The mission of the Internal Revenue Service, a bureau within the Department of the Treasury (Treasury), is to provide America’s taxpayers top quality service by helping them understand and meet their tax responsibilities and by applying the federal tax laws with integrity and fairness to all. In carrying out its mission, IRS annually collects over $2 trillion in taxes from millions of individual taxpayers and numerous other types of taxpayers and manages the distribution of over $300 billion in refunds. To guide its future direction, the agency has two strategic goals: (1) improve taxpayer service to make voluntary compliance easier and (2) enforce the law to ensure everyone meets their obligations to pay taxes. IRS is organized into four primary operating divisions to meet the needs of specific taxpayer segments:  The Wage and Investment Division services individual taxpayers and provides the information, support, and assistance these taxpayers need to fulfill their tax obligations.  The Small Business and Self-Employed Division services all fully or partially self-employed individuals and corporations and partnerships with assets of $10 million or less.  The Large Business and International Division services corporations and partnerships with assets greater than $10 million.  The Tax Exempt and Government Entities Division services a large and unique economic sector of organizations, which include pension plans, exempt organizations, governmental entities, and tax-exempt bond issuers. IRS’s Modernization and InformationTechnology Services (MITS) organization is responsible for delivering IT services and solutions to support tax administration as well as the operations of the broader organization. MITS also supports the delivery of IRS’s business systems modernization efforts and improvement of customer service, and its responsibilities include management of all IT investments in both the development, modernization, and enhancement phase and the operations and maintenance phase. MITS is headed by the Chief Technology Officer. Within MITS, the Strategy and Planning Office, headed by the Associate Chief Information Officer for Strategy and Planning, has primary responsibility for defining and implementing the IT investment management process. The Strategy and Planning office includes a Strategy and Capital Planning (S&CP) group that focuses on IRS-wide IT strategy and capital planning and investment controls. The S&CP office also helps ensure the alignment of IT investments with Treasury’s and IRS’s strategies, as well as with best practices for investment management. It includes the following offices: Investment Planning and Selection Office—responsible for enabling the prioritization and selection of significant IT investments. IT Strategic Planning Office—responsible for determining strategic alignment between the functional areas of the Strategy and Planning office and MITS.  Transition Management Office—responsible for assessing organizational readiness through an examination of people, process, assets, and financials of new, enhanced, and retired systems through procedures and tools and communication with MITS business partners.  Estimation Program Office—responsible for developing and using government and industry best estimation practices in the delivery of full IT life cycle estimates. Investment Management Office—responsible for serving as the primary interface with Treasury’s capital planning and investment control organizations to coordinate actions including baseline change requests, budget formulation documents, and Office of Management and Budget (OMB) IT Dashboard reporting. Investment Evaluation Office—responsible for examining whether an IT investment has met its intended objectives and yielded expected benefits as projected in the business case. The office is also responsible for examining the current performance of an investment and measures the performance against baseline parameters such as cost, schedules, and performance measures, and makes recommendations to IRS senior executives to aid investment management decisions to optimize the IRS IT portfolio. The Strategy and Planning office also includes the Financial Management Services group, which has responsibility for providing guidelines and direction on federal budget and financial policy for IT investments and operations. The group provides guidance on all matters pertaining to budget and financial policy, budget formulation, and financial analysis, including the management of IT expenses across the agency. Figure 1 shows a simplified and partial organizational chart of IRS. IT plays a critical role in enabling IRS to carry out its mission and responsibilities. For example, the agency relies on information systems to process tax returns, account for tax revenues collected, send bills for taxes owed, issue refunds, assist in the selection of tax returns for audit, and provide telecommunications services for all business activities, including the public’s toll-free access to tax information. The President’s fiscal year 2012 budget request for IRS is $13.3 billion. Of this requested amount, about $2.67 billion is for IT investments. According to IRS, about $447 million, or 17 percent, is to be spent on development, modernization, or enhancement activities; $1.88 billion, or 70 percent, is to be spent on operations and maintenance activities; and the remaining $344 million, or 13 percent, is for efforts associated with implementation of the Patient Protection and Affordable Care Act. IRS expects to fund 31 major systems representing about $1.68 billion, or 63 percent, of the total IT request, and 124 nonmajor systems representing $1 billion, or 37 percent, of the total request. Over the years, we have reviewed IRS’s Business Systems Modernization (BSM) program, the agency’s ongoing effort to modernize its tax administration and internal management systems, on an annual basis and also performed other work relevant to investment management at IRS:  Since 1999, we have reviewed and reported on IRS’s Business Systems Modernization program. In particular, we have reported on program management capabilities and controls that are critical to the effective management of this program, such as cost and schedule estimates, requirements development and management, and postimplementation reviews of deployed projects. Accordingly, we have made numerous recommendations aimed at strengthening these controls and capabilities. Most recently, in our May 2010 review of the Business Systems Modernization program, we reported that while IRS had done much to define the phases of its Customer Account Data Engine 2 strategy for managing individual taxpayer accounts, the agency had not defined specific time frames for addressing key planning activities for the second phase, including defining core requirements. We recommended that IRS take several actions to improve program management capabilities and controls, including defining specific time frames for planning activities for the second phase to guide progress. In commenting on a draft of this report, IRS stated it would review the recommendations and provide a detailed corrective action plan to address them.  As part of our annual audit of IRS’s financial statements, we assess the effectiveness of the agency’s information security controls over its key financial and tax processing systems, information, and interconnected networks. In March 2011, we reported that although IRS had made progress in correcting information security weaknesses that we have reported previously, many weaknesses had not been corrected, and we identified many new weaknesses during our audit of its fiscal year 2010 financial statements. Specifically, 65 out of 88 previously reported weaknesses—about 74 percent—had not yet been corrected. In addition, we identified 37 new weaknesses. These weaknesses relate to access controls, configuration management, and segregation of duties. Weaknesses in these areas increase the likelihood of errors in financial data that result in misstatement and expose sensitive information and systems to unauthorized use, disclosure, modification, and loss. An underlying reason for these weaknesses—both old and new—is that IRS has not yet fully implemented key components of a comprehensive information security program. These weaknesses continue to jeopardize the confidentiality, integrity, and availability of the financial and sensitive taxpayer information processed by IRS’s systems and, considered collectively, were the basis of our determination that IRS had a material weakness in internal control over its financial reporting related to information security in fiscal year 2010. In March 2011, we provided an update on IRS’s implementation of its Customer Account Data Engine 2 strategy for managing individual taxpayer accounts, noting weaknesses in the agency’s efforts to improve the credibility of cost estimates and that IRS had not yet finalized expected benefits or set related quantitative targets for the second phase. We recommended that IRS (1) improve the credibility of revised cost estimates by including all costs or provide a rationale for excluding costs, and adjust costs for inflation, and (2) identify all of the second phase benefits, set the related targets, and identify how systems and business process might be affected. IRS agreed with our recommendations. Treasury’s Inspector General for Tax Administration has also recently reported on investment management issues at IRS: In July 2010, the organization reported on IRS’s process to manage and control IT investments. It reported that IRS had recently merged its investment management activities into the Strategy and Capital Planning office, and stated that this office was in the process of updating IRS’s Capital Planning and Investment Control Process Guide, developing desk guides for business cases and data calls, and identifying the steps for implementing a systematic investment selection, monitoring, and review process. It also reported that it concurred with the Strategy and Capital Planning office’s November 2008 self-assessment that IRS was at the ITIM Stage 2 maturity level, and was moving toward the Stage 3 level of developing a complete investment portfolio. In addition to the groups within the MITS Strategy and Planning office mentioned above, several groups and individuals play a role in IRS’s process to manage its IT investments. Involvement from these groups and individuals is necessary to complete aspects of the process including reviewing, approving, and selecting proposed investments; monitoring the investments through their implementation; and evaluating the results once they have become operational. Table 1 identifies the groups that have a role in this process and shows their composition and responsibilities. IRS’s investment management process consists of four phases: preselect, select, control, and evaluate. Each phase is to be completed before beginning the subsequent phase. The preselect phase, which IRS began using during the summer of 2009, is to determine which proposals for new investments can move into the select phase and be considered for inclusion in the IRS IT portfolio. The process is intended to identify the specific business need an investment is expected to address and determine its alignment with the IRS strategic plan. Only investments that best support IRS’s strategic plan and priorities are to be promoted through the preselect process and progress to the following phases. During this phase, a business owner prepares a two-page business case summary that, among other things, documents alignment with the agency priorities established by IRS’s Senior Executive Team. In addition, a preliminary economic analysis accompanies the business case for each proposal. The Strategy and Capital Planning office is to provide the ERT with an initial overview of the submissions ensuring the data are complete and consistent with Senior Executive Team priorities and the IRS strategic vision. The ERT is to review these documents and determines whether the proposals can move forward. The select phase is the process by which proposals approved during the preselect phase are further reviewed by the ERT and selected for inclusion in IRS’s budget submission. Business cases are further developed from the two-page summary that is prepared for the preselect phase, to include added information such as three technical alternatives, a risk analysis, and performance measures. A solution concept and cost estimate document that further refines the investment proposal and strengthens the business case is also developed. The investment summary is to be provided to the Deputy Commissioners to be used to determine which investments are to be considered for inclusion in the agency’s portfolio. The ERT makes recommendations based on an investment’s strategic value assessment, benefits, economic/risk assessments, standards, performance measures, and major project milestones and deliverables and works with the Deputy Commissioners to reach consensus on the proposals to recommend for the agency’s budget submission, which then go to the Commissioner for final approval. The investments selected by the Commissioner are forwarded to the Department of the Treasury and then to OMB for funding approval. Once IRS’s budget appropriation is funded, the investments proceed to the control phase. The purpose of the control phase is to provide oversight of projects that have been selected or are already under way. Prior to entering the control phase, an investment must have a developed project plan that includes objectives, an acquisition plan, risk management plan, schedule, deliverables, and projected/actual cost and benefits. Additionally the investment must have established a governance board investment review schedule and obtained governance approval to enter the control phase. During the control phase, Organizational Level Governance Boards and Management Level Governance Boards are to oversee nonmajor projects within their respective areas of responsibility and lend support to the ESCs. The ESCs serve as advisory boards to the MEG, IRS’s highest- level governance board in overseeing IT projects. The ESCs are to monitor and track the progress and performance of ongoing IT investments against projected cost, schedule, and performance measures, and against quantitative and qualitative measures delivered through various mechanisms including health assessments, reviews of corrective actions plans, and milestone exit reviews. Specifically, a monthly health assessment is conducted to determine the extent to which investments are being effectively managed by reviewing key indicators such as cost and schedule. The health assessments are submitted to the ESCs for review and used by project managers to manage the project. A corrective action plan or baseline change request must be submitted and approved by the appropriate governance boards for investments that vary more than 10 percent from their original baseline in cost, schedule, or scope. The S&CP’s Investment Management Office works with the project managers to validate all data used in investment reviews for accuracy and completeness. During the control phase, the ESCs conduct milestone reviews to determine whether an investment is ready to proceed to the next stage of development. The IRS Chief Technology Officer is provided with summary IT portfolio cost and schedule reports, which include information on relevant performance measures. After an investment is deemed ready for deployment based on the decision of the Chief Technology Officer and governance bodies, it proceeds to the evaluate phase. The evaluate phase involves an annual process to determine the extent to which a major IT investment has met its intended objectives and yielded expected benefits. Once the investment has been implemented, it should be continually monitored for performance, reliability, maintenance activities, cost, resource allocation, defects, problems, and changes. There are two subprocesses that are undertaken depending on the age and life-cycle stage of the investment: the postimplementation review and the operational analysis. Nonmajor investments are not required to undergo either of these processes.  A postimplementation review is done to identify an IT investment’s impact on mission performance, focusing on the investment’s impact on stakeholders and customers as well as its ability to deliver results and meet baseline goals. It is intended to identify potential improvements to IT project management practices and is performed by completing an assessment that compares expected performance goals established during the select phase with actual results, and to identify lessons learned for both the investment and the investment management process. The postimplementation review is required annually for all major IT investments that (1) fully exited the acquisition phase and moved into operations and maintenance in the past 6-12 months, (2) implemented a major release or modification, or (3) were retired or terminated during either development or operations. Once the postimplementation review data have been collected and reviewed, the project sponsor is to provide a formal presentation to the Chief Technology Officer that summarizes the investment evaluation as well as provide recommendations. According to IRS, because of resource constraints, postimplementation reviews are being performed only for Business Systems Modernization projects.  An operational analysis is to be conducted once an investment or meaningful project segment has moved into the operations and maintenance stage and has had a postimplementation review conducted. The purpose of an operational analysis is to identify investments that are potential candidates for modification, acceleration, replacement, or retirement. It is to be done by assessing the ability of a mature system or application to continue meeting user needs and performance goals based upon the performance of the system relative to the cost of replacing the system. If the system is determined to be a potential candidate for replacement or modification, a business case will need to be developed in the preselect phase. The operational analysis is to be performed biannually for all major investments in operations and maintenance, but not for any major investments already identified as requiring replacement. If any changes to the investment’s acquisition baseline goals are required, the appropriate governance authority must approve them. Project managers are to report the operational analysis results on an annual basis as part of their budget submission. These results may also be submitted as lessons learned back into the other phases of the investment management process. To provide a method for evaluating and assessing how well an agency is selecting and managing its IT resources, GAO developed the ITIM framework. The ITIM framework is a maturity model composed of five progressive stages of maturity that an agency can achieve in its investment management capabilities. It was developed on the basis of our research into the IT investment management practices of leading private- and public-sector organizations. In each of the five stages, the framework identifies critical processes for making successful IT investments. The maturity stages are cumulative; that is, in order to attain a higher stage, the agency must have institutionalized all of the critical processes at the lower stages. The framework can be used to assess the maturity of an agency’s investment management processes and as a tool for organizational improvement. The overriding purpose of the framework is to encourage investment processes that increase business value and mission performance, reduce risk, and increase accountability and transparency in the decision process. We have used the framework in several of our evaluations, and a number of agencies have adopted it. These agencies have used ITIM for purposes ranging from self-assessment to the redesign of their IT investment management processes. ITIM’s five maturity stages represent steps toward achieving stable and mature processes for managing IT investments. Each stage builds on the lower stages; the successful attainment of each stage leads to improvement in the organization’s ability to manage its investments. With the exception of the first stage, each maturity stage is composed of critical processes that must be implemented and institutionalized in order for the organization to achieve that stage. These critical processes are further broken down into key practices that describe the types of activities that an organization should be performing to successfully implement each critical process. It is not unusual for an organization to be performing key practices from more than one maturity stage at the same time, but efforts to improve investment management capabilities should focus on implementing all lower-stage practices before addressing higher-stage practices. In the ITIM framework, Stage 2 critical processes lay the foundation for sound IT investment processes by helping the agency to attain successful, predictable, and repeatable investment control processes at the project level. Specifically, Stage 2 encompasses building a sound investment management foundation by establishing basic capabilities for selecting new IT projects. It involves developing the capability to control projects so that they finish predictably within established cost and schedule expectations and having the capability to identify potential exposures to risk and put in place strategies to mitigate that risk. It also involves instituting an IT investment board, which includes defining its membership, guidance policies, operations, roles, responsibilities, and authorities for one or, if applicable, more IT investment boards within the organization, and, if appropriate, each board’s support staff. The basic selection processes established in Stage 2 lay the foundation for more mature selection capabilities in Stage 3, which represents a major step forward in maturity, in which the agency moves from project-centric processes to a portfolio approach, evaluating potential investments by how well they support the agency’s mission, strategies, and goals. Stage 3 requires that an organization continually assess both proposed and ongoing projects as parts of a complete investment portfolio—an integrated and competing set of investment options. It focuses on establishing a consistent, well-defined perspective on the IT investment portfolio and maintaining mature, integrated selection (and reselection), control, and evaluation processes, which are to be evaluated during postimplementation reviews. This portfolio perspective allows decision makers to consider the interaction among investments and the contributions to organizational mission goals and strategies that could be made by alternative portfolio selections, rather than to focus exclusively on the balance between the costs and benefits of individual investments. Stages 4 and 5 require the use of evaluation techniques to continuously improve both the investment portfolio and the investment processes in order to better achieve strategic outcomes. At Stage 4 maturity, an organization has the capacity to conduct IT succession activities and, therefore, can plan and implement the deselection of obsolete, high-risk, or low-value IT investments. An organization with Stage 5 maturity conducts proactive monitoring for breakthrough information technologies that will enable it to change and improve its business performance. Organizations implementing Stages 2 and 3 have in place the selection, control, and evaluation processes that are consistent with the Clinger- Cohen Act. Stages 4 and 5 define key attributes that are associated with the most capable organizations. Figure 2 shows the five ITIM stages of maturity and the critical processes associated with each stage. As defined by the model, each critical process consists of key practices that must be executed to implement the critical process. In December 2010, OMB issued its 25 Point Implementation Plan to Reform Federal Information Technology Management, a plan spanning 18 months to reform IT management throughout the federal government. A key goal of the plan is to foster more effective management of large- scale IT programs. One way the plan recommends this be done is through streamlining governance and improving accountability. According to the plan, this involves reforming and strengthening investment review boards to enable them to more adequately manage agency IT portfolios, redefining the role of agency chief information officers and the federal Chief Information Officers Council to focus on portfolio management, and rolling out “TechStat” reviews at the agency and bureau levels to focus attention on IT investments, including those that are poorly performing or may need to be retired if they no longer meet the needs of the organization. In order to have the capabilities to effectively manage IT investments, an agency should (1) build an investment foundation by putting basic, project-level control and selection practices in place (Stage 2 capabilities) and (2) manage its projects as a portfolio of investments, treating them as an integrated package of competing investment options and pursuing those that best meet the strategic goals, objectives, and mission of the agency (Stage 3 capabilities). IRS has established most of the foundational practices needed to manage its IT investments. Specifically, the department has executed 30 of the 38 key practices identified by the ITIM as foundational for successful IT management (Stage 2), including all the practices needed to provide investment oversight and capture investment information, and most of those needed to ensure that projects support business needs. In addition, IRS has initiated efforts to manage its investments as a portfolio, which, if fully executed, will provide IRS with the capability to determine whether it is selecting the mix of investments that best meet the agency’s mission needs. Despite these strengths, weaknesses remain in IRS’s execution of certain critical Stage 2 processes. Specifically, IRS does not have an enterprisewide IT investment board with sufficient representation from IT and business units that is responsible for the entire investment management process, and the agency has not fully documented its investment management process. In addition, IRS does not have a process, including defined criteria, for reselecting ongoing investments. Until it addresses these weaknesses, IRS cannot be assured that it is making the best decisions regarding whether its investments support ongoing and future business needs. At the ITIM Stage 2 level of maturity, an organization has attained repeatable, successful IT project-level investment control and basic selection processes. Through these processes, the organization can identify expectation gaps early and take the appropriate steps to address them. According to ITIM, critical processes at Stage 2 include (1) defining IT investment board operations, (2) identifying the business needs for each IT investment, (3) developing a basic process for selecting new IT proposals and reselecting ongoing investments, (4) developing project- level investment control processes, and (5) collecting information about existing investments to inform investment management decisions. Table 2 describes the purpose of each of these Stage 2 critical processes. IRS has executed most of the key practices associated with the Stage 2 processes. These include all of the key practices associated with providing investment oversight and capturing investment information and most of the practices associated with meeting business needs. However, IRS can improve the practices associated with the instituting the investment board and selecting the investment critical processes. Table 3 summarizes the status of IRS’s Stage 2 critical processes, showing how many associated key practices the agency has executed. The establishment of decision-making bodies or boards is a key component of the IT investment management process. At the Stage 2 level of maturity, organizations define one or more boards, provide resources to support the boards’ operations, and appoint members who have expertise in both operational and technical aspects of proposed investments. The boards should operate according to a written IT investment process guide that is tailored to the organization’s unique characteristics, thus ensuring that consistent and effective management practices are implemented across the organization. The organization selects board members who are knowledgeable about policies and procedures for managing investments. Organizations at the Stage 2 level of maturity also take steps to ensure that executives and line managers support and carry out the decisions of the investment board. According to the ITIM, organizations should, among other things, (1) establish an enterprisewide IT investment board composed of senior executives from IT and business units that is responsible for defining and implementing the organization’s IT governance process, (2) have a documented IT investment process that directs each investment board’s operations, and (3) establish management controls for ensuring that investment boards’ decisions are carried out. (The complete list of key practices is provided in table 4.) IRS has executed six of the eight key practices for this critical process. For example, the agency has adequate resources for supporting the investment management process. These include the Strategy and Capital Planning office, which supports the ERT in ensuring proposed investments align with the agency’s Senior Executive Team priorities, and lower-level governance boards, which support the MEG in overseeing projects once selected. IRS also has a portfolio management tool that supports the process. In addition, to ensure investment boards’ decisions are carried out, the agency has established for the MEG, as well as for the lower-level governance boards supporting it, a coordinator position responsible for recording and tracking all board action items until closure. Despite these strengths, IRS has not fully documented its investment management process. Specifically, while IRS has several documents defining various aspects of its investment management process, none fully describe the preselect phase, which IRS began using during the summer of 2009; the select phase; or the role of the Executive Review Team. In addition, the guidance does not specify the manner in which IT investment-related processes will be coordinated with other organizational plans, processes, and documents—including, at a minimum, the strategic plan, budget, and enterprise architecture. IRS’s Associate Chief Information Officer for Strategy and Planning acknowledged the shortcomings in its documentation and stated that the agency intends to update it by the end of the fiscal year. Until this happens, IRS cannot be assured that its investment management process will be carried out in a consistent manner or coordinated with other relevant processes to ensure investment decisions are fully informed. In addition, IRS does not have an enterprisewide investment board with sufficient representation from both IT and business units that is responsible for the entire investment management process. Specifically, the select phase is primarily carried out by two senior executives (the Executive Review Team), working with several individuals, rather than a larger body composed of representatives from IRS’s IT and business units, and as a result, the perspective and expertise represented are not as broad as they would be with a larger board. Further, the responsibility for the select and control phases lies with two different groups rather than a single body, and it is not clear whether or how these groups are coordinating to ensure that the results of one phase are used to inform decisions made in the other, as would happen with a single board responsible for implementing all phases of the investment management process. IRS officials recognized the need for this coordination and stated they would address it by briefing the MEG (and later the ESCs) semiannually on the results of the select phase. In addition, the Associate Chief Information Officer for Strategy and Planning stated that “touch- points” between the investment management phases would be included in the investment management guidance that is expected to be updated by the end of the fiscal year. However, until IRS takes these actions and provides for broader business and IT representation among the groups responsible for carrying out the selection phase, it will have less assurance that its decision-making process is being optimized. Table 4 shows the rating for each key practice required to implement the critical process for instituting the investment board at the Stage 2 level of maturity and summarizes the evidence that supports these ratings. Defining business needs for each IT project helps to ensure that projects and systems support an organization’s business needs and meet users’ needs. This critical process ensures that an organization’s business objectives and its IT management strategy are linked. According to the ITIM, effectively meeting business needs requires, among other things, (1) documenting business needs with stated goals and objectives, (2) identifying specific users and other beneficiaries of IT projects and systems, (3) providing adequate resources to ensure that projects and systems support the organization’s business needs and meet users’ needs, and (4) periodically evaluating the alignment of IT projects and systems with the organization’s strategic goals and objectives. (The complete list of key practices is provided in table 5.) IRS has executed five of the seven key practices for ensuring business needs are met. Specifically, IRS has documented its business mission, with stated goals and objectives, in its IRS Strategic Plan for fiscal years 2009-2013. In addition, resources are devoted to ensuring that IT projects and systems support the organization’s business needs and meet users’ needs, including a portfolio management tool, several investment support groups, and a business case template in which new project proposals are required to show alignment with strategic goals and Senior Executive Team priorities. Further, IRS defines and documents business needs for both proposed and ongoing IT projects in its portfolio management tool. In addition, IRS’s enterprise life-cycle guidance calls for users to participate in project management throughout each project’s life cycle. For the four projects we reviewed, we verified that business needs and specific users and other beneficiaries were identified and documented in the portfolio management tool. In addition, we verified that users are involved in project management throughout the life cycle of the projects. Finally, IRS has several processes for defining and documenting business needs for proposed and ongoing projects and systems, including the preselect process in which proposed investments are aligned with the Senior Executive Team priorities that reflect strategic goals and objectives and the annual update of IRS’s Enterprise Transition Plan. This document, which provides a 3- to 5-year road map for deploying IT investments, among other things, aligns investments with IRS’s business domains (i.e., functions). Last year, IRS also initiated a Business-Technology Alignment initiative to align business units’ strategic focus areas with key technologies. We verified that the four projects we reviewed were aligned with strategic goals and objectives. However, while IRS has documented procedures for ensuring that IT projects and systems support IRS’s business needs, these procedures do not address actions to be taken when ongoing projects no longer support business needs. In addition, while IRS stated that proposed projects that do not align with the Senior Executive Team priorities are not accepted, the agency did not describe a process for taking corrective actions when ongoing projects are not aligned with business needs or provide supporting examples. Until IRS performs all the key practices associated with the Meeting Business Needs critical process, it will have less assurance that it is investing in only those projects that are needed to meet the agency’s business needs. Table 5 shows the rating for each key practice required to implement the critical process for meeting business needs at the Stage 2 level of maturity and summarizes the evidence that supports these ratings. Selecting new IT proposals and reselecting ongoing investments require a well-defined and disciplined process to provide the agency’s investment boards, business units, and developers with a common understanding of the process and the cost, benefit, schedule, and risk criteria that will be used both to select new projects and to reselect ongoing projects for continued funding. According to the ITIM, this critical process requires, among other things, (1) providing adequate resources for investment selection activities, (2) making funding decisions for new proposals according to an established process, and (3) using a defined selection process to select new investments and reselect ongoing investments. (The complete list of key practices is provided in table 6.) IRS has executed 6 of the 10 key practices associated with selecting an investment. The agency has aligned its funding decisions with its selection process for new and ongoing investments by having the Financial Management Services group issue guidance that integrates the funding initiatives with the investment selection process. IRS’s portfolio management tool contains forms for entering information related to the select phase. We verified that the four systems we reviewed—the Integrated Customer Communication Environment system, the Integration Collection System, the Integrated Data Retrieval System, and the Security Audit and Analysis System—used the forms in the portfolio management tool for entering select data. IRS has also documented criteria for analyzing, prioritizing, and selecting new investments in its capital planning guide that address its strategic goals. However, weaknesses remain in the organization’s ability to select investments. Although IRS has documentation that addresses the investment selection process, the guidance does not fully document the current process being used. For example, the guidance does not specify the roles and responsibilities of the ERT that has been involved in the selection process over the last 2 years. As previously noted, IRS recognizes this shortcoming in its documentation and stated that it plans to address it by the end of the fiscal year. Until IRS has documented policies and procedures that reflect the current process for selecting new investments, there is a risk that projects will not be selected in a consistent manner and IRS will not have the transparency that is needed to increase effectiveness. In addition, IRS has not established a process, including supporting criteria, for analyzing, prioritizing, and reselecting ongoing investments. MITS senior managers are expected to use a series of questions to evaluate their continued need for IT investments—in particular those in operations and maintenance—however, these questions are more focused on identifying savings and efficiencies than on evaluating the need for continued funding. Examples of these questions include the following: (1) Is there a less expensive option to provide maintenance support? (2) Can multiple project resources be combined to reduce costs? Until IRS establishes a process including criteria for reselecting investments, it will not be adequately assured that it is objectively continuing to fund the right projects. Considering that investments in operations and maintenance represent $1.88 billion, or 70 percent of IRS’s total IT budget request of $2.67 billion for fiscal year 2012, IRS could be funding millions of dollars in investments that are no longer needed and which could be made available for investments that better support the agency’s needs. Table 6 shows the rating for each key practice required to implement the critical process for selecting an investment at the Stage 2 level of maturity and summarizes the evidence that supports these ratings. An organization should effectively oversee its IT projects throughout all phases of their life cycles. An investment board should observe each project’s performance and progress toward predefined cost and schedule expectations as well as each project’s anticipated benefits and risk exposure. This does not mean that a departmental board should micromanage each project to provide effective oversight; rather, it means that the departmental board should be actively involved in all IT investments and proposals that are high cost or high risk or have significant scope and duration and, at a minimum, should have a mechanism for maintaining visibility of other investments. The board should also employ early-warning systems that enable it to take corrective actions at the first sign of cost, schedule, and performance slippages. According to the ITIM, effective project oversight requires, among other things, (1) having written policies and procedures for management oversight; (2) developing and maintaining an approved management plan for each IT project; (3) making up-to-date cost and schedule data for each project available to the oversight boards; (4) having regular reviews by each investment board of each project’s performance against stated expectations; and (5) ensuring that corrective actions for each underperforming project are documented, agreed to, implemented, and tracked until the desired outcome is achieved. (The complete list of key practices is provided in table 7.) IRS has executed all seven key practices associated with effective project oversight. The agency has developed written policies and procedures for management oversight of its investments. These include (1) a tiered escalation guide that outlines the process for elevating a project to a higher level of control or governance for review, mitigation, and resolution when resolution cannot be reached at a project’s respective level of control or governance, and (2) written procedures and a template for conducting milestone exit reviews to assess a project’s readiness for moving to the next phase of its life cycle or exiting a milestone. In addition, the agency has adequate resources for overseeing IT projects that lend support to the MEG, IRS’s highest governance board for overseeing projects during the control phase. To support the MEG, IRS has lower-level governance bodies—ESCs, Organizational Level Governance Boards, and Management Level Governance Boards—for overseeing the agency’s IT investments. For example, each quarter, the ESC cochairs review projects that are experiencing significant cost variances and schedule slippages. The agency also maintains an automated system for tracking project action items assigned during governance board meetings until mitigated. IRS also requires project management plans that document cost, schedule, benefit, and risk expectations. We verified that these project management plans were developed for the four projects we reviewed. Table 7 shows the rating for each key practice required to provide investment oversight and summarizes the evidence that supports these ratings. To make informed decisions regarding IT investments, an organization must be able to acquire, store, and retrieve pertinent information about each investment. During this critical process, the organization identifies its IT assets and uses a comprehensive repository to store pertinent investment information. This repository of IT investment information is used to track the organization’s IT resources to provide insights and trends about major IT cost and management drivers. The information in the repository serves to highlight lessons learned and to support current and future investment decisions. According to the ITIM framework, effectively capturing investment information requires, among other things, (1) developing documented policies and procedures for identifying and collecting information about IT projects and systems to support the investment management process, (2) assigning an official with responsibility for ensuring that the investment information collected meets the needs of the investment management process, (3) collecting and retaining easily accessible relevant investment information relating to identified IT investments, and (4) ensuring that information repositories are used by decision makers to support investment management and related decisions. IRS has executed all six practices associated with capturing investment information. For example, according to IRS officials, the Chief Technology Officer is responsible for ensuring that collected investment information meets the needs of the investment management process. Also, the agency has adequate resources for supporting the process, including the Investment Planning and Selection Office, the Estimation Program Office, and the Investment Management Office, which work together in the development and compilation of relevant investment information. Additionally, IRS has a number of tools to identify and collect investment information, including a portfolio management tool and project and action item tracking systems. Captured investment information is easily accessible to decision makers through reports generated by IRS’s portfolio management tool, quarterly briefings, and monthly health assessments that use six key performance indicators to determine an investment’s status. Table 8 shows the rating for each key practice required to implement this Stage 2 critical process and summarizes the evidence that supports these ratings. Once an agency has attained Stage 2 maturity, it needs to implement critical processes for managing its investments as a portfolio (Stage 3). Such capabilities enable an agency to consider its investments comprehensively, so that collectively the investments optimally address the organization’s mission, strategic goals, and objectives. Managing IT investments as a portfolio also allows an organization to determine its priorities and make decisions about which projects to fund and continue to fund based on analyses of the relative organizational value and risks of all projects, including projects that are proposed, under development, and in operation. Although investments may initially be organized into subordinate portfolios—based on, for example, business lines or life-cycle stages—and managed by subordinate investment boards, they should ultimately be aggregated into this enterprise-level portfolio. According to the ITIM framework, Stage 3 maturity includes (1) defining the portfolio criteria, (2) creating the portfolio, (3) evaluating the portfolio, and (4) conducting postimplementation reviews. During our review, we noted activities the agency had performed to manage its investments as a portfolio. For example, under the critical process for creating the portfolio, the agency provided evidence that it was capturing and maintaining investment information for future reference and that it had developed an Enterprise Portfolio and Sequencing Plan to guide its IT investments. IRS also has begun addressing the critical process for conducting postimplementation reviews. The agency has developed guidance that (1) specifies that the review should be conducted 6-12 months after a project’s deployment, (2) defines roles and responsibilities for conducting the review, and (3) identifies templates for supporting the process. IRS provided examples of the results of two such reviews. According to IRS officials, the agency has not concentrated on implementing Stage 3 key practices because the agency has focused its resources on establishing the Stage 2 practices associated with building the IT investment management foundation. Full implantation of the Stage 3 critical processes associated with portfolio management will provide IRS with the capability to determine whether it is selecting the mix of products that best meet the agency’s mission needs. Given the importance of IT to IRS’s mission, it is critical that the agency adopt an effective institutional approach to IT investment management. To its credit, IRS has implemented most of the key practices for such an approach, laying the groundwork for greater maturity. Most notably, the agency has established a strong process for overseeing its investments, implementing all the key practices associated with providing investment oversight. This should provide greater assurance that projects’ progress in meeting cost, schedule, risk, and benefit expectations is tracked and that corrective actions are taken when these expectations are not being met. However, IRS has yet to fully document its investment management process, which increases the risk that the process will not be implemented consistently or institutionalized. In addition, because of the Executive Review Team’s composition and the manner in which responsibilities for the select and control phases are assigned, IRS may not be optimizing its investment decision-making process. Finally, IRS has not established a structured process, including supporting criteria, for reselecting these projects. Considering the size of IRS’s IT budget, not having a process for reselecting ongoing projects could result in potentially millions of dollars being spent with no assurance that the funds are being used wisely. We recommend that the Commissioner of Internal Revenue direct the appropriate officials to take the following four actions.  ensure that the investment management guidance that is expected to be updated by the end of the fiscal year fully documents the preselect and select phases and the role of the Executive Review Team, and specifies the manner in which IT investment-related processes will be coordinated;  assign investment management responsibilities to optimize the decision-making process by ensuring that (1) selection decisions are made by a group that includes sufficient representation from business and IT units to provide broad perspective and expertise, and (2) investment decisions are fully informed by the results of relevant phases of the investment management process;  define and implement a process for taking corrective actions when ongoing projects are not aligned with strategic goals and objectives; and  define and implement a process, including defined criteria, for reselecting ongoing projects. In written comments on a draft of this report, IRS’s Commissioner concurred with our recommendations and stated that the agency would provide a detailed corrective action plan addressing each recommendation. The Commissioner further stated that IRS appreciated that the report recognized the progress the agency has made in providing investment oversight and capturing investment information. He also noted that IRS is reviewing its existing governance structure and the accountabilities of the various boards and is in the process of creating an Investment Review Board with broad senior-level representation. IRS’s comments are reprinted in appendix II. We are sending copies of this report to interested congressional committees and the Commissioner of Internal Revenue. In addition, the report will be available at no charge on GAO’s website at http://www.gao.gov. If you or your staff have any questions on the matters discussed in this report, please contact me at (202) 512-9286 or pownerd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III. The objective of our review was to assess the Internal Revenue Service’s (IRS) capabilities for managing its information technology (IT) investments. Our analysis was based on practices contained in GAO’s Information Technology Investment Management (ITIM) framework and the framework’s associated evaluation methodology, and focused on the agency’s implementation of critical processes and key practices for managing its business systems investments. To address this objective, we asked IRS to complete a self-assessment of its investment management process and provide supporting documentation. We reviewed the results of this self-assessment of Stage 2 practices and compared them against our ITIM framework and validated and updated the results of the self-assessment through document reviews and interviews with officials. We reviewed written policies, procedures, guidance, and other documentation that provided evidence of executed practices, including IRS’s Capital Planning and Investment Control Guide, Enterprise Transition Plan, Tiered Program Management Escalation Guide, Enterprise and Domain Processes and Procedures Manual–Release 1.3, Program Governance Office Procedure Guide v.1.0, Post Implementation Review Process Guide, Exhibit 300 Scoring Guide, portfolio management tool guidance, and various memorandums. We also reviewed Modernization and Information Technology Services Enterprise Governance committee, Executive Steering Committee, Organization Level Governance Board, and Management Level Governance Board meeting materials and other documentation. In addition, we conducted interviews with officials from IRS’s Modernization, Information Technology, and Services organization, Strategy and Capital Planning office, and Financial Management Services group. Together, these three organizations have the responsibility to oversee and ensure that IRS’s IT investment management process is implemented and followed. In comparing the evidence collected from our document reviews and interviews with the key practices in our ITIM framework, we rated the key practices as “executed” on the basis of whether the agency demonstrated (by providing evidence of performance) that it had met the criteria of the key practice. A key practice was rated as “not executed” when we found insufficient evidence of a practice during the review or when we determined that there were significant weaknesses in IRS’s execution of the key practice. In addition, IRS was provided with the opportunity to produce evidence for key practices rated as not executed. We did not assess progress in establishing the capabilities found in Stages 3, 4, and 5 because the agency officials acknowledged that IRS had not executed the key practices in these higher-maturity stages. We confirmed our analysis of IRS’s investment management process by examining supporting documentation. However, it was not within our scope to evaluate the outputs or outcomes of this process. As part of our analysis, we selected four projects as case studies to verify that the critical processes and key practices were being applied. The projects selected (1) are in different life-cycle phases, (2) represent a mix of major and nonmajor investments (different levels of funding), and (3) support different business domains. The four projects are described below:  The Integrated Collection System is a major information system within IRS’s filing and payment compliance business domain that is to improve revenue collections by providing electronic case processing to revenue officers and their managers. The Integration Collection System is to enable field revenue officers access to the most current taxpayer information using laptop computers for quicker case resolution and improved customer service. The system has investments in development and operations and maintenance. It is a major system and had a fiscal year 2010 cost of approximately $9.1 million.  The Integrated Customer Communication Environment, within the customer service business domain, is to support issue resolution by providing taxpayers with fast and efficient access to the information they need for pre- and postfiling. These applications use voice response, Internet, and other computer technology to provide quick, accurate, and convenient service to taxpayers 24 hours a day in real time. The system has investments in development and operations and maintenance. It is a major system and had a fiscal year 2010 cost of approximately $16.6 million.  The Integrated Data Retrieval System is a mission-critical system within IRS’s managing taxpayer accounts business domain, consisting of databases and operating programs that support IRS employees working active tax cases within each business function across the entire IRS. This system manages data that have been retrieved from the Tax Master Files, allowing IRS employees to take specific actions on taxpayer account issues, track status, and post transaction updates back to the Master Files. The system has investments in development and operations and maintenance. It is a major system and had a fiscal year 2010 cost of approximately $19.6 million.  The Security Audit and Analysis System, within the security services and privacy business domain, implements a data warehousing solution to provide online analytical processing of audit trail data. The system is to enable IRS to detect potential unauthorized accesses to IRS systems and provide analysis capabilities and reporting on data for all modernized and some current processing environment applications. The system has investments in development and operations and maintenance. It is a nonmajor investment and had a fiscal year 2010 cost of approximately $1.6 million. For these four projects, we reviewed the portfolio management tool documentation associated with each project and status reports. We also obtained investment information from the boards responsible for managing the projects. We conducted this performance audit from January 2010 to July 2011 at IRS’s offices in the Washington, D.C., area. Our work was done in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain significant, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. In addition to the individual named above, Sabine R. Paul, Assistant Director; William G. Barrick; James M. Crimmer; Lee A. McCracken; and Tomas Ramirez made key contributions to this report.

Summary: The Internal Revenue Service (IRS) relies extensively on information technology (IT) to carry out its mission. For fiscal year 2012, IRS requested about $2.67 billion for IT. Given the size and significance of these investments, GAO was asked to evaluate IRS's capabilities for managing its IT investments. To address this objective, GAO reviewed IRS policies and procedures and assessed them using GAO's IT investment management (ITIM) framework and associated methodology, focusing on the framework's stage relevant to building a foundation for investment management (Stage 2). GAO also interviewed officials responsible for IRS's investment management process. IRS has established most of the foundational practices needed to manage its IT investments. Specifically, the agency has executed 30 of the 38 key practices identified by the ITIM framework as foundational for successful IT investment management, including all the practices needed to provide investment oversight and capture investment information. For example, IRS has defined and implemented a tiered governance structure to oversee its projects and has several mechanisms for the boards to regularly review IT investments' performance. The agency has also established procedures for identifying and collecting information about its investments to inform decision making. Despite these strengths, IRS can improve its investment management process in two key areas. First, IRS does not have an enterprisewide IT investment board with sufficient representation from IT and business units that is responsible for the entire investment management process, and as a result may not be optimizing its decision-making process. Specifically, project selection is carried out by a team of two senior executives representing IRS's deputy commissioners, rather than a larger body composed of representatives from both IT and business units, and as a result, the perspective and expertise represented are not as broad as they would be with a larger board. Further, because the responsibility for the select and control phases lies with different groups rather than a single body, results of one process are not used to inform decisions made in the other, as would happen with a single board responsible for implementing all phases of the investment management process. IRS stated that it plans to address this coordination issue. Second, IRS does not have a process, including defined criteria, for reselecting (i.e., deciding whether to continue funding) ongoing projects. Given the size of its IT budget, IRS could be spending millions of dollars with no assurance that the funds are being used wisely. GAO is making recommendations to the Commissioner of Internal Revenue, including assigning responsibilities for implementing the investment management process to optimize decision making, and defining and implementing a process for deciding whether to continue funding ongoing projects. In commenting on a draft of this report, IRS concurred with GAO's recommendations.