investments, and agency CIOs are to categorize their IT investments by risk. Additionally, in the case of major IT investments rated as high risk for 4 consecutive quarters, the law requires that the agency CIO and the investment’s program manager conduct a review aimed at identifying and addressing the causes of the risk. Portfolio review. Agencies are to annually review IT investment portfolios in order to, among other things, increase efficiency and effectiveness, and identify potential waste and duplication. In developing the associated process, the law requires OMB to develop standardized performance metrics, to include cost savings, and to submit quarterly reports to Congress on cost savings. Federal data center consolidation initiative (FDCCI). Agencies are required to provide OMB with a data center inventory, a strategy for consolidating and optimizing the data centers (to include planned cost savings), and quarterly updates on progress made. The law also requires OMB to develop a goal of how much is to be saved through this initiative, and provide annual reports on cost savings achieved. Expansion of training and use of IT cadres. Agencies are to update their acquisition human capital plans to address supporting the timely and effective acquisition of IT. In doing so, the law calls for agencies to consider, among other things, establishing IT acquisition cadres or developing agreements with other agencies that have such cadres. Maximizing the benefit of the federal strategic sourcing initiative. Federal agencies are required to compare their purchases of services and supplies to what is offered under the Federal Strategic Sourcing initiative. OMB is also required to issue related regulations. Government-wide software purchasing program. The General Services Administration is to develop a strategic sourcing initiative to enhance government-wide acquisition and management of software. In doing so, the law requires that, to the maximum extent practicable, the General Services Administration should allow for the purchase of a software license agreement that is available for use by all Executive Branch agencies as a single user. In addition, in June 2015, OMB released guidance describing how agencies are to implement the law. OMB’s guidance states that it is intended to, among other things: assist agencies in aligning their IT resources to statutory requirements; establish government-wide IT management controls that will meet the law’s requirements, while providing agencies with flexibility to adapt to unique agency processes and requirements; clarify the CIO’s role and strengthen the relationship between agency CIOs and bureau CIOs; and strengthen CIO accountability for IT cost, schedule, performance, and security. In this regard, the guidance reiterates OMB’s existing guidance on PortfolioStat, the IT Dashboard, and the federal data center consolidation initiative, and expands its existing guidance on TechStat sessions. The guidance includes several actions agencies are to take to establish a basic set of roles and responsibilities (referred to as the “common baseline”) for CIOs and other senior agency officials that are needed to implement the authorities described in the law. For example, agencies were required to conduct a self-assessment and submit a plan describing the changes they will make to ensure that common baseline responsibilities are implemented. Agencies were to submit their plans to OMB’s Office of E-Government and Information Technology by August 15, 2015, and make portions of the plans publicly available on agency websites no later than 30 days after OMB approval. As of October 30, 2015, none of the 24 Chief Financial Officers Act agencies had made their plans publicly available. The guidance also noted that OMB will help support agency implementation of the common baseline by, for example, requiring the Federal CIO Council to, on quarterly basis, discuss topics related to the implementation of the common baseline and to assist agencies by sharing examples of agency governance processes and IT policies. Further, by June 30, 2015, the President’s Management Council was to select three members from the council to provide an update on government-wide implementation of FITARA on a quarterly basis through September 2016. However, as of October 28, 2015, OMB officials stated that the President’s Management Council had not yet selected members to provide these updates. In addition, OMB recently issued a memorandum regarding commodity IT acquisitions and noted that agencies buy and manage their IT in a fragmented and inefficient manner which conflicts with the goals of FITARA. Among other things, the memorandum directed agencies to standardize laptop and desktop configurations for common requirements and reduce the number of contracts for laptops and desktops by consolidating purchasing. The memorandum notes that OMB intends for agencies to implement standard configurations over time by using approved contracts, with a government-wide goal of 75 percent of agencies using approved contracts by fiscal year 2018. The memorandum requires agencies to develop transition plans to achieve this goal and submit them to OMB by February 28, 2016. Our government-wide high-risk area Improving the Management of IT Acquisitions and Operations highlights critical IT initiatives, four of which align with provisions in FITARA: (1) an emphasis on incremental development, (2) a key transparency initiative, (3) efforts to consolidate data centers, and (4) efforts to streamline agencies’ portfolios of IT investments. Our high-risk report notes that implementation of these initiatives had been inconsistent, and more work remained to demonstrate progress in achieving IT acquisition outcomes. Implementing the provisions from the law, along with our outstanding recommendations, will be necessary for agencies to demonstrate progress in addressing this high-risk area. OMB has emphasized the need to deliver investments in smaller parts, or increments, in order to reduce investment risk, deliver capabilities more quickly, and facilitate the adoption of emerging technologies. In 2010, it called for agencies’ major investments to deliver functionality every 12 months and, since 2012, every 6 months. However, we recently reported that less than half of selected investments at five major agencies planned to deliver capabilities in 12-month cycles. Accordingly, we recommended that OMB develop and issue clearer guidance on incremental development and that selected agencies update and implement their associated policies. Most agencies agreed with our recommendations or had no comment. In January 2010, the Federal CIO began leading TechStat sessions— face-to-face meetings to terminate or turn around IT investments that are failing or are not producing results. These meetings involve OMB and agency leadership and are intended to increase accountability and improve performance. OMB reported that federal agencies achieved over $3 billion in cost savings or avoidances as a result of these sessions in 2010. Subsequently, OMB empowered agency CIOs to hold their own TechStat sessions within their respective agencies. We have since reported that OMB and selected agencies held multiple TechStats, but additional OMB oversight was needed to ensure that these meetings were having the appropriate impact on underperforming projects and that resulting cost savings were valid. We concluded that until OMB and agencies develop plans to address these investments, the investments would likely remain at risk. Among other things, we recommended that OMB require agencies to address high-risk investments. OMB generally agreed with this recommendation. However, as of October 28, 2015, OMB has only conducted one TechStat review in the last 2 years. In particular, between March 2013 and October 2015, OMB held one TechStat on the Department of State’s legacy consular systems investment in July 2015. Moreover, OMB has not listed any savings from TechStats in any of its required quarterly reporting to Congress since June 2012. To help the government achieve transparency while managing legacy investments, in June 2009, OMB established a public website (referred to as the IT Dashboard) that provides detailed information on major IT investments at 27 federal agencies, including ratings of their performance against cost and schedule targets. Among other things, agencies are to submit ratings from their CIOs, which, according to OMB’s instructions, should reflect the level of risk facing an investment relative to that investment’s ability to accomplish its goals. As of August 2015, according to the IT Dashboard, 163 of the federal government’s 738 major IT investments—totaling $9.8 billion—were in need of management attention (rated “yellow” to indicate the need for attention or “red” to indicate significant concerns). (See fig. 1.) Over the past several years, we have made over 20 recommendations to help improve the accuracy and reliability of the information on the IT Dashboard and to increase its availability. Most agencies agreed with our recommendations or had no comment. In addition to spending money on new IT development, agencies also plan to spend a significant amount of their fiscal year 2016 IT budgets on the operations and maintenance (O&M) of legacy (i.e., steady-state) systems. From fiscal year 2010 to fiscal year 2016, this amount has increased, while the amount invested in developing new systems has decreased by about $7.1 billion. (See figure 2.) This raises concerns about agencies’ ability to replace systems that are no longer cost- effective or that fail to meet user needs. Of the more than $79 billion budgeted for federal IT in fiscal year 2016, 26 federal agencies plan to spend about $60 billion, more than three- quarters of the total budgeted, on the O&M of legacy investments. Figure 3 provides a visual summary of the relative cost of major and nonmajor investments, both in development and O&M. Given the size and magnitude of these investments, it is important that agencies effectively manage the O&M of existing investments to ensure that they (1) continue to meet agency needs, (2) deliver value, and (3) do not unnecessarily duplicate or overlap with other investments. To accomplish this, agencies are required by OMB to perform annual operational analyses of these investments, which are intended to serve as periodic examination of an investment’s performance against, among other things, established cost, schedule, and performance goals. However, we have reported that agencies were not consistently performing such analyses and that billions of dollars in O&M investments had not undergone needed analyses. Specifically, as detailed in our November 2013 report, only 1 of the government’s 10 largest O&M investments underwent an OMB-required operational analysis. We recommended that operational analyses be completed on the remaining 9 investments. Most agencies generally agreed with our recommendations. To improve the efficiency, performance, and environmental footprint of federal data center activities, OMB established the federal data center consolidation initiative in February 2010. In a series of reports, we found that, while data center consolidation could potentially save the federal government billions of dollars, weaknesses existed in the execution and oversight of the initiative. Most recently, we reported that, as of May 2014, agencies collectively reported that they had a total of 9,658 data centers; as of May 2015, they had closed 1,684 data centers and were planning to close an additional 2,431—for a total of 4,115—by the end of September 2015. We also noted that between fiscal years 2011 and 2017, agencies reported planning a total of about $5.3 billion in cost savings and avoidances due to the consolidation of federal data centers. In correspondence subsequent to the publication of our report, DOD’s Office of the CIO identified an additional $2.1 billion in savings to be realized beyond fiscal year 2017, which increased the total savings across the federal government to about $7.4 billion. Further, since our May 2014 report we received additional information from other agencies about their actual 2014 cost savings and revised plans for future savings. This information is shown in table 1, which provides a summary of agencies’ total data center cost savings and cost avoidances between fiscal years 2011 and 2017, as well as DOD cost savings and cost avoidances to be realized beyond 2017. However, in our September 2014 report, we noted that planned savings may be understated because of difficulties agencies encountered when calculating savings and communicating their estimates to OMB. We made recommendations to ensure the initiative improves efficiency and achieves cost savings. Most agencies agreed with our recommendations or did not comment. To better manage existing IT systems, OMB launched the PortfolioStat initiative, which requires agencies to conduct an annual, agency-wide IT portfolio review to, among other things, reduce commodity IT spending and demonstrate how their IT investments align with the agency’s mission and business functions. In November 2013, we reported that agencies continued to identify duplicative spending as part of PortfolioStat and that this initiative had the potential to save at least $5.8 billion through fiscal year 2015; however, weaknesses existed in agencies’ implementation of the initiative, such as limitations in the CIOs’ authority. We made more than 60 recommendations to improve OMB’s and agencies’ implementation of PortfolioStat. OMB partially agreed with our recommendations, and responses from 21 of the agencies varied, with some agreeing and others not. In April 2015, we reported that agencies decreased their planned PortfolioStat savings to approximately $2 billion—a 68 percent reduction from the amount they reported to us in 2013. Additionally, although agencies also reported having achieved approximately $1.1 billion in savings, inconsistencies in OMB’s and agencies’ reporting made it difficult to reliably measure progress in achieving savings. Among other things, we made recommendations to OMB aimed at improving the reporting of achieved savings, with which it agreed. We have also recently reported on two additional key areas of agency’s IT spending portfolio: software licensing and mobile devices. Regarding software licensing, we recently reported that better management was needed to achieve significant savings government- wide. In particular, 22 of the 24 major agencies we reviewed did not have comprehensive license policies, and only 2 had comprehensive license inventories. We recommended that OMB issue needed guidance to agencies and made more than 130 recommendations to the agencies to improve their policies and practices for managing software licenses. OMB disagreed with the need for guidance. However, we believe that without such guidance, agencies will likely continue to lack the visibility into what needs to be managed. Most agencies generally agreed with the recommendations or had no comments. We have also reported that most of the 15 agencies in our mobile devices review did not have an inventory of mobile devices and associated services, and only 1 of the 15 agencies we reviewed had documented procedures for monitoring spending. Accordingly, we recommended that the agencies take actions to improve their inventories and control processes and that OMB measure and report progress in achieving cost savings. OMB and 14 of the agencies generally agreed with the recommendations or had no comment. The Department of Defense partially agreed, and we maintained that actions were needed. In our February 2015 high-risk report, we identified actions that OMB and the agencies need to take to make progress in this area. These include implementing the recently enacted statutory requirements promoting IT acquisition reform, as well as implementing our previous recommendations, such as updating the public version of the IT Dashboard throughout the year. As noted in that report, we have made multiple recommendations to improve agencies’ management of their IT acquisitions, many of which have been discussed in this statement. In the last 6 years we made approximately 800 recommendations to multiple agencies. As of October 2015, about 32 percent of these recommendations had been implemented. Also in our high-risk report, we stated that OMB and agencies will need to demonstrate measurable government-wide progress in the following key areas: implement at least 80 percent of GAO’s recommendations related to the management of IT acquisitions and operations within 4 years. ensure that a minimum of 80 percent of the government’s major acquisitions deliver functionality every 12 months. achieve no less than 80 percent of the planned PortfolioStat savings and 80 percent of the planned savings planned for data center consolidation. In conclusion, with the recent passage of IT reform legislation, the federal government has an opportunity to improve the transparency and management of IT acquisition and operations, and strengthen the authority of CIOs to provide needed direction and oversight. Further, by identifying the management of IT acquisitions and operations as a new government-wide high-risk area we are bringing necessary attention to several critical IT initiatives in need of additional congressional oversight. OMB and federal agencies should expeditiously implement the requirements of the legislation and continue to implement our previous recommendations. To help ensure that these improvements are achieved, continued congressional oversight of OMB’s and agencies’ implementation efforts is essential. Chairmen Meadows and Hurd, Ranking Members Connolly and Kelly, and Members of the Subcommittees, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time. For additional information about this high-risk area, contact David A. Powner at (202) 512-9286 or pownerd@gao.gov, Carol Cha at (202) 512- 4456 or chac@gao.gov, or Valerie Melvin at (202) 512-6304 or melvinv@gao.gov. Individuals who made key contributions to this testimony are Kevin Walsh (Assistant Director), Chris Businsky, Rebecca Eyler, Kaelin Kuhn, and Jessica Waselkow. Telecommunications: Agencies Need Better Controls to Achieve Significant Savings on Mobile Devices and Services. GAO-15-431. May 21, 2015. Information Technology: Additional OMB and Agency Actions Needed to Ensure Portfolio Savings Are Realized and Effectively Tracked. GAO-15-296. April 16, 2015. Federal Chief Information Officers: Reporting to OMB Can Be Improved by Further Streamlining and Better Focusing on Priorities. GAO-15-106. April 2, 2015. High-Risk Series: An Update. GAO-15-290. February 11, 2015. Data Center Consolidation: Reporting Can be Improved to Reflect Substantial Planned Savings. GAO-14-713. September 25, 2014. Federal Software Licenses: Better Management Needed to Achieve Significant Savings Government-Wide. GAO-14-413. May 22, 2014. Information Technology: Agencies Need to Establish and Implement Incremental Development Policies. GAO-14-361. May 1, 2014. IT Dashboard: Agencies Are Managing Investment Risk, but Related Ratings Need to Be More Accurate and Available. GAO-14-64. December 12, 2013. Information Technology: Agencies Need to Strengthen Oversight of Multibillion Dollar Investments in Operations and Maintenance. GAO-14-66. November 6, 2013. Information Technology: Additional OMB and Agency Actions Are Needed to Achieve Portfolio Savings. GAO-14-65. November 6, 2013. Information Technology: Additional Executive Review Sessions Needed to Address Troubled Projects. GAO-13-524. June 13, 2013. Information Technology: Agencies Need to Strengthen Oversight of Billions of Dollars in Operations and Maintenance Investments. GAO-13-87. October 16, 2012. IT Dashboard: Accuracy Has Improved, and Additional Efforts Are Under Way to Better Inform Decision Making. GAO-12-210. November 7, 2011. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The federal government invests more than $80 billion annually in IT. However, these investments frequently fail, incur cost overruns and schedule slippages, or contribute little to mission-related outcomes. As GAO has previously reported, this underperformance of federal IT projects can be traced to a lack of disciplined and effective management and inadequate executive-level oversight. Accordingly, in December 2014, IT reform legislation was enacted, aimed at improving agencies' acquisition of IT. Further, earlier this year GAO added improving the management of IT acquisitions and operations to its high-risk list—a list of agencies and program areas that are high risk due to their vulnerabilities to fraud, waste, abuse, and mismanagement, or are most in need of transformation. This statement provides information on FITARA and GAO's designation of IT acquisitions and operations as a high-risk area. In preparing this statement, GAO relied on its previously published work in these areas. The law commonly known as the Federal Information Technology Acquisition Reform Act (FITARA) was enacted in December 2014 and aims to improve federal information technology (IT) acquisition and operations. The law includes specific requirements related to seven areas. For example, it addresses Agency Chief Information Officer (CIO) authority enhancements . Among other things, agency CIOs are required to approve the IT budget requests of their respective agencies and certify that IT investments are adequately implementing the Office of Management and Budget's (OMB) incremental development guidance. Enhanced transparency and improved risk management . OMB and agencies are to make publicly available detailed information on federal IT investments, and agency CIOs are to categorize IT investments by risk. Additionally, if major IT investments are rated as high risk for 4 consecutive quarters, the agencies are to conduct a review of the investment. Portfolio review. Agencies are to annually review IT investment portfolios in order to, among other things, increase efficiency and effectiveness, and identify potential waste and duplication. OMB is required to develop standardized performance metrics, to include cost savings, and to submit quarterly reports to Congress on cost savings. Federal data center consolidation initiative. Agencies are required to provide OMB with a data center inventory, a strategy for consolidating and optimizing the data centers (to include planned cost savings), and quarterly updates on progress made. OMB is required to develop a goal of how much is to be saved through this initiative, and report on progress annually. Maximizing the benefit of the federal strategic sourcing initiative . Federal agencies are required to compare their purchases of services and supplies to what is offered under the Federal Strategic Sourcing initiative. OMB has released guidance for agencies to implement provisions of FITARA, which includes actions agencies are to take regarding responsibilities for CIOs. The guidance also reiterates OMB's existing guidance on IT portfolio management, a key transparency website, and the federal data center consolidation initiative; and expands its existing guidance on reviews of at-risk investments. Agencies were to conduct a self-assessment and submit a plan to OMB by August 2015 describing the changes they will make to ensure that responsibilities are implemented. Further, portions of these plans are required to be made publicly available 30 days after OMB's approval; as of October 30, 2015, none of the 24 Chief Financial Officers Act agencies had done so. Further, FITARA's provisions are similar to areas covered by GAO's high-risk area to improve the management of IT acquisitions and operations. For example, GAO has noted that improvements are needed in federal efforts to enhance transparency, consolidate data centers, and streamline agencies' IT investment portfolios. To demonstrate progress in addressing this high-risk area, agencies will need to implement the legislation's provisions and GAO's outstanding recommendations. Over the last 6 years, GAO made about 800 recommendations to OMB and agencies to improve acquisition and operations of IT. As of October 2015, about 32 percent of these had been implemented. It will be critical for agencies to implement the remaining GAO recommendations and the requirements of FITARA to achieve improvements. , Carol Cha at (202) 512-4456 or chac@gao.gov , or Valerie Melvin at (202) 512-6304 or melvinv@gao.gov .