When one steps back and collectively evaluates how the government has traditionally managed and acquired information technology, some conclusions are painfully obvious. On the whole, the federal government’s track record in delivering high value information technology solutions at acceptable cost is not a good one. Put simply, the government continues to expend money on systems projects that far exceed their expected costs and yield questionable benefits to mission improvements. Familiar examples, such as the Federal Aviation Administration’s Air Traffic Control modernization and the Internal Revenue Service’s Tax Systems Modernization projects serve as stark reminders of situations where literally billions of dollars have been spent without clear results. Moreover, agencies have failed to take full advantage of IT by failing to first critically examine and then reengineer existing business and program delivery processes. Federal agencies lack adequate processes and reliable data to manage investments in information technology. Without these key components, agencies cannot adequately select and control their technology investments. As GAO’s financial and information management audits have demonstrated over the last decade, it is sometimes impossible to track precisely what agency IT dollars have actually been spent for or even how much has been spent. Even more problematic, rarely do agencies collect information on actual benefits to the organization accruing from their investments. More often than not, results are presented as descriptions of outputs and activities rather than changes in performance or program outcomes. How should the Congress expect this scenario to change once agencies take steps to implement ITMRA? In 5 to 7 years, the Congress should have a much clearer, confident understanding of the benefits to agencies’ performance that are attributable to IT expenditures. On a governmentwide basis, there should be higher overall success rates for IT projects completed within reasonable time frames, at acceptable costs, with positive net rates of return on investment. Modular, well-defined IT projects with short-term deliverables should be the rule rather than the exception. And institutionalized, up-to-date management processes should be producing consistent high-value investment decisions and results. Mr Chairman, ITMRA also has to reinforce and be reinforced by other important management reform legislation. Just as technology is most effective when it supports defined business needs and objectives, ITMRA will be more powerful if it can be integrated with the objectives of broader governmentwide management reforms. For example, changes made by the Federal Acquisition Reform Act (FARA) and the Federal Acquisition Streamlining Act (FASA) are focused on removing barriers to agencies obtaining products and services from outside sources in a timely, efficient manner. This is crucial in the technology arena where significant changes occur very rapidly. ITMRA builds in essential investment and performance ingredients that empower agencies to make wiser, not just faster, acquisitions of IT products and services. The Paperwork Reduction Act (PRA) emphasizes the need for an overall information resources management strategic planning framework, with IT decisions linked directly to mission needs and priorities. And, the act also focuses on reducing unnecessary information requirements on industry and citizens. ITMRA can work in concert with PRA by making sure that agencies understand what information is needed, the purpose it is being used for, and ensure it is collected once and shared many times. The CFO Act requires sound financial management practices and systems to be in place essential for tracking program costs and expenditures. ITMRA based-approaches to managing information systems should have a direct, positive impact on the creation of financial systems to support the higher levels of accountability envisioned by the act. GPRA focuses attention on defining mission goals and objectives, measuring and evaluating performance, and reporting on results. Budgets based on performance information provided under GPRA should include clear treatment of IT capital expenditures and its impact on agency operations. Similarly, ITMRA effectively supports GPRA by requiring that performance measures be used to indicate how technology effectively supports mission goals, objectives, and outcomes. Past experiences with other governmentwide reforms—such as the CFO Act, the National Performance Review (NPR), the Paperwork Reduction Act, and GPRA—indicate that implementation requires a significant investment of time at senior levels. Our own experiences in assisting agencies with self-assessments of their strategic information management practices have illustrated the many barriers that must be overcome. To date, our evaluation approach—which involves all levels and types of management—has been used in at least 10 agencies. In every case, it has taken considerable management time, talent, and resources to analyze organizational management strengths and weaknesses and then put corrective action plans in place. From the past, we know that the early days following the passage of reform legislation are telling. The level of governmentwide interest, discussion, and senior management involvement in planning for and directing change all indicate whether a “wait and see” approach versus a “get ready to meet the test” approach is being taken. During this period, consistent oversight leadership, coordination, and clear guidance from the Office of Management and Budget (OMB) is essential to getting agency implementation off to a constructive start. Without common direction and constancy of purpose from OMB, GAO, and the Inspectors General, agency executives are left reacting and responding to advice and directives that may be at cross purposes. It is also important that implementation actions focus on not only the means (i.e., policies, practices, and process) but also end results that are expected from the management reforms. For ITMRA to be successful, improved management processes and practices that focus on capital investment and planning, reengineering, and performance measurement are essential. But these are only the means to achieve the legislation’s ultimate goal—implementing high-value technology projects at acceptable costs within reasonable time frames that are contributing to tangible, observable improvements in mission performance. Continuous oversight from the Congress that focuses on these issues and strong support from the Administration are an essential incentives for keeping agency management accountable and focused on changes necessary to ensure more successful outcomes. The pilot efforts being conducted under GPRA also illustrate that outcome and performance-based decision-making will not be an easy, quick transition for federal agencies. Performance reports provided to the Congress under both GPRA and now ITMRA should become one of Congress’s major mechanisms for evaluating and ensuring agency accountability. A flurry of activity is underway across the government to implement new management processes required by ITMRA. To its credit, OMB—under the direction of the Deputy Director for Management—has taken a leadership role in organizing and focusing interagency discussions on changes needed to existing policy and executive guidance. Let me briefly summarize some of the major activities now underway. Several policy directives and guidance are being created or revised by OMB to reflect changes required by ITMRA. These include a draft Executive Order on Federal Information Technology which is currently with the President for review and signature. This order will officially create a governmentwide Chief Information Officers Council, composed of agency CIOs and Deputy CIOs and chaired by OMB’s Deputy Director for Management, to provide recommendations to OMB on governmentwide IT policies, procedures, and standards; the Government Information Technology Services Board, staffed by agency personnel, to oversee the continued implementation of the NPR IT recommendations and to identify and promote the development of innovative technologies, standards, and practices; and the Information Technology Resources Board, staffed by agency personnel and used to review, at OMB’s or an agency’s request, an information systems development or acquisition project and provide recommendations as appropriate. In addition, revisions are being made to two important OMB management and budget circulars. Circular A-130, Management of Federal Information Resources, is being changed to include the capital planning and portfolio management requirements of ITMRA. Circular A-11, Preparation and Submission of Budget Estimates, is expected to provide additional information on capital planning, including a new supplement on planning, budgeting, and acquiring fixed assets. Further, an estimated 90 percent of GSA’s Federal Information Resources Management Regulation is expected to be eliminated in response to ITMRA. The remaining segments are expected to be issued as parts of the Federal Acquisition Regulation, the Federal Property Management Regulation, or OMB guidance. The OMB IT Investment Guide, issued last November, establishes key elements of the investment process for agencies to follow in selecting, controlling, and evaluating their IT investments. This process will be used in the fiscal year 1998 budget submission cycle. The Investment Guide has been circulated among agency heads, CFOs, and senior IRM officials. In addition, OMB has made copies available to each of its five Resource Management Offices responsible for reviewing agency management, budget, and policy issues. OMB has also organized an interagency CIO Working Group—comprised of the existing senior IRM officials from the major agencies and departments—to assist in developing the policies, guidance, and information needed to effectively implement ITMRA. This working group has been very active, meeting once a month since January. The working group has created several interagency subcommittees that have been working to provide suggestions to OMB on changes needed in governmentwide policies and executive guidance to effectively implement ITMRA. Among these subcommittees are the CIO Subcommittee, which developed a paper on the appointment, placement alternatives, and roles and responsibilities of an agency’s CIO; the CIO Charter Workgroup, which developed the proposed charter for the CIO Council; and the Capital Planning and Investment Subcommittee, which has discussed potential approaches to IT capital planning processes and is working on a proposal for pilot testing new processes at several agencies. Because many of these activities are still underway, it is impossible to make conclusions about them at this time. However, taken as a whole, they send several positive signals. In each, OMB has played a proactive leadership role while remaining flexible enough to adapt to individual agency situations and needs. In general, although the depth and impact are uncertain, the direction of the guidance is consistent with ITMRA. First, it is clear that the federal IRM/IT community is widely represented and involved in these efforts. Rather than being the recipients of policy changes, agency officials are actively engaged in helping formulate new guidance and standards. For example, the interagency working groups that have been assembled to provide input on the CIO position and capital planning and investment processes have representation from numerous departments and agencies. Second, initial steps are being taken to emphasize the importance of selecting qualified CIO candidates who are being strategically placed with defined roles and responsibilities within the agencies. OMB has asked that before the major departments and agencies establish and fill these positions they formally submit information on (1) the CIO’s background and experience, (2) a description of the organizational placement of the CIO position, including reporting arrangements to the agency head and organizational resources expected to be under the control of the position, and (3) a description of the CIO’s authority and responsibilities. OMB expects to conduct discussions with agencies should it have concerns that the intent of the legislation is not being fulfilled. OMB has also responded formally to selected agencies where objections were raised about the CIO position. Third, recognizing the governmentwide shortage of highly skilled managerial and technical talent, several mechanisms are being established to help leverage IT skills and resources across agencies. Establishing the Information Technology Resources Board, the CIO Council, and Government Information Technology Service Board all demonstrate a recognition of the need to channel experienced management and technical resources towards significant problem or opportunity areas, particularly large, complex systems development or modernization projects that show early warning signs related to cost, schedule, risk, or performance. Fourth, a governmentwide implementation focus is being maintained. Especially noteworthy is the broad-based level of support and interaction covering IT issues that transcend specific agency lines. The Government Information Technology Services Working Group (GITS) serves as an excellent example of what can be achieved through interagency cooperation. In implementing many of the IT-related recommendations of the National Performance Review, GITS has effectively promoted electronic sharing of information across agency lines and to citizens. Fifth, special attention is being paid to core requirements of the legislation—establishing CIOs and improving IT capital planning and investment. These two provisions are directly aimed at strengthening pervasive management weaknesses we find in most federal agencies: (1) getting top executives to determine how major technology projects are intended to improve business goals and objectives, (2) getting program managers to take ownership of IT projects and holding them accountable for the project’s success, and (3) institutionalizing repeatable processes aimed at scrutinizing project costs and risks against delivered benefits. OMB, in considering revisions to existing management and budget circulars, has recognized the need to better integrate and consolidate existing agency guidance in order to improve its own oversight and alleviate imposing unnecessary reporting burdens on the agencies. The Deputy Director for Management convened a special working group to revise OMB’s current management bulletin on agency budgeting and planning for fixed capital assets, which includes major information systems acquisitions. The revised guidance is being made a supplement to OMB’s Circular A-11, the primary budget preparation guidance for federal agencies. In addition, OMB has drafted changes to Circular A-130 to be compatible with ITMRA, including the requirement that agencies develop consistent decision criteria that allow IT investments to be prioritized based on costs, benefits, and risks. ITMRA implementation activities, taken as a whole, indicate a willingness among agency officials and OMB to meet their responsibilities and expectations under the act. Nevertheless, we see critical challenges in five specific areas. Without addressing these challenges and additional effort to solidify current initiatives, implementation will be at risk early on. Let me briefly discuss each. Our observations of the implementation activities leads us to conclude that much of the involvement within federal agencies is heavily tilted towards IT and IRM officials and does not include top senior officials. Most of the interagency working groups come exclusively from IRM and strategic planning offices. Yet, our research of leading public and private organizations clearly demonstrates that strong leadership, commitment, and involvement in capital planning, investment control, and performance management must come from the executives who will actually use the information from these processes to make decisions. Although there has been communication with the President’s Management Council about ITMRA requirements, it is unclear how seriously this reform is being taken by senior agency management. Many of the agencies’ actions to date in contemplating CIO appointments do not reflect a full understanding of either the letter or the intent of the legislation. The CIO position under ITMRA seeks a strong, independent, experienced, executive-level individual who can focus senior management attention on critical information management issues and decisions. Yet, some individuals being considered lack clear track records and adequate business or technical experience. In other cases, the placement of the CIO is at a lower management level than what the legislation intended. According to information from OMB, 13 of the 27 largest departments and agencies have named CIOs. It is our understanding that three of these agencies have been advised by OMB that their CIO positions meet the requirements of the law. Our own review of the information being submitted to OMB by agencies indicates that the breadth of experience varies widely among the individuals being considered for the position. Signals coming from the Administration need to be strong, clear, and more consistent on the importance, placement, and skills associated with the position. In addition, four agencies have provided information to OMB indicating a desire to integrate the functions of the Chief Financial Officer with the Chief Information Officer. Mr. Chairman, as you have noted in your public statements, this was not the intention of the legislation. Moreover, a task force report recently submitted to OMB from the Industry Advisory Council argues strongly against combining the two positions. The CIO was created to give an executive-level focus and accountability for information technology issues and ensure greater accountability for delivering effective technology systems and services. In light of the existing problems in most agencies and the significant duties and responsibilities under each act, agencies would be best served by keeping the two positions separate. The problems associated with financial and information management in most federal agencies are very significant and require attention from separate individuals with the appropriate talent, skills, and experience in each area. Critical, sustained, high-level attention is needed on new skills in government that are essential to proposing, designing, building, and overseeing complex information systems. Recruitment efforts and strategies need to be established and retention of existing skilled staff reexamined. The magnitude of the challenges facing federal agencies in the IT area demand more talent than currently exists. Although one subcommittee of the interagency CIO Working Group has been created to examine this issue, it has not yet been given the attention it deserves. One area of particular concern is how the legislation is to be implemented at the department level versus their major subcomponents, namely agencies and bureaus. To date, neither the federal agencies or OMB have determined how newly required investment control processes, IT performance management, or IT strategic planning will be differentiated by organizational tiers within government entities. Additionally, it remains unclear how OMB’s own internal ITMRA implementation responsibilities will be strengthened. Although we have not yet fully evaluated OMB’s efforts, there appears to be insufficient attention to preparation for the oversight and evaluation of agencies’ IT capital planning and investment processes. OMB has yet to explicitly define as part of its own ITMRA implementation strategy how it expects to fulfill its responsibilities for (1) evaluating agency IT results, (2) ensuring capital planning and investment control processes are in place, (3) using accurate and reliable cost, benefit and risk data for IT investment decision-making, and (4) linking the quality and completeness of agency IT portfolio analyses to actual budget recommendations to the President. With the phasing out of GSA’s Time Out program—designed to get problem-plagued systems acquisition projects back on track and force improvements in agency IT management processes—the weight placed on OMB’s oversight responsibility has further increased. Under the OMB 2000 reorganization, program examiners in OMB’s Resource Management Offices will have primary responsibility for evaluating agency IT budget proposals and evaluating the implementation of governmentwide IRM policies. It remains unclear how OMB expects to train these examiners to evaluate the IT portfolios of the agencies over which they have oversight responsibility. Mr. Chairman, we will soon be issuing a report to you and Chairman Clinger of the House Committee on Government Reform and Oversight that specifically focuses on IT investment decision-making in five case study agencies. Our findings highlight important shortcomings in these agencies’ capabilities to meet the expectations of ITMRA’s investment control provisions. Based on this work, we will outline specific recommendations to OMB for ways it can improve its oversight role in this area. ITMRA embraces an entire set of comprehensive management reforms to IT decision-making. These parallel the set of strategic information management best practices we recommended in our May 1994 report, Executive Guide: Improving Mission Performance Through Strategic Information Management and Technology—Learning From Leading Organizations. As we have learned from our research of leading private and public organizations, long-term, repeatable improvements in managing IT are most successful when a complete set of information management practices are conducted in concert with each other. While much attention has been focused on the capital planning and the CIO provisions of ITMRA, equally intensive agency attention to other areas (e.g., strategic planning, business process reengineering, performance measurement, and knowledge and skills development) is also essential. Within a short period of time, efforts should begin to marshall agency attention to these key areas. Mr. Chairman, time is of the essence in order to meet congressional expectations that agencies begin acquiring and managing IT according to the approaches outlined in ITMRA. Agencies should be taking short- and long-term actions to change management processes to comply with the legislative requirements and intent. In overseeing the implementation of ITMRA, we suggest that congressional oversight in the short term focus on assessing critical agency actions in four areas that have direct bearing on the ultimate success of the law in producing real, positive change: Closely monitor the caliber and organizational placement of CIO candidates for departments and agencies. Past experience with the initial selection of CFOs in the federal government indicates that the rush to fill the position may take precedence over careful deliberation over choosing the right person. The caliber of the individuals placed in these slots can make a real difference in the likelihood of lasting management changes. This has been demonstrated through the success of the CFO Act. After some initial problems, well-qualified individuals were selected for these positions. Early signs of success will be the establishment of a pool of high-caliber CIOs who can effectively support agency heads on IT issues at appropriations and oversight hearings. However, an early warning sign of failure will be if individuals are elevated or reassigned within their organizations with little regard to qualifications, experience, or skill. Focus on the evaluation of results. The Congress must continually ask agency heads for hard numbers and facts on what was spent on information technology and what the agency got in return for the investment. These evaluations, wherever possible, must focus on information technology’s contribution to measurable improvements in mission performance. Improvements in productivity, quality and speed of service delivery, customer satisfaction, and cost savings are common areas where technology’s impact can be most immediate. Early signs of success will be examples of measurable impact or where high-risk IT projects with questionable results are stopped or delayed as a result of IT investment control processes. Early signs of failure will be examples where high-risk, low-return projects continue to be funded despite claims of management process changes. Monitor how well agencies are institutionalizing processes and regularly validating cost, return, and risk data used to support IT investment decisions. Informed management decisions can only occur if accurate, reliable, and up-to-date information is included in the decision-making process. Project cost data must be tracked and easily accessible. Benefits must be defined and measured in outcome-oriented terms. And risks must be quantified and mitigated to better ensure project success. Early signs of success will be agency examples where IT contributions to productivity gains, cost reductions, cycle-time reductions, and increases in service delivery quality and satisfaction are quantitatively documented and independently reported. Get the right people asking and answering the right questions. Throughout the budget, appropriations, and oversight processes, top agency executives, OMB program examiners, and members of the Congress must consistently ask what was spent, what was achieved, and was it worth it. Agency heads must be able to clearly answer these questions for their IT capital expenditures. Mr. Chairman, the success or failure of this critical legislative reform will have far reaching impact. Rising public expectations for improved service and the need to improve the efficiency of federal operations to support needed budget reductions all depend on wise investments in modern information technology. We look forward to working with this committee to make ITMRA a success and appreciate your leadership in spearheading this effort. That concludes my statement Mr. Chairman. I would be happy to answer any questions you or other members of the Subcommittee may have at this time. The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 6015 Gaithersburg, MD 20884-6015 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (301) 258-4066, or TDD (301) 413-0006. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.

Summary: GAO discussed the implementation of the Information Technology (IT) Management Reform Act (ITMRA). GAO noted that: (1) federal agencies have failed to reengineer their business and program delivery processes before acquiring new information systems, which results in costly IT resources; (2) ITMRA should empower federal agencies to make wise acquisitions of IT products and services; (3) lessons learned from other governmentwide management reforms indicate the need for senior management involvement, consistent oversight and leadership from the Office of Management and Budget (OMB), and a focus on capital investment and planning, reengineering, and performance measurement; (4) OMB has organized interagency discussions on needed policy and guidance changes and issued guidance on selecting, controlling, and evaluating agencies' IT investments; (5) OMB has established an interagency Chief Information Officers (CIO) working group to assist in developing policies, guidance, and information needed for effective ITMRA implementation; (6) the Administration is ensuring that CIO candidates are qualified and given sufficient authority and responsibility and that core legislative requirements are met; (7) challenges to ITMRA implementation include involving top agency management, consistently directing CIO appointments and organizational placement, building new IT skills, focusing on internal implementation at the department-level, and continually emphasizing an integrated management approach; and (8) congressional support and oversight is essential to ensuring successful implementation of ITMRA.