Customs’ responsibility includes (1) enforcing the laws governing the flow of goods and persons across the borders of the United States and (2) assessing and collecting duties, taxes, and fees on imported merchandise. To speed the processing of imports and improve compliance with trade laws, the Congress in 1993 enacted legislation that enabled Customs to streamline import processing through automation. The legislation also eliminated certain legislatively mandated paper requirements, allowing Customs to move from a paper-intensive to an automated import environment. Further, it required Customs to establish NCAP and specified critical functions that this program must provide, including the ability to electronically file import entries at remote locations and process drawback claims. In response to the authorizing legislation, Customs launched a major initiative in 1994 to reorganize the agency, streamline operations, and modernize the automated systems that support operations. In the process, Customs identified its core business processes as trade compliance (imports), outbound goods (exports), and passengers. In 1992, prior to redesigning its operations, Customs decided to move from centralized to distributive computing and selected a suite of hardware, software, and telecommunications products to enable it to do so. Customs refers to its effort to move to decentralized computing using these products as the Customs Distributed Computing for the Year 2000 (CDC-2000) project. The agency plans to implement ACE and its other modernized systems applications on these products. According to Customs, as of October 1, 1995, it had spent $63 million purchasing these products including upgrading its personal computers, installing local area networks, and acquiring minicomputers and related peripherals. Although no detailed analysis has been prepared, the CDC-2000 project director estimated that when completed, total purchases could reach $500 million. In January 1995, Customs hired Gartner Group Consulting Services to review the adequacy of this approach, and the contractor issued its report in April 1995. About this same time, Customs engaged another contractor—IBM Consulting Group—to determine whether the agency was technically capable of developing ACE. IBM reported its findings in February 1995. Customs’ strategy for implementing NCAP consists of three initiatives. First, Customs is redesigning the import process to better meet customer needs and improve operational efficiency and effectiveness. In doing so, the agency identified and prioritized the needs of its internal and external customers involved in import processing. Using this information, Customs determined how the new import process will work and is testing this new process at selected ports of entry. Customs plans to complete the definition of its redesigned import process by September 1997. Second, Customs is developing its new automated import processing system (ACE) applications to support the new import process and comply with NCAP-mandated functions. Customs is in the early stages of system development. Specifically, the agency has recently issued user requirements and is in the process of determining functional requirements. Customs estimates that when completed, the system will cost $125 million over its 10-year planned life. As of March 1996, Customs had spent $25 million on ACE. Customs plans to begin deploying ACE in October 1998. Finally, until ACE is deployed, Customs plans to enhance its existing import processing system—the Automated Commercial System—which operates in the existing centralized computing environment, to provide selected NCAP-mandated functions critical to meeting agency and trade community needs. For example, Customs is modifying this system to allow importers to file documentation at a port of entry other than where the goods are to arrive or be examined. Rather than wait for this function to be deployed with ACE, Customs plans to add this function to (1) facilitate inspections and import processing and (2) reduce the importers’ administrative burden by eliminating the need of having importer staff at the port of entry. Customs is currently testing this capability with seven importers at selected locations. Customs is also enhancing its current Automated Commercial System to provide electronic filing capabilities for drawback claims. To date, Customs has modified the system to enable electronic (1) filing of such claims by the trade community and (2) comparison of key information on drawback claims to the original import entries. Customs also plans to improve its controls over duplicate and excessive drawback payments, which we previously noted were a problem, by enhancing this system to maintain a cumulative record of drawback amounts paid against individual line items on import entries. This enhancement is scheduled to be completed by October 1997. In implementing its NCAP strategy, Customs has not adhered to strategic information management best practices that help organizations (1) mitigate the risks associated with modernizing automated systems and (2) better position themselves to achieve success. Specifically, Customs did not (1) conduct the requisite analyses (e.g., cost-benefit, feasibility, alternatives) before committing to the CDC-2000 project, (2) redesign its import and other business processes before the agency selected the hardware for ACE and other systems, (3) manage ACE as an investment, and (4) designate strict accountability for ensuring that it successfully incorporates all NCAP-mandated functions into the agency’s modernization effort. Organizations that have successfully modernized operations and systems use a structured approach to identify the architecture that most efficiently and effectively meets their information needs. First, they redesign their old business processes. Then they analyze the new processes to identify (1) the information needs of the entire organization and (2) alternative ways of meeting them, including consideration of costs and benefits. Finally, the organizations use this analysis to select an optimal businesswide configuration, which specifies where and how processing will occur and identifies the hardware, software, telecommunications, and other elements needed to support new automated systems. This configuration is commonly referred to as an architecture and serves as a guide for modernizing automated systems. Organizations that do not follow this disciplined approach risk (1) automating the wrong processes and (2) developing systems that do not function well or that cannot be readily integrated with other systems. Consequently, the agency may develop systems that do not enhance the agency’s mission performance or that reach only a fraction of their potential to do so. However, Customs selected its CDC-2000 approach for ACE and other systems without using this disciplined approach. Specifically, the agency began buying minicomputers, software, and other equipment to support decentralized processing in 1993, but did not start to redesign its first critical business process (imports) until late 1994 and the other two processes (passenger, exports) until January and August 1995. In addition, Customs does not plan to complete these redesign efforts until September 1997, October 1996, and December 1996, respectively. In formulating the CDC-2000 project, Customs did not identify the information needs of the entire organization and consider alternative ways of meeting them as well as the respective costs and benefits. These shortcomings were also reported by Gartner. In this regard, the contractor stated that Customs’ selected products were primarily a “buy list” and were largely identified without taking into consideration the information needs of agency processes and systems. While Gartner stated that “the CDC-2000 architecture is, in general, valid and reasonable,” Gartner recommended that Customs use a disciplined approach to fully identify its needs and only then select products to meet those needs. Customs officials said they had selected the products included in the CDC-2000 initiative before the import process was redesigned because they needed to move from their current centralized system to decentralized processing and believed that the products selected would meet any future system needs. They also said that, at the time of selection, they did not believe a rigorous supporting analysis was needed because the products chosen were widely used by industry. Further, although CDC-2000 was adopted over 4 years ago, Customs does not believe it has wasted its time and resources because, according to the agency, only $4 million of the $63 million CDC-2000 funds spent to date have been used to buy minicomputers, software, and other equipment to support decentralized processing. Customs officials noted that, to date, $59 million has been used to upgrade and install personal computers and local area networks, which needed to be acquired regardless of the architecture that was ultimately formulated. We recognize Customs’ need to improve office automation using personal computers and local area networks. However, Customs’ rationale for purchasing minicomputers, software, and other equipment is based on several faulty assertions. First, Customs risks wasting hundreds of millions of dollars it plans to spend in the future on the CDC-2000 project should it continue purchasing hardware and software to support decentralized processing without conducting a thorough analysis. Second, while decentralized processing and the products Customs selected may be widely used, this has no bearing on whether they are a cost-effective approach to meeting Customs’ needs. Further, since the agency does not yet know how it plans to conduct its business in the future or what automated systems would best support these new business processes, it is in no position to commit to CDC-2000. Third, the Federal Information Resources Management Regulation and Office of Management and Budget Circular A-130 require thorough analyses to justify major systems efforts such as CDC-2000. Finally, best practice organizations have learned that using a structured approach can help them effectively use resources and lead to order-of-magnitude gains in productivity. Successful organizations manage information system projects as investments rather than expenses. This includes (1) creating an investment review board of senior program and automated systems managers to select, monitor, and evaluate system projects, (2) establishing explicit criteria to assess the merits of each project relative to others, including the use of cost, benefit, and risk analyses, and (3) following structured systems development methodologies throughout the system’s life. Such disciplined control processes are required by the Office of Management and Budget to help federal agencies decide which planned systems are worthwhile investments and ensure that the risks associated with building those systems are adequately controlled. Although its annual automated systems expenditures total about $150 million, Customs does not manage ACE and its other systems as investments. First, while Customs has a systems steering committee, composed of senior officials who meet periodically to monitor automation projects such as ACE, the committee functions primarily as a sounding board that addresses concerns raised by project managers as well as committee members rather than as an investment review board. For example, the committee has not developed explicit decision criteria to assess mission cost, benefits, and risk of both ongoing and planned projects. Instead, the committee makes decisions on ACE and other systems, including Automated Commercial System enhancements, without considering such critical information as the merits of each project relative to others, how well these systems will contribute to improving mission performance, if their value will exceed their cost, and how likely they are to succeed. Customs officials acknowledged the steering committee’s shortcomings and told us that, while they had initiated an effort in January 1995 to redefine the steering committee’s role, including managing systems as investments, not much progress has been made since then. Customs’ Deputy Commissioner said he intends to restart efforts to establish an investment subcommittee under the steering committee but has not established a target date to do so. Second, although Customs’ system development policies require cost-benefit analyses to be performed prior to developing critical and costly systems, we found that Customs had not performed such analyses for ACE and the CDC-2000 project. Gartner and IBM also reported that such analyses were lacking. In this regard, Gartner stated that Customs needed to assess the cost and benefits for CDC-2000 because (1) the agency had only a limited understanding of what it will ultimately cost and (2) if Customs waited much longer, the cost of purchases of selected products could mushroom beyond the agency’s ability to control it. Similarly, IBM stated that to be successful with ACE, Customs needed to identify and continuously monitor the cost and benefits of this system. Customs officials told us they recognize that until the agency conducts these analyses, it will not know whether these major system investments are worthwhile. In response to these findings, Customs hired contractors to help perform these analyses, but it continues to develop ACE on CDC-2000 hardware and plans to continue making CDC-2000 purchases. These analyses are scheduled to be completed by July 1996. Third, in developing ACE, Customs also skipped or has not completed other required system development steps necessary to control development risks. Specifically, Customs has not resolved how to incorporate into ACE critical functions mandated over 2 years ago in NCAP. These functions include reconciling adjustments to importers’ duties and processing drawback claims. It also did not prepare a security plan, although Customs has had problems in the past implementing effective internal controls to protect systems and data. Customs officials acknowledged that, given where they are in the ACE development process, they should have determined how to deliver NCAP-mandated functions and completed their security plan. In addition, they told us that it is their intention to complete the security plan in July 1996 and update the user requirements in June 1996. Assigning clear accountability and responsibility for information management decisions and results is another important practice identified by successful organizations. As we pointed out in our January 1995 testimony on Customs’ plan to modernize the agency, Customs is in the midst of a major reorganization and during this time of change, it needs to clarify roles and responsibilities to reinforce accountability and facilitate mission success. We found, however, that clear accountability for meeting NCAP requirements is lacking. Customs has established a board called the Trade Compliance Board of Directors to redesign its import process. This board consists of senior officials who represent the import process and related systems. However, while the board’s charter makes it accountable for the redesigned import process, it does not establish accountability for successfully implementing NCAP. Customs’ Deputy Commissioner agreed that the agency needs to assign accountability and requisite authority to ensure that the functions mandated in NCAP are successfully implemented. Customs recognizes that it (1) cannot afford to fail in its effort to redesign and automate critical NCAP processes and (2) needs to make a more concentrated effort to implement best practices. However, Customs has not assigned responsibility for ensuring that NCAP is successfully implemented. Further, Customs has no assurance that continued buying of CDC-2000 equipment is the best way to accomplish its mission or that the hardware selected for ACE and other systems is appropriate. Customs is in the early stages of its modernization and has time to implement these best practices. While Customs is starting to take corrective action, the agency is at serious risk and vulnerable to failure until such action is completed. We recommend that, prior to additional CDC-2000 equipment purchases (except those for office automation needs) and before beginning to develop any applications software that will run on this equipment, the Commissioner of Customs should: Assign accountability and responsibility for implementing NCAP. Ensure that the export and passenger business processes are completed and the requirements generated from these two tasks, along with those of the import process requirements, are used to determine how Customs should accomplish its mission in the future, including who will perform operations and where they will be performed, what functions must be performed as part of these operations, what information is needed to perform these functions, and where data should be created and processed to produce such information, what alternative processing approaches could be used to satisfy Customs’ requirements, and what are the costs, benefits, and risks of each approach, and what processing approach is optimal, and not resume CDC-2000 purchases unless CDC-2000 is determined to be the optimal approach. Complete the agency’s effort to redefine the role of the systems steering committee to include managing systems as investments as required by the Office of Management and Budget’s Circular A-130 and information technology investment guide. This effort should include developing and using explicit criteria to guide system development decisions and using the criteria to revisit whether Customs’ planned investments, including ACE and Automated Commercial System enhancements, are appropriate. Direct the steering committee to ensure that all systems being developed strictly adhere to Customs’ system development steps. As part of this oversight, we recommend that before applications are developed for ACE, the steering committee ensure that Customs resolves how to incorporate NCAP-mandated functions into ACE and prepares a security plan. In commenting on a draft of this report, Customs agreed with all of our recommendations and said it plans to or has acted to implement them. First, Customs agreed to clarify and document accountability and responsibility for implementing NCAP. Second, Customs agreed to perform the requisite analyses to determine the optimal architecture and to cease CDC-2000 purchases, except those for office automation needs and prototyping, until this determination is made, which is fully responsive to our recommendation. Third, according to Customs, the agency has formally established its investment subcommittee and is studying best investment practices of federal and private sector organizations, which the investment subcommittee plans to use to develop operating procedures and investment criteria for reviewing system decisions. Finally, Customs agreed to have the systems steering committee address compliance with agency system development procedures at the committee’s next meeting. We are sending copies of this letter to the Chairmen and the Ranking Minority Members of the Senate Committee on Finance; the Subcommittees on Treasury, Postal Service and General Government of the Senate and House Appropriations Committees; the Senate Committee on Governmental Affairs; and the House Committee on Government Reform and Oversight. We are also sending copies to the Secretary of the Treasury, Commissioner of Customs, and Director of the Office of Management and Budget. Copies will also be available to others upon request. If you have questions about this letter, please contact me at (202) 512-6240. Major contributors are listed in appendix III. To determine the status of Customs’ strategy for implementing the National Customs Automation Program (NCAP), we reviewed the law—and its legislative history—establishing NCAP. We interviewed key Customs program and information system officials regarding process improvement and systems modernization efforts for the import process. We examined Customs’ People, Processes, and Partnerships report of September 1994, which outlines the agency’s vision for organizational and process change, and examined the 5-year information systems plan of April 1995 for fiscal years 1997-2001. We also reviewed background information on Customs’ existing automated import processing system and documents supporting current enhancements to that system as well as the (1) annual business plan, (2) project plan, and (3) user requirements documents for Customs’ planned ACE system. To assess the adequacy of Customs’ strategy for implementing NCAP, we assessed Customs’ strategic information management processes for developing ACE. In analyzing Customs’ processes, we applied fundamental best practices used by successful private and public sector organizations as discussed in our report, Executive Guide: Improving Mission Performance Through Strategic Information Management and Technology (GAO/AIMD-94-115, May 1994), and our related guide Strategic Information Management (SIM) Self-Assessment Toolkit (GAO/Version 1.0, October 28, 1994, exposure draft). We also made our assessment using the (1) Office of Management and Budget’s Circular A-130 Revised, Transmittal 2 (July 1994) and investment guide Evaluating Information Technology Investments, A Practical Guide (Version 1.0, November 1995) and (2) General Services Administration’s guide Critical Success Factors for Systems Modernization (October 1988). Specifically, to determine if information resources management plans supported the agency mission and customer needs for imports, we interviewed planning officials and examined 5-year and annual business and information management plans. To assess whether the business process is being considered in developing ACE, we conducted interviews and examined documentation for the redesigned import process, including the structured methodology used to conduct this initiative. At user conferences held by Customs, we also interviewed internal and external users of the current import system to determine whether customer information requirements are being identified in developing ACE. To determine whether ACE was guided by an architecture, we reviewed internal studies evaluating Customs’ distributed computing environment. We also analyzed commissioned studies, interviewed the contractors performing the studies, and obtained Customs’ response to the technical studies. In assessing whether CDC-2000 meets agencywide information needs, we examined agency documents and interviewed all three core business process owners as well as information systems officials. To determine if ACE is managed as an investment, we interviewed members of Customs’ systems steering committee and examined its minutes and an agenda book with background information for a committee meeting. Also, we reviewed Customs’ systems development life cycle procedures and compared ACE to applicable procedures to determine if required steps were completed at this initial stage of ACE development. Finally, to determine whether a single official was designated to ensure that NCAP requirements are met we interviewed members of the Trade Compliance Board of Directors which provides oversight of the redesign of the import process. We also examined the board’s charter, identified which Customs organizations were represented on the board, and reviewed minutes of meetings. Our work was performed at Customs headquarters in Washington, D.C., and its Data Center in Newington, Virginia. Mark E. Heatwole, Senior Assistant Director Antionette Cattledge, Assistant Director Brian C. Spencer, Technical Assistant Director Agnes I. Spruill, Senior Information Systems Analyst Gary N. Mountjoy, Senior Information Systems Analyst Cristina T. Chaplain, Communications Analyst The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 6015 Gaithersburg, MD 20884-6015 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (301) 258-4066, or TDD (301) 413-0006. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.

Summary: Pursuant to a congressional request, GAO reviewed the Customs Service's efforts to modernize its automated systems, focusing on: (1) the status and adequacy of Customs' implementation of the National Customs Automation Program (NCAP); and (2) whether Customs is using a best-practices approach to improve mission performance through strategic information management and technology in implementing NCAP. GAO found that: (1) Customs is redesigning its import process and plans to develop a new automated import system while it enhances its present system to meet NCAP mandates in the interim; (2) the new import process will serve customer needs better and improve operational efficiency and effectiveness; (3) Customs plans to deploy its new import system in October 1998; (4) Customs' modernization efforts are vulnerable to failure because it has not effectively applied best practices to the implementation of its NCAP strategy; (5) Customs selected new systems before it redesigned its key business processes and is not applying specific criteria in assessing projects, alternatives, costs and benefits, and systems architecture; (6) Customs has not managed its new automated system acquisition as an investment nor planned how to incorporate NCAP requirements into it; (7) two contractors' studies have highlighted the weaknesses in Customs' modernization plans and recommended ways to improve its efforts; (8) Customs plans to hire additional contractors to perform the needed modernization analyses, but it also intends to continue with system development and equipment purchases before these analyses are completed; and (9) Customs has not established clear accountability for ensuring that NCAP requirements are successfully implemented.