The tax administration system that collects about $2 trillion in revenues each year is critically dependent on a collection of obsolete computer systems developed by the IRS over the last 40 years. IRS envisions a future in which its tax processing environment will be virtually paper-free, and up-to-date taxpayer information will be readily available to IRS employees to respond to taxpayer inquiries. To accomplish this, IRS embarked on its ambitious BSM program. BSM involves the development and delivery of a number of modernized business, data, and core infrastructure projects that are intended to provide improved and expanded service to taxpayers as well as IRS internal business efficiencies. Recognizing the long-term commitment needed to solve the problem of obsolete computer systems, Congress set up a special BSM account in fiscal year 1998 to fund IRS’s systems modernization efforts. IRS initiated CADE as part of BSM, to modernize the agency’s outdated and inefficient data management system. IRS also sees this project as the corporate data source enabling future customer service and financial management applications. CADE is therefore IRS’s linchpin modernization project. In light of the projects that depend on CADE, as well as the many interrelationships that are to exist among CADE and IRS’s modernized applications and among CADE and current IRS applications, the agency must manage this critical project effectively. Without CADE, the business systems modernization program cannot succeed. IRS’s attempts to modernize its aging computer systems span several decades. This long history of continuing delays and design difficulties led to our designating IRS’s Tax Systems Modernization program, BSM’s predecessor, as a high-risk area in 1995. During the mid-1990s we reported on several technical and management weaknesses associated with Tax Systems Modernization, a program that began in the 1980s. These weaknesses related to incomplete or inadequate strategic information management practices; immature software development capability; incomplete systems architecture, integration planning, system testing, and test planning practices; and the lack of an effective organizational structure to consistently manage and control systems modernization organizationwide. We made a series of recommendations for correcting these weaknesses and limiting modernization activities until they were corrected. IRS subsequently discontinued the program after the agency had spent about $4 billion without receiving expected benefits. In fiscal year 1999, IRS launched the BSM program. IRS contracted with CSC as its prime systems integration services contractor for systems modernization, helping it design new systems and identify other contractors to develop software and perform other tasks. In our reviews of IRS’s BSM expenditure plans, we have identified numerous deficiencies in the BSM program, including a continuation of the weaknesses noted above. Also, a consistent challenge for IRS has been to make sure that the pace of systems acquisition projects does not exceed the agency’s ability to manage them. In May and November 2000, we reported that projects were in fact getting ahead of the modernization management capacity that needed to be in place to manage them effectively. In February 2002 we reported that such an imbalance was due to IRS’s first priority and emphasis being on getting the newer, more modern systems—with their anticipated benefits to taxpayers—up and running. In so doing, however, management controls had not been given equal attention and thus had not kept pace. This emphasis on new systems added significant cost, schedule, and performance risks that escalate as a program advances. Moreover, these risks increased as IRS moved forward because of interdependencies among projects, and the complexity of associated workload activities to be performed increased dramatically as more systems projects were built and deployed. In addition, we identified other deficiencies in the BSM program, including the need to establish processes that meet the level 2 requirements of the SEI’s Software Acquisition Capability Maturity Model, and to improve modernization management controls and capabilities, such as those related to configuration management, risk management, enterprise architecture implementation, human capital strategic management, integrated program scheduling, and cost and schedule estimating. In response to our recommendations, IRS has made important progress. First, significant progress has been made in establishing the modernization management controls needed to effectively acquire and implement information technology systems. For example, IRS has invested incrementally in its modernization projects; defined a systems life cycle management methodology, which IRS refers to as the Enterprise Life Cycle; developed and is using a modernization blueprint, commonly called an enterprise architecture, to guide and constrain its modernization projects; and established processes that meet the level 2 requirements of the SEI’s Software Acquisition Capability Maturity Model. Second, IRS has made progress in establishing the infrastructure systems on which future business applications will run. For example, IRS has delivered elements of the Security and Technology Infrastructure Release to provide the hardware, software, and security solutions for modernization projects. IRS has also built an enterprise integration and test environment that provides the environment and tools for multiple vendors associated with a release to perform integration and testing activities. Third, it has delivered certain business applications that are producing benefits today. These applications include Customer Communications 2001, to improve telephone call management, call routing, and customer self-service applications; Customer Relationship Management Examination, to provide off-the- shelf software to IRS revenue agents to allow them to accurately compute complex corporate transactions; and Internet Refund/Fact of Filing, to improve customer self-service by providing to taxpayers via the Internet instant refund status information and instructions for resolving refund problems. Fourth, IRS took steps to align the pace of the program with the maturity of IRS’s controls and management capacity, including reassessing its portfolio of planned projects. Nevertheless, IRS continued to face challenges to fully develop and implement its modernization management capacity. Last June we reported that IRS had not yet fully implemented a strategic approach to ensuring that it has sufficient human capital resources for implementing BSM, nor had it fully implemented management controls in such areas as configuration management, estimating costs and schedules, and employing performance-based contracting methods. We made several recommendations to address those issues. Our analysis has shown that weak management controls contributed directly to the cost, schedule, and/or performance shortfalls experienced by most projects. Given that the tasks associated with those projects that are moving beyond design and into development are by their nature more complex and risky and that IRS’s fiscal year 2004 BSM expenditure plan supports progress toward the later phases of key projects and continued development of other projects, systems modernization projects likely will encounter additional cost and schedule shortfalls. IRS will need to continue to assess the balance between the pace of the program and the agency’s ability to manage it. Based on IRS’s expenditure plans, BSM projects have consistently cost more and taken longer to complete than originally estimated. Table 1 shows the life cycle variance in cost and schedule estimates for completed and ongoing BSM projects. These variances are based on a comparison of IRS’s initial and revised cost and schedule estimates to complete initial operation or full deployment of the projects. As the table indicates, the cost and schedule estimates for full deployment of the e-Services project have increased by just over $86 million and 18 months, respectively. In addition, the estimated cost for the full deployment of CADE release 1 has increased by almost $37 million, and project completion has been delayed by 30 months. In addition to the modernization management control deficiencies discussed above, our work has shown that the increases and delays were caused, in part, by inadequate definitions of systems requirements. As a result, additional requirements have been incorporated into ongoing projects. increases in project scope. For example, the e-Services project has changed significantly since the original design. The scope was broadened by IRS to provide additional benefits to internal and external customers. cost and schedule estimating deficiencies. IRS has lacked the capability to effectively develop reliable cost and schedule estimates. underestimating project complexity. This factor has contributed directly to the significant delays in the CADE release 1 schedule. competing demands of projects for test facilities. Testing infrastructure capacity is insufficient to accommodate multiple projects when testing schedules overlap. project interdependencies. Delays with one project have had a cascading effect and have caused delays in related projects. These schedule delays and cost overruns impair IRS’s ability to make appropriate decisions about investing in new projects, delay delivery of benefits to taxpayers, and postpone resolution of material weaknesses affecting other program areas. Producing reliable estimates of expected costs and schedules is essential to determining a project’s cost-effectiveness. In addition, it is critical for budgeting, management, and oversight. Without this information, the likelihood of poor investment decisions is increased. Schedule slippages delay the provision of modernized systems’ direct benefits to the public. For example, slippages in CADE will delay IRS’s ability to provide faster refunds and respond to taxpayer inquiries on a timely basis. Delays in the delivery of modernized systems also affect the remediation of material internal management weaknesses. For example, IRS has reported a material weakness associated with the design of the master files. CADE is to build the modernized database foundation that will replace the master files. Continuing schedule delays will place resolution of this material weakness further out into the future. In addition, the Custodial Accounting Project is intended to address a financial material weakness and permit the tracking from submission to disbursement of all revenues received from individual taxpayers. This release has yet to be implemented, and a revised schedule has not yet been determined. Finally, the Integrated Financial System is intended to address financial management weaknesses. When IRS submitted its fiscal year 2003 BSM expenditure plan, release 1 of the Integrated Financial System was scheduled for delivery on October 1, 2003. However, it has yet to be implemented, and additional cost increases are expected. Given the continued cost overruns and schedule delays experienced by these BSM projects, IRS and CSC launched internal and independent assessments during 2003 of the health of BSM as whole, as well as CADE. Table 2 describes these assessments. The IRS root cause analysis, PRIME review, and the Office of Procurement assessment revealed several significant weaknesses that have driven project cost overruns and schedule delays, and also provided a number of actionable recommendations for IRS and CSC to address the identified weaknesses and reduce the risk to BSM. Deficiencies identified are consistent with our prior findings and include low program productivity levels, ineffective integration across IRS, and insufficient applications and technology engineering. As noted, CADE release 1 has experienced significant reported cost overruns and schedule delays throughout its life cycle, and has yet to be delivered. SEI’s independent technical assessment of CADE pointed to four primary factors that have caused the project to get off track and resulted in such severe cost and schedule impairments: (1) the complexity of CADE release 1 was not fully understood; (2) the initial business rules engine effort stalled; (3) both IRS and PRIME technical and program management were ineffective in key areas, including significant breakdowns in developing and managing CADE requirements; and (4) the initially contentious relationship between IRS and PRIME hindered communications. SEI also warned that CADE runs the risk of further trouble with later releases due to unexplored/unknown requirements; security and privacy issues that have not been properly evaluated (e.g., online transactions are different from the way IRS does business today); dependence on an unproven business rules engine software product; and the critical, expensive, and lengthy business rules harvesting effort that has not yet been started. SEI offered several recommendations to address current CADE issues and reduce project risk in the future. Based on these assessments, IRS identified a total of 46 specific issues for resolution in the following six areas, and developed a BSM action plan comprising individual action plans to address each issue: Organization and Roles. Immediate steps are needed to clarify IRS/PRIME roles and responsibilities and clearly define decision- making authorities. Key Skills & Strengthening the Team. Strengthened skills and capabilities are needed in such key areas as project management and systems engineering. Technology–Architecture & Engineering. More focus is needed to improve current systems architecture integration. Technology–Software Development Productivity & Quality. Improvements in product quality and productivity are essential to strengthening software delivery performance. Acquisition. Contracting and procurement practices require major streamlining to improve overall contract management. CADE. Delivery of CADE release 1 will require aggressive focus and attention, and a business rules engine solution requires additional evaluation. These 46 issue action plans were assigned completion dates and an IRS or PRIME owner was assigned to take the lead in implementing each plan. IRS and PRIME each also assigned a senior-level executive to drive the execution of the issue action plans, identify and help mitigate implementation hindrances or roadblocks, and ensure successful completion of all planned actions. To assess the efficacy of the BSM action plan, MITRE was tasked with conducting an independent analysis and provided feedback to IRS on the effectiveness of the specific issue action plans to address the associated findings/recommendations and correct any problems found. IRS has reported making steady progress with implementing the BSM action plan. According to the IRS BSM program office, as of late January 2004, 27 of the 46 issue action plans have been completed. Examples of completed actions include (1) making business owners and program directors accountable for project success; (2) assigning teams to investigate and resolve problem areas on key projects such as CADE, the Integrated Financial System, and e-Services; (3) aligning critical engineering talent to the most critical projects; (4) increasing the frequency of CADE program reviews; and (5) issuing a firm fixed-price contracting policy. Significant further work remains to complete implementation of the remaining 19 open issue action tasks. Bain & Company—which conducted the independent review of PRIME—has been hired to facilitate the implementation of various issue action plans within the Organization and Roles challenge area, while IRS has also contracted with SEI to conduct further periodic reviews of the CADE project. Additionally, the IRS Oversight Board recently issued a report on its own independent analysis of the BSM program, which made several observations and recommendations that are consistent with those discussed here. IRS has conducted an analysis of this report to reconcile the board’s recommendations with those that are currently being addressed in the BSM action plan. As a result, IRS plans to open two additional issues and action plans to address (1) rationalizing and streamlining oversight of the BSM program, and (2) determining and maintaining a manageable portfolio of projects. IRS expects to complete the majority of the BSM action plan by end of April of this year, and fully implement any remaining open actions by the end of the calendar year. Further, during 2003, the Treasury Inspector General for Tax Administration performed several reviews related to management of the BSM program and for specific BSM projects. These reviews identified several issues, including those related to compliance with the defined management and project development processes, full implementation of disciplined project testing processes and procedures, IRS’s cost and schedule estimation process, and contract management. IRS management reaffirmed their commitment to fully implement key management and project development processes. IRS’s multibillion-dollar BSM program is critical to agency’s successful transformation of its manual, paper-intensive business operations and fulfilling its restructuring activities. The agency has made important progress in establishing long-overdue modernization management capabilities and in acquiring foundational system infrastructure and some applications that have benefited the agency and the public. However, our reviews, those of the Treasury inspector general, and the recently completed internal and independent assessments of the BSM program clearly demonstrate that significant challenges and serious risks remain. IRS acknowledges this and is acting to address them. To successfully address these challenges and risks and to modernize its systems, IRS needs to continue to strengthen BSM program management by continuing efforts to balance the scope and pace of the program with the agency’s capacity to handle the workload, and institutionalize the management processes and controls necessary to resolve the deficiencies identified by the reviews and assessments. Commitment of appropriate resources and top management attention are critical to resolving the identified deficiencies. In addition, continuing oversight by the Congress, OMB, and others, as well as ongoing independent assessments of the program, can assist IRS in strengthening the BSM program. Meeting these challenges and improving performance are essential if IRS and the PRIME contractor are to successfully deliver the BSM program and ensure that BSM does not suffer the same fate as previous IRS modernization efforts. Mr. Chairman, this concludes my statement. I would be pleased to respond to any questions that you or other members of the subcommittee may have at this time. For information about this testimony, please contact me at (202) 512-3317 or by e-mail at daceyr@gao.gov. Individuals making key contributions to this testimony include Bernard R. Anderson, Michael P. Fruitman, Timothy D. Hopkins, and Gregory C. Wilshusen. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The Internal Revenue Service (IRS) has been grappling with modernizing its computer systems for many years. IRS's current program, commonly referred to as Business Systems Modernization (BSM), began in fiscal year 1999; about $1.4 billion has been reported spent on it to date. While progress has been made, the program continues to face significant challenges and risks. In recognition of these risks, IRS and a contractor recently completed several comprehensive assessments of BSM, including one of its Customer Account Data Engine (CADE) project, which is to modernize the agency's outdated data management system. At the request of the Subcommittee on Oversight, House Committee on Ways and Means, GAO's testimony will summarize (1) GAO's prior findings and recommendations, along with those of the recent assessments; and (2) actions IRS has taken or plans to take to address these issues. Prior GAO reviews have disclosed numerous modernization management control deficiencies that have contributed to reported cost overruns and schedule delays. Costs and completion dates for ongoing projects have grown from their initial estimates. Reasons for such delays include inadequate definition of systems requirements, increases in project scope, and underestimation of project complexity. These impair IRS's ability to make future systems investment decisions and delay delivery of benefits to taxpayers. GAO has made a series of recommendations focusing on stronger program management--and limiting modernization activities until such management practices were in place. IRS has made important progress in implementing management controls, establishing infrastructure, delivering certain business applications, and balancing the pace of the program with the agency's ability to manage it. Nevertheless, IRS needs to further strengthen BSM program management, including fully implementing modernization management controls in such areas as cost and schedule estimating. The recent BSM assessments identified many weaknesses, consistent with prior GAO findings, that contributed to the cost overruns and schedule delays, and offered recommendations to address them. IRS has responded by identifying 46 discrete issues to be resolved; according to the agency, 27 of these have been completed. Commitment of appropriate resources, top management attention, and continuing oversight by Congress and others are critical to the success of BSM.