VA’s mission is to promote the health, welfare, and dignity of all veterans in recognition of their service to the nation by ensuring that they receive medical care, benefits, social support, and lasting memorials. Its three major components, the Veterans Benefits Administration (VBA), the Veterans Health Administration (VHA), and the National Cemetery Administration, are primarily responsible for carrying out this mission. Over time, the use of IT has become increasingly crucial to the department’s effort to provide benefits and services. VA relies on its systems for providing access to medical information to ensure high-quality health care for veterans as well as for processing benefit claims, including compensation and pension and education benefits. In reporting on VA’s IT management over the past several years, we have highlighted challenges the department has faced in achieving its vision of creating “One VA”—that is, integrating IT resources to enable department employees to help veterans obtain services and information more quickly and effectively. One major challenge was that the department’s information systems and services were highly decentralized and that its administrations controlled a majority of the IT budget. As we have previously pointed out, it is crucial for the department CIO to ensure that well-established and integrated processes for leading, managing, and controlling investments are followed throughout the department. Similarly, a contractor’s assessment of VA’s IT organizational alignment, issued in February 2005, noted the lack of control over how and when money is spent. The assessment found that project managers within the administrations had the ability to shift money to support individual projects. Also, according to the assessment, the focus of department-level management was only on reporting expenditures to the Office of Management and Budget and Congress, rather than on managing these expenditures within the department. In response to the challenges that we and others noted, the department officially began its effort to provide the CIO with greater authority over IT in October 2005. At that time, the Secretary issued an executive decision memorandum granting approval for the development of a new IT management structure for the department. According to VA, its goals in moving to centralized management are to provide the department better oversight over the standardization, compatibility, and interoperability of IT systems, as well as better overall fiscal discipline for the budget. By July 2006, the department’s realignment contractor began work to assist with the realignment effort. In February 2007, the Secretary approved the department’s new organization structure, which includes the Assistant Secretary for Information and Technology, who serves as VA’s CIO. As shown in figure 1, the CIO is supported by a Principal Deputy Assistant Secretary and five Deputy Assistant Secretaries—new senior leadership positions created to assist the CIO in overseeing functions such as cyber security, IT portfolio management, systems development, and IT operations. In April 2007, the Secretary approved a governance plan that is intended to enable the Office of Information and Technology to centralize its decision making. The plan describes the relationship between IT governance and departmental governance and the approach the department intends to take to enhance governance. As the foundation for its realignment, VA plans to implement improved management processes in five key areas: enterprise management, business management, business application management, infrastructure, and service support. The particular management processes, recommended by the department’s realignment contractor, were based on industry best practices and encompass all areas of IT management, such as those necessary for effective IT programs (such as security management and asset management processes) and IT initiatives (such as risk management and project management processes). In attachment 1, we provide brief descriptions of the 36 IT management processes to be addressed in VA’s realignment. According to the contractor, establishing improved management processes and standardizing these processes across the department are essential to the effectiveness of the centralized management model. By implementing these improved processes, VA expects to correct deficiencies it has encountered as a result of its decentralized management approach. Proper implementation should result in institutionalizing best management practices that will be sustained regardless of future leadership changes at the department. According to the contractor, with a system of defined management processes, the Office of Information and Technology could quickly and accurately change the way IT supports the department. The contractor also noted that failure to include such processes in the realignment would introduce the risk that any progress in completing the realignment would be the result of trial and error. We have reported in the past on key factors that are needed in order to successfully transform an organization to be more results oriented, customer focused, and collaborative in nature. We reported that large-scale change management initiatives are not simple endeavors and require the concentrated efforts of both leadership and employees to realize intended synergies and to accomplish new organizational goals. We also noted that there are a number of key practices that can serve as the basis for federal agencies to transform their cultures in response to governance challenges, such as those that an organization like VA might face when transforming to a centralized IT management structure. Among the significant factors we identified as critical for ensuring the success of VA’s move to centralized management are ● ensuring commitment from top leadership, ● establishing a governance structure to manage resources, linking the IT strategic plan to the organization strategic plan, ● using workforce strategic management to identify proper roles for ● communicating change to all stakeholders, and ● dedicating an implementation team to manage change. In our recent review of the department’s effort to realign its IT program, we evaluated, among other things, whether the realignment plan includes the critical factors for successful transformation as discussed above. We reported that VA’s realignment plan included elements of several of the six critical success factors that we identified. However, VA had not fully addressed all six factors. Only one factor had been fully addressed; additional work remained on the other five factors, as shown in table 1. The department had fully addressed the first critical success factor, ensuring commitment from top leadership, as demonstrated by the Secretary’s actions in support of the realignment. Besides approving the transfer of personnel to the centralized office, the Secretary approved in February 2007 a new organization structure for centralized IT management. Since undertaking the realignment, VA concentrated its efforts on transferring approximately 6,000 staff to the CIO’s office from the administrations and staff offices and on creating the new centralized organizational structure. As shown in the table, VA had begun or planned to begin actions on four other critical success factors, but it had not completed the actions. For example, the department approved its governance plan to address how the Office of Information and Technology will manage resources; however, it had not yet established the boards that are to provide governance over the centralized structure. In addition, although the department had identified the responsibilities for managing its workforce within its new structure, it had not yet established a knowledge and skills inventory to help determine the proper roles for all employees in the new organization. VA had neither addressed nor planned to address the last critical success factor: dedicating an implementation team to manage change. Although it had highlighted the importance of managing change in its realignment documentation, VA did not plan to establish a realignment implementation team. As we have pointed out, a dedicated implementation team that is responsible for the day-to-day management of a major change initiative is critical to ensure that the project receives the focused, full-time attention needed to be sustained and successful. Specifically, the implementation team is important to ensuring that various change initiatives are implemented in a coherent and integrated way. The team must have the necessary authority and resources to set priorities, make timely decisions, and move quickly to implement the transformation. In addition, the implementation team can assist in tracking implementation goals for a change initiative and identifying performance shortfalls or schedule slippages. It is important for the team to use performance metrics to provide a succinct and concrete statement of expected performance versus actual performance. Because of its close involvement with the change initiative, the implementation team can also suggest corrections to remedy any problems. The department had not addressed this critical success factor: it had not dedicated an implementation team to manage the realignment effort and track its progress. At the conclusion of our review in June 2007, staff from the IT realignment office, which was responsible for overseeing the realignment, had been reassigned to other areas of responsibility within the department’s new structure. In addition, the Director of the Realignment Office told us that multiple offices would assume responsibility for managing the realignment through July 2008: the Office of Quality and Performance Management would oversee process implementation across the Office of Information and Technology, and the Office of Oversight and Compliance Management would assess whether the department is complying with the new processes. However, there was no one group responsible for managing the realignment in its entirety. Without such a dedicated group, it is less likely that VA will be able to ensure that the realignment is managed effectively throughout its implementation. With regard to the new IT management processes, the department had begun to take action, but it had not made significant progress at the time of our report. The department had planned to begin implementing 9 of the 36 new processes in March 2007. However, the department had missed key implementation dates for these processes. As of May 2007, it had begun pilot testing two of the new processes: the risk management process and the solution (that is, business application) test and acceptance process. Thus, although the department had taken positive steps in moving to centralized IT management, it had much more work to complete before the realignment can be considered finished and a success. If VA does not continue to address the critical success factors we identified and develop and implement the new management processes by their target date, the department may continue to operate in a decentralized manner and risk not fully realizing the long-term benefits of the realignment. Accordingly, we recommended that the department dedicate an implementation team responsible for change management throughout the transformation and that it develop detailed IT governance process descriptions that identify how IT resources will be managed in the centralized organization. We also made seven additional recommendations aimed at ensuring that the realignment is successfully accomplished. The department generally concurred with our recommendations and stated that it has taken action or has actions under way to address each of our recommendations. Although IT management has been centralized under the CIO, at the time of our review, IT programs and initiatives continued to be managed under previously established processes. The key processes to be used as the foundation for the realignment had not yet had an impact on IT programs (specifically, security and inventory management) or initiatives (such as VBA’s modernization efforts and VHA’s initiatives on sharing medical data with DOD). As mandated by the Federal Information Security Management Act (FISMA) of 2002, every agency is to establish an information security program. In addition, security management is a key management process that under the realignment is to be established uniformly across the department. VA’s IT systems contain sensitive information that is vulnerable to inadvertent or deliberate misuse, loss, or improper disclosure. This vulnerability was highlighted by an incident in May 2006, when VA announced that computer equipment containing personally identifiable information on approximately 26.5 million veterans and active duty members of the military was stolen from the home of a VA employee. Until the equipment was recovered, veterans did not know whether their information was likely to be misused. In a September 2007 report, we state that although VA has made progress in addressing security weaknesses, it has not yet fully implemented key recommendations to strengthen its information security practices. It has implemented 2 of our 4 previous recommendations and only 2 of the 22 recommendations made by the department’s inspector general (IG). Among those recommendations not implemented are our recommendation that it complete a comprehensive security management program and an IG recommendation to strengthen critical infrastructure planning to ensure that information security requirements are addressed. Because these recommendations have not yet been implemented, the department will be at increased risk that personal information of veterans and other individuals, such as medical providers, may be exposed to data tampering, fraud, and inappropriate disclosure. Our report describes several major initiatives that VA has begun or continued since the May 2006 security incident, in efforts to strengthen information security practices and secure personal information within the department. Among these initiatives are the department’s efforts to reorganize its management structure to provide better oversight and fiscal discipline over its IT systems. Establishing an effective IT management structure is the starting point for coordinating and communicating the continuous cycle of information security activities necessary to address current risks on an ongoing basis while providing guidance and oversight for the security of the entity as a whole. Under FISMA and the Veterans Benefits, Health Care, and Information Technology Act of 2006, the CIO ensures compliance with requirements of these laws and designates a chief information security officer (CISO) to assist in carrying out his responsibilities. One mechanism organizations can adopt to achieve effective coordination and communication is to establish a central security management office or group to coordinate departmentwide security-related activities. To ensure that information security activities are effective across an organization, the management structure should also include clearly defined roles and responsibilities for all security staff and coordination of responsibilities among individual staff. Under the realignment, the management structure for information security has changed, but improved security management processes have not yet been completely developed and implemented. In particular, under the new structure, responsibility for information security functions within the department is divided between two organizations (see fig. 2), but no documented process yet exists for the two responsible offices to coordinate with each other in managing and implementing the departmentwide security program. Under the new organization, the Director of the Cyber Security Office (who is also the department’s designated CISO) has responsibility for developing and maintaining a departmentwide security program, among other things. However, the Director of the Field Operations and Security Office is responsible for implementing the program. Although VA officials indicated that these officials are communicating about the department’s implementation of security policies and procedures, this communication is not defined as a role or responsibility for either position in the new management organization book, nor is there a documented process in place to coordinate the management and implementation of the security program. Both of these activities are key security management practices. Without a documented process, policies or procedures could be inconsistently implemented throughout the department, which could prevent the CISO from effectively ensuring departmentwide compliance with FISMA. In addition, without a defined process and responsibilities, VA will have limited assurance that the management and implementation of security policies and procedures are effectively coordinated and communicated. Developing and documenting these policies and procedures are essential for achieving an improved and effective security management process under the new centralized management model. Accordingly, among the actions we recommended to the department was to document clearly defined coordination responsibilities for the Director of Field Operations and Security and the Director of Cyber Security, as well as to develop and implement a process for these officials to coordinate on the implementation of IT security policies and procedures throughout the department. We also made 15 other recommendations to improve the department’s ability to protect its information and systems, including the development of various processes and procedures to ensure that tasks in the department’s security action plans have time frames for implementation. VA generally agreed with our recommendations and stated that it had already implemented some of the recommendations and had actions under way to address the others. In light of reported weaknesses in VA inventory controls and reported thefts of laptop computers and data breaches, the adequacy of such controls has been an ongoing concern. In July 2007, we reported and testified on an assessment of the risk of theft, loss, or misappropriation of IT equipment at selected VA medical centers. Our assessment found that a weak overall control environment for IT equipment at the four locations we audited posed a significant security vulnerability to the nation’s veterans with regard to sensitive data maintained on this equipment. According to our Standards for Internal Control in the Federal Government, agencies are required to establish physical controls to safeguard vulnerable assets, such as IT equipment, which might be vulnerable to risk of loss; in addition, federal records management law requires federal agencies to record essential transactions. However, we reported in July that current VA property management policy does not provide guidance for creating records of inventory transactions as changes occur. Also, policies requiring annual inventories of sensitive items (such as IT equipment), adequate physical security, and immediate reporting of lost and missing items had not been enforced. Our statistical tests of physical inventory controls at the four locations identified a total of 123 missing IT equipment items, including 53 computers that could have stored sensitive data. The lack of user-level accountability and inaccurate records on status, location, and item descriptions make it difficult to determine the extent to which actual theft, loss, or misappropriation may have occurred without detection. Table 2 summarizes the results of our statistical tests at each location. We also found that the four VA locations had reported over 2,400 missing IT equipment items, valued at about $6.4 million, identified during physical inventories performed in fiscal years 2005 and 2006. Missing items were often not reported for several months and, in some cases, several years. It is very difficult to investigate these losses because information on specific events and circumstances at the time of the losses is not known. Further, our limited tests of computer hard drives in the excess property disposal process found hard drives at two of the four case study locations that contained personal information, including veterans’ names and Social Security numbers. Our tests did not find any remaining data after sanitization procedures were performed. However, weaknesses in physical security at IT storage locations and delays in completing the data sanitization process heighten the risk of data breach. Although VA had taken some actions to improve controls over IT equipment (such as issuing several new policies to establish guidance and controls for IT security) and had reorganized and centralized the IT function within the department under the CIO, we reported that these actions had not yet been fully implemented. The new CIO organization had no formal responsibility for medical equipment that stored or processed patient data and did not address roles or necessary coordination between information resource management and property management personnel with regard to inventory control of IT equipment. The Assistant Secretary for Information and Technology, who serves as the CIO, told us that the new CIO organization structure will include a unit that will have responsibility for IT equipment asset management once it becomes operational. However, at the time of our report, this unit had not yet been funded or staffed. To ensure accountability and safeguarding of sensitive IT equipment, effective implementation will be key to the success of the department’s IT policy and organizational changes. We made 12 recommendations for actions to be taken by the department to help minimize the risk of loss, theft, and misappropriation of government IT equipment used in VA operations. The recommendations included establishing policies and procedures that require, among other things, recording inventory transactions and establishing specific, individual user-level accountability. VA management generally agreed with our findings and concurred with all 12 recommendations, noting that it had actions planned or under way to address them. To administer various benefits programs, VBA relies on an aging system, the Benefits Delivery Network (BDN). The BDN, which has been in operation for more than 40 years, is based on antiquated software programs, which have become increasingly difficult and costly to maintain. VBA is in the process of replacing the BDN with a faster, more flexible, and higher capacity system. Replacing the BDN has been a focus of systems development efforts at VBA since 1986. VBA currently depends on the BDN to administer programs for three types of benefits: (1) compensation and pension, (2) education, and (3) vocational rehabilitation and employment (VRE) services. Originally, the administration planned to modernize the entire system, but after experiencing numerous false starts and spending approximately $300 million on the overall modernization of the BDN, VBA revised its strategy in 1996. First, it narrowed its focus to replacing only those functionalities that support the compensation and pension program, and began developing a replacement system, which it generally refers to as the Veterans Service Network (VETSNET). Then, in December 1999, it began an initiative, The Education Expert System (TEES), to move its education claims processing systems from the BDN to new technology platforms and a new architecture, as a way to improve its education benefits delivery services. (We have not evaluated the VRE program or possible plans to migrate VRE operations from the BDN.) Progress Made in Long-Term Effort to Replace Benefits Payment System, but Challenges Persist When VBA began the VETSNET project in 1996, it planned to complete the replacement system in May 1998 at an estimated cost of $8 million. However, over the years, VBA encountered numerous problems in completing the replacement system. We have reported on this topic several times, making numerous recommendations. Although VA concurred with our recommendations and took several actions to address them, its actions were not sufficient to implement all our recommendations or establish the program on a solid footing: certain basic requirements of sound project management, such as an integrated project plan for the replacement system, continued to be lacking. In 2005, because of concerns about continuing problems with the replacement project, VA contracted for an independent assessment of the department’s options for the project, including whether the project should be terminated. This assessment, conducted by the Carnegie Mellon Software Engineering Institute (SEI), concluded that the replacement project faced many risks arising from management and organizational issues, but no technical barriers that could not be overcome. According to SEI, a new system was still needed, and VBA would not be able to successfully deliver a full, workable solution unless it addressed its management and organizational weaknesses. SEI recommended that VBA continue to work on the project at a reduced pace, while taking an aggressive approach to addressing the identified weaknesses. We reported in April 2007 that VBA was generally following the course of action recommended by SEI: it was continuing to work on the replacement initiative at a slower pace, while taking action to address identified weaknesses in overall management and software development processes. For example, VBA established a new governance structure, and it took steps to improve its software development processes, such as establishing risk and requirements management processes. However, some processes had not been addressed, such as capacity planning and management, which will be important for ensuring that further development does not lead to processing slowdowns. Further, VBA had not yet documented policies and procedures to institutionalize all the process improvements that it made on the replacement initiative, having first concentrated its efforts on establishing the governance and building the organization. If VBA does not institutionalize these improvements, it increases the risk that they may not be maintained through the life of the project or be available for application to other development initiatives. As of April 2007, VBA had developed critical functionalities needed to process and pay certain original compensation claims using the replacement system. According to VBA officials, all five of the major software applications that make up the new system were being used in VA’s regional offices to establish and process new compensation claims for veterans. In April 2007, the replacement system was providing monthly compensation payments to almost 50,000 veterans (out of about 3 million veterans who receive such payments). Nonetheless, the system requires further development, and VBA still faces the substantial task of converting records for the approximately 3.5 million beneficiaries on the BDN to the replacement system. Under the realignment, the responsibility for all system development projects has moved from VBA to the central CIO organization: specifically, the Deputy Assistant Secretary for Enterprise Development. Thus, this official is now responsible for completing the development and implementation of VETSNET. Accordingly, we recommended that the CIO document and incorporate the improved processes for managing risks, requirements, and defects into specific policy and guidance for the replacement initiative and for future use throughout VBA. VA concurred with our recommendation and stated that the VETSNET project management processes will be incorporated into a set of standard project management policies, processes, and procedures for all IT projects in VA. Further, the CIO has identified the VETSNET governance model as the model for all VA enterprisewide IT projects, and it is being implemented in other VA priority IT development programs. In addition, we made five other recommendations aimed at sustaining the improved management and software development processes currently being used by VETSNET project management, including processes for capacity planning and management. The Secretary also agreed with these recommendations and described actions planned in response. Improved Planning Needed to Guide Development and Implementation of Education Benefits System The Education Expert System (or TEES) effort aims to replace the existing education benefits systems on the BDN with a new rules- based system that will add more automated capabilities, eliminate most human intervention, and enable faster and more accurate processing of education claims. When it began the initiative, VBA had planned to complete the new system by September 2005; however, in 2004, the department refocused and rebaselined the system’s development effort. VA currently estimates that the TEES initiative will be completed by 2011. When we reported on this matter in July 2007, VBA had enhanced education benefits claims processing by developing certain functionalities to allow information to be captured in an electronic format. For example, it had developed automated systems that allow (1) education institutions to provide online enrollment certifications, (2) students to provide online and telephonic verification of enrollment, and (3) the public to inquire about approved academic programs, licensing and certification programs, and national exams. However, although VBA had identified other initiatives as necessary to complete the new system and eliminate most human intervention, it had not taken action on these initiatives, which included moving the processing and payment functionality used for many education claims from the BDN to new technology. Contributing to our concerns was that VBA did not have an integrated project plan for the TEES initiative. According to agency officials, the plan that had been developed in 2001 has not been updated since 2004, when program goals were modified. Because VBA did not have an integrated project management plan, it lacked critical elements needed to effectively guide the initiative to completion (such as a full description of the scope of the system development efforts) and an overall approach for coordinating its various education claims initiatives (such as the BDN code conversion effort). Without these critical elements, the department would be at risk of wasting millions of dollars on education claims processing initiatives that may overlap or be duplicative. One reason for this management weakness is the lack of well- defined IT management processes across VA, which is to be addressed by the realignment. Under the realignment, the responsibility for TEES, like other system development projects, has moved from VBA to the Deputy Assistant Secretary for Enterprise Development, who is part of the central CIO organization. At the time of our report, the TEES project had not yet been affected by VA’s stated intention of incorporating the VETSNET project management processes into a set of standard project management policies, processes, and procedures for all IT projects in the department. Establishing improved IT management processes is vital to ensuring effective project management and thus the future development and implementation of TEES. To ensure the successful implementation of TEES, we made three recommendations aimed at ensuring that a comprehensive, integrated project plan to coordinate and manage the initiative would be developed. VA concurred with our recommendations and described actions planned to address them. For almost 10 years, VA and DOD have been engaged in multiple efforts to share electronic medical information, which is important in helping to ensure that active-duty military personnel and veterans receive high-quality health care. These include efforts focused on the long-term vision of a single “comprehensive, lifelong medical record for each service member” that would allow a seamless transition between the two departments, as well as more near-term efforts to meet immediate needs to exchange health information, including responding to current military crises. As we testified in May 2007, VA and DOD have made progress in sharing health information, but much work remains to achieve the goal of a shared electronic medical record and seamless transition between the two departments. In their long-term initiatives, each department is developing its own modern health information system to replace its legacy systems, and they are collaborating on a program to develop an interface to enable these modernized systems to share data and ultimately to have interoperable electronic medical records. Unlike the legacy systems, the modernized systems are to be based on computable data: that is, the data are to be in a format that a computer application can act on, for example, to provide alerts to clinicians (of such things as drug allergies) or to plot graphs of changes in vital signs such as blood pressure. According to the departments, such computable data contribute significantly to patient safety and the usefulness of electronic medical records. At the time of our testimony, the departments had begun to implement the first release of the interface between their modernized data repositories, and computable outpatient pharmacy and drug allergy data were being exchanged at seven VA and DOD sites. Although the data being exchanged were limited, implementing this interface is a milestone toward the long-term goal of modernized systems with interoperable electronic medical records. While working on this long-term effort, the two departments also made progress in various near-term initiatives to exchange electronic medical information in their existing systems. The departments completed development of a system to allow the one- way transfer of health information from DOD to VA when service members leave the military. DOD has been using this system (the Federal Health Information Exchange or FHIE) to transfer information to VA since 2002. According to department officials, as of March 2007, over 184 million clinical messages on more than 3.8 million veterans had been transferred to the FHIE data repository, and VA had been given access to data for more than 681,000 separated service members and demobilized Reserve and National Guard members who had been deployed. Transfers are done in batches once a month, or weekly for veterans who have been referred to VA treatment facilities. According to a joint DOD/VA report, FHIE has made a significant contribution to the delivery and continuity of care of separated service members as they transition to veteran status, as well as to the adjudication of disability claims. In addition, two ongoing demonstration projects were successfully exchanging particular types of data at selected sites: ● The Laboratory Data Sharing Interface allows DOD and VA facilities serving the same geographic area to share laboratory resources. As of May 2007, this capability had been deployed at 9 localities to communicate orders for lab tests and their results electronically and could be deployed at others if the need is demonstrated. ● The Bidirectional Health Information Exchange allows a real-time, two-way view of health data from existing systems. As of May 2007, this system provided this capability (for outpatient data) to all VA sites and 25 DOD sites and (for certain inpatient discharge summary data) to all VA sites and 5 DOD sites. Expanding this interface is the foundation of the departments’ interim strategy to share information among their existing systems. The two departments had also undertaken ad hoc activities to accelerate the transmission of health information on severely wounded patients from DOD to VA’s four polytrauma centers. These centers care for veterans and service members with disabling injuries to more than one physical region or organ system. The ad hoc processes include manual workarounds such as scanning paper records and individually transmitting radiological images. Such processes were generally feasible only because the number of polytrauma patients was small (about 350 in all as of May 2007). Through all these efforts, VA and DOD have achieved exchanges of health information. However, these exchanges are as yet limited, and it is not clear how they are to be integrated into an overall strategy toward achieving the departments’ long-term goal of comprehensive, seamless exchange of health information. Significant work remains to be done for the departments to achieve their long-term goals, including agreeing to standards for the remaining categories of medical information, populating the data repositories with all this information, completing the development of their modernized systems, and transitioning from the legacy systems. In addition, the departments have not yet projected a completion date for the project as a whole. Consequently, it is essential for the departments to develop a comprehensive project plan to guide this effort to completion. In previous work, we have made numerous recommendations with regard to this effort, placing particular stress on the need for comprehensive planning. VA and DOD have agreed with our recommendations, and have taken action to implement them. However, at the time of our May testimony, the two departments had not yet developed a comprehensive integrated project plan. The need for such a comprehensive plan is further highlighted by the strategy announced by the two departments in January 2007: that is, to jointly develop a new inpatient medical record system. The departments have indicated that by adopting a joint solution, they could realize significant cost savings and make inpatient health care data immediately accessible to both departments. Incorporating this new strategy into the departments’ ongoing efforts would be greatly facilitated by a comprehensive project plan. In summary, effectively instituting the realignment is essential to ensuring that its IT programs achieve their objectives and that VA has a solid and sustainable approach to managing its IT investments. The department continues to work on improving such programs as information security and asset control, and it currently has many significant initiatives under way, for which substantial investments have been made. Yet we continue to see management weaknesses in these programs and initiatives (many of a long-standing nature), which are the very weaknesses that VA aims to alleviate with its reorganized management structure. However, until the department provides the foundation for its new IT management structure by carrying out its plans to establish a comprehensive set of improved management processes, the impact of this vital undertaking will be diminished. Implementation of the recommendations that we have made in this area could play a significant role in resolving many of these concerns. Mr. Chairman, this concludes my statement. I would be pleased to respond to any questions that you or other members of the committee may have at this time. For information about this testimony, please contact Valerie C. Melvin at (202) 512-6304 or melvinv@gao.gov. Key contributions to this testimony were made by Barbara Oliver, Assistant Director; Barbara Collier, B. Scott Pettis; J. Michael Resser; Eric Trout, and Charles Youman. Addressing long- and short-term objectives, business direction, and their impact on IT, the IT culture, communications, information, people, processes, technology, development, and partnerships. Defining a structure of relationships and processes to direct and control the IT endeavor. Identifying potential events that may affect the organization and managing risk to be within acceptable levels so that reasonable assurance is provided regarding the achievement of organization objectives. Architecture management Creating, maintaining, promoting, and governing the use of IT architecture models and standards across and within the change programs of an organization. Assessing all applications, services, and IT projects that consume resources in order to understand their value to the IT organization. Managing the department’s information security program, as mandated by the Federal Information Security Management Act (FISMA) of 2002. IT research and innovation Generating ideas, evaluating and selecting ideas, developing and implementing innovations, and continuously recognizing innovators and learning from the experience. Planning, organizing, monitoring, and controlling all aspects of a project in a continuous process so that it achieves its objectives. Managing and prioritizing all requests for additional and new technology solutions arising from a customer’s needs. Determining whether and how well customers are satisfied with the services, solutions, and offerings from the providers of IT. Providing sound stewardship of the monetary resources of the organization. Establishing a pricing mechanism for the IT organization to sell its services to internal or external customers and to administer the contracts associated with the selling of those services. Enabling the IT organization to understand the marketplace it serves, to identify customers, to “market” to these customers, to generate “marketing” plans for IT services and support the “selling” of IT services to internal customers. Compliance management Ensuring adherence with laws and regulations, internal policies and procedures, and stakeholder commitments. Maintaining information regarding technology assets, included leased and purchased assets, licenses, and inventory. Enabling an organization to provide the optimal mix of staffing (resources and skills) needed to provide the agreed-on IT services at the agreed-on service levels. Service-level management Managing service-level agreements and performing the ongoing review of service achievements to ensure that the required and cost-justifiable service quality is maintained and gradually improved. Ensuring that agreed-on IT services continue to support business requirements in the event of a disruption to the business. Developing and exercising working relationships between the IT organization and suppliers in order to make available the external services and products that are required to support IT service commitments to customers. Knowledge management Promoting an integrated approach to identifying, capturing, evaluating, categorizing, retrieving, and sharing all of an organization’s information assets. Translating provided customer (business) requirements and IT stakeholder-generated requirements/constraints into solution-specific terms, within the context of a defined solution project or program. Creating a documented design from agreed-on solution requirements that describes the behavior of solution elements, the acceptance criteria, and agreed-to measurements. Bringing together all the elements specified by a solution design via customization, configuration, and integration of created or acquired solution components. Validating that the solution components and integrated solutions conform to design specifications and requirements before deployment. Addressing the delivery of operational services to IT customers by matching resources to commitments and employing the IT infrastructure to conduct IT operations. Ensuring that all data required for providing and supporting operational service are available for use and that all data storage facilities can handle normal, expected fluctuations in data volumes and other parameters within their designed tolerances. Identifying and prioritizing infrastructure, service, business, and security events, and establishing the appropriate response to those events. Planning, measuring, monitoring, and continuously striving to improve the availability of the IT infrastructure and supporting organization to ensure that agreed-on requirements are consistently met. Matching the capacity of the IT services and infrastructure to the current and future identified needs of the business. Creating and maintaining a physical environment that houses IT resources and optimizes the capabilities and costs of that environment. Managing the life cycle of a change request and activities that measure the effectiveness of the process as well as providing for its continued enhancement. Configuration management User contact management Managing each user interaction with the provider of IT service throughout its life cycle. Controlling the introduction of releases (that is, changes to hardware and software) into the IT production environment through a strategy that minimizes the risk associated with the changes. Identifying, controlling, maintaining, and verifying the versions of configuration items and their relationships in a logical model of the infrastructure and services. Restoring a service affected by any event that is not part of the standard operation of a service that causes or could cause an interruption to or a reduction in the quality of that service. Resolving problems affecting the IT service, both reactively and proactively. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The Department of Veterans Affairs (VA) depends on information technology (IT) to effectively serve our nation's veterans, with an IT budget of about $1 billion annually. However, it has encountered numerous challenges in managing its IT programs and initiatives. To address these challenges, VA is realigning its IT organization and management to a centralized model founded on a defined set of improved management processes. Begun in October 2005, the realignment is planned to be complete by July 2008. In this testimony, GAO discusses its recent reporting on VA's realignment effort and its management of other IT programs and initiatives, including ongoing systems development efforts and work to share electronic health information with the Department of Defense (DOD). To prepare this testimony, GAO reviewed its past work in these areas. VA has made progress in moving to a centralized management structure for IT; however, at the time of GAO's review in May 2007, the department had still to address certain critical success factors for transformation, and it had not yet institutionalized key IT management processes. VA's plans for realigning the management of its IT program include elements of several of the six factors that GAO identified as critical for the department's implementation of a centralized management structure, and it had fully addressed one factor--ensuring commitment from top leadership--having obtained the Secretary's approval of the realignment and the new IT governance structure. However, as of May 2007, the department did not plan to address one of the critical success factors: dedicating an implementation team to manage change. Having such a team is important, since the implementation of the realignment is expected to continue until July 2008. Without a dedicated team, it is less likely that the implementation will be managed effectively. In addition, although the department had begun to take action to establish improved management processes--a cornerstone of the realignment--it had not made significant progress. As of May 2007, it had begun pilot testing 2 of 36 planned new processes. Until it institutionalizes key processes throughout the department, the full benefits of the realignment may not be realized. At the same time that it is implementing the realignment, VA is managing ongoing IT programs such as information security and inventory control, and it is continuing initiatives to develop IT systems. The department is managing these programs and initiatives using existing management processes, many of which display the long-standing weaknesses that VA aims to alleviate through its realignment. Some progress has been made: for example, the department took actions to improve controls over IT equipment, such as issuing several new policies to establish guidance and controls for information security, but because the realignment was not yet fully implemented, improved processes for inventory control had not been established. In addition, progress on the development of a modernized compensation and benefits system occurred after the project implemented improved management processes, which the department now plans to apply to all its IT projects. VA also achieved a milestone in the long-term effort to share electronic health information with DOD, having begun to exchange limited medical data with DOD (at selected sites) through an interface between the data repositories for the modern health information systems that each department is developing. To achieve their long-term vision, VA and DOD have much work still to do (such as extending the current capability throughout both departments), and the two departments have not yet projected a final completion date for the whole initiative. Further progress in VA's IT programs and initiatives could be significantly aided by the improved processes that are the cornerstone of the realignment. Until these are fully implemented, the impact of the realignment on these programs and initiatives is uncertain