The FBI serves as the primary investigative unit of the Department of Justice. The FBI’s mission responsibilities include investigating serious federal crimes, protecting the nation from foreign intelligence and terrorist threats, and assisting other law enforcement agencies. Approximately 12,500 special agents and 18,000 analysts and mission support personnel are located in the bureau’s Washington, D.C., headquarters and in more than 450 offices in the United States and more than 50 offices in foreign countries. Mission responsibilities at the bureau are divided among the following five major organizational components: Intelligence: Collects and analyzes information on evolving threats to the United States and ensures its dissemination within the FBI, to law enforcement, and to the U.S. intelligence community. Counterterrorism and Counterintelligence: identifies, assesses, investigates, and responds to national security threats. Criminal Investigations: Investigates serious federal crimes, including those associated with organized crime, violent offenses, white-collar crime, government and business corruption, and civil rights infractions. Probes federal statutory violations involving exploitation of the Internet and computer systems for criminal, foreign intelligence, and terrorism purposes. Law Enforcement: provides law enforcement information and forensic services to federal, state, local, and international agencies. Administration: manages the bureau’s personnel programs, budgetary and financial services, records, information resources, and information security. To execute its mission responsibilities, the FBI relies on IT, and this reliance has continued to grow. The bureau operates and maintains hundreds of computerized systems, networks, databases, and applications, such as: the Combined DNA Index System, which supports forensic examinations; the National Crime Information Center and the Integrated Automated Fingerprint Identification System, which helps state and local law enforcement agencies identify criminals; the Automated Case Management System (ACS), which manages information collected on investigative cases; the Investigative Data Warehouse, which aggregates data in a standard format from disparate databases to facilitate content management and data mining; and the Terrorist Screening Database, which consolidates identification information about known or suspected international and domestic terrorists. Following the terrorist attacks in the United States on September 11, 2001, the FBI shifted its mission focus to detecting and preventing future attacks, which ultimately led to the FBI’s commitment to reorganize and transform. According to the bureau, the complexity of this mission shift, along with the changing law enforcement environment, strained its existing IT environment. As a result, the bureau accelerated the IT modernization program that it began in September 2000. This program, later named Trilogy, was the FBI’s largest IT initiative to date, and consisted of three parts: (1) the Information Presentation Component to upgrade FBI’s computer hardware and system software, (2) the Transportation Network Component to upgrade FBI’s communication network, and (3) the User Application Component to upgrade and consolidate FBI’s five key investigative software applications. The heart of this last component became the Virtual Case File (VCF) system, which was intended to replace the obsolete Automated Case Support system, FBI’s primary investigative application. While the first two components of Trilogy experienced cost overruns and schedule delays, both are nevertheless currently still operating. However, VCF never became fully operational. In fact, the FBI terminated the project after Trilogy’s overall costs grew from $380 million to $537 million, the program fell behind schedule, and pilot testing showed that completion of VCF was infeasible and cost prohibitive. Among reasons we and others cited for VCF’s failure were poorly defined system requirements, ineffective requirements change control, limited contractor oversight, and human capital shortfalls due to, for example, no continuity in certain management positions and a lack of trained staff for key program positions. The FBI reports that it has almost 500 systems, applications, databases, and networks that are in operation, undergoing enhancement, or being developed or acquired. In particular, it has identified 18 new or enhancement projects that support its intelligence, investigative, and analyst activities. Included in these is the Sentinel program. The Sentinel program succeeds and expands VCF and is intended to meet FBI’s pressing need for a modern, automated capability for investigative case management and information sharing to help field agents and intelligence analysts perform their jobs more effectively and efficiently. The program’s key objectives are to: (1) successfully implement a system that acts as a single point of entry for all investigative case management and that provides paperless case management and workflow capabilities, (2) facilitate a bureau-wide organizational change management program, and (3) provide intuitive interfaces that feature data relevant to individual users. Using commercially available software and hardware components, Sentinel is planned to provide a range of system capabilities and services, including: investigative case management, leads management, and evidence management; document and records management, indexed searching, and electronic links to legacy FBI systems and external data sources; training, statistical, and reporting tools; and security and application management. The FBI plans to acquire Sentinel in four phases, each of which will span 12 to 18 months. While the specific content of each phase is to be proposed by and negotiated with the prime contractor, the general content of each phase is as follows: Phase 1: Includes a Web-based portal that will provide a data access tool for ACS and other legacy systems and includes the definition of a service- oriented architecture to support delivery and sharing of common services across the bureau. Phase 2: Includes the creation of case document and records management capabilities, document repositories, improved information assurance, application workflow, and improved data labeling to enhance information sharing. Phase 3: Includes updating and enhancing system storage and search capabilities. Phase 4: Includes implementing a new case management system to replace ACS. Overall, the FBI estimates that the four phases will cost about $425 million and take 6 years to complete. For fiscal year 2005, the FBI reprogrammed $97 million in appropriated funds from various sources to fund Sentinel work and submitted a $100 million budget estimate for fiscal year 2007. To manage the acquisition and deployment of Sentinel, the FBI established a program management office within the Office of the Chief Information Officer. The program office is led by a program manager and consists of the eight primary units described here (see fig. 1). Human capital decision making is vested with the program manager (or deputy program manager in his absence.) Program Management Office Staff: General Counsel provides legal advice; dedicated Contracting Officer manages program support and development contracts on behalf of the Program Management Office; and office staff manages day-to-day operations. Communications and Liaison Team: Prepares communications for the user community regarding Sentinel content and progress, media releases, and program briefings for stakeholders through FBI channels. Also, prepares information and reports for congressional stakeholders and testimony for the Director, Deputy Attorney General, and Attorney General regarding the program. Organizational Change Management Team: Prepares user community for adapting to new technology and associated work process changes and cultural shifts and serves as the user community’s representative and information conduit to the program office. Business and Administrative Support Unit: Provides support and oversight services, including support for human capital management, information and physical security, budget and investment management, contract support, audit, cost estimation, financial management, earned value management, and property management. Program Integration Unit: Prepares program baselines and plans, including milestones, and tracks progress against them; also, documents baseline changes. Manages the configuration management process, schedules program reviews, and provides major reports and updates regarding the program to bureau management and stakeholders. System Development Unit: Focuses on system design and development and related technical aspects of the program, such as design, development, and testing to ensure that technical solutions meet system and user requirements. Performs technical analyses of new requirements and changes to the enterprise architecture. Transition Unit: Manages the phased roll-out of system capabilities, including headquarters and field site preparation, user training, and changeover in user support to the Operations and Maintenance Unit. Operations and Maintenance Unit: Oversees and supports deployed system capabilities. To support the program office, the FBI has also issued task orders under existing contracts for program management support and services. In 2005, we testified that the FBI’s efforts to establish a strategic approach to managing its IT human capital remained a work in progress, and that completing these efforts posed a significant challenge for the bureau. In addition, we reported that the CIO had yet to create a strategic approach to managing IT human capital. As we said at that time, such an approach includes an assessment of the core competencies and essential knowledge, skills, and abilities needed to perform key IT functions, as well as an inventory of existing workforce capabilities and a gap analysis between defined needs and existing capabilities. The approach also provides for defining strategies and actions for filling identified gaps, such as the appropriate mix of hiring, training, and contract activities. It also establishes performance and accountability mechanisms, such as time frames, resources, roles and responsibilities, and performance measures associated with executing the strategies and actions. In September 2005, the National Academy of Public Administration reported that the bureau had developed a strategic human capital plan and had initiatives under way to improve its human capital system. However, it also reported that the bureau’s programs, activities, and actions were unlikely to produce a successful human capital program. Specifically, human capital improvement efforts were not carried out in a systematic, coordinated, and strategic manner; human capital management responsibility and authority were shared among different individuals; implementation of initiatives that involved contractors was not effectively coordinated; and implementation of plans and decisions was not always sustained. The Academy concluded that the bureau is likely to miss its staffing targets, due in part to insufficient workforce planning. To its credit, the FBI has moved quickly to staff its Sentinel program office, following what the Sentinel program manager describes as a meticulous series of actions to determine staffing needs, develop position descriptions, review resumes and reassess program needs. During the last year, it has also filled most of the positions in the plan primarily by using contractors. Nevertheless, a few key positions remain unfilled. Moreover, the staffing plan addressed only the program’s immediate staffing needs; it does not provide for the kind of strategic human capital planning and management that our research has shown to be critical to the success of any organization, such as inventorying the knowledge and skills of existing staff, forecasting knowledge and skill needs over the life of the program, and formulating explicit strategies for filling gaps. Exacerbating this lack of a strategic approach to human capital management is that the program’s inventory of risks does not include human capital as a program risk, and thus steps are not planned to proactively address these risks. Program officials told us that they are satisfied with Sentinel workforce management efforts, and, although challenges lie ahead, they are confident that the FBI can address the program’s evolving human capital needs. In contrast, other program documentation cites human capital as a program challenge and risk. In our view, the FBI’s approach to managing human capital in the Sentinel program is reactive and introduces the risk of not having skilled personnel available. A more proactive approach would increase the bureau’s ability to deliver Sentinel’s needed functionality and promised mission benefits on time and within budget. To its credit, the FBI has moved quickly to staff its Sentinel program office. During the last year, it created a staffing plan for Sentinel that is to serve as the program’s primary human capital planning document. Basically, this staffing plan defines the program’s immediate workforce requirements and identifies key program functions, positions, skills, and staffing levels that the FBI says it currently needs to begin executing the program. The staffing plan is intended to be a “living” document, meaning that the FBI intends to update it as required to reflect significant changes in the program office’s roles and responsibilities and staffing needs throughout the life of the program. These officials also stated that they developed the plan with the assistance of a contractor, and that it reflects their meticulous efforts to analyze staffing needs (skills and levels), develop position descriptions, review resumes, and reassess program needs. Further, they said that it is based on more than 100 years of combined program management experience and knowledge and that these efforts complied with bureau policies and procedures. Using the plan, program officials told us that they collaborated with the FBI Human Capital Office to fill defined positions with transfers from other FBI units and other federal agencies, and by hiring from outside the government. In doing so, the officials said that their approach was to fill program leadership positions with government staff and to fill the rest with government and contractor staff. Further, FBI officials said that they had initially focused on positions associated with near-term program management activities, such as program planning, requirements management, and contract solicitation and award. For government positions, program officials received support from the Human Capital Office in posting job announcements and processing applications. The program officials worked directly with existing contractors to fill contract positions. According to officials, they were able to address their initial staffing needs quickly because of the priority the Sentinel Program Manager, who is directly responsible for human capital decisions, devoted to recruitment and staffing efforts during the program’s planning stages, the availability of the FBI’s Human Capital Office to assist them, and the ability to draw from existing contract vehicles. Of the program’s 78 positions, 60 are to be filled by contractors (77 percent). This level of reliance on contractors for program management is appreciably higher than it was for another major IT program that we recently reviewed . For example, the ratio of government-to-contractor staffing on the Department of Homeland Security’s US VISIT program was about 50-50. According to Sentinel officials, their reliance on contractors for program management is a common practice in intelligence programs. While we are not aware of any generally accepted standards governing the desired mix of government versus contractor personnel performing program management functions, acquisition experts have recently raised over-reliance on contractors in performing program management functions as an emerging issue in the federal government. To date, the program office reports that it has filled 63 of 78 identified positions (81 percent). According to program officials, they are actively recruiting 5 of the 15 unfilled positions and plan to hire the remaining 10 in later phases of the program, when the need for these positions becomes more relevant. Among the 15 vacancies is the lead test engineer position, which is important for ensuring the testability of defined system requirements early in the program. According to program officials, the unfilled positions have had no negative impact on the program’s schedule or deliveries to date. (See fig. 2 for a complete list of the program office’s positions, including those still unfilled.) The success of any IT program depends on effectively leveraging people, processes, and tools to achieve defined outcomes and results. To effectively leverage people, they must be treated as strategic assets. As we previously reported, a strategic approach to human capital management enables an organization to be aware of and prepared for its current and future human capital needs, such as workforce size, knowledge, skills, and training. To be effective, our research shows that such a strategic approach includes using data-driven, fact-based methods to (1) assess the knowledge and skills needed to execute a program; (2) inventory existing staff knowledge and skills; (3) forecast the knowledge and skills needed over time; (4) analyze the gaps in capabilities between the existing staff and future workforce needs, including consideration of evolving program and succession needs caused by turnover and retirement; and (5) formulate strategies for filling expected gaps, including training, additional hiring, and the appropriate use of contractors. (See fig. 3 for an overview of this process). Through effective human capital management, organizations can effectively mitigate the serious risks associated with not having highly qualified employees. The Sentinel program has yet to determine and follow such a strategic approach to managing its human capital needs. In particular, in addressing its near-term staffing needs, FBI officials did not use a documented, fact- based, data-driven methodology to assess needs and existing capabilities, nor did it perform a gap analysis of the number of staff required and the specific skills and abilities needed to develop, maintain, and implement Sentinel. As previously stated, officials told us that they relied on their collective years of experience in managing IT projects and the assistance of a contractor to create the staffing plan, and that they reviewed resumes of candidates to fill the positions in the staffing plan. These efforts have not produced program life cycle strategies for retention of key staff, succession planning for key positions, long-term hiring of new staff, replenishment of workforce losses due to foreseeable attrition, or training of existing staff. The staffing plan also fails to specify the desired mix of government and contractor staff for the program. As we reported in 2005, the Chief Information Officer planned, at that time, to hire a contractor with human capital expertise to help identify gaps between existing skills and abilities and those needed to successfully modernize the bureau’s entire IT organization. In commenting on a draft of this report, the CIO stated that, in July 2005, he began a three-phase strategic human capital planning initiative, the purpose of which is to provide the CIO with the means to meet the bureau’s IT human capital needs for the 21st century. The three phases are (1) development of a competency model and an inventory of existing staff knowledge and skills, (2) an analysis of gaps between staff needs and existing capabilities, and (3) development and implementation of strategies to fill critical gaps. The FBI reports that they are close to completing the first phase, but that much work remains to be done. At the same time, the Sentinel program is well under way. Moreover, while the CIO stated that the Sentinel staffing plan will dovetail with this three-phase initiative, program officials told us that it was not clear to them how, or whether, the program’s staffing efforts were aligned with or part of other human capital efforts under way at the bureau. Nevertheless, program officials told us that they do not see a need to change their approach to managing Sentinel human capital because they believe that the approach used to initially staff-up the program office had served them well. Officials told us they will reassess their human capital needs for future phases of the project to ensure the right complement of staff and skills mix is available for each phase. In addition, they said that the bureau’s life cycle management policies and procedures do not require such a strategic approach to managing human capital for IT programs. Our analysis of the bureau’s system life cycle management directive and program management handbook confirmed that they do not contain policies, procedures, or guidance for doing so. In our view, not addressing Sentinel human capital more strategically and proactively increases the risk of not delivering required system capabilities and expected mission value on time and within budget. Risk management is a continuous, forward-looking process that is intended either to prevent program cost, schedule, and performance problems from occurring or to minimize the impact if problems do occur by proactively identifying risks, implementing risk mitigation strategies, and measuring and disclosing progress in doing so. To its credit, the FBI has established a risk management process for Sentinel that includes a risk management plan and an inventory of risks that are to be proactively managed to mitigate the probability of their occurring and their impacts if they do occur. However, this risk inventory does not include any human capital-related risks. According to program officials, the inventory does not include human capital risks because they do not see a need to include them. Available Sentinel program documentation and other statements by program officials, however, suggest otherwise. For instance, the Sentinel staffing plan states that adequate staffing is a critical factor in the program office’s ability to successfully execute its responsibilities, and that staff recruitment will be a difficult challenge given the competition for skilled IT professionals with security clearances in the Washington Metropolitan Area. Moreover, the FBI’s fiscal year 2007 budget submission for Sentinel (Exhibit 300) identifies the availability of human capital for the prime contractor as a program risk, and in commenting on a draft of this report, the CIO stated that human capital risks exist. In addition, officials identified various hiring challenges, such as that two-thirds of applicants fail the bureau’s security screening process and that the time it takes to execute the hiring process can be lengthy. Moreover, they said that they will face on-going hiring issues due to attrition and staff rotations. For instance, several contractor staff had recently left the program—although the CIO said that this was normal attrition—and the bureau filled the positions within 30 days. Also, 4 of the program office’s 19 government staff are on temporary duty and will rotate to other tours of duty, including the program manager, whose 2-year detail at the FBI expires in 2007 (although the possibility exists for a one-year extension). In our view, not identifying human capital as a program risk and managing it as such on a major IT program like Sentinel increases the chances that promised system capabilities and benefits will not be delivered on time and within budget. The success of any IT program depends on effectively leveraging people, processes, and tools to achieve defined outcomes and results. To effectively leverage people, they must be treated as strategic assets and managed as such. Notwithstanding the FBI’s considerable efforts to quickly staff-up the Sentinel program office, it has not adopted the kind of strategic management approach needed to effectively leverage Sentinel human capital throughout the life of the program, in part because the FBI’s IT program management policies and procedures do not require it. Moreover, the program’s risk management inventory does not include the availability of Sentinel human capital, and thus it is not recognized and managed as a serious program risk. Given the pressing need to deliver mission-critical investigative and intelligence IT support to FBI agents and analysts and the importance of strategic human capital management to programs like Sentinel, it is essential that this program risk be proactively mitigated. Unless the FBI adopts a more strategic and proactive approach to managing Sentinel human capital and treats it as a program risk, the chances of the program delivering required intelligence and investigative capabilities and mission value in a timely and cost effective manner are diminished. To strengthen the FBI’s management of its Sentinel program and to better ensure that the program delivers required capabilities and expected benefits on time and within budget, we make the following two recommendations: The FBI Director should have the bureau’s CIO establish IT program management policies and procedures for strategically managing IT programs’ human capital needs and ensure that these policies and procedures are fully implemented on all major IT programs, including Sentinel. The FBI Director should have the CIO treat and manage both Sentinel program office and prime contractor human capital availability as program risks and periodically report to the Director on the status and results of efforts to mitigate these risks. In written comments on a draft of this report signed by the CIO and reprinted in appendix II, the FBI agreed with our recommendations and stated that while progress has been made to lay a foundation for improved IT human capital management across the bureau, much work remains. In this regard, the FBI described steps completed, under way, and planned relative to managing human capital on the Sentinel program and across the FBI IT organization. For instance, the FBI stated that the CIO’s office invested 3 months in developing a staffing plan for Sentinel that analyzed staffing needs in light of lessons learned from other IT projects, analyzed resumes of both government and contactor staff, and used contractor staff until government staff could replace them. In addition, FBI stated that it has initiated Project Management Professional certification and training efforts and begun a strategic human capital planning initiative that is to provide a repeatable and strategic approach to managing IT human capital resources across its IT organization. We support these steps as they are consistent with our findings and recommendations. The bureau also provided other technical comments and updated information, which we have incorporated, as appropriate, in the report. We are sending copies of this report to the Chairman and Vice Chairman of the Senate Select Committee on Intelligence and the Ranking Minority Member of the House Permanent Select Committee on Intelligence, as well as to the Chairman and Ranking Minority Member of the Senate Committee on the Judiciary, the Chairman of the Senate Committee on Appropriations Subcommittee on Commerce, Justice, Science, and Related Agencies, and the Chairman and Ranking Member of the House Committee on Appropriations, Subcommittee on Science, the Departments of State, Justice, and Commerce, and Related Agencies. We are also sending copies to the Attorney General; the Director, FBI; the Director, Office of Management and Budget; and other interested parties. In addition, the report will also be available without charge on GAO’s Web site at http://www.gao.gov. Should you have any questions about matters discussed in this report, please contact me at (202) 512-3439 or by e-mail at hiter@gao.gov. Contact points for our Office of Congressional Relations and Public Affairs Office may be found on the last page of this report. Key contributors to this report are listed in appendix II. Our objective was to determine whether the Federal Bureau of Investigation (FBI) has adequately provided for the human capital needs of its Sentinel program. To address our objective, we focused on three areas: FBI’s efforts to date in staffing the Sentinel program office, the bureau’s plans to address gaps between the program’s human capital needs and existing FBI capabilities, and the extent to which FBI is proactively treating and managing human capital as a program risk. To evaluate whether the FBI is adequately providing for the Sentinel program’s human capital needs, we compared the bureau’s efforts against relevant criteria and best practices, including our own framework for strategic human capital management. These criteria promote the use of data to determine key performance objectives and goals in identifying current and future human capital needs, including the appropriate number of employees, the key competencies and skills mix for mission accomplishment, and the appropriate deployment of staff across the organization. They also advocate strategies for identifying and filling human capital gaps and performing succession planning, as well as being the basis for efforts intended to mitigate human capital-related program risks. To accomplish these steps, we requested key staffing-related documents from the FBI, including (1) the organization chart for the Sentinel program office, including filled positions and vacancies and the source of the resources filling those positions (i.e., internal FBI, contractors, outside hires); (2) FBI’s assessment of workforce needs—including positions, roles and responsibilities, and core competencies—to adequately perform system acquisition activities (i.e., configuration management, organizational change management, risk management, contractor tracking and oversight, and solicitation); (3) a current skills inventory and identification of gaps and shortfalls in human capital available to meet workforce needs and plans to address these shortfalls; and (4) FBI’s inventory of program risks, including risks associated with human capital or workforce planning. In addition, we reviewed the number and mix of contractor and government positions needed to staff the Sentinel program office and analyzed where the FBI stands in filling these positions. We reviewed the evidence provided, including FBI’s Life Cycle Management Directive Version 3.0 and the FBI Project Management Handbook Version 1.0, and compared it to our criteria to determine if the bureau’s plans and efforts to date comport with best practices and relevant guidance. Further, and in order to verify our analyses, we interviewed appropriate FBI officials and Sentinel program office personnel. We performed our work at FBI headquarters in Washington, D.C., from September 2005 through July 2006 in accordance with generally accepted government auditing standards. In addition to the contact named above, the following people made key contributions to this report: Paula Moore, Assistant Director; JC Ceaser; Neil Doherty; Nancy Glover; Dan Gordon; Kevin Walsh; and Kim Zelonis.

Summary: The Federal Bureau of Investigation (FBI) recently began a 6-year, $425 million program called Sentinel to replace and expand on both its failed Virtual Case File (VCF) project and its antiquated, paper-based, legacy system for supporting mission-critical intelligence analysis and investigative case management activities. Because of the FBI's experience with VCF and the importance of Sentinel, GAO was requested to address a number of program management issues associated with acquiring Sentinel via a prime development contractor. This report focuses on one of these issues: whether the FBI is adequately providing for the program's human capital needs. The findings are based on GAO's review of relevant program documentation, interviews with program officials, and human capital management guidance. To its credit, the FBI has moved quickly to staff its Sentinel program office. During the last year, it created a staffing plan for Sentinel, which defines the positions needed for the program, and it has filled most of the positions in the plan, primarily by using contract staff (77 percent). However, a few key program management positions remain to be filled. More importantly, the Sentinel staffing plan addresses only the program office's immediate staffing needs. It does not provide for the kind of strategic human capital management focus that GAO's research and evaluations have shown to be essential to the success of any organizational entity. For example, the staffing plan was not derived using a documented, data-driven methodology and does not provide for inventorying the knowledge and skills of existing staff, forecasting future knowledge and skill needs, analyzing gaps in capabilities between the existing staff and future workforce needs, (including consideration of expected succession needs), and formulating strategies for filling expected gaps. Exacerbating this situation is that the FBI is not proactively managing Sentinel human capital availability as a program risk; it has not included human capital in the program's risk inventory nor has it developed and implemented a proactive risk mitigation strategy, even though program documents cite human capital as both a challenge and a risk. According to program officials, they plan to manage their human capital needs in the same way as when they initially staffed the program office, in part because the bureau's IT system life cycle management policies and procedures do not require them to do otherwise. Unless the FBI adopts a more strategic approach to managing human capital for the Sentinel program and treats human capital as a program risk, the chances of delivering required intelligence and investigative support capabilities in a timely and cost-effective manner are reduced.