VA’s mission is to promote the health, welfare, and dignity of all veterans in recognition of their service to the nation by ensuring that they receive medical care, benefits, social support, and lasting memorials. Over time, the use of IT has become increasingly crucial to the department’s efforts to provide such benefits and services. For example, the department relies on its systems for medical information and records for veterans, as well as for processing benefit claims, including compensation and pension and education benefits. In reporting on VA’s IT management over the past several years, we have highlighted challenges that the department has faced in achieving its “One VA” vision, including that information systems and services were highly decentralized and that its administrations controlled a majority of the IT budget. For example, we noted that, according to an October 2005 memorandum from the former CIO to the Secretary of Veterans Affairs, the CIO had direct control over only 3 percent of the department’s IT budget and 6 percent of the department’s IT personnel. In addition, in the department’s fiscal year 2006 IT budget request, the Veterans Health Administration was identified to receive 88 percent of the requested funding, while the department was identified to receive only 4 percent. We have previously pointed out that, given the department’s large IT funding and decentralized management structure, it was crucial for the CIO to ensure that well-established and integrated processes for leading, managing, and controlling investments were followed throughout the department. Further, a contractor’s assessment of VA’s IT organizational alignment, issued in February 2005, noted the lack of control for how and when money is spent. The assessment found that project managers within the administrations were able to shift money as they wanted to build and operate individual projects. In addition, according to the assessment, the focus of department-level management was only on reporting expenditures to the Office of Management and Budget and Congress, rather than on managing these expenditures within the department. The department officially began its initiative to provide the CIO with greater authority over the department’s IT in October 2005. At that time, the Secretary of Veterans Affairs issued an executive decision memorandum that granted approval for the development of a new centralized management structure for the department. According to VA, its goals in moving to centralized management included having better overall fiscal discipline over the budget. In February 2007, the Secretary approved the department’s new management structure. In this new structure, the Assistant Secretary for Information and Technology serves as VA’s CIO and is supported by a principal deputy assistant secretary and five deputy assistant secretaries—senior leadership positions created to assist the CIO in overseeing functions such as cyber security, IT portfolio management, and systems development and operations. In April 2007, the Secretary approved a governance plan that is intended to enable the Office of Information and Technology, under the leadership of the CIO, to centralize its decision making. The plan describes the relationship between IT and departmental governance and the approach the department intends to take to enhance governance and realize more cost-effective use of IT resources and assets. The department also made permanent the transfer of its entire IT workforce under the CIO, consisting of approximately 6,000 personnel from the administrations. In June 2007, we reported on the department’s plans for realigning the management of its IT program and establishing centralized control of its IT budget within the Office of Information and Technology. We pointed out that the department’s realignment plans included elements of several factors that we identified as critical to a successful transition, but that additional actions could increase assurance that the realignment would be completed successfully. Specifically, we reported that the department had ensured commitment from its top leadership and that, among other critical actions, it was establishing a governance structure to manage resources. However, at that time, VA had not updated its strategic plan to reflect the new organization. In addition, we noted that the department had planned to take action by July 2008 to create the necessary management processes to realize a centralized IT management structure. In testimony before the House Veterans’ Affairs Committee last September, however, we pointed out that the department had not kept pace with its schedule for implementing the new management processes. As part of its IT realignment, VA has taken important steps toward a more disciplined approach to ensuring oversight of and accountability for the department’s IT budget and resources. Within the new centralized management structure, the CIO is responsible for ensuring that there are adequate controls over the department’s IT budget and for overseeing capital planning and execution. These responsibilities are consistent with the Clinger-Cohen Act of 1996, which requires federal agencies to develop processes for the selection, control, and evaluation of major systems initiatives. In this regard, the department has (1) designated organizations with specific roles and responsibilities for controlling the budget to report directly to the CIO; (2) implemented an IT governance structure that assigns budget oversight responsibilities to specific governance boards; (3) finalized an IT strategic plan to guide, manage, and implement its operations and investments; (4) completed multi-year budget guidance to improve management of its IT; and (5) initiated the implementation of critical management processes. However, while VA has taken these important steps toward establishing control of the department’s IT, it remains too early to assess their overall impact because most of the actions taken have only recently become operational or have not yet been fully implemented. Thus, their effectiveness in ensuring accountability for the resources and budget has not yet been clearly established. As one important step, two deputy assistant secretaries under the CIO have been assigned responsibility for managing and controlling different aspects of the IT budget. Specifically, the Deputy Assistant Secretary for Information Technology Enterprise Strategy, Policy, Plans, and Programs is responsible for development of the budget and the Deputy Assistant Secretary for Information Technology Resource Management is responsible for overseeing budget execution, which includes tracking actual expenditures against the budget. Initially, the deputy assistant secretaries have served as a conduit for information to be used by the governance boards. As a second step, the department has established and activated three governance boards to facilitate budget oversight and management of its investments. The Business Needs and Investment Board; the Planning, Architecture, Technology and Services Board; and the Information Technology Leadership Board have begun providing oversight to ensure that investments align with the department’s strategic plan and that business and budget requirements for ongoing and new initiatives meet user demands. One of the main functions of the boards is to designate funding according to the needs and requirements of the administrations and staff offices. Each board meets monthly, and sometimes more frequently, as the need arises during the budget development phase. The first involvement of the boards in VA’s budget process began with their participation in formulating the fiscal year 2009 budget. As part of the budget formulation process, in May 2007 the Business Needs and Investment Board conducted its first meeting in which it evaluated the list of business projects being proposed in the budget using the department’s Exhibit 300s for fiscal year 2009, and made departmentwide allocation recommendations. Then in June, these recommendations were passed on to the Planning, Architecture, Technology, and Services Board, which proposed a new structure for the fiscal year 2009 budget request. The recommended structure was to provide visibility to important initiatives and enable better communication of performance results and outcomes. In late June, based on input from the aforementioned boards, the Information Technology Leadership Board made recommendations to department decision makers for funding the major categories of IT projects. In July 2007, following its work on the fiscal year 2009 budget formulation, the boards then began monitoring fiscal year 2008 budget execution. However, according to Office of Information and Technology officials, with the governance boards’ first involvement in budget oversight having only recently begun (in May 2007), and with their activities to date being primarily focused on formulation of the fiscal year 2009 budget and execution of the fiscal year 2008 budget, none of the boards has yet been involved in all stages of the budget formulation and execution processes. Thus, they have not yet fully established their effectiveness in helping to ensure overall accountability for the department’s IT appropriations. In addition, the Office of Information and Technology has not yet standardized the criteria that the boards are to use in reviewing, selecting, and assessing investments. The criteria is planned to be completed by the end of fiscal year 2008 and to be used as part of the fiscal year 2010 budget discussions. Office of Information and Technology officials stated that, in response to operational experience with the 2009 budget formulation and 2008 budget execution, the department plans to further enhance the governance structure. For example, the Office of Information and Technology found that the boards’ responsibilities needed to be more clearly defined in the IT governance plan to avoid confusion in roles. That is, one board (the Business Needs and Investment Board) was involved in the budget formulation for fiscal year 2009, but budget formulation is also the responsibility of the Deputy Assistant Secretary for Information Technology Resource Management, who is not a member of this board. According to the Principal Deputy Assistant Secretary for Information and Technology, the department is planning to update its governance plan by September 2008 to include more specificity on the role of the governance boards in the department’s budget formulation process. Such an update could further improve the structure's effectiveness. In addition, as part of improving the governance strategy, the department has set targets by which the Planning, Architecture, Technology, and Services Board is to review and make departmentwide recommendations for VA’s portfolio of investments. These targets call for the board to review major IT projects included in the fiscal year budgets. For example, the board is expected to review 10 percent for fiscal year 2008, 50 percent for fiscal year 2009, and 100 percent for fiscal year 2011. As a third step in establishing oversight, in December 2007, VA finalized an IT strategic plan to guide, manage, and implement its operations and investments. This plan (for fiscal years 2006-2011) aligns Office of Information and Technology goals, priorities, and initiatives with the priorities of the Secretary of Veterans Affairs, as identified in the VA strategic plan for fiscal years 2006-2011. In addition, within the plan, the IT strategic goals are aligned with the CIO’s IT priorities, as well as with specific initiatives and performance measures. This alignment frames the outcomes that IT executives and managers are expected to meet when delivering services and solutions to veterans and their dependents. Further, the plan includes a performance accountability matrix that highlights the alignment of the goals, priorities, initiatives, and performance measures, and an expanded version of the matrix designates specific entities within the Office of Information and Technology who are accountable for implementation of each initiative. The matrix also establishes goals and time lines through fiscal year 2011, which should enable VA to track progress and suggest midcourse corrections and sustain progress toward the realignment. As we previously reported, it is essential to establish and track implementation goals and establish a timeline to pinpoint performance shortfalls and gaps and suggest midcourse corrections. As a fourth step, the department has completed multi-year budget guidance to improve management of its IT portfolio. In December 2007, the CIO disseminated this guidance for the fiscal years 2010 through 2012 budgets. The purpose of the guidance is to provide general direction for proposing comprehensive multi-year IT planning proposals for centralized review and action. The process called for project managers to submit standardized concept papers and other review documentation in December 2007 for review in the January to March 2008 time frame, to decide which projects will be included in the fiscal year 2010 portfolio of IT projects. The new process is to add rigor and uniformity to the department’s investment approach and allow the investments to be consistently evaluated for alignment with the department’s strategic planning and priorities and the enterprise architecture. According to VA officials, this planning approach is expected to allow for reviewing proposals across the department and for identifying opportunities to maximize investments in IT. Nevertheless, although the multi-year programming guidance holds promise for obtaining better information for portfolio management, the guidance has not been fully implemented because it is applicable to future budgets (for fiscal years 2010 through 2012). As a result, it is too early to determine VA’s effectiveness in implementing this guidance, and ultimately, its impact on the department’s IT portfolio management. Finally, the department has begun developing new management processes to establish the CIO’s control over the IT budget. The department’s December 2007 IT strategic plan identifies three processes as high priorities for establishing the foundation of the budget functions: project management, portfolio management, and service level agreements. However, while the department had originally stated that its new management processes would be implemented by July 2008, the IT strategic plan indicates that key elements of these processes are not expected to be completed until at least fiscal year 2011. Specifically, the plan states that the project and portfolio management processes are to be completed by fiscal year 2011, and does not assign a completion date for the service level agreement process. As our previous report noted, it is crucial for the CIO to ensure that well- established and integrated processes are in place for leading, managing, and controlling VA’s IT resources. The absence of such processes increases the risk to the department’s ability to achieve a solid and sustainable management structure that ensures effective IT accountability and oversight. Appendix I provides a timeline of the various actions that the department has undertaken and planned for the realignment. In summary, while the department has made progress with implementing its centralized IT management approach, effective completion of its realignment and implementation of its improved processes is essential to ensuring that VA has a solid and sustainable approach to managing its IT investments. Because most of the actions taken by VA have only recently become operational, it is too early to assess their overall impact. Until the department carries out its plans to add rigor and uniformity to its investment approach and establishes a comprehensive set of improved management processes, the department may not achieve a sustainable and effective approach to managing its IT investments. Mr. Chairman and members of the Subcommittee, this concludes my statement. I would be pleased to respond to any questions that you may have at this time. For more information about this testimony, please contact Valerie C. Melvin at (202) 512-6304 or by e-mail at melvinv@gao.gov. Key contributors to this testimony were Barbara Oliver, Assistant Director, Nancy Glover, David Hong, Scott Pettis, and J. Michael Resser.

Summary: The use of information technology (IT) is crucial to the Department of Veterans Affairs' (VA) mission to promote the health, welfare, and dignity of all veterans in recognition of their service to the nation. In this regard, the department's fiscal year 2009 budget proposal includes about $2.4 billion to support IT development, operations, and maintenance. VA has, however, experienced challenges in managing its IT projects and initiatives, including cost overruns, schedule slippages, and performance problems. In an effort to confront these challenges, the department is undertaking a realignment to centralize its IT management structure. This testimony summarizes the department's actions to realign its management structure to provide greater authority and accountability over its IT budget and resources and the impact of these actions to date. In developing this testimony, GAO reviewed previous work on the department's realignment and related budget issues, analyzed pertinent documentation, and interviewed VA officials to determine the current status and impact of the department's efforts to centralize the management of its IT budget and operations. As part of its IT realignment, VA has taken important steps toward a more disciplined approach to ensuring oversight of and accountability for the department's IT budget and resources. For example, the department's chief information officer (CIO) now has responsibility for ensuring that there are controls over the budget and for overseeing all capital planning and execution, and has designated leadership to assist in overseeing functions such as portfolio management and IT operations. In addition, the department has established and activated three governance boards to facilitate budget oversight and management of its investments. Further, VA has approved an IT strategic plan that aligns with priorities identified in the department's strategic plan and has provided multi-year budget guidance to achieve a more disciplined approach for future budget formulation and execution. While these steps are critical to establishing control of the department's IT, it remains too early to assess their overall impact because most of the actions taken have only recently become operational or have not been fully implemented. Thus, their effectiveness in ensuring accountability for the resources and budget has not yet been clearly established. For example, according to Office of Information and Technology officials, the governance boards' first involvement in budget oversight only recently began (in May 2007) with activities to date focused primarily on formulation of the fiscal year 2009 budget and on execution of the fiscal year 2008 budget. Thus, none of the boards has yet been involved in all aspects of the budget formulation and execution processes and, as a result, their ability to help ensure overall accountability for the department's IT appropriations has not yet been fully established. In addition, because the multi-year programming guidance is applicable to future budgets (for fiscal years 2010 through 2012), it is too early to determine VA's effectiveness in implementing this guidance. Further, VA is in the initial stages of developing management processes that are critical to centralizing its control over the budget. However, while the department had originally stated that the processes would be implemented by July 2008, it now indicates that implementation across the department will not be completed until at least 2011. Until VA fully institutes its oversight measures and management processes, it risks not realizing their contributions to, and impact on, improved IT oversight and accountability within the department.